Make TicketTask a first-class workspace-scoped aggregate

[seonghobae]

Problem

Current TicketTask persistence has user_id and organization_id but no workspace_id. PR #1486 can scope email-linked task joins through Email.workspace_id, but the task aggregate itself cannot enforce workspace ownership. CodeRabbit's exact-head review identified the remaining WebDAV path: a task id owned by the same user/organization can still be addressed from another workspace because webdav_service has no task-level workspace predicate; hiding the joined email is not an ownership invariant.

This is a structural authorization/data-model gap, not a route-specific query tweak. Fix it in the Naruon canonical owner rather than adding another ACL workaround.

Required domain/schema repair

• Add non-null workspace_id to TicketTask as part of the aggregate owner scope (user_id, organization_id, workspace_id).
• Add an Alembic migration that backfills email-linked tasks from email_records.workspace_id and defines an explicit, deterministic policy for existing source-less tasks; no guessed cross-workspace default.
• Move task repositories/queries/mutations (API, WebDAV, Reply-SLA, imports/workers) to the same three-part workspace owner invariant.
• Preserve external/legacy compatibility at boundaries; do not duplicate source ownership truth in consumers.
• Add cross-workspace negative tests for GET/list/update/WebDAV/Reply-SLA paths and a real PostgreSQL migration acceptance test.
• Update DDD/ADR/data-model documentation so TicketTask workspace ownership is authoritative rather than inferred from an optional related email.

Acceptance

1. A same-user/same-organization session in workspace B cannot discover, read, mutate, sync, or infer the existence/state of a task owned by workspace A, whether the task has a related email or is source-less.
2. Existing migrated rows receive an auditable workspace assignment or fail migration/provisioning closed; no silent arbitrary assignment.
3. Repository-owned tests plus real PostgreSQL migration tests are GREEN on the unchanged exact head.
4. PR feat(noema-agent): add calendar conflict-check tool #1486's WebDAV review finding is resolved by the aggregate invariant, not by route-local masking.

Evidence: PR #1486 review thread PRRT_kwDOSNjZ2s6hzF2d, predecessor exact head 9ebb5953463059eaae3a5053ef4623ef89347203.

Live validation — 2026-09-19

Exact source audit on #1486 22c173bb93ef15c3244477fe32540aeb2bcf1199 confirms this is still a real aggregate-boundary RED, not a stale review finding:

• backend/db/models.py::TicketTask still has user_id and nullable organization_id but no workspace_id.
• backend/api/tasks.py::_build_task_query scopes joined Email rows by workspace but explicitly admits TicketTask.related_email_id IS NULL; source-less tasks therefore have no workspace ownership predicate for list/PATCH.
• backend/services/webdav_service.py::determine_knowledge_materialization_intent_from_db constrains the optional joined Email by workspace but selects TicketTask itself only by task/user/organization.
• backend/services/noema_agent.py::tool_list_tasks and tool_update_task_status select/update tasks by user/organization (plus task uid for update) without workspace, even though the agent dependency already carries workspace_id.

The implementation order remains constrained by migration ownership. #1503 9151c75568c582c8147cfee6757cd00a9b4d60b7 owns the deterministic workspace owner/organization bindings and canonical 0018_workspace_registry → 0019_email_read_state_repair → 0020_workspace_organization_binding → 0021_workspace_personal_owner_binding chain. #1486 carries a separate descendant migration history. Adding TicketTask.workspace_id directly on the unreconciled #1486 ancestry would either guess a source-less workspace or cement a parallel/colliding migration lineage.

Decision: keep this issue open/high and do not mask it with another route predicate. First reconcile the canonical workspace/migration owner through the normal non-force stack, then implement the aggregate invariant. After reconciliation, email-linked tasks backfill from Email.workspace_id; a source-less task may be assigned only from one auditable canonical workspace-owner binding. Zero or multiple valid candidates must fail migration/provisioning closed with explicit diagnostics; no arbitrary personal/default workspace is allowed.

Required negative acceptance after that reconciliation includes Tasks API source-less list/PATCH, WebDAV task lookup/materialization, Noema list/update, Reply-SLA creation/reload, imports/workers, and a real PostgreSQL migration containing ambiguous and unassignable legacy rows.

Live prerequisite topology

The earlier shorthand .github#2040 repair → external dispatch is no longer sufficient. Protected .github/main remains 64aa08d7fa487deacd41c761c36277ca68cab6c9; scheduler/producer owner #2040 remains exact 12c3fa6f3623aa5f2979d3d5ee4ed987002a6c0d, Draft/open/non-mergeable. Because both sides changed the shared scheduler after merge base fb17ef556f94f673234aa557254ae52779e9a7b0, #2040 must first perform ordinary/non-force path-wise protected-main reconciliation, preserving its valid owner deltas while adopting compatible current-main queue/coalescing/capacity behavior and resolving the production repository-identity RED.

Central base-SAST/security is also a distinct prerequisite. .github#2269@a83d6d325c28620bb393d7b79a3cc74fe8130c38 and .github#2272@5b9e8642361818769d58af6f4e17a6087c90f6ad both harden initial https://api.github.com admission, but default urllib.request redirect handling still has a reproduced credential-egress RED: a cross-origin 30x can carry the Authorization header unless redirects are rejected or every redirect target is revalidated. #2272 additionally carries the deploy-pages.yml caller-input shell-injection repair, but central Semgrep excludes .github/workflows, so executable regression coverage is still required. #2272 has not yet fully inherited #2269's focused CodeQL-helper regression delta; sibling closure/supersession is therefore not justified.

Related #2268/#2271 repository-identity slices are source authority only until their own acceptance settles. The external authenticated repository_dispatch canary remains independent of repository-local CodeQL success.

Current dependency order is therefore: central #2269/#2272 valid production+test delta convergence or a verified complete successor → #2040 path-wise protected-main reconciliation with #2268/#2271 adopt/adapt where applicable → fresh exact-head central security/SAST/CodeQL + qualifying review → unchanged external dispatch canary → #1623 revalidation against the then-current vulnerability database and protected integration → #1694 → #1691 → #1503 protected workspace/migration owner → #1486 ordinary adoption/rechain → this #1673 aggregate implementation and exact-head PostgreSQL/security/review acceptance.

This ordering is an owner/migration repair finding, not permission to close or silently defer the product gap.

[seonghobae]

2026-09-19 prerequisite refinement

The TicketTask.workspace_id aggregate RED remains unchanged, but the central prerequisite graph gained a later CodeQL credential owner. .github#2275@443c9f6013a831b7e4605532809f7aae375d1019 is stacked on #2271@2b849c874122961e025c29f7fa0bb697863c3d68 and owns only target GHAS/code-scanning analysis-read credential selection. It probes the target code-scanning/analyses endpoint and passes only a credential that proves analysis-read capability into the GHAS identity proof; #2271 retains repository-identity admission and #2040 retains scheduler/wake authority.

#2275 is not acceptance-ready. Current CodeRabbit thread PRRT_kwDOS_C14s6j3erF is unresolved because the fail-closed test asserts result.stderr although the selector emits its ::error::no configured credential can read target CodeQL analyses... diagnostic to stdout. Exact Security 35384698705, CodeQL 35384698801, and Semgrep 35384698974 runs remain queued, and current review metadata reports 75% diff-scoped docstring coverage rather than the 100% owned-production documentation target.

The base-SAST sibling also settled partially: .github#2272@5b9e8642361818769d58af6f4e17a6087c90f6ad has Semgrep 35346250233 SUCCESS but Agent Review Runtime Quality 35346250239 FAILURE at Verify exact-head path policy and syntax; CodeQL/Python Security/Security remain queued. That failure is caused by an acceptance-path allowlist that rejects legitimate .config/semgrep.yml and .github/workflows/deploy-pages.yml changes before later tests. It must be repaired narrowly; cross-origin redirect credential containment, the deploy-pages executable regression, and #2269 focused-regression inheritance remain open.

Accordingly, do not implement the aggregate migration early. Current order is #2269/#2272 convergence + #2275 correction/acceptance → #2040 ordinary/non-force protected-main reconciliation using the latest valid #2268/#2271/#2275 slices → fresh central acceptance/review → external dispatch canary → #1623 revalidation/integration → #1694 → #1691 → #1503 → #1486 ordinary adoption/rechain → this #1673 implementation. The eventual backfill invariant is unchanged: email-linked tasks derive workspace_id from Email.workspace_id; source-less rows require exactly one auditable owner binding, and zero/multiple candidates fail closed.

[seonghobae]

Correction to the preceding prerequisite note

.github#2275 advanced after the previous comment to exact a900ec17f1e4a7db384e3052c23d3cf7440f0651. The one ordinary-forward delta changes only the focused GHAS credential test (+1/-1), correcting the fail-closed assertion from stderr to stdout; CodeRabbit thread PRRT_kwDOS_C14s6j3erF is now resolved/outdated.

This does not unblock the aggregate migration yet. Fresh #2275 exact-head Security 35389309836, CodeQL 35389309810, and Semgrep 35389309876 are queued, the PR remains Draft, and qualifying current-head review is absent. The prior diff-scoped docstring report was 75%, so the 100% owned-production documentation target also remains unproven. Preserve the dependency order from the prior note using current #2275 a900ec17...; do not implement TicketTask.workspace_id before #1503/#1486 ancestry is reconciled.

[seonghobae]

#2275 exact-head advance

Central #2275 is now exact a3b8cc1017acb82ed9a002c1f591c70617ad87e6. The new commit is doctoring-only (+11/-5), preserves the corrected fail-closed stdout assertion, and records all three OriginWeave language shards as terminal at the same immediate GHAS identity failure. Fresh Security 35389422805, Semgrep 35389422859, and CodeQL 35389422758 are queued. Replace the stale exact-head reference in the preceding note; the #1503 → #1486 → #1673 migration/aggregate ordering is unchanged.

[seonghobae]

2026-09-19 aggregate prerequisite correction

The TicketTask.workspace_id RED is still valid, but the central prerequisite snapshots above are stale.

Fresh authority is now .github#2279@25f83aaee9eb97e423f6ef2467e722035bc2e362 for authenticated GitHub-API initial/redirect authority plus the corrected GHAS transport test seam; all five current hosted runs remain queued. .github#2272@4967d66f303bde675080466e359e75c260a91e06 separately owns the Pages shell-boundary repair and an executable dedicated CI, with all six current runs queued. .github#2275@fc9c5537d9910f0536dab2aaf52888078c8ead64 owns only capability-based selection of a credential that can read target code-scanning/analyses; its live authority correctly treats #2279 as a foundation prerequisite.

A selector cannot manufacture permission. .github#2276 is still separately open because an unchanged target-repository analyses read reproduced HTTP 403 Resource not accessible by integration; central GHAS acceptance therefore also needs the real installation/permission path plus a protected-base/exact-head analyses canary. Scheduler owner .github#2040@12c3fa6f3623aa5f2979d3d5ee4ed987002a6c0d remains Draft/open/non-mergeable with the production repository-identity RED, so ordinary/non-force path-wise protected-main reconciliation is still required.

Do not implement the aggregate migration early. The current path is: central authenticated-HTTP/Pages convergence → #2275 capability acceptance + #2276 analyses-read permission/canary → #2040 protected-main reconciliation and fresh central GREEN/review → #1623 current-vulnerability revalidation → #1694 → #1691 → #1503 protected workspace/migration owner → #1486 ordinary adoption/rechain → this #1673 implementation. The eventual backfill invariant remains unchanged: email-linked tasks derive workspace ownership from authoritative Email.workspace_id; source-less legacy tasks require exactly one auditable canonical workspace-owner binding, while zero or multiple candidates fail closed.