fix(identity): persist unlink+relink in lifecycle order - #124
fix(identity): persist unlink+relink in lifecycle order#124cursor[bot] wants to merge 7 commits into
Conversation
A buyer who links an anonymous assessment to a Keyverse account must still see that link after process restart. Persist assessment_participant plus append-only link and link-end evidence, reload through the domain lifecycle, and fail closed on conflicting replay or a subject already bound to another participant. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Keep TRACEABILITY, ADR-0020, ERD, and as-built schema pointing at the opened persist/reload vehicle instead of an unnamed Active PR. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Apply each identity link and then its matching ends in one transaction so a complete in-memory unlink+relink aggregate survives restart. Cover one-shot persist, exact replay, and subject reuse after unlink. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Add a tenant-scoped current-subject lookup so a returning Keyverse login can find the same product-owned participant after the anonymous session token is gone. Ended or replaced subjects stay unfindable until they are current again. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Remove the accidentally committed build tree and ignore /target so later local verification cannot leak compiler outputs into the identity-link successor. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review
Do not merge #124 at 729f3c6. GitHub rejects REQUEST_CHANGES on this bot-authored PR from this automation identity, so this is a blocking COMMENT with the same verdict.
Lifecycle-order persist of a complete unlink+relink aggregate is the right #114 repair. The remaining buyer hole is that current-subject lookup and uniqueness still trust only current_participant_identity_link.
After that derived projection is deleted, load_participant_by_current_identity_subject returns None and a second participant can persist the same issuer-scoped subject as Inserted. ADR-0020 already says the projection is derivable and not the evidence source of truth. Unterminated participant_identity_link rows must answer both lookup and uniqueness.
Prefer the successor that adds those RED contracts. Do not fold HTTP, live Keyverse verification, or backup/restore dumps into this slice. Do not self-approve.
Sent by Cursor Automation: Fix Issues
2 participants
Superseded
This unlink/relink lifecycle-order slice is fully contained in the verified successor chain #133 → #147 → #160. Do not merge this predecessor.
Fresh ancestry evidence:
729f3c6368634699e43947ee03155864d7659842fb0ca5b3da71ffc93768db44484de9ede9f6d6b9is ahead of fix(identity): restore current projection on exact replay #147 by 4 commits, behind by 0.#160 carries the lifecycle-order/history recovery behavior and adds the hosted dual-proof persist/recover command boundary. #160 remains Draft and must still satisfy exact-head CI/security/review gates. Closing this PR does not promote any successor behavior to protected-main truth.