fix(security): action-item containment (review findings) + ops-hygiene sweep

[bejranonda]

Summary

Two workstreams, one honest PR:

Security fixes (independent adversarial review, 2026-07-10):

• Finding 1 (critical, confirmed): action_item rows could be promoted to org visibility (no type guard) and the Oracle task block queried with org-wide accessibleProjectIds → any project member could broadcast meeting content (assignee email, task text) into every other project's Oracle. Fixed with defense in depth: promote and fork now 422 on action_item; accessibleProjectIds removed from the entire task-query path (baseWhere hard-bounds to the active project); regression test pins that an org-visible foreign action item never appears in listings nor can be resolved cross-project.
• Finding 2 (important): cross-user prompt injection — task text authored by member A lands in member B's agent context primed as actionable. Mitigation: the injection block now carries explicit untrusted-content framing; stronger stances (assignee confirmation) documented as the revisit trigger.
• Review also confirmed as safe: cross-org isolation of buildKnowledgeWhereV2, parameterized tag queries (no SQLi), resolve containment, RULE_TYPES_PREDICATE coverage.

Ops hygiene:

• First backup restore drill passed (isolated pgvector container, 0 errors, 228/228 embeddings) — procedure now in DEPLOY_CHECKLIST §Backups
• KNOWN_ISSUES §0m: drill result, KEA meta-noise prune (3 rows, carve-out-compliant), self-referential-gate-window caveat for the 07-17 reading
• GUIDELINES §11 + KNOWLEDGE: non-rule sweep now includes the visibility-travel paths (the generalized lesson from finding 1)

No Prisma migrations.

Test plan

• ✅ Reviewer claims verified against code before fixing (promote/fork guard absence, oracle call site)
• ✅ New db-guarded regression tests: org-visible foreign action item invisible to both listings and resolve; untrusted-framing line present
• ✅ Restore drill + prune executed and verified live (documented in KNOWN_ISSUES §0m)
• ⬜ CI green (relying on CI for typecheck/test/build)

🤖 Generated with Claude Code

https://claude.ai/code/session_01KfujUMcYWzRkwHmG8RYTDM

Summary by CodeRabbit

• Bug Fixes

  • Action items are now strictly limited to their originating project and cannot be promoted or forked across project boundaries.
  • Organization-wide task visibility no longer exposes project-specific action items.
  • Action-item content is clearly framed as user-authored work data, reducing the risk of treating it as executable instructions.

• Documentation

  • Added guidance for action-item isolation and visibility rules.
  • Expanded deployment documentation with backup restore-drill procedures and validation steps.
  • Documented recent security and operational improvements.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 4b03e50a-0af7-489f-bdee-f673cbd40667

📥 Commits

Reviewing files that changed from the base of the PR and between 2c09f7d and 6000d09.

📒 Files selected for processing (9)

• apps/web/app/api/knowledge/[id]/fork-to-project/route.ts
• apps/web/app/api/knowledge/[id]/promote/route.ts
• docs/DEPLOY_CHECKLIST.md
• docs/GUIDELINES.md
• docs/KNOWLEDGE.md
• docs/KNOWN_ISSUES.md
• packages/core/src/__tests__/action-items.test.ts
• packages/core/src/action-items.ts
• packages/core/src/oracle.ts

---

📝 Walkthrough

Walkthrough

Action items are now project-bound across query, Oracle, promotion, and fork flows. Their injected text receives untrusted-content framing. Tests and documentation cover containment, while deployment documentation adds a PostgreSQL restore drill.

Changes

Action-item containment

Layer / File(s)	Summary
Project-scoped action-item queries packages/core/src/action-items.ts	Action-item listing and resolution no longer accept accessible project IDs, always use project-only filtering, and add untrusted-content framing to injection output.
Project-scoped Oracle task context packages/core/src/oracle.ts	OPEN TASKS retrieval no longer passes organization visibility project IDs.
Visibility transition guards apps/web/app/api/knowledge/[id]/promote/route.ts, apps/web/app/api/knowledge/[id]/fork-to-project/route.ts	Promotion and fork-to-project requests reject action_item rows with HTTP 422.
Containment validation and contracts packages/core/src/__tests__/action-items.test.ts, docs/GUIDELINES.md, docs/KNOWLEDGE.md	Tests cover foreign-project isolation and injection framing; documentation specifies project-only action-item containment.
Operational record docs/KNOWN_ISSUES.md	The ops-hygiene catalog records the containment and prompt-injection fixes alongside operational follow-up items.

Backup restore operations

Layer / File(s)	Summary
Backup restore drill docs/DEPLOY_CHECKLIST.md	The deploy checklist adds an isolated pgvector restore procedure with SQL error and embedding-count checks, cleanup steps, and an image requirement.

Estimated code review effort: 3 (Moderate) | ~25 minutes

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/ops-hygiene-sweep

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}