GT-604 (Tracker half): open the ledger's front door, and let the Core deposit through it

[beyondnetPeru]

The Tracker half of GT-604 (P0) — "No surface writes evidence to the Tracker". Pairs with evolith_arch32#314, which makes the three Core surfaces deposit through it. Also adds T-055.

The gate

POST /api/v1/core-evaluation-transactions, bound to the CoreMachine scheme by name so dev-bypass cannot reach it. A new permission tracker:core-transaction:ingest is carried by the machine key without :read — depositing evidence is not permission to read the ledger. The tenant is derived from which key matched; a body carrying tenantId is rejected with 400, so a caller cannot deposit into someone else's ledger.

Idempotent on (tenant, correlationId), backed by a unique index — without it the idempotency rule is unenforceable under concurrency and two racing CI runs would count the same verdict twice. Engine stored verbatim, both owners in separate columns, status ingested rather than completed.

Evidence, including the negative half

Red first, real output:

Expected response.StatusCode to be OK {200}, but found MethodNotAllowed {405}.
Con error!  Con error: 7, Superado: 0, Total: 7

Then green. Plus CoreEvaluationIngestContractTests (T-038 drift guard), mutation-verified — removing Engine from the DTO yields Campos perdidos: $.rulesExecuted[0].engine, [1].engine, [2].engine — and CoreEvaluationIngestSchemaTests, red against an unmigrated database, green after.

These tests have no environment gates. Unlike the existing CoreEvaluationTransactionPersistenceLiveTests, they fail rather than skip when Postgres is missing or unmigrated. The integrating session confirmed that property by accident: run against a database migrated only to the previous branch, they went 8 red, correctly naming the missing index —

Índices presentes: PK_… | IX_…operation_id | IX_…tenant_id_status, but no such item was found

— and after dotnet ef database update, 12/12 green, with IX_core_evaluation_transactions_tenant_id_correlation_id verified present on the live database. A skip would have hidden that; a failure did not.

Full Tracker suite, Release, -warnaserror: 1033 + 14 passed, 0 failed, 0 warnings. The repo's own cross-language guard caught an omission — new DTO fields required updating tracker-web/src/api/types.ts in the same change.

RoboSoft robot (criterion 3)

robosoft/robots/core-evidence-ingest.robot.mjs scaffolds a failing fixture with a CODEOWNERS, sets two env vars, and runs the real CLI — it posts nothing itself. Against a live tracker-api: 18/18, rules=125, violations=93, owned=93/93, idempotency before=1 after=1. Negative half: with a key the Tracker does not recognise, no row appears and the robot fails at step 4.

Not added to the default CI robot list — it needs the Evolith CLI and a CoreMachine key that pipeline does not deploy, the same reason core-integration and runtime-approvals are excluded. It gets a dedicated local-test.sh robosoft-ingest target that fails loudly instead of skipping.

The declared GT-603 dependency: REFUTED

The row itself flagged it as an unconfirmed hypothesis. It does not hold:

1. GT-603's diff touches audit_entries only — zero files under Integration/CoreEvaluationTransaction.
2. core_evaluation_transactions writers emit no audit_entries row, so "ingest writes an audit row as a side effect" is false.
3. AuditActor is scoped to the Audit aggregate; GT-604's attribution comes from EvaluationResult.requester (Core, GT-586). No shared actor type is forked.
4. Proof by construction: this was built and fully verified off origin/develop without GT-603.
5. Merge check: git merge-tree clean; after merging, dotnet ef migrations has-pending-model-changes reports "No changes have been made to the model since the last migration", both migrations apply in sequence, merged suite 1044/1046 (the 2 failures are RepoRoot() returning null because the check worktree lived under /tmp).

It was a transcription error. The rows are independent.

T-055

Warranted and written, bilingual, registered in DECISIONS.md/.es.md and evolith.yaml → adrRegistry: the Core deposits, the Tracker owns the ledger. Bilingual parity green; validate-docs reports the same 111 pre-existing findings as bafebd4, all under docs/audit/, none in these files.

🤖 Generated with Claude Code