[LIghtJUNction]

Expose Root and active bank balances and transaction projections for anonymous auditing. Registered/custodial users may publish their own account with a signed visibility operation; revoking a bank role restores its saved preference and archiving hides the account.

New money.public_balance, money.public_ledger, and money.visibility_set contracts and read-only /@handle/public-balance / public-ledger views preserve existing private v1 contracts and credential ceilings. Public transactions include only IDs, integer amount, accounts and time; free-form references and signed/private receipt contents are excluded. Publication covers full history, and private counterparties' IDs appear only on the published account's transactions. Add persistent money_visibility schema and CLI entry points; startup creates this additive table idempotently without changing ledger rows. The strict complete-recovery catalogue includes its exact columns, constraints and index; unknown schema objects remain rejected, and publication-policy drift invalidates a recovery proof.

Validation:

• Ruff check and format check, diff check passed.
• Final public-money suite: 4 passed, including uniform not-found for non-account/missing targets.
• Complete recovery proof suite: 27 passed, including real backup/restore preserving publication policy, policy-drift rejection and strict unknown-schema rejection.
• 37 passed: public publication, opt-in/out, ownership/old ceilings, bank revocation, archive, pagination, private-field exclusion, read-only HTTP GET/HEAD and effect fences, published dictionary compatibility.
• Earlier combined run had 41 passed and one fixture failure (attempted archive with a nonzero balance); fixture now drains the account and all affected tests pass. That run also passed money core, legacy account paths and ledger account isolation.

Root agent handles the user-authorized deployment separately; this worktree has not deployed or modified production accounts.

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[LIghtJUNction]

Update: this schema compatibility blocker is resolved in final PR head 0b393b7. The packaged catalogue includes the table, columns, constraints and index, with the exact schema check unchanged. Tests cover nonempty visibility preferences surviving backup/restore and detection of preference-state drift. The recovery job passed 133 tests. All 12 PR workflows are now successful; Rewrite aggregate verified 2,874 non-overlapping tests, with 8 additional conformance tests and the package build passing.

Those PR checks tested synthetic merge 03d98bd into 85f0aad. The PR subsequently merged as 0fc1764 on a newer main base; this comment does not claim that combined-main CI has finished.

Original finding on 1d6e644:

The current CI run exposes a schema compatibility blocker on 1d6e644: Issue recovery regressions finished with 2 failed, 109 passed and 21 errors. The failing complete-recovery tests stop in recovery_state.known_catalogue() with recovery_schema_unsupported.

This PR adds money_visibility to the PostgreSQL schema, but the packaged src/msg/data/recovery-state-schema.json is unchanged and has no entry for it. known_catalogue() compares the actual table/constraint/index shape with that file exactly, so even a newly initialized database can no longer capture a complete recovery proof.

Please update the packaged catalogue for the added table, columns, constraints and index while preserving the exact schema check. Then rerun tests/test_complete_recovery_proof.py and the recovery workflows; a nonempty visibility preference in the capture/restore test would also verify that the new persistent state is included. The earlier nonzero-balance archive fixture is already fixed in this head and is not the cause of this failure.