feat(schedule): expose audited terminal reason writes

[seonghobae]

Buyer outcome

Refs #287. This stacked Draft exposes the existing schedule reason-event domain and same-connection project-version persistence stack through the project schedule write API for explicit skipped and not_performed outcomes. Cancellation remains outside this bounded slice.

Exact current stack

• live parent feat(schedule): bind reason events to authoritative project versions #548: feat/schedule-reason-project-version-287@22883d1667891080bc5c9fdc2c5e721edb7833c7;
• exact contributor head: ae670764a54d451103e72c2453c74ff3f95c198f;
• exact contributor tree: 8fbd424cbc0a7cb06cc879fa0500c0abf5612529;
• current parent is the exact merge base; child is ahead-only by 22 commits and zero-behind;
• exact current-parent→child semantic diff is seven paths: package.json, server/app.mjs, server/app_core.mjs, tests/api/schedule-reason-collaboration.test.mjs, tests/api/schedule-reason-membership-revocation.test.mjs, tests/api/schedule-reason-route.test.mjs, and tests/unit/toast-accessibility.test.mjs;
• both current Devin review threads are resolved after executable repair evidence;
• no qualifying independent current-head APPROVED review exists; and
• do not integrate independently of feat(schedule): bind reason events to authoritative project versions #548/feat(schedule): persist terminal reason events atomically #519/feat(schedule): authorize and audit terminal reason events #518/feat(schedule): derive auditable schedule outcomes #517/feat(schedule): establish four-level work-item hierarchy domain #515.

Implemented route and collaboration contract

POST /api/projects/:id/schedule/reasons reuses the established session boundary, derives project context server-side, enforces project membership and write role, bounds the request body, requires the current project version, verifies one exact work-item identity in the project snapshot, permits only skipped and not_performed, persists the reason record and project-version transition on the same SQLite connection, and returns the committed reason identity without rewriting task JSON.

A successful reason write also publishes the ordinary project.update SSE/webhook signal after commit so connected collaborators do not retain stale concurrency state. The committed project version now receives a project_revisions snapshot inside the same reason-event SQLite savepoint. The snapshot retains the unchanged project plan, while project version, revision history identity, normalized reason event, and immutable audit evidence commit or roll back together.

Current TDD repair evidence

Two current-head review findings were verified against live behavior and repaired test-first rather than treated as informational blockers:

• Collaboration notification: RED 77cc6269d4b8fdc81c13482c3d6c42c4d73740c9 proved that a committed reason version was not broadcast. The repair exports and invokes publishProjectUpdate only after the reason transaction commits; predecessor GREEN Server Tests 33031946425 proved SSE and project.update webhook delivery.
• Revision continuity: RED 7d2c3ed7ffe8e3a236e9cd7e119a6bace1aae148 added a real API regression requiring committed reason version 3 to remain fetchable through /api/projects/:id/revisions/3. Server Tests 33034442401, unit/API job 98393973898, failed exactly with 404 !== 200. GREEN ae670764a54d451103e72c2453c74ff3f95c198f inserts the unchanged snapshot only after the authoritative transition succeeds and inside the existing savepoint.

For current head ae670764a54d451103e72c2453c74ff3f95c198f:

• Server Tests 33034622472: terminal success; unit/API job 98394537504 includes schedule reason collaboration notification regression passed, and cloud-e2e is success;
• Dependency Review 33034622517: success;
• OSV Scanner 33034622845: success.

The current hosted PR Server Tests checkout is synthetic merge revision 41141601b87b6799cca991080b06eaf4ae847406 (ae670764... merged into parent 22883d166...), not the immutable contributor head. It is strong product/regression evidence but is not treated as exact-contributor-head merge authorization. ScopeWeave #523 owns the repository-native exact-head checkout/coverage control repair; ContextualWisdomLab/.github#1222 owns the organization-reusable SAST/Security exact-head control path.

Scope fence / merge gate

Keep this PR Draft until the prerequisite stack reaches protected develop. Then reconcile only this bounded semantic delta onto the fresh integrated base and regenerate every applicable exact-head CI, browser E2E, owned statement/branch/function/line coverage, docstring, CodeQL/SAST/security, dependency/supply-chain, package/provenance, recovery, review, and thread-resolution gate. Valid unresolved findings must remain zero and a qualifying independent current-head approval must exist before merge or auto-merge. Synthetic, predecessor, stale, author-only, model-only, pending, skipped-required, cancelled, absent, neutral-required, failed, or status-only evidence is non-authorizing.

Refs #287

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 2 potential issues.