feat: implement T-019 reliable event ingress

tests/test_postgres_contract.py

@@ -62,6 +62,8 @@ class PostgresContractTests(unittest.TestCase):
                 "013_privileges_bell_events.sql",
                 "014_audit_relay.sql",
                 "015_privileges_audit_relay.sql",
+                "016_event_ingress.sql",
+                "017_privileges_event_ingress.sql",
             ],
             names,
         )
@@ -146,6 +148,28 @@ class PostgresContractTests(unittest.TestCase):
         self.assertIn("grant select, insert on table bell.audit_events to bell_runtime", privileges)
         self.assertIn("revoke all on table bell.audit_events, bell.audit_relay_receipts from sense_app", privileges)
 
+    def test_event_ingress_has_permanent_source_receipts_and_minimal_privileges(self) -> None:
+        migration = normalized(migration_text("016_event_ingress.sql"))
+        privileges = normalized(migration_text("017_privileges_event_ingress.sql"))
+        for marker in (
+            "create table if not exists bell.event_ingress_bindings",
+            "create table if not exists bell.event_ingress_receipts",
+            "primary key (producer_id, source_event_id)",
+            "create table if not exists bell.event_ingress_nonces",
+            "expires_at >= received_at + interval '10 minutes'",
+            "insert into bell.schema_migrations(version) values (5)",
+        ):
+            self.assertIn(marker, migration)
+        self.assertIn(
+            "grant select, insert on table bell.event_ingress_receipts to bell_runtime",
+            privileges,
+        )
+        self.assertIn(
+            "grant select, insert, delete on table bell.event_ingress_nonces to bell_runtime",
+            privileges,
+        )
+        self.assertNotIn("endpoint_ref", privileges.split("revoke all on table sense.devices")[1])
+
 
 if __name__ == "__main__":
     unittest.main()