[shivros]

Summary

Implements the COD-475 outbound-history specification gate as a docs-only OpenSpec change. It translates Shiv's durable storage-first ruling into a producer contract for accepted outbound sends without changing Iris runtime behavior.

Contract covered

• shared durable retained-record seam; no provider-local or HTTP-owned history archive
• configured-instance-qualified identity, source echo/retry idempotency, and conflict behavior
• accepted prefixes for multi-request sends
• explicit capture, audit, persistence, and ambiguous-outcome semantics with no automatic resend
• exact source-authoritative direction, thread timestamps, contacts, and attachment coverage
• one generated HTTP/compiled-CLI/MCP outcome contract and zero-provider-call retained reads
• dependency boundaries for COD-492, COD-493, COD-494, COD-543, and COD-544

Files

• openspec/changes/add-outbound-history/proposal.md
• openspec/changes/add-outbound-history/design.md
• openspec/changes/add-outbound-history/tasks.md
• openspec/changes/add-outbound-history/specs/outbound-history/spec.md

Validation

• git diff --check passed
• structural fallback: 4 required files, 7 requirements, 13 scenarios, 12 tasks
• openspec validate add-outbound-history --strict was unavailable in the hosted runner
• no Rust, generated artifact, dependency, migration, credential, deployment, release, or live-provider behavior changed

Closes the specification portion of COD-475; runtime implementation remains behind reviewed contract/seam gates.

[shivros]

🤖 Automated Review Panel

Reviewer A — gpt-5.6-luna

APPROVE

• No blocking findings.
• The contract satisfies the settled storage-first producer goal, preserves external outcomes and safety boundaries, and introduces no frozen-spec or project-convention violation.
• Non-blocking observation: confirm a reviewed compatible retained-record seam before runtime implementation; the spec's explicitly reviewed-equivalent-seam allowance is acceptable for this docs-only gate.

Reviewer B — Gemini 3 Flash Preview

APPROVE

• No blocking findings.
• The producer seam correctly feeds durable storage without inventing a volatile archive, and the retained reader remains zero-provider-call.
• Partial failures, post-acceptance capture/audit failures, configured-instance collision isolation, frozen artifacts, Hydra projection, and privacy boundaries are covered.
• Non-blocking observation: the thread timestamp/message atomicity requirement will require transactional support in the future storage slice.

Both reviewers assessed this as a docs-only specification gate; no runtime or release evidence was expected from this PR.