fix(loop-memory): isolate cross-initiative authority evidence

[Abiorh001]

PR Trust Bundle: WS-ENG-007-00R4

Intent

Allow a signed start for an idle initiative after another initiative becomes the
latest global merge, without attaching one PR's protected evidence to another
initiative's lifecycle.

Scope

• Keep the latest global merge and its protected evidence unchanged.
• Validate the selected initiative's authority projection independently.
• Bind that projection byte-for-byte to its prior signed ledger basis.
• Add updater and independent-checker regressions for the exact failure.

Reviewed Revision

145c1f92f13ad3467ce89fac6895828ef9d01f24

CI Integrity

• No workflow, permission, required check, coverage floor, test, reviewer, signed
  start, or human merge checkpoint was removed or weakened.
• All 289 focused tests pass.
• Exact updater branch coverage is 90.18 percent with two-decimal enforcement.

Reviewer Result

All nine required internal tracks passed after fixes. No Critical or High
finding remains open.

Human Review Focus

• Confirm authority projection validation no longer constructs a synthetic merge
  record with foreign protected evidence.
• Confirm source/completed identity remains bound to the prior signed initiative
  record by both transition validators.
• Confirm malformed authority metadata fails closed in updater and checker.
• Confirm no successor starts automatically.

Remaining Risk

A new main merge before this recovery lands requires the branch and evidence to
be refreshed normally; the signed event still requires exact current main.

Summary by CodeRabbit

• Bug Fixes

  • Prevented cross-initiative starts from borrowing merge evidence or lifecycle identity from another initiative.
  • Added stricter validation for authority records, source metadata, commit details, and completed chunks.
  • Ensured malformed or forged authority data fails safely.

• Tests

  • Added regression coverage for cross-initiative evidence separation and malformed authority records.
  • Expanded validation and updater coverage for idle initiative starts.

[coderabbitai]

Warning

Review limit reached

@Abiorh001, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 39 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6682d81b-78d4-408f-96e2-1a9240fb7e1c

📥 Commits

Reviewing files that changed from the base of the PR and between 9323695 and 2315b1f.

📒 Files selected for processing (6)

• .agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/CHUNK_MAP.md
• .agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/STATUS.md
• .agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-00R4-external-review-response.md
• .agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-00R4-internal-review-evidence.md
• .agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-00R4-pr-trust-bundle.md
• scripts/test_check_loop_memory_state.py

📝 Walkthrough

Walkthrough

This change adds the WS-ENG-007-00R4 recovery contract, routes its successor merge intent, directly validates authority sources, and adds regression coverage ensuring cross-initiative starts preserve initiative-local lifecycle identity without borrowing global merge evidence.

Changes

Authority Projection Repair

Layer / File(s)	Summary
Recovery contract and routing .agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/*, .agent-loop/merge-intents/*	Documents WS-ENG-007-00R4, updates recovery status and sequencing, records review evidence, and adds the schema-v2 successor merge intent.
Direct authority validation scripts/update_post_merge_memory.py, scripts/check_loop_memory_state.py	Validates authority sources directly, including schema shape, repository and SHA fields, PR identity, bounded text, timestamps, completed metadata, and canonical intent paths.
Cross-initiative regression coverage scripts/test_update_post_merge_memory.py, scripts/test_check_loop_memory_state.py	Covers malformed authority data and verifies that cross-initiative starts do not reuse another initiative’s merge-bound evidence.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• Flow-Research/workstream#122: Introduced the same start/cancel authority validation path being modified here.
• Flow-Research/workstream#165: Overlaps with authority validation and cross-initiative merge-evidence handling.
• Flow-Research/workstream#190: Directly relates to merge-bound protected-check evidence validation in the reconciliation paths.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description covers intent and scope, but omits most required template sections like chunk, evidence commands, acceptance proof, and full reviewer tables.	Add the missing template sections: Chunk, Human-Approved Intent, What Changed/Why/Design/Alternatives, Evidence, Acceptance Criteria Proof, Test Delta, and full reviewer/external review tables.
Docstring Coverage	⚠️ Warning	Docstring coverage is 18.18% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the main change: isolating cross-initiative authority evidence.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/ws-eng-007-00r4-cross-initiative-start

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
@.agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/CHUNK_MAP.md:
- Line 9: Update the WS-ENG-007-01 dependency entry in CHUNK_MAP.md to replace
the stale 00R3 prerequisite with 00R4, preserving the existing wording for the
remaining prerequisites and status.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8354c70d-6608-4095-a386-09efdeebd7ea

📥 Commits

Reviewing files that changed from the base of the PR and between a3eecad and 9323695.

📒 Files selected for processing (10)

• .agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/CHUNK_MAP.md
• .agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/STATUS.md
• .agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/chunks/WS-ENG-007-00R4-cross-initiative-authority-projection.md
• .agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-00R4-internal-review-evidence.md
• .agent-loop/initiatives/WS-ENG-007-concurrent-pr-review-reconciliation/reviews/WS-ENG-007-00R4-pr-trust-bundle.md
• .agent-loop/merge-intents/WS-ENG-007-00R4.json
• scripts/check_loop_memory_state.py
• scripts/test_check_loop_memory_state.py
• scripts/test_update_post_merge_memory.py
• scripts/update_post_merge_memory.py