feat(context-fabric): require immutable contract release pins

[seonghobae]

Current owner slice

This Draft is the pg-owned consumer-readiness/security stack for immutable Context Fabric release identity, provider-neutral BatchInferencePort, tenant-scoped lifecycle/outbox evidence, and fail-closed PostgreSQL runtime admission. It remains stacked on dependency-root #233 and is not production/release authority before normal protected integration.

Fresh exact boundary — 2026-09-07 KST

• protected/default main: 5913c4bad79d6bc29d7cc1c624abb7db2ea6a77c;
• exact base / merge base: test(recovery): cover stale evidence registry cleanup #233 01d231fde23b82e2ced258d7bfcb4721ed75706d;
• exact current head: 8597201242a3e4d43a9688aac12c94595abbbe7b;
• compare from test(recovery): cover stale evidence registry cleanup #233: ahead 793 / behind 0;
• state: Draft, open, mechanically mergeable;
• formal review inventory and review-thread inventory on this exact head are empty. Absence of review is not approval.

Latest RED -> causal repair lineage

Fresh review found that migration-time table-program admission was not sufficient runtime authority. Migrations 0008/0009 reject user triggers and rewrite rules at schema admission, but a privileged operator could attach one later, revoke the installer privilege, and leave the persistent program able to intercept or suppress lifecycle-outbox writes. _require_rls_application_role() re-proved live RLS/role/definer/view/materialized/inheritance/foreign authority but did not re-read the canonical relation's own pg_trigger/pg_rewrite rows.

• RED tests b560c71c7b2cd348074aec511839fd1d401e142c and f95e1a8d13366022bafc16fdb021cc9d8e62a1f4 added structural and real PostgreSQL post-migration trigger/rule specimens; 4823cae6f3d5198c6094c8e55f8e235551d9dae6 wired the runtime smoke into hosted CI.
• Hosted RED CI 34109490188 on exact 4823cae6... produced 1 failed, 1628 passed, 7 deselected in the structural suite and failed PostgreSQL/container job 101702171341. The smoke first demonstrated a post-migration BEFORE INSERT trigger intercepting a canonical write, then failed because runtime admission still accepted the credential: runtime admitted post-migration user-trigger drift. The specimen also covers an ON INSERT DO INSTEAD NOTHING rewrite rule.
• Minimal production repair ed74f30d699772e4b48d9b404f77fa336616acfc adds only two live catalog existence checks before tenant binding/data SQL: reject non-internal pg_catalog.pg_trigger rows whose tgrelid is the admitted outbox and reject pg_catalog.pg_rewrite rows whose ev_class is the admitted outbox. Existing RLS, role traversal, definer/view/materialized/foreign authority, migrations, tenant/data SQL, and workflow gates are unchanged.
• AGENTS/CLAUDE and Proposed ADR 0024 now carry the same invariant: migration success is point-in-time evidence, not authority for later attached-program drift. ADR 0024 cites PostgreSQL 18 pg_trigger, pg_rewrite, and trigger-behavior primary documentation and remains Proposed until protected integration.

Earlier RED/repair evidence in this PR remains part of the security lineage: selectable/administerable role authority, recursive mixed SET/ADMIN delegation, callable and nested user-schema SECURITY DEFINER, exact routine search_path = pg_catalog, pg_temp, effective-principal ordinary-view closure, materialized-copy provenance, direct/view/definer foreign-data authority, and inheritance/partition parents with foreign descendants through cycle-safe pg_catalog.pg_inherits ancestry.

Exact-current hosted GREEN

Exact current head 8597201242a3e4d43a9688aac12c94595abbbe7b is terminal GREEN; predecessor evidence is not being transferred.

• CI 34110307432: success. Coverage/docstrings/lint/package, Python 3.10, Python 3.12, Python 3.14, and PostgreSQL/container all passed.
• Quality job 101704769974: 1629 passed, 7 deselected; owned production 4236/4236 statements and 1126/1126 branches covered, public docstrings 100%, Ruff/lock/build successful.
• PostgreSQL/container job 101704770146: success after exact-head verification. The new live table-program authority smoke passed together with replay/default/column/relation/CHECK/RLS/effective-session-role/DML grant/MAINTAIN/role-admin delegation/live-policy/replication-definer/admin-definer/nested-definer/search-path/foreign-data/delegated-foreign-data/materialized-view/direct-foreign/partitioned-foreign authority smokes.
• Release Acceptance 34110307504, job 101704743385: success. Two clean exact-head source trees independently produced matching wheel/sdist artifacts and bounded reproducibility evidence.

Upstream prerequisite is not merge-ready

#233 remains the dependency root. Its leaf CI/Release Acceptance/security lanes do not substitute for the required central review/check state or a qualifying approval. Fresh review inventory still contains only dismissed historical OpenCode REQUEST_CHANGES records and a Devin COMMENTED review; there is no qualifying current APPROVED review.

Normal merge therefore remains gated by the live #233 required-check state, including the central CodeQL/OpenCode/Noema owner paths. No leaf workaround, synthetic status, self-approval, routine administrator bypass, force update, or gate weakening is permitted.

Documentation, performance, and release boundaries

ARCHITECTURE.md, CHANGELOG.md, and docs/product-technical-gap-baseline.md overlap documentation-only Draft #324. A fresh handoff records the table-program RED→repair→GREEN lineage while preserving #324's unique Result Application semantic-identifier decision/traceability delta. Do not replace either ledger wholesale from a stale parent.

Issue #307 owns the acquisition/performance evidence gap. Its complete-path p95 <= 20 ms measurement must now include the live pg_trigger/pg_rewrite probes inside connection acquisition -> authority admission -> tenant binding -> data I/O -> cleanup. Security work may not be removed from the timing path to manufacture the target.

No compatible immutable GitHub Release is assumed from a mutable sibling branch/head. After #233 normally integrates or is genuinely superseded with complete inherited delta/evidence, reconcile #319 non-destructively onto then-current protected main and reacquire exact-final-head CI/security/SAST/review/package/SBOM/provenance/reproducibility/release evidence before promotion.

No force push, destructive rebase, protected-main direct write, self-approval, routine bypass, gate weakening, cross-service SQL, sibling-source copy, mutable production dependency, or predecessor-evidence transfer is accepted.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Current-head repair finding on ec196204bbbaa69941113bbc1fd134ad9050302e: require_context_lifecycle_scope_continuity() documents previous as earlier evidence and current as later evidence, but it validates only tenant/subject/authority/origin continuity. It accepts a later lifecycle record whose system_time is earlier than the previous record (for example previous 2026-09-03T07:00:01.123456Z, current 2026-09-03T07:00:00Z). That breaks the pg-owned append/audit interpretation of system-recorded time while valid/business time may legitimately move independently for retrospective evidence.

RED: add a lifecycle-continuity regression with the same scope identities and a distinct event id, but a regressed system_time; current source does not raise. GREEN: keep valid_time unconstrained across lifecycle events, but require nondecreasing parsed UTC system_time in the continuity helper and preserve the fixed non-reflecting error boundary. Re-run focused lifecycle tests plus exact branch coverage before claiming GREEN. This remains pg-owned release-independent consumer readiness and does not require unreleased Context Graph bytes.

[seonghobae]

Exact-current development evidence (2026-09-05 KST)

Current exact head is 1b5c4305d045736750797d4742d39cc76f288eef, still Draft/open/mergeable on predecessor #233@01d231fde23b82e2ced258d7bfcb4721ed75706d; protected main remains 5913c4bad79d6bc29d7cc1c624abb7db2ea6a77c.

A new tenant-isolation finding was reproduced and repaired in migration 0008. The prior lifecycle-outbox RLS predicate used unqualified = and current_setting, leaving policy predicate operator/function authority dependent on the migration session's name-resolution environment.

• RED 6c22770e752dc24666477429835862fd2e43a523 requires versioned canonical policy v2, explicit OPERATOR(pg_catalog.=), explicit pg_catalog.current_setting, and retirement of v1/legacy names.
• GREEN package migration 5b7cdbad7868d0a76ac30981d381c831324995a0 and Docker mirror 0236c036c3a0f72c1e88ffee69670ae11b8c8e7c now share exact blob c46bc65d2bfb5f87b71a0789e8c8025c49f4d0df.
• Regression-test normalization completed at 36b35d699e9aec4ea4ecd7fe01f33650ec5d8872; the test asserts v2 is created before v1/legacy retirement and that the predicate contains two explicit pg_catalog operator/function bindings.
• Code-current documentation was updated across ADR 0002, doctoring, ARCHITECTURE, README, operator guide, CHANGELOG, and the newly established docs/product-technical-gap-baseline.md. Wording intentionally claims search-path independence only for RLS policy predicate operator/function authority, not the entire migration DDL.

PostgreSQL primary references: PostgreSQL 18 pg_policy (https://www.postgresql.org/docs/18/catalog-pg-policy.html) and CREATE POLICY (https://www.postgresql.org/docs/18/sql-createpolicy.html).

Exact-head hosted evidence is not GREEN yet. CI 33954792298 has all five jobs queued pre-checkout with steps=[] and runner_id=0; Release Acceptance 33954792301 is likewise queued pre-checkout with steps=[] and runner_id=0. No predecessor run is transferred and no no-op retrigger/runner-selector churn is used.

Parent #233 remains Ready/open/mergeable but still lacks a qualifying APPROVED review and retains the central authenticated CodeQL-dispatch verdict blocker. Immutable GitHub Release inventories remain empty for pg-llm-batch, context-graph-contracts, enterprise-architecture-core, and contextual-orchestrator; CO #1021 remains mutable open/Ready/mergeable evidence rather than release authority. Therefore this PR stays Draft and no merge/release authority is claimed.