EVENTS-001B: approved event-source admission contract (pure, source-only)

[daliu]

Closes #439. Second conservative, safe-by-default source-only slice of parent #121 (EVENTS-001A) — the INGEST half of the public-event pipeline whose PUBLISH half is the §8.6 projectPublicEvent projection (#399). Parent #121 stays open.

functions/eventSourceAdmission.js — a non-throwing frozen-verdict reducer classifyEventSourceAdmission(approvedSourceEvidence, deliveryEvidence) that decides whether one raw, untrusted structured-source delivery may be admitted as a private draft, returning exactly one frozen verdict: admit / refused / denied. Imports only node:util; imported by nothing; reads no clock, env, network, Firestore, or provider; zero runtime behavior, awaits no deploy.

§8.6 (throwing projector) decides what a public VIEW may contain from a trusted reviewed record. This (non-throwing reducer) decides the arrow before it — an approved source's untrusted delivery → a private draft — and defers all public-CONTENT validation (control chars, markup, URL scheme, timestamp ranges, timezone, ordering, event-type vocabulary, tighter public bounds) back to §8.6. Defense in depth; no sibling duplicated.

Four marquee safety properties, encoded structurally:

1. Source-authorized — admits only for an APPROVED, ACTIVE, PUBLIC-ELIGIBLE descriptor whose sourceId matches the delivery's. Null descriptor → source_not_approved without ever parsing the untrusted payload; inactive → source_inactive; non-public kind → source_kind_not_public; mismatch → source_mismatch.
2. Public/protected boundary (allowlist, never denylist) — delivery key set must be EXACTLY the closed public-candidate allowlist; any outside key (how an inlined discount code, guest list, payment state, provider token, or credential would arrive) → unexpected_field, never admitted. No protected-field NAME appears in the source; a protected offer is linked only via the opaque protectedOfferRef.
3. Never auto-publishes — sole success verdict stamps lifecycle: 'draft', published: false; decision vocabulary has no publish/approve verb.
4. Injective idempotency key — draftId = collision-free join of (sourceId, sourceEventId, sourceRevision) over a reserved | the opaque grammar excludes; same revision → SAME id, new revision → DISTINCT id.

Tests (functions/eventSourceAdmission.test.js, 92 cases): full admit/refused/denied matrix; source-authorization battery (null/inactive/non-public-kind/mismatch, each proven to not parse the payload); the public/protected boundary (every protected field name as an extra key → unexpected_field, incl. non-enumerable; opaque protectedOfferRef null-and-handle); never-auto-publish asserted on enums + across the matrix; injective draftId sweep; malformed batteries for both arg positions (proxy/revoked-proxy/foreign-proto/symbol/accessor-never-invoked/extra-and-missing); fail-closed check ordering; a never-throws hostile sweep in both positions; determinism/immutability/frozen singletons; and a source-boundary test locking the require set to exactly {node:util}, header §8.6a/EVENTS-001B, no protected/secret vocabulary in code, and imported-by-nothing.

SYSTEM_DESIGN.md §8.6a documents the compose/defer-to-§8.6 rationale, a flowchart, the four properties, and explicit distinctness vs §8.6/§8.5a/§8.5b/§8.7/§8.22.

Local: ESLint 8.56.0 exit 0; jest eventSourceAdmission 92/92 green (secrets unset).

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	a08f908
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a5fcd79145d3f0009ffdd9e
😎 Deploy Preview	https://deploy-preview-440--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.