Implement durable store contract and registration roadmap

workplans/USER-WP-0009-postgres-durable-store-requirements.md

@@ -4,13 +4,13 @@ type: workplan
 title: "Postgres Durable Store Consumer Requirements"
 domain: netkingdom
 repo: user-engine
-status: proposed
+status: finished
 owner: codex
 topic_slug: netkingdom
 planning_priority: high
 planning_order: 9
 created: "2026-06-05"
-updated: "2026-06-05"
+updated: "2026-06-15"
 depends_on:
   - USER-WP-0007
 state_hub_workstream_id: "b5c85993-4aa2-4a8d-98b6-d174ab1b4538"
@@ -22,9 +22,11 @@ state_hub_workstream_id: "b5c85993-4aa2-4a8d-98b6-d174ab1b4538"
 
 Define, from the `user-engine` consumer perspective, what a durable
 Postgres-backed store must provide before user-engine depends on it in
-NetKingdom. This workplan is requirements-only: it should not implement the
-Postgres adapter, provision databases, create tenant infrastructure, or choose
-the final provider repository design.
+NetKingdom. The 2026-06-15 review also identified and closed one missing
+durable-store contract in this repository: `UserEngineService` now consumes an
+adapter-neutral store protocol instead of the concrete in-memory store. This
+workplan still does not implement the Postgres adapter, provision databases,
+create tenant infrastructure, or choose the final provider repository design.
 
 ## Scope Direction
 
@@ -51,7 +53,7 @@ schema, migrations for its own tables, store semantics, and conformance tests.
 
 ```task
 id: USER-WP-0009-T1
-status: todo
+status: done
 priority: high
 state_hub_task_id: "64c578e1-e2a1-48d4-8da9-659d4f881ef3"
 ```
@@ -64,7 +66,7 @@ schema version reporting.
 
 ```task
 id: USER-WP-0009-T2
-status: todo
+status: done
 priority: high
 state_hub_task_id: "19cfd23e-8a87-416d-b948-c727e8c5a11c"
 ```
@@ -76,7 +78,7 @@ security, observability, backup/restore expectations, and acceptance tests.
 
 ```task
 id: USER-WP-0009-T3
-status: todo
+status: done
 priority: high
 state_hub_task_id: "d3b388de-bb79-41d5-805e-d2def88ac926"
 ```
@@ -88,7 +90,7 @@ secrets, authorization, or audit-platform concerns.
 
 ```task
 id: USER-WP-0009-T4
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "d0e05af7-d777-4948-b072-79f1ffb9fc3a"
 ```
@@ -99,7 +101,7 @@ the isolated MVP without leaking Postgres concepts into domain code.
 
 ```task
 id: USER-WP-0009-T5
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "3c428960-be5b-411e-bd9b-7cba833abba8"
 ```
@@ -111,7 +113,7 @@ readiness, and redacted diagnostics.
 
 ```task
 id: USER-WP-0009-T6
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "d606094a-254c-46d5-9bb8-a3449ce61c2c"
 ```
@@ -133,10 +135,46 @@ expectations, encryption, and operational runbooks.
   tests.
 - The provider-repo boundary is explicit and avoids duplicating IAM, secrets,
   authorization, audit-platform, or infrastructure ownership.
+- `UserEngineService` depends on an adapter-neutral store protocol with
+  readiness, query, transaction, audit, outbox, and diagnostics semantics.
 - No Postgres implementation code is added as part of this workplan.
 
 ## Expected Outputs
 
 - `docs/postgres-durable-store-consumer-requirements.md`
 - Store-boundary notes suitable for a future provider repo.
+- `UserEngineStore` protocol and local-store conformance behavior.
 - Follow-up implementation workplan inputs for a Postgres adapter.
+
+## Implementation Notes
+
+Implemented on 2026-06-15:
+
+- Added `UserEngineStore` in `src/user_engine/ports.py` as the durable
+  persistence boundary for service behavior.
+- Moved `UserEngineService` from the concrete in-memory store type to the
+  store protocol.
+- Replaced service reads of local dict/list fields with protocol accessors for
+  users, identities, applications, bindings, catalogs, audit, outbox, and
+  diagnostics.
+- Added store transaction boundaries around mutating writes so domain changes,
+  local audit records, and outbox events commit or roll back together.
+- Kept authorization-denial audit records durable without emitting outbox
+  events, including when a denial happens inside a composed outer transaction.
+- Extended `InMemoryUserEngineStore` as the reference adapter with query
+  helpers, record counts, pending outbox access, audit-log access, and nested
+  transaction rollback semantics.
+- Added conformance tests for protocol-only store consumption, failed-mutation
+  rollback, and denial-audit persistence across rollback.
+- Updated the durable-store and public contract docs to describe the new
+  adapter boundary.
+- No Postgres adapter, database dependency, provisioning, credentials, or
+  infrastructure ownership was added.
+
+Verification:
+
+```text
+make test
+Ran 42 tests in 0.134s
+OK
+```