feat: revoke tenant-safe credential references

[seonghobae]

Summary

• add an idempotent credential revocation command bound to tenant, learner, registration, decision, and credential identity
• return the persisted lifecycle state and revoked_at; repeated revocation returns the same revoked projection
• extend the real PostgreSQL/API quality smoke path with revoke, retry, and cross-tenant assertions
• document the credential lifecycle and next product gap

Buyer-visible outcome

A tenant can retire a previously issued credential reference without mutating the completion decision or copying the external Open Badges/CLR payload. The learner, registration, decision, and credential boundaries remain explicit and tenant-safe.

Evidence

• actionlint .github/workflows/quality.yml
• cargo +1.97.1 fmt --all -- --check
• cargo +1.97.1 test --workspace --all-targets --locked (6 passed)
• cargo +1.97.1 clippy --workspace --all-targets --locked -- -D warnings
• RUSTDOCFLAGS='-D warnings' cargo +1.97.1 doc --workspace --no-deps --locked
• cargo +1.97.1 build --bin lms_api --locked
• fresh real PostgreSQL 18.4/API smoke with a NOSUPERUSER NOBYPASSRLS role: credential issue returned issued; revoke returned revoked with revoked_at; repeated revoke returned HTTP 200; cross-tenant revoke returned HTTP 400
• fixed the CI row assertions to pass app.tenant_id through PGOPTIONS under forced RLS, so current-head database counts are tenant-visible rather than false zeroes
• disposable migration rollback/reapply smoke: 15 policies before, 0 kernel tables after rollback, 15 policies after reapply
• current-head GitHub workflows are queued: Quality 32440646796, SAST 32440646759, Security 32440646749, OpenCode 32440645089, Noema 32440645057, Strix 32440645073, scheduler 32440645064, Close Empty PR 32440645068

Scope boundary

The external credential authority remains responsible for the portable credential payload and external distribution. Open Badges/CLR conformance, released external contracts, assessment execution, browser E2E, audit/outbox, and production coverage/load evidence remain explicit gaps.

Merge gate

This PR is stacked on PR #9. Please review exact current head cb3ed30d09e967d662095107a685c79baad02c62 against base f22806a539a9e6fe3f1943013dd74f14e648ffdb. Do not treat local or green CI checks as semantic approval.

---

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d90f0eb6-df97-45a1-a0ca-045e3910faab

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head review request for af03805: credential revocation is tenant/learner/registration/decision/credential bound, persists revoked_at, and is idempotent for retries. Local Rust checks, actionlint, and real PostgreSQL 18.4 issue/revoke/cross-tenant evidence passed. Please independently review this exact head and rerun required checks; no approval or protected merge bypass is requested.

[seonghobae]

Current-head review request for 230fde8. Re-verify the exact-head diff, required Checks, tenant/security boundaries, and any valid review findings after the shared Rust component-install fix. COMMENT only; no approval or protected-merge bypass is requested.

[seonghobae]

Current-head review request for cb3ed30d09e967d662095107a685c79baad02c62 against base f22806a539a9e6fe3f1943013dd74f14e648ffdb. The stack was reconciled with current PR9. Local pinned Rust checks, build, and actionlint passed. Real PostgreSQL/API smoke with a NOSUPERUSER NOBYPASSRLS role returned issued -> revoked with revoked_at, retry HTTP 200, and cross-tenant HTTP 400. I also fixed the workflow's forced-RLS row assertions to set app.tenant_id through PGOPTIONS; current-head checks are queued. Please independently re-check lifecycle idempotence, immutable completion decision boundaries, tenant isolation, retry semantics, rollback ordering, and the tenant-context CI assertions. COMMENT only; no approval or protected-merge bypass is requested.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.