Revenue acknowledges ADR-0016 medallion warehouse layout with a consumer-scoped application mart
Revenue has read ADR-0016 (Proposed) and agrees with the data access model: bronze raw per-domain source, conform-only wide silver, a single materialized gold mart with consumer-scoped sections, cross-domain composition allowed in gold and nowhere else, and the consumer firewall as the structural enforcement of that placement rule. Revenue has no contract correction to ADR-0016 itself. Silver as a published, versioned contract is the right discipline, and it is the same boundary Revenue already relied on in its 2026-05-19 mart-registry section review and the silver-gap classification reply filed 2026-05-22.
Revenue's slice
Revenue's operational source database is bronze, raw and untouched as Revenue writes it. The revenue silver face is conform-only and wide: it resolves grain to canonical person_id (ADR-0003) and conforms types, naming, and drops per warehouse-model-discipline §2, with no narrowing and no cross-domain logic. The existing revenue.event_log (the heterogeneous-grain V1 pre-shaped on 2026-05-12, with explicit primary_entity_type and primary_entity_id and the five categories) re-tiers as the gold revenue section built over that silver face, and Revenue scopes its own section's content. This is a re-tiering, not a rebuild, which is the right call.
One ask on silver's conform scope
Revenue owns money truth, and Finance reads the revenue silver face to reconcile commercial truth in its gold section. So the revenue silver face has to stay wide enough that the cross-silver Finance composition preserves three Revenue invariants. None of these is a change to ADR-0016; they are the conform-scope Revenue will hold the silver contract to, and they line up with the ADR's own "silver too thin reopens" trigger.
First, writeback-separation. Provider success and internal writeback success are distinct facts (the rule that came out of the Square double-charge incident). Silver must not collapse them into one status column. payment.received carries payment_path (invoice_paid versus active_charge); the disambiguation has to survive conform.
Second, the reconciliation facts. Refund-cycle duration and funding-sub-state lag are ledger_reconciliation-category facts, not customer-journey counts. Silver and the Finance gold section must keep them in the reconciliation category rather than blending them into journey or active-student counts.
Third, the release reason-code partition. Auto-release versus explicit-operator reason codes are partitioned in credit.released v2 §6.1. That partition has to stay visible through silver so downstream reconciliation can route on it without re-deriving from initiator.
Revenue will review the contracts/warehouse-silver/ revenue-face shape against these three when Platform publishes it, and will raise any gap on the silver contract thread rather than here.
References
adrs/ADR-0016-medallion-warehouse-data-access-model.md(the ADR; Proposed)standards/engineering/warehouse-model-discipline.md(model shape; the §2 conform rules)2026-05-19-revenue-mart-registry-revenue-section-review,2026-05-19-revenue-mart-100-percent-deployment-reply(Revenue's prior mart-section positions)contracts/credit-reservation-lock/README.md§6.1 (the auto-release versus explicit-operator reason-code partition)