Git causal bridge: staged Git projection, verifiable checkpoint journaling, and redb 4.2 sync (RFC §1–§22 + CB follow-ups)

[geekgonecrazy]

Git causal bridge (RFC-ATOMIC-GIT-CAUSAL-BRIDGE)

This branch implements the complete Git causal bridge on top of the current dev (bcbe2c5a, includes #198, #195, redb 4.2.0 + the pinned redb_2_6 shim). Merge-base is dev's tip; a squash or merge here lands cleanly.

What ships

RFC §1–§22 core (CB-1A → CB-10B)

• Shadow Git pipeline (CB-1/2/3): colocated projection of Atomic views onto Git refs with content-addressed change storage (V3 format, FastCDC chunking).
• Verifiable bridge checkpoint (CB-4/5B/5C): signed RFC §7.3 Anchors bound to the Ed25519 binding key, journaled Recorded preimage recovery, workspace-txn entry/exit protocols with remediation (Git-owned sequences, conflicted index, missing/stale checkpoints all fail closed with exact remediation reports).
• Hook observation (CB-9A/9B): post-checkout, reference-transaction, and pre-commit advisory dispatchers journal external Git transitions as immutable evidence (git-events.jsonl → captured events → commit-time capture bindings), with commit interpretation closures and capture-token bindings for prepared ref ops.
• Import path (CB-9A): plain-git commits import as foreign history, absorbed into the bridge's causal ledger.
• Bridge watch daemon (CB-13D R7): bounded external-transition watch, suppressible with attribution marker (.atomic/bridge/suppressed-operation.json).
• Diagnostics: atomic git bridge status/verify/reconcile/census, divergence notices, forensic status (read-only, no reconciliation).

CB follow-up cycle (::12–::25, all vault-attested)

• ::16-::23 — agent turn provenance hardening (review R1-R7): dirty-turn Git-transition classification (RFC §10.2), exact managed-commit capture (ManagedGitCommitCaptured), durable refusals for unexplained transitions, journal-backed multi-agent concurrent hooks (ordered ledgers without external serialization), owner-scoped provenance checkpoint state machine (reserve/append/bind/acknowledge across process crashes).
• ::24 — the full CB-13D follow-up: R1 (budgeted branch-only refresh, ephemeral-view-creation deferral, sandbox fencing), R2 (LockScanProof across 10 lock namespaces, fail-closed walkers), R3 (MetadataHint::verified_baseline), R4 (bounded Watchman probe + truthful Fallback + suppression attribution), R5 (crash-during-effect fixtures, linked-worktree equivalence), R6 (crashed-consumer claim replay exactly-once), R7/sweep (owner waiver recorded verbatim in vault).
• ::25 — RFC §22 documentation sweep, §19 policy snapshot, closure audit, label audit, cross-stream matrix suite (§22.5).

dev sync (this PR's merge commit)

• redb 2.6.3 → 4.2.0 with the in-place upgrade_legacy_database path (databases written by pre-4.2 binaries upgrade on open; both upgrade tests ported and green).
• Ours' CB-12A/13D semantics restored on top of dev's journal machinery:
  • Git-only turns still classify (RFC §10.2); clean-turn refusals persist durably; watch notices drain before the next tool call.
  • Journal commits fail closed when an owner sink is present; without one, no provenance is written (dev's contract) and the session JSON remains the crash-safe evidence.
  • Observation-only turns publish through the fast gate with completion events; idle duplicate Stops return early without minting turns; programmatic journal turns (tool hooks without a visible turn start) still activate and publish.
  • Bare sandbox pointers resolve canonical identity on read-only opens; provisioned sandboxes keep their own working-copy records.
  • status/diff/hooks wait for transient writers (typed DatabaseBusy retried inside the opener, 10s) instead of failing fast; terminal hooks acquire turn-publication.lock before the boundary guard so a killed Stop releases it by process death alone.
• Test-seam reconciliation: redb 4.2's graceful-shutdown marker is not a mutation signal (size-based pristine snapshots in cb0c/cb5c/doctor tests); scoped manifest + IDE JSON + git-JSON share one --json flag; empty drafts hide by default in view list (dev UX).

Verification

Suite	Result
atomic-core lib	3654 passed, 0 failed
atomic-repository (lib + integration)	1509 passed, 0 failed
atomic-agent (lib + integration + doc)	1369 + 27 passed, 0 failed
atomic-cli (all suites, --test-threads=1)	2409 passed, 0 failed

The full journal multi-agent suite (database_owner_integration_test, 23 tests) is green end-to-end: concurrent hooks commit lossless envelopes, killed Stops release the publication lock and retry, crashed owners resume exactly-once, and scoped concurrent Stops never record sibling files.

Vault / provenance

All work is intent-driven and attested in the Atomic vault (.vault/intents/): ::12 through ::25 are done with all criteria met; review ::3's canonical signed artifact survives as the AC-3 record per owner disposition (option b). Pushed to the Atomic storage remote (origin) and GitHub.

Ops notes

• Databases written by pre-4.2 binaries upgrade in place on first open of this build (one-way).
• redb is pinned to 4.2.0; the redb_2_6 companion (same crate, v2.6.3) exists solely for the legacy upgrade path.
• Every commit fsyncs (redb 4.2 removed Durability::Eventual); the historical write-vs-write_txn_immediate split collapses onto durable commits, which only strengthens the receipt contract.