fix(reconcile): reject hostile candidate member access

[seonghobae]

RED → GREEN trust-boundary repair for #231

This Draft originated from protected main@b84f0c94154043a3473939c01bb6471de5a129ae and never wrote source or documentation directly to protected main. To remove the inherited aggregate coverage blocker without duplicating its tests, it is now an explicit Draft child of dependency-root #233.

Exact stack boundary

• current base branch: fix/recovery-evidence-weakref-coverage-b84f0c9
• exact base SHA: 5951b7a4d779903b8924abaef2a387cae50b7f54
• exact head SHA: 9d7f1413dbe8390c165ffa841f2e70a3a7c2f191
• compare from exact base to exact head: ahead 3 / behind 0
• PR diff relative to the stack base remains exactly:
  • pg_llm_batch/reconciliation.py
  • tests/test_provider_reconciliation_worker.py

The stack merge commit is non-destructive and retains both histories. It does not alter #233 or protected main.

Writer lineage

Retained feat/provider-reconciliation-worker-current-main@c5a5414ff6b21ae4025289eefcc3e6452f454e1c is historical/superseded lineage from closed #187 → closed #188 → merged #189. Fresh targeted branch inventory still finds this branch as the only reconciliation-candidate-type-boundary lane. Fresh formal reviews and inline review threads are empty. No competing actor moved this branch during this metadata refresh.

RED evidence

Test-only RED head a18c7798629427655d9fb110b5ed010b82c25aa5 added a hostile ReconciliationCandidate subclass and a candidate-shaped non-package object whose identity-member access executes behavior. Exact-head CI run 32001256725 checked out that RED head; Python 3.10 and 3.14 failed at the new regressions while source identity verification succeeded. That deliberate RED evidence does not transfer.

Narrow production fix

_validate_candidate() now requires type(candidate) is ReconciliationCandidate before candidate member access, then preserves validate_endpoint_alias() and validate_remote_resource_id(). A subclass or shaped object therefore cannot execute caller-controlled identity-member behavior before the trust boundary rejects it.

No shared validator, provider I/O, scheduling authority, tenant authority, lease semantics, persistence, result application, or exactly-once claim is widened.

Pre-stack GREEN context

The pre-stack exact head 61d52f9e47c2110fae2550db02495dd7c41b66f2 had terminal-success Security Scan, SAST Semgrep, and Release Acceptance. CI checked out that exact head; Python 3.10/3.12/3.14 and PostgreSQL/container jobs passed, 1334 non-integration tests passed, and pg_llm_batch/reconciliation.py was exact 100% statement/branch covered. Its only aggregate CI failure was the inherited protected-main 99.96% coverage deficit that #233 supplies.

That pre-stack evidence is context only and is not current-head approval or transferable validation.

Current contributor-head validation boundary

Current workflow conclusions for unchanged stacked head 9d7f1413dbe8390c165ffa841f2e70a3a7c2f191 are:

• SAST Semgrep 32199874249: workflow conclusion success, but the actual scanner checkout was synthetic PR merge faedad079c68d05a4282ec38fb7e1200add2b0ff, not the contributor head;
• CI 32199874239: success; its coverage/docstrings/lint/package, Python 3.10/3.12/3.14 unit jobs, and PostgreSQL/container jobs completed with exact-source verification;
• Release Acceptance 32199874220: success; and
• Security Scan 32199874242: workflow conclusion success, but the Trivy filesystem job also actually checked out synthetic PR merge faedad079c68d05a4282ec38fb7e1200add2b0ff, not the contributor head.

The synthetic merge is recorded by both scanner logs as Merge 9d7f1413dbe8390c165ffa841f2e70a3a7c2f191 into b84f0c94154043a3473939c01bb6471de5a129ae. Semgrep additionally reported SEMGREP_SUPPRESSED_COUNT=15 and zero retained findings after suppression filtering. Therefore these historical green Security/SAST conclusions are not exact-contributor-head acceptance under this repository contract. The central exact-source repair has since integrated and #233 has separately regenerated exact-head evidence, but neither fact transfers evidence to #232. Fresh mutable control-plane truth belongs only in pg #244 and read-only .github#1222; reacquire #232's own security/review evidence only on its unchanged final integration candidate after the predecessor lands. Fresh formal reviews and inline review threads on #232 are empty; absence of review is not approval.

Keep this PR Draft because the exact predecessor remains non-passing on review/governance and because #232's current Security/SAST evidence is synthetic.

Dependency / governance boundary — refreshed 2026-08-30

#233 is the exact predecessor and must merge first. #233 remains unchanged at 5951b7a4d779903b8924abaef2a387cae50b7f54. Its fresh exact-contributor-head CI, Release Acceptance, Security Scan, SAST Semgrep, and bounded Strix evidence now exist; do not retain the obsolete claim that #233 still lacks exact-source Security/SAST evidence. #233 nevertheless remains non-passing because its active same-head OpenCode CHANGES_REQUESTED has not been superseded and no qualifying approval exists under live governance.

Do not duplicate mutable central SHAs/runs/retry state here. Issue #244 is the sole pg-owned mutable control-plane ledger and must be freshly read before any review/security/scheduler decision; .github#1222 remains read-only central acceptance tracking. A current central or predecessor success never transfers to #232.

Do not churn #232/#233 to manufacture events, duplicate #233's tests, dismiss non-passing evidence, self-approve, weaken gates, or copy central workarounds.

After #233 integrates, retarget this PR to the then-current protected main, prove the reconciled descendant diff remains only this trust-boundary repair, and reacquire every exact-final-head quality/security/package/provenance/release/review gate. No predecessor, pre-stack, synthetic, queued, infrastructure-failed, dismissed, status-only, or author-only evidence transfers.

Refs #231, #102, #233, #244, #311; read-only central dependency .github#1222.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@cwl-noema-review