feat(capability): add release scoped shadow bindings

cmd/commit-runtime/notification_executor.go

@@ -14,6 +14,7 @@ import (
 type notificationBindingSource interface {
 	ActiveCapabilityBinding(context.Context, capability.CapabilityID, identity.PrincipalID) (capability.Binding, error)
 	CapabilityBinding(context.Context, capability.CapabilityBindingID, int64) (capability.Binding, error)
+	ResolveCandidateCapabilityBinding(context.Context, capability.CandidateReleaseContext) (capability.CandidateBindingResolution, error)
 }
 
 type operationDispatcher struct {
@@ -23,6 +24,7 @@ type operationDispatcher struct {
 	secretRef            string
 	secret               string
 	client               *http.Client
+	candidateContext     *capability.CandidateReleaseContext
 }
 
 func (d operationDispatcher) Execute(action commitcontract.AuthorizedAction) ports.ExecutionResult {
@@ -30,6 +32,20 @@ func (d operationDispatcher) Execute(action commitcontract.AuthorizedAction) por
 		return d.continuityExecutor.Execute(action)
 	}
 	subject := action.Proposal.NotificationSubject
+	if d.candidateContext != nil {
+		resolved, err := d.bindings.ResolveCandidateCapabilityBinding(context.Background(), *d.candidateContext)
+		if err != nil || resolved.Mode != capability.CandidateBindingModeShadow || resolved.Binding.Context != *d.candidateContext {
+			return ports.ExecutionResult{Known: true}
+		}
+		if subject.BindingID != resolved.Binding.BaseActiveBindingID || subject.BindingRevision != resolved.Binding.BaseActiveBindingRevision {
+			return ports.ExecutionResult{Known: true}
+		}
+		executor, err := notificationexecutor.NewShadow(resolved.Binding, d.secret, d.client)
+		if err != nil {
+			return ports.ExecutionResult{Known: true}
+		}
+		return executor.Execute(action)
+	}
 	exact, err := d.bindings.CapabilityBinding(context.Background(), subject.BindingID, subject.BindingRevision)
 	if err != nil || exact.SecretRef != d.secretRef {
 		return ports.ExecutionResult{Known: true}
@@ -49,6 +65,11 @@ func (d operationDispatcher) Reconcile(action commitcontract.AuthorizedAction) p
 	if action.Proposal.Operation != commitcontract.OperationDeliverProspectiveNotification {
 		return d.continuityReconciler.Reconcile(action)
 	}
+	if d.candidateContext != nil {
+		// A candidate shadow delivery is never reconciled against the ACTIVE
+		// production target. Its typed receipt is the sole candidate evidence.
+		return ports.ExecutionResult{Known: true}
+	}
 	subject := action.Proposal.NotificationSubject
 	exact, err := d.bindings.CapabilityBinding(context.Background(), subject.BindingID, subject.BindingRevision)
 	if err != nil || exact.SecretRef != d.secretRef {