fix(security): reconcile tenant submission authority on current main

[seonghobae]

Objective

Reconcile stale PR #346's fail-closed tenant-aware submission boundary directly on protected main, without importing stale ancestry or changing the explicit legacy/demo submission overloads.

Exact current-head evidence

• protected base at reconstruction: 961f44a19c4ced87f8062b3ab9842a9a08d05235;
• exact head: 763bc9ac3204180710f2333c6a222810eb808920;
• changed paths: tenant-aware DefaultDocumentConversionService.submit(...) plus two focused regressions only;
• CI, Security Scan, SAST Semgrep, and fuzz: terminal-success;
• mergeable: true;
• unresolved inline findings: zero;
• stale predecessor fix(security): reject missing tenant authority at submission boundary #346 is superseded.

Security contract

The production tenant-aware submission overload rejects an absent TenantContext before validation, hashing, repository access, artifact storage, or worker dispatch. It no longer invents buyer-demo tenant or subject authority at an authenticated boundary. The explicitly tenant-less overload remains the separate legacy/demo compatibility path and continues to construct its documented demo context before delegating.

Scope boundary

Tenant-aware submission authority only. This does not implement production OIDC/JWT, change tenant/permission header semantics, add durable job persistence, alter upload validation or deduplication, or remove the explicit legacy/demo overload. Issue #314 and the credential-registry stack own those separate authentication concerns.

Merge gate

Keep this exact head unchanged. Auto-merge may act only after all live required checks remain successful, zero valid unresolved findings remain, and a qualifying independent non-author approval is attached to this exact head. If live protection requires an updated base, rebuild or update against protected main and regenerate every base-sensitive check and review. No predecessor evidence transfers.

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0c446324-12d4-4d3f-8306-741bb6528706

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-current-head review request for 763bc9ac3204180710f2333c6a222810eb808920 on protected main 961f44a19c4ced87f8062b3ab9842a9a08d05235. CI, Security Scan, SAST Semgrep, and fuzz are terminal-success; the PR is mergeable and has no unresolved review threads. This branch is the current-main replacement for stale #346. Review read-only; do not mutate the branch or bypass independent approval.

@opencode-agent review
@cwl-noema-review review
@strix review
@coderabbitai review

[coderabbitai]

@seonghobae I will perform a read-only review of PR #438 at 763bc9ac3204180710f2333c6a222810eb808920. I will not modify the branch or approve the PR.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@opencode-agent review
@coderabbitai review
@cwl-noema-review review
@strix review

Review exact head 763bc9ac3204180710f2333c6a222810eb808920 only. Exact-head CI, Security Scan, SAST Semgrep, and fuzz are terminal-success; unresolved inline findings are zero. Validate that the tenant-aware submission overload rejects missing authority before validation, hashing, repository access, artifact publication, or worker dispatch while preserving the explicit legacy/demo overload.

Review read-only; preserve independent reviewer identity. Do not mutate the branch, synthesize author approval, weaken protection, or merge.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 33 minutes and 24 seconds before sending another message.