[LIghtJUNction]

Scope

Refs #76. This is a verified authorization increment, not automatic closure of every umbrella acceptance requirement and not production deployment.

Existing main already contains the shared shareability/ShareGrant hardening from earlier integration. The final six-file diff against main 13c562ea05d273e618b1ea06b9e452da79d4439f contains:

• security/authorization.py: check Topic bans on every ancestor, rather than stopping at the nearest Topic.
• storage/sqlite.py (shared session implementation used by the database adapters): require a currently active Organization and matching active membership subject/org identities. Archived/missing groups and mismatched restored membership bodies cannot confer group authority. Independent valid user grants remain alternatives.
• Three new regression files and docs/AUTHORIZATION_SOURCES.md: nine-source transport/CLI matrix, stale organization and constrained ShareGrant sources, protected previews, ancestor bans, attachment boundaries, concurrent revoke/read, ShareLink body-only transport and actual PostgreSQL backup/restore.

ShareGrant@2 stays read-only with empty constraints; unknown stored operations/constraints fail closed. No new capability, signed CA ceiling expansion, alternative escrow implementation or production permission changes.

Exact-head verification, refreshed 2026-09-28

Head: 6924cd4bc9de784185ea75cb341d07ec5fe58ef2.
Tree: 24010db7aecdf85b1303a029e431fc456121a985.
Integrated base: 13c562ea05d273e618b1ea06b9e452da79d4439f.
Full existing Rewrite contracts CI 36386876605: completed/success on this exact head. The workflow and shard evidence verifier are unchanged by this PR. Prior local PostgreSQL 14/Python 3.13 evidence is supplemental, not a replacement for target CI.

This audit read all six final file diffs, including both production changes and all three added test files. There are no unresolved review threads. Copilot did not complete an external review because of quota; that is not represented as an approval. No new source edits or local full-suite rerun were performed by this audit.

Merge and follow-up boundaries

Use squash merge with the expected head SHA so transient branch publication history is not added to main. Read back the resulting main commit/tree and CI state. Keep #76 open until its remaining acceptance matrix is individually reconciled; source checks and complete CI do not establish production/whole-design acceptance.

Parallel #112 must preserve this Authorizer and integrate quarantine without weakening current-source revocation. Its restored read expectations will need joint testing: the new quarantine intentionally blocks business reads, whereas these tests currently exercise authorized minimal projections of an isolated restored service. Retain both quarantine denial and underlying authorization/field-privacy evidence rather than deleting either test family or bypassing the recovery gate.

No production data, Root key, PIN, database restoration, real outbound mail or deployment was used or changed. Latest issue status and parallel ownership: #83.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-27T20:54:06.401333Z	e9416c7	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[LIghtJUNction]

Conflict resolution complete. Current main/#111 authorization code is retained for the overlapping Authorizer/share-policy implementation because it is the newer superset. #105's independent authorization matrix, recovery-boundary tests, docs and SQLite test support remain on the branch. This avoids reverting share_target_error, current organization checks and bounded parent-grant validation.