ADR-054: 22.9 Review Workflow — Verified-Office Authority + Review Chain

ApprovedAction::covers — the store-side action re-check — was ADDED during the per-commit adversarial reviews (the plan’s proof types bound level at mint time only). U2 handlers MUST mint proofs for the TRUE action they perform.

authorize_system + EnforcementWitness moved from U1 to U4 (dead-code deny; no U1 consumer). The system CHECK token and the covers system arm shipped in U1 as planned; the interim is strictly tighter.

Anchor derivation became the typed TermsAppendKind parameter (Amendment vs Renewal{new_renewal_due}) rather than the plan’s prose "renewal appends write fresh dues" — the kind is explicit at every call site.

The legacy result_requires_completion CHECK was dropped as SUBSUMED: the NULL-guarded outcome-shape CHECKs (outcome IS NOT NULL AND …) imply it. (Its first draft leaked NULL outcomes through SQL three-valued logic — the constraint probes caught it; the subsumption argument holds only with the explicit NULL guards.)

complete_review gained the future-date guard (completions never post-date today) — a U3 BusinessClock seam alongside enqueue_reconcile_months.

The drain’s claim-first ordering + failed-pair re-enqueue and its infallible-report contract came from the commit-4 review (the drafted drain marked processed AFTER repair — a TOCTOU that could drop a concurrent mutation’s signal — and propagated bookkeeping errors into batch failure).

The mutation surface landed as FOUR B1-safe api modules (mutations / review_ops / review_completion / review_views), not the plan’s "two" — the 500-line route-module budget forced the further splits.

Completion replay honesty is TWO layers: the scalar fingerprint (date/outcome/actor/evidence/linkage demand-shape) plus an in-tx content comparison against the rows the prior completion LINKED — a replay carrying differing terms/transition content is a 409, never a silent 200 (per-commit review finding; generated resulting_* ids are deliberately not compared — a replay cannot know them).

The natural-window gate exempts honest replays (an open slot already at the requested due; any reschedule of an already-superseded slot) — idempotent no-ops must not start demanding regional office because today moved.

The caseworker assignment re-check runs IN-TX under FOR UPDATE on the ACTING worker’s identity (ADR-028 lifting — the same axis the authz engine evaluates), not the outer token’s roles.

The event payload actor key is created_by (not actor): craig-security’s user-attribution chains read created_by first, so audit rows attribute to the worker instead of system.

At the ruleset, reinstatement is fail-closed structurally: the supervisor transition allow row is TARGET-SCOPED to the four non-active statuses, so a request with missing/forged attrs can never fall into a wildcard allow (reviewer-found shape, pinned by L3 tests).

EnforcementWitness gates only the SCHEDULED legs. The witness is buildable solely from the enforcement knobs (both default off) and is the scheduler’s only path to a system proof, refused per-leg (ApprovalError::EnforcementLegDisabled). A MANUAL execute never holds one: its per-row proofs come from authorize_worker on the EXECUTOR’s own session (regional+ SweepExecute at run level — checked at the endpoint for error UX AND inside the engine, which never trusts callers — with the per-row county floors covered by the executor’s office, recorded truthfully). Automation never fabricates a human office; a human never hides behind system.

Enforcement DOES enqueue reconciliation — exactly the current month. The plan’s "sweep enforcement never queues anything" phrasing yields to the U1 as-built store primitive: a coverage-changing transition with business_date = business-today enqueues one current-month pair, so the #1068 drain voids a suspended month’s undisbursed row. No backdating occurs (the plan’s real intent); skipping the enqueue would leave paid coverage standing after suspension — money-wrong.

Preview and execute share ONE ruleset operation token (review_sweep, ruleset 1.2.0’s single supervisor row): the table is the realm axis; the office axis (regional SweepExecute) differentiates execute. The v1.1.0 deny-unknown pin repointed to a genuinely-unnamed token.

Run-state lifecycle as landed: observed (terminal for pure-observe runs) · previewed → executing → completed · failed (any post-insert run-fatal error stamps the row in-process; a HARD process death cannot — its stranded executing row is stamped failed, with a crash-naming error detail and zeroed counters, by the NEXT lease holder’s entry reap, #1538 — so operators can always tell a crash from an in-flight run) · expired (stamped in place when a stale preview is redeemed). Single-use = the run lease against CONCURRENT executes plus the FOR UPDATE CAS against replays; a wrong token neither burns the preview nor changes state, and only the token’s SHA-256 digest ever persists.

Leg predicates: leg 1 is STRICTLY past due + 30d grace (aligned with the report-only invariant); leg 2 is INCLUSIVE at exactly three months suspended. Candidate scans are keyset pages over agreements (the generator pattern) evaluated against the passed business as_of (#1092), re-verified in-tx per agreement before any write (drift skips, never forces).

The devstack "compose profile" became an overlay file (docker-compose.sweep-demo.yml, the scale.yml precedent) — compose profiles cannot vary env on an always-on service. The devstack/test posture keeps the scheduler OFF (recorded asymmetry: payments are additive + idempotent, sweep enforcement mutates status); knobs nest as CRAIG_FINANCIALSUBSIDY_REVIEW_SWEEP*.

Sweep telemetry: run/leg counters, both backlog gauges, a run-duration histogram, a last-success timestamp gauge, and a lease-skip counter (craig_common::metrics::subsidy_review_sweep); the completion event financial.subsidy_review_sweep_completed parses as a system action with no resource id, and enforcement transitions ride the EXISTING transitioned event with run_id + trigger_review_id (deliberately outside the audit id family — attribution stays on the agreement).

U2’s endpoints translate sessions to proofs per-operation and orchestrate completion linkage (interval/term creation + resulting_* in one transaction); pending → active is rejected at the endpoint (activation belongs to the #1069/#1070 eligibility flows).

U3 swaps the enumerated UTC seams (enqueue_reconcile_months, the completion future-date guard, validate_transition_date, the #1068 scheduler anchor and endpoint bound) to the jurisdiction BusinessClock.

U4 landed authorize_system/EnforcementWitness, the sweep engine
run-record writers + preview/execute surface + scheduler knobs (as-built above); the queue retry-cap remains #1098.

The ⁂ #1073 list carries the 22.9 best readings this ADR encodes (matrix minimums, reinstatement authority by head reason, the paper-never-amends rule, cycle lengths from completion date).

Three legs, not two: EnforcementLeg::PerDiemHandoff joins Suspend and Terminate — knob auto_per_diem_handoff (default OFF), system proofs bound to exactly the per_diem_begins termination shape (reason-disjoint from leg 2, so neither termination knob’s consent spends on the other). Handoff candidates take precedence: they are excluded from the leg-1/leg-2 sets unconditionally.

Execute handshake: the execute request carries per-leg acknowledged counts that must equal the preview’s pinned set sizes, else 409 sweep-preview-stale without burning the preview — a client that predates a leg (missing field = 0) can never execute candidates it never rendered. Checked after the token digest, before the CAS.

Completion event is best-effort after finalize: a staging failure WARNs and counts (subsidy_sweep_completion_stage_failures_total) — it never rewrites a finalized run’s committed counters to a defaulted failed row (the prior behavior, now classified as the defect it was).

The sweep’s observe posture writes ONE more documented surface: the leg-3 detection facts (subsidy_perdiem_handoffs — a knowledge ledger, not an agreement write).