Platform publishes ADR-0048 closure auth and guarded reservation contracts

Platform publishes service-auth v1.5.0 and credit-reservation-lock v3.4.0 referencing Revenue's settled onboarding-closure v1.0.0. ADR acceptance and Revenue's protocol-agreed event have cleared; Platform's existing commitment moves from conditional to working with those satisfied gates removed. No duplicate commitment is created.

Published selectors

The first two implement the settled Revenue route map. Delivery agreed through the ADR coordinator to the third selector and exact three-route binding: POST /api/v1/delivery/v1/onboarding-closures/operations requires cancel, GET that path plus /{operation_id} requires read, and POST that operation path plus /abort requires cancel and original initiating subject. Command kinds are cancel_hold and cancel_soft_hold. No general inspection route or scheduling authority is added. Delivery owns publication of its command/evidence schema and resource authorization.

All three policies use fixed production workload identity, canonical tenant/Organization reach, five-minute signed JWTs, audit and no-store behavior. Default workload scopes and operator policy remain unchanged. Abort requires the original command scope and subject; operation-ID knowledge and actor strings confer no authority. The new Delivery audience is additive and cannot authorize Revenue routes. Credit release retains the existing version-2 wire schema and administrative-void vocabulary; revision and reconciliation evidence live in exact reads.

Local evidence and remaining gates

Platform implementation is local in modules/service-auth/{schema,dto,workload,route}.ts, with adjacent workload and route tests. The complete Vitest suite passed 363 tests in 49 files; typecheck, guardrails and diff whitespace checks passed. Tests sign and verify real local RSA/JWT fixtures and cover exact scope/reach/TTL, caller confusion, preview/development, wrong audience, expired/future proof, separate denial audits and unchanged defaults. These are local issuer tests, not deployed workload proof or producer resource-authorization tests.

The coordinator reported a Revenue test-isolation incident and paused shared-local database rehearsal. Platform has made no database mutation for this work. The database-backed identity/geography portions of npm test remain unrun pending a verified isolated target; the commitment stays working. Producer wrong-person/resource, cross-operation read/abort, payment/provider and concurrency evidence remain owner work. No local test count establishes production readiness.

No runtime deployment, flag enablement, provider request or live obligation cancellation is authorized by this publication. Contract availability is distinct from deployed selector availability. Consumers can wire the published selectors; production activation remains gated by ADR-0048's full evidence requirements.

References

• Service-auth v1.5.0
• Credit-reservation-lock v3.4.0
• Revenue settled protocol
• Existing Platform commitment