feat: add native subscription authority

[andrei-hasna]

Summary

• add an explicit @hasna/accounts/native-subscription package boundary for Infinity and AuthCapsule
• add closed signed online-generation and maintenance contracts with credential-free binding metadata
• add SERIALIZABLE, forced-RLS PostgreSQL ledgers for maintenance and ordinal-one capability consumption
• add checksummed package-owned capacity migrations and migration runner

Validation

• bun test src/native-subscription — 53 pass, 0 fail; repeated five times
• isolated bun test — 376 pass, 15 platform/PostgreSQL-gated skips, 0 fail
• bun run typecheck — pass
• bun run build — pass
• bun run test:compat — pass
• built subpath import/export smoke — pass
• staged shield review — clean
• whole-tree secret scan — no findings in changed files; baseline findings are confined to the pre-existing RDS public certificate bundle and two existing configuration files

Review focus

Please review closed-schema/signature canonicalization, credential-free boundaries, HELD/drain maintenance authority, SERIALIZABLE/RLS/advisory-lock CAS races, migration idempotency/rollback, and the additive package export.

Residual validation boundary

No live PostgreSQL or provider call was performed in this task. Existing PostgreSQL integration tests remain environment-gated.

Todos: e802534a-28a3-4750-af19-5f5e1889a341

[andrei-hasna]

P1 remediation pushed in 803983c.

Closed the independent-review findings across owner-scoped concurrency/replay, configuration-driven direct and SET ROLE runtime boundaries, migration catalog attestation and rollback/drift/RLS/immutability coverage, sensitive-field enforcement before canonical signing/persistence, and portable NodeNext declarations with a packed-consumer test.

Verification: 380 pass / 0 fail in the isolated full unit suite; 16 pass / 0 fail against PostgreSQL 17; typecheck, legacy compatibility, build, no-cloud scan, contract examples, vendor-kit, repo conformance, and packed consumer all pass. Staged gitleaks scan: no leaks. The PR remains draft and the Todos task remains in progress for review B and re-review.

[andrei-hasna]

Review-B P1 remediation pushed at exact head f61c564ef74ad8169b31d710ea97e445d6a8f6ea.

The native PostgreSQL 17 migrator now fails closed against a canonical live-catalog manifest even when schema_migrations remains intact. The manifest covers 242 ordered columns (type, nullability, default, identity/generated state, and collation), 188 PK/UNIQUE/CHECK/FK constraints (full definitions, key order, FK actions, validation/deferral), and 7 explicit indexes (method, uniqueness/readiness, full definition, ordered keys, and partial predicate).

Regression evidence:

• 383 unit tests passed, 25 environment-specific skips, 0 failures
• PostgreSQL 17 integration: 18/18 passed, including all 27 core CAS/maintenance constraint removals and altered collation/key/FK/check/index cases
• typecheck and compatibility typecheck passed
• build passed
• no-cloud scan, contract tests/conformance, vendor-kit, repo conformance passed
• packed tarball NodeNext consumer typecheck passed
• staged and origin/main..HEAD gitleaks scans passed

Adversarial self-review found and closed a collation-attestation omission before this commit. No open P0/P1 remains in the implementation self-review. PR remains draft and the owning task remains in progress pending two fresh post-fix reviewers; no merge, publish, release, or deployment was performed.

[andrei-hasna]

Review-D P1 remediation pushed at exact head 02ed6827ae0f7403fc547f3a241aa20f61737693.

Root cause: the legacy read ordered by applied_at, version, so rows inserted as [2,1] with identical timestamps were normalized to [1,2]; migration 3 SQL could run before a later failure.

The corrective contract adds schema migration v4 with a database-assigned GENERATED ALWAYS ledger_sequence, an append-only ledger trigger, finite-timestamp enforcement, sequence-first replay, and exact sequence owner/dependency/ACL attestation. Legacy ledgers remain compatible only when finite unique timestamps prove an exact prefix; duplicate/ambiguous timestamps fail with SCHEMA_CHECKSUM_MISMATCH before package SQL.

Verification:

• focused migration/manifest unit: 23/23 passed
• clean full suite: 392 passed, 26 environment-specific skips, 0 failed
• PostgreSQL 17 full integration: 19/19 passed, including exact [2,1] same-timestamp zero-unsafe-SQL regression, legacy-prefix upgrade, current replay, and concurrent migrators
• typecheck, legacy compatibility, build, no-cloud scan, SDK/contracts, contract examples, vendor-kit, repository conformance: passed
• packed tarball NodeNext consumer: passed
• staged and full origin/main..HEAD gitleaks scans: no leaks

Adversarial self-review found no P0/P1. PR remains draft and task remains in progress pending two fresh independent exact-head reviewers. No merge, publish, release, or deployment was performed.

[andrei-hasna]

Exact-head P1 ledger remediation pushed at d685d9f. Public validation now recomputes canonical request, lineage, operation, reservation, grant, and deterministic maintenance-use bindings; consume revalidates the stored grant and compares the complete receipt/grant binding before INSERT; timestamps at or before the Unix epoch fail before transaction open. Regression proof: focused 8/8 (106 assertions), clean full 397/0, PostgreSQL 17 live 22/22, typecheck/compat/build/packed NodeNext/no-cloud/contracts/conformance all pass, staged and origin/main..HEAD gitleaks clean. Adversarial self-review P0=0/P1=0; descriptor/schema/catalog/migration attestations unchanged. No merge, publish, release, or deploy.

[andrei-hasna]

Exact-head P1 implementation: c473f0b

Fix: signed-envelope canonicalization now permits a wire-valid 64-byte canonical base64url Ed25519 signature only at the exact top-level signature path for the exact known schema_version. Generic canonicalJson and every ordinary field retain the existing credential/secret scanner. Covered online-generation receipts, capability-use consume receipts, maintenance grants, Infinity HELD receipts, maintenance consume receipts, and PostgreSQL evidence validation/digests.

Regression matrix: sk-, sk_, rk-, rk_, pk-, pk_, token-, token_, secret-, secret_. Each forged wire-valid signature reaches cryptographic FORBIDDEN instead of scanner VALIDATION_FAILED; an ordinary issuer collision remains VALIDATION_FAILED.

Verification at this head:

• focused affected group: 52 pass, 0 fail
• prefix regressions: 50 consecutive repeated runs green
• clean full suite: 399 pass, 29 expected skips, 0 fail
• PostgreSQL 17: 22 pass, 0 fail
• typecheck + compatibility typecheck
• build + contracts conformance + vendor-kit + repo conformance + no-cloud scan
• pack dry-run + packed NodeNext consumer
• staged and origin/main..HEAD gitleaks: no leaks

Independent exact-head adversarial review is being coordinated separately; no merge, publish, or deploy performed.