feat(schedule): authorize and audit terminal reason events

[seonghobae]

Buyer and governance impact

Refs #287. This bounded stacked slice adds the authorization and immutable audit contract required before skipped, cancelled, or not_performed can become trusted schedule facts. It prevents silent inference, stale authority, self-approved cancellation, and unaudited mutation while remaining framework and database neutral.

Exact current stack and scope

Current parent: feat/schedule-outcome-domain-287@918e1a5194bea1ac817bdad2394adda1fdd51478 (#517).
Current contributor head: cf7412e8b98dfd2ff6e76ddd232470b79f1a5b5b.

The child is an ahead-only descendant of the exact parent. The live parent-to-child diff is limited to four authorization/evidence files:

• CHANGELOG.md;
• docs/doctoring/schedule-reason-event-authorization.md;
• package.json;
• server/schedule_reason_event_domain.mjs and its focused unit/coverage contract registration as represented by the current PR file set.

The branch was reconciled non-destructively with the current outcome parent and preserves protected contextual-orchestrator registrations. No editor, API route, database schema, attachment, Clearfolio, billing, dependency, lockfile, workflow, deployment, or protected-branch artifact is changed.

Authorization and audit contract

• supports only explicit terminal reason kinds: skipped, cancelled, and not_performed;
• requires exact resource/work-item identity, actor identity, reason code/text, and expected resource version;
• returns one immutable authorized event and one immutable audit receipt;
• requires cancellation approval from a distinct verified approver and rejects self-approval or missing/invalid approval;
• binds approval and authorization to the exact resource version so stale authority cannot be replayed after intervening work-item mutation;
• rejects non-cancellation approval confusion;
• requires persistence to atomically advance the exact expected version and return the exact event/audit identity;
• keeps authorization, persistence, and audit ports explicit so Hono/SQLite/PostgreSQL adapters cannot silently become policy authority;
• collapses malformed, unsupported, stale, or unauthorized requests into stable bounded failures without leaking tenant existence.

TDD and verification discipline

The contract regressions preceded production implementation and cover valid skipped/not-performed events, independent cancellation approval, stale version, self-approval, wrong reason type, malformed inputs, audit identity, port failures, immutable outputs, and exact version-bound persistence handoff. The branch was later reconciled to the parent’s current tree without dropping hierarchy or outcome behavior.

On unchanged head cf7412e8..., repository-native Server Tests, Dependency Review, and OSV Scanner are terminal success. The stacked feature base yields six check records, all terminal-success except skipped manifest bookkeeping; no failed, queued, or in-progress check is present. There are no submitted reviews or review threads on the exact current head. Absence of protected-develop workflows on this stacked base is not promoted to evidence for those gates.

The PR is Ready for independent review so the stack can progress, but it must not integrate independently of #517 and #515. Workflow/model/status evidence is not qualifying approval.

Standards and integration boundary

docs/doctoring/schedule-reason-event-authorization.md distinguishes active-PR design from protected shipped truth and records the threat model, decision, immutable event/audit contract, approval/version semantics, rollback, and APA 7 references. The product contract supports CSAP/SOC 2 evidence readiness but does not claim certification.

This PR does not close #287. Durable SQLite/PostgreSQL adapters, authenticated route/UI integration, version-store wiring, variance/forecast computation, and buyer decision views remain separate bounded work. PR #519 is the current persistence child and must remain reconciled to this exact parent.

Merge gate

Do not integrate before #517 and #515. After the prerequisite stack reaches protected develop, reconcile this exact bounded semantic diff onto the resulting live head and rerun every then-applicable CI, browser E2E, coverage/docstring, SAST, security, dependency, supply-chain, package/provenance, resolved-thread, and qualifying independent-approval gate. No predecessor-head, author-only, skipped, neutral, status-only, synthetic, or model-only evidence transfers.

Refs #287

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0f723e12-00e3-4819-acb4-bbe9052425f8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.