[seonghobae]

Objective

Advance issue #314 with a provider-neutral identity-key snapshot. A verifier can bind a server-owned verifier profile to one immutable key-set generation and bounded cache lifetime so unknown keys, stale generations, pre-fetch use, or expired snapshots fail closed before key material is treated as current authority.

Exact current-head evidence

• protected base at latest head construction: 961f44a19c4ced87f8062b3ab9842a9a08d05235;
• test-only RED head: 5f7099cad795a74e102dcb9366b5968b875a84bd;
• exact current GREEN head: 39ad0fc5def7b9e1b48be9c797d4b34f71bd5eba;
• changed paths: IdentityKeySnapshot.java and its focused regression only;
• CI, Security Scan, SAST Semgrep, and fuzz: terminal-success;
• mergeable: true;
• unresolved inline findings: zero.

Key-authority contract

The immutable snapshot defensively copies exact trusted key identifiers, requires a positive generation fence, models fetchedAt as inclusive and expiresAt as exclusive, rejects malformed authority inputs, and authorizes a key only when the caller's expected generation matches and the snapshot is current.

Scope boundary

Value type only. This does not parse JWTs, verify signatures, fetch discovery/JWK documents, store JWK bodies, choose algorithms, map issuer/audience/roles, modify controllers, or replace signed-HMAC authentication. Issue #314 remains open for those integrated guarantees.

Merge gate

Keep this exact head unchanged. Auto-merge may act only after every live required check remains terminal-success, zero valid unresolved findings remain, and a qualifying independent non-author approval is attached to this exact head. If live protection requires an updated base, rebuild or update against protected main and regenerate all base-sensitive evidence. No predecessor evidence transfers.

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1b6e471f-c8f0-41d4-801f-6d4ccb92fe00

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent review
@coderabbitai review
@cwl-noema-review review
@strix review

Review exact head 39ad0fc5def7b9e1b48be9c797d4b34f71bd5eba only. Exact-head CI, Security Scan, SAST Semgrep, and fuzz are terminal-success; unresolved inline findings are zero. Validate defensive key-ID copying, positive generation authority, inclusive fetch/exclusive expiry, and exact-generation current-key authorization without inferring JWK transport or signature verification.

Review read-only; preserve independent reviewer identity. Do not mutate the branch, synthesize author approval, weaken protection, or merge.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 7 minutes and 15 seconds before sending another message.

[opencode-agent]

Queued @opencode-agent ; Already queued @cwl-noema-review on this exact request for PR #375 at head c322c17ca52132d10286430a113bddb794649f24. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #375 at head c322c17ca52132d10286430a113bddb794649f24. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #375 at head c322c17ca52132d10286430a113bddb794649f24. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #375 at head c322c17ca52132d10286430a113bddb794649f24. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #375 at head c322c17ca52132d10286430a113bddb794649f24. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #375 at head c322c17ca52132d10286430a113bddb794649f24. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @cwl-noema-review and @opencode-agent on this exact request for PR #375 at head c322c17ca52132d10286430a113bddb794649f24. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[seonghobae]

Closing as superseded by consolidated current-main Draft #487. #487 preserves this PR's exact key-snapshot production/test blobs and validates profile/generation/current-key authority inside the integrated federated verification chain. The consolidated head must earn its own exact-head gates and approval.