chore(auth): retain duplicate timing-hardening provenance until #814 verifies

[seonghobae]

이 generated PR은 #814와 같은 bearer-token length-mismatch hardening을 별도 branch에서 다시 구현했고 repository-wide .jules/sentinel.md doctrine을 추가했습니다. Fresh comparison에서 #819에만 남겨야 할 고유 production behavior·test fixture·contract는 확인되지 않았습니다. 오히려 #814가 dedicated regression으로 wrong-length/equal-length compare_digest boundary를 직접 검증하고 severity를 defense-in-depth 수준으로 좁혀 canonical owner 역할을 하고 있습니다.

Current canonical successor는 #814 exact 5126ab5322246e76c0c28d7e67a710d52bff3801입니다. #814는 later unrelated pypdf/lock drift와 regression deletion도 ordinary descendant로 되돌려 현재 다시 main.py + tests/test_auth_compare_digest.py의 bounded semantic tree를 소유합니다.

#819 branch는 history를 지우지 않고 ordinary child 129806d5d05faf2c78ff87f01204862dbe25804f에서 exact protected develop@e06b1f3fb10903569124af011da213951e6e2473 tree를 채택했습니다. 따라서 현재 live tree는 protected base와 동일하고 duplicate implementation과 branch-local Sentinel doctrine은 ancestry에만 남습니다. No force push/destructive rebase was used.

이 PR은 아직 단순 Close하지 않습니다. #814가 unchanged current head에서 모든 유효 semantic/test contract를 완전 승계하고 fresh correctness/security/static-analysis/governance evidence와 independent review를 얻은 뒤에만 verified succession으로 Close할 수 있습니다. #814가 동등 계약을 잃으면 이 predecessor를 repair source로 다시 평가합니다.

No predecessor GREEN, self-approval, gate weakening, scanner suppression, source-neutral retrigger, or administrator bypass transfers.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}