Module journal 

Public wire DTOs for the event-sourced release journal (ADR-0003).

Two durable representations ride on these types:

• journal.jsonl — the append-only event log: one JournalEvent per line, each self-contained (it carries its own JOURNAL_SCHEMA_VERSION, a monotonic JournalEvent::seq, a JournalEvent::ts, an JournalEvent::idempotency_key, and its EventKind payload). The log is the single source of truth.
• manifest.json — the materialized RunState projection reduced from the log. It is disposable and reconstructable from the events (ADR-0003 §2): if the manifest cannot be rebuilt from the journal there would be two sources of truth, which is forbidden. It exists only as an O(1) cache for release show.

Versioning + forward tolerance

The journal is durable across ossctl upgrades — a run started under one version must be resumable under the next — so each event carries its own JOURNAL_SCHEMA_VERSION, independent of the envelope crate::SCHEMA_VERSION that versions the --json wire surface. Additive fields are tolerated (serde ignores unknown fields on read); a newer required event schema is refused with an actionable error rather than silently mutating state (the refusal lives in crate::release::journal, which reads these back).

These DTOs are owned by the journal: siblings (the plan model, the adapters) may hold richer in-memory receipt types, but what the journal persists is exactly the shape here.

Structs

JournalEvent

One line of journal.jsonl: a schema-versioned, sequenced, timestamped envelope around an EventKind.

PhaseRecord

One completed-phase record in the RunState projection.

PublishReceipt

The per-target publish receipt the journal persists — the fact “this exact artifact landed” that resume/reconcile checks against the registry (the remote is ground truth, ADR-0003 §4).

RunState

The materialized run state — the projection reduced from the event log and cached in manifest.json.

TagState

The progress of one release tag through its landing steps. Every field is a monotonic (false → true) fact set by its own journal event, so re-applying a tag event is a no-op. created_local and pushed_remote are orthogonal landing facts; github_release vs github_release_delegated are the two mutually-exclusive dispositions of the Release step (created-by-engine vs delegated-to-CI) — the coordinator writes exactly one, and refuses to record a second contradictory one (crate::release::coordinator’s tag phase), so the illegal both-true state is unreachable for a valid run. They stay flat flags (with a clippy::struct_excessive_bools allow) rather than a ReleaseDisposition enum for consistency with the surrounding flat-flag style and a #[serde(default)]-friendly additive wire shape; folding them into an enum is a tracked cleanup, not a correctness fix given the write-time guard.

Enums

EventKind

The payload of a journal event — the ADR-0002 event classes. Serialized internally tagged on a kind discriminator, flattened into the JournalEvent envelope so each JSONL line is one flat object.

Phase

The five coordinator phases, in barrier order (ADR-0002): the derived PartialOrd/Ord follows declaration order, so DryRun < Build < Publish < Tag < Dist — the order the projection sorts phase records in.

PhaseOutcome

How a phase barrier finished.

RunStatus

Terminal-or-not status of a run, derived from the event stream.

Constants

JOURNAL_SCHEMA_VERSION

Schema version stamped on every JournalEvent and RunState.