fix(security): require trace purpose authorization

[seonghobae]

Buyer-visible security gap

Closes #117. Inference or admin authentication alone must not disclose prompts, outputs, provider evidence, workflow traces, or batch evidence.

Change

• require a verified trace purpose scope before trace-bearing chat, admin simulation, workflow/evaluation creation, batch-result retrieval, and trace-enabled workflow/evaluation reads;
• apply the same gate to streaming/non-streaming route and conduct responses;
• validate include_orchestration_trace as a strict JSON boolean when present; strings, numbers, arrays, objects, and null are rejected;
• write a metadata-only orchestration_trace_access_granted audit event before release and fail closed with generic 503 if audit persistence is unavailable;
• keep static single-token mode as a local development escape hatch; production uses the injected scope-aware verifier;
• update ADR 0013, doctoring guidance, and all affected HTTP regression contracts.

This PR remains stacked on #780 and must be integrated only after the parent reaches protected main. No Figma/Storybook change: this is a backend authorization contract. Existing Figma source remains vsZMd8WAv42HDRgcZuNcWk.

Verification

• uv run pytest -q — 1440 passed in 558.85s
• focused trace/security suite — 34 passed
• uv run ruff check on changed Python files — passed
• python -m compileall -q contextual_orchestrator — passed
• git diff --check — passed

Please review exact current HEAD fc0ebae309fbf8f6023514e02c08b8e63fdc10ad. Merge only through protected normal review/checks; no bypass or self-approval.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d85a5f35-0194-4147-8de1-8bce50d0f27a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head review at 7e6dc150ae177a63231e944108422597ccb285a8:

• Trace-bearing chat responses now require the verified trace purpose after inference authentication.
• Access is audited before orchestration starts; prompts, outputs, credentials, and PII are not included.
• Audit persistence failure returns a generic 503 and releases no trace.
• Focused security tests and the full 1440 passed suite cover the change.

This is stacked on #780; no independent required Checks are reported for the stacked branch. Merge only after the parent reaches protected main and the exact rebased head receives required Checks and approval.

[seonghobae]

Exact current HEAD is fc0ebae309fbf8f6023514e02c08b8e63fdc10ad. The trace-purpose gate now covers chat, streaming, admin/workflow/evaluation trace outputs, and batch-result retrieval; trace flags are strict JSON booleans. Fresh exact-head evidence: full suite 1440 passed in 558.85s, focused trace/security 34 passed, Ruff/compileall/diff-check passed. Please review this SHA only; no bypass or self-approval.

[seonghobae]

@opencode-agent Review exact current HEAD fc0ebae309fbf8f6023514e02c08b8e63fdc10ad only. Verify every trace-bearing route uses the purpose gate and strict boolean contract.

[seonghobae]

[seonghobae]

[seonghobae]

Current-head proof for caf1eb34d92f8d1e3d99a98f4278378f6bc4e85f:

• The current parent-integrated stack applies the verified trace purpose gate to trace-bearing evidence routes and preserves strict boolean/no-op request validation.
• Trace, security, tool-shape, and Responses regression suite: 50 passed.
• Ruff, compileall, and git diff --check: passed.

This PR remains stacked on #780; current parent and protected Checks must be satisfied before normal merge. No self-approval, admin merge, or force-push was used.