agent-trace-dwh-replica: Implement Turso Sync replica boundary

The DWH adapter lacked a single-owner connection boundary for bootstrapping and synchronizing repository replicas. Add lock-before-open Turso Sync ownership, non-provisioning schema readiness checks, pull and push operations, credential-safe diagnostics, and a shared connection/runtime seam.

Cover bootstrap, contention, bidirectional synchronization, reconstruction, and incompatible-schema behavior with unit and local sync-server integration tests. Document the resulting operating constraints.

Plan: agent-trace-dwh-turso-sync-replica (T02)

Record the accepted single-owner, disposable replica decision and make the implemented boundary discoverable from the architecture and context map.

Mark the plan acceptance criteria and T03 complete, capture validation evidence and residual risk, and remove the standalone unreachable-remote redaction test while retaining direct redaction coverage.

Plan: agent-trace-dwh-turso-sync-replica (T03)

Co-authored-by: SCE <sce@crocoder.dev>

Author: davidabram

cli/Cargo.lock

@@ -29,7 +29,7 @@ path = "src/main.rs"
 anyhow = "1"
 chrono = "0.4"
 clap = { version = "4", features = ["derive"] }
-turso = { version = "0.7.0" }
+turso = { version = "0.7.0", features = ["sync"] }
 clap_complete = "4"
 dirs = "6"
 fs4 = "0.13.1"

cli/Cargo.toml

@@ -2,12 +2,18 @@
 //!
 //! This module owns the canonical repository-scoped bridge lock proving
 //! exactly one process owns the local `agent-trace-sync.db` Turso Sync
-//! replica at a time. It never touches the multiprocess-WAL source capture
-//! database (`crate::services::agent_trace_db`) and does not itself open a
-//! Turso Sync connection: that is a later boundary built on top of the lock
-//! established here.
+//! replica at a time, and the [`AgentTraceDwhReplica`] type that is the sole
+//! owner of a Turso Sync builder for that replica. It never touches the
+//! multiprocess-WAL source capture database
+//! (`crate::services::agent_trace_db`), never enables that database's
+//! `experimental_multiprocess_wal` flag, and never provisions the DWH schema
+//! locally: it only verifies the schema an already-bootstrapped replica
+//! reports.
 
 mod lock;
+mod replica;
 
 #[allow(unused_imports)]
 pub use lock::{BridgeLock, BridgeLockError};
+#[allow(unused_imports)]
+pub use replica::{AgentTraceDwhReplica, AgentTraceDwhReplicaConfig, AgentTraceDwhReplicaError};