refactor(knowledge): close ACL module

.tegami/close-acl-module.md

@@ -0,0 +1,15 @@
+---
+packages:
+  orgmemory: patch
+subject: Close the Knowledge ACL module boundary
+---
+
+# Close the Knowledge ACL module boundary
+
+## Improvements
+
+Knowledge ACL now enforces a closed public API with an explicit dependency
+allowlist limited to `organization`, `permission`, `shared`, and
+`shared::error`. This completes the ACL closure required by the existing
+[Claude Fable 5 architecture verdict](../docs/increments/active/2026-07-31-spring-modulith-package-refactor/challenge-verdict.md)
+after its sibling implementation edges were replaced with owned APIs.

core/src/main/java/com/orgmemory/core/knowledge/acl/package-info.java

@@ -5,9 +5,15 @@
  * depends on either implementation. Its source-ingestion facade owns ACL validation,
  * snapshot/head persistence, sealing, and readiness queries without exposing JPA types. The
  * Retrieval and Graph consume immutable facts through ACL-owned facades rather than repositories
- * or persistence entities. The module remains open only until its public contracts and outgoing
- * dependency allowlist are mechanically verified for closure.
+ * or persistence entities. The closed boundary exposes only types in this root package and limits
+ * outgoing dependencies to organization, permission, and shared foundations.
  */
 @org.springframework.modulith.ApplicationModule(
-        type = org.springframework.modulith.ApplicationModule.Type.OPEN)
+        type = org.springframework.modulith.ApplicationModule.Type.CLOSED,
+        allowedDependencies = {
+            "organization",
+            "permission",
+            "shared",
+            "shared::error"
+        })
 package com.orgmemory.core.knowledge.acl;

core/src/test/java/com/orgmemory/core/ModulithVerificationTests.java

@@ -131,10 +131,21 @@ void sourceLedgerDoesNotDependOnGraphImplementation() {
     }
 
     @Test
-    void knowledgeAclIsAnOpenNestedModuleDuringTheRefactor() {
+    void knowledgeAclIsAClosedNestedModule() {
         var acl = modules.getModuleByName("knowledge.acl").orElseThrow();
+        var allowedDependencies = acl.getAllowedDependencies(modules).stream()
+                .map(Object::toString)
+                .map(dependency -> dependency.replace(" :: ", "::"))
+                .collect(TreeSet::new, Set::add, Set::addAll);
 
-        assertTrue(acl.isOpen());
+        assertFalse(acl.isOpen());
+        assertEquals(
+                Set.of(
+                        "organization",
+                        "permission",
+                        "shared",
+                        "shared::error"),
+                allowedDependencies);
     }
 
     @Test

docs/increments/active/2026-07-31-spring-modulith-package-refactor/plan.md

@@ -514,7 +514,7 @@ PR #210 merged as `4feaf5ca3a89b254c57932d2441747ced5c56b04` after all
 required CI checks passed. CodeRabbit confirmed both fixes and resolved both
 review threads before merge.
 
-## Current Pull Request Gates
+## Twentieth Pull Request Evidence
 
 - ACL owns a read-only `SourceAclQuery` and immutable snapshot/Space-generation
   facts for sibling consumers.
@@ -545,3 +545,33 @@ authorization-consolidation changes, focused boundary tests passed in 46s, the
 docs check passed across 415 Markdown files, all 37 release-policy tests passed,
 and the terminating `clean test` completed successfully in 5m53s across 99
 tasks. The PR diff remains 16 paths.
+
+PR #213 merged as `6e8e5fe2d357f217d9c0bf16716576046a2bba8e` after all
+required CI checks passed. CodeRabbit was rate limited, and direct inspection
+confirmed zero inline comments, reviews, or review threads before merge.
+
+## Current Pull Request Gates
+
+- `knowledge.acl` is a closed nested application module rather than an open
+  migration module.
+- Its outgoing allowlist is limited to organization, permission, shared, and
+  `shared::error`.
+- `modules.verify()` passes, proving existing consumers use only ACL's public
+  root-package contracts and no undeclared outgoing edge exists.
+- The closure regression test pins both the closed state and the exact
+  four-entry dependency allowlist.
+- Focused ACL and Modulith tests, `:core:test`, docs/release checks, and the
+  terminating repository `clean test` gate pass.
+- The pull request contains production module metadata and tests and remains
+  below 100 changed files before the next Knowledge module is assessed.
+
+Pre-PR verification completed: focused ACL and Modulith tests passed in 25s;
+`:core:test` passed in 1m08s; the docs operating-model check passed across 417
+Markdown files and 8 mirrored domain pairs; all 37 release-policy tests passed
+under Node 24.15; and the terminating repository `clean test` gate completed
+successfully in 5m07s across 99 tasks. Diff hygiene, the zero ACL sibling-import
+scan, and the four-path PR scope check passed.
+
+CodeRabbit requested that the release note spell out `shared::error` instead
+of grouping it under vague shared-foundation wording. The note now mirrors the
+exact four-entry allowlist already enforced by production metadata and tests.