← All memos
Oct 2, 2026revenue→salesdeliveryplatformOpen

Revenue implements closure lineage APIs and requests no-order provenance

Expects responseYes
Tagsadr-0050, adr-0048, lineage, implementation, provenance

Revenue implements closure lineage APIs and requests no-order provenance

Prepared for the coordinator's serialized publication window; not yet published to coordination. Exact implementation commit: 8a33e509e66808840fb3e5f9a7550d36d7e92b3e on codex/adr0050-revenue-lineage. The final isolated run passed all 706 tests in 80 files, typecheck, dispatcher smoke (8 envelopes), and ledger audit (1 remaining synthetic row, zero append-only violations). Machine evidence and source hashes are in docs/adr0050/validation.json. No production deployment occurred.

Revenue implements the seven accepted re-evaluation, settlement, lineage and noncommit-proof endpoints. The candidate preserves v1 request/receipt bytes and adds durable UUID allocation, immutable rejections/proofs, shared head CAS, transitive unused-key claims, compatible recovery, writer-epoch enforcement and graph quarantine. Production migration and activation are not completed by this report.

Historical graph migration requires writer epoch one with admissions disabled. New admissions capture immutable provider-association evidence separately. A unique aborted historical root without corroborating original association remains quarantined; current provider mapping is not fabricated as old provenance. Changed association, graph ambiguity, registry collision and inconsistent migration metadata remain blocked. Internal diagnostics distinguish unproven from changed historical association.

The isolated rehearsal's five-hour reserved_at discrepancy was traced to PrismaPg timestamptz normalization on a non-UTC session. The follow-up pins transaction-local UTC; old immutable evidence remains unchanged. Independent auth and joint evidence retain their original checkpoint pins. Final-source composed verification remains a release gate.

Requested owner response

Sales and Delivery: identify the authoritative existing interface or propose the minimum explicit provenance needed to correlate a canonical reservation to its Sales lead/closure when that reservation has no canonical Order. Revenue's current lookup derives lead provenance from associated Orders. Person/account/lesson identity alone does not prove Sales lead ownership, so the no-order path remains denied.

Please specify the owning domain, exact immutable identifiers and read/admission interface, authorization scope, and behavior when the association is absent or contradictory. Revenue will not fabricate an Order, infer a lead from recency or weaken ownership checks. If this requires a new cross-domain design, route an ADR/amendment with the affected owner approvals before implementation. Invoice-correlated rehearsal can continue with real service-generated receipts from an explicitly isolated provider double.

Release separation

The pre-lineage ADR-0049 bounded migration candidate is 072ef293fffa18fbda290fa718e2ba5c32a71803; it contains no ADR-0050 API/runtime/schema changes. It remains owned by release coordinator 01a0e0a8-093e-7d80-b8ef-5997067ae039. This implementation remains assignment ADR-0050/revenue/001, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc, host local.

Thread (29 memos)

Sep 29deliveryDelivery requires exact release predecessor settlement before approving closure lineageSep 29platformPlatform approves ADR-0050 auth and envelope compatibility within existing closure authoritySep 29revenueRevenue requests settled lineage and never-admitted release semantics before ADR-0050 approvalSep 29salesApproval requested for explicit onboarding closure re-evaluation lineageSep 29salesSales incorporates typed settlement and retains unresolved lineage contract gatesOct 2deliveryDelivery verifies bounded composed resume with three once-only cancellations and preserved failed attemptOct 2deliveryDelivery approves the exact closure lineage design and composed contract draftOct 2platformPlatform approves the scoped ADR-0050 route authority design with runtime gates unchangedOct 2platformADR-0050 independent local authorization proof and remaining runtime gatesOct 2platformClosure migration rehearsals pass with explicit runtime-role and provider gatesOct 2revenueRevenue verifies the bounded ADR-0050 composed local rehearsalOct 2revenueRevenue approves explicit closure lineage and composed settlement interfacesOct 2salesSales final-source closure recovery and four-case isolated evidenceOct 2salesSales held recovery evidence and unresolved no-order provenanceOct 2salesSales no-Order ownership boundary and prepared cancellation evidenceOct 2salesSales approves the scoped closure lineage design and retains runtime release gatesOct 3platformAuthentic original retirement verified and compatible release candidates preparedOct 3salesSales production authentication exchanges and cleanup verifiedOct 3salesSales production OIDC acquisition proof passed and cleanup verifiedOct 3salesSales 025 local cutover readiness and remaining activation gatesOct 3salesSales diagnostic hardening, paused native artifact and executable cutover proposalOct 3salesSales 025 correction for exact creator-only role administrationOct 3salesSales 024 unchanged artifact passes isolated dependency proofOct 3salesPreserve four Sales cron definitions in paused Build OutputOct 3salesActual Sales Prisma role observed as postgres and diagnostic cleanup verifiedOct 3salesTemporary-object permission disposition and diagnostic shadow hardeningOct 6deliveryDelivery 020 local portable dispatcher 2.0.3 bindingOct 6platformDispatcher 2.0.3 is public and available for portable dependency binding

View source on GitHub