docs(milestone-15): specify durable readiness ledger and replay registry

ARCHITECTURE_DECISIONS.md

@@ -147,6 +147,14 @@ This ledger records repository-level decisions. Feature-level decisions should m
 - **Decision:** Keep all shared Milestone 14 contracts strict, versioned, storage-independent, and provider neutral in `@founderos/knowledge-schema`. `createProductionProviderReadinessEvaluator` and `createDisabledProductionProviderAdapterHarness` construct the only public readiness facades in `@founderos/knowledge-engine`; each captures one approved static Transport Policy authority at configuration time, returns a frozen object, and rejects per-request authority replacement. The evaluator reuses the exact durable Milestone 12 Delivery and Milestone 13 Invocation verifier, then enforces externally supplied Authorization Decision evidence before Adapter, Credential Reference, Capability, Transport, Rate, or Cost preparation. It does not implement authentication or an authorization-decision engine. Credential handling validates only a logical, fingerprinted reference; no resolver, secret bytes, environment value, authorization header, secret read, or secret storage enters the domain or application boundary. The expected signed Transport Policy comes from the captured deterministic provider-neutral authority keyed by the exact authorized Adapter ID, fingerprint, provider family, and policy version; its single synchronous lookup exposes no URL, client, network, credential, DNS, TLS, or socket operation and is invoked only after Authorization. The caller Policy must equal that authority. Only the Milestone 13 Invocation timeout is constrained by the Transport request timeout: Milestone 13 application-attempt retry and Milestone 14 transport retry are separate controls and are reconstructed independently in Request Plan verification. The Transport policy is HTTPS-only, hostname/port allowlisted, redirect-denying, certificate-validating, size bounded, and represented only by a deterministic verified plan; configured host classification replaces live DNS checks at this milestone. Rate/Capacity and Cost/Budget admission use explicit time, bounded caller-supplied simulation state, deterministic fixture pricing, and integer minor units. Readiness and harness inputs categorically reject Circuit reset during common synchronous capture, before durable authority or policy lookup; Circuit and Health derivation preserve disabled/quarantined containment, fail closed for disabled, open, unavailable, or quarantined state, and bound half-open activity to a dry-run probe. Redaction occurs before bounded deterministic in-memory Logs, Metrics, Traces, and public errors are emitted; no external observability sink exists. Observability readiness is verified before the byte-stable redacted Request Plan is built. Twelve fixed Response Mapping fixtures produce ephemeral, independently verified Milestone 13-compatible evidence without retaining raw provider material or writing the execution Ledger. The disabled harness exposes exactly 11 validation/simulation modes, including Health evaluation, and no execution method. Both public boundaries reject raw Knowledge, Query Results, hidden Context, endpoints, credentials, callbacks, clients, executable Provider payloads, enabled Adapter state, and prebuilt low-level readiness artifacts. The final Decision can be only `not-assessed`, `not-ready`, `ready-for-dry-run`, or `disabled-by-policy`; its complete nested authority is independently recomputed. The final gate is an explicit structural stop, and the production import closure contains no DNS, TLS, socket, HTTP, provider SDK, credential resolver, environment, randomness, or implicit-clock dependency.
 - **Consequences:** FounderOS can prove production-provider preparation controls and deterministic fixture mapping without creating a public bypass around `invokeGovernedReasoning`, resolving a credential, persisting readiness output, or making a network call. Every public Milestone 14 wrapper rejects hidden, symbolic, accessor-backed, inherited, non-enumerable, and custom-prototype capabilities before reading wrapper values or consulting durable/configuration authority. Gate 10 constructs a private bounded in-memory observability sink, appends the already-redacted bundle exactly once, requires an exact retained snapshot, and binds strict retention evidence into the final Decision before readiness can continue. Only after that Decision verifies does its evaluator issue the exact canonical Decision/evidence pair into a private four-entry `first-issued-fifo-v1` registry; identical issuance is idempotent without refreshing FIFO order. Decision verification requires the original retention evidence, an un-evicted entry from the same evaluator instance, and deterministic reconstruction without creating a sink or emitting again. A fresh evaluator or evicted pair fails closed. No caller can supply a sink or issuance registry, full harness readiness does not duplicate emission, and the issuance authority is neither durable nor cross-process. `ready-for-dry-run` is evidence for non-executing planning only and is not production readiness or permission for live traffic. A real Provider Adapter and its credential-resolution and outbound-transport infrastructure require a later reviewed milestone and new architecture decision. Also deferred are persistence, real provider pricing synchronization, streaming, tool/function calling, Agents, Hermes, MCP, multi-provider routing or failover, authentication and authorization systems, external observability, distributed rate/circuit/credential controls, autonomous planning, and UI.
 
+## ADR-0019: Persist verified provider-readiness evaluations without enabling provider execution
+
+- **Status:** Proposed
+- **Date:** 2026-08-01
+- **Context:** Milestone 14 can issue and verify one deterministic non-executing provider-readiness Decision only through the configured evaluator instance while the exact Decision/evidence pair remains in its private four-entry FIFO registry. That deliberate process-local limit proves issuance but cannot provide restart-safe audit authority or demonstrate reproducibility through a fresh evaluator. Moving next to credential resolution or outbound transport would collapse persistence, secret, network, and provider risk into one boundary before readiness evidence is durably trustworthy.
+- **Decision:** Specify strict, versioned, storage-independent durable readiness transaction, permanent global identity ownership, audit, commit-marker, replay-attempt, integrity, recovery, and derived-index contracts in `@founderos/knowledge-schema`. Specify `@founderos/knowledge-engine` as the owner of exact plain-data capture, Milestone 12 ledger verification, reuse of the sole Milestone 13 Delivery/Invocation authority resolver, approved Milestone 14 evaluation and same-instance registration verification, canonical package comparison, registration and replay orchestration, an engine-owned storage port, and a governed local file-backed adapter. The initialized empty ledger will have one explicit deterministic genesis complete-history commitment, zero-event head, and reserved `m15-genesis` marker; atomic installation of the byte-identical fixed marker will be its sole visibility boundary. Registration callers will request ownership, semantic-event, audit-entry, and marker IDs, and the first commit will globally own those coordinates together with its key, request, transaction, and Decision identities. Registration will atomically commit one exact verified Milestone 14 Decision, ordered gate trace, retained non-secret evidence, evaluator configuration projection, and complete Delivery/Invocation identity projection under permanent idempotency and expected-head control. An identical registration retry will repeat the governed resolver and evaluator sequence exactly once, prove exact ownership equality, and return the original without append. Replay after restart will always reconstruct at immutable `originalEvaluationTime` with a fresh approved evaluator and separately assess current admissibility at `replayEvaluatedAt`; a historical `matched` result may coexist with `authorization-expired`. A distinct replay submission records separate historical and current-admissibility evidence; append status exists only in the operation result. An exact replay retry verifies its permanently owned idempotency key and request, attempt, semantic-event, audit-entry, and marker IDs plus the complete original request fingerprint, then returns the original attempt without reassessment or append even when later events have advanced the current head. The sole ledger-head schema will bind exact latest audit-entry, semantic-event, and subject-transaction ID/fingerprint pairs; marker embedding, `readHead()`, and derived `HEAD` will use byte-identical head bytes. The canonical commit marker is computed last under the sole acyclic commitment table and archived immutably with its event. Atomic replacement of a byte-identical fixed current-marker copy is the sole authoritative visibility boundary; separate `HEAD` projections and indexes are derived and rebuildable. Integrity and recovery results will remain ephemeral, non-fingerprinted, and absent from every durable record and log. The first adapter will acquire its cooperative single-writer lock before staging and will use canonical JSON, SHA-256, no automatic stale-lock stealing, atomic same-filesystem publication, restart recovery, safe-path confinement, and fail-closed ambiguous-state handling.
+- **Consequences:** FounderOS will be able to audit and independently replay-verify non-executing readiness evaluations across restart without persisting Milestone 14 evaluator-local issuance state or weakening Delivery and Invocation authority. A durable transaction remains evidence only: it cannot refresh Authorization, resolve a credential, authorize live traffic, or bypass a future execution gate. Only Credential Reference IDs and fingerprints may persist. Raw Knowledge, Query Results, hidden Context, secrets, headers, endpoints, provider bodies, clients, callbacks, functions, and executable payloads remain prohibited. The local adapter will be single-machine, same-filesystem, cooperatively locked, and vulnerable to coordinated privileged rollback or directory replacement outside its documented checks; it will not provide distributed coordination or automatic abandoned-lock recovery. Real provider adapters, credential and secret access, HTTP/DNS/TLS/socket/proxy/SDK transport, response ingestion, streaming, tools/functions, Agents, Hermes, MCP, routing, failover, distributed persistence, external observability, UI, deployment, and production enablement remain separately deferred. This ADR remains Proposed until a separately authorized implementation is complete and independently reviewed.
+
 ## ADR template
 
 ```markdown

DOCUMENTATION_INDEX.md

@@ -216,6 +216,24 @@ Milestone 14 is implemented by provider-neutral readiness contracts in [`@founde
 - [Reasoning Authorization Enforcement Boundary Specification v1.0](./docs/milestones/milestone-14/FounderOS_Reasoning_Authorization_Enforcement_Boundary_Specification_v1.0.md)
 - [Secure Outbound Provider Transport Policy v1.0](./docs/milestones/milestone-14/FounderOS_Secure_Outbound_Provider_Transport_Policy_v1.0.md)
 
+### Milestone 15 — Durable Production-Provider Readiness Evaluation Ledger and Replay Verification Registry Foundation
+
+**Specified — not implemented.** Milestone 15 defines future durable registration and dual-time fresh-evaluator replay verification for the non-executing Milestone 14 readiness package. Historical reconstruction uses immutable original time; current admissibility uses explicit replay time. One deterministic genesis history/head/marker commitment authorizes the initialized empty ledger, and every later event preserves an immutable archived marker value. Atomic installation of the byte-identical fixed current-marker copy is the sole visibility boundary; the marker-embedded head and `readHead()` are byte-identical, while separate `HEAD` projections and indexes remain derived. Registration callers explicitly request every original-event ID, and integrity/recovery results remain ephemeral. It does not implement runtime contracts, persistence, credential resolution, provider transport, a real provider, or live-execution authority.
+
+- [Milestone 15 Package README v1.0](./docs/milestones/milestone-15/FounderOS_Milestone_15_Package_README_v1.0.md)
+- [Durable Production-Provider Readiness Evaluation Ledger and Replay Verification Registry Foundation Specification v1.0](./docs/milestones/milestone-15/FounderOS_Milestone_15_Durable_Production_Provider_Readiness_Evaluation_Ledger_and_Replay_Verification_Registry_Foundation_Specification_v1.0.md)
+- [Milestone 15 Architecture Specification v1.0](./docs/milestones/milestone-15/FounderOS_Milestone_15_Architecture_Specification_v1.0.md)
+- [Durable Readiness Evaluation Transaction Contract v1.0](./docs/milestones/milestone-15/FounderOS_Durable_Readiness_Evaluation_Transaction_Contract_v1.0.md)
+- [Readiness Evaluation Registration and Idempotency Contract v1.0](./docs/milestones/milestone-15/FounderOS_Readiness_Evaluation_Registration_and_Idempotency_Contract_v1.0.md)
+- [Durable Readiness Evaluation Ledger Contract v1.0](./docs/milestones/milestone-15/FounderOS_Durable_Readiness_Evaluation_Ledger_Contract_v1.0.md)
+- [Readiness Replay Verification Registry Contract v1.0](./docs/milestones/milestone-15/FounderOS_Readiness_Replay_Verification_Registry_Contract_v1.0.md)
+- [Readiness Ledger Integrity and Recovery Specification v1.0](./docs/milestones/milestone-15/FounderOS_Readiness_Ledger_Integrity_and_Recovery_Specification_v1.0.md)
+- [Local File Readiness Ledger Adapter Specification v1.0](./docs/milestones/milestone-15/FounderOS_Local_File_Readiness_Ledger_Adapter_Specification_v1.0.md)
+- [Readiness Evidence Privacy and No-Execution Policy v1.0](./docs/milestones/milestone-15/FounderOS_Readiness_Evidence_Privacy_and_No_Execution_Policy_v1.0.md)
+- [Milestone 15 Acceptance Criteria v1.0](./docs/milestones/milestone-15/FounderOS_Milestone_15_Acceptance_Criteria_v1.0.md)
+- [Milestone 15 Verification Checklist v1.0](./docs/milestones/milestone-15/FounderOS_Milestone_15_Verification_Checklist_v1.0.md)
+- [Milestone 15 Codex Implementation Prompt v1.0](./docs/milestones/milestone-15/FounderOS_Milestone_15_Codex_Implementation_Prompt_v1.0.md)
+
 ## Repository governance
 
 - [Architecture decisions](./ARCHITECTURE_DECISIONS.md)