feat: connect Ask answers to canonical project histories (v2.20.0)

[seonghobae]

Buyer outcome

Post-scoped Ask and Global Ask citations now open the same authorization-first Project history used by the dedicated Buyer destination. The integration reuses the canonical project query, timeline, and optional TEPP validation rather than creating parallel authority.

Exact stack

• Canonical Project history parent: feat: add Buyer Project history destination (v2.18.0) #285.
• TEPP validation parent: feat: recover TEPP validation on canonical Project history (v2.19.0) #339 at 59d687e746bfa504302e4b4a3752615c3653ec35.
• Current child head: 7d2654fb19ba7a88815edcefeb0a44f1bd05f619.
• Follow-up hardening is stacked as fix: reuse authorized entity ids on Global Ask cutoff query (v2.20.1) #357 and fix: reuse shared Global Ask session storage key (v2.20.2) #360; atomic failed-turn rollback is tracked as blocker [Bug] Roll back rejected Global Ask turn atomically instead of poisoning the session #362.
• The latest parent and concurrent child repair lines were preserved through ordinary merge commits; no force update, history rewrite, protection bypass, or feature rollback was used.
• GitHub currently reports this head mergeable, but mergeability is not merge readiness.

Product and security boundary

Ask returns structured links only from cited posts that pass current tenant ABAC, publication eligibility, and the answer knowledge cutoff. Exact source project identity outranks inferred identity. Opening a link lazily reuses the canonical timeline and optional TEPP metadata; it never creates a second project query, classifier, timeline, or TEPP client. Persisted answers are withheld when any citation loses visibility, and stale Global Ask sessions must restart before hidden prose is reused. Citation UUIDs are validated before SQL. Unexpected contextual-orchestrator/provider errors return a generic 503 without raw provider details.

Stabilization already applied without retreat

The committed product source contains the following fixes; temporary repair workflows are absent.

• The final Global Ask SQL binds cutoff as positional argument $4.
• The final SQL reuses the once-materialized authorized_entity_ids, preserving private-visibility scope even when the public API receives a one-shot iterable.
• The post-chat cutoff migration and rollback use unique identity 0054, while canonical Project-history lookup retains 0053.
• Every integration-test, replay, migration-script, ADR, and changelog reference follows the new identity.
• A focused one-shot-scope test asserts the exact final argument tuple.
• A real PostgreSQL regression executes the final query boundary.
• A repository-wide migration-prefix test prevents numeric identity collisions.
• Both prior self-modifying stabilization workflows were removed from the product head.

Remaining current-head blocker

The current implementation persists a Global Ask turn before performing its final post-persist citation reauthorization. If that reauthorization fails, the generic 503 is correct, but the rejected turn remains in the session and can force every later request to restart with 409.

Issue #362 owns the non-regressive fix: persist and final reauthorization must run inside one outer PostgreSQL transaction, and the existing 503 must be raised inside that transaction so the rejected turn and citation rows roll back. The post-persist race check, ABAC, cutoff, existing session continuity, and prior successful turns must remain intact. #342 is not merge-ready until that fix is present on the accepted stack and its real PostgreSQL rollback/session-continuity test passes.

Tracked non-blocking hardening

• [Performance] Batch reauthorize persisted post-Ask evidence without N+1 queries #358: batch persisted-exchange reauthorization without weakening fail-closed behavior.
• [Maintainability] Centralize Global Ask session storage access #359 / fix: reuse shared Global Ask session storage key (v2.20.2) #360: centralize the Global Ask session-storage key while retaining 404/409 recovery.
• [Operability] Preserve server diagnostics behind generic orchestrator 503 responses #361: preserve PII-safe server diagnostics behind generic provider 503 responses.

Verification evidence and live gate

Fresh hosted runs were created for 7d2654fb19ba7a88815edcefeb0a44f1bd05f619:

• Tests: queued (32454001638)
• SAST Semgrep: queued (32454001628)
• Security Scan: queued (32454001635)

Queued status is not success, and these runs predate the still-required #362 product fix. The final accepted head must rerun focused tests, the real PostgreSQL contracts, complete Python and frontend suites, lint, production build, Storybook, migration replay, compile/import checks, and diff hygiene.

Merge gate

Merge only after:

1. TEPP fix(ui): keep digest disclosure panels and 24px targets (v0.86.3) #155 → fix: leave tied organization similarity unbound (v0.86.4) #159 and LineageWeave parent prerequisites settle in order;
2. [Bug] Roll back rejected Global Ask turn atomically instead of poisoning the session #362 is implemented without removing Global Ask, persistence, ABAC, cutoff, or session continuity;
3. every required check is terminal-success on the final restacked exact head;
4. every valid review thread is resolved against that head;
5. a qualifying independent formal approval exists; and
6. GitHub accepts the protected merge without self-approval, force-push, history rewrite, or bypass.

Predecessor-head, queued, pending, author-only, and child-derived evidence is not transferable.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d7d76c92-1e6c-4261-9df0-da6c27b334a6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact current head: ab489d81af9b48cf6adc7ae7ff22f84001cf20e2.

The self-modifying PR workflow and repair scripts were removed after local application. The shipped product now attaches authorization- and cutoff-bound project-history links to post-scoped and Global Ask, reuses the canonical timeline/optional TEPP validation, persists exact Ask knowledge cutoffs through migration 0053, validates citation UUIDs, and fails closed when citations lose access. Unexpected contextual-orchestrator/provider exceptions are normalized to a generic 503 without exposing raw provider messages.

Verification on this head lineage: backend 761 passed, 17 skipped, 5 warnings before the final version metadata correction; frontend 165 passed, lint, Vite build, Storybook build; API integration 98 passed, 5 skipped; Ask contracts 18 passed; schema 7 passed; release-version hygiene 4 passed; compileall and diff-check passed. Hosted required Checks are newly queued and no independent formal approval exists. Parent PR #339 remains unmerged, so this is not merge-ready for protected integration.

[seonghobae]

Documentation checkpoint added. Exact current head is now 202b7603404bd83c51e75dfb88661d82c601b992; parent #339 remains 43262dc76622928fdf90b922653949b4ac7c6631. Hosted required Checks restarted/queued for this exact head; independent approval is still absent.

[seonghobae]

Exact current head updated to bd9e965e3943ea19a115d53c0a8f39a0f70968d6 by the documentation freshness correction. The parent remains 43262dc76622928fdf90b922653949b4ac7c6631; hosted Checks are queued for this exact head and no independent approval is present.

[seonghobae]

Parent #339 advanced to 8d12743 and was merged normally into this stack. Exact head is now 6b38366; 37 focused Ask/TEPP tests and diff-check passed after propagation. Hosted checks remain queued and formal independent approval is still required; no merge attempted.

[devin-ai-integration]

Devin Review found 10 new potential issues.

[seonghobae]

Stabilization ownership note for the exact current stack:

• Preserve the canonical Project-history, TEPP validation, post Ask, and Global Ask behavior; do not revert or close the feature.
• Fix the committed source itself: bind the final Global Ask cutoff as $4, reuse the already-materialized authorized entity IDs, move the child cutoff migration/rollback to unique identity 0054, and update all migration/replay references.
• Add both a fake-boundary assertion and a real PostgreSQL execution regression, plus a repository-wide unique migration-prefix contract.
• Remove both temporary stabilization workflows from the final product head.
• Re-fetch every review thread and rerun full exact-head checks before resolving or merging.

Current queued checks and repair workflows are evidence gathering only; they are not treated as a completed fix.

[seonghobae]

Root-cause repair at 80ce60411463bf21102397b9edf9053dce28a99d

The exact branch source now contains the fix instead of relying on a self-modifying workflow:

• Bound cutoff as the fourth argument of the final gather_global_chat_sources PostgreSQL query.
• Renamed the colliding post-chat cutoff migration from 0053 to unique 0054, including rollback, migration dispatch, API contract, and cutoff tests.
• Added permanent migration-identity and real-PostgreSQL cutoff regression contracts.
• Removed both stabilize-pr342-global-ask*.yml workflows; no workflow edits, commits, pushes, or deletes product source at runtime.
• Added ADR 0125 and a changelog fragment.

Verification:

• Focused synthetic/backend suite: 11 passed, 2 skipped
• With LINEAGEWEAVE_TEST_POSTGRES_ADMIN_DSN=postgresql://seonghobae@localhost/postgres: 4 passed, 1 skipped
• Python compile and git diff --check passed.

The branch was pushed normally. Hosted required Checks and formal approval remain the merge gate; no self-approval, force-push, or merge bypass was used.

[seonghobae]

Merge-resolution evidence at 7d2654fb19ba7a88815edcefeb0a44f1bd05f619

The concurrent remote commits were integrated with normal merges; no force-push was used.

Current exact-head state:

• Global Ask final SQL binds the requested cutoff as parameter 4.
• Generator-backed authorized corporate-entity scope is materialized once and reused, so ABAC scope is not lost before the final query.
• Migration 0054 remains unique and dispatched alongside the recovery stack's 0101/0102 migrations.
• Source-mutating stabilization workflows remain removed.
• Baseline conflict resolution preserves both the Ask integration record and the recovery maintenance note.

Verification at the merge-resolution head:

• 13 passed, 1 skipped with the local PostgreSQL cutoff test enabled.
• No conflict markers.
• git diff --check passed.

Hosted required Checks and formal approval are still the only merge gates. No self-approval, force-push, or protected merge bypass was used.

[seonghobae]

Remaining authorized-entity reuse from the 80ce604 cutoff repair is now stacked as #357 (feat/ask-authorized-entity-ids-reuse-v2201 → this branch). The product head already binds $4 and unique migration 0054; #357 reuses materialized authorized_entity_ids as $1 and records v2.20.1. Independent APPROVE and exact-head required Checks remain the merge gate. No self-approval or force-merge.

[devin-ai-integration]

Devin Review found 3 new potential issues.

[devin-ai-integration]

🔍 Session can be poisoned by a persisted turn that then fails the post-persist visibility check

In ask_agent, persist_global_ask_turn writes the new turn's citations (main.py) BEFORE read_authorized_ask_evidence verifies them (:2956). If the post-persist check fails (503, "evidence changed"), the just-persisted citation stays in global_ask_turn_citation. On the next request, global_ask_session_citations_authorized re-checks all session citations including that one and returns 409, forcing a session restart. This is a narrow race and is broadly consistent with the ADR 0113 fail-closed intent, but it means a transient provider/visibility hiccup can permanently retire a session rather than being retryable. Worth confirming this is the intended fail-closed boundary.

(Refers to this code)

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[seonghobae]

이 동작은 의도된 fail-closed 결과가 아니라 유효한 session-liveness 결함입니다. 숨겨진 citation을 반환하지 않는 계약은 유지하되, persist와 post-persist authorization check를 하나의 outer database transaction으로 묶고 all_citations_visible == false 예외를 transaction 내부에서 발생시켜 새 turn/citation insert 전체를 rollback해야 합니다. 실제 PostgreSQL 회귀 테스트는 (1) visibility race를 유도해 503을 받고, (2) 해당 session의 turn/citation 수가 증가하지 않으며, (3) 같은 session의 다음 안전한 질문이 409 없이 계속되는지 검증해야 합니다. 이 스레드는 최종 exact head에서 그 테스트와 전체 suite가 통과하기 전까지 해결하지 않습니다.

[seonghobae]

GitHub writes retry (2026-08-21 cycle).

Exact parent head remains 7d2654fb19ba7a88815edcefeb0a44f1bd05f619. Cutoff $4, authorized_entity_ids reuse, unique 0054, and the one-shot generator contract are on this head. Stacked #357 (16c8c6a) now only locks ADR/CHANGELOG/v2.20.1 plus list-argument assertions after a normal merge.

Independent APPROVE is still required. I will not self-approve. Remaining Global Ask maintenance defect (hardcoded sessionStorage literals in acceptAnswer/409) will ship as a separate stacked slice, not mixed into this PR.