security(state): define idempotent generation admission

[seonghobae]

Refs #80 #192. Draft child of current #199@2ce6ddbb86b370928eebdae22ab17b0042663c56 after ordinary non-force adoption.

This successor defines the bounded PostgreSQL source-generation admission contract without enabling production PostgreSQL selection, repository wiring, snapshot publication, or claiming #80/#192 complete.

RED -> causal repair

Test-only exact ce7b8ebed5d4e242e4404ee7c60e2e66d9643ba1 required a real PostgreSQL 18.4 wardnet_admit_reputation_source_generation(...) boundary. Hosted CI 34232142028, rust job 102080672291, acquired GitHub-hosted ubuntu-24.04, passed checkout/toolchain/formatting, then failed in Test because migration 0002_reputation_source_generation_admission.sql did not exist. Required behavior is: first binding -> committed; byte-identical replay -> replay; divergent immutable evidence on an existing token -> deterministic reputation_source_generation_replay_conflict; historical token rebound at another ordinal -> the same replay conflict; another token at an occupied ordinal -> deterministic reputation_source_generation_ordinal_conflict; rejected attempts create no extra history row.

Production repair fe204d5a1fd96ae63c302718c48be55022cd166d added only the admission migration over #199's forced-RLS immutable relation. The function is SECURITY INVOKER, binds its tenant argument to the transaction-local wardnet.tenant_id, keeps the table's unique token/ordinal constraints authoritative, treats only the complete immutable tuple as replay, maps divergent token/ordinal reuse to stable conflict classes, and revokes PUBLIC execution. It does not introduce a recent-token cache, mutable history, cross-service SQL, provider routing, or a second lifecycle truth.

That production head exposed an integration-harness defect rather than a SQL failure: CI 34232816650, job 102082941192, failed because two PostgreSQL tests executed in parallel inside one test process and both derived Docker container name wardnet-postgres-generation-<pid>. Repair b4d748fbd2128ac7f8b46c559343d41a19eb91ba gives each in-process test container a monotonic per-process suffix while preserving ordinary parallel test execution; it does not serialize the suite or weaken CI.

Non-force parent adoption and exact-current evidence

Parent #199 advanced after the first GREEN. Commit 63b2731d7173d24fc15cc1c340fb177727d33251 is a normal two-parent merge commit (b4d748f... + current #199 2ce6dd...) titled chore(stack): adopt current #199 into #200; it preserves #200's generation-admission/harness delta while adopting the intervening Runtime Configuration ancestry instead of force-rewriting history. Comparison from b4d748f... to current head shows only the parent Runtime Configuration delta outside #200's owned migration/tests.

Current exact head is therefore 63b2731d7173d24fc15cc1c340fb177727d33251, base is #199@2ce6ddbb86b370928eebdae22ab17b0042663c56, and hosted CI 34234982519 is terminal SUCCESS on this exact head. Submitted reviews: 0. Inline review threads: 0. No self/model approval is supplied.

Remaining issue acceptance and stack discipline

This slice proves durable historical binding plus exact idempotent admission only. #192 still requires producer lifecycle identity, admitted evidence snapshot, completeness/pagination proof and last-known-good publication pointer to move atomically in one transaction; concurrent competing transitions, injected failure/rollback, pooled-connection context hygiene, migration upgrade/rollback/restore and backup/restore remain subsequent RED/GREEN work. Draft #207 is the direct atomic-publication successor on this exact head and does not enable production PostgreSQL authority.

Keep dependency order #140 -> #193 -> #194 -> #196 -> #198 -> #199 -> #200. Parent movement must continue by ordinary adoption/non-force restack and invalidates predecessor gate evidence. No force update, destructive rebase, self/model approval, routine bypass, gate weakening, mutable foreign dependency, predecessor-result transfer or no-op workflow churn.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}