[bokelley]

Queued compliance refreshes remain bound to the exact human credential that authorized admission. This PR persists that credential and its authorization epoch, re-proves the current WorkOS identity, and checks authorization across sensitive continuations and canonical writes.

Dependency and merge order: #7450 → #7452 → #7457. Keep this PR Draft, auto-merge disabled, and unmerged on conductor/secure-web-admin-credential-sweep. No maintainer renewal, merge, deployment, or issue closure is authorized.

Current head and lineage

• Exact head: 9b82d0da9a29d614edb33aec0ed490f76ca65254; exact tree: aad38bde1e6146e99aab1b66259d3ba39efa27e8.
• The reviewed queue commit 310845d7958f4695a94b4a89920856ef90ae55b4 remains on its original local parent 31e43f16d1ba3d157ba1022ee6d2203bd3d958df. This update adds only the independently reviewed migration allocation correction: 2 logical files, +3/-3.
• Current remote fix(auth): authorize web admins by authenticated credential #7452/base head is 7c3d8d3a48963928a79ce37be75b77e33c635662. This update does not replay the queue onto that parent. GitHub reports 91 files, +7,693/-1,008, DIRTY/CONFLICTING against the current base because of inherited divergence. The PR comparison is not yet a qualified restack.
• Publication uses the exact expected lease 310845d7958f4695a94b4a89920856ef90ae55b4. No landed migration is renamed, rewritten, or removed.

Migration allocation correction

Main dc69e0b2264b4c563f2175a48c515b7108dbb4f6 permanently contains 591_enable_verification_profile_comparisons.sql from merged #7542 and 597_supply_path_manifest_provenance.sql from merged #7544. The unmerged queue migration moves to 599_compliance_refresh_authenticated_credential.sql.

Number	Current owner or reservation
591	Landed main: 591_enable_verification_profile_comparisons.sql (#7542); immutable
592	#7463
593	#7464, with inherited dependency in #7460
594	Unpublished Slack lifecycle reservation
595	#7501
596	Unpublished grant lifecycle reservation
597	Landed main: 597_supply_path_manifest_provenance.sql (#7544); immutable
598	Withheld following the post-merge #7542 follow-up claim; not allocated to this PR
599	#7457: queued compliance-refresh authenticated credential provenance

The live public/current private allocation audit was rechecked before publication and found no competing 599 claim. The correction renames the SQL file, updates one migration-number diagnostic, and updates the existing integration test's filename reference and pre-migration comment. All 99,721 unaffected tracked blobs/modes are identical. All runtime code and SQL enforcement semantics are unchanged. New SQL blob: de8d612c56b4838f903f22f0efa462a7ca90da07; SHA256: ac112531a7e409d898282d670495553cb7064fa5b917887045c3c2ad97b92de4. No protocol release surface changed, so no changeset is required.

Security invariants

• Migration 599 enforces the mixed-version gate in PostgreSQL: exclusive table lock, abort if any row is running, legacy queued rows terminalized with stable missing-provenance status, and explicit __unproven__ provenance for legacy histories. Credential and fingerprint columns are NOT NULL without defaults. Sentinel rows cannot execute; old inserts and old worker claims fail closed, including claims against valid new jobs. Fresh valid requests can be submitted after legacy rejection.
• Registry admission, ownership, execution, and polling use the exact authWorkosUserId ?? id principal. Canonical linked IDs, stale local email, and request isAdmin cannot substitute for exact credential authorization. Static administrators cannot enqueue or execute queued refreshes.
• Provenance and authorization fingerprints are checked before active/recent request coalescing. Bounded WorkOS lookup uses the current exact credential and current email for independent break-glass decisions. Deletion, returned-ID mismatch, and revoked authorization are terminal; lookup/store unavailability retries within the queue limit and retains distinct public unavailable semantics.
• Epoch/fingerprint rechecks fence saved-secret access, outbound dispatch, long-await continuations, canonical evidence/snapshot/type writes, badge fan-out, and completion. Guarded writes share authorization-lock transactions; typed failures and late timed-out continuations remain fenced.

Exact-tree local qualification

• Focused units plus migration loader/order/duplicate regressions: 150/150 across 11 files. Repository migration naming/duplicate/number validation: 3/3.
• PostgreSQL 16 integrations: 79/79 — migration gate 11, durable queue 23, registry refresh 45.
• Fresh pinned-main inventory: 573 ordinary migrations applied; fresh main-plus-599 inventory: 574. All 575 main SQL files are byte-preserved in the local union fixture. Evaluator migrations 584/585 are excluded by the application's normal migration policy.
• Incremental main upgrade with real legacy user/static queued rows applies only 599. Both legacy rows become terminal missing-provenance records; provenance columns are NOT NULL without defaults; an old-writer INSERT fails with SQLSTATE 23502. Landed 591/597 and queue599 coexist. Fresh and upgrade replay each apply zero migrations and preserve all ledger entries/timestamps.
• Full canonical qualification: 99/99 stages, including server and fixed-trace typechecks. Full server qualification: 9,749 passed, 31 skipped across 624 files.
• Initial failures remain documented: one canonical 30-second typecheck-wiring timeout passed a complete quiet shard rerun under unchanged limits (25 stages, 1,063 root tests); a missing-Python server failure passed its complete 17-test file after Python was added only to the disposable image; two worker assertions passed a complete quiet 34-test file rerun with unchanged source/budgets. No failing test was excluded.
• Independent exact-tree and evidence review found no discrepancy: intended path/blob/diff identity, immutable main migration bytes, PostgreSQL readback, replay ledgers, and qualification-log hashes verified. This is automated review, not human approval.
• Commit/push hook evidence: actual pre-commit hook passed 1,063 root tests, all 9,749 server tests with 31 skipped across 624 files, guard suites, and server/fixed-trace typechecks under original budgets. Actual pre-push hook passed version synchronization and changeset scope checks. Its path filters skipped docs and advisory storyboard checks for this two-file correction; no hook bypass or explicit storyboard-skip flag was used.

CI registration history and current hold

On 2026-09-14 the coordinator authorized a temporary main retarget for old head 310845d7958f4695a94b4a89920856ef90ae55b4, pinned main 2da35544ffb7257861324786a33cae9db0457bac, and then-parent 31e43f16d1ba3d157ba1022ee6d2203bd3d958df. Retarget was confirmed at 22:19:58 UTC; the guard stopped at 22:20:04 on the inherited #7529/#7450 conflict in server/src/addie/generated/tool-surface-inventory.generated.json. Base was restored at 22:20:05, verified at 22:20:09, and independently audited at 22:21:21. No full CI workflows registered from that attempt.

The inherited local storyboard qualification is unchanged: the earlier default advisory matrix encountered the documented cache-version mismatch (3.2.0-rc.3 versus seller capability through 3.2-rc.1). The earlier publication used the documented ADCP_SKIP_STORYBOARD_MATRIX=1 rerun, never HUSKY=0; neither local storyboard matrix is claimed passing. Old-head CI and approvals do not qualify this new head.

Fresh exact-head checks: IPR Agreement and the exact-head IPR Policy / Signature status passed. Check Migration Numbers passed on this exact head via its supported manual trigger; workflow-dispatch mode checks the branch inventory, while the current-main union and byte preservation are covered by the local qualification above. GitGuardian passed. Ladon and Mintlify checks are skipped; neither is human approval. All currently registered checks are terminal. Full Build Check/test CI remains absent for this stacked base.

Hold for corrected #7450 → #7452 replay and terminal required exact-head CI. The current stacked base does not trigger Build Check under its branch filters; no retarget or workflow/source change is included in this allocation correction. Independent human approval remains required before any merge. No maintainer renewal is requested by this update.

---

Open workspace in Conductor

[aao-secretariat]

Ladon verdict: Approve

Approve — server-only credential-authorization sweep for the queued compliance-refresh path.

What I checked:

• Reviewer surfaced no blocking or medium findings (clean LGTM).
• No no-auto-approve team match; gated_paths: false, so no hard approval gate applies.
• high_risk: true, but reasons are one (added) migration (591) and several (modified) route files. Per the high-risk-flag reading rules, a (modified) sensitive file with no medium-or-higher finding is presumed safe, and an (added) migration on its own is normal scaffolding. No (deleted) entries → row 3 does not fire.
• No medium findings at all → rows 4, 5, 8 do not fire. No prior decision → row 6 N/A.
• Change is operational-only (no static/schemas/source/**, dist/**, or normative docs touched), so schema↔docs coherence, oneOf, changeset-scope, artifact-immutability, and 3.1.x patch-eligibility gates are not triggered. No protocol/breaking-class change present.
• Auth-posture change (authorize by exact authenticated WorkOS credential authWorkosUserId ?? id with fail-closed provenance and bounded external I/O) is well-covered across admission, execution, polling, admin sweep, and migration 591.

None of decision-table rows 1–8 fire → row 9 = approve.

[aao-secretariat]

Ladon verdict: Approve

Approve — subsequent pass on the compliance-refresh authorization rework, clean.

The reviewer verified the delta end-to-end: credential binding uses authWorkosUserId in both admission and worker paths, the legacy-row rejection fence matches the worker's advisory-lock key, the provenance guard equals migration 591's CHECK constraint, and all external I/O is bounded (WorkOS getUser 5s race + maxRetries 0, DB lookups via withDatabaseDeadline) with authorization_unavailable retryable and revoked/provenance_missing terminal. No new critical, high, or medium findings.

Decision-table walk:

• Rows 1 — no critical/high findings.
• Row 2 — gated_paths is false; review_decision is APPROVED regardless.
• Row 3 — no (deleted) high-risk entries (migration 591 is (added) scaffolding; registry-api.ts is (modified) with no findings).
• Rows 4/5 — no medium findings at all.
• Row 6 — prior decision was approve, not escalate.
• Row 7 — no no-auto-approve team match.
• Row 8 — zero medium findings.
• Row 9 — approve.

Note: migration 591 runs automatically on startup in production and was judged as production-facing by the reviewer; the provenance guard was confirmed to match the migration's CHECK. This is a server/platform change (no static/schemas/source/** or docs/reference/** touched), so schema↔docs coherence, changeset, oneOf, and 3.1.x patch-eligibility gates do not apply.

[aao-secretariat]

Ladon verdict: Approve

Approve — queued-refresh credential-provenance fix (PR1c continuation of #7411/#6827).

Server-only change with a clean reviewer pass: no Critical/High/Medium findings. Verified advisory-fence key parity, fail-closed provenance validation before coalescing, live-credential revalidation bounded to 5s at execution, error routing to 403/503, and legacy NULL-provenance rows failing closed without backfill while permitting fresh resubmission. No protocol surface touched (static/schemas/source/** untouched), so no changeset required.

Gate check:

• No no-auto-approve team match.
• gated_paths: false; review_decision: APPROVED.
• high_risk: true only from an (added) migration and a (modified) route — reviewer surfaced no medium-or-higher concern on either, so no escalation trigger. The migration under server/src/db/migrations/** was reviewed as production-facing (runs on startup) and is fail-closed. This is not a protocol/breaking-class change.
• Prior decision was approve; this run remains clean.

No rows 1–8 fire → row 9 approve.

The base branch was changed.

[aao-secretariat]

Ladon verdict: Approve

Approve — subsequent pass, no findings.

This is a follow-up review to a prior clean approve. The only delta since the last run is the migration allocation correction: renaming the compliance-refresh authenticated-credential migration to 599_compliance_refresh_authenticated_credential.sql. The reviewer verified 599 is a free, valid slot (base main tops out at 598, with gaps at 588/592-596), all references (file, migration-number diagnostic, integration-test readFileSync path) point consistently to 599, the stale #7457/591 comment in registry-api.ts was removed, and the migration's mixed-version gate semantics are unchanged.

No new findings; no critical/high/medium concerns surfaced. High-risk flag is true only due to a new migration file (added) and modified route files under server/src/routes/**, but the reviewer found no medium-or-higher concerns on any of them — modifications are presumed safe per the change-kind guidance. No deletions in sensitive paths.

Decision table: rows 1-8 do not fire (no findings, gated_paths false, no deletions, no medium findings, no team gate, prior decision was approve not escalate). Falls through to row 9 → approve.