fix(result): bind immutable results to current session provenance

[seonghobae]

Why

ResultSnapshot::new must not accept caller-rebound participant, session, or instrument-version provenance. The authoritative AssessmentSession already owns those bindings under ADR-0003, ADR-0005, and ADR-0010.

Current-base repair

This PR supersedes #90 because protected main advanced after #90's exact-head CI. In particular, result-snapshot PostgreSQL persistence tests landed on main with the predecessor constructor and would not compile if #90 were merged without current-base revalidation. This branch starts from protected main a7637351be8f0f90c12651d3bcafd959bc52ac81, reapplies the verified ownership fix, and migrates the newly integrated persistence fixture to an authoritative assessment session.

Scope

• bind immutable result construction to AssessmentSession provenance;
• fail closed on session, participant, and instrument-version mismatch;
• preserve existing scientific scoring values/provenance without recomputation;
• migrate all known current-main constructor call sites, including real PostgreSQL persistence coverage;
• no persistence schema, bounded-context ownership, external API/event, or psychometric arithmetic change.

Architecture mappings remain unchanged: this enforces existing accepted authority/provenance decisions rather than introducing a new ownership boundary. Canonical protected-main traceability should advance only after integration.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2a66dfc5-6a0f-46f8-b16d-80ab29b8dd6f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Review (36fb316)

Owner/session/instrument-version binding is the right constructor contract for this slice. ResultSnapshot::new now requires an AssessmentSession, rejects rebound participant/session/instrument-version evidence, and copies those identities from the session rather than from caller-controlled input. Existing scoring-contract and PostgreSQL persist fixtures were migrated to the new constructor. Do not merge until exact-head CI is terminal-success and an independent last-push review exists. This review is not an approval.

Ready to merge: No

Draft; required checks are still queued on this synchronize. Last-push independent review is still required.

What is sound

• Fail-closed mismatch arms have realistic tests and Display copy that tells the caller which provenance disagreed.
• Scientific values remain copied from the already-validated scoring boundary; this PR does not recompute scores.
• Persistence fixtures now construct an authoritative session instead of compiling against the predecessor constructor.

Residual product gaps (do not block this slice; do not fold into #157)

• Construction still accepts a Created session. Every current fixture publishes a result for a session that never activated, completed, or began scoring. A later slice must fail closed unless the session is Scoring or Scored.
• Assessment spec, scoring version, and calibration are still taken from the scoring request, not from the session’s published release.
• #157 still uses the unbound three-argument constructor. Land this owner-binding head first; do not treat #157 as a substitute.

Scope note

36fb316 seeds claim_deadline_at so recovery invariants compile after #81. Keep that minimal current-base repair if CI needs it. The documented recovery landing remains #177. Do not grow recovery docs or COPY claims on this branch.

Changelog

The public constructor signature changed and caller rebinding now fails closed. Record that under Unreleased before this head is marked ready.

Independent reviewer required. Do not self-approve. Prefer this head over closed #90. Do not open a second owner-binding PR; extend this constructor only for the session-state gate.

  

_{Sent by Cursor Automation: Fix Issues}

[seonghobae]

Successor for the scoring-state residual is #189 (f3e542d). Prefer that head for owner-binding plus fail-closed publication unless the session is Scoring or Scored. Keep this draft for the owner-binding-only slice; do not merge both. Recovery claim_deadline_at documentation remains #177. Result reload remains #157.

[seonghobae]

Closing as a proven superseded predecessor. Fresh compare shows #97 head 36fb3160 is the merge base/ancestor of #189 head f3e542d0; #189 preserves the authoritative session/participant/instrument-version binding and adds the missing publication-state gate so immutable results can be created only once the session is Scoring or Scored. #189 explicitly says to prefer it over #97.