Service Agent Proof Ledger

Status: orchestrator-owned progress ledger for service-owner agents.

The machine-readable ledger is service-agent-proof-ledger.json. Use it with service-agent-manifest.json, service-agent-execution-queue.json, service-agent-next-slice-queue.md, service-agent-next-slice-queue.json, service-workflow-test-matrix.md, and agent-handoff-format.md. Use service-agent-closeout-ledger.json to track whether a service has an accepted first-slice handoff before claiming that bounded slice is accepted. Use service-agent-next-slice-closeout-ledger.json for future handoffs spawned from nextTaskId.

Ledger Rules

• spawn-ready means the dispatch row, task pack, workflow row, and first verification command are wired. It does not mean the service is complete.
• Every completed service-agent slice must include the closeout evidence from docs/agents/agent-handoff-format.md: task id, docs read, legacy evidence, files changed, focused tests, first verification output, route/default status, rollback notes, remaining risks, and next task.
• The closeout ledger is the machine-readable acceptance gate for that handoff; a row remains not complete until make test-service-agent-closeout-ledger passes with an accepted handoff path for the row.
• The next-slice closeout ledger is the acceptance gate for a future nextTaskId handoff; it must pass make test-service-agent-next-slice-closeout before the proof gate moves.
• Default public route promotion is separate from service readiness. It still needs route-specific live/browser proof and rollback evidence.
• IAM/Profile default promotion additionally needs populated target validation with the required migrator run report.
• Alias and runtime-adapter rows must not create duplicate implementation directories.

Current Proof State

Dispatch ID	Service	Proof status	Open proof gate
SVC-001	api-gateway	spawn-ready-not-complete	Route-specific gateway live/browser proof and rollback notes are required before any default route promotion.
SVC-002	bff-service	spawn-ready-not-complete	BFF route changes need owner-service source evidence and gateway route proof.
SVC-003	iam-service	spawn-ready-cutover-gated-not-complete	Default IAM/Profile auth promotion still needs a passed default cutover proof bundle over production-like populated targets with run-report evidence, candidate review, browser proof, and rollback-after-candidate proof.
SVC-004	profile-service	spawn-ready-cutover-gated-not-complete	Default profile route promotion still needs a passed default cutover proof bundle over production-like populated targets with candidate diff evidence, browser proof, and rollback-after-candidate proof.
SVC-005	organization-service	spawn-ready-not-complete	IAM membership write authority and school-service read-model sync proof must stay explicit before member-write route promotion.
SVC-006	classroom-service	spawn-ready-not-complete	Classroom public route work needs route guard proof and owner-local profile/org references only.
SVC-007	course-service	spawn-ready-not-complete	Student course route changes need route guards, live/browser proof, and default rollback notes.
SVC-008	question-service	spawn-ready-not-complete	Question read/write/type route changes need save/reload, live/browser, and rollback evidence before default promotion.
SVC-009	exam-service	spawn-ready-not-complete	Exam authoring/start slices need exam-attempt contract proof plus live/browser proof before public route promotion.
SVC-010	attempt-service	spawn-ready-not-complete	Attempt public/start slices need route, live, browser, idempotency, and rollback proof.
SVC-011	file-service	spawn-ready-not-complete	Storage/media promotion requires parity proof and browser evidence for touched upload/read flows.
SVC-012	import-service	spawn-ready-not-complete	Import create/status/approval/review changes need matching route, live, browser, and rollback proof.
SVC-013	formula-docx-service	runtime-adapter-not-complete	Parser/runtime work must stay behind the external Go Formula adapter and must not create services/formula-docx-service.
SVC-014	search-service	spawn-ready-not-complete	Search route promotion needs exact legacy route ownership mapping plus rebuild/projection proof.
SVC-015	ai-service	spawn-ready-not-complete	AI job/public route changes need usage/wallet boundary proof and route live proof; AI must not own quota or credit movement.
SVC-016	billing-service	spawn-ready-not-complete	Subscription entitlement events need replay/idempotency proof before public subscription route promotion.
SVC-017	wallet-service	spawn-ready-not-complete	Wallet route changes need immutable ledger, replay, route guard, live proof, and rollback evidence.
SVC-018	usage-service	spawn-ready-not-complete	Billing sync replay is accepted; AI generation and OCR/import caller contracts remain owner-service bounded, while route-specific live/browser and rollback proof is required before default public caller route promotion.
SVC-019	payment-service	spawn-ready-not-complete	Payment webhook/reconcile changes need idempotency, paid-event replay, and downstream billing/wallet proof.
SVC-020	notification-service	spawn-ready-not-complete	Notification route changes need already-resolved-recipient proof and route rollback notes.
SVC-021	audit-service	spawn-ready-not-complete	Audit producer/backfill changes need append-only, replay/idempotency, retention, and compatibility proof.
SVC-022	analytics-service	spawn-ready-not-complete	Analytics changes need rebuildable projection/event-source proof and route guard evidence.
SVC-023	admin-service	spawn-ready-not-complete	Admin route/dashboard changes need owner-service source proof, route/browser proof, and rollback notes before default promotion.

How To Use It

1. Pick the dispatch row from service-agent-manifest.json.
2. If the first slice is already accepted, pick the next bounded proof-gate focus and nextTaskId from service-agent-next-slice-queue.json; otherwise pick the concrete first-slice taskId from service-agent-execution-queue.json.
3. Spawn the worker with the matching prompt packet.
4. Require the first verification command plus the route/workflow checks from service-workflow-test-matrix.md.
5. Update the handoff evidence, the closeout ledger or next-slice closeout ledger, QA docs, and this ledger only after the worker has produced concrete test output and rollback notes.