feat(addie): add private smoke authority ledger

[bokelley]

Summary

Private authorization and PostgreSQL ledger contract only for Addie #6842. No provider adapter, route, job, cron, composition root, credential, issuer key, provider/API call, or runnable dispatch path is included.

• No-spend, default-off, non-promotable, and not runnable: FIXED_TRACE_COMPONENT_SMOKE_CURRENT_MODULE_CAN_DISPATCH remains permanently false.
• Production Ed25519 trust registry and the separately reviewed one-shot trust-root pin remain deliberately null. An injected root cannot mint a capability until a later review pins its digest.
• Ledger stores only irreversible digests/HMACs and bounded categorical accounting metadata; it retains no bearer grant, raw signature, nonce, prompt, output, provider error, payload, or credential.
• The exact SHA-256-bound 168-row plan is distinct from up to 192 ordinal-specific provider attempts: 126 provider-dispatch assignments, 21 local-terminal assignments, and 21 pre-dispatch-fault assignments.

Audit dispositions

• Authorization and lifetime: verifier-minted opaque authority only; test syntax verification/arbitrary roots cannot mint it; signature is digest-only; verifier and database cap TTL at 15 minutes.
• Reservation and plan integrity: every mutation locks and matches derived reservation ID plus authorization digest. A deferred exact-manifest digest binds every assignment field; plan rows are immutable apart from one monotonic outcome.
• Dispatch sequencing: new intents require consumed, no existing open intent, and for ordinal N>1 a succeeded immediate predecessor with tool_continuation_required. A final ordinal-1 generation response blocks ordinal 2.
• Terminal and cost accounting: exact returned identity is required for admitted actual cost; a mismatched identity becomes unknown/pricing-unavailable instead. Per-slot reservation, input including cache, output, timeout, and serialized cumulative ceilings apply. A known over-limit response preserves observed cost but does not claim an admitted actual cost.
• Continuation/ambiguity/denominator: continuation at the maximum ordinal is categorically settled as invalid_limits, halts dispatch, and can close as a provider failure. Unknown-exposure recovery locks either consumed or already-unknown authorization idempotently, then derives started/unclosed provider outcomes without invented evidence; untouched assignments close as zero-call not_executed_after_halt. Every 168 assignment has one outcome; only a fully completed consumed run becomes completed; halted/unknown remain permanently nondispatchable.
• Direct SQL: trigger checks prevent intents after halt/unknown/completion, terminal assignment re-entry, identity-mismatched succeeded or actual-cost rows, duplicate/open/skip ordinal attempts, state rollback, and mutation/deletion of immutable plan, intent, or authorization evidence.
• Recovery lock ordering: application/direct intent INSERT uses target plan → authorization; terminal UPDATE uses target attempt → authorization and never locks a plan. Every application plan-outcome writer takes ROW EXCLUSIVE before its target plan row; direct UPDATE has the same PostgreSQL table lock. Before recovery acquires any plan row it takes SHARE ROW EXCLUSIVE, serializing it against those writers, then locks the complete immutable plan set in assignment order → all existing attempts in deterministic order → authorization. Complete-plan locking is the insertion gate, so no intent can appear after its attempt snapshot. recordProviderIntent observes unresolved work before a target or under the authorization, commits that transaction, then invokes standalone recovery. Failed recovery returns persistence_uncertain, never a false durable-poison result.

Validation

• Rebased onto origin/main d44a71a553476480d08a0fff76e2a606b08997c4.
• Clean-environment focused unit tests: env -u DEV_USER_EMAIL -u DEV_USER_ID npx vitest run --config server/vitest.config.ts tests/unit/addie/fixed-trace-component-smoke-private-authorization.test.ts tests/unit/addie/fixed-trace-component-smoke-private-ledger-state.test.ts — 37 passed.
• npm run typecheck — passed.
• Fresh disposable UTF-8 PostgreSQL 16 database: all 582 migrations applied, then server/tests/integration/addie/fixed-trace-component-smoke-private-ledger-migration.test.ts — 33 passed. This includes blocker-controlled precheck-to-committed-intent-to-standalone-recovery interleaving, a forced recovery lock-timeout regression proving no false durable poison or later dispatch, a three-transaction full-plan recovery insertion-gate/phantom regression, reverse-order multi-outcome writer versus recovery coverage, and recovery-gate-first application-outcome coverage.
• git diff --check — passed.
• Exceptional recovery: normal pre-commit and a direct precommit:server-unit previously reached the repository fixed 600-second wall-clock timeout while still advancing in this VM. The normal hook is a timeout/failure, not a pass. The latest commit uses the authorized one-time HUSKY=0 timeout exception. Exact-head GitHub CI remains the full-suite gate.

Draft only pending exact-head GitHub CI, root inspection, and independent Sol re-review. No merge, ready-for-review transition, runtime activation, provider call, or spend.

[aao-secretariat]

Ladon verdict: Approve

Approve — additive, dormant private smoke authority ledger (#6842), no blocking or medium findings.

What I checked:

• High-risk flag context: high_risk is true but every reason is (added) — new files under server/src/addie/** and a new migration under server/src/db/migrations/**. New files matching high-risk globs are normal scaffolding and are not escalation-worthy on the flag alone (no (deleted) or (modified) entries, so rows 3 and 5 do not fire).
• Gated paths: gated_paths: false, so row 2 does not apply despite review_decision: REVIEW_REQUIRED.
• Migration 582: production-facing (runs on startup), occupies the next free slot; reviewer verified the expected_cost SQL reproduces the TS datedPricingCostMicros accounting for all four pricing profiles; plan/attempt/authorization rows are trigger-immutable and recovery is fail-closed (persistence_uncertain, never a false durable-poison).
• Reachability: module is dormant/unreachable (IS_CONSTRUCTED=false, no src importer, production trust registries hard-null and fail-closed).
• Protocol surface: touches no static/schemas/source/**, docs, or dist artifacts — no changeset required, no schema↔docs drift, no oneOf regression, no artifact-immutability concern.
• Author team gates: no no-auto-approve match.

One non-blocking follow-up noted by the reviewer (no lock/statement timeout on transaction() for a future live runtime) — dormant today, not a current medium finding.

No critical/high/medium findings → rows 1–8 do not fire → row 9 approve.