[shivros]

Summary

• Materializes the negotiated inbox-to-notification v1 ownership, provenance, consent, delivery-state, and recovery contract.
• Adds versioned synthetic Iris-message/Rite-event fixtures covering positive, replay, collision-isolation, mirror, and fail-closed cases.
• Adds real IrisSource::parse_message boundary tests that prove fixture projection without implementing future policy selection or delivery runtime.

Verification

• cargo build --all-targets
• cargo test --all-targets — 51 tests passed, including all three inbox-notification fixture tests.
• cargo clippy --all-targets -- -D warnings
• cargo fmt --all -- --check
• cargo run -p rite-codegen -- check
• creed diff
• jq empty tests/fixtures/inbox-notifications/v1/fixtures.json
• git diff --check origin/main
• Dual-model review panel completed.

Scope boundary

This is a design/fixture gate only. It does not add a new source, action, route, configuration value, checkpoint, retry loop, deployment, or live notification.

Linear: COD-498

[shivros]

🤖 Automated Review Panel

Reviewer A — GPT-5.6-terra (Codex)

APPROVE — the design is explicitly a design/fixture gate, preserves the Iris/Rite ownership split and generic source/action boundary, covers the agreed v1 cases, and exercises the real IrisSource::parse_message path. Focused fixture verification passed: 3 tests.

Reviewer B — Gemini 3 Flash (OpenRouter)

BLOCK (reviewed disposition below) — raised questions about direction projection, durable receipt planning, and content-opt-in enforcement.

Runner disposition

No runtime defect was found in this scoped change:

• IrisSource::parse_message intentionally preserves the complete source message under metadata.message; the new tests assert the agreed literal nested paths rather than inventing a second direction mapping.
• The document explicitly assigns replacement of the current volatile receipt/action path to COD-501's durable receipt/checkpoint/outbox slice; it does not claim that current runtime behavior already satisfies it.
• Content opt-in is a future policy-selection gate. Redacting parser output here would change the existing source adapter and exceed this design/fixture-only ticket; future selection tests must fail closed before any handler action.

Full local gates, JSON fixture validation, and git diff --check origin/main passed. No source/action runtime, deployment, or live notification behavior is claimed.

[shivros]

Auto-Merge Gate

Confidence: 0.86

Rationale: COD-498 materializes the agreed design/fixture contract and verifies it through the real IrisSource::parse_message boundary. The change adds no source/action runtime, endpoint, configuration, credential, deployment, or live-notification behavior. The review panel's initial concerns are explicitly addressed by the documented scope disposition.

Checks observed: CI test and Creed context drift completed successfully. The PR is open, non-draft, cleanly mergeable, and does not carry a manual-review marker.

Scope limits: This merge is only the contract/fixture gate; all generic selector, structured action, durable checkpoint/outcome, and live-delivery work remains separately scoped.