Persist resumable delivery-plan DAGs and split state

[tom-sapletta-com]

Outcome

Materializes the inert subactor.compiled-work-plan/v1 DTO as a durable Planfile ticket DAG and resumes it after interrupted writes without allocating duplicate ticket IDs.

Material delivery

• closed Pydantic contracts for compiled candidates, checkpoints, splits and terminal receipts;
• atomic state replacement under .planfile/delivery-plans/<plan-id>.json plus recovery from exact candidate bindings when tickets landed before the state file;
• explicit parent/child split links and dependency rewiring in both state and Planfile tickets;
• deterministic ready/waiting/split/terminal resume frontier based only on structured state;
• immutable receipt/checkpoint dedupe, stale/conflict rejection and no command/executor/tool authority;
• packaged Draft 2020-12 JSON Schema and public contract documentation.

Verification

• pytest -q: 414 passed, 6 skipped
• ruff check planfile/delivery_plan.py planfile/delivery_plan_contracts.py tests/test_delivery_plan.py
• focused mypy reports no errors in the two new modules
• JSON Schema meta-validation passed
• wheel build passed and includes planfile/schemas/delivery-plan-state.schema.v1.json

Closes #46

[ifuri-validator-agent]

Deterministic Validator approval for exact head 292b382868c21ed52f0774f4a126dafcd893c4f2.

Ticket: ticket-046
Correlation ID: planfile-pr-49-ticket-046
Model: zai/glm-5.3
Reviewed diff chunks: 8
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 8 diff chunk(s). Chunk adds durable delivery-plan runtime: public contracts doc, CHANGELOG entry, module exports, facade methods, and the start of DeliveryPlanRepository with strict state validation. No security issues visible; tests pass per PR data. | Chunk 2 of 8 adds rigorous state validation for delivery plan state files: candidate binding checks, ticket binding uniqueness, checkpoint/receipt/split integrity with ref dedupe, status-invariant enforcement, parent/child/dependency referential integrity, and Kahn-style dependency cycle detection. Receipt map validates staleness and conflicts against the compiled plan. All failure paths use structured _fail error codes rather than exceptions with untrusted data. | Chunk 3/8 of the delivery plan module shows idempotent materialization with mutation locking, identity/candidate conflict detection, receipt dedupe and stale rejection, and checkpoint sequencing. Logic is consistent with the stated contracts; tests and CI pass. | Chunk 4 of 8 introduces record_split, resume, and closed Pydantic contracts for delivery plans. record_split performs stale/conflict checks, dependency rewiring, cycle checks, and ticket updates under a mutation lock. resume computes a deterministic frontier from persisted state. Contracts use strict validation, extra=forbid, frozen models, regex-validated identifiers, and path traversal guards (_SAFE_PATH, _BRANCH). No security issues, command execution, or secret access. No failing checks. | Chunk 5 of 8 contains Pydantic contract models (ticket candidates, compiled work plans, terminal receipts, checkpoints) with strict pattern validation, sorted/dedup normalization, cross-field invariants, digest/idempotency checks, and DAG dependency-order validation. Code is inert validation-only with no execution or secret access. | Chunk 6 of 8 contains Pydantic validators for DeliveryPlanSplitV1 and checkpoint evidence references, plus the delivery-plan-state JSON Schema. Validators enforce uniqueness, format constraints, sorted canonical ordering, and minimum split children, consistent with the JSON Schema definitions. Test results show all checks passing. | Final chunk contains the tail of the Draft 2020-12 JSON Schema, packaging of schemas/*. in pyproject.toml package-data, and a comprehensive new test suite covering atomic/idempotent materialization, recovery after state-file loss, terminal receipt requirement/dedupe, checkpoint and receipt resume behavior, fail-closed conflict handling, and split-state dependency rewiring. Tests are deterministic (UTC timestamps, fixed digests) and exercise error paths. CI checks pass. | Final diff chunk contains test coverage for delivery split recording, dependency rewiring, resume frontier behavior, and contract validation rejecting embedded tool/command authority. All reported checks pass (414 passed, 6 skipped; notify and ci-loop PASS). No issues in visible code.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.
Merge will be attempted after this approval when explicitly authorized.

Decision record (recomputable)

DECISION D-046-6864
TICKET ticket-046
HEAD_SHA 292b382868c21ed52f0774f4a126dafcd893c4f2
CORRELATION_ID planfile-pr-49-ticket-046
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["notify=PASS","ci-loop=PASS"]
INPUT required_checks = ["ci-loop","notify"]
INPUT required_checks_source = "protected registry (env/request)"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
INPUT superseded_checks = []
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "zai/glm-5.3"
ASSERT VERDICT_AUTHORITY != "ADVISORY"