feat(access): persist attachment-view grants in SQLite

[seonghobae]

Buyer and security impact

This bounded stacked #413 slice turns the framework-neutral access-grant domain in #506 into durable, restart-safe SQLite state suitable for later attachment-view and stream runtime migrations. It does not change URL transports by itself and therefore does not close #413.

Exact current stack and scope

• current parent: feat/access-grant-domain-413@f3ae1f1f4ee66024776507d75f8fb752b2bf748c (feat(access): add short-lived opaque grant domain #506);
• exact contributor head: e1206cedf482df4626cc7b84d5ad7800147b28e6;
• exact contributor tree: 0ee0c8e9ed10072c5925250b79e6c24ffbafc85a;
• fresh parent→child ancestry: ahead, 55 commits ahead, 0 behind;
• fresh semantic delta: exactly nine SQLite-persistence/evidence paths:
  • CHANGELOG.md;
  • docs/doctoring/sqlite-access-grant-persistence.md;
  • package.json;
  • server/access_grant_sqlite.mjs;
  • server/db.mjs;
  • tests/unit/access-grant-audit-outbox.test.mjs;
  • tests/unit/access-grant-sqlite-edge.test.mjs;
  • tests/unit/access-grant-sqlite.test.mjs;
  • tests/unit/coverage-script-contract.test.mjs.

The parent’s current access-grant hardening, Playwright lock update, documentation, tests, and all protected-develop behavior are preserved outside those nine paths.

Reconciliation repair

Fresh state showed this child had diverged from live parent #506 and was 11 parent commits behind. A first non-destructive two-parent reconciliation commit (4f472291...) fixed ancestry but reused the stale child tree. Once the live parent became the merge base, that exposed four unintended parent regressions in docs/doctoring/short-lived-access-grant-domain.md, package-lock.json, server/access_grant_domain.mjs, and tests/unit/access-grant-domain-edge.test.mjs; the resulting Server Tests run failed. That intermediate head is defective evidence and must never be reused.

The causal repair at e1206ced... rebuilds the child tree from exact current parent tree 426141d10f01bc028b22423ef52a0a70e0358510 and overlays only the nine child-owned blobs. Fresh comparison now proves ahead-only/zero-behind ancestry and exactly the intended nine-file semantic delta, with no deletion or weakening of the parent’s access-grant authority snapshot, edge tests, package lock, or doctoring contract.

Durable adapter contract

• installs access_grants and the immutable audit outbox only during database bootstrap, never during a request;
• stores only SHA-256 token hashes and bounded non-secret metadata; no plaintext grant secret column exists;
• uses descriptive multiword snake_case schema objects and normalized relations;
• binds subject/project/attachment lifecycle through foreign keys;
• performs tenant-nondisclosing project and ready-attachment authorization before mint;
• represents membership authority as bounded membership_id:token_version state;
• consumes one-time grants with one conditional SQLite update binding hash, purpose, audience, project, optional attachment, expiry, revocation/use state, and exact live membership version;
• couples successful mint/consume transitions to secret-free audit evidence under the same savepoint so audit persistence failure rolls back the usable-grant transition;
• preserves historical audit evidence after subject/project/attachment deletion; and
• keeps the domain port independent of SQLite so a future PostgreSQL adapter can run the same behavioral contract.

TDD and verification boundary

The original persistence regression imported an intentionally absent server/access_grant_sqlite.mjs and failed RED with ERR_MODULE_NOT_FOUND before implementation. Focused tests cover replay, wrong-resource non-consumption, cross-tenant isolation, attachment readiness, session/membership invalidation, membership removal/re-add, resource deletion, stream grants, restart durability, bootstrap idempotence, schema/FK constraints, adapter failures, transactional audit rollback, historical evidence retention, and c8 registration.

After the reconciliation repair, all predecessor-head checks and reviews are historical. Exact-head workflows for e1206ced... have been freshly created and are non-passing until terminal; central SAST/Security results remain subject to the organization-owned exact-head evidence repair in .github#1222. No predecessor, synthetic, queued, skipped, absent, status-only, model-only, or author-only evidence is merge authority.

Standards, rollback, and integration boundary

docs/doctoring/sqlite-access-grant-persistence.md records active-PR versus protected-shipped truth, state and transaction models, tenant boundaries, 3NF/naming decisions, rollback, TDD evidence, and APA 7 references to RFC 6750, RFC 9700/BCP 240, and current SQLite foreign-key/isolation/transaction documentation.

Rollback removes the adapter, bootstrap call, focused tests, coverage registrations, doctoring record, and SQLite-specific changelog entries together. It must not delete production data without a separately reviewed migration/recovery decision.

This PR does not close #413 or #433. Authenticated exchange routes, browser/runtime migrations, revocation hooks, PostgreSQL parity, calendar-subscription lifecycle, UI flows, and eventual rejection of general session JWT query transport remain separate bounded work.

Merge gate

Keep this PR Draft until the unchanged exact head has terminal exact-head CI/browser/owned-coverage/docstring/security/dependency/supply-chain evidence, zero valid unresolved findings, and the required qualifying independent approval. Do not integrate independently of #506. After #506 reaches protected develop, reconcile this bounded semantic diff onto the resulting protected head and regenerate all then-applicable evidence.

Refs #413 and #433

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 29ed520c-c262-4e44-a9f7-d176b60a6cb6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 2 new potential issues.

[seonghobae]

Admission-state correction for exact head 98fd12d145292ed198fde111bd02690c3e18ecbf.

Finding: no current APPROVED review.

This PR is being moved from Ready to Draft/Proposed. It remains open and its commits, reviews, threads, and valid delta are preserved. Return it to Ready only after the causal blocker is repaired and the unchanged or non-force-reconciled exact head has fresh terminal Checks, zero substantive unresolved findings, and any then-required current-head/latest-push independent approval.

No bypass, synthetic status or approval, manual rerun, Force Push, review dismissal, or Close is used.