feat(api): consolidate export idempotency lookup and quarantine-parity adapters

[seonghobae]

Consolidated Analysis Run / export lookup landing vehicle

This Draft is the surviving naruon-facing Analysis Run / export lookup application-adapter vehicle. It folds strict-ancestor one-operation PRs instead of keeping them as parallel WIP. #465 was folded first, #471 was folded after its cross-tenant disclosure defect was repaired and quarantined, and #474 has now been fast-forward folded after verifying #466@12e8337d68d3263feab21c63cf66a8578e997d07 was exactly #474's merge base and #474 was two commits ahead with no divergence. #465/#471/#474 remain immutable review and RED/GREEN history; their source is preserved on this branch.

Preserved metric-free lookup behavior

• GET /v1/exports/by-idempotency/{idempotency_key} dispatches before GET-by-id so the route prefix is not parsed as a server-assigned export_id;
• lookup is naruon-only; LineageWeave and unpublished consumers fail closed;
• zero or multiple matches fail closed without a tenant oracle;
• metric/scientific-acceptance fields are recursively refused;
• tepp-export-lookup lookup exposes only the metric-free identity (export_id, decision_code, idempotency_key);
• opaque idempotency keys accepted by authorization remain addressable: slash is percent-encoded as data and literal by-idempotency remains valid data after the route prefix.

Stored-request-by-idempotency quarantine

The first stored-request GET implementation searched Naruon tenant namespaces using consumer + client key and could serialize tenant_workspace_id and principal_id without authenticated tenant/principal scope. This vehicle therefore keeps GET /v1/exports/by-idempotency/{idempotency_key}/request quarantined until a versioned authenticated tenant-and-principal authority binding exists and proves cross-tenant/cross-principal denial. An idempotency key is replay identity, never a bearer credential.

The folded #474 CLI is quarantine parity, not disclosure: tepp-export-lookup-request get validates its local inputs and calls the typed exchange builder, which returns authorization_denied; it does not print the stored authorization request or tenant/principal identity. This preserves fail-closed behavior instead of creating a separate supported route.

DDD / queue authority

These GET/CLI mechanics are adapters inside the Analysis Run application context, not bounded contexts. Operation-specific ADR 0093/0094/0099/0100 records are implementation lineage pending repository-wide normalization under #437; one route, refusal, or CLI verb does not create architecture authority. Further compatible export-lookup mechanics must fold here or into a coherent successor rather than mint another micro-PR.

Reusable psychometric arithmetic remains outside this adapter. HTTP success/failure is never ADR 0014 scientific acceptance. NaruonLiveService stays POST-only.

Current exact head: 71f34b890bbd096eee152947c5e22d9778d323e8.

Merge gate

The latest fold invalidates predecessor-head hosted evidence as landing authority. Reacquire fresh exact-head Rust/documentation/security/SAST and 100% owned production line/branch coverage, re-fetch current reviews/threads, and obtain qualifying independent current-head approval under live organization rules. Keep the stored-request-by-idempotency resource quarantined unless authenticated scope is implemented and tested. No predecessor-head evidence transfer, force push, fail-open change, self-approval, or routine protection bypass.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 3 potential issues.

[devin-ai-integration]

Devin Review found 3 new potential issues.

[devin-ai-integration]

🔍 Current-head coverage remains unverified

Repository rules require 100% production line and branch coverage. Confirm current-head coverage for the new route, DTO, transport parser, and CLI branches.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[seonghobae]

Exact-head COMMENT on 71f34b890bbd096eee152947c5e22d9778d323e8 (not APPROVE; author COMMENT is not an independent approval under ruleset 18156473). Predecessor Checks/reviews do not transfer. Do not un-draft. Do not unstack onto main. Do not add GET to NaruonLiveService.

Fail-closed read at this SHA:

• naruon_export_idempotency_lookup_stored_request_exchange validates origin/key syntax (slash, NUL, reserved by-idempotency prefix, max length) then returns ApiError::AuthorizationDenied without minting a disclosure exchange (export_idempotency_lookup_stored_request_http.rs).
• FORBIDDEN_STORED_REQUEST_KEYS includes tenant_workspace_id and principal_id plus scientific/terminal keys.
• tepp-export-lookup-request documents that compose stays quarantined and never prints a stored export-authorization request; CLI contract compose_stays_quarantined_and_never_discloses_stored_create asserts AuthorizationDenied even after a matching POST exists.
• LineageWeave consumer and non-loopback hosts fail closed in from_args.

Keep ADR 0099 quarantine. An idempotency key is replay identity, not a bearer credential. Reactivation still requires a versioned authenticated tenant-and-principal binding plus proven cross-tenant/cross-principal denial. Do not un-quarantine stored-request-by-client-key disclosure. Unique tepp-export-lookup / tepp-export-lookup-request plus ADR 0093+0094+0099+0100 remain occupied here (folded #465/#471/#474). mergeable_state=unstable — not merge-ready.