fix(security): fail closed on tenant-scoped job ID lookup

[seonghobae]

Objective

Close the remaining tenant-scoped identifier lookup blind spot directly after #342 without moving its verified exact head. The repository contract currently implements findByTenantAndId(...) as a global findById(...) followed by an in-process ownership filter, which is unsafe as the default contract for future durable adapters and undermines storage-boundary tenant isolation.

Test-first state

This Draft starts intentionally RED at exact test-only head a28d936195b40b1442d7ebeae5f4c86657c01bcd. The focused regression requires the interface default to fail closed without invoking global findById, and requires the process-local adapter to resolve tenant ownership directly from its scoped storage boundary while rejecting missing tenant/job authority and concealing foreign jobs.

Stack and scope

This PR is deliberately stacked on #342 exact head 4eeba73d70db172e44062891c01273efc4109d93 because both slices own ConversionJobRepository and InMemoryConversionJobRepository. It does not move #342, edit AdminController, overlap the active Jules admin PR, change content-hash demo compatibility, implement durable persistence, or claim issue #326/#312/#263 completion.

Acceptance

Observe exact-head RED -> smallest fail-closed contract and in-memory override -> exact-head Maven verification with repository coverage/Javadoc gates -> applicable CI/security/fuzz evidence -> current review/thread/base refetch. Keep Draft while #342 remains open; after #342 integrates, reconcile this unique delta onto the new protected main and regenerate base-sensitive evidence before final merge. Independent write-authorized approval remains a separate protected-merge gate.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fa165fe8-157e-4c96-a68f-704cf7b2815d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}