feat(bap): bind lifecycle receipts to idempotency keys

[seonghobae]

Buyer-visible boundary

This is the next bounded slice of #200, stacked on the independently resolved current head of #208:

• base BAP branch/head: feat/bap-task-lifecycle / 85cc477688246900697f4cfb91c0c8f1f692934a;
• protected main: 0841d2ab3d8b5e60a03c0a8e818cf438e2716829;
• exact current branch head: 40d642d5470a7753b8211907c190367f742f2f12.

The BAP lifecycle owns an immutable in-memory command receipt binding a bounded caller-supplied tenant namespace, idempotency key, task identifier, lifecycle event, and accepted transition. Exact replay requires exact retry metadata and exact equality with the lifecycle's most recently accepted transition. Ambiguous, stale, foreign, divergent-history, or state-only restored snapshots fail closed without a second lifecycle mutation.

This branch exposes storage-neutral typed seams needed to reconstruct both sides of that replay identity from persisted primitive fields: BapTaskTransition::restore(...) revalidates an accepted transition against the lifecycle state machine; BapTaskLifecycle::restore_with_transition(...) requires exact validated last-transition evidence for every non-created snapshot; and BapCommandReceipt::restore(...) revalidates bounded retry identifiers before reconstructing the immutable receipt. The persistence boundary remains responsible for integrity/authenticity of supplied evidence and for atomicity with any external side effect.

Test-first repair evidence

The receipt/recovery contract covers exact retry, metadata conflicts, foreign lifecycle reuse, stale reuse after lifecycle advancement, same-state/different-sequence reuse, divergent histories, identifier validation, Debug redaction, state-only recovery refusing replay, transition reconstruction, transition-backed lifecycle restoration, and persisted receipt reconstruction.

A commercial recovery defect was reproduced on this canonical branch: persisted transition/lifecycle state could be reconstructed through the public typed API, but a persisted BapCommandReceipt could not, so true cross-process replay was impossible. Test-only RED head 794e532dd70c1f03416b87016ec8f10d565ee6cc, CI run 32535286702, Rust-contracts job 96934913891, failed with the expected E0599 because BapCommandReceipt::restore(...) did not exist. Production repair df89f56a7976447da76214c7d8300633d600639d added the restore boundary while reusing fail-closed idempotency-key, tenant-ID, and task-ID validation. The regression was then strengthened for empty and over-limit retry-identity fields, and formatting-only follow-up evidence removed the final canonical rustfmt delta.

Subsequent stack reconstruction incorporated the current #208 dependency head while preserving this branch's unique idempotency/recovery work. Historical RED/repair evidence remains historical only and is not promoted to the reconstructed head.

Exact-current verification

On unchanged exact head 40d642d5470a7753b8211907c190367f742f2f12 against exact live base 85cc477688246900697f4cfb91c0c8f1f692934a:

• CI run 32656243461: success;
• Rust contracts job 97235334220: repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy, and rustdoc success;
• Production coverage job 97235334314: success, including exact production function/line/region/branch enforcement;
• exact coverage artifact exact-coverage-40d642d5470a7753b8211907c190367f742f2f12: artifact ID 9497531585, SHA-256 4c4cc40be8d110619fd8a9f04664f373106249722348da1117cecda4e61cd04c;
• fresh formal review inventory contains no review submissions;
• fresh inline review inventory contains no review threads; and
• exact-head workflow inventory exposes CI only. Same-head SAST, Security Scan, Manifest V3, Noema, and Strix results are absent and are not claimed.

GitHub reports the Draft open and mergeable. No predecessor-head check, scanner result, review, status, comment, synthetic merge, or model output transfers to this head or counts as independent approval.

Safety and truth boundary

This remains an in-memory lifecycle/idempotency primitive plus typed recovery-validation/reconstruction seams. It does not authenticate the caller or tenant, authorize an operation, persist receipts or transition evidence, authenticate persisted evidence, provide durable concurrent deduplication or locking, atomically couple receipt storage to browser/network side effects, or reconcile ambiguous external outcomes. A durable owner must persist receipt + exact transition evidence atomically at the appropriate production boundary, authenticate that evidence on restore, preserve policy/tenant/session authority, and reconcile uncertain side effects before commercial crash recovery can be claimed.

Keep this PR Draft while prerequisite #208 remains active. No workflow, secret, governance, release, tag, publish, approval, Ready-state, or merge mutation is included.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d9b401a6-1f1d-4216-96cb-8ab8664474ab

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}