fix(data-integrity): bind artifact-read audit to issued token authority

[seonghobae]

Objective

Keep verified artifact-read evidence bound to the immutable issued-link identity that produced it. The ledger previously accepted READ events for an unknown token or another tenant/subject/document, and restart replay accepted those tampered relationships as durable audit evidence.

Test-first evidence

Exact test-only head 02462d5256932266b8df93d4152a25a783f4f941, based on #402 exact head c1389e97f25157638e2ffdaa6a6eebba45cae91a, added ArtifactLinkLedgerReadAuthorityTest before changing production. Exact-head CI 31543296702 checked out that SHA and failed in the Maven test/coverage gate as expected while recordRead(...) and replayRead(...) still appended parsed events without consulting the issued-link map.

RCA refined one initial test assumption before the production repair: revocation is a separate temporal state, not a different immutable token identity. A request can verify before a concurrent revocation and append its audit event after the revocation transition, so rejecting a matching read solely because the token is now revoked would lose legitimate audit evidence and overconstrain the race boundary. The final regression therefore rejects unknown-token and tenant/subject/document identity mismatch on live append and restart replay, while the existing ISSUED -> REVOKED -> READ round-trip remains valid.

Implementation and GREEN evidence

Current exact implementation head is 559118e410d6e0d2f98fbf2b50ede7f1460900d0, with parent #402 still exact c1389e97f25157638e2ffdaa6a6eebba45cae91a and protected main still exact 55d7ae8647208e301f282350f076eeddaba61d11 at the latest direct refetch.

The implementation binds each read event to an existing issued token record with exact tenant, subject, and document identity before append/publication, and applies the same invariant during restart replay. Runtime mismatch raises a controlled IllegalStateException; malformed persisted authority continues to use the ledger's generic invalid-line failure. Revocation state is deliberately not part of the immutable identity predicate, preserving legitimate audit-after-concurrent-revoke ordering.

The first implementation head 78f15060f738a7ab043dbb9cd45c7308aab64f91 reached functional tests but failed the repository's exact 100% branch-coverage gate because the new fail-closed null event / null token id branches were not directly exercised. No production behavior was weakened: focused regressions were added for those malformed runtime inputs. The ancestor status-code fixture was also made authority-valid by persisting a matching ISSUED record before injecting raw READ status boundaries, so #400's independent 100..599 invariant remains isolated.

Exact current-head proof:

• CI 31544505151: success;
• Maven exact-head test/coverage job 93953995574: success;
• Maven synthetic parent-merge compatibility job 93953995561: success;
• Buyer-readiness scripts job 93953995693: success;
• fuzz 31544505148: success;
• formal reviews: none;
• unresolved review threads: none at the latest direct refetch.

Scope and dependency

This child is deliberately stacked on #402/#400/#357 because those PRs own the same append-only artifact-link/read ledger integrity path. It changes only read-event identity binding plus focused regressions. It does not alter token signature verification, artifact byte delivery, HTTP status validation, revocation transition validation, token-expiry decisions, tenant authentication, persistence technology, or external audit storage.

Merge gate

Keep Draft while the ancestor stack remains open. #357 is the protected-main-facing parent and remains gated by live governance/independent approval; #400 and #402 must then be reconciled/integrated in order before this child is rebuilt against the resulting protected baseline. After every parent integration, regenerate base-sensitive CI/security/review evidence on the new exact child identity. Independent non-author approval remains a separate protected-merge gate.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5dbcde7e-ca6b-4499-99c5-a2054498a74a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by clean current-stack reconstruction #450. #450 is based on exact current revocation parent #449 head 17fcbbe59267397c49fac208e2611130936eecb9, begins with test-only RED commit bab2867ca6ba3b6e470d35b7504c87cdba201006, and restores this PR's read-authority invariant plus the authority-valid ancestor status fixture without importing obsolete #402/#400/#357 ancestry. Exact GREEN candidate head is 9b44b4448fdbfb1fe1d3aacede4d492df2ca7124; child checks are being regenerated. Closing this stale stacked PR prevents ambiguous parent lineage and duplicate review. No predecessor check or approval evidence transfers.