(CODUX-225) Encrypt and atomically persist connector state

[numnx]

🧩 Task: Encrypt and atomically persist connector state

Automated task PR opened by Code UX for T08.

📋 Summary

Sprint: Sprint 225 · Chat connector completeness and verification · Task: T08

Complete and verify all six chat connectors through provider-specific profiles, correct authentication and session behavior, encrypted durable state, atomic routing and retries, REST/MCP/dashboard management, official-documentation evidence, deterministic contract coverage, and credential-gated checks limited to provider-controlled endpoints, with Discord prioritized.

🤖 Model & Provider

Provider	Codex CLI
Model	gpt-5.6-sol

⏱️ Timing

Started	2026-07-13 22:51:18 UTC
Finished	2026-07-13 23:13:23 UTC
Duration	22m 5s

📊 Token Usage

Metric	Value
Input tokens	257,625
Cached input tokens	15,843,072
Output tokens	48,133
Total tokens	16,148,830
Invocations	1
Tool calls	103
Active time	21m 13s

Included usage estimate (subscription/local login): $10.65

✅ QA Review

⏳ QA review runs after this PR is opened. Check the task card in the dashboard for the outcome once it lands.

📝 Full Task Prompt

## Objective
Provide durable encrypted secrets, verification results, replay receipts, provider sessions, retry scheduling, and compare-and-set delivery leases for all connector runtimes.

## Scope
- `src/contracts/chat-provider-types.ts`
- `src/repositories/db/app-db-schema.ts`
- `src/repositories/db/app-db-migrations.ts`
- `src/repositories/chat-provider-repository.ts`
- Create `src/services/chat-provider-secret-service.ts`
- `src/infrastructure/security/encrypted-sqlite-secret-store.ts` and credential key-provider interfaces, only where reusable integration is needed
- `tests/backend/repositories/chat-provider-repository.test.ts`
- Create `tests/backend/services/chat-provider-secret-service.test.ts`

## Implementation Requirements
1. Add fresh-schema and idempotent upgrade support for encrypted connector secret envelopes, sanitized verification status/details, expiring ingress replay receipts, resumable provider session state, explicit `next_attempt_at`, and outbound delivery lease owner/expiry fields.
2. Stop writing new plaintext `secret_json`; introduce a connector secret service over the existing encrypted SQLite/key-provider boundary and expose only ephemeral resolved credentials to provider profiles.
3. Add an idempotent post-key-readiness migration that seals legacy `secret_json` before clearing it, leaves legacy data intact if encryption fails, reports actionable readiness state, and safely resumes after interruption.
4. Reset verification state whenever authentication, transport, or required setup changes while preserving it for display-name-only changes.
5. Make inbound idempotency insertion atomic under concurrent requests, add atomic replay-receipt insertion, compare-and-set session updates, and lease-based outbound claim/complete/release operations with stale-lease recovery.
6. Enforce channel-binding ownership when a delivery or session references a connection, and retain cascade/cleanup behavior for connection deletion without orphaning encrypted envelopes or receipts.
7. Test fresh databases, legacy upgrades, repeated migrations, key unavailability, rollback on partial failure, secret rotation, redacted public reads, duplicate races, lease contention, stale recovery, session compare-and-set conflicts, and expiry cleanup.

## Constraints
- Never lower the existing encrypted credential key-readiness requirements or invent a second unencrypted fallback.
- Do not delete a legacy secret until its encrypted envelope and metadata are committed successfully.
- Preserve current connection, binding, and delivery IDs and retain read compatibility throughout migration.
- Keep transaction boundaries short and do not perform network calls while a SQLite transaction is open.

## Verification
- Run `pnpm run test:backend -- tests/backend/repositories/chat-provider-repository.test.ts tests/backend/services/chat-provider-secret-service.test.ts`.
- Run `pnpm run lint` and `pnpm run build`.
- Confirm database assertions find no raw newly written connector secret and concurrent claims yield exactly one lease owner.

🌿 Branch Info

Base: feature/CODUX-225-chat-connector-completeness-and-verification
Head: task/feature-codux-22-t08-codex-361e6fad-mrjtgr1j

---

🤖 Generated by Code UX