M3-19: persist scheduler-triggered Metadata Fabric binding

[zhouning]

Problem

M3-18 proves that an authorized DolphinScheduler run can trigger OpenMetadata and Gravitino projection/read-back for a real Chongqing ResourceVersion, but the verified provider binding is not persisted in GDA Control. The PlatformRun remains reconciling, and no durable ledger entry connects the scheduler execution, provider apply authorization, provider evidence, and immutable ResourceVersion.

Runtime reconciliation also established a bounded drift condition: the retained OpenMetadata UUID/FQN/version/content/governance/snapshot still matches M3-18 evidence, while the Gravitino target backed by a local memory catalog is absent.

Goal

Persist the M3-18 provider binding through PlatformGateway as an immutable, tenant-scoped GDA Control fact. Permit only the exact missing Gravitino projection to be repaired under the existing content-bound metadata_fabric.apply authorization, then require a zero-mutation replay before binding commit. Keep terminal success, durable-catalog, and production-readiness claims fail closed.

Scope

• Validate the committed M3-18 evidence and its exact dependency fingerprints before any write.
• Reconstruct the exact real-data ResourceVersion, scheduler definition/run, provider apply plan, PolicyDecision, Approval, and provider read-back binding.
• Require the retained OpenMetadata UUID/FQN/version/content/governance/snapshot to match M3-18 before any provider mutation.
• When and only when OpenMetadata is exact and the Gravitino target is absent, recreate the exact Gravitino projection under the existing independent metadata_fabric.apply authorization.
• If the dedicated M3-18 memory catalog retained provider metadata but lost connector namespace state, require its catalog configuration to match exactly and its visible schema inventory to be empty before a provider-native forced catalog reset and recreation. Any non-empty or differently configured catalog blocks before reset.
• Require all repair mutations to be under gravitino.*, require zero OpenMetadata mutations, and require the immediate exact replay to be no_op with zero mutations.
• Commit the verified binding through PlatformGateway on a fresh PostgreSQL 16 database.
• Produce sanitized, content-bound local evidence and CI validation.
• Synchronize ADR, roadmap, System-of-Record, Platform Truth, and required CI.

Non-Goals

• Production deployment, OIDC/TLS, provider-wide minimum privilege, or production scheduler identity.
• Mutating retained OpenMetadata state or repairing any other partial/drifted provider condition.
• Claiming a durable Gravitino catalog; the repaired target remains a local memory catalog and durable_catalog_verified=false.
• Marking PlatformRun succeeded without Artifact, QualityResult, LineageEvent, and RunSuccessEvidence.
• Writing source Shapefiles, absolute local paths, or legacy catalog state.

Acceptance Criteria

• Committed M3-18 evidence validates against the current contract and exact dependency evidence fingerprints before database or provider writes.
• OpenMetadata exact identity/governance/snapshot verification occurs before any Gravitino repair; drift blocks with zero provider mutations.
• Missing OpenMetadata, a non-empty or configuration-drifted Gravitino catalog, any unexpected provider state, or any non-Gravitino repair mutation fails closed.
• The bounded repair records one or more gravitino.* mutations, records zero OpenMetadata mutations, recreates the M3-18 binding candidate, and the immediate exact replay is no_op/0 mutations.
• First PlatformGateway binding commit returns created=true; exact replay returns created=false; exactly one binding row exists.
• The stored binding matches the M3-18 OpenMetadata UUID/FQN, Gravitino identity/revision, ResourceVersion UUID, and Chongqing content SHA-256.
• Execution-plan, PolicyDecision, Approval, and provider evidence Artifacts are content-bound to the same tenant, Run, DefinitionVersion, ResourceVersion, and apply authorization.
• Authorization drift, provider evidence drift, missing artifacts, direct UPDATE/DELETE, and cross-tenant read/write attempts fail closed.
• PlatformRun remains reconciling; durable_catalog_verified=false; no production-ready, production-ingestion, or legacy-write claim becomes true.
• Checked evidence contains no source dataset path or secret and CI does not require local real-data files.
• Focused tests, fresh PostgreSQL rehearsal/validator, Platform Truth validation, Ruff, and the required platform test suite pass.

Dependencies/Blockers

• PR feat: execute active metadata projection through scheduler #32 / M3-18 committed evidence and provider read-back.
• Existing M3-3 binding ledger and PlatformGateway contract.
• Local Docker/PostgreSQL and the ready OpenMetadata/Gravitino workloads for runtime verification.

Status

in_review

Execution Gate

allowed