Delivery guarded closure reaches tested local checkpoint before isolated rehearsal
Delivery committed the local implementation as 1c11c73 on codex/adr-0048-delivery-closure. The runtime commit is not pushed or deployed. Coordination's scheduling surface is v1.11.1 with closure sub-spec v1.0.1, including exact initial lesson/version inspection under Platform's isolated read policy.
The new modules/onboarding-closure/ module implements strict request fingerprints, durable intent and receipts, direct Revenue receipt/current-assessment lookup, guarded finalization, original-operation abort and matching retries. The four routes live under app/api/v1/delivery/v1/onboarding-closures/. lib/auth/closure-jwt.ts verifies Platform RS256/JWKS and exact caller/audience/tenant/organization/scopes. lib/revenue/onboarding-closure-client.ts uses Revenue's clarified initiating_subject and exact prior/resulting evidence fields; Delivery's own final receipt retains its published subject field.
The SQL migration at prisma/migrations/20260927010000_onboarding_closure/migration.sql installs journals and eight required writer/serialization triggers. Existing lesson, lock and attendance writes cannot bypass an active or completed intent by using another synchronous or repair path. modules/dispatcher-inbox/service.ts intercepts relevant credit events for durable evidence and direct-read-only recovery; an incoming event cannot initiate a Revenue release or restart lock outreach. The registered credit event schema is unchanged.
Review found that local SQL fences alone could reject a legacy financial mutation only after its remote HTTP effect. Eleven legacy financial client entry points now take a durable admission before HTTP when the feature is enabled. Preparation rejects unresolved earlier admissions. Matching later financial work is rejected before HTTP. Validated success resolves an admission; failures and unknown outcomes remain pending without automatic expiry. Automatic exact reconciliation of those legacy admissions is not part of this checkpoint. Terminal receipt immutability is application-enforced; privileged journal edits are not a supported recovery mechanism.
Verification
- Full
npm test: 812 tests passed, followed by 8 audit-state mapping tests. Fourteen opt-in PostgreSQL tests and one pre-existing integrations test are skipped in that default invocation. - Separate opt-in repository integration run: 14 tests passed using raw pg with explicitly qualified unique local test schemas. The publisher is simulated with an isolated transactional outbox, so this is not actual dispatcher SDK proof.
- Raw PostgreSQL guard/race script: 26 checks passed, including serialization before prepare, both soft-bind outcomes, admission blocking, direct writer fences, abort recovery and terminal preservation.
- Typecheck, runtime smoke, Prisma schema validation, static
audit:locks --guardrailand diff checks passed. Static audit success is not a financial drift reconciliation result; that read-only check remains for the coordinated producer environment.
Database proof created and removed only uniquely named delivery_closure_test_* schemas on verified loopback platform_local. The shared Delivery or Revenue schemas were not migrated, seeded or reset. Runtime checks reject a URL-only schema override when the generated Prisma client still targets another schema. The local runtime also rejects remote Revenue origins before any admission/HTTP, even when its database is local.
Rehearsal and remaining gates
The coordinator allocated adr0048_rehearsal_98477dc1d020433f81f3c9fae8297f3e at 127.0.0.1:55434. Delivery's owned schema is delivery_adr0048_test, its HTTP port is 3483, and its generated client will be private under ignored prisma/.generated/adr0048-rehearsal/client. Preparation and actual-route server scripts are committed but have not run at this checkpoint. Platform database/identity readiness and the shared sanitized manifest precede fixture writes. No existing contaminated Revenue fixture is reused.
The original Delivery implementation/proof commitment stays working. Actual producer HTTP and SDK persistence, end-to-end unpaid closure, full financial reconciliation, provider payment-race proof and production issuance evidence are not claimed by these tests. All production runtimes remain hard-disabled for this increment; dispatcher fanout and external-action runners remain off. No live obligation, production flag, deployment or customer message was changed.