#171: Align passive authentication mapping tasks

src/server/negative-results/repository.ts

@@ -208,7 +208,10 @@ type NegativeResultRow = {
 };
 
 export class DatabaseNegativeResultRepository implements NegativeResultRepository {
-  constructor(private readonly database?: Queryable) {}
+  constructor(
+    private readonly database?: Queryable,
+    private readonly manageTransactions = true,
+  ) {}
 
   private run<T>(operation: (db: Queryable) => Promise<T>): Promise<T> {
     return this.database ? operation(this.database) : withDatabase(operation);
@@ -261,7 +264,7 @@ export class DatabaseNegativeResultRepository implements NegativeResultRepositor
     input: UpdateNegativeResultInput,
   ): Promise<NegativeResultRecord | undefined> {
     return this.run((db) =>
-      withTransaction(db, async (tx) => {
+      this.inTransaction(db, async (tx) => {
         const current = await readCurrentRow(tx, id);
         if (!current) return undefined;
         const record = mapRow(current);
@@ -291,7 +294,7 @@ export class DatabaseNegativeResultRepository implements NegativeResultRepositor
 
   async upsertBySubject(input: CreateNegativeResultInput): Promise<NegativeResultRecord> {
     return this.run((db) =>
-      withTransaction(db, async (tx) => {
+      this.inTransaction(db, async (tx) => {
         const normalized = normalizeCreateInput(input);
         await validateDatabaseInput(tx, normalized);
         const key = coverageKey(normalized);
@@ -333,10 +336,20 @@ export class DatabaseNegativeResultRepository implements NegativeResultRepositor
       return result.rows.map(mapRow);
     });
   }
+
+  private inTransaction<T>(
+    db: Queryable,
+    operation: (tx: Queryable) => Promise<T>,
+  ): Promise<T> {
+    return this.manageTransactions ? withTransaction(db, operation) : operation(db);
+  }
 }
 
-export function createDatabaseNegativeResultRepository(db?: Queryable) {
-  return new DatabaseNegativeResultRepository(db);
+export function createDatabaseNegativeResultRepository(
+  db?: Queryable,
+  options: { manageTransactions?: boolean } = {},
+) {
+  return new DatabaseNegativeResultRepository(db, options.manageTransactions ?? true);
 }
 
 export function createInMemoryNegativeResultRepository(

src/server/recon/index.ts

@@ -22,6 +22,14 @@ export {
 	type PersistPassiveAuthSurfaceResult,
 	persistPassiveAuthSurface,
 } from "./passive-auth-surface";
+export {
+	type CompletePassiveAuthMappingInput,
+	createPassiveAuthTaskAlignmentService,
+	lockPassiveAuthMappingScope,
+	type PassiveAuthMappingScope,
+	type PassiveAuthTaskAlignmentResult,
+	type PassiveAuthTaskAlignmentService,
+} from "./passive-auth-task-alignment";
 export {
 	type CreateStoredPassiveAuthSurfaceInput,
 	type CreateStoredPassiveAuthSurfaceResult,

src/server/recon/passive-auth-blockers.ts

@@ -10,6 +10,7 @@ import type { PassiveAuthSurfaceSummary } from "./passive-auth-surface";
 export type PersistPassiveAuthBlockersInput = {
 	projectId: string;
 	threadId?: string;
+	sourceThreadId?: string;
 	targetId: string;
 	taskId?: string;
 	summaryArtifactId: string;
@@ -43,6 +44,8 @@ export async function persistPassiveAuthBlockers(
 				dedupeKey: passiveBlockerDedupeKey(input, signal.reason),
 				metadata: {
 					workflow: "passive-auth-surface-v1",
+					scope: "project-target",
+					sourceThreadId: input.sourceThreadId ?? input.threadId ?? null,
 					summaryArtifactId: input.summaryArtifactId,
 					sourceArtifactIds: [...signal.evidenceArtifactIds].sort(),
 					passiveOnly: true,

src/server/recon/passive-auth-surface.ts

@@ -1,8 +1,4 @@
-import {
-	type BlockerRecord,
-	type BlockerService,
-	getDefaultBlockerService,
-} from "../blockers";
+import type { BlockerRecord } from "../blockers";
 import type {
 	ArtifactServiceInstance,
 	CreateArtifactResult,
@@ -14,7 +10,11 @@ import {
 	type NormalizedDiscovery,
 	normalizeDiscoveryArtifacts,
 } from "./discovery-artifact-normalizer";
-import { persistPassiveAuthBlockers } from "./passive-auth-blockers";
+import {
+	createPassiveAuthTaskAlignmentService,
+	type PassiveAuthTaskAlignmentResult,
+	type PassiveAuthTaskAlignmentService,
+} from "./passive-auth-task-alignment";
 
 export type PassiveAuthSurfaceSummary = {
 	targetId: string;
@@ -55,15 +55,17 @@ export type PersistPassiveAuthSurfaceResult = {
 	summary: PassiveAuthSurfaceSummary;
 	artifact: CreateArtifactResult;
 	blockers: BlockerRecord[];
+	taskAlignment: PassiveAuthTaskAlignmentResult;
 };
 
 type ArtifactWriter = Pick<ArtifactServiceInstance, "createArtifact">;
 
 export async function persistPassiveAuthSurface(
 	input: PersistPassiveAuthSurfaceInput,
 	artifactWriter: ArtifactWriter,
-	blockerService: BlockerService = getDefaultBlockerService(),
+	taskAlignment: PassiveAuthTaskAlignmentService = createPassiveAuthTaskAlignmentService(),
 ): Promise<PersistPassiveAuthSurfaceResult> {
+	const mappingTask = await taskAlignment.start(input);
 	const normalized = normalizeDiscoveryArtifacts(input.artifacts);
 	const summary = buildPassiveAuthSurfaceSummary(
 		input.targetId,
@@ -75,7 +77,7 @@ export async function persistPassiveAuthSurface(
 		projectId: input.projectId,
 		...(input.threadId ? { threadId: input.threadId } : {}),
 		targetId: input.targetId,
-		...(input.taskId ? { taskId: input.taskId } : {}),
+		taskId: mappingTask.id,
 		name: `passive-auth-surface-${input.targetId}.json`,
 		kind: "report",
 		contentType: "application/json",
@@ -87,25 +89,30 @@ export async function persistPassiveAuthSurface(
 		attributionPolicy: "project-thread-task-target",
 		metadata: {
 			workflow: "passive-auth-surface-v1",
+			sourceTaskId: input.taskId ?? null,
 			rawArtifactIds: summary.rawArtifactIds,
 			rawArtifacts: summary.rawArtifacts,
 			blockerReasons: summary.blockers.map((blocker) => blocker.reason),
 			authCategories: summary.authRoutes.map((route) => route.category),
 		},
 	});
-	const blockers = await persistPassiveAuthBlockers(
-		{
-			projectId: input.projectId,
-			...(input.threadId ? { threadId: input.threadId } : {}),
-			targetId: input.targetId,
-			...(input.taskId ? { taskId: input.taskId } : {}),
-			summaryArtifactId: artifact.id,
-			summary,
-		},
-		blockerService,
-	);
+	const aligned = await taskAlignment.complete({
+		projectId: input.projectId,
+		...(input.threadId ? { threadId: input.threadId } : {}),
+		targetId: input.targetId,
+		taskId: mappingTask.id,
+		...(input.taskId ? { sourceTaskId: input.taskId } : {}),
+		reportArtifactId: artifact.id,
+		summary,
+	});
 
-	return { normalized, summary, artifact, blockers };
+	return {
+		normalized,
+		summary,
+		artifact,
+		blockers: aligned.blockers,
+		taskAlignment: aligned,
+	};
 }
 
 export function buildPassiveAuthSurfaceSummary(