[PetrefiedThunder]

Superseded by #3751

The conflicts are resolved against current main in draft #3751 on the permitted codex/ branch. GitHub does not support changing this PR's head branch, so #3751 replaces this draft without deleting its branch/history. The replacement has 40 passing tests with no skips and a completed independent Muse review at head 346c5cd890d4807bcded9ae59c93445a93a11c97. Vercel preview creation was disabled and verified before its push. No PR was merged.

---

Summary

• Nonempty tenant exports previously reported chainHashVerified: true, integrityVerified: true, and X-RegEngine-Integrity-Verified: true solely because rows existed. Return false until this route actually performs cryptographic verification, preserving the existing boolean contract.
• Clarify that stored hashes are exported without verification. Keep structural EPCIS validation separate from cryptographic integrity.
• Add wrong-stored-hash regressions with structural validation enabled and disabled; strengthen tenant mismatch and authentication-denial tests to prove rejection before storage access.

Type of Change

• Bug fix
• Security fix
• Documentation: endpoint description

Test Plan

• Unit and local route tests added/updated.
• Live database/deployment integration tests: not run.
• Manual testing on a deployed service: not run.

All evidence below applies to commit bd00081a2069f8e0ee79dc2eef99e822e81e5157. Tests used the existing repository Python 3.11 virtual environment from the isolated worktree.

~/Projects/RegEngine/repo/.venv/bin/python -m pytest services/ingestion/tests/test_epcis_export.py services/ingestion/tests/test_epcis_export_1342.py services/ingestion/tests/test_legacy_router_tenant_context.py --no-cov

24 passed in 1.28s; no skips

Before the source fix, the nonempty-row case and both wrong-hash cases failed: 3 failed, 13 deselected. This reproduced the unsupported true flags. The passing suite also covers empty exports, storage failures, overflow behavior, and access-denial propagation. Storage is controlled/faked; the authentication-denial tests stub the authentication function boundary.

Additional checks:

• Ruff lint and format checks passed on all three changed files.
• Diff checks and applicable pre-commit hooks passed, including detect-secrets and private-key detection.
• Gitleaks staged-change scan passed.
• TruffleHog changed-file and exact-task-branch scans passed with no verified/unknown findings. The branch scan was repeated before push with scan errors treated as failures.
• Independent read-only code review passed. Supplementary Muse review reached its eight-step limit without a verdict and is not counted as a passed review.

Remaining limitations

• Review gate blocker: Engine Review Pass currently fails with "Invalid author engine" because the openclaw/ branch prefix is not recognized. No review bypass or branch-policy change was made.

• Automatic preview: the GitHub push triggered Vercel deployment dpl_xSKBpszsyF6t3JPsqqMak5nRhFLY for this exact branch/head. It was already READY when inspected, so in-progress cancellation was no longer available. No deployment command, production promotion, or deployment-setting change was performed.

• Integration blocker: GitHub reports this draft as CONFLICTING / DIRTY. main advanced 35 commits to c770b2b7746365e6a9afecd10b4566977348d2df and changed the same export source/tests. The row-presence verification bug is still present there. This draft preserves the exact tested commit; conflict resolution and tests against the combined revision remain pending. The 24-test result applies only to the submitted head.

• This removes false verification claims; it does not implement a cryptographic verifier or detect tampering. False means integrity has not been established. Canonical event-content recomputation, chain linkage/membership, and snapshot-bound export verification remain separate work.

• The full ingestion suite, live API-key backend, live database, and deployed behavior were not validated. Commit-blocking versus advisory runtime behavior and semantic TLC/omitted-CTE pilot gates remain outside this patch.

• A broader TruffleHog history scan returned 188 unknown findings, zero verified findings, across 62 files and 48 older commits. None were in the three changed files. These remain unresolved and potentially live; clean patch scans do not clear repository history. No secret values are included here, and no exclusions, baselines, or credentials were changed.

• Existing retailer-compatibility wording is inherited and was not validated by this change.

Checklist

• Changes follow existing patterns and are limited to three files.
• No hardcoded secrets or credentials introduced.
• No sys.modules stubs added.
• Endpoint documentation updated for verification semantics.
• Changed-file lint and formatting checks pass.
• Draft PR only; no merge, manual deployment, or outreach performed. Repository automation triggered CI and a Vercel preview check after the push.

Related Issues

No issue linked.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
regengine	Ready	Preview	Oct 29, 2026 8:44am UTC

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Blocker Checklist

Head SHA: bd00081a2069f8e0ee79dc2eef99e822e81e5157

Status: Ready

• All review threads resolved
• No reviews requesting changes
• No blocked review engines