fix: enforce Keyverse identity and tenant authorization

[seonghobae]

Summary

• replace boolean-only bearer decisions with fail-closed VerifiedIdentity results carrying subject, org, workspace, scopes, and roles
• enforce exact org/workspace metadata ABAC and scope RBAC at the HTTP boundary
• bind workflow, evaluation, and batch resources to a secret-free tenant context and hide cross-tenant or ownerless reads
• update ADR-0003, Keyverse/KV/API docs, and regression tests

Exact identity and stack state

• Contributor exact head: 5a065bb44b4b7296f68ec992b04ab36b85d90e0e
• Live stacked base: PR Support local MLX orchestration and audited model judgment #109 branch codex/local-llm-benchmark@c138d1737b69fec9805253398a41046617a3a7a7
• Protected base behind the stack: main@6841b71935e0b7cb98fb52bcb4709cc5100c8d87
• Exact comparison against the live stacked base: 3 commits ahead, 0 behind
• Hosted exact-head workflow runs: absent
• Formal reviews and inline review threads: zero
• Qualifying independent non-author approval: absent
• The 324-test result below is local evidence only. It does not substitute for hosted exact-head Tests, Security, Security Scan, SAST, Fuzz, complete production coverage/public-docstring evidence, or protected integration of Support local MLX orchestration and audited model judgment #109.

This PR remains Draft while #109 is Draft/unintegrated and while exact-head release evidence is incomplete.

Verification

• uv run --with pytest --with hypothesis --no-project python -m pytest tests -q
• 324 passed
• python3 -m compileall -q contextual_orchestrator tests/test_security_hardening.py
• git diff --check

This is intentionally stacked on contextual-orchestrator PR #109 so the existing Keyverse verifier seam and its reviewed parent changes remain in the same normal protected merge flow. No JWT parser, Keycloak admin credential, or Admin merge is introduced.

Live stack revalidation (2026-08-12)

• Contributor head remains 5a065bb44b4b7296f68ec992b04ab36b85d90e0e and protected main remains 6841b71935e0b7cb98fb52bcb4709cc5100c8d87.
• Stacked parent PR Support local MLX orchestration and audited model judgment #109 advanced to 216177f2c3524a145b24e6b9eafa3e8ca86306f5; the comparison is now 3 commits ahead and 13 commits behind with merge base c138d1737b69fec9805253398a41046617a3a7a7.
• The earlier “3 ahead, 0 behind” statement is historical. This branch is frozen for source mutation until its moving parent stabilizes; no stale-base evidence transfers.
• PR Support local MLX orchestration and audited model judgment #109 is Draft and its exact-head production coverage gate is failing. PR fix: enforce Keyverse identity and tenant authorization #110 still has no hosted exact-head workflow run, formal review, inline review thread, or qualifying independent approval.

Keep this PR Draft. Reconcile its three unique tenant-authorization commits only after PR #109 reaches one accepted stable head or integrates into protected main, then regenerate every exact-head test, security, fuzz, coverage, docstring, and independent-review gate.

Current-head tenant-existence disclosure defect (2026-08-12)

Exact head 5a065bb44b4b7296f68ec992b04ab36b85d90e0e still has a valid fail-closed privacy defect. The workflow-run lookup is the working comparison path: a foreign tenant is converted to KeyError and receives the same 404 workflow_run_not_found envelope as an absent identifier. In contrast, existing foreign or ownerless resources at /api/v1/evaluation_runs/{id}, /api/v1/batch_routing_jobs/{id}, /api/v1/batch_routing_jobs/{id}/results, and /v1/batch/embeddings/{id} reach authorize_resource(..., require_tenant=True) and return 403 tenant_forbidden, while absent identifiers return 404. That difference reveals resource existence and contradicts the stated “hide cross-tenant or ownerless reads” contract.

Do not mark this PR Ready. The parent advanced to 216177f2c3524a145b24e6b9eafa3e8ca86306f5, leaving this head 13 commits behind, so this branch is frozen for source mutation during the current writer lease. After the parent stabilizes, repair test-first with HTTP regressions requiring indistinguishable 404 status and resource-specific not-found envelopes for absent, foreign-tenant, and ownerless identifiers across all four lookup families, while preserving successful same-tenant access and avoiding payload/status leakage before authorization. Then rerun the focused tests, full suite, 100% production statement/branch/public-docstring gates, security/fuzz workflows, and current-head independent review.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4c6fed77-c2b3-4bc2-b2b3-b48d3e1ecf24

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Closed by autonomous commercial loop: PR targets non-main base codex/local-llm-benchmark (stack intermediate). Re-open against current main after #111–#114 land if the product gap remains. (fix: enforce Keyverse identity and tenant authorization)