security(csrf): extract browser-provenance follow-up from checksum owner #1361

[seonghobae]

Current authority — 2026-09-17

The original ownership finding is source-repaired but not yet evidence-complete, so this issue remains open.

What was wrong

Post-restack #1361 still mixed two responsibilities in backend/main.py / backend/tests/test_main.py: bounded checksum registration and an unrelated browser-provenance/origin-consistency hardening. That violated the checksum lane's single-writer boundary even though the security delta itself was valid.

Historical verification also corrected the predecessor story: merged #563 is not the backend authority for this later provenance distinction; its merged delta is AI-Hub/frontend work. The relevant browser-side origin history is #653, while the backend provenance behavior required its own owner.

Implemented succession and prerequisite repair

Dedicated owner #1706 remains the single writer for the browser-provenance boundary. Its predecessor direct-develop head b283f3bd33541cb1f7b2b8110a169c1f87636b3c exposed a real prerequisite failure: Security Scan 35086721109 failed in Trivy because protected develop still carried vulnerable dependencies outside #1706 ownership:

• Next.js 16.0.10 — HIGH GHSA-h25m-26qc-wcjf and GHSA-v6x2-4r74-8gmx;
• Sharp 0.34.3 / libvips 8.17.1 — HIGH CVE-2026-33191.

Canonical dependency-security owner #1623 already owns the required Next.js/Sharp floor and regression contract. #1706 therefore did not duplicate dependency files or suppress Trivy. It was ordinary/non-force restacked onto exact #1623:

• current security(csrf): separate browser provenance verification from checksum lane #1706 exact head 4788be4ba8f2a5adef287d164bd9181c714d9796;
• base/prerequisite #1623@509be4c1d9b6c7ba239a108656e2382681a85341;
• first parent preserves predecessor security(csrf): separate browser provenance verification from checksum lane #1706 b283f3bd...; additional parent adopts fix(deps): patch frontend audit security floors #1623;
• fresh compare from fix(deps): patch frontend audit security floors #1623 is behind_by=0 and exactly three files: backend/main.py, backend/tests/test_main.py, docs/doctoring/browser-provenance-csrf-boundary.md;
• PR remains Draft/open/mergeable.

Review gate is now GREEN on the current head

CodeRabbit completed a fresh review after #1706 had been retargeted onto #1623. Formal review PRR_kwDOSNjZ2s8AAAABN6kH6Q is APPROVED at 2026-09-16T21:59:23Z; current review-thread inventory is empty. The review covered exact 4788be4b..., selected the three effective browser-provenance files, and produced no actionable finding. This review remains valid only while the exact head is unchanged.

Hosted evidence is still RED for the current integration context

The exact 4788be4b... push created six PR workflow runs at 2026-09-16T21:50:12Z while the PR still targeted develop; the PR was retargeted to #1623 at 21:50:13Z. Those runs therefore belong to the earlier direct-base event context. Fresh lookup still shows those same six runs queued/pending, but later completion would not make them proof of the current #1623 integration context.

No dummy/no-op commit, temporary retarget, copied workflow, synthetic status, or blind rerun will be used to manufacture a current-context receipt. #1706's remaining acceptance is hosted current-base execution only.

The browser-provenance contract remains deliberately narrower than a generic cookie-CSRF claim. Browser-derived state-changing requests carrying provenance signals must fail closed on inconsistent/missing Origin/Referer evidence, while provenance-free API requests continue to the bearer-authentication boundary.

Canonical checksum owner #1361 remains separate:

• exact 6bf2989d571a2aa94ce1f92997650cc450e88e9d;
• exact parent fix(deps): patch frontend audit security floors #1623 509be4c1d9b6c7ba239a108656e2382681a85341;
• behind_by=0;
• pure nine-file bounded-checksum delta;
• browser-provenance source/tests absent from its effective product state;
• stacked-admission/current-head review gates remain tracked separately under fix(ci): make stacked PR validation a develop prerequisite #1691.

Generated checksum duplicate #1707 remains Draft zero-effective-delta provenance on #1361; it is not a second product owner.

Remaining acceptance before this issue may close

1. fix(deps): patch frontend audit security floors #1623 must complete its own central CodeQL prerequisite path or be completely succeeded through protected integration.
2. security(csrf): separate browser provenance verification from checksum lane #1706 must obtain terminal required hosted evidence for its current fix(deps): patch frontend audit security floors #1623 integration context. Its current-head independent review is already satisfied while 4788be4b... remains unchanged.
3. feat(tools): add bounded content checksum generator #1361 must complete its normal prerequisite chain and obtain current-context hosted/review evidence.
4. Re-fetch exact heads and verify the browser-provenance delta remains exclusively owned by security(csrf): separate browser provenance verification from checksum lane #1706 and absent from feat(tools): add bounded content checksum generator #1361 effective product state.
5. Only then may this issue close.

Refs #1361, #1623, #1691, #1706, #1707. No force push, destructive rebase, silent security deletion, scanner suppression, duplicate writer, self-approval, synthetic status, source-neutral wake commit, or gate weakening.

[seonghobae]

Verified and extracted.

Fresh protected develop@042b0c70531b229af3acbd0421a2f23098d848b3 review confirmed the residual #1361 hunks are a distinct backend browser-provenance CSRF contract. Merged #563 is not source authority for this backend behavior: its actual merged diff contains only frontend/src/app/ai-hub/page.test.tsx and frontend/src/components/AIHubLayout.tsx. Merged #653 is the relevant browser-proxy predecessor; its Next.js proxy intentionally rejects state-changing requests with neither Origin nor Referer.

Dedicated direct protected-base owner is now #1706 at exact 98e8ad5b2642986d1095c10bdf88c0dbe402d7f2:

• RED 181ce1cc108db0d48c3d97dbf50fdb9b3d8e9dc2 reproduces Sec-Fetch-Site: same-origin + missing Origin/Referer reaching the auth gate under protected source;
• fix 23e59fd27415ef81b297c36fcdb46c608f2e240d activates strict Origin/Referer verification only for state-changing /api/* requests that carry browser provenance (Origin, Referer, or Sec-Fetch-Site), preserving provenance-free non-browser clients;
• doctoring 98e8ad5... records W3C Fetch Metadata, OWASP CSRF guidance, Barth/Jackson/Mitchell (CCS 2008), rejected alternatives, and the 🛡️ Sentinel: [HIGH] Fix CSRF origin bypass in API proxy #653 boundary.

#1706 is a 3-file delta (backend/main.py, backend/tests/test_main.py, doctoring) and its six repository-local PR workflows are admitted but currently queued. No GREEN is claimed yet.

#1361 was then forward-repaired without force/rebase: c7a26703... returns backend/main.py to protected CSRF semantics while retaining checksum registration, and b98dbf984b7128aa0412e318c7590a7eea5d9717 restores backend/tests/test_main.py to its #1623 base state. Fresh compare against #1623 now shows exactly 9 checksum-owned files; the CSRF delta is no longer duplicated there. #1361 exact head still has zero repository-local workflow receipts, so it remains Draft and is fresh stacked-admission evidence for #1691.

Keep this issue open until #1706 has terminal exact-head required checks and independent review; the owner-boundary extraction itself is complete.

[seonghobae]

Owner-separation repair is now implemented without closing this issue prematurely.

• dedicated successor security(csrf): separate browser provenance verification from checksum lane #1706 is exact b283f3bd33541cb1f7b2b8110a169c1f87636b3c on protected develop, with exactly backend/main.py, backend/tests/test_main.py, and docs/doctoring/browser-provenance-csrf-boundary.md as its effective delta;
• feat(tools): add bounded content checksum generator #1361 was ordinary/non-force forward-repaired and is now exact 5c42f5270d9424039d58f0a30ef1766b4ed22ab0 on fix(deps): patch frontend audit security floors #1623, with a pure nine-file checksum delta; backend/tests/test_main.py is no longer in its effective diff and backend/main.py retains checksum registration only;
• security(csrf): separate browser provenance verification from checksum lane #1706 has formal current-head CodeRabbit APPROVED review with zero review threads. Its six repository workflows are admitted but remain queued, so hosted executable evidence is not complete;
• feat(tools): add bounded content checksum generator #1361 remains Draft with zero repository-local workflow receipts on its stacked base and a fresh exact-head CodeRabbit review request pending.

Therefore requirements 1–3 and the single-writer separation are implemented, but requirement 5 is not terminal. Keep this issue open until #1706 receives all then-live exact-head required GREEN and normally integrates (or a verified complete successor does), after which #1361 must still preserve the separated checksum-only tree through its own normal prerequisite integration.