fix: roll back unauthorized Global Ask turns (v2.20.3)

[seonghobae]

Buyer impact

A Global Ask answer that loses citation authorization during the final check must not poison the existing session. This stacked PR keeps the generic 503 boundary, rolls back only the rejected turn/citations, and lets the same session continue safely.

Change

• Adds an explicit PostgreSQL transaction-owned persistence helper for the /api/ask cited-answer path.
• Holds one connection/outer transaction across turn and citation inserts plus final citation reauthorization using the same tenant scope and knowledge cutoff.
• Raises the existing generic 503 inside that transaction when evidence changes.
• Keeps the no-authorized-source empty-turn path and Valkey publication outside the database transaction.
• Adds ADR 0129, v2.20.3 changelog, and product gap baseline evidence.

Exact stack

• Base: feat/ask-session-storage-key-v2202 at 0a5a5799b444c44dc2952edc7227b1b96b97457e.
• Head: f6ce19f8e10aa7ec2b0a95f3adbbea816bd39594.
• Issue: [Bug] Roll back rejected Global Ask turn atomically instead of poisoning the session #362.

Verification

• Real PostgreSQL rollback/session-continuity integration regression: passed; a prior turn remained while the rejected turn and citations were absent, and the same session completed a safe follow-up.
• Backend API suite at the preceding production-code head: 106 passed, 5 skipped, 5 warnings.
• Focused Ask/post-chat/cutoff contracts: 27 passed, 3 skipped.
• Current focused rollback regression: 1 passed.
• Python compileall and git diff --check: passed.
• Synthetic integration data only; no production records or credentials are committed.

Hosted Checks, independent approval, and merge remain external gates. Do not self-approve, force-push, or merge past protection.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a2756237-b083-49e0-834d-42eae40735f2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 new potential issue.

[devin-ai-integration]

📝 Info: Reauthorization read now runs inside the write transaction

The final read_authorized_ask_evidence executes inside the API-owned conn.transaction() while the session row is held under for update (post_chat_ingestion.py). It is read-only and under READ COMMITTED still observes concurrently committed visibility changes, so the race check is preserved; the session lock is just held marginally longer.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[seonghobae]

Reviewed exact current head fb0d185a. The Global Ask rollback path reauthorizes every persisted citation before writing, preserves prior authorized turns when reauthorization fails, and atomically authorizes post-chat citations.

Exact-head validation:

• reauthorization/rollback API tests: 3 passed
• Global Ask project-history tests: 8 passed
• CodeGraph and diff checks: passed

No current bug/security review finding requires a patch. Please obtain formal approval and terminal-success Checks for fb0d185a before merge.

[seonghobae]

@claude Please review exact current head fb0d185. Focus on reauthorizing every persisted citation, atomic rollback on unauthorized turns, preserving prior authorized history, and post-chat citation authorization. Publish an exact-head review; do not modify, self-approve, or merge.