@lssm-tech/integration.work-durable-store
PostgreSQL implementation of the canonical Work Graph event, idempotency, projection, and transactional-outbox ports. It binds every instance to a tenant, stores immutable events, and ships forced-RLS migration SQL. Command commits do not update projections; an authorized outbox worker calls project after commit.
This is a managed-runtime integration, not a local-default substitute.
Durable command ports expose optional lookupCommitted so services can resolve an authorized retry before object-existence or revision validation. The PostgreSQL adapter fences the request identity and returns its persisted receipt, or an idempotency conflict for changed input. Managed hosts keep lookup, projection reads and commit in one outer authority transaction, so concurrent identical creates return one committed event. Other adapters must implement this receipt lookup to qualify equivalent retry behavior.
Work scope validation now includes tenant, organization and workspace on object reads, including both materialized projections and replay fallback. Mismatched projection identities fail closed. Mutation services validate the current object's identity/scope and replay receipts against the authorized actor and scope. PostgreSQL commits serialize by aggregate before revision checks and reject changing an existing aggregate's scope; projection upserts cannot replace a newer revision with an older worker result. These changes preserve existing wire contracts and require no schema migration. Tenant-only event/outbox worker ports remain trusted internal surfaces and must not be exposed as workspace-authorized reads.
Work object reads compare materialized projection revision with the committed event head in one SQL snapshot. A lagging or missing projection falls back to scoped event replay, so committed updates, archives and restores are visible without waiting for the outbox worker. Returned metadata carries the current aggregate revision, including lifecycle-only events. Reads do not mutate projections. Long aggregate histories still require performance qualification.
Work outbox lease validity uses the PostgreSQL clock. A caller availability cutoff cannot expire another worker’s active lease, and expired leases cannot acknowledge or release work even before replacement. Settlement checks expiry again in its conditional write. Hosts must still use distinct claim identities and authorize effects independently; this does not activate the OPA consumer.
Work outbox lease contract v2 requires deliveryAttempt on acknowledge/release, copied from the claimed record's deliveryAttempts. The dispatcher supplies it automatically. Matching a worker name and future expiry is insufficient: settlement also checks the exact persisted attempt. Old or missing attempt values fail closed. Update custom callers before upgrading; no database migration or stored-record reset is required.
Workspace revision fencing hashes every canonical Work aggregate head, including unplaced, completed and archived work. Work commits take a shared workspace advisory lock; proposal publication takes its exclusive counterpart and checks the complete digest before persistence. The interactive planner and internal background proposal publisher use this fence. Upgrade all Work writers before qualifying it; older writers that omit the shared lock are not covered. Calendar freshness and policy/approval checks remain independent.
