fix(proof): bound workload preflight repeats

[bizzybee90]

Purpose

Repair the exact fail-closed blocker from governed proof run 31383676961: a second valid live-workload-cutoff-options lifecycle exhausted a one-shot OPTIONS policy while the canonical Home desktop cutoff GET is source-owned with exactly four occurrences.

Included scope

• Add a separate primitive-only frozen Home desktop live-workload-cutoff contract.
• Recognize only the exact workspace-bound email_provider_configs GET with ordered select, workspace filter, ordered cutoff fields, and limit=1, plus exact fetch/null/min 4/max 4 and public profile/app-origin identity.
• Permit only its exact derived live-workload-cutoff-options to use min 0/max 4.
• Independently reconstruct dynamic identity in compiler and live recorder.
• Credit completion debt only from fully completed matching dual-adapter base lifecycles.
• Snapshot route and viewport once; preserve every other OPTIONS policy and route/context binding unchanged.

Exact evidence

Run 31383676961 on exact source be98bedf1a491d7c4cdf8af3b31fcb51a13dd15e stopped at tenant-a / home / desktop-1440x900 with live-workload-cutoff-options → policy_occurrence_exhausted. Exact source/deployment binding passed. Cleanup, aggregate postflight, and recovery passed; writer/reader were skipped and the run published zero evidence artifacts.

Explicit exclusions

No generic descriptor registry, matcher sharing, or occurrence propagation; no alternate route, viewport, tenant, workspace, URL/query/header/method/resource/body/bounds/label; no fifth occurrence; no unrelated policy, timeout, count, global-limit, application, workflow, dependency, schema, credential, provider, billing, customer, staging, or production change.

Architecture placement

Current owner / directory: existing product-proof network-policy compiler and live-evidence recorder under scripts/; no new subsystem.

Dependencies and duplicate-system check: a frozen primitive descriptor removes literal drift, while compiler and recorder independently reconstruct the dynamic workspace UUID, ordered URL/query, origins, headers, labels, method, body, resource, route, viewport, context, and bounds. Existing CORS generation and repeatable-preflight completion-debt lifecycle are reused.

Security and tenancy impact

• Authentication / authorization: unchanged.
• Tenant isolation: exact tenant-a context and expected workspace UUID are bound in the canonical identity; wrong route, viewport, identity, query, origin, header, or cross-pair fails closed.
• Service-role impact: none.
• Provider / webhook impact: none.
• Secrets impact: none; raw workspace IDs, URLs, headers, request IDs, counts, and credentials remain excluded from evidence.

Data impact

• Schema / migration / RLS / grant impact: none.
• Backfill, retention, or rollback: none; code rollback restores the prior proof blocker.

Verification

• Behavioural tests: network policy 27/27; live evidence 176/176; total focused 203/203; broader cloud/network/live 385/385.
• CI / security review: independent exact-head audit found zero findings; fresh hosted gates mandatory.
• Proof-first reproduction: unchanged source produced exact OPTIONS max 1 versus source-owned base max 4 while every other identity field matched.
• Dynamic/source binding: alternate workspace identity, four mounted Home owners, exact source chain/order, and original-identity non-retention are pinned.
• Adversarial coverage: 1/0, 1/1, 2/2, 4/4 and interleaved positives; completion debt/incomplete base; fifth completed and in-flight rejection; every base/OPTIONS/binding mutation; one-shot and cross-pair preservation; exact diagnostics, counts, seal, receipt, TOCTOU, and redaction.
• Syntax, ESLint, diff, and redaction checks: pass.

Release safety

• Deployment scope: private no-index preview only after protected exact-head merge.
• Monitoring / stop conditions: stop if more than four occurrences are needed, a different label/reason appears, or cleanup/postflight/recovery/evidence chain fails.
• Rollback or containment: predecessor be98bedf1a491d7c4cdf8af3b31fcb51a13dd15e / manifest 6d85d7915e37d11efa3944df09765c998bf722daeeaadf7c3114b59b7f3d5779; no production action.

Documentation and generated files

• Docs / diagrams / ADR updates: none; no architecture, workflow, or schema change.
• Generated-file or lockfile justification: none.

Completion check

• Starts from current origin/main.
• No valuable work remains only in a dirty worktree, stash, or local-only branch.
• Source branch will be retired under the branch policy after merge.
• Any PR-size or branch-retention exception is documented below, or neither applies.
• Fresh latest-head protected CI and CodeRabbit approval.
• Exact protected merge, private preview, and complete governed proof.

Policy exceptions (leave blank when none apply)

PR-size exception rationale: four files and one coherent safety fix; 887 inserted lines are dominated by isolated lifecycle, identity, debt, count, diagnostic, source-ownership, TOCTOU, and privacy tests required to prove the exact exception cannot widen.

Retained branch reason / owner / review date / maximum retention date:

Summary by CodeRabbit

• New Features

  • Added support for validating the Home live-workload cutoff network request.
  • Added checks for request URLs, parameters, headers, methods, viewport, route, context, and POST data.
  • Added support for repeatable CORS preflight requests and completion tracking.

• Bug Fixes

  • Improved handling of route and viewport values during request validation.
  • Ensured live workload queries and sidebar behavior use consistent request settings.

• Tests

  • Added comprehensive coverage for request lifecycle, limits, pairing, and canonical request validation.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR adds a Home live-workload cutoff contract for the email_provider_configs request. The network policy, live-evidence recorder, and tests now validate canonical request fields, bounded lifecycles, repeatable preflights, route and viewport bindings, and source ownership.

Changes

Home live workload cutoff

Layer / File(s)	Summary
Contract and source request collection scripts/product-proof-network-policy.mjs, scripts/product-proof-network-policy.test.mjs	Defines the Home cutoff contract and uses its query, header, viewport, and occurrence fields in request construction and validation. Tests verify contract immutability, request cardinality, preflights, workspace binding, and source ownership.
Recorder matching and lifecycle accounting scripts/product-proof-live-evidence.mjs	Normalizes route and viewport labels, validates the canonical GET and OPTIONS requests, permits managed preflight repetition, and counts completed cutoff requests.
Lifecycle and policy validation tests scripts/product-proof-live-evidence.test.mjs	Adds canonical fixtures and tests for valid lifecycles, preflight debt, occurrence limits, request identity, context bindings, cross-pairing, one-shot behavior, and label snapshotting.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Home
  participant createSourceRequestCollector
  participant liveEvidenceRecorder
  participant Supabase
  Home->>Supabase: request email_provider_configs with contract query
  Supabase-->>createSourceRequestCollector: return GET and OPTIONS network events
  createSourceRequestCollector->>liveEvidenceRecorder: provide context, route, viewport, and lifecycle data
  liveEvidenceRecorder-->>Home: validate completion and occurrence bounds

Loading

Possibly related PRs

• bizzybee90/bizzybee-app#464: Adds related bounded Home-specific GET/OPTIONS network-policy contracts.
• bizzybee90/bizzybee-app#465: Extends the same contract-driven request and preflight handling.
• bizzybee90/bizzybee-app#457: Introduces related managed-preflight lifecycle and accounting behavior.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: limiting repeated workload preflight occurrences.
Description check	✅ Passed	The description covers the required purpose, scope, architecture, security, data, verification, release safety, and completion sections.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-product-proof-live-workload-cutoff-preflight-occurrences-20260810

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/product-proof-network-policy.test.mjs`:
- Around line 974-978: Update the routeOptions list so the
live-workload-cutoff-options entry is included for both the home and channels
routes, matching the desktop OPTIONS requests emitted by
addDesktopSidebarRequests while preserving the existing exclusion for other
routes.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 01af7d94-7115-4188-bb2c-38ae177ad12c

📥 Commits

Reviewing files that changed from the base of the PR and between be98bed and 0c974a2.

📒 Files selected for processing (4)

• scripts/product-proof-live-evidence.mjs
• scripts/product-proof-live-evidence.test.mjs
• scripts/product-proof-network-policy.mjs
• scripts/product-proof-network-policy.test.mjs