fix(migration): bind grants to canonical upload pairs

Draft
KH
13d ago
+1871-988

Stacked corrective follow-up on draft #110. Base: feat/migration-assertion. This PR is one amendment commit and must land after #110.

Security and integration:

  • Stores a canonical contract-v1 plan and exact sorted source-user/workspace pairs.
  • Normalizes one relay_ prefix and derives signed meta.upload entirely from stored grant data.
  • Rejects cross-pair/key/content/identity and persisted-plan tampering.
  • Exports canonicalMigrationJson, normalizeMigrationGrantPairs, and verifyStoredMigrationGrantPlan from storage/interface and the package root.
  • Caps plan_json + allowed_pairs_json at 1,000,000 UTF-8 bytes; the shared #43 fixture is 1,695 bytes.
  • Caps grants at 64 distinct users, bounding alias-safe Cloud identity checks at 128 Durable Object subrequests.
  • Keeps issuance default-off and revoke callable while disabled.
  • Documents grant versus key revocation timing, the required Cloud binding deploy, workspace-membership trust, and nonblocking core/Go rollout.
  • Removes packages/types/tsconfig.tsbuildinfo from the diff.

Regression evidence:

  • Exact #43 digest/content/entry vectors.
  • Cross-pair, plan/key/content, expiry/no-refresh, canonical alias, storage-tamper negatives.
  • Restored not-human, org-mismatch, not-found, ambiguous-user, and revoked-key negatives.
  • SQLite revoke and audit failure rolls back both changes.
  • Public source and built-package export probes.

Validation at 2adf414a7767d8cc3e268c6a4bb790d27447e9e4:

  • focused 41/41
  • server 727/727
  • SDK 170/170
  • CLI 12/12
  • root standalone 8/8
  • typecheck 11/11
  • build 9/9
  • Helm default/enabled renders and diff check passed

Hosted Actions only target PRs based on main, so none are scheduled for this deliberately stacked PR. The concurrent root fanout encountered host EDQUOT in CLI temp writes; the same affected suites pass serially under /dev/shm. No live keys, deploys, grants, or migrations were performed.

Agent Relay sessions

  • codex session 01a18c1c · opened via gh pr create · last active 2026-10-30