security(state): publish source generations atomically

[seonghobae]

Refs #80 #192. Draft child of exact #200@63b2731d7173d24fc15cc1c340fb177727d33251.

This slice owns the next Wardnet durable-state invariant after idempotent generation admission: generation binding, immutable publication evidence, completeness/provenance/lifecycle identity, monotonic publication order, last-known-good publication state, tenant visibility, and the publication mutation capability must not become partially, cross-tenant, or directly mutable. It does not enable production PostgreSQL selection, source fetching, EgressWeave transport authorization, Context Graph mutation, or foreign-owner behavior.

Executed RED lineage

• d8d0cd3ba5c8eca454b1510a745b29b36136fe99: CI 34237346607, rust job 102098369156, reached the real PostgreSQL acceptance and failed because migration 0003 did not exist.
• f2ef0b0bbaa5599c9d82dbc54e3e27b71e5d643a: CI 34238906678, job 102103706051, passed the first atomic/concurrent case and failed because unused-but-regressive generation-9@9 -> generation-10@8 returned committed.
• 43c6396e750d27c35f0a071543e81fce4cc788f2: after the PostgreSQL Official Image final-startup harness repair, CI 34243761631, job 102120327373, passed every preceding PostgreSQL 18.4 acceptance and failed exactly because the runtime role could directly UPDATE reputation_source_publication_head, bypassing CAS/monotonicity despite tenant RLS.

The earlier 34242389465 / 102115594964 socket-loss run is harness evidence only, not semantic RED: pg_isready had accepted the image's temporary init server. The repaired harness requires the official final-startup marker plus pg_isready.

Current decision and implementation

Migration 0003_reputation_source_publication.sql provides immutable publication history plus a tenant/source last-known-good head, exact-prior compare-and-swap, strict successor ordinal monotonicity, transaction-scoped tenant/source serialization, deterministic replay/conflict classification, FORCE RLS and rollback-safe evidence-completeness failure.

The privilege repair changes the outer publication capability to SECURITY DEFINER, pins function-local search_path to pg_catalog, pg_temp, and keeps PUBLIC execution revoked. The executable deployment-role acceptance provisions a dedicated NOLOGIN/NOSUPERUSER/NOBYPASSRLS state owner, transfers the outer function to it, grants that owner only the underlying DML/EXECUTE capability needed by the bounded transaction, and grants the runtime role read access plus outer-function EXECUTE only. It verifies rolsuper=false, rolbypassrls=false, prosecdef=true, runtime publication INSERT=false and head UPDATE=false; function-mediated publication succeeds, while direct head regression and immutable-history forgery fail and leave authoritative state unchanged.

Cluster-role provisioning stays in #80 instead of being hidden in an application migration. Production PostgreSQL authority remains fail closed pending repository wiring, pooled tenant-context checkout/reset, deployment/migration role installation, upgrade/rollback/recovery, backup/restore and immutable protected release acceptance.

ADR docs/adr/2026-09-08-reputation-source-publication-transaction-boundary.md remains Proposed and records the problem, alternatives, PostgreSQL/NIST evidence, risks and release conditions. CHANGELOG.md records the Unreleased security boundary. No Accepted/release claim is made.

Exact-current GREEN

Current exact head is 1d45a024f7e6a0cc351eda3b9fb317ccf6e35300. Hosted CI 34245836806, rust job 102127456517, is terminal SUCCESS on that exact documentation-bearing head: checkout/toolchain, cargo fmt --check, locked workspace tests including all real PostgreSQL 18.4 atomicity/concurrency/ordinal/tenant/privilege cases, strict Clippy and cleanup all completed successfully. The earlier functional head 80af90273def9f72042ef378d3a74ea31b8a6de6 also had terminal CI 34244982960 SUCCESS, but only the current-head run is used for readiness.

Submitted reviews: 0. Inline review threads: 0 at the last fresh inventory. No self/model approval is supplied. Keep Draft behind #140 -> #193 -> #194 -> #196 -> #198 -> #199 -> #200; parent movement must be adopted non-force and invalidates this gate evidence.

No self/model approval, routine bypass, force update, destructive rebase, gate weakening, mutable foreign dependency, predecessor-result transfer, or no-op workflow churn.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}