feat: Add DigestUpsertRequest and LockEntity models

- Introduced DigestUpsertRequest for handling digest upsert requests with properties like ChannelId, Recipient, DigestKey, Events, and CollectUntil.
- Created LockEntity to represent a lightweight distributed lock entry with properties such as Id, TenantId, Resource, Owner, ExpiresAt, and CreatedAt.

feat: Implement ILockRepository interface and LockRepository class

- Defined ILockRepository interface with methods for acquiring and releasing locks.
- Implemented LockRepository class with methods to try acquiring a lock and releasing it, using SQL for upsert operations.

feat: Add SurfaceManifestPointer record for manifest pointers

- Introduced SurfaceManifestPointer to represent a minimal pointer to a Surface.FS manifest associated with an image digest.

feat: Create PolicySimulationInputLock and related validation logic

- Added PolicySimulationInputLock record to describe policy simulation inputs and expected digests.
- Implemented validation logic for policy simulation inputs, including checks for digest drift and shadow mode requirements.

test: Add unit tests for ReplayVerificationService and ReplayVerifier

- Created ReplayVerificationServiceTests to validate the behavior of the ReplayVerificationService under various scenarios.
- Developed ReplayVerifierTests to ensure the correctness of the ReplayVerifier logic.

test: Implement PolicySimulationInputLockValidatorTests

- Added tests for PolicySimulationInputLockValidator to verify the validation logic against expected inputs and conditions.

chore: Add cosign key example and signing scripts

- Included a placeholder cosign key example for development purposes.
- Added a script for signing Signals artifacts using cosign with support for both v2 and v3.

chore: Create script for uploading evidence to the evidence locker

- Developed a script to upload evidence to the evidence locker, ensuring required environment variables are set.

docs/db/tasks/PHASE_1_AUTHORITY.md

@@ -12,13 +12,13 @@
 1. Create `StellaOps.Authority.Storage.Postgres` project
 2. Implement full Authority schema in PostgreSQL
 3. Implement all repository interfaces
-4. Enable dual-write mode for validation
+4. (Retired) Dual-write mode used during cutover; removed in cleanup
 5. Switch Authority to PostgreSQL-only after verification
 
-**2025-12-02 Update**
-- Dual-write decorators (token, refresh token) implemented with metrics and configurable fail-fast behaviour.
-- Backfill/verification harness added in Postgres library to copy tokens/refresh tokens from secondary backend and emit deterministic checksums.
-- Sprint PG-T1.9–PG-T1.12 unblocked; staging cutover awaits scheduled window.
+**2025-12-03 Update**
+- Dual-write wrappers removed post-cutover; Authority now runs Postgres-only with direct repositories.
+- Backfill harness retired; staging/production operate solely on PostgreSQL.
+- Sprint PG-T1.9–PG-T1.12 closed; no remaining dual-write dependencies.
 
 ---
 
@@ -339,38 +339,10 @@ public static IServiceCollection AddAuthorityStorage(
 
 ---
 
-### T1.9: Implement Dual-Write Wrapper (Optional)
+### T1.9: Dual-Write Wrapper (Retired)
 
-**Status:** TODO
-**Assignee:** TBD
-**Estimate:** 1 day
-
-**Description:**
-Implement dual-write repository wrapper for safe migration.
-
-**Subtasks:**
-- [ ] T1.9.1: Create `DualWriteUserRepository`
-- [ ] T1.9.2: Implement write-to-both logic
-- [ ] T1.9.3: Implement read-from-primary-with-fallback logic
-- [ ] T1.9.4: Add metrics for dual-write operations
-- [ ] T1.9.5: Add logging for inconsistencies
-- [ ] T1.9.6: Create similar wrappers for other critical repositories
-
-**Configuration Options:**
-```csharp
-public sealed class DualWriteOptions
-{
-    public string PrimaryBackend { get; set; } = "Postgres";
-    public bool WriteToBoth { get; set; } = true;
-    public bool FallbackToSecondary { get; set; } = true;
-    public bool ConvertOnRead { get; set; } = true;
-}
-```
-
-**Verification:**
-- [ ] Writes go to both backends
-- [ ] Reads work with fallback
-- [ ] Inconsistencies are logged
+**Status:** N/A (Removed 2025-12-03 post-cutover)
+**Notes:** Dual-write path served migration; code and configuration removed in cleanup.
 
 ---
 

docs/db/tasks/PHASE_3_NOTIFY.md

@@ -2,7 +2,7 @@
 
 **Sprint:** 4
 **Duration:** 1 sprint
-**Status:** TODO
+**Status:** DONE (2025-12-02)
 **Dependencies:** Phase 0 (Foundations)
 
 ---
@@ -13,6 +13,7 @@
 2. Implement Notify schema in PostgreSQL
 3. Implement 15 repository interfaces
 4. Handle delivery tracking and escalation state
+5. Switch Notify services to PostgreSQL-only (cutover)
 
 ---
 
@@ -165,19 +166,23 @@ See [SPECIFICATION.md](../SPECIFICATION.md) Section 5.5 for complete Notify sche
 
 ### T3.10: Switch to PostgreSQL-Only
 
-**Status:** TODO
+**Status:** DONE
 **Estimate:** 0.5 days
 
+**Notes:**
+- `StellaOps.Notify.WebService` now registers `AddNotifyPostgresStorage` exclusively; Mongo/InMemory paths removed.
+- Integration suites (delivery/escalation/digest) passing on Postgres (see `out/test-results/notify-postgres/TestResults_Postgres.trx`).
+
 ---
 
 ## Exit Criteria
 
-- [ ] All 15 repository interfaces implemented
-- [ ] All integration tests pass
-- [ ] Notification delivery working end-to-end
-- [ ] Notify running on PostgreSQL in production
+- [x] All 15 repository interfaces implemented
+- [x] All integration tests pass
+- [x] Notification delivery working end-to-end
+- [x] Notify running on PostgreSQL in production
 
 ---
 
 *Phase Version: 1.0.0*
-*Last Updated: 2025-11-28*
+*Last Updated: 2025-12-02*