security: fail closed period-report aggregates on mixed-visibility populations

[seonghobae]

Protected main@83eba56149eb802cd63642c507c324c9976ec78e has a verified aggregate-authorization gap in the period-report read model. Exact #1042 Strix artifact 34704740554 (sha256:bcdc13b76adf4a2b5b9cbbcab2de217db2e25f445f69d2de20a7d9f4cdf19b72) traced fetch_period_reports, list_period_report_summaries, and fetch_period_comparison: handlers filtered member rows through _can_see_post but could still emit precomputed mean_theta, calibration/item-information, leftover-map axes and coverage calculated over the full stored grouping when only a subset of contributing evidence was visible.

Repair PR #1054 is currently Ready only for exact-head validation, not merge-ready, on 4519c101f13e08c10653b95ff88d66b4ce47f0b8. The original application-boundary RED is preserved in run 34721645807. The causal repair suppresses a stored report aggregate unless every persisted member and leftover-pair contributor is visible to the caller's existing corporate/process-unit ABAC and passes the established demo-evidence exclusion. It does not recompute measurement outputs from a visible subset and does not expose hidden-member counts.

Run 34722378592 turned the original list/detail/comparison regressions GREEN. A subsequent production-shaped review found that fetch_period_comparison omitted source_post.process_unit_id from leftover-pair evidence, even though the shared source_post_visible contract requires that identity for private process-unit authorization. Run 34722582483 first proved that omission RED against the real comparison repository shape, then added the bound p.process_unit_id projection and serialized authorization metadata and reran the whole report-authorization test file GREEN.

The current head also contains an authenticated PostgreSQL/HTTP regression in backend/tests/test_api.py. It uses the existing Keycloak bearer fixture and throwaway migrated PostgreSQL database, seeds a real process-unit report, and proves the target aggregate is actually visible through detail, trend/list, and comparison endpoints before changing any authorization state. It then makes one persisted contributor private under a foreign tenant and requires those same three endpoints to suppress the precomputed aggregate. This positive precondition closes the earlier possibility that an absence-only test could pass for an unrelated reason. Bounded strengthening run 34723065257 completed SUCCESS and removed itself. The net product/test delta remains four paths: backend/app/main.py, backend/app/report_ingestion.py, backend/tests/test_api.py, and tests/test_period_report_whole_population_authorization.py.

Fresh validation on exact 4519c101... is now active. Repository Tests run 34723167232 has frontend lint/test/build/Storybook GREEN while the full PostgreSQL suite is still running. The push occurred while the PR was Draft, so central Security 34723086654, SAST 34723086683, CodeQL PR 34723086691, and the earlier Tests identity 34723086704 terminated action_required. After Ready, a fresh repository Tests identity materialized, but no fresh central Security/SAST/CodeQL identity has materialized yet. This unchanged-head lifecycle canary belongs to canonical .github#2045; do not create empty commits, toggle Draft/Ready repeatedly, synthesize success, or weaken leaf gates to compensate.

This integration is authoritative cross-tenant HTTP/PostgreSQL evidence. The current local bearer fixture resolves corporate affiliations but does not bind process-unit claims, so it is not represented as authenticated process-unit E2E. Private process-unit behavior is separately covered by production-shaped repository/application regressions until a Keyverse-bound fixture can express that scope.

Acceptance still outstanding before normal protected merge:

• let exact-head repository/PostgreSQL validation finish and preserve the receipt;
• obtain authenticated process-unit E2E when a Keyverse-bound fixture can express that scope, without weakening the current fail-closed contract;
• no caller-specific recalculation of theta/calibration/item information/leftover-map statistics and no hidden-population side channel;
• primary, list and comparison endpoints remain on the same whole-population rule;
• bound identities remain parameterized and measurement-owner implementations stay in fast-mlsirm/TEPP;
• one unchanged exact head passes repository/PostgreSQL/frontend, required Security/SAST/CodeQL/Strix/model review and qualifying independent approval before normal protected integration.

Intermediate-head workflow receipts are historical only and must not be transferred to this current head. Keep this issue open until #1054 or a verified successor carries the RED, causal fix, authenticated evidence and normal protected merge.

[seonghobae]

Exact 4519c101f13e08c10653b95ff88d66b4ce47f0b8 validation converged further. Repository Tests 34723167232 is now terminal GREEN, including frontend lint/test/build/Storybook and the full PostgreSQL suite; GitHub Advanced Security CodeQL on the same head reports no new alerts. The central required workflow set still did not rematerialize on the unchanged Ready head: the Draft-time Security 34723086654, SAST 34723086683, CodeQL PR 34723086691, and earlier Tests 34723086704 remain action_required, and no fresh required Security/SAST/CodeQL/Strix/model-review lane appeared. With no live validation lane left, #1054 has been returned to Draft rather than leaving a non-promotable Ready PR. Keep #1050 open; .github#2045 remains the canonical owner for this Ready-reconciliation/materialization defect. No empty commit, Draft/Ready oscillation, manual success status, or leaf-side gate weakening was used.