fix(security): scope job ID lookup after current reservation stack

[seonghobae]

Objective

Reconstruct stale stacked PR #361's unique tenant-scoped identifier lookup boundary on the exact current reservation parent #443, preserving immutable UUID ownership while removing global-read fallbacks.

Exact stack identity

• parent PR fix(reliability): reserve conversion job identifiers after current analytics #443 exact head/base: d5a57a7f4e97467bb2fb163f37e4de5691d7ba31;
• test-only RED commit: 87e41e97d557f0f711eda83ba3245bf62eff620a;
• exact GREEN candidate head: ff6185f318be66fe706f1cf0e12a4063a8bd408b;
• changed paths are limited to repository/service scoped lookup contracts and focused regressions;
• fix(reliability): reserve conversion job identifiers after current analytics #443's lifetime identifier reservation remains in the merged in-memory adapter.

Contract

Default repository and service tenant-ID lookups fail closed rather than invoking globally addressable reads. The in-memory adapter normalizes and applies tenant ownership at its storage boundary while rejecting absent tenant/job authority and concealing foreign jobs. The default application service delegates the tenant predicate to that repository boundary.

Scope boundary

This is a process-local adapter contract. It does not add durable row-level security, database persistence, distributed authorization, generation-fenced mutation, or identity-provider integration. The parallel admin-boundary work is now owned by clean current-main replacement #455; contaminated predecessor #440 is closed and none of its evidence transfers. #455 adds adjacent tenant-scoped list/delete/retry service operations, so the two deltas must be reconciled after their respective parent lines integrate.

Merge gate

Keep Draft while #443/#432 remain unmerged. Require this exact child head's emitted checks and zero valid unresolved findings. After ancestors and clean parallel #455 reach protected main, rebuild or retarget the bounded delta onto the new exact protected base and regenerate all main-targeted CI, Security Scan, SAST, fuzz, current-head reviews, and qualifying independent approval. No evidence from #361, #440, or predecessor heads transfers.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ccbf2826-8334-43a5-b1ba-e739ddffbec9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}