[E-00105] Add authoritative PR-group execution ledger

[andrei-hasna]

Summary

• E-00105 implements acceptance scope todos-pr-group-ledger-v1 at repair-cycle-1 exact head a8cf8fa.
• The authoritative SQLite/PostgreSQL root, leaf-attempt, and append-only event ledger now has deterministic lineage, one active writer generation, terminal immutability, multiple leaves per repository root, exact idempotent replay, legal lifecycle transitions, bounded repair accounting, and cleanup authorization.
• Local and authenticated remote HTTP, OpenAPI, generated SDK, typed client, JSON contracts, CLI routing, SQLite, and PostgreSQL expose equivalent fail-closed authority with no shadow SQLite fallback.

Repair provenance

• original previous head: 6ddaa7a
• rejected pushed head: b4a0cd4
• repaired exact head: a8cf8fa
• repair cycle: 1 of 2
• writer generation: 5f4c3eab-982d-4bd8-b231-8b407fbc9db1
• attempt nonce: 2675a46d-ffb1-4d6d-8f5c-1b2e78031090
• repair run: bcc18831-8bd5-4482-bc83-d922d25a33bb
• child goal: e736934c-95c3-42d4-89ab-a62cf92da696

Review findings reconciled

• Global sequence-aware review authority prevents obsolete-head late approvals from restoring merge authorization.
• Migration-65 legacy IDs are adopted idempotently without foreign-key rewrites, duplicate authority, or null-to-concrete authority splitting.
• Exact admission and recovery replay resolve before terminal and writer-fencing guards while changed requests remain deterministic conflicts.
• New admissions require concrete PR/base identity; active writers require a 30-second stale lease before recovery.
• Conditional merge requires closed successful provider-CI proof bound to repository, PR, base, and head plus reviewer/merge-operator identity and run separation; merge outcome must use the conditional operator.
• SQLite migration 67 and PostgreSQL enforce strict lineage columns, globally unique receipt keys, and typed CI proof storage.
• Cancelled/failed cleanup remains fail closed; merged and NO-GO cleanup require exact bound terminal evidence.
• Bounded 100-attempt state projections omit evidence for omitted attempts and advertise incomplete receipt history rather than returning an unparseable projection.
• Remote mutation clients validate deterministic group, attempt, event, request-lineage, provider-run, and previous-attempt identities; incompatible envelopes map to REMOTE_API_INCOMPATIBLE.

Changed files in this follow-up

• migrations/0006_pr_group_ledger.sql
• src/cli/cloud-router.ts
• src/cli/pr-group-commands.test.ts
• src/db/migrations.ts
• src/db/schema.ts
• src/index.ts
• src/json-contracts.test.ts
• src/json-contracts.ts
• src/pr-groups/http-client.test.ts
• src/pr-groups/http-client.ts
• src/pr-groups/ledger.test.ts
• src/pr-groups/ledger.ts
• src/pr-groups/postgres.ts
• src/pr-groups/sqlite.ts
• src/pr-groups/types.ts
• src/sdk/index.ts
• src/sdk/v1.generated.ts
• src/server/openapi.ts
• src/server/pr-groups.test.ts
• src/server/v1.test.ts

Validation

• child three-finding red baseline: 20 pass / 3 fail; green: 23 pass / 0 fail
• later cumulative red baseline: 33 pass / 9 fail
• focused affected gate: 94 pass / 0 fail; 830 assertions
• full repository: 2667 pass / 18 skip / 0 fail across 201 files; 12518 assertions
• bun run typecheck: pass
• bun run build: pass
• bun install --frozen-lockfile: pass with no dependency changes
• bun run verify:release: clean-tree non-authoritative review pass, deterministic package/tree, isolated tarball install and CLI/MCP/server smoke, skipped_checks empty; nothing published
• generated SDK freshness: pass; SHA-256 d442313b7dc5f6cfa950e9ab6250b2fcda8560c71930336e26967b2ab0894575
• fresh SQLite integrity: migration 67, three ledger tables, strict four lineage columns, global receipt uniqueness, CI proof column, zero FK errors
• live isolated PostgreSQL: migration plus real adapter transactions passed with two groups, two attempts, nine events, global receipt replay rejection, strict schema and complete schema cleanup
• labeled adversarial self-review: P0/P1/P2 none unresolved; P3 none blocking
• frozen write set: exact 20 of 29 allowed files; diff check clean
• non-printing staged, exact-range, cumulative-range, and pre-push credential scans: pass
• commit trailer scan: no Co-Authored-By

Risk and rollback

• Provider CI is stored as a closed typed exact-head evidence envelope accepted by the authenticated ledger boundary; this change does not query a provider API or mutate provider state.
• Live PostgreSQL validation used one isolated local schema that was removed after success; no production database was touched.
• Rollback before merge is branch-only: reset feat/e-00105-pr-group-ledger to b4a0cd4. No deploy, publish, release, merge, package-version, lockfile, or production-data mutation occurred.

Landing state

• Do not merge automatically.
• Fresh exact-head provider CI must be terminal green at a8cf8fa.
• Coordinator-owned independent final exact-head reviews remain outside this child implementation handoff.