fix(clearfolio): require explicit artifact origin trust

[seonghobae]

Superseded by #504

#498 advanced from 28cff4ad079e72da417d5830ca90de799b7483ad to 4f017140c1ab375e4f302bf2094a64e7b290d14b after this child branch was cut. The reconciled replacement #504 is a true descendant of the exact live #498 head and preserves this PR's full child behavior. Exact comparison from this head e4d2f5f02294fe3e337e075ee05ad2afc2889aa6 to replacement head 15950464256d7c6759ee328437b66e2617b671bc changes only #498's later rejected-provider-body repair and its regression test; comparing live #498 to #504 is ahead-only with exactly the six child-scope files. This PR is closed to remove the stale-stack duplicate; no unique child work is discarded.

---

Buyer/security goal

Issue #489 allowed an arbitrary cross-origin HTTPS artifact URL returned by Clearfolio to become a ScopeWeave redirect target. This stacked slice establishes an exact-origin trust policy so same-origin artifacts remain the default and explicitly reviewed HTTPS artifact origins can be added without weakening URL-component validation.

Current implementation

Current head e4d2f5f02294fe3e337e075ee05ad2afc2889aa6 is stacked directly on #498 head 28cff4ad079e72da417d5830ca90de799b7483ad.

The branch contains the regression contract and production fix:

• arbitrary cross-origin HTTPS artifact links fail by default;
• optional CLEARFOLIO_ARTIFACT_ORIGINS entries are parsed as exact HTTPS origins only;
• malformed, HTTP, credentialed, path/query/fragment-bearing, and empty-entry configuration fails with stable code clearfolio_artifact_origins_invalid before artifact-link provider transport;
• returned artifact URLs reject credentials, fragments, insecure downgrade, and any origin outside the provider origin plus explicit allowlist;
• scheme/host/effective-port identity is compared through canonical URL.origin values rather than prefix matching;
• same-origin artifactToken values may continue through the Clearfolio viewer, while approved cross-origin tokens stay bound to the returned approved origin and are never transplanted;
• the focused regression runs in both the normal unit suite and canonical production coverage cases;
• the existing downstream-contract regression was reconciled so cross-origin compatibility is tested only under the explicit allowlist rather than silently preserving the old arbitrary-HTTPS behavior;
• CHANGELOG.md and docs/doctoring/clearfolio-artifact-origin-trust.md record the buyer/operator boundary, rollback, and APA 7 references.

The slice preserves #493/#498 invariants: explicit development-only mock behavior, validated provider configuration, non-redirecting bounded provider calls, bounded streamed JSON, validated document/job inputs, sanitized failures, and tenant-scoped HMAC claims.

Current exact-head evidence

On unchanged head e4d2f5f0, the repository-native workflows that run on this stacked base are terminal success: Server Tests, Dependency Review, and OSV Scanner. The first implementation head exposed one intentional contract collision in the legacy Clearfolio downstream test: it still expected arbitrary cdn.example redirects without authorization. That failure was repaired by configuring the explicit artifact-origin allowlist around those compatibility assertions; the rerun is green. Cloud E2E on the failed predecessor run was already green, and no predecessor result is promoted to current-head evidence.

There are currently no review threads or formal review submissions on this exact head. Base-filtered security/SAST/fuzz workflows that do not run against this feature branch are not counted as passing; after the parent stack reaches protected develop, this semantic delta must be reconciled and those protected-base gates rerun.

Dependency

This PR is intentionally stacked on #498, which is stacked on #493. It must not integrate before those parent slices. Once the parents reach protected develop, retarget/reconcile this bounded semantic delta against the resulting live base and require the full exact-head protected CI/security/SAST/dependency/coverage/review policy before merge.

Refs #489

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ba41e2ef-96e1-4074-b4c0-57a8cca01ebb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}