fix(proof): bound workspace binding preflight repeats

[bizzybee90]

Purpose

Repair the exact fail-closed blocker from governed proof run 31369456189: a second valid workspace-user-binding-options lifecycle exhausted a one-shot OPTIONS policy while its exact base GET is source-owned with max 2.

Included scope

• Recognize only the exact canonical workspace-user-binding GET: exact user-bound Supabase REST URL/query ordering, GET/fetch/null body, min 1/max 2, and exact accept-profile plus app-origin identity.
• Permit only its exact derived workspace-user-binding-options policy to use min 0/max 2.
• Independently re-prove base/options identity in live normalization.
• Credit completion only through the canonical internal base marker.
• Require accepted OPTIONS not to outnumber completed matching base GETs at readiness, seal, and finalize.
• Keep authenticated-user-options at 4 and every other OPTIONS policy at 1.

Exact evidence

Run 31369456189, source 476c2116d6725a7e69edf3622484825fbaad2985, stopped at tenant-a / home / desktop with workspace-user-binding-options → policy_occurrence_exhausted. Cleanup, explicit postflight, and independent recovery passed. Tenant B was absent, tenant A unchanged, protected surfaces zero, provider/production flags false, and no proof artifact was published.

Explicit exclusions

No generic options.max = base.max, label-suffix matching, wildcard/subset identity, extra occurrences for workspace-record or any other policy, timeout/global-limit changes, app behavior, workflow/gate, dependency, schema, credential, provider, billing, customer, staging, or production mutation.

Architecture placement

Current owner / directory: existing product-proof network policy and live evidence under scripts/; no new subsystem.

Dependencies and duplicate-system check: extends the existing collector/recorder and replaces three duplicated canonical workspace-binding constants with one primitive-only frozen descriptor. Producer and recorder still independently construct and validate dynamic user, URL, origin, and header identity.

Security and tenancy impact

• Authentication / authorization: read-only request classification only; no auth or grant change.
• Tenant isolation: exact expected user-bound URL, origins, headers, labels, and occurrence bounds; cross-user and cross-pair variants fail closed.
• Service-role impact: none.
• Provider / webhook impact: none.
• Secrets impact: none; redaction and privacy tests remain fail-closed.

Data impact

• Schema / migration / RLS / grant impact: none.
• Backfill, retention, or rollback: none; code rollback only, with the known proof blocker returning.

Verification

• Behavioural tests: focused live evidence 66/66, network policy 19/19, including adversarial occurrence, debt, identity, and privacy cases.
• CI / security review: prior exact head passed all hosted gates; fresh exact-46b5b8cc gates and CodeRabbit rereview are mandatory.
• Independent exact-head security audit: zero findings.
• Syntax/parser, diff, and redaction checks: pass.

Release safety

• Deployment scope: private no-index preview only after protected exact-head merge.
• Monitoring / stop conditions: stop on any gate failure, changed reason/label, or cleanup, postflight, recovery, or evidence-chain failure.
• Rollback or containment: predecessor 476c2116d6725a7e69edf3622484825fbaad2985 / manifest 4afe27ea36469c6c97023f064c03e008090a1ecebf47d4d8fecc06d060b22add; no production action.

Documentation and generated files

• Docs / diagrams / ADR updates: none; no architecture, gate, or schema change.
• Generated-file or lockfile justification: none.

Completion check

• Starts from current origin/main.
• No valuable work remains only in a dirty worktree, stash, or local-only branch.
• Source branch will be retired under the branch policy after merge.
• Any PR-size or branch-retention exception is documented below, or neither applies.
• Fresh latest-head protected CI and CodeRabbit approval.
• Exact protected merge, private preview, and complete governed proof.

Policy exceptions (leave blank when none apply)

PR-size exception rationale: four files and one coherent safety fix; total PR is 635 insertions/31 deletions, slightly above the normal 400–600 guideline because 467 inserted lines are adversarial lifecycle and privacy tests required to prove the narrow exception cannot widen.

Retained branch reason / owner / review date / maximum retention date:

Summary by CodeRabbit

• Bug Fixes

  • Improved validation of workspace-user binding requests, including identity, URL, headers, methods, request bodies, and occurrence limits.
  • Enhanced handling of repeated CORS preflight requests and request completion ordering.
  • Added safeguards for malformed, incomplete, mismatched, or cross-policy request sequences.
  • Improved diagnostics while preventing secrets from appearing in successful results.

• Tests

  • Expanded coverage for workspace-user binding, preflight behavior, request pairing, lifecycle completion, and validation rules.

[coderabbitai]

📝 Walkthrough

Walkthrough

The product-proof scripts now recognize authenticated workspace-user-binding requests for /rest/v1/users. They validate identity and request details, support repeatable managed CORS preflights, track completion, and test valid and invalid lifecycle variants.

Changes

Workspace user-binding evidence

Layer / File(s)	Summary
Canonical request contract and identity wiring scripts/product-proof-live-evidence.mjs, scripts/product-proof-network-policy.mjs, scripts/product-proof-network-policy.test.mjs	A frozen workspace-user-binding contract defines the canonical request. Network-policy construction and live-evidence validation use the normalized user identity and validate request fields and occurrence limits.
Managed preflight and completion tracking scripts/product-proof-live-evidence.mjs, scripts/product-proof-network-policy.mjs, scripts/product-proof-network-policy.test.mjs	Workspace-user-binding preflights use the contract label and occurrence maximum. Managed-preflight detection and canonical request completion tracking include this request type.
Workspace-binding lifecycle validation scripts/product-proof-live-evidence.test.mjs	Tests cover request fixtures, ordering, interleaving, incomplete lifecycles, occurrence exhaustion, malformed requests, cross-policy pairing, and successful Realtime finalization.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Browser
  participant LiveEvidence
  participant NetworkPolicy
  participant Realtime
  Browser->>LiveEvidence: Send workspace-user-binding GET and managed OPTIONS requests
  LiveEvidence->>NetworkPolicy: Classify requests with expected user identity
  NetworkPolicy-->>LiveEvidence: Return canonical request and preflight occurrence matches
  LiveEvidence->>LiveEvidence: Track preflight and base-request completion
  LiveEvidence->>Realtime: Finalize validated evidence

Loading

Possibly related PRs

• bizzybee90/bizzybee-app#380: Introduces the product-proof network evidence contracts extended by this change.
• bizzybee90/bizzybee-app#457: Introduces managed-preflight detection and completion accounting extended here.
• bizzybee90/bizzybee-app#461: Adds repeatable authenticated-user preflight and lifecycle accounting extended to workspace-user-binding requests.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the fix for repeated workspace binding preflight handling.
Description check	✅ Passed	The description covers all required template sections with clear scope, security, data, verification, release, and completion details.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-product-proof-workspace-binding-preflight-occurrences-20260810

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/product-proof-live-evidence.test.mjs`:
- Around line 2608-2623: Remove the duplicate preflightFor definition near the
later test and hoist one module-scope preflightFor helper shared by both tests.
Preserve its existing label default and preflight request shape, and update both
test sections to call the shared helper.

In `@scripts/product-proof-network-policy.mjs`:
- Around line 515-529: The canonical workspace-user-binding contract is
duplicated across three sites; export one shared descriptor and derive each site
from it. In scripts/product-proof-network-policy.mjs lines 515-529, replace the
inline comparison and provide the descriptor’s maxOccurrences to
addCommonAuthenticatedRequests. In scripts/product-proof-live-evidence.mjs lines
702-725, derive the URL, headers, and occurrence bounds from that descriptor. In
scripts/product-proof-network-policy.test.mjs lines 675-677, assert against the
exported descriptor instead of restating the occurrence rule.

In `@scripts/product-proof-network-policy.test.mjs`:
- Around line 650-656: Update the repeatable-preflight assertion in the test to
sort the mapped actual labels before comparing them with the expected labels.
Keep the existing filter and expected label set unchanged so the assertion
remains independent of request insertion order.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: a2d8678e-9891-412e-aed5-d6eb4b4d0571

📥 Commits

Reviewing files that changed from the base of the PR and between 476c211 and a40bb10.

📒 Files selected for processing (4)

• scripts/product-proof-live-evidence.mjs
• scripts/product-proof-live-evidence.test.mjs
• scripts/product-proof-network-policy.mjs
• scripts/product-proof-network-policy.test.mjs