[PetrefiedThunder]

Summary

Nonempty EPCIS exports previously set chainHashVerified, integrityVerified, and X-RegEngine-Integrity-Verified to true merely because stored rows existed. Keep all three false until the export route performs cryptographic verification, and document that stored hashes are exported without verification.

Supersedes #3750 using the accepted codex/ branch prefix. Conflicts were resolved against main c770b2b7746365e6a9afecd10b4566977348d2df, preserving canonical EPC/GTIN handling, tenant-scoped KDE joins, transformations, structural validation, and skipped-event accounting. The change remains limited to three files.

Verification

Exact reviewed and tested head: 346c5cd890d4807bcded9ae59c93445a93a11c97.

• 40 local regression tests passed, no skips. Covers export behavior, wrong stored hashes with structural validation on/off, all-skipped data, storage errors/overflow, and authentication/tenant rejection before storage. Temporary PyLD dependencies enabled the JSON-LD test without changing application manifests.
• 12 additional acceptance scenarios passed, zero failures or local blockers, using a fully migrated isolated PostgreSQL 16.14 database, separate Redis, two synthetic tenants, real database-backed API keys, and no dependency overrides or authentication bypass.
• Acceptance proved own-tenant exports, A/B/A isolation, missing/altered keys returning 401, conflicting body/header tenant claims returning 409, empty/all-skipped exports, and Redis returning 200 then 429 with positive Retry-After. Denied requests performed zero export queries; successful requests positively controlled the SQL observer and incremented real Redis counters.
• Application and key-management roles were NOSUPERUSER/NOBYPASSRLS. All four relevant tables had forced RLS. Alembic reached the checkout's head b8c1e4f2a901.
• CI ingestion: 6,087 passed, 58 skipped, 6 expected failures. Skips/expected failures are not counted as passes.
• All four required checks pass: CI Status Gate, PR Gate: Backend, PR Gate: Frontend, and PR Gate: Workflow Contract. Secrets, migrated live-database, security/RLS/isolation, full-ingestion signal, and monolith-build jobs also passed.
• Ruff, formatting, applicable pre-commit hooks, detect-secrets, and scoped Gitleaks/TruffleHog checks passed.
• Independent exact-head Muse review and Codex integration review passed. The final acceptance harness also passed independent review after adding query-observer and real-Redis positive controls.

Review: #3751 (comment)

CI completion: https://github.com/regengine/RegEngine/actions/runs/40845584622/job/123361650727

Remaining limitations

• This removes false verification claims. It does not implement tamper detection, canonical content recomputation, chain linkage/membership verification, or snapshot-bound export verification.
• The new acceptance test mounted the actual router/dependencies in an isolated FastAPI app through ASGI transport. Consolidated-server startup/middleware, production hosting/pooler behavior, and concurrent multi-worker behavior were not exercised by that local test.
• Rows were seeded directly; ingestion acceptance and commit-blocking versus advisory behavior remain separate work. The local cluster used PostgreSQL 16.14; live-database CI uses PostgreSQL 17.
• Historical scanning still reports 188 unknown findings and zero verified findings. These remain untriaged; clean patch/harness scans do not clear repository history.
• Inherited retailer-compatibility wording was not validated by this fix.

Delivery

The isolated acceptance services were stopped and their task ports verified closed. No production credentials or customer data were used; generated raw keys stayed in memory. No application changes were needed after the tested commit.

Merged by squash as 9f3ff20aa668ca748641a1528bf998c3e22135d0 on 2026-10-29 at 09:27:58 UTC. The merged Git tree exactly matches the reviewed/tested head. All four required checks passed before the merge; normal branch protections were enforced.

No deployment or outreach was performed. Before merge, this Vercel project's Git integration was disconnected; its production deployment and domain assignments were verified unchanged. Post-merge checks found zero Vercel deployments for the merge SHA and no new Railway deployments. The Railway deployment workflow was already disabled and remains disabled. Vercel Git integration remains disconnected until a release is authorized, because reconnecting may trigger deployment. The reviewed remote branch was preserved, and the temporary branch-retention setting was restored.

[github-actions]

PR Blocker Checklist

Head SHA: 346c5cd890d4807bcded9ae59c93445a93a11c97

Status: Ready

• All review threads resolved
• No reviews requesting changes
• No blocked review engines

[coderabbitai]

Caution

Review failed

The pull request is closed.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[PetrefiedThunder]

REVIEW: PASS muse 346c5cd

Independent Muse review, relayed by Codex from a completed read-only Muse CLI session. Muse reviewed the final diff and endpoint context pinned to this exact head; it did not run tests or access the repository directly.

Muse found no material blocker:

• Both verification flags and the matching header remain false while stored hashes and export metadata are preserved.
• Structural validation cannot turn on cryptographic verification claims.
• Upstream transformation, canonical identity, skip handling and tenant-scoping behavior are preserved.
• Wrong-hash tests cover validation enabled/disabled; the all-skipped path remains unverified.
• JSON-body tenant mismatch and authentication rejection prevent storage access.

Lead-executed validation: 40 passed, no skips, across the export, 1342, GS1/JSON-LD and legacy tenant-context suites. Ruff, formatting, hooks, Gitleaks and scoped TruffleHog checks passed.

Limitations: this is not a cryptographic verifier or a production validation claim. Muse's review was static, based on supplied code; live storage/authentication and deployed behavior were not tested. Inherited retailer-compatibility wording and historical secret findings remain outside this patch.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: b1ab5108-4898-4c1b-a281-557ee1acc318)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T09:28:38.640828Z	346c5cd	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.