test(control-plane): pin the capability-repository structure; record F-08 closure

A new capabilities test enforces the audit F-08 shape both ways: every
port method must resolve inside a capability repository (never the
assembly facade), and the embedded and PostgreSQL implementations of one
method must live in same-named modules — the two adapters cannot drift
apart silently. Plus the CHANGELOG entry for the split.

Full gate on this host: SHARDED_SUITE=PASS 2436/2436 (peaks 739-934 MiB
under the 1024 MiB guard), full-src mypy clean, ruff check/format clean,
integration outbox 9/9, property 13/13.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: JuliaEdom

CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to AgentFlow are documented in this file.
 
 ## [Unreleased]
 
+### Refactor — control-plane adapters split into capability repositories (audit F-08)
+
+The two control-plane monoliths (`embedded.py` 1,977 lines, `postgres.py`
+1,914 lines) are now bounded capability repositories — webhook, alert,
+outbox/replay, usage/audit over a shared base — with method bodies moved
+verbatim. `embedded.py` / `postgres.py` stay the assembly points and the
+only public import surfaces, so no consumer import changes; the tests'
+monkeypatch seams (`embedded.connect_duckdb`, `postgres.psycopg`, …) keep
+their pre-split homes. A new capabilities test pins the structure both
+ways: every port method must resolve inside a capability repository (never
+the facade), and the embedded and PostgreSQL implementations of one method
+must live in same-named modules, so the two adapters cannot silently
+drift apart. Path-pinned tooling (ruff S608 ignore, security-tooling S608
+count, the enqueue-lease static contract) moved with the code. Verified:
+full mypy over `src` clean, ruff check/format clean, the bounded Windows
+shard runner green across the unit suite.
+
 ### Docs — project closure contract
 
 - `docs/PROJECT_CLOSURE.md` freezes the engineering scope, maps the July

tests/unit/test_control_plane_capabilities.py

@@ -51,6 +51,34 @@ def test_capabilities_cover_the_wide_facade_without_exposing_it_to_consumers() -
     )
 
 
+def _home_suffix(adapter: type, name: str, prefix: str) -> str:
+    """The capability-module suffix (``webhook``, ``alert``, ...) whose
+    repository class defines ``name`` for this adapter family."""
+    for klass in adapter.__mro__:
+        if name in klass.__dict__:
+            module = klass.__module__.rsplit(".", 1)[-1]
+            assert module.startswith(prefix), (
+                f"{adapter.__name__}.{name} resolves outside the {prefix}* "
+                f"capability repositories: {module}"
+            )
+            return module.removeprefix(prefix)
+    raise AssertionError(f"{adapter.__name__} does not define {name}")
+
+
+def test_capability_methods_live_in_matching_bounded_repositories() -> None:
+    # Audit F-08: the two adapters must evolve in sync, and review/mutation
+    # locality comes from each capability method living in its bounded
+    # repository module. Every port method must resolve inside a capability
+    # repository (never the assembly facade), and the embedded and PostgreSQL
+    # implementations of one method must live in same-named modules.
+    for name in sorted(ControlPlaneStore.__abstractmethods__):
+        embedded_home = _home_suffix(EmbeddedControlPlaneStore, name, "embedded_")
+        postgres_home = _home_suffix(PostgresControlPlaneStore, name, "postgres_")
+        assert embedded_home == postgres_home, (
+            f"{name} drifted: embedded_{embedded_home} vs postgres_{postgres_home}"
+        )
+
+
 def test_app_repository_resolvers_return_narrow_views_of_same_store() -> None:
     store = SimpleNamespace()
     app = SimpleNamespace(state=SimpleNamespace(control_plane_store=store))