feat(web): add authenticated goal creation BFF

[seonghobae]

Scope

Advances #209 with one bounded first-party authenticated Goal browser boundary. The web BFF authenticates through Identity, derives workspace authority server-side, signs the exact Planning method/path, forwards no browser credential to Planning, validates returned ownership/schema evidence, rejects duplicate/oversized collections, and exposes only browser-safe Goal evidence.

The feature history remains test-first and retains the media-type and duplicate-identity regressions. This slice does not add the Goals workspace UI and does not close #209.

Protected-main adoption

Protected main is 193a87ef54c3fe6dcda4755bce4d6bc81e3a0297. Current exact #214 head df958511364ecc50716ebf1bf4445a29738f6bdb is an ahead-only non-force descendant whose merge base is that protected main. The feature delta remains exactly five Goal-BFF paths. The dependent buyer-path stack was previously restacked non-destructively through Weekly Review; no child delta was rewritten or dropped.

Fresh exact-head evidence and foundation finding

The six repository workflows for df958511... are terminal:

• Commercial Readiness 34111043740: GREEN.
• SAST Semgrep 34111043749: GREEN.
• AppGuardrail 34111043811: GREEN.
• CI 34111043732: RED only in validate; today-concurrency, compose_runtime, browser-acceptance, and merge_compatibility are GREEN. The validate job checked out exact df958511..., completed setup/frozen install, then failed at root pnpm format:check before lint/typecheck/test/build.
• Security Scan 34111043773: RED in Trivy FS after exact-head checkout and successful scan/SARIF production; OSV and Scorecard are GREEN. This branch does not own the shared vulnerable package graph.
• CodeQL PR 34111043847: RED in the central asynchronous CodeQL compatibility protocol; dispatch itself completed successfully. This remains central owner authority rather than a reason to alter Goal BFF source.

Fresh causal inspection still places both repository-level REDs outside this five-file Goal slice. Root formatting/package/security authority is owned by protected-main-based #249, not by the buyer-path leaf. #249 has since advanced beyond its earlier qs-only state: current exact 4aed8e66a95dd0b43c86849cf023294addd5e9ab preserves root-only AppGuardrail Markdown semantics and is repairing the shared qs, multer, retained Next 15.5, and sharp dependency graph under exact pnpm@10.15.0 regeneration. Its current package repair workflow has already proved regeneration and structural patched-resolution checks and is now executing the canonical PostgreSQL-backed full repository contract suite; that current head is not yet GREEN and no package candidate is claimed published.

Therefore #214 must not copy a root override, package lock, scanner suppression, or temporary repair workflow. After #249 integrates normally, #214 must adopt the resulting protected foundation through an ordinary non-force descendant, preserve its five-file Goal delta, and reacquire exact-head repository/security/review evidence.

Review and merge boundary

Submitted independent reviews are still absent. Keep Draft until #249 integrates normally, #214 adopts the resulting protected main non-destructively, and the unchanged descendant reacquires terminal repository/central checks plus current independent review/thread authority. No self-approval, administrator bypass, force-push, destructive rebase, stale evidence reuse, scanner suppression, or gate weakening is used.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}