M3-23: atomically promote real-feature output ledger bundle

[zhouning]

Problem

M3-22 produced path-free ResourceVersion, Artifact, QualityResult and LineageEvent candidates for a real Chongqing feature slice, but deliberately left them outside GDA Control. Calling the existing single-record gateway methods sequentially would expose partial authority if a process failed between commits.

Goal

Promote the checked M3-22 output bundle into GDA Control as one exact-replay PostgreSQL transaction while preserving tenant isolation, append-only authority and the existing PlatformRun terminal-success gate.

Scope

• Require the checked M3-22 evidence and immutable source/output identities.
• Require pre-existing output authority Resource, source ResourceVersion, DefinitionVersion and accepted or reconciling PlatformRun.
• Append one output ResourceVersion, output Artifact, quality-evidence Artifact, passed QualityResult and source-to-output LineageEvent in foreign-key order under one gateway transaction.
• Reject missing authority, drifted prerequisites, conflicting identities and mixed partial state.
• Prove injected rollback, exact replay, FORCE RLS, least privilege, cross-tenant rejection and direct UPDATE/DELETE rejection on PostgreSQL 16.
• Keep the PlatformRun accepted and prove success finalization remains rejected.
• Emit sanitized evidence, ADR, Platform Truth/System-of-Record updates and required CI validation.

Non-Goals

• Recreating deleted M3-22 object-store material.
• Fabricating missing PolicyDecision or Approval Artifacts.
• Claiming independent quality-evidence provenance or PlatformRun success.
• Claiming staging or production ingestion, protected identity, durable catalog, production object storage or production readiness.
• Changing the earlier gateway-bound evidence chain.

Acceptance Criteria

• First promotion creates exactly 1 ResourceVersion, 2 Artifacts, 1 QualityResult and 1 LineageEvent.
• Exact replay creates no rows and returns the same content-bound bundle.
• Failure before QualityResult leaves every candidate count at zero.
• Missing output authority and partial pre-existing state fail closed.
• Cross-tenant read/direct insert and eight direct mutations are rejected.
• PlatformRun remains accepted at state version zero with one initial event.
• Existing terminal success finalization rejects the incomplete evidence.
• No source path, feature payload, BSM, WKB, credential or local database URL is committed.

Implementation

• Branch: feat/ar1-metadata-fabric-real-feature-ledger-promotion
• Promotion SHA: 404b6e4e5d8194f092bd83ef99cbf2d1d727015b926cd438a79eb0210f969a22
• Contract SHA: bd21c81925f66acdfecca5cabd78651f31deab4165da2ccd6900c4e5796e5735
• Evidence SHA: f6efea5000791dec1716a8354a8e39a8425b083ca4d409f4bcb61f0e7e03580d
• Required-platform tests: 888 passed
• PostgreSQL control-plane tests: 11 passed
• Stacked PR: feat: atomically promote real feature ledger bundle #43
• Commit: 1179284

Status

in_review

Execution Gate

allowed