Closes #353

Summary

Production sellers running ADCP_ENV=production were blocked from HITL flows because InMemoryTaskRegistry.is_durable=False trips the production-mode gate in create_adcp_server_from_platform. The gate error message literally says "v6.1 ships PostgresTaskRegistry" — this PR delivers it.

Adds PostgresTaskRegistry: a durable TaskRegistry implementation backed by a decisioning_tasks Postgres table. Wiring is a one-line change for adopters:

from psycopg_pool import AsyncConnectionPool
from adcp.decisioning import PostgresTaskRegistry, serve

async with AsyncConnectionPool("postgresql://...") as pool:
    registry = PostgresTaskRegistry(pool=pool)
    await registry.create_schema()  # idempotent; safe on every boot
    serve(MyPlatform(), registry=registry)

Implementation note — psycopg over SQLAlchemy: The issue referenced "SQLAlchemy ORM model." The TaskRegistry Protocol is fully async; psycopg_pool.AsyncConnectionPool (already in the [pg] extra) is a natural drop-in with no new dependency, while SQLAlchemy async ORM would add a heavyweight dep and an AsyncSession lifecycle that doesn't compose cleanly with the Protocol's one-connection-per-call shape. Both expert reviewers converged on psycopg.

Files changed

Key correctness properties

• Cross-tenant isolation at SQL level: get() uses WHERE task_id = %s AND (%s IS NULL OR account_id = %s) — account scoping is in the WHERE predicate, not Python-level filter after fetch.
• Atomic terminal transitions: complete() and fail() use UPDATE ... WHERE state NOT IN ('completed', 'failed') RETURNING task_id. If zero rows return, a follow-up SELECT determines unknown vs. idempotent vs. conflict — no TOCTOU across workers.
• Terminal-state guard on progress: update_progress() uses WHERE state NOT IN ('completed', 'failed') so straggler writes can't resurrect completed tasks.
• is_durable: ClassVar[bool] = True set at class level (not instance), matching what serve.py:194 checks.
• account_id validation in issue() copied verbatim from InMemoryTaskRegistry — rejects empty, whitespace, and "<unset>" values.

What's tested

• pytest tests/test_decisioning_pg_task_registry.py — runs without real DB; covers stub import, is_durable, account_id validation, Protocol structural matching
• tests/conformance/decisioning/test_pg_task_registry.py — full lifecycle, cross-tenant security, idempotency, concurrent issue — requires ADCP_PG_TEST_URL

Note: The pg-replay-store CI job should be extended to also run tests/conformance/decisioning/test_pg_task_registry.py (cannot edit .github/workflows from triage PRs — flagged as a nit for human reviewer).

Pre-PR review

• code-reviewer: approved after fixing — _table internal param added for test isolation, pre-formatted SQL, unused logging removed, stub ClassVar annotation corrected, missing complete/fail(unknown) conformance tests added.
• dx-expert: approved — adopt path clear, create_schema() + raw DDL file covers both boot-and-go and migration-tool adopters, from adcp.decisioning import PostgresTaskRegistry is discoverable. SQL file now in wheel via pyproject.toml fix.

Nits surfaced (not fixed in this PR)

• CI pg-replay-store job doesn't run decisioning conformance tests (.github/workflows edit needed — out of triage PR scope)
• No example file showing Postgres wiring end-to-end (follow-up)
• Cross-terminal behavior (complete() after fail()) undocumented in Protocol — follow-up to align InMemoryTaskRegistry and document in Protocol docstring

Triage-managed PR. This bot does not currently iterate on
review comments or PR conversation threads (only on the source
issue). To unblock:

• Push fixup commits directly: gh pr checkout <num> →
  fix → push.
• Or re-trigger: comment /triage execute on the source
  issue.

See adcp#3121
for context.

Session: https://claude.ai/code/session_01L8ig1NtL6WZQcYge3RKrb3

Generated by Claude Code