test(auth): audit admin access lifecycle proof

[Abiorh001]

Change

WS-QUAL-003-13 — Admin access lifecycle proof audit.

Current head: d30808f1ee91fa6c38150b8bdbe54f9036009650.
Integrated main: 003cc6e2643ae1296166fd77018b313169935c24.

Goal / Intent And Planning Context

Audit behavior, not test count or coverage. Retain a representative signed-token API journey and independently diagnosable PostgreSQL transaction/concurrency proof. One PR contains reviewed checkpoints.

Durable scope, design, assertion inventory and acceptance criteria.

What Changed / Why

• Eight mixed bootstrap/admin-access tests become focused owner tests. All 203 original assertion spans have named survivors; the 15 unselected monolith test bodies remain AST-identical.
• Fault probes inspect real staged product/evidence before raising, then verify fresh-session rollback. Grant faults target the actual grant-service session rather than an earlier independent rate-control commit.
• Races require the exact independent waiter/blocker PIDs. A hosted negative control removes the real owner lock and proves that the unchanged race test rejects it.
• Read-transition cases use fresh valid identities with triggers enabled, eliminating reset bypasses. Exact replay asserts persisted target, role, scope, project and granting actor plus linked operation evidence.
• Fixture custody, recursive structural scanning, lane registration, assertion mapping and the roadmap are reconciled together.

Design / Alternatives Rejected

Real signed ASGI requests prove API composition, not deployed-network E2E. Real PostgreSQL proves locking and rollback; mocks do not substitute for those boundaries. Do not hide the old scenario in large helpers, remove tests by count alone, or claim incidental event totals prove each operation.

Scope Control / Product Behavior

Only the declared test/support, inventory/map, scanner, lane-catalogue and audit documentation paths change relative to main. Grant-read/validation owner files and the roadmap update are explicit scope refinements in the record. No production behavior, migration, workflow, threshold, timeout or dependency changes. Product PR377 and checker-documentation PR383 are integrated and preserved. No local spreadsheet exports exist.

Evidence / Acceptance Criteria Proof

• Local: 38 focused CLI/catalogue/structural tests passed; 147 mixed nodes collected with fixture resolution. Collection is not PostgreSQL execution.
• Ruff, structural ledger/assertion-map validation, Commitrail, Markdown links, stale scans and diff checks passed. All 15 unselected bodies and the moved database fixture are AST-identical to their baseline.
• Final Backend run 34173535038 and Agent Gates 34173535052 pass: all seven lanes, AUTH preflight and aggregate.
• 5,061/5,061 cases completed; zero skips/deselections. Global coverage 91.5647%. Existing floors preserved.
• Synthetic merge c219f8bc8dadb37d7413a2c77c8fc59150197bfe has the exact main/head parents and tree 7446e223d5eb124ea4eefb176ec91e76de010891, identical to the current head.
• Discriminating probes: CLI stderr leak and dispatch substitutions fail; missing lane registration fails; five stored-grant fact substitutions fail; the real missing-owner-lock negative control passes by rejecting the broken race proof at its intended observation.
• The first historical API run exposed two test assumptions: audit storage uses actor_id, and the first route commit may be independent rate control. The staged-state assertions rejected that premature fault injection. Both were repaired and executed successfully before final synchronization.

Test Delta

The three removed large functions were 1,041/485/280 lines. test_auth.py shrinks from 5,822 to 3,877 lines; its remaining families are explicitly out of scope. The new owner has 47 named functions / 103 expanded cases, all files below 500 lines, tests at most 120 and helpers at most 100. Independent cases replace behavior hidden inside loops; this is not a claim of net test-count reduction. Debt entries fall 78→75 with no new or grown debt.

Impact-Routed Reviewer Results

Implementation reviews closed at clean 225ffd2bcf382e7c86a63f574c97b967afc07b3f over 67a2f1bd7dbbff76d2635d1f084c479de339558f:

• QA / test-delta: PASS. Actual node custody, exact assertion map, rollback stage, lock negative control and independent fact-substitution probes verified.
• Security / reuse: PASS. Real transaction/concurrency, scoped disclosure and concealment evidence verified; no remaining finding.
• CI integrity / docs: PASS WITH LOW RISKS / PASS on that implementation head, including artifact hash chain, complete manifest and cleanup.

All three low corrections are resolved: exact persisted grant fields (SEC-ADMIN-IMPL-001), precise access-administrator survivor (TD13-MAP-001), and overview/roadmap reconciliation (DOC-QUAL13-001). The old CLI finding was withdrawn after reproducing the real statement order.

Strict branch protection then required integrating documentation-only PR383. backend/, .ci/, .github/ and this audit's records are byte-identical between 225ffd2 and d30808f; the audit roadmap paragraph is also unchanged. CI/docs independently verified that compatibility. The retained QA/security receipts apply to that unchanged cone; they are not relabeled new-head reviews. Final CI/docs replay at clean d30808f is PASS WITH LOW RISKS / PASS, with independently verified exact-head artifact hashes, complete node custody, coverage and cleanup. No blocking finding remains. These summaries mirror, rather than own, private reviewer evidence.

External Review / CI Integrity

CodeRabbit: not fresh. The full-review retry was rate-limited; its green check is not substantive approval. No review threads exist. All required GitHub checks pass; no workflow, test-selection, threshold, timeout or dependency weakening occurred.

Remaining Risks / Human Review Focus

• Final Backend wall time was 546.131s, slowest semantic lane 369.043s, aggregate runner cost 1,822.619s. The advisory 480s target was missed; no speedup is claimed (CI-QUAL13-TIMING-001, low).
• Inspect original-to-survivor mapping, actual fault staging, exact lock custody and fixture cost. CodeRabbit remains unavailable, not an approval substitute.
• The remaining service-actor, profile/link and other AUTH families, followed by the rest of the suite audit, require later bounded work. This PR does not complete the entire audit or activate product behavior.

Human Merge Ownership

Human approval and explicit approval to merge this PR remain required. No agent review or passing check authorizes merge.

[coderabbitai]

Warning

Review limit reached

Next included review available in 32 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: f5ccb534-dd6e-4b6b-845c-f1e0abf88aad

📥 Commits

Reviewing files that changed from the base of the PR and between 003cc6e and d30808f.

📒 Files selected for processing (29)

• .ci/auth-boundaries/TEST_STRUCTURE_DEBT.json
• .ci/auth-boundaries/assertion-maps/WS-QUAL-003-13.json
• .commitrail/initiatives/WS-QUAL-003/OVERVIEW.md
• .commitrail/initiatives/WS-QUAL-003/WS-QUAL-003-13.md
• backend/scripts/test_lane_catalogue.py
• backend/scripts/test_structure_boundary.py
• backend/tests/architecture/test_test_structure_boundary.py
• backend/tests/authentication/fixtures.py
• backend/tests/authorization/admin_access/__init__.py
• backend/tests/authorization/admin_access/concurrency_support.py
• backend/tests/authorization/admin_access/conftest.py
• backend/tests/authorization/admin_access/fault_support.py
• backend/tests/authorization/admin_access/fixtures.py
• backend/tests/authorization/admin_access/read_support.py
• backend/tests/authorization/admin_access/support.py
• backend/tests/authorization/admin_access/test_admin_reads_postgresql.py
• backend/tests/authorization/admin_access/test_api_journey.py
• backend/tests/authorization/admin_access/test_bootstrap_cli.py
• backend/tests/authorization/admin_access/test_bootstrap_postgresql.py
• backend/tests/authorization/admin_access/test_failure_atomicity_postgresql.py
• backend/tests/authorization/admin_access/test_grant_api_postgresql.py
• backend/tests/authorization/admin_access/test_grant_concurrency_postgresql.py
• backend/tests/authorization/admin_access/test_grant_reads_postgresql.py
• backend/tests/authorization/admin_access/test_grant_validation_postgresql.py
• backend/tests/authorization/admin_access/test_read_concurrency_postgresql.py
• backend/tests/authorization/admin_access/test_timestamp_concurrency_postgresql.py
• backend/tests/test_auth.py
• backend/tests/test_ci_lane_catalogue.py
• docs/roadmap_status.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Abiorh001]

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 50 minutes.