feat(integration): persist plugin delivery-origin grants

[seonghobae]

Scope

Canonical successor to #221, stacked on current #205. This advances #130 with the Integration-owned PostgreSQL delivery-origin grant store and normalized 3NF schema. It still performs no outbound HTTP and does not claim SSRF-safe network delivery is complete.

Current non-force ancestry

Parent #205 is now 3a0050225669d1ab263e7a093f6acf08385653ba, itself an ahead-only descendant of protected main@193a87ef54c3fe6dcda4755bce4d6bc81e3a0297. Current exact child is ff9dc40b67988e2af2d547c13b225aad9ec5e7f7, a non-force two-parent descendant of prior #235 head 62b83dda7f929bb5f0bfc0c9e27a67ed81554d02 and current #205.

Fresh compare from the current parent is ahead-only (behind_by=0) and still exactly eight Integration-owned persistence/migration/test paths. Parent authority and the merged #218 runner/control-plane foundation are inherited by ancestry rather than copied into the child delta. No predecessor checks/reviews transfer after this head move.

The preserved RED→repair lineage still culminates in RED 02c183b882ab70cc5e8c779a8714e8c6cc583992 → repair 62b83dda7f929bb5f0bfc0c9e27a67ed81554d02: migration 0004 rechecks exact active installation/workspace/user authority and takes FOR SHARE before admitting a delivery-origin grant, closing the installation-revocation TOCTOU window. The disposable-PostgreSQL contract remains required execution evidence rather than a fabricated GREEN claim.

The durable row contains origin authority plus opaque grant/installation/workspace/user identity only. DNS/IP rebinding resistance, connect-time address enforcement, redirect/proxy policy, bounded response bytes/timeouts, secret/KMS composition, signing/idempotency, durable outcomes/retry/dead-letter and operator recovery remain later #130 slices.

Keep Draft until #205 integrates normally, then retarget/restack non-destructively and reacquire exact-head repository/security/PostgreSQL/review evidence. No self-approval, bypass, force-push, destructive rebase or predecessor evidence reuse.

Refs #130, #205, #221.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}