feat(lifecycle): add immutable artifact-deletion receipt foundation

[seonghobae]

Objective

Implement issue #263 Slice B as a bounded receipt-ledger foundation only. This Draft adds a standalone and file-backed RECEIPT_V1 state store for durable deletion intent and recovery evidence. It does not integrate HTTP deletion, artifact cleanup, scheduling, dependencies, or product status semantics; those remain in cleanup Slice C #279 and later product-status work.

Exact current stack

Exact current head is 2c15cfbf85de33aa7ed72cdeb2dc9f8c8fd77943 on immutable base branch stack/admin-endpoint-auth-v1 snapshot d57f1aa8153aa092607a147c9587c683f009ea06.

Fresh state:

• 6 commits and 14 changed files relative to the immutable snapshot;
• GitHub reports the Draft mergeable;
• no endpoint, controller, artifact-store, scheduler, workflow, dependency, packaging, version, or release change;
• the current parent fix(security): require signed tenant claims on admin endpoints #268 exact head is 3ba53ac843685e483fdd3f8f060ba61825b9a798;
• its null/blank lifecycle-event tenant isolation behavior was synchronized into this branch in test-first order without weakening the bounded ledger slice.

Test-first sequence

1. RED 7e0c8f3da1f6d5063b6172da2c40b5b5ce41eb32 defines deterministic receipt identity, replay, crash-tail, transition, failure, and coverage contracts.
2. GREEN 8448fdd98d4a6c58f4e5407fcfcce903785abaa8 adds the versioned store, configuration, ADR, changelog, and deterministic tests.
3. Replay hardening through f1062d1de28a2304ec9a8e51ee4c774322b7fa2b adds deterministic strict-replay coverage and the corresponding parser correction.
4. RED 1f4abb80fa18fe00f336dc0d7c656f90d5901ec7 proves null and blank scoped lifecycle-event tenants cannot read buyer-demo events.
5. GREEN 2c15cfbf85de33aa7ed72cdeb2dc9f8c8fd77943 makes that query fail closed while preserving explicit legacy demo behavior.

Receipt contract

Each immutable identity binds deletion request ID, tenant, permanently reserved conversion-job ID, exact artifact SHA-256, privacy-safe audit correlation, and request time. Exact duplicates are idempotent; same-job identity conflicts fail closed.

The monotonic lifecycle is:

DELETION_REQUESTED → METADATA_TOMBSTONED → ARTIFACT_CLEANUP_PENDING → ARTIFACT_CLEANUP_COMPLETED

with retry:

ARTIFACT_CLEANUP_PENDING → ARTIFACT_CLEANUP_FAILED → ARTIFACT_CLEANUP_PENDING.

Completion is terminal. Transition time cannot reverse. Failure evidence is restricted to controlled [a-z0-9_]{1,64} codes.

Durability and replay boundary

• strict UTF-8 RECEIPT_V1 records are bounded to 16 KiB;
• append uses a fixed LF commit delimiter and returns only after FileChannel.force(true);
• any non-empty unterminated final tail fails closed and is preserved;
• replay rejects malformed Base64URL, missing/blank identity, invalid timestamps/states/counts, immutable conflicts, non-monotonic time, illegal successors, unsafe failure details, and oversized records;
• attempt count and attempt time must coexist consistently and remain preserved across retry and completion;
• completed receipts remain retained for idempotency but are excluded from pending work.

Exact-head acceptance state

• fuzz run 31101994051 is currently in progress and is not passing until it completes successfully;
• zero inline review thread exists;
• no formal exact-current-head CodeRabbit/OpenCode/Noema/Strix review exists;
• CI, Security Scan, SAST, complete Maven/JaCoCo/Javadoc evidence, and counted independent write-authorized approval are absent for this stacked head and therefore not passing.

Keep this PR Draft. Parent order remains #270 → #268 → this receipt foundation → cleanup Slice C #279. After parent integration, reconcile onto protected main, confirm the effective diff and ancestry, and rerun every base-sensitive gate. Do not resolve #268's incomplete-cleanup finding from this foundation alone, weaken tests, infer approval from advisory status, bypass protections, or publish a release.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bceaa739-76b0-4ac8-817f-a6cd00f5891b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

@opencode-agent @cwl-noema-review Please independently review exact immutable receipt-foundation head 8448fdd98d4a6c58f4e5407fcfcce903785abaa8 against exact parent snapshot d57f1aa8153aa092607a147c9587c683f009ea06. Verify the bounded 11-file, two-commit Slice B: immutable receipt identity, legal/illegal state transitions, attempt evidence preservation, strict UTF-8 and 16 KiB bounds, fixed LF commit delimiter, FileChannel.force(true), torn-tail fail-closed replay, idempotent duplicates, same-job conflict rejection, completed-receipt retention, standalone/file-backed MSA contract, complete tests/Javadocs, and absence of endpoint, cleanup worker, scheduler, workflow, dependency, packaging, version, or release changes. Submit no approval or passing claim unless exact-head evidence and repository protections are satisfied.

[coderabbitai]

@seonghobae I will review PR #280 against the specified base and head commits. I will not approve it or claim a passing result without exact-head evidence and repository-protection verification.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Superseded by #282. Exact receipt implementation and test blobs are preserved, but #282 reconstructs RED 96a09662eed2449baece2b76e3bdd3d5c6800300 → GREEN 8c803dafd14c1b6e7cac80b39e5c5a9915fc1cbd directly on current immutable parent snapshot 3ba53ac843685e483fdd3f8f060ba61825b9a798. This keeps the same bounded 11-file Slice B while inheriting the valid fail-closed tenant lifecycle-event query. Closing this older-base Draft unmerged; predecessor checks/reviews remain stale.

[seonghobae]

Closing as superseded by clean-stack PR #282. #282 is based directly on the exact tenant-isolated parent snapshot 3ba53ac843685e483fdd3f8f060ba61825b9a798, preserves the same RECEIPT_V1 foundation, and now also carries the replay-coverage RED/GREEN hardening at exact head 3396c03a458294175006efd0c9cea35d6911d55c; exact-head fuzz run 31102838777 succeeded. This v1 PR has a stale immutable base and extra synchronization commits, so keeping it open would duplicate review and obscure stack order. No predecessor checks or reviews are transferred to #282.