feat(bell): add alert acknowledgement vertical slice

tests/test_postgres_contract.py

@@ -64,6 +64,8 @@ class PostgresContractTests(unittest.TestCase):
                 "015_privileges_audit_relay.sql",
                 "016_event_ingress.sql",
                 "017_privileges_event_ingress.sql",
+                "018_bell_alerts.sql",
+                "019_privileges_bell_alerts.sql",
             ],
             names,
         )
@@ -170,6 +172,24 @@ class PostgresContractTests(unittest.TestCase):
         )
         self.assertNotIn("endpoint_ref", privileges.split("revoke all on table sense.devices")[1])
 
+    def test_alert_history_is_append_only_and_runtime_is_least_privilege(self) -> None:
+        migration = normalized(migration_text("018_bell_alerts.sql"))
+        privileges = normalized(migration_text("019_privileges_bell_alerts.sql"))
+        for marker in (
+            "create table if not exists bell.rule_versions",
+            "create table if not exists bell.event_rule_sweeps",
+            "create table if not exists bell.rule_evaluations",
+            "create table if not exists bell.alerts",
+            "create table if not exists bell.alert_events",
+            "create table if not exists bell.alert_transitions",
+            "create table if not exists bell.alert_command_receipts",
+            "insert into bell.schema_migrations(version) values (6)",
+        ):
+            self.assertIn(marker, migration)
+        self.assertIn("before update or delete", migration)
+        self.assertIn("grant select, insert on table", privileges)
+        self.assertNotRegex(privileges, r"grant\s+(?:update|delete|truncate|all)")
+
 
 if __name__ == "__main__":
     unittest.main()