Add user preference and history protocol contracts

[KazanderDad]

Parent Goal: Goal: SDK contracts for authenticated user portal surfaces
Depends on: architecture/API-contract task
Blocks: Refresh generated artifacts and SDK validation evidence

Objective

Add canonical protocol/OpenAPI contracts for user preference and user history portal surfaces when those contracts are public or cross-repo.

Expected Surfaces

• packages/protocol/schemas/*
• packages/protocol/src/index.ts
• packages/protocol/src/validators.ts
• packages/protocol/src/fixtures.ts
• packages/protocol/src/protocol.test.ts
• api/openapi.yaml

Scope

• Prioritized receive paths/wallets across registered PayToDapps.
• User route preference reads/writes.
• Resolve question summaries and returned answer/status summaries.
• Exact quote detail records and selected quote records.
• Payment intent summaries and transaction/receipt summaries.
• Privacy-safe negative/error states.

Non-Goals

• Do not expose private Supabase table shapes or service-role details.
• Do not add Cubid identity issuance or grant management contracts unless explicitly classified as a Cubid/MyPayTag boundary by the architecture task.

Guardrails

• Contracts must be user-scoped and safe for public or partner consumption.
• Exact quote detail contracts may include provider names, amounts, fees, expiry, and route steps, but not private credentials or unrelated wallet graph data.

Acceptance Criteria

• New or updated schemas validate representative fixtures for preferences, questions, answers, quotes, selected quotes, payment intents, and receipts.
• OpenAPI components and examples match protocol schemas.
• Tests fail for missing required auth/user scoping fields and forbidden private fields.

Validation Plan

• pnpm generate
• pnpm api:validate
• pnpm test
• pnpm scan:public-boundary

Stop Condition

Stop after schemas, validators, fixtures, OpenAPI components, and focused tests are updated, with generated artifacts ready for the next task.

[KazanderDad]

Vetting Addendum\n\nImplementation worktree: /Users/botmaster/src/myPayTag/mypaytag-sdk-5-user-portal, branch codex/5-user-portal-sdk, base origin/dev. Use this same SDK sprint worktree for SDK issues #4, #5, and #6. Create it with git fetch origin && git worktree add ../mypaytag-sdk-5-user-portal -b codex/5-user-portal-sdk origin/dev if it does not already exist. Retain until the sprint PR is merged and approved-cleanup runs.\n\nThis is cross-repo contract work, so independent validation is required. Issue Validator: after implementation, local validation, session-log update, and commit, run issue-validator before moving this issue to In Review. Provide issue URL, parent URL, commit hash, worktree path, changed files summary, validation commands/results, smoke result, visual evidence for UI-facing work or N/A, and boundaries/non-goals. Validator reports pass, pass-with-notes, or fail to the orchestrator.\n\nImplementation expectations: update code, technical docs, tests, and agent-context/session-log/main.md as relevant before committing. Commit exactly this issue scope, include the issue number in the commit message, and comment with commit hash, validation evidence, smoke result, boundary check, and residual risks.

[KazanderDad]

Implementation Evidence

Implemented in commit f558043 on worktree /Users/botmaster/src/myPayTag/mypaytag-sdk-5-user-portal, branch codex/5-user-portal-sdk.

Changed files:

• Added portal preference/history JSON Schemas under packages/protocol/schemas/.
• Added generated protocol schema/type source under packages/protocol/src/generated/.
• Added validators, fixtures, and focused protocol tests.
• Added OpenAPI Portal endpoints and components for /portal/preferences and /portal/history.
• Updated agent-context/session-log/main.md.

Validation run:

• pnpm generate: passed
• pnpm build: passed
• pnpm api:validate: passed
• pnpm test: passed, 64 tests across workspace package runs
• pnpm scan:public-boundary: passed
• git diff --cached --check: passed before commit

Smoke test: N/A for protocol-only work; OpenAPI portal examples are validated against canonical protocol validators in packages/protocol/src/protocol.test.ts.

Boundary check:

• No private Supabase table shapes or service-role concepts were added to contracts.
• Portal responses require user-scoped envelopes and reject private/wallet/provider diagnostic fields.
• Cubid-owned identity issuance and grant management remain out of scope.

Residual risk:

• Distribution/package artifacts remain for MyPayTag-sdk#6.

[KazanderDad]

Issue Validator Report

Result: pass

Target issue: MyPayTag-sdk#5 Add user preference and history protocol contracts
Commit reviewed: f558043

Evidence reviewed:

• Commit diff and changed files.
• Implementation evidence comment above.
• Portal schema, validator, fixture, OpenAPI, and test references.

Validation commands rerun or inspected:

• Reran pnpm api:validate: passed.
• Reran pnpm scan:public-boundary: passed.
• Inspected prior implementation evidence for pnpm generate, pnpm build, and pnpm test: passed.
• Verified OpenAPI portal examples are covered by protocol validator tests.

Boundary check:

• Contracts are user-scoped and reject private/wallet/provider diagnostic fields.
• No Cubid-owned identity issuance or grant-management contract was added.
• No private Supabase table shape or service-role language is exposed in the new public contract surface.

Ready for In Review: yes.