C1-A04 follow-up — Bind change requests at provider boundary

[LogicDuke]

Purpose

Quarantined stacked validation repair for the single CURRENT RC-1 / P3 contract-completeness finding discovered during the fresh C1 stack closure audit.

This PR is intentionally stacked directly on PR #36.

Required base:

repair/c1-a04-exec-boundary-contract

Required parent HEAD:

c8fde78b2721a2eb8b60485f5f6ea42ba92d5d7b

It MUST NOT target PR #35, PR #21, PR #14, or main.

Finding

RC-1 / CURRENT / P3

repair.change_request correctly required:

• effective source identity = authorized repair ref;
• effective target identity = protected parent;
• fail-closed handling for cycles, indeterminate resolution, and unauthorized direction.

However, the anti-TOCTOU wording was scoped to the "mutation/receiving boundary".

Because repair.change_request is explicitly non-ref-mutating, the contract did not explicitly require the validated source/target identity relationship to remain bound through the actual trusted change-request/provider creation boundary.

This left four adversarial surfaces under the same root cause:

• CR6 — source identity changes after pre-check before creation;
• CR7 — target identity changes after pre-check before creation;
• CR9 — provider independently re-resolves refs;
• CR10 — provider derives source/target from ambient repository state.

Repair

This patch generalizes the execution-boundary invariant so authorization-dependent repository identity must remain valid at the actual trusted boundary that consumes that identity.

It explicitly covers:

• repair.commit at the actual commit mutation boundary;
• repair.push at the actual push receiving/mutation boundary;
• repair.change_request at the actual change-request/provider creation boundary.

For repair.change_request, the contract now requires:

• effective source to remain the authorized repair ref;
• effective target to remain the protected parent;
• those identities to remain bound through the provider create/update request;
• the provider not to independently re-resolve to a materially different identity;
• the provider not to derive source/target from inconsistent ambient repository state;
• fail-closed behavior if the authorized relationship cannot safely be maintained through creation.

No specific Git command, lock, transaction, or implementation mechanism is prescribed.

No stronger atomicity is claimed than the eventual executor mechanism can actually prove.

Scope

Changed files exactly:

• docs/architecture/C1-repair-job-authority.md
• src/domain/repair-job.ts

src/domain/repair-job.ts changes are TSDoc/comments only.

Zero executable TypeScript token changes.

No runtime behavior, type, API, operation, permit operand, execution authority, Git/filesystem/network/subprocess authority, Ready authority, or merge authority change.

Independent validation

Result:

PASS

Validated commit:

bf78cf668e6b93701c83ea0a3537c185aaca40e8

Validated parent:

c8fde78b2721a2eb8b60485f5f6ea42ba92d5d7b

Validated binary patch SHA-256:

79658740148B5AB2E78824403DB842274256D9FFF4E2F08F71D6D1D7EDAEA9C4

Validated patch bytes:

6308

Independent validation proved:

• exact changed files only;
• zero executable TypeScript token changes;
• 2939 executable tokens before / 2939 after;
• token differences: 0;
• CR1–CR10 PASS;
• C5 PASS;
• P5 PASS;
• role matrix preserved;
• no remaining contradictory mutation-only wording;
• git diff --check PASS;
• typecheck PASS;
• lint PASS;
• full suite PASS: 882 tests / 15 files;
• build PASS;
• npm audit: 0 vulnerabilities;
• validator made zero edits;
• patch fingerprint remained byte-identical before and after validation.

Preserved boundaries

• canonical ref validation remains intact;
• Git-equivalent textual alias protection remains intact;
• symbolic/effective ref-name fail-closed rules remain intact;
• commit-OID vs ref-name distinction remains intact;
• worktree HEAD binding remains intact;
• push destination/refspec binding remains intact;
• force-push denial remains intact;
• protected-parent role awareness remains intact;
• change-request source/target direction remains intact;
• permit scope remains intact;
• Ready authority remains separate;
• merge remains operator-only;
• auto-merge remains forbidden;
• C1 remains pure TypeScript.

Quarantine

Required flow:

this DRAFT child
→ exact-head CI
→ independent GitHub reviews
→ classify every new finding
→ policy/evidence gate
→ Ready
→ POST-READY review/check observation
→ PASS: human CREATE A MERGE COMMIT upward into PR #36 branch
→ establish PR #36 NEW HEAD
→ fresh PR #36 audit

If Ready/post-Ready review finds a CURRENT defect:

RETURN THIS PR TO DRAFT.

Do not repair it directly.

Create another isolated repair from the exact affected HEAD.

FAIL means reject/discard/quarantine this child.

PR #36 remains untouched.

MERGE IS OPERATOR-ONLY.

No AI may merge this PR or enable auto-merge.

Maximum autonomous state:

READY_FOR_MERGE

Summary by CodeRabbit

• Documentation
  • Clarified safeguards requiring authorized source and target references to remain consistent throughout change-request creation and updates.
  • Permitted provider-side reference resolution only when effective identities and source-to-target relationships remain equivalent.
  • Expanded concurrency guidance to cover every boundary where identities are consumed, including provider creation.
  • Documented fail-closed behavior for changed, conflicting, indeterminate, or unverifiable identities.
  • Clarified that commit and push targets must be validated at their actual mutation or receiving boundaries.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e82f865c-64dd-4a67-a881-bcfb551965f8

📥 Commits

Reviewing files that changed from the base of the PR and between bf78cf6 and 0bef03c.

📒 Files selected for processing (2)

• docs/architecture/C1-repair-job-authority.md
• src/domain/repair-job.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The change binds change-request source and target identities through provider creation or update. It requires concurrency enforcement and fail-closed behavior when identity equivalence cannot be preserved or verified.

Changes

Repair identity boundaries

Layer / File(s)	Summary
Change-request identity enforcement docs/architecture/C1-repair-job-authority.md, src/domain/repair-job.ts	Providers may resolve source and target refs only when they preserve the authorized effective identities and relationship. Substitutions, material differences, and unverifiable identities require refusal. Concurrency and permit enforcement apply at the provider creation boundary.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🔵 Low · up to 0bef0

This PR tightens the change-request contract without changing runtime code; it is mergeable with owner awareness that the provider must bind the authorized source and protected target through creation and fail closed if that relationship cannot be preserved.

Poem

A rabbit checks each source and target ref,
Keeps authorized identities in step.
If provider checks cannot confirm the chain,
The change request must not remain.
Bound refs guide the way.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the follow-up and the main change: binding change requests at the provider boundary.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch repair/c1-change-request-provider-binding

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[LogicDuke]

@codex review

[LogicDuke]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: bf78cf668e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bf78cf668e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Allow provider resolution that preserves the validated identity

For provider APIs whose create/update operation accepts source and target ref names, the provider necessarily resolves those names against its authoritative repository state. This absolute prohibition therefore makes an ordinary provider incapable of satisfying the contract even when it resolves both names atomically to exactly the authorized effective refs; it also conflicts with the following allowance to safely re-establish identity at the boundary. Limit the prohibition to re-resolution that yields a materially different identity, rather than forbidding provider-side resolution itself.

Useful? React with 👍 / 👎.

[LogicDuke]

@codex review

[LogicDuke]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 0bef03c164

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[LogicDuke]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[LogicDuke]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.