Module journal 

Public wire DTOs for the event-sourced release journal (ADR-0003).

Two durable representations ride on these types:

• journal.jsonl — the append-only event log: one JournalEvent per line, each self-contained (it carries its own JOURNAL_SCHEMA_VERSION, a monotonic JournalEvent::seq, a JournalEvent::ts, an JournalEvent::idempotency_key, and its EventKind payload). The log is the single source of truth.
• manifest.json — the materialized RunState projection reduced from the log. It is disposable and reconstructable from the events (ADR-0003 §2): if the manifest cannot be rebuilt from the journal there would be two sources of truth, which is forbidden. It exists only as an O(1) cache for release show.

Versioning + forward tolerance

The journal is durable across shipshape upgrades — a run started under one version must be resumable under the next — so each event carries its own JOURNAL_SCHEMA_VERSION, independent of the envelope crate::SCHEMA_VERSION that versions the --json wire surface. Additive fields are tolerated (serde ignores unknown fields on read); a newer required event schema is refused with an actionable error rather than silently mutating state (the refusal lives in crate::release::journal, which reads these back).

These DTOs are owned by the journal: siblings (the plan model, the adapters) may hold richer in-memory receipt types, but what the journal persists is exactly the shape here.

Structs

BumpInputs

The engine-owned bump inputs a --bump run persists so release resume can reconstruct the exact sealed plan after an interruption.

BumpRecord

The record of an applied engine bump — the durable fact that makes resume idempotent (never double-bumps).

DefaultBranchState

Durable evidence that the release commit is contained by the remote default branch. Kept separate from tag state because branch advancement happens only after destination verification.

JournalEvent

One line of journal.jsonl: a schema-versioned, sequenced, timestamped envelope around an EventKind.

PhaseRecord

One completed-phase record in the RunState projection.

PublishReceipt

The per-target publish receipt the journal persists — the fact “this exact artifact landed” that resume/reconcile checks against the registry (the remote is ground truth, ADR-0003 §4).

RunState

The materialized run state — the projection reduced from the event log and cached in manifest.json.

TagState

The progress of one release tag through its landing steps. Every field is a monotonic (false → true) fact set by its own journal event, so re-applying a tag event is a no-op. created_local and pushed_remote are orthogonal landing facts; github_release vs github_release_delegated are the two mutually-exclusive dispositions of the Release step (created-by-engine vs delegated-to-CI) — the coordinator writes exactly one, and refuses to record a second contradictory one (crate::release::coordinator’s tag phase), so the illegal both-true state is unreachable for a valid run. They stay flat flags (with a clippy::struct_excessive_bools allow) rather than a ReleaseDisposition enum for consistency with the surrounding flat-flag style and a #[serde(default)]-friendly additive wire shape; folding them into an enum is a tracked cleanup, not a correctness fix given the write-time guard.

Enums

EventKind

The payload of a journal event — the ADR-0002 event classes. Serialized internally tagged on a kind discriminator, flattened into the JournalEvent envelope so each JSONL line is one flat object.

Phase

The coordinator phases, in barrier order (ADR-0002): the derived PartialOrd/Ord follows declaration order, so Bump < DryRun < Build < Publish < Tag < Dist < Verify < AdvanceBranch — the order the projection sorts phase records in.

PhaseOutcome

How a phase barrier finished.

RunStatus

Terminal-or-not status of a run, derived from the event stream.

Constants

JOURNAL_SCHEMA_VERSION

Schema version stamped on every JournalEvent and RunState.