[ToddHebebrand]

Summary

W15 PR B: the money surface of the Pax8 AI tools. manage_pax8_orders gains submit (four-eyes, mandatory pinned digest, agent-human-only) and reconcile (supervised, MFA-gated), and the order-submit transaction gets the claim-time verification hook plus the OD-1 approved-baseline CAS on manual_quantity for REST and AI alike.

• T8 — claim hook in the money-critical transaction. submitOrder({ …, verifyClaim?, onPreflightFailure? }) (defaults keep today's REST behaviour); claimOrder runs the hook inside the claim transaction after validateDirectOrderLinesForSubmit and the duplicate-target check, and the bundle carries the integration generation; createClient refuses Pax8IntegrationGenerationChangedError when the live row's URL or credential ciphertext changed after the claim (quorum Q4); reopenUnsentOrder is a CAS on status='submitting', the claimed submittedAt and every line pending (quorum Q3). OD-1 (Todd 2026-10-31: A, REST too): every claimed line records the linked contract line's manual_quantity as authorized_baseline_quantity inside the claim transaction; persistSubmitResults and persistReconcileResults CAS manual_quantity = authorized_baseline_quantity; a conflict keeps the remote outcome (succeeded) and flags billing_conflict, never overwriting (quorum Q6).
• T9 — digest, four-eyes submit, reconcile. actionIntents/pax8OrderDigest.ts pins every local input of what is sent and billed (line quantity/sortOrder/provisioning/commitment, snapshot unitCost, derived active commitment, contract-line manualQuantity + unitPrice incl. new lines, contract-currency catalog price, company mapping, integration apiBaseUrl + credential ciphertext); unchanged by a lastSeenAt bump, a token refresh or the claim's own draft→submitting transition. Preview exposes previewDigest + submitWith; the release sequence (W15-D6) re-checks the digest, re-fetches dependencies for change AND cancel lines, runs verifyClaim, then isMock, then the send, then the CAS persist. Refusals: PRICE_CHANGED, COMMITMENT_CHANGED, PREVIEW_MISMATCH, COST_UNKNOWN, COMMITMENT_AMBIGUOUS, PREFLIGHT_FAILED (reopens, never marks failed), > 20 lines. The card says estimated (OD-2 accepted) and names every CANCEL as terminal with its commitment term (quorum Q7/Q8). Submit is AGENT_HUMAN_ONLY_ACTIONS (never a proposal: no idempotency key at Pax8, cancel is terminal); reconcile is supervised and MFA-gated (OD-3).
• T10 — integration suite aiToolsPax8OrderSubmitScope.integration.test.ts (Pax8 client mocked at createPax8ClientForIntegration): partner B cannot submit partner A's order; edit between intent and release → content_changed; edit between digest check and claim → PREVIEW_MISMATCH, order still draft; approved submit with mocked success writes manual_quantity; mocked timeout → needs_reconcile, resolved by reconcile. Runs under the Integration Tests CI job.
• T11 — copy, docs, golden prompt g116 ("Submit Contoso's Pax8 order." → preview then submit), web tier config rows, release-notes line.

Plan amendment B1 (recorded on #6785)

pax8_order_lines_authorized_baseline_chk (2026-07-16) limited the approved baseline to change_quantity lines, so cancel and quote-created new lines could not carry it across a timeout into reconcile. Migration 2027-01-18-120000-pax8-order-line-baseline-any-action.sql re-creates the CHECK as IS NULL OR >= 0 (idempotent, writes no rows, the shipped 2026-07-16 file is untouched). No new column; export policy unchanged; Drizzle gains only a column comment.

Index budget (W19 bounds, anchored to PR A's measured values)

Measure	PR A	PR B	Delta
Always-on B1	2,507 B	2,507 B	0
Billing B2	737 B	738 B	+1 B
Largest block	1,713 B	1,713 B	0
Worst page turn B3	5,270 B	5,270 B	0

Closes #6785
Refs #6754

Merge Danger

Door: one-way, small: one migration that only relaxes a CHECK. Behaviour door: submit is reachable only through a two-person approval with a pinned digest, by humans, on a connection an admin has already configured; nothing submits on merge or deploy. REST behaviour changes in exactly one way: a billing edit during a Pax8 HTTP call is no longer overwritten (recorded as billing_conflict instead).

Blast radius: pax8OrderSubmitRepository.claimOrder (optional hook, default unchanged), the two persist paths (CAS), the AI tool class maps and effect-digest registry.

Testing

Red first in each task.

• Unit / contract (API): 51 files / 2,829 passed — MFA gate, guardrails (+ Pax8 tier tests), approval scope, agent principal, MCP coverage, tool index (+ W15 budget), Agent SDK tools, effect-digest coverage, user-owned release, description/output budgets, tier-config and AI-docs parity, site scope, reference fields, parked fanout, Pax8 submit / repository / preview / order-submit handler, migration RLS scope, autoMigrate, pax8 schema, pax8 routes.
• Area gating: 190 passed.
• API typecheck: exit 0. check-migration-naming --against-ref origin/main: OK. git diff --check: clean.
• Integration: written, runs in CI (Integration Tests). db:check-drift runs in CI (the implementer sandbox could not start the checker).

Deploy note (from the review fix pass)

Before deploying, inventory production Pax8 order lines already in_flight or needs_reconcile with a NULL authorized_baseline_quantity on a non-change_quantity action (cancel / new subscription). Such lines predate baseline capture for every action; on reconcile the CAS misses and the line is recorded billing_conflict:baseline_missing (vendor success kept, billing edit preserved, order partially_failed, review guidance surfaced) rather than written blindly. Read-only inventory:

SELECT o.id AS order_id, o.partner_id, o.org_id, o.created_at,
       l.id AS line_id, l.action, l.submit_state, l.contract_line_id,
       c.line_type, c.manual_quantity
FROM pax8_orders o
JOIN pax8_order_lines l ON l.order_id = o.id AND l.partner_id = o.partner_id AND l.org_id = o.org_id
LEFT JOIN contract_lines c ON c.id = l.contract_line_id AND c.org_id = l.org_id
WHERE l.submit_state IN ('in_flight', 'needs_reconcile')
  AND l.authorized_baseline_quantity IS NULL
  AND l.action <> 'change_quantity';

Expect zero rows; any found need a human to compare vendor evidence against billing before deploy.

Needs Todd

• g116 live chat smoke with a live key: "Submit Contoso's Pax8 order." → preview → two-person approval → submit; confirm the estimated-cost and terminal-cancellation copy and the reconcile guidance on an unknown outcome.

Implemented by Codex (gpt-6.1-sol) under the orchestrator brief with one independent read-only review round applied; PR A review and Gate B decisions carried.

🤖 Generated with Claude Code

[strix-security]

Strix Security Review

Warning

This pull request has 90 commits after the last Strix review (91aab6c). Strix has not reviewed these changes.
Automatic review on push is off for this repository. To review the latest changes, tag @strix-security in a comment, or turn on re-review on push.

✅ No open security findings.

PR summary: Adds four-eyes `submit` and supervised `reconcile` actions to the Pax8 AI order tool, a pinned effect digest binding the approved order content, a claim-time verification hook with integration-generation pinning, and an approved-baseline compare-and-swap before Pax8 results are written to contract-line billing quantities.

Review summary

Reviewed the Pax8 money surface added by this PR: the four-eyes submit action with its mandatory pinned effect digest and agent-human-only exposure, the supervised reconcile action, the new claim-time verification hook with integration-generation pinning, the OD-1 approved-baseline CAS on contract_lines.manual_quantity, and the migration that relaxes the authorized_baseline_quantity CHECK. The authorization chain holds: submit is tier 3 four-eyes with a mandatory pin, is denied to AI/flow principals both in the exposure list, the guardrail check and the handler, is refused for site-restricted callers, and releases only under a human approver's session; the claim-time digest recompute runs inside the claim transaction and rolls back on drift, and the integration destination and credentials are re-verified before the client is built. Reconcile sends no vendor write, derives outcomes only from matching vendor evidence, and its billing write is bounded by the claim-time baseline. No security vulnerability was confirmed in the changed code; all eight suspected issues raised during the review were independently validated and rejected. Two non-security correctness observations are worth the author's attention but are not findings: a spurious billing_conflict marker now lands on succeeded lines linked to non-manual contract lines (quote-sourced per-device lines), and previewPax8Order opens a partner-wide DB context that relies on both current callers having already checked the order's organization.

Ruled out (8)

• Can the new Pax8 order digest resolver read another tenant's order and reveal it exists?
  The resolver does run under the system DB context and reads the order by id only, but nothing but a SHA-256 leaves it, the prerequisite is a 122-bit random foreign order id, and no preview, submit or reconcile of a foreign order is reachable.
• Does a line linked to a non-manual contract line now record a false billing_conflict?
  The behaviour is real and reachable for quote-sourced per-device lines, but no billing quantity is changed, the string is only copied into display fields nothing gates on, and it is confined to the submitting tenant's own order.
• Can the change_quantity digest baseline disagree with the quantity shown on the approval card?
  The staged baseline is validated against the live contract quantity before the claim overwrites it, both columns are numeric(12,2), and any divergence fails closed with a restage refusal rather than an unauthorized write.
• Can an automated flow release a submit intent as the human approver and bypass the agent-human-only gate?
  Flow-step intents release under a rebuilt flow principal that the handler refuses, the approver-substitution path only starts a flow run, and a site-restricted principal cannot enable a flow in the first place.
• Can reconcile treat pre-existing vendor state as proof of a cancel and zero the contract line's billing quantity?
  The branch is unchanged from main, only ever writes zero for a cancel, and the actor is an MFA-verified billing operator who can already set that quantity directly through the contract-line API.
• Can a concurrent reconcile reset an in-progress submit and lose a real vendor write?
  Both paths serialize on the order row lock and re-verify line state, the only pre-claim vendor traffic is a non-writing mock preflight, and the loser receives a 409 in a consistent state.
• Does reconcile reach the billing-quantity sink with weaker approval than four-eyes submit?
  The write is pre-existing, is bounded to lines a digest-verified four-eyes submit already claimed, and is no more authority than the existing single-operator REST submit and reconcile routes.
• Can a line be added after the claim is taken, or can a token-cache change slip past the generation pin?
  addOrderLine re-locks the parent row and re-checks its status immediately before the insert, and the token-cache columns only affect the bearer token used against the pinned endpoint, failing closed on an auth error rather than redirecting a write.

_{Review 1 on this PR · 91aab6c · requested Oct 31 17:41 UTC when the PR was opened}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}

[cloudflare-workers-and-pages]

Deploying breeze with    Cloudflare Pages

Latest commit:	97f3b0c
Status:	✅  Deploy successful!
Preview URL:	https://65e02b14.breeze-9te.pages.dev
Branch Preview URL:	https://feature-6754-ai-full-control-j2w0.breeze-9te.pages.dev

View logs

[ToddHebebrand]

Review run: /pr-review-toolkit:review-pr on head 91aab6c with four reviewers (code-reviewer, silent-failure-hunter, pr-test-analyzer, type-design-analyzer).

Verdict: the money path holds — one send per order (CAS claim with NOT EXISTS non-pending lines, claimLines throws on partial claim, reconcile never calls createOrder), verifyClaim runs inside the claim transaction and a throw rolls it back, unknown outcomes land in needs_reconcile and are never retried, the digest sentinels fail closed at intent creation and release, the digest pins every local billing input (incl. the claim's own status transition normalised), the OD-1 CAS keeps the Pax8 outcome and never overwrites, tenant/site gates run before any read, and the B1 migration only relaxes the CHECK. Not mergeable yet: observability after the send is missing and some guidance is wrong. A fix pass is running; findings and dispositions:

High (fix): H1 a post-send persist conflict discards Pax8's response (order id, subscription ids) with no log or Sentry event — the one piece of evidence reconcile would need; H2 billing_conflict is written to the row but invisible through the reconcile result and the submit audit (audited as success); H3 updateManualContractQuantity reports "quantity changed" for a deleted line, a non-manual line, a null quantity and a real baseline miss alike; H4 AI submit/reconcile write no audit row when the service throws after a real send, and failed/partially_failed results are audited as success.

Medium (fix): M1 claim-phase 409s (claim lost, integration unavailable, baseline not captured) are mapped to "reconcile any unknown write" although nothing was sent, and PREVIEW_MISMATCH travels as a message prefix; M2 a reopen CAS miss loses the original refusal; M3 Pax8IntegrationGenerationChangedError says "during sync" and turns a provably unsent REST submit terminal; M4 preview does not block when a linked contract line was deleted; M5 lines already awaiting reconcile at deploy have a NULL baseline for cancel/new lines and would be flagged billing_conflict with the wrong reason (deploy note added).

Type design (fix, mechanical): closed Pax8SubmitRefusalCode union + Pax8ClaimDriftError; satisfies-checked expectedLines compare map so a new schema field cannot drift; LoadedBundle/ClaimedBundle split with a credential-generation hash instead of ciphertext in memory; discriminated SubmitResult; typed Pax8OrderMaterial + preview-field source classification; SubmitMode instead of two independent optionals.

Tests (fix): integration case for the OD-1 CAS under a concurrent edit; real createClient field-comparison refusal (current test returns [] before the comparison); release-twice at service and integration level; PREVIEW_MISMATCH structural cases; reopen CAS predicate inspection; describePax8Submit branch; vacuous createClient assertion removed; cosmetic three-status it.each collapsed.

Dismissed: none. The '?' placeholder for a new subscription's fromQuantity in the approval copy is folded into the fix pass.

[ToddHebebrand]

Fix pass pushed as 1ffe12c (29 files): every item in the review summary is addressed — execution evidence (vendor order id, per-line subscription ids/states) is logged and captured before persistence and again on a persist failure; both persist paths return billingConflicts, surface a billing nextStep, set partially_failed and audit REST/AI failures; updateManualContractQuantity reports baseline_changed / line_missing / not_manual / no_quantity / baseline_missing distinctly (integrity drift → Sentry); AI submit/reconcile audit thrown errors as failures and incomplete outcomes as such; Pax8ClaimDriftError + explicit phases replace the message-prefix sniff, claim-phase refusals say nothing was sent; reopen CAS misses keep the original refusal as cause; REST integration drift reopens instead of terminal-failing; preview blocks on a missing contract line; PAX8_SUBMIT_REFUSAL_CODES union, exhaustive LINE_ASSERTION_CODE, LoadedBundle/ClaimedBundle with a credential hash instead of ciphertext, discriminated SubmitResult, typed/versioned digest material with a preview-field source contract, explicit SubmitMode. Tests: OD-1 CAS under a concurrent edit (integration), real createClient drift refusal with SQL assertions, release-twice at service and integration level, structural PREVIEW_MISMATCH, reopen CAS predicate, impact-summary branch, 'new → quantity' card copy. Deploy note added to the body (NULL-baseline inventory). Local: 58 files / 3,160 tests green; typecheck 0; index +1 B.

[ToddHebebrand]

Head CI on 1ffe12c red in three jobs: the new scope integration suite is blocked by CONTRACT_LINE_MISSING for a line whose contract line exists (the M4 blocker query is wrong against a real DB — production bug, being fixed in the query); the pre-existing pax8OrderSubmit.integration case still expects a throw where OD-1 now records billing_conflict:line_missing (test updated to the approved contract); and the REVIEWED_AI_AGENT_SITES classification contract needs the new agent-human-only refusal site classified. Fix pass running.

[ToddHebebrand]

Pushed ba49d45: the preview's repeatable-read transaction now carries the order's org/partner visibility (it previously opened with partner scope and no accessible orgs, so the linked contract line read came back empty and CONTRACT_LINE_MISSING fired for an existing line — the genuinely missing case still blocks); the pre-existing REST integration case asserts the OD-1 contract (billing_conflict:line_missing, vendor outcome kept, billing untouched, order partially_failed); the agent-human-only refusal site is classified in REVIEWED_AI_AGENT_SITES. Local: 6 files / 452 + 58-file sweep 3,163 green; typecheck 0. CI rerunning.

[ToddHebebrand]

Land gate: head ba49d45 CI success (run 41232869679); four-reviewer round on 91aab6c with every finding fixed across two passes (preview transaction scoping, OD-1 REST contract test, agent-site classification) and spot-checked; base main; deploy note in the body. Enqueued. Closes #6785 on merge → W15 complete.

[ToddHebebrand]

Release-notes entry moved to the consolidated notes PR (see #10853 once opened) to stop merge-queue conflicts; no functional change.

[ToddHebebrand]

Refreshed onto current main (head 067623cc84) after the UNMERGEABLE dequeue.

Conflict resolution (merge commit c93bc311da)

• aiGuardrails.agentPrincipal.contract.test.ts: AGENT_HUMAN_ONLY_ACTIONS keeps this PR's manage_pax8_orders:submit. The manage_groups:add_devices / remove_devices entries are dropped to match main: fix(ai-tools): manage_groups add_devices/remove_devices supervised with org/site scope guards (#10149) #10822 (ai-tools: make manage_groups add_devices/remove_devices supervised with scope guards (QW9 follow-up from #6754 W04) #10149) moved them to supervised tier 3. Where the two sides disagreed, main's behaviour was kept.
• llm/toolEval/goldenPrompts.ts: keeps both cases, this PR's g116 (Pax8 submit) and main's g117 (ai-tools: manage_tickets SDK input shape lacks merge_preview/merge; system_cleanup has no cancel (found in #6754 W06) #10161 ticket merge).
• llm/toolEval/goldenPrompts.test.ts: case count raised from 116 to 117, with the g116 and g117 assertions both kept.
• docs/release-notes/next-release-draft.md is identical to main.

Migration rename (067623cc84)
2027-01-18-141000-pax8-order-line-baseline-any-action.sql is renamed to 2027-01-18-189000-…, which sorts after main's 2027-01-18-170000 and 171000. The one reference to it, in src/db/schema/pax8.test.ts, is updated.

Verification

• pnpm install --frozen-lockfile succeeded.
• vitest: 78 files, 2404 tests passed. This covers the guardrail contract, toolEval/, parkedFanout.contract, automationPrincipal.contract, agentToolCatalog.contract, and the PR's pax8, actionIntents, parity and sentry suites. (mcpCoverage.test.ts does not exist.)
• git merge-tree --write-tree HEAD origin/main exits 0.

Not enqueued.

[ToddHebebrand]

Added picker label aiAgentsPage.catalog.actions.manage_pax8_orders.reconcile to all 8 locale settings.json (the only key the label contract reported missing; manage_pax8_orders tool label and submit were not flagged). Merged origin/main cleanly. Head 131c2c1.

[ToddHebebrand]

Main merged more migrations; unshipped migration moved to 2027-01-18-192000-pax8-order-line-baseline-any-action.sql so it sorts after main's newest (191000). No functional change.