feat: add purpose-bound delegated review authority (ENG-CORE-DELEGATION-001B)

[ezutfen]

Identity

• packet_id: ENG-CORE-DELEGATION-001B-FIX1
• parent_packet_id: ENG-CORE-DELEGATION-001B
• expected_work_start_sha: 143acc870244fa8c6d8d9a06066599e7a77fd533
• actual_work_start_sha: 143acc870244fa8c6d8d9a06066599e7a77fd533
• final_head_sha: b1d89c9ed5c2e19746cc2e2e54c8049cd6946fe2
• synthetic_merge_ref_sha: 5d0368a91c27c2229d18397524d742091b3123ff

Change summary

This pull request adds a separate, opaque, single-use delegated-review credential domain. It supports only review.queue and review.transition. The fix commits harden five fail-closed boundaries found during review.

• Authorized revoke of a missing review external reference now returns the truthful not_found response. Its event keeps only known issuer, grant, credential, owner, and digest evidence.
• A narrow ASGI boundary authenticates and purpose-checks engdr_ attempts before FastAPI body validation. Malformed or noncanonical requests revoke the token and return the generic delegated 401 response.
• Duplicate or ambiguous Authorization headers cannot bypass the ASGI boundary. One distinct review credential is terminally denied with purpose_mismatch. Multiple distinct review credentials return the generic delegated 401 response without selecting a credential.
• Issuer-global cross-class idempotency conflicts now use attribution from the existing token. PostgreSQL rejects contradictory token event class, grant, purpose, tenant, or principal evidence.
• PostgreSQL binds delegated review item events to the token actor, target item, and target review status. Queue tokens cannot supply transition attribution.

Existing engd_ read delegation remains compatible. The change does not broaden ordinary API-key, service-client, review, read, or provisioner authority. Public review responses do not expose internal delegation attribution.

Files changed by FIX1 and the follow-up

• docs/ops/service-delegation.md
• engram/api/app.py
• engram/api/service_boundary.py
• engram/auth.py
• engram/delegation_auth.py
• engram/models.py
• migrations/030_service_review_delegation.sql
• migrations/downgrades/030_service_review_delegation.sql
• tests/test_service_review_delegation.py
• tests/test_service_review_delegation_postgres.py

Migration and downgrade evidence

• A fresh PostgreSQL database migrated cleanly through migration 030.
• The persisted 029-to-030 read-delegation upgrade and the 030-to-029-to-030 round trip passed.
• A clean 030 database can downgrade without changing persisted read-delegation data.
• A database with delegated-review authority or item-event evidence refuses downgrade atomically.
• Real owner, app, and provisioner role checks passed in Compose CI.

Local evidence

• Focused delegated-review unit suite: 26 passed.
• Focused actual-HTTP, real-PostgreSQL, and migration suite: 16 passed.
• Final make check: Ruff passed; strict mypy passed; 2,579 tests passed and 527 were skipped.
• Final clean make compose-ci: root 3,072 passed and 34 skipped; SDK 55 passed; MCP 36 passed; hooks 186 passed.
• Fresh migration, pgvector 0.8.5, application-role NOBYPASSRLS, and FORCE RLS checks passed.

Remote CI

• Exact-head run 30602961703: success. Expected and checked-out SHA: b1d89c9ed5c2e19746cc2e2e54c8049cd6946fe2.
• Merge-ref run 30602961706: success. Expected and checked-out SHA: 5d0368a91c27c2229d18397524d742091b3123ff.
• refs/pull/127/merge still resolved to 5d0368a91c27c2229d18397524d742091b3123ff after both runs completed.

Credential scan evidence

• The final local repository and diff scan found zero credential-shaped values.
• Both remote Compose scanners covered the exact source snapshot, generated JUnit artifacts, and PostgreSQL text fields.
• Both reported tracked_files=0 database_fields=0.
• No raw credential, authorization header, idempotency key, external reference, or request body enters logs or persisted evidence.

Remaining limitations

This change does not implement Portal UI, browser credential delivery, CIAM, MFA, browser-session step-up, or Portal proxy behavior. ENG-PORTAL-REVIEW-001A remains deferred. Operators must explicitly enable review delegation and configure a review broker and review grant.

Recommendation

GREEN_FOR_REVIEW. Keep this pull request draft, open, and unmerged for reviewer reassessment.