[rhein1]

Worker scopes were checked at the API entrypoint but omitted from the store's final credential checks. A scope withdrawn during an asynchronous provider verifier could still journal resources or complete cleanup; retained claim and journal requests also lacked a store-level scope check.

This change rechecks worker:claim for claims/replays and worker:write for preflight, renewal, journals/receipts, settlement, and terminal cleanup/recovery. PostgreSQL serializes credential edits with the authority decision using a shared row lock, checks credential validity after acquiring that lock, refreshes the database clock before claim replay, and repeats scope checks in final writes. Receipt reads use a transaction. Memory-store checks enforce the same scopes. Rejections preserve state, reservations, receipts, and audit history.

Progresses the fail-closed worker authority work in #375 and #303; closes neither issue. The missing production worker and durable distributed handle implementation remain outside this bounded store repair.

Review correction and validation

• Eight initial regressions fail on unchanged base b30a3ded3b191e2d4d13c5d13f19092f841f0fa9 and pass with the scope repair. These demonstrate missing authority rejection/credential serialization.
• Independent review identified a lock-wait expiry race in the first repair. Two additional real PostgreSQL regressions reproduce expired lease/credential replay at eb9a1a0. On the original base, no credential lock wait occurs and replay completes before expiry. Commit 2903760 fixes both by evaluating credential validity and lease time after lock acquisition; tests observe the actual database blocking relationship and release after database-authoritative expiry.
• Full local PostgreSQL 16.15 suite after the correction: 88/88 pass, zero skips. This run used WSL Node 18.19.1, supplementary evidence outside the supported Node range.
• Windows Node 24.13.0: 80 pass, 8 explicit PostgreSQL skips, zero failures. Syntax/source-only check: 21 modules, 13 runtime modules.
• Risk Fork, MCP, Claude SDK, and n8n lockfile audits each report zero vulnerabilities after the dependency repairs below. Exact-head CI provides clean-install and supported Node qualification.
• Integration count sync and whitespace checks pass. Running the documented rename-preflight generator gives the existing canonical inventory (185 files / 369 references); the earlier Windows failure was CRLF-only, with no tracked content change.

Dependency repair provenance

The base's dependency audits blocked aggregate CI independently of the authority change. Existing reviewed repairs were composed with cherry-pick -x, without unrelated feature commits:

• 1fa19e1 from 015443b7af2b55e3a1711672c3b699dd879ecaf4 in fix(deps): clear integrations dependency audit gates #444: MCP fast-uri/ip-address and corresponding hosted bundle attestation.
• 028af2e from 91359404eeecb4c57a7f0facacac234001a436ef in fix(deps): clear integrations dependency audit gates #444: Claude SDK and n8n lockfile repairs.
• 54dca81 from 1d95644033348fa34b89758900a4b6cc038422e6 in fix(governance): preserve receipts across callback failures and cancellation #449: isolated n8n development workflow fixture qualification; no governance feature commits included.
• 4c39fe9 uses the same reviewed fast-uri 3.1.8 version, tarball, and integrity metadata for Risk Fork's production lock, within AJV's existing compatible range. No audit threshold, exception, runtime API, or package version changes.

Current candidate and review gate

Candidate: 498bd1562f55e8bb9f4ecb1d004ebe9911d895e6; current base: b30a3ded3b191e2d4d13c5d13f19092f841f0fa9.

Exact-head hosted checks refreshed October 3, 2026: 51 successful / 0 failed / 0 pending. Required Validate Machine Surfaces passes. Risk Fork managed-service jobs pass on supported Node 20/22/24, each with disposable PostgreSQL and 88/88 tests, zero skips, including the lock-wait regressions. Platform release-candidate builds are retained CI artifacts; package publication is disabled.

Later maintenance commits corrected the Windows npm audit subprocess, recorded the maintainer-authored bounded MatrAIx hold review through October 8, and aligned the hosted MCP lock, embedded dependencies and integrity records. They supersede the earlier expired-hold failures at 4c39fe9. No inventory promotion, validation bypass, audit suppression or runtime authority was added.

The required eligible independent GitHub approval remains absent. This PR is still draft. Issue #375 remains open for the production worker, distributed handles, separate credentials/rotation, least-privilege database roles and runtime qualification.

Remaining boundaries

Production remains hard-disabled. Database tests use a disposable migration-owner connection, not a qualified runtime role. PostgreSQL FOR SHARE needs UPDATE privilege on a locked table column; a separately reviewed least-privilege locking interface and owner/migrator/runtime role qualification remain Gate 4 work. This PR grants no database privileges and must not be operationalized by granting workers broad API-key mutation rights.

The host worker/controller/provider bridge, durable multi-instance portable handles, separate execution/cleanup/recovery credentials, provider qualification, edge/OAuth operation, and gates 2-6 remain open. Source verification does not establish operational completion. No merge, publication, deployment, provider execution, spend, historical approval replay, or external owner outreach was performed. No recursive delegation was used.

[jmborden1112-beep]

Owner-authorized solo-maintainer approval through the configured secondary account. Both accounts belong to the maintainer; no independent human approval is claimed. Exact reviewed head: 498bd15. All 51 hosted checks passed. Separate read-only source lenses found no verified blocking source defect; focused authority/HTTP tests passed 22/22. This approves the default-off source tranche only. Issue #375 production gates remain open; no deployment, publication, provider use, spend, canary, or activation is authorized by this review.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-04T01:52:04.734954Z	498bd15	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.