feat: add delegated-request response boundary (ENG-CORE-DELEGATED-BOUNDARY-001A)

[ezutfen]

Summary and exact scope

Adds one credential-aware sensitive-response middleware for any HTTP request presenting a Bearer credential with the reserved engd_ prefix. No route, scope, schema, migration, token grammar, or /v1/items implementation changed.

Original hosted-consumer blocker

Delegated credentials already authenticated on ordinary read routes, but the service-path-only middleware did not add the hosted privacy and correlation headers to GET /v1/items.

Work-start and final SHAs

• Expected work-start: 6109f7d45afdd6d9d36f8448b7bcd0a16a526ccd
• Actual work-start: 6109f7d45afdd6d9d36f8448b7bcd0a16a526ccd
• Intervening commits: none
• Branch head: 0fde2d130af7e0d056a67a9d0bfb7b8cf8afcdc7
• Synthetic merge-ref: 6ed3b516975a628030ebeac778f6bea219972fbb

Delegated-request classification

Classification reads raw ASGI authorization headers before authentication, recognizes case-insensitive Bearer plus exact engd_, retains no credential, does not authenticate or consume, and scans duplicates so any delegated attempt receives the boundary while authentication rejects duplicate headers.

Response-header contract

Every classified delegated success or failure receives exactly:

• Cache-Control: no-store
• Pragma: no-cache
• Referrer-Policy: no-referrer
• X-Request-ID: <validated caller ID or generated UUID>

Request-ID correlation

The middleware establishes one effective visible-ASCII request ID before authentication. Delegated consumption/denial evidence and the final response use that state value. Invalid IDs are replaced once and never echoed.

Unhandled-failure behavior

Unexpected delegated-route exceptions become a generic 503 with DELEGATED_REQUEST_UNAVAILABLE / Request unavailable, the four boundary headers, and no exception detail.

Service-route compatibility

The existing /v1/service/* headers, validation sanitization, and generic provisioning failure body remain unchanged through compatibility aliases and service-specific exception handling.

Ordinary API-key compatibility

Ordinary eng_, unauthenticated health/readiness, route bodies, and statuses are unchanged and do not receive the new private headers.

Single-use regression evidence

Real-PostgreSQL coverage verifies routing does not consume, successful ordinary reads consume exactly once, replay remains denied, validation/scope paths preserve the existing consumption semantics, and response handling does not reactivate a token.

PostgreSQL audit-correlation evidence

tests/test_service_delegation_postgres.py::test_delegated_http_boundary_and_audit_request_id_correlation passed locally, at exact head, and at merge-ref with zero skips. It covers success, invalid generated ID, invalid secret, expired, used, revoked, authority-invalidated, scope, routing, and validation evidence correlation.

Portal consumer proof

Ran the stopped Portal prototype from a disposable snapshot against Core 0fde2d130af7e0d056a67a9d0bfb7b8cf8afcdc7; the original Portal worktree was not modified. The whoami certification passed (1 passed). A live delegated inventory response passed the exact four-header boundary and echoed its supplied request ID, satisfying this Core prerequisite. ENG-PORTAL-MEMORY-001A still needs a Portal-side response-schema correction because its strict response validator rejects Core's unchanged existing generated content_tsv response field. Changing Portal or the /v1/items response body is outside this Core packet.

Local validation totals

• make compose-ci: Core 3,028 passed / 34 expected skips; SDK 55 passed; MCP 36 passed; hooks 186 passed; all Compose-backed checks passed.
• Focused auth/boundary suite: 68 passed.
• Ruff lint: passed.
• Strict MyPy over 70 source files: passed.
• Real-PostgreSQL delegated audit proof: 1 passed, 0 skipped.
• Core credential leak scan: tracked_files=0 database_fields=0.

Exact branch-head CI evidence

Exact PR Head CI run 30448986170 passed against exact head 0fde2d130af7e0d056a67a9d0bfb7b8cf8afcdc7.

JUnit: 3,339 collected; 3,305 passed; 34 expected skipped; 0 failures; 0 errors. The 54 delegated-boundary/delegation-PostgreSQL cases had 0 skips.

Separate synthetic merge-ref CI evidence

CI merge-ref run 30448986172 passed against synthetic merge SHA 6ed3b516975a628030ebeac778f6bea219972fbb.

JUnit: 3,339 collected; 3,305 passed; 34 expected skipped; 0 failures; 0 errors. The 54 delegated-boundary/delegation-PostgreSQL cases had 0 skips. Runtime-image smoke, lock drift, deployment Compose validation, and conformance vectors also passed.

Secret and artifact-scan evidence

Credential leak scanning passed locally, at exact head, and at merge-ref. GitHub-reported artifact digests:

• junit-exact-head-30448986170-1: sha256:2e97382f5c9e1315bae657e1391cf6c7692629968db8c8cd1a80a5ea23a89a36
• Zutfen-LLC~engram~UBF69X.dockerbuild: sha256:e158edb686fa95ebac17c7afd4c64959bd4046c8ffe89e805ff6ca4668055e20
• junit-merge-ref-30448986172-1: sha256:372163d62e6945a3ba035d3840f3a17cbf4db3833a317c59ab99ed4f7dbf8f38
• Zutfen-LLC~engram~QFH8H6.dockerbuild: sha256:e487e4860f4d00d3a9eccf8abeeb31a6523f266cca49f95e57ab936eb7a5dda6
• Zutfen-LLC~engram~RJYT3B.dockerbuild: sha256:06b9e9bc944701d5d03ff0a6c6187ff11c2ea5722e00c3b95f63e072530077d3

Disposable Portal proof credentials, keys, databases, volumes, containers, artifacts, and snapshot were destroyed after testing.

Explicit non-goals

No Portal modification; no memory-inventory implementation; no new route; no schema/migration; no scope, token grammar, TTL, audience, binding, replay, revocation, or issuance changes; no generic proxy or browser token delivery; no retries; no service credentials on ordinary routes; no delegated credentials on service routes.

Final recommendation is GO for this Core prerequisite. ENG-PORTAL-MEMORY-001A still requires the separate Portal-side response-schema correction noted above.