Add Conversations project resource-link producer surfaces

[andrei-hasna]

Implements DUB-00029 for the reviewed Projects resource-link contract.

Summary:

• adds bounded stable-ID enumeration for project-linked channels
• adds exclusive numeric pagination for messages/replies inherited from one chn_ channel
• rejects channel/message project conflicts and leaves unbound data outside the producer population
• exposes SQLite/PostgreSQL parity through authenticated REST, OpenAPI, generated SDK, Store transports, and project-registration CLI commands
• preserves existing conditional registration/readback/inverse behavior and numeric reply-parent compatibility

Verification:

• focused producer matrix: 23 pass, 0 fail
• full repository suite: 1818 pass, 0 fail across 123 files
• bun run typecheck: exit 0
• bun run build: exit 0
• npm pack --dry-run --json: exit 0; CLI/server/root/SDK JS and declarations present
• gitleaks protect --staged --redact --no-banner: no leaks found

Todos: 0d28de89-0a2b-4339-8b3e-6f79bfca9600

Implementation only: independent review, merge, release, install, and live migration are intentionally left to the parent workflow.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

Adversarial review — NO_GO

Exact candidate: head 0149b06; base/current main 81867a8; HEAD and merge-result tree e518639d5eb320903f1a45dc42a59387dd271be8; git diff --quiet HEAD merge-tree returned rc=0; protected GitHub CI and macOS checks are SUCCESS.

Two current in-scope P1 blockers:

1. Cross-channel reply-parent UUID disclosure and integrity violation. The new SQLite and PostgreSQL collection queries join reply parents by numeric ID without constraining parent and child to the same channel/session, while authenticated bulk ingest accepts the numeric reply_to. Literal fresh-SQLite repro: {"parent_channel":"left-channel","child_channel":"right-channel","exposed_reply_to_target_id":"2e0ccd88a1ab4ac19c36baa439382345","parent_uuid":"2e0ccd88a1ab4ac19c36baa439382345","item_count":1}. A right-channel page exposes a parent UUID from left-channel.

2. Public CLI registration lifecycle parity is incomplete. It exposes capability, create, channels, messages, and read-channel, but no receipt lookup, inverse/compensation, or inverse-verification commands although Store/API/SDK implement them and the registration/rollback contract requires them.

Supporting controls: focused tests 34 pass / 0 fail / 276 expectations; typecheck rc=0; SDK generation rc=0; generated SDK diff rc=0. One intermittent full-suite react/jsx-dev-runtime error is non-blocking because its exact ChatView rerun returned rc=0.

Focused remediation acceptance: SQLite and PostgreSQL same-channel parent resolution plus authenticated cross-channel negative cases; reply-parent compatibility regressions; and CLI receipt lookup, inverse, and inverse-verification unit/e2e paths. The same fixed Codewith reviewer will re-review only these two defects, their fixes, and direct regressions.

[andrei-hasna]

[REVIEW] NO_GO — #148 @ 0149b06 — lens: correctness+security+gates, reviewer Damon (1 of 1)

Reviewed the full diff against origin/main at 81867a8 and read the surrounding registration authority, SQLite/PostgreSQL storage paths, authenticated HTTP routing, Store transport, CLI, generated SDK/OpenAPI, message project inheritance, and all changed tests.

Commands and results:

• bun install — exit 0. Setup only; not counted as a test gate.
• bun run typecheck — exit 0; no TypeScript diagnostics (pass/fail counts not applicable).
• bun run test — DID NOT EXIT, so no exit code exists to report. The runner printed 1818 pass, 0 fail, 6456 expect() calls, and Ran 1818 tests across 123 files. [383.25s], then remained live in ep_poll for more than 12 minutes. A second exact invocation reproduced the same non-termination. Both review-started processes were terminated after the evidence was captured.

Blocking P0/P1 findings:

• P1, required test gate: the repository-declared bun run test gate does not terminate and therefore cannot return the required successful exit code. Assertion counts are green, but a hanging gate is not a passing gate and cannot support merge. Remedy: make the declared test command terminate on its own with exit 0 after the summary; then re-run this same gate for focused verification.

No concrete P0/P1 correctness or security defect was found in the changed producer surfaces themselves. The new GET routes remain behind the existing read-scope authentication, use bound SQL parameters, enforce project/channel membership, and return identity/digest metadata rather than message bodies.

Non-blocking follow-ups: none.

[andrei-hasna]

cwseat-019fdc59 DUB-00029 executor handoff for exact candidate 7d8d160a4c5a91dc11ef4da6d1743fec5ffa994c (tree 01bce63402fb2b7ee182a172517e995b0216ab17). The scoped P1 fixes enforce same-channel and same-session reply parents in SQLite, PostgreSQL, direct POST, and authenticated bulk ingest, while preserving idempotent skips for already stored UUIDs. The public CLI now exposes terminal receipt lookup, compensation, and inverse verification through existing Store/API/SDK authority. Evidence: focused matrix 80 pass / 0 fail; affected API lane after final hardening 56 pass / 0 fail; full repository before that API-only hardening 1821 pass / 0 fail; typecheck, build, SDK generation with no generated diff, package dry-run (242 files), contract kit, no-deployment-mode gate, diff check, and staged gitleaks all exited 0. No merge or release performed. The reserved reviewer should assess this exact SHA against the two named P1s and direct regressions only.

[andrei-hasna]

Fixed independent Codewith reviewer focused remediation verdict: GO on exact head 7d8d160, tree 01bce63402fb2b7ee182a172517e995b0216ab17. Scope stayed limited to the two original P1 defects and direct regressions. SQLite/PostgreSQL reply-parent joins and direct/authenticated bulk-ingest validation now enforce same channel/session; the public CLI exposes lookup-receipt, compensate, and verify-inverse with terminal readback/absence verification. Affected evidence: 92 pass, 0 fail, 584 assertions across 8 files; CLI help, typecheck retry, and diff check rc=0; protected ci and swift (macOS) SUCCESS. No remaining reachable in-scope P0/P1.

[andrei-hasna]

[REVIEW] GO — #148 @ 7d8d160 — lens: correctness+security+gates, reviewer Xenon (1 of 1)

Verdict: GO.

What I ran:

• git log --oneline origin/main..HEAD — exit 0; 2 commits.
• git diff origin/main...HEAD --stat — exit 0; 16 files changed, 2230 insertions, 6 deletions.
• bun install — exit 0; setup only, 168 installs checked across 167 packages, no changes.
• bun run typecheck — exit 0; 1 declared typecheck gate passed, 0 failed, 0 diagnostics.
• bun run test — exit 0; 1822 pass, 0 fail, 6488 expect() calls across 123 files.

What I read:

• The full diff of all 16 changed files against origin/main at 81867a8.
• Surrounding CLI, SDK, HTTP authorization and route handling, local/HTTP/PostgreSQL store implementations, SQLite/PostgreSQL migrations, message parent and project-scope validation, generated OpenAPI surfaces, and the focused unit/e2e coverage.
• The producer write/readback/inverse paths, including cross-project rejection, parent channel/session boundaries, response/byte/time bounds, and parameterized database queries.

Blocking P0/P1 findings: none.

Non-blocking follow-up:

• The bulk registration route accepts reply parents that already exist in storage, but not a parent introduced in the same bulk request. The path fails closed, and the current payload has no immutable in-batch parent identity, so this is a P2 contract limitation rather than a correctness or integrity blocker for the supported path.