PR74-F2 — bind Autoflow to snapshot repository

[LogicDuke]

PR74-F2 repairs the CURRENT P2 repository-identity finding on parent PR #74.

Finding:
A valid serialized Autoflow WorkflowState could be accepted even when its
repositoryId differed from snapshot.repository.repositoryId, violating the
Cockpit one-repository envelope invariant and allowing workflow status/counts
to be attributed to the wrong repository.

Repair:

• keeps repository.repositoryId as the trusted envelope identity;
• validates the reconstructed Autoflow state against that captured identity;
• rejects the whole snapshot on mismatch via invalidFields=["autoflow"];
• does not rewrite, coerce, or inject either identity;
• leaves readWorkflowState unchanged;
• leaves PR74-F1 prototype insulation unchanged;
• leaves D2/D4 semantics unchanged;
• adds no authority.

Independent validation:

• original defect independently reproduced on parent f9e8cb6;
• 16/16 locked conditions PROVEN;
• focused autoflow-provenance: 24 passed;
• relevant suites: 1768 passed;
• thread-pool full suite: 30 files / 1769 tests passed;
• normal npm test classified as pre-existing ENVIRONMENT/TEST-RUNNER FAILURE,
  reproduced identically on untouched parent;
• typecheck PASS;
• lint PASS;
• build PASS;
• git diff --check PASS.

Repair commit:
0a81ccf

Parent:
f9e8cb6

Keep this PR DRAFT.

Do not request reviewers.
Do not manually trigger Codex.
Do not manually trigger CodeRabbit.
Do not add attribution metadata.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: a82053aa-ce3b-433d-b4c5-a16019699d54

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-04T19:42:19.899126Z	0a81ccf	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.