C1-A04 follow-up — Make protected-parent identity role-aware

[LogicDuke]

Purpose

Fourth-level quarantined validation repair for the CURRENT/P2 contract
contradiction discovered during review of PR #36.

This PR is intentionally stacked directly on PR #36.

Required base:

repair/c1-a04-exec-boundary-contract

Required head:

repair/c1-a04-change-request-target-role

It MUST NOT target PR #35, PR #21, PR #14, or main.

Finding

PR #36 correctly requires:

• repair.commit effective mutation target → authorized repair ref;
• repair.push effective destination → authorized repair ref;
• repair.change_request.sourceRef effective identity → authorized repair ref;
• repair.change_request.targetRef effective identity → protected parent.

However, nearby contract wording also required refusal wherever an effective
identity was or dereferenced to the protected parent.

That rule was role-blind and therefore contradicted the valid
repair.change_request.targetRef case.

Classification:

CURRENT / P2

The contradiction fails closed rather than opening authority, but a literal
future executor would reject every valid repair change request.

Repair

The protected-parent rule is now role-aware.

The resulting invariant is:

• repair.commit protected-parent effective mutation target → REJECT;
• repair.push protected-parent effective destination → REJECT;
• repair.change_request.sourceRef protected-parent effective identity → REJECT;
• repair.change_request.targetRef protected-parent effective identity →
  REQUIRED / AUTHORIZED;
• unrelated, cyclic, indeterminate, or unsafe required identities → FAIL CLOSED.

The exemption applies only to the authorized change-request target role and does
not grant protected-parent authority to any other operand or operation.

Scope

Changed files exactly:

• docs/architecture/C1-repair-job-authority.md
• src/domain/repair-job.ts

src/domain/repair-job.ts changes are comments/TSDoc only.

No runtime, type, API, operation, permit operand, or execution-authority change.

Independent validation

Result:

PASS

Validated commit:

afba343d1ca2bb8c27e50dd5e8964fc039b84034

Validated parent:

fc49e9aa81f949807dd9d5b2acc4afbd792032e1

Validated binary patch SHA-256:

2F6789A763B88BF36C52AD7D04410A5976CE4689F52886DDAF6DFD967AEAF689

Validated patch bytes:

5412

Independent validation proved:

• changed files exactly as authorized;
• zero executable TypeScript token changes;
• 2939 executable tokens before / 2939 after;
• emitted JavaScript byte-identical after comments removed;
• AST structural shape identical;
• no runtime/type/API changes;
• role matrix correct;
• no remaining role-blind contradiction;
• no target-role scope leak;
• all 8 adversarial role cases PASS;
• git diff --check PASS;
• typecheck PASS;
• lint PASS;
• full suite PASS: 882 tests / 15 files;
• build PASS;
• npm audit: 0 vulnerabilities;
• validator made zero edits;
• patch fingerprint remained byte-identical.

Preserved boundaries

• commit effective-HEAD binding remains intact;
• push destination binding remains intact;
• TOCTOU / mutation-boundary enforcement remains intact;
• change-request source direction remains repair branch;
• change-request target direction remains protected parent;
• symbolic-ref cycle and indeterminate-identity fail-closed remain intact;
• original textual-alias protection remains intact;
• C1 remains pure TypeScript;
• no Git/filesystem/network/subprocess authority is added;
• no new execution authority is granted;
• force-push denial remains intact;
• merge remains operator-only;
• auto-merge remains forbidden;
• PR C1-A04 follow-up — Complete execution-boundary ref contract #36 remains protected from direct AI repair;
• PR C1-A04 follow-up — Clarify symbolic-ref resolution boundary #35, C1-A04 — Reject Git-equivalent protected/repair refs #21, and Cockpit C1 — Repair Job Authority Envelope & Merge Barrier #14 remain untouched.

Quarantine

Required flow:

this DRAFT child
→ exact-head CI
→ independent GitHub reviews
→ classify every finding
→ policy/evidence gate
→ Ready
→ post-Ready observation
→ PASS: human CREATE A MERGE COMMIT upward into PR #36 branch
→ establish PR #36 NEW HEAD
→ fresh PR #36 audit

FAIL means this child remains quarantined/rejected and PR #36 stays untouched.

MERGE IS OPERATOR-ONLY.

No AI may merge this PR or enable auto-merge.

Maximum autonomous state:

READY_FOR_MERGE

Summary by CodeRabbit

• Documentation
  • Clarified authorization rules for canonical references and protected-parent identities.
  • Documented that change-request targets must resolve to the protected parent, while other mutation targets must not.
  • Added fail-closed guidance for targets that resolve incorrectly, change during validation, or cannot be safely established.
  • Clarified that reference-name comparisons apply to each operand’s specific role.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 06ff3e94-9d3c-40d8-9c7f-a4c0a229452b

📥 Commits

Reviewing files that changed from the base of the PR and between fc49e9a and afba343.

📒 Files selected for processing (2)

• docs/architecture/C1-repair-job-authority.md
• src/domain/repair-job.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The change refines documentation for repair target authorization. It defines role-specific protected-parent handling, effective ref-name comparison, and fail-closed behavior. No executable logic or public declarations change.

Changes

Repair target authority

Layer / File(s)	Summary
Role-specific target rules docs/architecture/C1-repair-job-authority.md, src/domain/repair-job.ts	The documentation now requires effective ref-name comparison and fail-closed target resolution. repair.change_request must target the protected parent; other mutation roles must reject it.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to afba3

This PR clarifies role-aware protected-parent identity rules without changing runtime behavior or execution authority; no actionable merge-blocking risk remains after normal checks and review.

Poem

I’m a rabbit guarding refs in a row,
Parent targets may pass—or no.
One change request knows the sacred way,
Other roles must turn away.
Fail closed, with paws held tight.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main documentation change: making protected-parent identity handling role-aware.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch repair/c1-a04-change-request-target-role

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[LogicDuke]

@codex review

[LogicDuke]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: afba343d1c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".