C1 F1/F2 — Snapshot trusted state before hostile reads

[LogicDuke]

Purpose

This stacked validation PR repairs the trusted-before-hostile ordering invariant on protected parent PR #14.

Parent PR:

#14 — Cockpit C1 — Repair Job Authority Envelope & Merge Barrier

Exact protected-parent SHA:

dd1bdd494f37d0cf42ea79fd7a9eb41d04a17bbe

Repair head:

f8eb259664fd2ae15eb1792daedd41665e63ced7

Findings

F1 — CURRENT / P1 / BLOCKING

authorizeJobOperation read hostile request-controlled state before capturing trusted repair-job authorization state.

A hostile request getter could mutate the still-live job before snapshot capture and change an expected denial into:

ALLOW_ONCE / WITHIN_JOB_ENVELOPE

with a non-null permit.

Repair:

capture/freeze trusted job authorization state before any hostile request read.

F2 — CURRENT / P2

operatorMergeAuthorizes read candidate-controlled state before capturing the supplied merge target.

A hostile candidate getter could mutate the still-live target before target capture and change:

false → true

Repair:

capture target fields before any candidate-controlled read.

F1 and F2 are one trusted-before-hostile invariant family.

Scope

Exactly four files:

• src/domain/execution-permit.ts
• src/domain/job-authorization.ts
• tests/domain/execution-permit.test.ts
• tests/domain/job-authorization-invariants.test.ts

No documentation changes.

No F3–F8 work.

No exported API change.

No authority expansion.

Validation

Fresh independent validation:

PASS

Focused F1/F2 tests:

115 passed

Full suite:

885 passed

Typecheck:

PASS

Lint:

PASS

Build:

PASS

git diff --check:

clean

Validated patch identity:

SHA-256:

3BD4918F2A6C812D4DB2C5048D965560A6F33967802930C7B792CB92CB9F2C89

Bytes:

7638

Committed patch identity:

exact match.

Quarantine

This PR must remain DRAFT until exact-head CI and independent GitHub review gates pass.

Do not merge directly.

Do not enable auto-merge.

Do not modify protected parent PR #14 directly.

If this repair fails validation, reject/quarantine this child and leave PR #14 untouched.

Summary by CodeRabbit

• Bug Fixes

  • Strengthened authorization checks against malicious or unexpected request behavior.
  • Prevented merge and job authorization decisions from being affected by state changes during validation.
  • Ensured stale merge targets are rejected reliably.
  • Prevented unauthorized operations from receiving permits.

• Tests

  • Added regression coverage for hostile request accessors and target mutation scenarios.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 114773f3-1589-4d46-9bf2-ca9d097f1ee8

📥 Commits

Reviewing files that changed from the base of the PR and between dd1bdd4 and f8eb259.

📒 Files selected for processing (4)

• src/domain/execution-permit.ts
• src/domain/job-authorization.ts
• tests/domain/execution-permit.test.ts
• tests/domain/job-authorization-invariants.test.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The authorization evaluators now snapshot trusted merge targets and jobs before reading untrusted candidate or request properties. Tests cover stale values and hostile getters that mutate live authorization state during evaluation.

Changes

Authorization Snapshot Ordering

Layer / File(s)	Summary
Merge target snapshot validation src/domain/execution-permit.ts, tests/domain/execution-permit.test.ts	operatorMergeAuthorizes captures target fields before reading candidate authorization properties. Tests cover mismatched HEAD values and candidate getters that mutate the target.
Job snapshot authorization src/domain/job-authorization.ts, tests/domain/job-authorization-invariants.test.ts	authorizeJobOperation snapshots the trusted job before reading the request. The regression test verifies DENY, PROTECTED_REF_MUTATION, and no execution permit after request-side mutation.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to f8eb2

The PR makes a localized ordering fix with no reported merge-blocking risk remaining after the stated validation checks.

Poem

I’m a rabbit guarding the gate,
I snapshot first and evaluate straight.
Hostile getters may hop and pry,
But captured truths will not comply.
No stale permits shall pass by!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 4 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the two fixes: snapshotting trusted state before reading hostile state.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch repair/c1-snapshot-trusted-before-hostile

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[LogicDuke]

@codex review

[LogicDuke]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: f8eb259664

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".