refactor(knowledge): close Source Ledger module

.tegami/close-source-ledger-module.md

@@ -0,0 +1,15 @@
+---
+packages:
+  orgmemory: patch
+subject: Close the Source Ledger module boundary
+---
+
+# Close the Source Ledger module boundary
+
+## Improvements
+
+Source Ledger now enforces a closed public API and an explicit allowlist for
+its ACL, storage, organization, permission, and shared dependencies.
+
+This completes the mechanical closure gate required by the independent
+[Claude Fable 5 architecture challenge](../docs/increments/active/2026-07-31-spring-modulith-package-refactor/challenge-verdict.md).

core/src/main/java/com/orgmemory/core/knowledge/sourceledger/package-info.java

@@ -3,9 +3,17 @@
  *
  * <p>Retrieval now implements source-owned visibility and embedding-profile ports, so this
  * module no longer depends on Retrieval, Asset, Space, Graph, or Connector. ACL persistence
- * is accessed only through ACL-owned facade contracts; the module remains open while its
- * broader external consumer surface is reduced for closure.
+ * is accessed only through ACL-owned facade contracts. The module is closed so external
+ * consumers can depend only on its public API surface.
  */
 @org.springframework.modulith.ApplicationModule(
-        type = org.springframework.modulith.ApplicationModule.Type.OPEN)
+        allowedDependencies = {
+            "knowledge.acl",
+            "knowledge::storage",
+            "organization",
+            "permission",
+            "shared",
+            "shared::error"
+        },
+        type = org.springframework.modulith.ApplicationModule.Type.CLOSED)
 package com.orgmemory.core.knowledge.sourceledger;

core/src/test/java/com/orgmemory/core/ModulithVerificationTests.java

@@ -1,6 +1,7 @@
 package com.orgmemory.core;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static com.tngtech.archunit.lang.syntax.ArchRuleDefinition.noClasses;
 
@@ -40,10 +41,23 @@ void knowledgeSpaceIsAnOpenNestedModuleDuringTheRefactor() {
     }
 
     @Test
-    void sourceLedgerIsAnOpenNestedModuleDuringTheRefactor() {
+    void sourceLedgerIsAClosedNestedModule() {
         var sourceLedger = modules.getModuleByName("knowledge.sourceledger").orElseThrow();
+        var allowedDependencies = sourceLedger.getAllowedDependencies(modules).stream()
+                .map(Object::toString)
+                .map(dependency -> dependency.replace(" :: ", "::"))
+                .collect(TreeSet::new, Set::add, Set::addAll);
 
-        assertTrue(sourceLedger.isOpen());
+        assertFalse(sourceLedger.isOpen());
+        assertEquals(
+                Set.of(
+                        "knowledge.acl",
+                        "knowledge::storage",
+                        "organization",
+                        "permission",
+                        "shared",
+                        "shared::error"),
+                allowedDependencies);
     }
 
     @Test

docs/increments/active/2026-07-31-spring-modulith-package-refactor/design.md

@@ -287,6 +287,19 @@ objects. Source Ledger still consumes ACL-owned command/value contracts in the
 intentional one-way direction; an exact Modulith dependency assertion pins
 that surface so repositories or entities cannot leak back across the seam.
 
+## First Module Closure
+
+Source Ledger is the first extracted Knowledge slice to move from migration
+state to a closed Spring Modulith module. Its outgoing dependency policy names
+only ACL's public API, the parent Knowledge storage named interface,
+organization, permission, and the shared base/error contracts.
+
+The closed-module verification succeeds without publishing a new named
+interface because Source Ledger's intentional consumer contracts already live
+in its module base package, while no consumer reaches an internal subpackage.
+The closure test and `modules.verify()` make both that API visibility and the
+outgoing allowlist executable constraints.
+
 ## Strongest Counterargument
 
 Ordinary internal subpackages would reduce directory size immediately and

docs/increments/active/2026-07-31-spring-modulith-package-refactor/plan.md

@@ -454,7 +454,7 @@ required CI checks passed. Its actionable CodeRabbit finding was fixed in
 `fc8b3be5`, confirmed by the reviewer, and the only review thread was resolved
 before merge.
 
-## Current Pull Request Gates
+## Eighteenth Pull Request Evidence
 
 - ACL owns a transactional facade for validation, snapshot/entry/seal
   persistence, head advancement, and normalization/promotion readiness.
@@ -476,3 +476,36 @@ files and 8 mirrored domain pairs; all 37 release-policy tests passed; and the
 terminating repository `clean test` gate completed successfully in 5m46s
 across 108 tasks. Diff hygiene, the zero Source Ledger-to-ACL-persistence scan,
 and the 12-path PR limit check passed.
+
+PR #209 merged as `daeeb75adf3a6396522778ef9f5e7a7c83854935` after all
+required CI checks passed. CodeRabbit was rate limited, and direct inspection
+confirmed zero inline comments, reviews, or review threads before merge.
+
+## Current Pull Request Gates
+
+- `knowledge.sourceledger` is a closed nested application module rather than
+  an open migration module.
+- Its outgoing allowlist is limited to `knowledge.acl`, `knowledge::storage`,
+  organization, permission, shared, and `shared::error`.
+- `modules.verify()` passes, proving current consumers use only Source Ledger's
+  public module surface and no undeclared outgoing edge exists.
+- Focused Modulith and Source Ledger consumer tests pass; `:core:test` and the
+  terminating repository `clean test` gate pass.
+- The pull request contains production module metadata and tests, remains below
+  100 files, and completes CI/review/merge before the next Knowledge module is
+  assessed for closure.
+
+Pre-PR verification completed: the initial closed-module probe passed; the
+explicit outgoing allowlist passed `modules.verify()`; focused Source Ledger,
+Connector, API, Worker, and Modulith tests passed in 1m47s; `:core:test` passed
+in 1m24s; the docs operating-model check passed across 399 Markdown files and
+8 mirrored domain pairs; all 37 release-policy tests passed; and the
+terminating repository `clean test` gate completed successfully in 6m30s
+across 108 tasks. Diff hygiene and the under-100-file scope check passed.
+
+CodeRabbit requested that the regression test pin the exact outgoing allowlist
+and that the release note link the existing independent architecture
+challenge. Both review findings are addressed without rerunning the settled
+challenge or changing the closure outcome. The focused Modulith, docs, and
+release gates passed, and the terminating repository `clean test` gate passed
+again in 1m23s across 99 tasks using the shared build cache.