Platform ADR-0053 local candidate and isolated proof complete with explicit activation gates

Assignment ADR-0053/platform/008, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc/local. Clean branch codex/adr0053-platform at 368e5b526c71b6e6f18124ec4026747a83d503d1, checkout C:/Users/jallr/.codex/worktrees/adr0053-platform/platform. Source implementation commit 1dfa6e7d6ed541e5f7702af905fa4f7919d57c34, based on released Platform/Render 3909dac plus accepted ADR-0052 candidate cherry-picks 4e384a4 and fe97906. Accepted ADR-0053 merge df75605d32c82f91785d3e788814c0b519f72c8b and contract head 8359420eb10fe558affcacbfa0e9a18961220d38 remain pinned.

Implements exactly six new singleton-scope policy rows behind independent default-off SERVICE_AUTH_SCHEDULING_RECOVERY_WORKLOAD_ENABLED, retaining the four older scheduling rows and existing closure/business policies. Adds the closed eight-field scheduling resource verdict with exact original association, retained merged lineage, coherent read-only snapshot, explicit served tenant/Organization mapping, authorization before lookup, uniform nondisclosure and 10000ms monotonic budget. Existing Person facts alias resolution is unchanged. Per-attempt scheduling proof callback receives SDK cache bypass, zero expiration buffer and a fresh UUID nonce; actual Vercel consumers must forward those fields. Platform has no installed Vercel OIDC SDK, so local adapter tests are not actual SDK/runtime evidence.

Full suite: 409 unit tests with one worker, 32 identity and three geography integration checks, typecheck, audit guardrails and whitespace checks pass. Initial default-parallel npm test had four load-related existing timeout/timer failures; all tests pass in the complete single-worker rerun and both integration commands pass against the isolated database. Issuer proof: 80 unique issued tokens, 28 denials and real audit failure that returns no token. Resource proof: 48 cases, 16 coherent concurrent snapshots and 41 fresh audited positive token issuances. Actual loopback HTTP proof: six cases. Real merge proof preserves three synthetic seeded journal/audit/event rows byte-for-byte and the original tenancy while mutable external mapping rekeys and legacy facts alias resolution stays unchanged. Business row-content hashes/counts are unchanged across read/denial and issuance proofs. Real RS256, production handler, Prisma and PostgreSQL are used; workload claims/keys, contacts and provenance seeds are synthetic, monotonic boundary clock is controlled. Privileged fixture database role is not serving-role grant proof.

Durable manifest docs/evidence/adr0053-platform-008/manifest.json SHA256 66be17986219b1b21e0ab29ceb3cde5578889068765f058af6028de3396cd29c contains reports, public JWKS/config and original-versus-final source hashes. Issuer fixture http://127.0.0.1:51194 PID22480 kid adr0053-local-68e032ff-061d-4b16-a999-b51a4068f2a7 remains unchanged. Separate resource fixture http://127.0.0.1:56978 PID13084 uses that same issuer/JWKS and isolated database platform_adr0053_f5aea1915dfc4ea4ab29671726cb544c on 127.0.0.1:55434, schema platform. No proof/bearer/private key is persisted. Early handoff hashes remain immutable; only launcher non-serve proof/report code and unused-by-issuer outbound helper differ at final source. Executed issuer policy/exchange/verifier/audit graph is unchanged. Existing shared and ADR-0052 listeners/databases/keys were not reset or rotated.

Production remains off. Required release gates include actual owner Vercel production custom-audience proof and deployed audit checks, signer custody/fixed public JWKS, serving SELECT-only role proof, owning-domain current-human compatibility adapters, common writer locks and original receipt/recovery/compensation/finalization evidence, and consumer migrations within the unchanged deadlines. Rollback disables new issuance/resource flags while retaining protected originals, immutable journals, fences and safe recovery; already-issued tokens may remain valid up to 300 seconds. ADR-0052 deadline 2026-10-17T00:42:57Z is not extended; ADR-0053 maximum 2026-10-17T03:32:35Z remains.

Existing current-human composite compatibility uses the supported Platform bootstrap plus operator-session app check, with actual named Organization membership and the same current user, before producer effects. Delivery's inspected old hold-create/atomic handlers have no installed enforcement and are not authenticated compatibility proof. No new Sales-to-Delivery mutation policy is granted. Separate owner disposition SHA256 e0808500eb8e1679da8df6a69436449ac9bf633fcc859536802439765fe4552d is prepared for root publication.

Soft-resolution assessment_revision has no accepted complete Identity source revision mapping. Identity's closed snapshot has no generation; tenancy/merge/Organization invalidating writers lack one complete ordered source clock. A local-only Delivery counter or newly hashed current verdict cannot silently satisfy every relevant source-fact advance. GET remains read-only. Positive retirement stays fail closed pending Delivery/Sales reviewed mapping or approved maintenance boundary, without inventing a remote lease or new authority. Separate boundary memo SHA256 997b6960a1fd24b553f34d81f2b0922860e155908f44acb67b3a7e6ef253f845 asks the exact owner review. Proposed ADR-0054 original-bind authority is separate and unimplemented here.

Live ledger was checked and shows the Platform006 conditional commitment with Accepted ADR gate cleared. A prepared source-copy update marks its local implementation commitment completed and removes that resolved conditional gate, while preserving all production activation gates. Root-publication plan pins old memo SHA256 e3dce862a301652b7c2b8c1e1c171700a12c79a5b8308fbd4c86321a83683a38 and updated copy SHA256 6f8f4f5d2fb29a180f5276ca842a8c1bacf40918341f0de8c97646c329fed42a. Root alone publishes source memos, updates the commitment, indexes and checks freshness. This participant edited no canonical coordination or foreign code and performed no deployment/activation.