fix(v0.6): complete W43 SCRAM admission contract by ammarheidari · Pull Request #159 · araditc/Kafdeck

ammarheidari · 2026-09-25T11:15:56Z

Authority

Follow-up remediation for W43 under #157 / tracker #146. Scope #145 remains accepted/closed; planning #147 is admitted. PR #158 merged an incomplete SCRAM slice whose own body still marked W43 NOT MERGE READY; final W43 admission therefore remains withheld until this remediation passes governed evidence.

Remediation implemented on current head

Current head: 1dc96474ca0b2526e9a38678c86fe3997f82a7a3, base main@bd6dd6c007ded83e65775934c4defa1b3e928368.

preserves the legacy v0.5 operation/hash path while adding a server-preallocated durable OperationId overload for operation-bound SCRAM planning;
adds the common server-owned CRITICAL risk floor for ScramAlter;
binds canonical SCRAM plan to durable operation/requester/policy/cluster/resource/authorization/precondition/material identity;
adds one-shot request-scoped upsert finalization material through the existing MutationDispatchService -> MutationExecutor path; no delayed plaintext storage;
adds typed delete finalization without secret material;
adds digest-key rotation and metadata-drift pre-dispatch invalidation;
adds live original-requester + distinct currently eligible direct-subject approver revalidation; no OIDC group rehydration;
adds durable SCRAM conflict obligations before provider I/O and no-redispatch behavior for previously admitted effects;
ambiguous upsert remains ExecutionUnknown even when mechanism/iteration metadata later matches; metadata never proves password equality;
delete ambiguity may be promoted only by observed credential absence;
exact missing SCRAM user maps narrowly from Confluent Local_Partial per-user ResourceNotFound to empty exact-user metadata; other partial/error shapes remain failures;
adds real Kafka synthetic create/upsert -> authenticate -> rotate -> reject-old/authenticate-new -> delete -> reject-new lifecycle evidence to the existing smoke/compatibility matrix;
adds architecture/fault regressions for operation identity, finalization, drift, current authorization, obligations and ambiguity.

Activation boundary

No public REST/OpenAPI/UI route and no default SCRAM handler/validator DI activation is introduced. W39 remains fail-closed unless W43 dependencies are explicitly injected; W49 retains public activation.

Final admission gate

W43 remains NOT YET ADMITTED COMPLETE until current-head applicable CI is green, substantive review is complete, required threads are resolved, and a fresh current-head CODEOWNER approval from akhiabanchian exists.

No release/tag/OCI publication is authorized.

Refs #157 #146 #145

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

chatgpt-codex-connector · 2026-09-25T11:16:14Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-25T12:18:19.989446Z	`1dc9647`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 75b5ce3947

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

ammarheidari · 2026-09-25T11:25:47Z

@codex review

Please review exact source head 225329347b745cdf732afb2d84773b5a1b1b967a, with particular attention to W43 SCRAM operation-ID/HMAC binding, one-shot requester finalization, current independent-approver revalidation, durable conflict obligations, no-redispatch after ambiguous upsert, and real Kafka lifecycle evidence. Do not infer password equality from metadata.

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

…cope Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 225329347b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

ammarheidari · 2026-09-25T11:43:13Z

@codex review

Please review exact head 536dd1a0a35bf2b76a0a6d988e75ec712c61466d after the W43 deterministic SCRAM observation/delete/authentication fixes and the resolved review dispositions. Focus on correctness, ambiguity semantics, secret handling, and governed W43/W49 activation boundaries.

- normalize exact-user ResourceNotFound to empty SCRAM metadata - require full mechanism absence before delete verification can resolve uncertainty - prove create/rotate/delete credentials with real SCRAM authentication - disambiguate provider SaslMechanism in the integration harness Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

ammarheidari · 2026-09-25T11:45:01Z

@codex review

Fresh exact-head review requested after DCO-safe history repair. Please review a9c6822cd1f8a50739b501b32370da1c81af8ebd (not the superseded heads) for W43 correctness, ambiguity handling, credential lifecycle evidence, and W49 activation-boundary compliance.

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

ammarheidari · 2026-09-25T11:48:43Z

@codex review

Please review fresh exact head d8e3ea93707720b837336576fab735fabd899c14. The latest fix classifies Confluent exact-user SCRAM absence from the per-user exception.Results error (the outer exception is Local_Partial), while keeping all other shapes fail-closed. Re-check W43 ambiguity/secret/authorization and W49 activation boundaries.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d8e3ea9370

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

ammarheidari · 2026-09-25T12:14:41Z

@codex review

Please review fresh exact head 1dc96474ca0b2526e9a38678c86fe3997f82a7a3 after the execution-material claim-failure/expiry remediation. Verify zeroization ownership, TOCTOU behavior, and that no W49 activation boundary was crossed.

chatgpt-codex-connector · 2026-09-25T12:18:18Z

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 1dc96474ca

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

ammarheidari added 5 commits September 25, 2026 14:44

feat(v0.6): admit preallocated mutation operation identity

95a0a13

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

feat(v0.6): enforce critical SCRAM mutation floor

3aa2f79

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

feat(v0.6): allow server-preallocated mutation admission identity

07c8ecd

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

feat(v0.6): bind SCRAM plan to durable mutation identity

fa432f6

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

feat(v0.6): add one-shot SCRAM finalization material builder

75b5ce3

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

ammarheidari requested a review from akhiabanchian as a code owner September 25, 2026 11:15

ammarheidari added 5 commits September 25, 2026 14:46

feat(v0.6): add fail-closed SCRAM effect authorization boundary

3094cb0

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

feat(v0.6): revalidate SCRAM preview before dispatch

e07eb63

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

feat(v0.6): revalidate live SCRAM requester and approver

3343035

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

feat(v0.6): keep SCRAM pre-dispatch integration fail closed

7ad946d

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

fix(v0.6): fail closed on invalid SCRAM binding metadata

072228a

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

chatgpt-codex-connector Bot reviewed Sep 25, 2026

View reviewed changes

Comment thread src/backend/Kafdeck.Api/MutationAdmissionService.cs

Comment thread src/backend/Modules/Kafdeck.Modules.Administration/MutationOperation.cs

ammarheidari added 10 commits September 25, 2026 14:49

feat(v0.6): coordinate SCRAM effects through durable obligations

7752d5a

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

feat(v0.6): finalize SCRAM through common mutation dispatcher

0c0111b

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

test(v0.6): bind SCRAM finalization to durable operation identity

989ae6f

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

test(v0.6): preserve preallocated operation identity at admission

db5b2de

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

test(v0.6): cover SCRAM pre-dispatch drift and key rotation

f0d6fbc

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

test(v0.6): prove SCRAM ambiguity and no-redispatch semantics

6341058

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

fix(v0.6): treat exact missing SCRAM user as empty metadata

908eb15

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

test(v0.6): add real Kafka SCRAM credential lifecycle

5eb8d55

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

test(v0.6): run SCRAM lifecycle in Kafka compatibility matrix

e1bdb37

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

test(v0.6): prove live SCRAM requester and approver revalidation

2253293

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

This was referenced Sep 25, 2026

v0.6 W43 — SCRAM administration with ephemeral requester finalization #157

Closed

v0.6 — Fleet Operations planning and implementation tracker #146

Closed

ammarheidari added 4 commits September 25, 2026 14:57

fix(v0.6): admit SCRAM through closed fleet authorization

023e4f8

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

feat(v0.6): derive stable SCRAM operation identity from idempotency s…

4b9265b

…cope Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

feat(v0.6): validate stable SCRAM identity at admission

96ca16d

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

fix(v0.6): keep SCRAM idempotency identity stable across retries

0e70fba

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

fix(v0.6): preserve SCRAM uncertainty before stale-state checks

0766a79

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

chatgpt-codex-connector Bot reviewed Sep 25, 2026

View reviewed changes

Comment thread src/backend/Modules/Kafdeck.Modules.Administration/ScramMutationExecutionService.cs Outdated

Comment thread src/backend/Kafdeck.Api/W39MutationPreDispatchGuard.cs

Comment thread tests/Kafdeck.Architecture.Tests/KafkaScramMutationIntegrationTests.cs

akhiabanchian previously approved these changes Sep 25, 2026

View reviewed changes

test(v0.6): prove stable SCRAM idempotency binding

f486bde

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

ammarheidari dismissed akhiabanchian’s stale review via f486bde September 25, 2026 11:30

test(v0.6): cover SCRAM fleet admission and retry idempotency

3ab0dc8

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

akhiabanchian self-requested a review September 25, 2026 11:34

akhiabanchian previously approved these changes Sep 25, 2026

View reviewed changes

ammarheidari dismissed akhiabanchian’s stale review via 59faea4 September 25, 2026 11:41

ammarheidari requested a review from akhiabanchian September 25, 2026 11:43

ammarheidari force-pushed the fix/v0.6-w43-admission-remediation branch from 536dd1a to a9c6822 Compare September 25, 2026 11:44

fix(w43): classify exact-user SCRAM partial results

d8e3ea9

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

chatgpt-codex-connector Bot reviewed Sep 25, 2026

View reviewed changes

Comment thread src/backend/Kafdeck.Api/MutationDispatchService.cs

akhiabanchian previously approved these changes Sep 25, 2026

View reviewed changes

fix(w43): zero execution material on claim failure

7e17ec8

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

ammarheidari dismissed akhiabanchian’s stale review via 7e17ec8 September 25, 2026 12:14

fix(w43): reject expired dispatch before materialization

1dc9647

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

ammarheidari requested a review from akhiabanchian September 25, 2026 12:14

akhiabanchian approved these changes Sep 25, 2026

View reviewed changes

akhiabanchian merged commit 714f5e8 into main Sep 25, 2026
14 checks passed

akhiabanchian deleted the fix/v0.6-w43-admission-remediation branch September 25, 2026 13:37

ammarheidari mentioned this pull request Sep 25, 2026

fix(kafka): stabilize record-read setup after W43 merge #160

Merged

Conversation

ammarheidari commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Authority

Remediation implemented on current head

Activation boundary

Final admission gate

Uh oh!

chatgpt-codex-connector Bot commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

ammarheidari commented Sep 25, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ammarheidari commented Sep 25, 2026

Uh oh!

ammarheidari commented Sep 25, 2026

Uh oh!

ammarheidari commented Sep 25, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

ammarheidari commented Sep 25, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ammarheidari commented Sep 25, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Sep 25, 2026 •

edited

Loading