feat(worker): Gate P4 backend convergence and adapter replacement

[kapustazh]

Summary

Gate P4: Backend Convergence and Simulator Replacement.
Wires real @oneshot/privy-adapter (ArcSettlementAdapter, PrivyAuthorizationAdapter) and @oneshot/reconciliation (RecoveryService) into apps/worker. Replaces mock settlement / authorization types and simulator recovery engine with production bridges:

• PostgresIntentLedger.completeSubmission: Supports atomic rowCount-checked CAS transitions for UNKNOWN -> COMMITTED and UNKNOWN -> FAILED_SAFE alongside SUBMITTING, failing closed on invalid states. Fixes no-op UNKNOWN -> UNKNOWN version calculation.
• IntentLedgerRecoveryCommandStore: Implements RecoveryCommandStorePort over IntentLedger with durable atomic deduplication via outbox_jobs unique constraint (job_key: 'recovery-event:<eventId>', status: 'DELIVERED'), expectedStateVersion CAS check, and fails closed on unconfirmed completion.
• PrivyArcEvidenceBridge: Derives verified proof envelopes strictly from real TransactionReceipt / ReceiptSource without synthetic fallback data (arc: null when unobserved), decodes Transfer logs to match exact binding, synchronizes submissionReference: 'sub-' + binding.businessIntentId across local and arc evidence, and refuses MARK_COMMITTED without authoritative Arc tx reference and block number.
• apps/worker/src/composition.ts: Exports createProductionRecoveryService and composes real settlement and authorization adapters.
• Zero external submissions by construction: reconcile_intent executes through RecoveryService with externalSubmissionCount: 0 and settlementPermission: 'NEVER'. Logs actual updated post-reconciliation ledger state.
• apps/worker/tsconfig.json & tsconfig.json: Added missing project references to @oneshot/arc-adapter, @oneshot/privy-adapter, and @oneshot/reconciliation to preserve clean build topological ordering.

Scope and acceptance criteria

• The change is limited to the stated milestone or issue.
• Acceptance criteria are listed and satisfied.
  • P4.1: Backend convergence (real adapters + RecoveryService, createProductionRecoveryService exported) - PASS
  • P4.2: Evidence & persistence bridges (UNKNOWN CAS transitions; durable atomic dedup; PrivyArcEvidenceBridge from real receipts) - PASS
  • P4.3: Task wiring & zero-submission invariant (reconcile_intent via RecoveryService, zero external submissions) - PASS
  • P4.4: docs/GATE_P4_CHECKLIST.md updated for steps 1-3 and backend convergence - PASS
• No unrelated cleanup is included.

Product and security invariants

• Tenant isolation remains fail-closed.
• Sponsor authorization, auditability, and daily caps remain enforced where applicable.
• Recipients cannot modify sponsor controls or access sponsor-only data.
• No secret, token, production identifier, or personal data is committed or pasted into review prompts.
• Any non-applicable invariant is explained below.

Invariant notes:

• Zero external submissions: reconcile_intent strictly resolves ambiguous or unobserved intents without blind submission retries (externalSubmissionCount: 0, settlementPermission: 'NEVER').
• Crash-safe deduplication: recordRecoveryEvent enforces idempotency atomically via PostgreSQL outbox_jobs table unique constraint (job_key: 'recovery-event:<eventId>').
• Fail-closed verification: completeSubmission checks CAS row count and fails closed (SUBMISSION_NOT_FOUND / INVALID_STATE) on stale retries.

Validation

Commands and results:

pnpm test: PASS (36 test files, 510 tests passed)
pnpm --filter @oneshot/worker test: PASS (3 files, 20 tests passed)
pnpm --filter @oneshot/reconciliation test: PASS (4 files, 66 tests passed)
pnpm --filter @oneshot/storage-postgres test: PASS (2 tests passed)
pnpm lint: PASS (0 errors, 0 warnings)
pnpm typecheck: PASS (tsc -b clean)
pnpm format:check: PASS (all files formatted)
pnpm validate:fixtures: PASS (9 fixtures validated)
markdownlint-cli2: PASS (89 files linted, 0 issues)
git write-tree: c81eac4bdb47673913e1f18e35ff6b86045560b8

Independent review evidence

Gate A — exact candidate tree before push

• Base commit SHA: 50d8e7b4ba9ff247464ff9b0b36c19227c4c538d

• Candidate tree SHA: c81eac4bdb47673913e1f18e35ff6b86045560b8

• Candidate commit SHA: 01ec3db99fcbbb5fdfff8ee05efcb3da11b7b9f3

• Reviewer tool: free-pi-cli

• Reviewer model: glm-5.3-flash

• Verdict: VERDICT: PASS

• Findings or residual risks:

  • Blocking findings: None.
  • Non-blocking notes:
    • Receipt log match in PrivyArcEvidenceBridge does not compare log.address against binding.tokenContract; foreign-token transfers rejected by deterministic core as hold.
    • transfer_log_index: 0 recorded on MARK_COMMITTED path; uniqueness safe via state CAS.
    • Default production recovery composition uses simulator MCP / advisor until Lane C01.

• The reviewed tree equals the committed tree.

Gate B — exact remote PR head

• Pull request URL/number: feat(worker): Gate P4 backend convergence and adapter replacement #30 (feat(worker): Gate P4 backend convergence and adapter replacement #30)

• Remote head commit SHA: 01ec3db99fcbbb5fdfff8ee05efcb3da11b7b9f3

• Remote head tree SHA: c81eac4bdb47673913e1f18e35ff6b86045560b8

• Reviewer tool: free-pi-cli

• Reviewer model: glm-5.3-flash

• Verdict: VERDICT: PASS

• Findings or residual risks:

  • Blocking findings: None.
  • Non-blocking notes:
    • Production profile builds RecoveryService only when recoveryBridgeOptions is provided; otherwise reconcile_intent silently no-ops (fail-safe).
    • Crashes between transition and recordRecoveryEvent can duplicate evidence observations on retry (state CAS guarantees at-most-once settlement).
    • Subgraph MCP / advisor defaults remain in default production recovery composition until Lane C01.

• Gate B reviewed the current remote head and matches Gate A's approved tree, or a fresh Gate A was run for the changed tree.

• Agent policy / repository-policy and all applicable CI checks pass.

Risk and rollback

• Residual risks:
  • Live Docker/PostgreSQL integration tests require container runtime which is unavailable in local environment; covered by unit suites and deterministic mocks.
• Rollback or recovery plan:
  • Revert this PR; worker falls back to previous simulator-based composition.

Human merge

• A human owner has reviewed the evidence and will perform the merge.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	oneshot	01ec3db	Sep 08 2026, 01:03 AM