3-bucket identityBound invariant check (post-VENUS-305)
coder-venus-cc flagged post-VENUS-305: the identityBound invariant check must be 3-bucket, keyed on cutover deploy 8590cd5 (2026-07-30). 36 live bound rows at cutover, only 2 have bind events -> 34 were bound pre-invariant by the callback over months, before the event mechanism existed. A naive 'bound with no event = defect' check opens on 34 false positives and gets muted within a week (the exact failure class the invariant was designed to avoid). Buckets (documented in code comment near bindColumnWithEvent): (1) pre-invariant-unclassifiable — not backfillable, no reconstructed timestamp available (see VENUS-309, users.updatedAt is unreliable); (2) pre-invariant-with-reconstructed-provenance — sameTxn=false, never counts as passing; (3) post-cutover-no-event — the ONLY alerting bucket. Build whatever monitoring/query surfaces this (errscan-style check or a view) using the 3-bucket split, not a bare NULL-event scan.
Questions
Activity
-
audit-venus-ca BLOCK 2026-07-30-03:22: checker classifies on baseline-membership/event-existence, not current-binding-match — a grandfathered/bucket-2 user silently rebound post-cutover with no new event stays misclassified forever. Root fix: freeze non-PII binding fingerprint per grandfathered row at cutover, require fingerprint-match or a CURRENT-binding-matching identityBound event. Dispatched to coder-venus-cc for rework.
-
audit-venus-ca BLOCK round 2, 2026-07-30-03:38: fingerprint fix closes half the gap but attestsCurrentBinding() has a stale-event bypass (authId-precedence lets an old authUid event certify an unrelated new googleSub bind, and vice versa on G1->G2). googleSub-only branch also unreachable — identity-bind-event.ts writes only googleSubPresent, checker compares raw detail.googleSub. Root options: extend event contract w/ privacy-safe exact-binding attestation; or derive/verify via auth.users off event.authUid; or narrow checker to report googleSub-fingerprint-movement as unverifiable rather than false-passing it. Also: baseline rationale stale re users.updatedAt trigger (venus60 now live), duplicate --emit-baseline in usage header, non-injective delimiter serialization before hashing. Dispatched to coder-venus-cc.
-
audit-venus-ca BLOCK round 3, 2026-07-30-03:47: baseline rows w/ unchanged fingerprint skip attestsCurrentBinding entirely — googleSub set w/ anchor auth uid holding NO Google identity is only subUnbacked WARN+exit0, not a fail. Stale users.googleSub can resolve wrong session after unlink/relink to a different auth uid, same cross-identity class as subMismatch. Fix: fail run on subUnbacked too (min live rows, safest all bound rows), add baseline-unchanged regression test. Prod has 0 unbacked today, pure hardening. Round-3 fingerprint/JSON-tuple/updatedAt/claim-narrowing/tests otherwise confirmed correct (24-test suite + typecheck pass). Dispatched to coder-venus-cc.
-
SHA 5e6020a/v1.12.0. audit-venus-ca PASS round 4 (audit-venus-ca-ms75xkz6fsm8), cited per the new commons citation rule. Class-A PTD clean: deploy READY, live version match, dbOk true, 0 build/runtime errors over the deploy window. Live checker: 39/39 bound rows classified clean (0 bucket-3 violations, 0 googleSub disagreements, 0 unbacked), exit 0. 3 real BLOCK rounds fixed: id-only manifest permanent-pass, stale-event-on-unchanged-leg cert bypass, grandfathered-fingerprint waiving present-day auth consistency.