[seonghobae]

Objective

Close the remaining tenant-scoped identifier lookup blind spot directly after #342 without moving its verified exact head. The repository contract currently implements findByTenantAndId(...) as a global findById(...) followed by an in-process ownership filter, which is unsafe as the default contract for future durable adapters and undermines storage-boundary tenant isolation.

Test-first state

This Draft starts intentionally RED at exact test-only head a28d936195b40b1442d7ebeae5f4c86657c01bcd. The focused regression requires the interface default to fail closed without invoking global findById, and requires the process-local adapter to resolve tenant ownership directly from its scoped storage boundary while rejecting missing tenant/job authority and concealing foreign jobs.

Stack and scope

This PR is deliberately stacked on #342 exact head 4eeba73d70db172e44062891c01273efc4109d93 because both slices own ConversionJobRepository and InMemoryConversionJobRepository. It does not move #342, edit AdminController, overlap the active Jules admin PR, change content-hash demo compatibility, implement durable persistence, or claim issue #326/#312/#263 completion.

Acceptance

Observe exact-head RED -> smallest fail-closed contract and in-memory override -> exact-head Maven verification with repository coverage/Javadoc gates -> applicable CI/security/fuzz evidence -> current review/thread/base refetch. Keep Draft while #342 remains open; after #342 integrates, reconcile this unique delta onto the new protected main and regenerate base-sensitive evidence before final merge. Independent write-authorized approval remains a separate protected-merge gate.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b6eb923c-3b54-48c8-9ec0-9f513cd1ec13

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by clean current-stack reconstruction #451. #451 is based on exact current identifier-reservation parent #443 head d5a57a7f4e97467bb2fb163f37e4de5691d7ba31, begins with test-only RED commit 87e41e97d557f0f711eda83ba3245bf62eff620a, preserves #443's lifetime UUID reservation, and restores this PR's scoped repository/service lookup contract. Exact GREEN candidate head is ff6185f318be66fe706f1cf0e12a4063a8bd408b; child checks are being regenerated. Closing this stale stack prevents ambiguous ancestry and duplicate review. No predecessor evidence transfers.