security(state): persist tenant-scoped generation bindings

[seonghobae]

Refs #80 #192. Draft child of current #198@53d17b89f31eb297980e24aea806b9737f4fe87c after ordinary non-force adoption.

This is the first bounded durable PostgreSQL schema/RLS slice for reputation source-generation history. It does not enable StateAuthority::Postgres, remove the existing fail-closed backend-availability guard, publish snapshots, add pooling, or claim #80/#192 complete.

Exact test-only RED head 18b9228c32acc607a94d4638093a0d21d0ac2c22 changed only tests/postgres_generation_rls.rs. Hosted CI 34225504005, job 102058512687, passed checkout/toolchain/format and failed because the required migration did not yet exist. The hostile integration contract requires PostgreSQL 18.4 execution, a non-owner/non-BYPASSRLS runtime role, default-deny tenant RLS, transaction-local tenant context, tenant-scoped historical generation-token uniqueness, tenant-scoped ordinal uniqueness, and no context leakage after transaction end.

Causal schema GREEN edc957710afdc3b3529dbfb8d0e19f5f9482a076 added the smallest production migration plus CHANGELOG. Exact-head hosted CI 34226651321 was terminal SUCCESS: forced RLS, missing/cross-tenant denial, tenant-scoped token and ordinal uniqueness, permitted cross-tenant reuse of the same external source identity, isolated reads, and transaction-local context cleanup all executed against PostgreSQL 18.4. Production startup remains fail closed; no repository adapter is enabled.

Fresh review then found a DDD/single-writer violation: this child had also created docs/product-technical-gap-baseline.md, while #130 is the live sole writer for that ledger. Repair e0e0cbb75ce5f2f39f501bf4d145755965b983ea removed the competing path instead of closing or duplicating the documentation authority. Fresh changed-file inventory is only CHANGELOG.md, migrations/0001_reputation_source_generation.sql, and tests/postgres_generation_rls.rs; #130 receives the exact PostgreSQL evidence separately.

Bounded immutability head b23c34f6656f6c4abd0b59875894d47bd86379e6 added executable mutation acceptance without changing production SQL: the deliberately over-privileged test runtime role receives SQL UPDATE/DELETE grants, while absence of UPDATE/DELETE RLS policies must expose zero mutable rows. The test asserts attempted provenance UPDATE and generation DELETE each affect zero rows and that the original provenance remains byte-for-byte present. Hosted CI 34230257863 was terminal SUCCESS on that head.

Non-force parent adoption and exact-current evidence

Parent #198 subsequently advanced. Current 2ce6ddbb86b370928eebdae22ab17b0042663c56 is a normal two-parent merge commit (b23c34f... + current #198 53d17b...) titled chore(stack): adopt current #198 into #199; it preserves #199's durable generation-history/RLS slice while adopting intervening Runtime Configuration ancestry instead of rewriting history.

Exact-current CI 34234948897 and Fuzz 34234948958 are terminal SUCCESS on 2ce6ddbb86b370928eebdae22ab17b0042663c56. The earlier same-head CI 34234926867 failure is superseded by the later terminal-success run and is not used as current non-passing evidence. Submitted reviews remain 0; no self/model approval is supplied.

The relation binds (tenant_id, source_id, source_generation) and (tenant_id, source_id, source_generation_ordinal) uniquely, rejects blank/invalid identities, carries immutable completion/provenance identity, and applies ENABLE ROW LEVEL SECURITY plus FORCE ROW LEVEL SECURITY. No recent-token cache, cross-service SQL, foreign-owner source, mutable dependency, snapshot/publication pointer, or fake in-memory persistence.

PostgreSQL 18.4 is the integration target for this slice. RLS semantics remain fail closed: normal access is policy-gated, no applicable policy is default deny, table owners normally bypass unless FORCE ROW LEVEL SECURITY, and superuser/BYPASSRLS is outside the runtime-role model.

Keep Draft behind #140 -> #193 -> #194 -> #196 -> #198; after any parent movement, non-force adopt current ancestry and reacquire every exact-head gate. This exact-head evidence proves the bounded slice only on its current ancestry; it does not authorize the still-disabled production PostgreSQL repository adapter. No self/model approval, routine bypass, force update, destructive rebase, gate weakening, predecessor-result transfer, or no-op workflow churn.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}