[bokelley]

Explicit Addie account-link correlation creation fails during node-postgres extended-query parsing on main, before the ownership predicates execute. Give the reused surface parameter $2 and initiating-user parameter $4 a consistent text type at every occurrence. Slack and web correlations can then be issued for the exact originating principal and thread.

Real PostgreSQL first reports 42P08: inconsistent types deduced for parameter $2 (text versus character varying). Typing only $2 exposes the same inherited ambiguity for $4. The final production change is exactly four $2::text casts and two $4::text casts; removing those six casts reproduces the base file byte-for-byte. No predicate, token generation/hash, ten-minute expiry, consume query, replay protection, or callback refusal changes.

Availability repair and positive-control qualification for #7498 / #6827 only. #6827 remains open. This PR is directly on main and does not include or modify #7498's preserved patch. No migration, generated-file change, protocol changeset, historical cleanup, or broader identity-linking closure is included. Draft only, auto-merge off, unmerged. Human review renewal is gated on fresh terminal-green CI for the rebased head. No production resources were accessed.

Publication identity	Value
Base branch and sole parent	main / cdcc8f996e8acd2417d5f7a547711cd21929289b
Head	ee81e58e9f3c9be46d49dcb6c35c304eb9a9152c
Tree	58dee668e4c20ebd72b54a1fb636718350ca28b8
Delta	1 commit, 2 files, +209 / -5
GitHub main verification	Exact cdcc8f99 verified after successful main deployment; publication uses the explicit expected-22b96a44 lease

Pure rebase from published head 22b96a44fdc0537a3e88b050f830b441c61253ab onto exact main cdcc8f996e8acd2417d5f7a547711cd21929289b after successful deployment run 34925749626. Both changed file blobs, the canonical patch, and the stat are byte-identical; git range-diff reports equivalence. Independent review found no file or semantic overlap with #7533’s CSRF/MCP changes. The update uses an explicit expected-22b96a44 lease.

File identities (SHA-256 over file bytes):

File	SHA-256
server/src/db/addie-account-link-correlation-db.ts	5ab8370cdad5aabd374fe1e0a8fb03fb0015de7bc05cc77ab99f3a340acb3398
server/tests/integration/addie-account-link-correlation-db.test.ts	c701a876122fef5a245dee016a9fbcc6d062921180b82deda3d3afe69f90e3e2

Reproducible delta hashes, with BASE and HEAD set to the exact commits above:

• git diff --binary --full-index --no-ext-diff --no-color BASE HEAD | sha256sum: 34679dcc121671c848afe4c805f02c53ea23d99f6fbd484177f831d108994634
• git diff --stat=120 BASE HEAD | sha256sum: 1ac8fbc8392d1628ee5b12d46eda090a42d5b7ef36b9a7ebc8bb13f010792c76

Validation:

Check	Result
Real PostgreSQL integration, production helper and migrations	20/20 passed locally and in fresh exact-head CI
GitHub PostgreSQL integration shards	161 files passed / 2 skipped; 2,126 tests passed / 8 skipped; the 20-test correlation file passed on the exact head
Focused helper / account-link tool / delivery / OAuth callback unit tests	28/28 passed on the refreshed tree; combined unit/real-PG run 48/48
Required root unit suite	71 files, 1,063 passed
Full required server unit suite	617 files, 9,476 passed, 31 skipped (9,507 total); 974.71 seconds
Source and fixed-trace test-aware typecheck	Passed in the full required-gate sequence
New integration-file typecheck	Passed
CSRF/MCP focused suites	83/83 passed locally and in fresh CI: csrf-middleware 71, mcp-route-authorization 4, mcp-principal-authorization 8
Migration registry	3/3 checks passed
Ordinary migration smoke	Fresh source-runner pristine apply and rerun passed: 571 migrations through 590; compiled-runner sources unchanged from prior successful smoke
Repository gates and diff guard	All required pre-commit components, local pre-push checks, normal publication push hook, and diff check passed without bypass
Independent exact-head security/delta review	Clear with no blockers on ee81e58e9f3c9be46d49dcb6c35c304eb9a9152c; sole parent, tree, clean worktree, preserved blobs/patch and complete local gates independently verified
Exact-head GitHub CI	Terminal green on ee81e58e9f3c9be46d49dcb6c35c304eb9a9152c: 32 passed / 1 expected Draft AI-review skip; zero pending or failed contexts

The integration test covers Slack, web/WorkOS, and web/anonymous creation; exact versus wrong user/thread/channel/surface and unsupported user type; stored SHA-256 hash rather than raw token and unchanged TTL; two distinct concurrently issued tokens that remain independently valid; wrong-principal/wrong-surface consume without burning; one-time consumption and replay rejection; simultaneous consumption with one winner; expiry; and owner/channel/user-type/external-ID changes between creation and consumption. Every case calls the production database helper against migrated PostgreSQL.

Failure reproduction uses PostgreSQL 16.15 (postgres:16 image digest sha256:f1c3376c26f2609ab9f29f71f824103fe2fcd8ee0346485cb6122a4f93df6f94), node-postgres 8.23.0, and Node 24.19.0. The INSERT was extracted unchanged using git show from base helper blob ecf334ba1d944bb7bd07c0427c90385de77de1fb and sent with a values array through pg.Client.query. Both exact and wrong Slack/web principals fail at parse time, with zero correlation inserts. The $2-only intermediate was separately reproduced failing on $4, also with zero inserts. Base SQL SHA-256: bd72ec01948177def8f5ecee4e6afac25645fcd0012caf9b8f21c948867df5da; final SQL SHA-256: 3373d94d113dfdaeeb13cae458c4675bfe7ac8e6e6e4b964fbd1f3c0e3717f6c (both exclude an added file-ending newline).

Local migration smoke used isolated loopback-only Docker databases and the production runner's supported ADDIE_MATCHED_V4_EVALUATOR_SCHEMA_REQUIRED=false option, skipping protected evaluator-only migrations 584/585. It does not claim the full CI evaluator-role tampering matrix. No schema was mocked or rewritten. Source-runner pristine migration smoke and both parameter-failure reproductions were rerun against this base. Git object identity confirms that the compiled runner’s source, entire migrations tree, client, configuration, compiler and dependency manifests are unchanged from the previously validated candidate.

Normal Git rebase does not invoke a commit hook. Every required pre-commit component was run directly, including the full server suite rather than the clean-index staged-file selector; local pre-push checks ran without publishing before release.

Focused commands (with DATABASE_URL pointing only to the isolated Docker fixture):

npx vitest run --config server/vitest.config.ts \
  tests/integration/addie-account-link-correlation-db.test.ts
npx vitest run --config server/vitest.config.ts \
  tests/unit/addie-account-link-correlation-db.test.ts \
  tests/unit/addie-account-link-tool.test.ts \
  tests/unit/addie/account-link-delivery.test.ts \
  tests/unit/native-auth-http-wiring.test.ts
npm run test:migrations
npm run typecheck

Reproduction scripts, logs, exact SQL delta audit, and the independent review are retained in this workspace's gitignored .context/rebase-cdcc/ (prior published-head evidence remains preserved separately). Their evidence qualifies this narrow repair only; it does not qualify #7498's entire preserved patch or close the remaining #6827 work.

---

Open workspace in Conductor

[aao-secretariat]

Ladon verdict: Approve

Approve.

Server-only fix: adds six explicit type casts ($2::text×4, $4::text×2) to reconcile the parameter types PostgreSQL deduces for reused surface/initiating-user params in createAccountLinkCorrelation's INSERT…SELECT, resolving the 42P08 parse-time error. Behavior preserved — no change to predicates, TTL, hashing, or the consume path; casts match the varchar column types. Test file (+204) exercises cascade cleanup backed by the real ON DELETE CASCADE FK.

Scope check: touches only server/src/db/** Addie code and its integration test — no protocol surface (static/schemas/source/**, docs/reference/**, dist/**), so no changeset required and no schema↔docs coherence concerns. Not a migration under server/src/db/migrations/**.

Gates: gated_paths false; high_risk false; no no-auto-approve team match. No Critical/High/Medium findings. Rows 1–8 do not fire → row 9 approve. (Note: review_decision is REVIEW_REQUIRED, but the gated-paths hard gate only applies when gated_paths is true, which it is not here.)