Sales acknowledges the exact collected ADR-0052 architecture and contracts
Assignment ADR-0052/sales/005; participant 01a0ff07-d3d4-7553-bf28-5314810de63e, host local; coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc, host local. Sales approves the architecture and concrete contract package reviewed at exact Git commit c114a77d3319e8a36d3edd0e9043e4972b895cc7, coordination draft PR 3. Reviewed checkout C:/Users/jallr/Documents/Sguild/repos/platform/.tmp/adr0052-contract-review was clean and remained read-only. This is Sales' formal acknowledgment, not another owner's approval or evidence of implementation, issuance or runtime readiness.
Approved architecture and contract boundaries
Sales approves ADR-0052 with scheduling v2.0.0, workload/bind-settlement and compatibility/release sub-specs, service-auth v1.8.0, credit-reservation-lock v3.5.0 with strict bind-evidence, reservation-release-api v1.1.0, and compatible sales-ordering v2.9.0 with durable bind/financial recovery. Exact four-policy paths, caller/output subjects, tenant and singleton Organization reach are bounded and independent. Sales receives soft-create authority only; no inspection, bind, settlement, generic scheduling, cancellation, refund or Coaching authority is inferred. Current exact resource authorization precedes both effects and original receipt disclosure; possession of an old key is insufficient.
New Sales human admission requires both fresh trusted matching-user Platform verdicts, exact tenant/active Organization/enabled membership and role sales, owner or admin conjunctively with Sales app authorization. SuperAdmin alone and global role aggregation do not establish Organization permission. Immutable v2 admission and its ssh2:<admission UUID> key, protocol headers, original wire bytes/canonical identity/fingerprint and original actor persist before send. Recovery is service-owned after valid admission despite later initiating-human expiry, Organization switching or permission removal, subject to current service/resource/business authority. Every attempt obtains fresh audited authority without persisted credentials, with the honest residual issued-token validity bound of at most 300 seconds plus at most 30 seconds tolerance.
Permanent exact command/key/receipt/tombstone identity, changed-body/protocol conflict, strict version dispatch and separately appended original receipt evidence address Sales' replay concerns. Existing v1 readers/rows/keys/actors/receipts remain unchanged; there is no automatic legacy execution or receipt replay through these four policies, no invented admission upgrade and no fifth policy. Incomplete/evicted history remains non-executable quarantine. Historical receipt success neither proves present readiness nor permits replacement work around unresolved original obligations.
The cross-owner fenced bind protocol supplies race-safe canonical order/reservation/Lesson evidence and exact committed-or-permanent-noncommit settlement. Unknown send/response/issuer/provider/writeback outcome preserves protection and original identity. Sales-to-Revenue close request/status/success/error shapes remain unchanged; Revenue owns its new internal bind intent and stable provider/preparation attempts. Fresh-key/re-soft-hold guidance is restricted to definitive original resolution and separately admissible new work, never ambiguous recovery. Reservation admission, current authoritative reservation and intent CAS revisions remain distinct; legitimate incoming financial facts cannot strand exact settlement.
Successful Delivery bind atomically installs nonexpiring intent-owned continuation protection with its original receipt. Revenue atomically retains/transfers financial protection to that exact close; only protected original financial continuation and its durable stable provider attempt can collect. Genuine incoming payment/refund and operational facts remain recordable while contradictory progression waits or reconciles. Pending/awaiting evidence after lost bind response and unknown provider/writeback retain protection. Settled/abandoned are irreversible and require the specified no-future-executable-work predicates; terminal old intent never resumes collection. Abandonment cannot depend solely on a cancellation waiting for the same protection, and invoice issuance can resolve without awaiting future customer payment. These clauses preserve safety and an owner-controlled recovery path without another inspection route.
Delivery retirement reads fresh authenticated terminal evidence outside local transaction locks, then compares exact intent/resources/key/fingerprint/original ReceiptRef and local protection identity/generation under lock, CASes only that protection and records immutable retirement evidence. A stale generation, missing proof or current access denial cannot clear protection. Both domains use their common documented compatible-writer/row lock order and never hold transaction locks while awaiting the other. All invalidating writers, including related-resource mirrors, cron/inbox/admin/raw SQL and obsolete binaries, must obey enforceable producer serialization. Sales approves this exhaustive-by-effect contract obligation; an initial source inventory is not deployed coverage proof.
Compatibility, release and evidence limits
Sales approves the planned cutover attempt of at most four hours with explicit checkpoint and a maximum 14-calendar-day deprecation interval beginning at actual accepted scheduling v2 publication. This starts no maintenance. Failed gates retain safe pause/protection and require explicit extension/recovery; rollback preserves authenticated compatible writers, permanent identities, fences, tombstones and quarantine. Old insecure execution cannot return as rollback. Separately authorized held-resource compensation remains required before new close admission resumes; these four policies do not grant it. Existing ADR-0050 assignments, fixtures, immutable rejection/proof/head/generation/receipt semantics and original bytes remain separate.
All five Sales-authored annex/schema/example/validator/requirements files in the reviewed commit match the finalized Sales draft byte-for-byte. Reviewed assembled policy manifest, resource/receipt decision table, continuation/retirement protocol, Revenue evidence/ordering recovery, version changes and portable composed validation/CI integration. Reused the unchanged Sales evidence (44 positive/negative cases, four independent RFC3339 cases, nine shared digest vectors) with exact schema references and pinned format dependencies. The validator fails closed when date-time checking is absent; the earlier bare-Python format-assertion claim was corrected before this package. Coordinator reports combined Platform 188+8, Delivery 44 shape/11 semantic plus digests, Revenue 52, and corpus/registry/pointer checks passed at this package; those are reviewed coordinator-reported static results, not independently rerun or production proof. No duplicate suite was run without a changed concern.
Actual production workload proofs/exchanges, all four route guards and denial effects, full deployed writer/sender exclusion and lock order, provider/preparation/financial truth staging, bind/release/cancel/settlement/retirement races, crash recovery, compensation, cutover and rollback remain implementation/activation gates. This formal architecture/contract approval does not certify those gates or start runtime work. Removal of proposal-only publication labels and normal acceptance metadata is a mechanical publication step; any substantive contract/protocol change requires renewed affected-owner review.
Live ADR-scoped inbox/ledger discovery found no implementation commitment completed by this review. This acknowledgment is prepared only in the permitted Sales coordination clone. Coordinator is sole publisher and retains indexer/freshness checks for the accepted collected batch. No root-checkout edit, application implementation, token issuance, database/listener/fixture mutation, deployment or live pause occurred.