[Mr444-dev]

Summary

• Deduplicate Inbox delivery using the domain event's stable EventId, backed by a PostgreSQL unique constraint.
• Atomically persist a new Inbox receipt and its derived workflow-event projection.
• Quarantine malformed or ambiguous JSON and conflicting payloads that reuse an event ID; commit Kafka offsets only after the database transaction succeeds.
• Add EF Core migrations and an explicit adoption path for databases created by the former EnsureCreated bootstrap.
• Remove literal deployment credentials from Terraform and Kubernetes configuration; require sensitive Terraform input and externally managed Kubernetes Secret references.

Verification at merge

• GitHub Actions check #13 passed for the PR head before merge.
• The recorded local verification for this change passed a Release build with warnings treated as errors, 71 unit tests, and 14 PostgreSQL-backed integration tests.
• A live Kafka/PostgreSQL Compose smoke test covered delivery, a republish at a new offset, conflict quarantine, malformed JSON quarantine, and migrations. It did not inject a worker crash between the PostgreSQL commit and Kafka offset commit.
• The repository was subsequently history-rewritten to remove earlier committed credential literals. No post-rewrite workflow run was reported, so this description does not claim one.

Delivery semantics and limits

Delivery is at least once, not exactly once. The projection is a derived event summary, not authoritative workflow state. Outbox publication still holds a database transaction while waiting for Kafka acknowledgement. The Outbox DLQ does not yet have an operator-controlled replay path. This remains a portfolio prototype, not production software.

Deployment security follow-up

The HTTPS-only example Gateway and readiness probe are included. If either old database credential was ever applied to a real environment, rotate it: rewriting Git history does not revoke a credential.

History cleanup

After the merge, the public main and PR branch histories were rewritten. Current branch heads are:

• main: fbdd6f3d3c220f4702eea11b8a1aef34b0bfd283
• codex/idempotent-inbox-event-id: 9a5ee0904a5d2747b50b8ab71e9b0651a0d812f4

Local scans found no exact matches for the removed credential literals in the Git object stores of the available checkouts. GitHub may retain pull-request refs or cached views of earlier commits; consult GitHub's sensitive-data removal guidance for the remaining cleanup process.