C1-A04 follow-up — Allow identity-preserving provider resolution

[LogicDuke]

Purpose

Quarantined stacked validation repair for the single CURRENT / P3 post-Ready
finding discovered on PR #38.

This PR is intentionally stacked directly on PR #38.

Required parent branch:

repair/c1-change-request-provider-binding

Required parent HEAD:

bf78cf668e6b93701c83ea0a3537c185aaca40e8

It MUST NOT target PR #36, PR #35, PR #21, PR #14, or main.

Finding

Classification:

CURRENT / P3

Post-Ready thread:

PRRT_kwDOTzqfcs6a5BWQ

Comment:

PRRC_kwDOTzqfcs7j6BOX

Root cause:

The RC-1 repair correctly bound change-request source/target identity through the
provider creation/update boundary, but its wording absolutely prohibited the
provider from independently re-resolving ref names.

That made ordinary provider APIs non-conforming even when they necessarily
resolve supplied source/target names against authoritative repository state and
obtain exactly the same already-authorized effective identities.

The defect is fail-safe and documentation/future-boundary only, therefore P3.

Repair

The contract now distinguishes identity-preserving provider resolution from
identity-changing resolution.

Allowed:

provider resolves supplied source/target names at its authoritative
create/update boundary and obtains exactly the authorized effective identities.

Forbidden:

re-resolution, ambient repository state, substitution, or any other mechanism
causes the request to be created from or consume a materially different
effective source or target identity.

The change-request source/target relationship remains bound through provider
creation/update.

If the authorized identity relationship has changed, cannot be safely
re-established, or cannot be shown equivalent at the consuming boundary:

FAIL CLOSED.

No Git command, lock, transaction, provider-specific mechanism, or stronger
atomicity claim is introduced.

Scope

Changed files exactly:

• docs/architecture/C1-repair-job-authority.md
• src/domain/repair-job.ts

src/domain/repair-job.ts changes are TSDoc/comments only.

Zero executable TypeScript token changes.

No runtime behavior, API, type, operation, permit operand, Git/filesystem/
subprocess/network authority, Ready authority, or merge authority change.

Independent validation

Result:

PASS

Fresh independent validator:

Opus 4.8 in a distinct session.

Validated commit:

7810d6e337e3b664526bb8017f0f80e12ad2b312

Validated parent:

bf78cf668e6b93701c83ea0a3537c185aaca40e8

Validated binary patch SHA-256:

EA12A93A008F39CB8F3DD3845827663FBA2ACD16995C83B2D13997CE1DDEFC7C

Validated patch bytes:

3690

Independent validation proved:

• exact two changed files;
• zero executable TypeScript token changes;
• 2939 executable tokens before / 2939 after;
• token differences: 0;
• CR1–CR11 expected outcomes;
• CR11 identity-preserving provider resolution = AUTHORIZED / CONFORMING;
• CR6 / CR7 fail closed;
• CR9 / CR10 materially different identity = NOT AUTHORIZED;
• RC-1 not reopened;
• C5 / P5 not weakened;
• role/identity matrix preserved;
• no OID-equality loophole;
• no provider-atomicity overclaim;
• contract consistency PASS;
• git diff --check PASS;
• typecheck PASS;
• lint PASS;
• full suite PASS: 882 tests / 15 files;
• build PASS;
• npm audit: 0 vulnerabilities;
• validator made zero edits;
• patch fingerprint remained byte-identical before and after validation.

Preserved boundaries

• canonical ref validation remains intact;
• Git-equivalent alias rejection remains intact;
• symbolic/effective ref-name rules remain intact;
• commit-OID vs ref-name distinction remains intact;
• worktree HEAD binding remains intact;
• push destination/refspec binding remains intact;
• force-push denial remains intact;
• protected-parent role awareness remains intact;
• change-request source = authorized repair ref;
• change-request target = protected parent;
• cycles/indeterminate resolution fail closed;
• permit scope remains intact;
• Ready authority remains separate;
• human/operator merge authority remains preserved;
• auto-merge remains forbidden;
• C1 remains pure TypeScript.

Quarantine lifecycle

Required flow:

this DRAFT child
→ exact-head CI
→ independent GitHub reviews
→ classify every new finding
→ policy/evidence gate
→ Ready
→ POST-READY review/check observation
→ PASS: human CREATE A MERGE COMMIT upward into PR #38 branch
→ establish PR #38 NEW HEAD
→ fresh PR #38 audit

If Ready/post-Ready review finds a CURRENT defect:

RETURN THIS PR TO DRAFT.

Do not repair it directly.

Create another isolated child from the exact affected HEAD.

FAIL means reject/discard/quarantine this child.

PR #38 remains untouched.

MERGE IS OPERATOR-ONLY.

No AI may merge this PR or enable auto-merge.

Maximum autonomous state:

READY_FOR_MERGE

Summary by CodeRabbit

• Bug Fixes
  • Improved validation for provider-resolved source and target references.
  • Prevented change requests from being created when identities or source-to-target relationships cannot be verified.
  • Ensured stacked change requests fail safely when provider-side resolution alters authorized references.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8eaf00db-f228-40b0-b2f1-fcc756a227be

📥 Commits

Reviewing files that changed from the base of the PR and between bf78cf6 and 7810d6e.

📒 Files selected for processing (2)

• docs/architecture/C1-repair-job-authority.md
• src/domain/repair-job.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The provider boundary now permits provider-side ref resolution when it preserves the authorized source, target, and direction. Changed, unresolved, or inequivalent identities must fail closed without creating a change request.

Changes

Repair job authority

Layer / File(s)	Summary
Provider resolution contract docs/architecture/C1-repair-job-authority.md, src/domain/repair-job.ts	The provider may resolve refs against authoritative state only when the authorized source and protected-parent target remain materially equivalent. The provider must refuse the request when equivalence cannot be established.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 7810d

This PR clarifies identity-preserving provider resolution without changing runtime behavior or executable code; no actionable merge-blocking risk remains beyond normal checks and review.

Poem

I’m a rabbit guarding refs tonight,
Source and target must stay right.
If identities change or fade,
No change request shall be made.
Fail closed, then hop away!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: allowing provider resolution that preserves authorized identities.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch repair/c1-provider-resolution-identity

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[LogicDuke]

@codex review

[LogicDuke]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 7810d6e337

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".