feat(research): add campaign family cumulative ledger with replayable receipts

[proerror77]

Change

Adds the Campaign authorization contract and a cumulative, replayable family ledger to the research control plane (alpha-domain, alpha-store). No live dispatch is wired to it; research code still does not import execution adapters or touch order, risk, or runtime paths.

Commits on this branch:

• 428f7416 feat(research): define signed Campaign root grants — alpha_domain::campaign_control: CampaignRootGrantV1 (family policy, execution binding with digest-pinned images, policy allowlist, generation ceiling, root budget, validity window), ed25519 signing/verification into a non-deserializable VerifiedCampaignRootGrant, CampaignAttemptReservationV1 with a stable operation_id, and CampaignAttemptSettlementV1 where consumed_trials: None means unknown, never zero.
• 61921633 feat(research): bind grants to declared feedback views — the root grant carries CampaignEvaluationViewsV1 (search/selection view hashes plus feedback visibility). v1 can only declare the shared search/learning-visible walk-forward view, labelled search_visible_validation; it cannot claim independent selection.
• 8598c5b7 fix(governance): append approval revocation evidence — migration 004 plus approval_revocations: revocation is an authenticated monday.approval_revocation.v1 record bound to the original approval hash; the approval row is never rewritten. get_approval is the effective view for all authorization consumers, identical replay is idempotent, conflicting or missing evidence after a recorded revocation fails closed.
• 7e938957 feat(research): add campaign family cumulative ledger with replayable receipts — migration 005 plus campaign_ledger: one authenticated head per family and an append-only, hash-linked chain of monday.campaign_ledger_receipt.v1 receipts for root registration (signed grant + approval bytes), attempt reservation, terminal settlement, and approval revocation. Reservations charge declared trials / Job seconds / LLM tokens against root and family ceilings before any external operation; a failed Job with unknown consumption keeps the full reservation charged; revoking a campaign_root approval appends the family receipt in the same DuckDB transaction as the revocation evidence. Receipts publish to create-once sequence keys and dispatch admission requires an independent readback acknowledgement for every earlier receipt. Family snapshots replay into a fresh store only under the original integrity key; publication acknowledgements are never inferred from a backup. Also promotes ed25519-dalek to a regular alpha-store dependency (replay re-verifies the historical grant key), boxes the large RootRegistered variant, and records the revocation receipt at revoked_at clamped to the chain tail instead of wall-clock time so replay is deterministic and a revocation is never rejected for ordering.
• 7d60e12e merge of origin/main (26c3da1e, post-fix(research): preserve Campaign checkpoints across interruptions #1100); no Rust conflicts.
• 5d2cd8e4 test(research): prove family budget survives reopen and root change.

Issue relationship

None

Validation

From rust_hft/ on head 5d2cd8e4:

• cargo fmt --check --package alpha-store --package alpha-domain — clean
• cargo test -p alpha-store --locked — 53 passed, 0 failed (8 new campaign_ledger::tests: chain linkage/ordering, unknown consumption stays charged and blocks over-budget retries, revocation + receipt roll back together when the head cannot be authenticated, scheduled revocation joins at registration and bounds Job deadlines, snapshot import under the original key only, dispatch admission requires readback of every prior receipt, idempotent retransmission / conflicting bytes / family-ceiling escalation rejected, budget survives reopen and root change)
• cargo test -p alpha-domain --locked — 84 passed, 0 failed
• cargo clippy -p alpha-store -p alpha-domain --locked --all-targets -- -D warnings — clean
• cargo check -p alpha-harness --locked --all-targets — clean (dependent app crate)
• git diff --check — clean

Runtime impact and rollback

None. Research/control-plane only: two additive DuckDB migrations (004_approval_revocations, 005_campaign_family_ledger) create new tables and never rewrite existing rows; no collector, runtime, execution, or risk path changes; no live dispatch consumes the ledger yet. Rollback is reverting the merge; existing approval rows and journal history remain readable.

Made with Cursor

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 26361367-8bac-4c4a-93a6-6d1de7b15c6d

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}