security: separate resolved customer identity from source-post tenant ownership

[seonghobae]

Protected main@83eba56149eb802cd63642c507c324c9976ec78e has the Customer Master tenant-boundary/domain-model defect reproduced in POST /api/customer-master/resolve-hint: resolved customer identity had been conflated with source_post.corporate_entity_id, which is authorization ownership. Accepted ADR 0042 requires raw customer identifiers to remain evidence and resolved catalog identity/provenance to be stored separately.

#1055 remains the single LineageWeave source repair lane at exact 50c4935eef1029467595f7004818643598b737c9, now Draft. The validation-only Ready admission ended after Strix terminalized. Repository Tests 34746058653 (including full PostgreSQL/frontend), Security 34746058657, SAST 34746058639, and Strix 34746057545 are terminal SUCCESS. Required CodeQL 34746058693, Noema 34746057619, and OpenCode 34746057593 remain terminal FAILURE at their canonical owner boundaries (.github#1929/#2106, contextual-orchestrator#1106, .github#2045 respectively); no leaf workaround or synthetic status is permitted.

Strix job 103694153476 completed Run Strix (quick) successfully and uploaded artifact 10318318320, digest sha256:45c82c7f1f044185a4795b4b4db37d2ce30346e44e516ce027f2bf53fe89581e. Artifact inspection is material: it contains one Medium CWE-862 finding. The post_read-gated GET /api/posts/{post_id}/summary can derive a missing summary and pass live hierarchy/verification clients to persist_post_summary, which can create/update the shared global corporate_entity catalog. Protected main independently contains the same path. This is tracked as #1078 and is a promotion blocker; Strix workflow SUCCESS must not be interpreted as zero findings.

The #1055 Customer Master repair itself preserves source corporate/process authorization ownership, stores resolution in migration 0250, delegates catalog binding to the existing corporate-entity owner, runs external corroboration after releasing source-evidence DB ownership, then reacquires a short transaction to revalidate/share-lock the exact captured source set and idempotently persist the association. Raw source_post.source_customer_code evidence is preserved; request matching is normalized; blank-only input fails 422; tied exact catalog labels fail closed; Customer Master projects one coherent latest resolution row. ADR 0374 remains Proposed until protected integration.

The public response/shared-eligibility contracts remain current. Current exact head includes the minimal fixture repair for qualified source_post.* SQL; production authorization/persistence semantics were not weakened. Real PostgreSQL + Keycloak + Valkey authenticated topology remains #1057's owner and must not be duplicated here.

A separate buyer-path resilience gap remains #1077: canonical corporate-entity resolution can retain a borrowed asyncpg pool lease across hierarchy/provider I/O despite correctly delaying explicit transaction/advisory locking. #1077 controls resource ownership; #1078 controls mutation authorization. They are distinct invariants and neither moves catalog semantics into Customer Master or contextual-orchestrator.

Acceptance remains: caller-scoped evidence only; source tenant/process ownership never rewritten; normalized/idempotent resolution association with raw provenance; canonical catalog-owner consumption; no external network call while source-row transaction/explicit lock is held; stale/concurrent scope changes fail closed; parameter-bound authorization; ordinary-hosted response-shape and shared-eligibility contracts; #1057 real-service authenticated cross-tenant E2E; #1078 RED→GREEN and Strix closure; touched production docstring acceptance; resolved review threads; and one unchanged current product head with repository/PostgreSQL/frontend, Security/SAST/Required CodeQL, terminal acceptable Strix/OpenCode/Noema, and qualifying independent approval GREEN before normal protected integration.

No broad post_admin substitution for summary reads, Keyverse copy, source-field rebinding, local catalog algorithm, cross-service SQL, warning suppression, skipped-E2E-as-GREEN claim, provider/model override, no-op validation churn, lifecycle flip loop, fabricated status, or pool-size workaround.

[seonghobae]

Repair is now active in #1055. Exact validation-admission head is 77e7c8bd8bacb8f0ce30dd9e5ddd71c30a7632da.

Implemented so far: migration 0250 + rollback, Proposed ADR 0374, explicit CurrentAccount corporate/process scope at the HTTP boundary, scoped source-evidence capture owned by post_eligibility, DB-resource release before external corroboration, exact-source FOR SHARE revalidation in a short persistence transaction, fail-closed scope drift, normalized/idempotent source_post_customer_resolution, no source-post tenant-field rebind, Customer Master read-model consumption of the normalized association, and a live PostgreSQL cross-tenant regression proving only the authorized tenant's source gets the resolution association while both posts retain original ownership.

The temporary bounded patch workflows/scripts used to safely modify main.py were removed from the resulting branch. One earlier repair runner failed and was removed; the replacement endpoint/read-model runners completed successfully before self-removal.

#1055 is Ready only to obtain fresh exact-head validation. Do not close #1052 yet: authenticated HTTP/E2E cross-tenant evidence and the full Security/SAST/CodeQL/Strix/model-review/independent-approval promotion set are still required.

[seonghobae]

Repair PR #1055 advanced to exact e11ff8698f20afc4ac628a6a86611ad1348c3fcb. The ADR 0042 boundary remains intact: source-post corporate/process ownership is never rebound; normalized customer resolution is persisted separately. Review follow-up also fixed four validated defects: whitespace-only hints are rejected at the HTTP model boundary; matching uses normalized hint identity while the association preserves the actual raw source_post.source_customer_code; Customer Master resolution metadata is selected coherently from one deterministic newest resolution row; and the focused test helper no longer violates Ruff B008. Cross-tenant bearer/PostgreSQL coverage now includes a foreign same-hint source exclusion, raw whitespace preservation, and coherent latest-resolution read-model metadata. Temporary repair workflow/script self-removed. The PR is Ready only to admit fresh exact-head validation. Repository Tests materialized (34730379137), but central required workflows deferred while Draft have not yet rematerialized on the unchanged head; canonical control-plane canary recorded at .github#2045. Keep #1052 open until exact-head PostgreSQL/full suite plus authoritative Security/SAST/CodeQL/model review and normal protected integration are complete.

[seonghobae]

#1055 advanced from predecessor 7dbd133320d8b12bde394569955e0ae6503f8f39 after terminal validation exposed one remaining acceptance gap rather than a product regression. The predecessor completed repository/full-PostgreSQL Tests, Security, SAST, dynamic CodeQL/Code Quality, Noema and Strix successfully; Required CodeQL/OpenCode remained non-green for their existing control-plane/coverage conditions. It was therefore returned to Draft before further source work.

Two ordinary non-force commits then closed the docstring/test-contract gap without changing Customer Master production semantics: 080994cdc40bea2d4dc547329cda1ff080bfd5e2 documents the focused ingestion test doubles/helpers and verifies the exact normalized-association INSERT argument tuple, and 4a8721ca1758dd717c333cd7dd1ce4f652b203fa documents the live PostgreSQL ownership proof. Final causal commit b26e5391d087e2e9610a8c0d52eaeb68f1f912a7 adds an executable AST contract requiring docstrings on every production function owned/touched by this repair (customer_hint_ingestion, post_eligibility, and the Customer Master HTTP/read-model boundaries).

#1055 is Ready only as exact-head validation admission on b26e5391.... This real source/test head movement materialized all ten expected repository/central lanes, including fresh Security/SAST/Required CodeQL, Strix, OpenCode and Noema identities; they are currently queued/running. Predecessor receipts and approvals are historical only and will not be transferred. Keep #1052 open until the same exact head is fully green/reviewed and normally integrated into protected main.

[seonghobae]

추가 DDD finding을 확인해 #1055를 다시 Draft로 내리고 repair를 진행했습니다. 기존 repair가 source-post tenant/process ownership과 resolved customer identity를 분리한 방향은 맞았지만, customer_hint_ingestion 안에서 lower(entity_name)으로 corporate_entity를 직접 조회하고 없으면 직접 INSERT하는 제3의 catalog identity 경로를 만들고 있었습니다. 이는 accepted ADR 0010의 get_or_create_corporate_entity 단일 creation/resolution owner, ADR 0012의 creation concurrency contract, ADR 0160의 corroborated alias/tied-candidate binding을 우회합니다. corporate_entity.entity_name 자체도 schema unique identity가 아닙니다.

Realistic RED를 tests/test_customer_hint_resolution_ownership.py에 추가해 Customer Master가 canonical get_or_create_corporate_entity를 소비하고 local where lower(entity_name) / direct insert into corporate_entity를 가지지 못하게 했습니다. Production repair는 customer-name corroboration 뒤 source-row lock을 잡지 않은 상태에서 canonical corporate catalog owner에 binding을 위임하고, 그 결과 id를 받은 뒤에만 기존 짧은 source revalidation/FOR SHARE transaction에서 association을 저장합니다. 따라서 canonical owner의 hierarchy/alias/concurrency 규칙은 재사용하고, source authorization lock을 external inference/verification 동안 유지하지 않습니다. Unit/live-PostgreSQL regressions와 ADR 0374도 같은 경계로 갱신했습니다.

현재 branch는 API call-site wiring을 같은 non-force branch 위에서 마무리하는 bounded self-removing repair lane을 실행 대기 중입니다. 최종 causal head가 만들어지기 전의 validation receipt는 promotion evidence로 사용하지 않습니다. #1052는 계속 open 유지합니다.

[seonghobae]

Fresh #1055 lifecycle update on exact 08a08108a87657ad427a6b6fa9b1b327166b0c9e:

• Strix 34734708382 / 103665605436 is now terminal FAILURE, not live. Admission/workspace/CO sidecar/install/input preparation succeeded; Run Strix (quick) stopped after the long-running provider path failed.
• Uploaded strix-reports artifact 10312018582 (sha256:77b9dbed73fa593f285f394e6e7b04231625b5ef2492a7325f28698d3d6c5440) has run.json.status="stopped", 53 LLM requests / 2,414,841 tokens and zero SARIF results. Zero findings are not treated as GREEN because the scan did not complete authoritatively. The terminal path is provider/rate-limit/timeout related and is recorded on canonical contextual-orchestrator#1106; no provider/model override is being introduced in LineageWeave.
• With Required CodeQL/OpenCode/Noema already terminal FAILURE and no validation lane left alive, fix(customer-master): separate customer resolution from source ownership #1055 has been returned to Draft.
• The remaining LineageWeave-owned RED is still the stale authenticated Customer Master exact response plus missing ordinary-hosted response-shape contract. A bounded single-writer repair is staged on the same branch; it must reproduce executable RED, add a pure runtime serializer contract, update the existing authenticated expectation, remove its temporary workflow from the resulting tree, and publish only if the branch has not moved. Full PostgreSQL+Keycloak+Valkey hosted topology remains test(e2e): run authenticated FastAPI contract lane in hosted CI instead of service-wide skip #1057 ownership.

[seonghobae]

Authority update for #1055 current exact head 50c4935eef1029467595f7004818643598b737c9.

Predecessor 8448a2b4... surfaced a real repository RED in Tests 34743575403: frontend lint/test/build/Storybook was GREEN, while the PostgreSQL suite finished 2 failed, 1777 passed, 147 skipped. The failures were test_corroborated_resolution_persists_separate_association and test_corroborated_resolution_reuses_existing_catalog_entity.

RCA: the production Customer Master authorization/resolution boundary was not the failure. After the shared literal SQL was correctly qualified with source_post.*, the unit fake in tests/test_customer_hint_ingestion.py still matched the old unqualified select post_id, post_title / select post_id from source_post strings. It therefore returned no captured evidence and made resolve_customer_hint correctly return None; the concurrent-scope regression also stopped reaching its intended revalidation phase.

Causal repair 50c4935e... changes only those fake recognizers to the canonical qualified SQL (select source_post.post_id, source_post.post_title and select source_post.post_id from source_post ... for share). Production authorization, persistence, scope, locking, provider/model and workflow behavior are unchanged.

Because this was a verified causal commit while #1055 was Ready, fresh current-head validation identities materialized rather than relying on predecessor receipts: Tests 34746058653, Security 34746058657, SAST 34746058639, Required CodeQL 34746058693, Noema 34746057619, Strix 34746057545, OpenCode 34746057593, dynamic code scanning 34746057012, and Code Quality 34746057323. They are still settling; #1055 remains Ready only for validation admission and is not merge-ready. All visible inline review threads are resolved/outdated.

#1057 remains the owner for required PostgreSQL + Keycloak + Valkey authenticated hosted topology. No owner duplication or gate weakening was introduced.

[seonghobae]

Fresh #1055 authority supersedes the validation paragraph in this issue: exact head is 50c4935eef1029467595f7004818643598b737c9. Tests 34746058653 is terminal SUCCESS including full PostgreSQL; Security 34746058657 and SAST 34746058639 are SUCCESS. Required CodeQL 34746058693 and Required OpenCode 34746057593 are terminal FAILURE at their already-owned central settlement/publication boundaries. Required Noema 34746057619 is now terminal FAILURE after exact-head admission/credential/head-validation/visibility/CO-sidecar success; Prepare Noema model verdict failed and publication was skipped. Failure artifact 10314028509 (noema-sidecar-evidence, digest sha256:3e1362ba30338c8b605ffbed97795b01af7366961ab32669db1073f4ab21b199) is retained; present metadata is insufficient to attribute the cause to leaf source or provider. Strix 34746057545 remains the only live lane and is executing Run Strix (quick). #1055 therefore stays Ready only to preserve that exact-head lane; once Strix terminalizes, remaining required failures force Draft before further source work. #1057 remains the hosted real-service auth-topology owner.

[seonghobae]

Fresh owner-boundary review found a separate buyer-path resilience gap outside #1055's current correctness repair: the canonical get_or_create_corporate_entity(...) path delays its explicit transaction/advisory lock until after provider I/O (correct), but still retains the borrowed asyncpg connection across hierarchy inference / relation-verification and recursive parent resolution. The process pool is bounded at max_size=10, and #1055 makes Customer Master an additional online consumer of this same catalog owner, so concurrent catalog misses can starve unrelated DB-only requests without any explicit lock being held.

This follow-on is now tracked as #1077 with a deterministic pool-exhaustion RED and acceptance for snapshot → release lease → provider work → fresh under-lock recheck/write. It remains a corporate-entity catalog bounded-context repair; Customer Master must not duplicate matching/creation logic or provider routing.

Do not move #1055 to implement #1077 while its exact-head Strix admission is live. #1055's tenant-ownership/resolution separation remains the active source lane; #1077 should serialize after that head settles. This does not invalidate the current Customer Master correctness evidence, but it is a commercial resilience/performance gate before treating concurrent catalog-backed buyer paths as production-ready.