feat(context): bridge module plans and guard evidence identity
Connect server-built context module plans to a bounded dependency runner, and close catalog/recording integration gaps before automatic dispatch is enabled.
- The bridge consumes planner output, runs independent modules in parallel waves, and releases dependent modules only after saved/reused outcomes are persisted. Blocked plans, failed authorization, failed dependencies and ambiguous receipts do not proceed. Trace persistence failures stop scheduling; no automatic retries.
- Catalog requests can reach their existing database operation through the shared allowlist.
- MusicBrainz and MLC recording lookups verify the supplied ISRC against the recording attached to the selected workspace request, before reuse and before completion.
Validation: 20 planner/bridge tests, 16 recording resolver/registry tests, and the earlier 9 catalog/transport tests pass; repository lint passes. Whole-repository TypeScript reports errors outside changed files. Regression tests reproduced the original catalog rejection and incorrect recording reuse/save before the fixes.
Limits: fixture-tested with injected provider/database boundaries. The bridge is in-process and is not yet wired to saved-request durable workflows, a production dispatch registry or outcome storage. Composition/work-code binding and server spend policy remain required before enabling those paths. No live calls, merge or deployment. Recording lookup checks are not an atomic cross-table transaction.
Refs recoupable/app#2119, recoupable/app#2120, recoupable/app#2122, recoupable/app#2125, recoupable/app#2142.
Guarded dispatch follow-up
Adds an explicit dispatcher for MusicBrainz, MLC recording and Spotify release. Server input loads follow access checks; new provider calls require collection-policy approval at credential/permit acquisition, including cache misses. Unsupported paths fail before loading input. 27 planner/bridge/dispatcher tests and lint pass, including a connected planner-to-collector fixture. Provider/storage boundaries are mocked. Production input/policy/storage adapters and durable workflow wiring remain unfinished; no live calls or deployment.
Saved module input follow-up
The dispatcher now defaults to a scoped saved-request input loader for recording ISRCs and canonical Spotify release IDs. Read-only release resolution is explicitly allowlisted. Sixteen targeted adapter/dispatcher tests and lint pass; no changed-file TypeScript diagnostics. No deployment or live calls.
Before automatic enrichment is enabled, the database completion transaction must also recheck request status and subject membership atomically. The current completion function validates attempt ownership but lacks that final membership check. Production spend policy, outcome storage and durable workflow wiring remain unfinished.