chore(review): track prompt inbox identity foundation chain

DOCS.md

@@ -225,6 +225,16 @@ Engram exposes two different runtimes. Keep routes split by runtime:
 - **Cloud runtime (`engram cloud serve`)**
   - `GET /health` (cloud service health)
   - `GET /sync/pull`, `GET /sync/pull/{chunkID}`, `POST /sync/push`, `POST /sync/mutations/push`, `GET /sync/mutations/pull` (cloud sync transport)
+  - `POST /sync/session-authorities` registers a session explicitly with JSON `session_id` and owner `project`.
+    Managed principals need a project grant; legacy authenticated tokens use the configured allowlist.
+    Grant normalization does not change the stored owner: a grant for `alpha-foo` can authorize `alpha/foo`, whose owner remains `alpha/foo`.
+    In insecure no-auth mode registration returns 401 without writing; oversized JSON returns 413.
+    Chunks and imported sessions never bootstrap registration: an imported/offline session needs deliberate reauthorization.
+    Matching owner replay returns 200; conflicting owner returns 409. Registration alone does not authorize prompt claims or deletes.
+  - `POST /sync/prompt-pair-claims` requires a bearer token and JSON `session_id`, `source_inbox_id`, `sync_id`, `owner_project`, and `project` (prompt storage project).
+    `owner_project` is an authorization selector, **not** authority: the server checks grants/legacy allowlist for both projects before looking up the independently registered session, then requires its stored owner to match the selector. Grant aliases do not rewrite stored project identity.
+    Missing registration, owner mismatch, and authority disappearance during claim all return the same generic 404 JSON body with `error_code: session_authority_unavailable`; an absent old-server route returns a 404 without that code. Matching claim replay returns 200, competing pair binding 409. Invalid JSON/unknown fields return 400, oversized bodies 413, and insecure no-auth mode 401.
+    `MutationTransport.RegisterSessionAuthority` and `ClaimPromptPair` can POST these JSON requests over the configured transport; non-200 responses are errors, with an absent old-server route classified as `server_unsupported`. Autosync does not invoke these methods yet. Clients must explicitly register the session under its owner and claim the pair under dual authorization before relying on remote pair provenance. Delete enforcement and the client handshake/pending retry path are not implemented yet; this route alone does not make unverified deletes safe.
   - `GET /dashboard/*` HTML routes (browser dashboard)
 
 Dashboard route tree (`engram cloud serve`):
@@ -780,7 +790,7 @@ Cloud server startup fails closed when the token is missing unless `ENGRAM_CLOUD
 Cloud server always requires `ENGRAM_CLOUD_ALLOWED_PROJECTS` (comma-separated), including insecure mode, so project scope remains server-enforced.
 `ENGRAM_CLOUD_TOKEN` + `ENGRAM_CLOUD_ALLOWED_PROJECTS` are server-side requirements for authenticated mode and must be configured before `engram cloud serve` (or compose startup).
 Authenticated mode also requires an explicit non-default `ENGRAM_JWT_SECRET`; implicit development defaults are rejected.
-Dashboard requests support browser login in authenticated mode: use `/dashboard/login` to exchange the bearer token for an HttpOnly dashboard cookie scoped to `/dashboard`. Protected `/dashboard/*` HTML routes require that cookie and do **not** treat raw `Authorization: Bearer ...` headers as an authenticated browser session. Sync API routes (`/sync/pull`, `/sync/pull/{chunkID}`, `/sync/push`, `/sync/mutations/push`, `/sync/mutations/pull`) remain header-auth only. For cloud authenticated sync and admin requests, the Authorization parser trims outer whitespace and requires exactly two whitespace-delimited fields: a case-insensitive `Bearer` scheme and one credential. Tabs or multiple spaces between fields are accepted; whitespace embedded in the credential and a scheme glued to the credential are rejected. This describes field separation, not an RFC credential-character grammar; it does not describe the local `ENGRAM_HTTP_TOKEN` parser. In insecure mode (`ENGRAM_CLOUD_INSECURE_NO_AUTH=1` + no `ENGRAM_CLOUD_TOKEN`), dashboard auth is bypassed and `/dashboard/login` redirects to `/dashboard/`.
+Dashboard requests support browser login in authenticated mode: use `/dashboard/login` to exchange the bearer token for an HttpOnly dashboard cookie scoped to `/dashboard`. Protected `/dashboard/*` HTML routes require that cookie and do **not** treat raw `Authorization: Bearer ...` headers as an authenticated browser session. Sync API routes (`/sync/pull`, `/sync/pull/{chunkID}`, `/sync/push`, `/sync/mutations/push`, `/sync/mutations/pull`, `/sync/session-authorities`, `/sync/prompt-pair-claims`) remain header-auth only. For cloud authenticated sync and admin requests, the Authorization parser trims outer whitespace and requires exactly two whitespace-delimited fields: a case-insensitive `Bearer` scheme and one credential. Tabs or multiple spaces between fields are accepted; whitespace embedded in the credential and a scheme glued to the credential are rejected. This describes field separation, not an RFC credential-character grammar; it does not describe the local `ENGRAM_HTTP_TOKEN` parser. In insecure mode (`ENGRAM_CLOUD_INSECURE_NO_AUTH=1` + no `ENGRAM_CLOUD_TOKEN`), dashboard auth is bypassed and `/dashboard/login` redirects to `/dashboard/`.
 
 `ENGRAM_CLOUD_ADMIN` is optional in authenticated mode. Its sessions can access the existing dashboard admin read surfaces, project sync controls, and audit logs, but managed-user, token, and project-grant mutations require a managed admin token.
 `ENGRAM_CLOUD_ADMIN` is rejected in insecure mode (`ENGRAM_CLOUD_INSECURE_NO_AUTH=1`) to avoid an incoherent admin/browser auth path.

cmd/engram/autosync_e2e_test.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/http/httptest"
+	"reflect"
 	"sync"
 	"sync/atomic"
 	"testing"
@@ -18,6 +19,49 @@ import (
 	_ "modernc.org/sqlite"
 )
 
+func TestMutationTransportAdapterForwardsPromptAuthority(t *testing.T) {
+	var paths []string
+	var bodies []map[string]string
+	srv := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.TLS == nil || r.Method != http.MethodPost || r.Header.Get("Authorization") != "Bearer test-token" {
+			t.Errorf("unexpected request security or method: TLS=%v method=%s auth=%q", r.TLS != nil, r.Method, r.Header.Get("Authorization"))
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		var body map[string]string
+		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+			t.Errorf("decode request: %v", err)
+			http.Error(w, "invalid request", http.StatusBadRequest)
+			return
+		}
+		paths = append(paths, r.URL.Path)
+		bodies = append(bodies, body)
+		_ = json.NewEncoder(w).Encode(map[string]string{"status": "ok"})
+	}))
+	defer srv.Close()
+	trustTLSServer(t, srv)
+
+	mt, err := remote.NewMutationTransport(srv.URL, "test-token")
+	if err != nil {
+		t.Fatal(err)
+	}
+	adapter := &mutationTransportAdapter{remote: mt}
+	if err := adapter.RegisterSessionAuthority("session-1", "alpha"); err != nil {
+		t.Fatal(err)
+	}
+	if err := adapter.ClaimPromptPair("session-1", "inbox-2", "sync-3", "alpha", "beta"); err != nil {
+		t.Fatal(err)
+	}
+	wantPaths := []string{"/sync/session-authorities", "/sync/prompt-pair-claims"}
+	wantBodies := []map[string]string{
+		{"session_id": "session-1", "project": "alpha"},
+		{"session_id": "session-1", "source_inbox_id": "inbox-2", "sync_id": "sync-3", "owner_project": "alpha", "project": "beta"},
+	}
+	if !reflect.DeepEqual(paths, wantPaths) || !reflect.DeepEqual(bodies, wantBodies) {
+		t.Fatalf("requests: paths=%v bodies=%v; want paths=%v bodies=%v", paths, bodies, wantPaths, wantBodies)
+	}
+}
+
 // ─── E2E Round-trip test (REQ-212) ───────────────────────────────────────────
 
 // TestAutosyncPushPullRoundTrip tests the full push/pull cycle using a real
@@ -305,6 +349,33 @@ func (s *autosyncFakeStore) ListPendingSyncMutations(_ string, limit int) ([]sto
 	return result, nil
 }
 
+func (s *autosyncFakeStore) MaxPendingSyncMutationSeq(string) (int64, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	var max int64
+	for _, mutation := range s.mutations {
+		max = mutation.seq
+	}
+	return max, nil
+}
+
+func (s *autosyncFakeStore) ListPendingSyncMutationsAfterSeq(target string, after int64, limit int) ([]store.SyncMutation, error) {
+	pending, err := s.ListPendingSyncMutations(target, len(s.mutations))
+	if err != nil {
+		return nil, err
+	}
+	var page []store.SyncMutation
+	for _, mutation := range pending {
+		if mutation.Seq > after {
+			page = append(page, mutation)
+			if len(page) == limit {
+				break
+			}
+		}
+	}
+	return page, nil
+}
+
 func (s *autosyncFakeStore) CountPendingNonEnrolledSyncMutations(_ string) ([]store.PendingSyncMutationProjectCount, error) {
 	return nil, nil
 }

cmd/engram/cloud.go

@@ -222,12 +222,12 @@ var runUpgradeRemirror = func(s *store.Store, project string, cc *cloudconfig.Co
 func cmdCloud(cfg store.Config) {
 	if len(os.Args) < 3 {
 		fmt.Fprintln(os.Stderr, "usage: engram cloud <subcommand> [options]")
-		fmt.Fprintln(os.Stderr, "supported subcommands: status, enroll, unenroll, config, serve, upgrade, repair, bootstrap")
+		fmt.Fprintln(os.Stderr, "supported subcommands: status, enroll, unenroll, config, serve, upgrade, repair, bootstrap, attest-prompt-source")
 		exitFunc(1)
 	}
 	if os.Args[2] == "--help" || os.Args[2] == "-h" || os.Args[2] == "help" {
 		fmt.Println("usage: engram cloud <subcommand> [options]")
-		fmt.Println("supported subcommands: status, enroll, unenroll, config, serve, upgrade, repair, bootstrap")
+		fmt.Println("supported subcommands: status, enroll, unenroll, config, serve, upgrade, repair, bootstrap, attest-prompt-source")
 		return
 	}
 
@@ -248,9 +248,11 @@ func cmdCloud(cfg store.Config) {
 		cmdCloudRepair()
 	case "bootstrap":
 		cmdCloudBootstrap()
+	case "attest-prompt-source":
+		cmdCloudAttestPromptSource(cfg)
 	default:
 		fmt.Fprintf(os.Stderr, "unknown cloud command: %s\n", os.Args[2])
-		fmt.Fprintln(os.Stderr, "supported subcommands: status, enroll, unenroll, config, serve, upgrade, repair, bootstrap")
+		fmt.Fprintln(os.Stderr, "supported subcommands: status, enroll, unenroll, config, serve, upgrade, repair, bootstrap, attest-prompt-source")
 		exitFunc(1)
 	}
 }

cmd/engram/cloud_prompt_source_attestation.go

@@ -0,0 +1,119 @@
+package main
+
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"net/url"
+	"os"
+	"strings"
+
+	"github.com/Gentleman-Programming/engram/v2/internal/cloud/remote"
+	"github.com/Gentleman-Programming/engram/v2/internal/cloudconfig"
+	"github.com/Gentleman-Programming/engram/v2/internal/store"
+)
+
+const promptSourceAttestationUsage = "usage: engram cloud attest-prompt-source --sync-id <exact-sync-id> --owner-project <asserted-owner>"
+
+type promptSourceAttester interface {
+	AttestPromptSource(sessionID, sourceInboxID, syncID, ownerProject, promptProject string) (int64, error)
+}
+
+// The preview is observed data; the owner is a separate human assertion.
+func attestPromptSource(s *store.Store, syncID, owner, endpoint string, remote promptSourceAttester, input io.Reader, output io.Writer) error {
+	preview, found, err := s.PreviewPromptSource(syncID)
+	if err != nil {
+		return fmt.Errorf("prompt source preview failed: %w", err)
+	}
+	if !found {
+		return fmt.Errorf("no unambiguous complete prompt source preview for exact sync ID")
+	}
+	if _, err := fmt.Fprintf(output, "Observed source: session=%q source_inbox=%q sync_id=%q prompt_project=%q kind=%q\nHuman-asserted owner: %q\n", preview.SessionID, preview.SourceInboxID, preview.SyncID, preview.Project, preview.Kind, owner); err != nil {
+		return fmt.Errorf("attestation preview output failed: %w", err)
+	}
+	if _, err := fmt.Fprint(output, "Send this exact tuple for remote attestation? Type yes or no: "); err != nil {
+		return fmt.Errorf("attestation confirmation question output failed: %w", err)
+	}
+	line, err := bufio.NewReader(input).ReadString('\n')
+	if err != nil && err != io.EOF {
+		return fmt.Errorf("confirmation input failed: %w", err)
+	}
+	if strings.TrimSpace(line) != "yes" {
+		if strings.TrimSpace(line) == "no" {
+			return fmt.Errorf("attestation declined; no remote call made")
+		}
+		return fmt.Errorf("invalid confirmation; type yes or no; no remote call made")
+	}
+	id, err := remote.AttestPromptSource(preview.SessionID, preview.SourceInboxID, preview.SyncID, owner, preview.Project)
+	if err != nil {
+		return fmt.Errorf("remote attestation failed: %w", err)
+	}
+	if id <= 0 {
+		return fmt.Errorf("remote attestation returned no positive ID; local confirmation not saved")
+	}
+	if err := s.ConfirmPromptSourceAttestation(endpoint, preview, owner, id); err != nil {
+		return fmt.Errorf("remote attestation succeeded (ID %d), but local confirmation failed: %w; do not assume local authorization", id, err)
+	}
+	if _, err := fmt.Fprintf(output, "Remote attestation ID %d confirmed locally for sync ID %q\n", id, syncID); err != nil {
+		return fmt.Errorf("remote attestation confirmed locally, but success output failed: %w", err)
+	}
+	return nil
+}
+
+// Validate the endpoint before creating transport or persisting it as remote_target.
+func promptSourceAttestationEndpoint(raw string) (string, error) {
+	endpoint, err := cloudconfig.ValidateServerURL(raw)
+	if err != nil {
+		return "", fmt.Errorf("invalid cloud server URL")
+	}
+	parsed, err := url.Parse(endpoint)
+	if err != nil || parsed.User != nil {
+		return "", fmt.Errorf("cloud server URL credentials are not allowed")
+	}
+	return endpoint, nil
+}
+
+func cmdCloudAttestPromptSource(cfg store.Config) {
+	args := os.Args[3:]
+	if len(args) == 1 && (args[0] == "--help" || args[0] == "-h" || args[0] == "help") {
+		fmt.Println(promptSourceAttestationUsage)
+		return
+	}
+	if len(args) != 4 || args[0] != "--sync-id" || args[2] != "--owner-project" || strings.TrimSpace(args[1]) == "" || strings.TrimSpace(args[3]) == "" {
+		fmt.Fprintln(os.Stderr, promptSourceAttestationUsage)
+		fatal(fmt.Errorf("one exact sync ID and an asserted owner project are required"))
+		return
+	}
+	cc, err := resolveCloudRuntimeConfig(cfg)
+	if err != nil {
+		fatal(fmt.Errorf("cloud runtime configuration unavailable"))
+		return
+	}
+	if cc == nil || cc.ServerURL == "" {
+		fatal(fmt.Errorf("cloud server URL is required"))
+		return
+	}
+	endpoint, err := promptSourceAttestationEndpoint(cc.ServerURL)
+	if err != nil {
+		fatal(err)
+		return
+	}
+	if strings.TrimSpace(cc.Token) == "" {
+		fatal(fmt.Errorf("human bearer token required for remote dual-grant enforcement"))
+		return
+	}
+	transport, err := remote.NewMutationTransport(endpoint, cc.Token)
+	if err != nil {
+		fatal(fmt.Errorf("cloud transport configuration rejected"))
+		return
+	}
+	s, err := storeNew(cfg)
+	if err != nil {
+		fatal(fmt.Errorf("local store unavailable: %w", err))
+		return
+	}
+	defer func() { _ = s.Close() }()
+	if err := attestPromptSource(s, args[1], args[3], endpoint, transport, os.Stdin, os.Stdout); err != nil {
+		fatal(err)
+	}
+}