feat: operationalise project bus for Sandbox

evidence/WP-PA-002-REVIEW-BRIEF.md

@@ -0,0 +1,32 @@
+# Independent Review Brief — WP-PA-002
+
+Reviewer: Claude Code (`REVIEWER`)  
+Implementer: Codex (`IMPLEMENTER`)
+
+Review only the exact commit supplied by the PA. Do not change, commit or push
+implementation code. Verify that the commit descends from accepted WP-PA-001
+commit `a2229bc26902e79d63a368e8ab002ebefd4f0863`.
+
+## Required review
+
+1. Match every acceptance criterion in `work-packages/WP-PA-002.md` to
+   implementation and independent evidence.
+2. Build and run the packaged application under Python 3.12.
+3. Build and run the container, confirm its health check and non-root identity.
+4. Bootstrap a fresh database twice and prove replay creates no extra events.
+5. Authenticate separately as PO, PM, PA, Codex and Claude; verify the roster,
+   event sync and pending-actions reads.
+6. Create a live backup, restore it in isolation, run integrity checks and
+   compare event cursors.
+7. Search Git history and the reviewed tree for committed credentials.
+8. Adversarially verify that bootstrap/operations tooling cannot weaken the
+   governance invariants accepted in WP-PA-001.
+9. Verify the runbook preserves SG/PTO/project-thread authority until the
+   independent `APPROVE` and PM `ACCEPT` activation gate.
+10. Check that no deployment is described as production-ready beyond the
+    constraints in `docs/PRODUCTION_PROFILE.md`.
+
+Write `REVIEW-REPORT-WP-PA-002.md` with exactly one verdict:
+`APPROVE`, `CHANGES_REQUESTED`, or `REJECT`. Include exact commit SHA,
+environment, commands, results, findings with severity, residual risks, and a
+machine-readable summary.