feat(ops): add A06 release bundle

[kapustazh]

Summary

Adds the A06 release and operations bundle: safe PostgreSQL bootstrap/reset commands, seven deterministic settlement-invariant scenarios, worker exports for the scenario runner, operations runbook, and mainnet-readiness checklist. Arc mainnet remains disabled and unpinned.

Scope and acceptance criteria

• The change is limited to A06 release operations.
• Safe database bootstrap/migration and guarded demo reset are implemented.
• Seven required retry, concurrency, restart, lost-response, and failure scenarios are executable.
• Operational boundaries and mainnet readiness are documented.
• No unrelated cleanup is included.

Product and security invariants

• Tenant isolation remains fail-closed.
• Sponsor authorization, auditability, and daily caps remain enforced where applicable.
• Recipients cannot modify sponsor controls or access sponsor-only data.
• No secret, token, production identifier, or personal data is committed or pasted into review prompts.

Invariant notes: this milestone does not change sponsor or recipient authorization paths. It adds operational tooling and validates the core 1 business intent -> at most 1 committed settlement invariant. Mainnet submission remains disabled.

Validation

Commands and results:

pnpm check:generated: PASS
pnpm validate:fixtures: PASS (9 contract + 7 UI fixtures)
pnpm format:check: PASS
pnpm lint: PASS
pnpm typecheck: PASS
pnpm test: PASS (49 files, 605 tests)
pnpm scenarios:invariants: PASS (7/7, max one settlement)
markdownlint A06 docs/context: PASS
pnpm db:bootstrap without DB config: expected fail-closed missing-config guard
pnpm db:reset-demo without DB config: expected fail-closed missing-config guard

Independent review evidence

Gate A — exact candidate tree before push

• Base commit SHA: 36df8fa06b94a0c08e32fa729a41ef2f22b464dd

• Candidate tree SHA: 8c65cbd198f11efe1cd8bf172ac7aff89f59644b

• Candidate commit SHA: a3c8f752d02c6038a6bfd44d882eca4b63e65de4

• Reviewer tool: free-pi-cli

• Reviewer model: glm-5.3-flash

• Verdict: VERDICT: PASS

• Findings: no blockers. Non-blocking notes cover omitting computed schemaDigest in the throw message, absence of CLI exit-code automated test for success === false, and in-memory ledger scope for invariant scenarios. Blocker from initial Gate B (bootstrap-db.mjs ignoring BootstrapResult.success) verified fixed fail-closed.

• The reviewed tree equals the committed tree.

Gate B — exact remote PR head

• Reviewed HEAD commit SHA: a3c8f752d02c6038a6bfd44d882eca4b63e65de4

• Reviewed HEAD tree SHA: 8c65cbd198f11efe1cd8bf172ac7aff89f59644b

• Gate A tree SHA: 8c65cbd198f11efe1cd8bf172ac7aff89f59644b (exact match)

• Reviewer tool: free-pi-cli

• Reviewer model: glm-5.3-flash

• Verdict: VERDICT: PASS

• Findings: no blockers. Non-blocking notes cover restart scenario ledger simulation details, scenario in-memory scope, and schema digest omission in CLI error message.

• Summary: Independent inspection confirms tree identity equality (HEAD tree = Gate A candidate tree), draft PR targeting develop, and all four required checks green on the exact head. The A06 bundle delivers safe advisory-locked bootstrap with checksum fail-closed migration verification, guarded demo reset preserving schema_versions, seven deterministic invariant scenarios each asserting <= 1 settlement with UNKNOWN never blindly retried, worker exports, npm scripts, and operational runbook/mainnet-readiness docs. Arc mainnet remains unpinned and fail-closed. Ready for human review; agents must not merge.

• Gate B reviewed the current remote head and matches Gate A's approved tree.

• Repository policy and all applicable CI checks pass.

Risk and rollback

• Residual risk: the CLI scenario ledger is deterministic and in-memory; PostgreSQL durability and concurrency remain covered by the existing integration suites. Mainnet profile data remains intentionally unpinned.
• Rollback: revert the A06 commits. Database reset preserves schema_versions and refuses production/mainnet profiles unless explicitly forced.

Human merge

• A human owner has reviewed the evidence and will perform the merge.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	oneshot	a3c8f75	Sep 08 2026, 05:10 PM