fix(proof): bound drafts workload preflights

[bizzybee90]

Purpose

Repair the exact fail-closed blocker from governed proof run 31441924040: tenant-A Drafts on desktop emitted a second canonical live-workload-cutoff-options preflight while the proof policy allowed only one.

Included scope

• Add one frozen primitive contract for the exact tenant-A / Drafts / desktop live-workload cutoff pair.
• Bind its two base GET owners to an exact two-occurrence OPTIONS allowance.
• Independently re-prove the same dynamic request identity in the live recorder and completion-bound preflight debt to fully completed base lifecycles.
• Add lifecycle, identity, cardinality, mobile one-shot, cross-pair, counter, and redaction coverage.

Explicit exclusions

• No general OPTIONS or REST widening.
• No application, database, schema, RLS, provider, credential, timeout, diagnostic, staging, or production change.
• No change to mobile Drafts, Home, Channels, or any other route/policy occurrence contract.

Architecture placement

Current owner / directory: existing product-proof network policy and live-evidence recorder under scripts/.

Dependencies and duplicate-system check: extends the existing exact-contract, managed-preflight, and completed-base debt mechanisms; no new subsystem or shared cross-trust matcher.

Security and tenancy impact

• Authentication / authorization: read-only request classification only; no auth or grant change.
• Tenant isolation: exact tenant-A, Drafts, desktop, expected-workspace URL, origin, headers, method, body, resource type, labels, and bounds; wrong tenant/workspace/route/viewport variants fail closed.
• Service-role impact: none.
• Provider / webhook impact: none.
• Secrets impact: none; fixed diagnostics and evidence remain redacted.

Data impact

• Schema / migration / RLS / grant impact: none.
• Backfill, retention, or rollback: none; one-commit code rollback restores the predecessor proof blocker.

Verification

• Behavioural tests: proof-first source reproduced OPTIONS 1 !== 2; after repair, focused network/live 364/364, broader cloud/network/live 551/551, complete product-proof cloud suite 1083 pass + 1 expected skip, and application Vitest 871/871.
• CI / security review: local lint, typecheck, syntax, diff check, production build with synthetic non-secret config, dependency audit, and scoped security review are green; fresh exact-head hosted gates and CodeRabbit review are mandatory.

Release safety

• Deployment scope: private no-index successor preview only after protected exact-head merge.
• Monitoring / stop conditions: stop on any gate failure, third preflight, noncanonical identity, debt/count/seal failure, cleanup/recovery failure, or a new governed-proof blocker.
• Rollback or containment: predecessor source 394c84dcb30826f7873719fd6e1cbecb27b9bcd9, preview manifest 608240475e45172fe29bf8310513e9d104f074fe894b6e29d1b47ed7d1bfce3a; no production action in this PR.

Documentation and generated files

• Docs / diagrams / ADR updates: none; existing proof architecture and release gates are unchanged.
• Generated-file or lockfile justification: none.

Completion check

• Starts from current origin/main.
• No valuable work remains only in a dirty worktree, stash, or local-only branch.
• Source branch will be retired under the branch policy after merge.
• Any PR-size or branch-retention exception is documented below, or neither applies.

Policy exceptions (leave blank when none apply)

PR-size exception rationale: four files and one coherent fail-closed repair; 862 inserted lines exceed the normal guideline because 722 lines are literal contract and adversarial lifecycle/identity/privacy tests required to prove the exception cannot generalize.

Retained branch reason / owner / review date / maximum retention date:

Summary by CodeRabbit

• New Features
  • Added support for tracking live workload activity on the Drafts route.
  • Added desktop-specific cutoff handling for Drafts workload requests.
  • Improved network validation for Drafts requests, including CORS preflight behavior and workspace binding.
  • Added consistent handling for repeated managed preflight requests and completion tracking.
• Bug Fixes
  • Prevented unsupported, malformed, or cross-route requests from being accepted as valid Drafts activity.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 0591fb45-f64f-476b-8ead-f407b2e25fb2

📥 Commits

Reviewing files that changed from the base of the PR and between e6c129f and 353fd72.

📒 Files selected for processing (1)

• scripts/product-proof-network-policy.test.mjs

---

📝 Walkthrough

Walkthrough

Adds a drafts live-workload cutoff contract. The network policy generates and classifies its requests. The evidence recorder validates canonical requests, repeatable preflights, occurrence limits, and completion accounting. Tests cover desktop, mobile, identity, binding, and rejection cases.

Changes

Drafts live-workload contract

Layer / File(s)	Summary
Contract and request production scripts/product-proof-network-policy.mjs, scripts/product-proof-network-policy.test.mjs	Defines the drafts email_provider_configs contract, applies desktop occurrence limits, conditionally produces the request, classifies CORS preflights, and validates contract immutability and source ownership.
Lifecycle evidence validation scripts/product-proof-live-evidence.mjs, scripts/product-proof-live-evidence.test.mjs	Tracks canonical drafts requests and repeatable preflights, counts completed requests, and tests lifecycle, identity, proof-binding, body, occurrence, and mobile behavior.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Browser
  participant NetworkPolicy
  participant EvidenceRecorder
  Browser->>NetworkPolicy: Request drafts live workload
  NetworkPolicy->>NetworkPolicy: Match canonical request and CORS preflight
  NetworkPolicy->>EvidenceRecorder: Provide classified network events
  EvidenceRecorder->>EvidenceRecorder: Validate lifecycle and completion accounting

Loading

Possibly related PRs

• bizzybee90/bizzybee-app#483: Adds route-specific live-workload contracts with bounded CORS preflight handling.
• bizzybee90/bizzybee-app#466: Provides analogous Home route cutoff contract and preflight accounting.
• bizzybee90/bizzybee-app#461: Extends repeatable managed-preflight tracking and completion accounting.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the proof fix and the Drafts workload preflight bound.
Description check	✅ Passed	The description covers the required scope, architecture, security, data, verification, release safety, documentation, and completion sections.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-product-proof-drafts-live-workload-preflight-occurrences-20260811

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/product-proof-network-policy.test.mjs`:
- Around line 1614-1628: Replace the formatting-sensitive source string checks
in the drafts route assertions with stable structural or semantic assertions
that remain valid when JSX formatting changes. Update the checks around
draftsSource, draftsSlaSource, draftsRoute, and draftsOwner while preserving
validation that the hooks, cutoff call, route, and EscalationHub drafts owner
are each present exactly as required.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9ecabfbd-394d-478b-9c61-898d3ebbc303

📥 Commits

Reviewing files that changed from the base of the PR and between 394c84d and e6c129f.

📒 Files selected for processing (4)

• scripts/product-proof-live-evidence.mjs
• scripts/product-proof-live-evidence.test.mjs
• scripts/product-proof-network-policy.mjs
• scripts/product-proof-network-policy.test.mjs