feat(autosync): preflight keyed prompt authority before push

[dnlrsls]

🔗 Linked Issue

Closes #1458

Child of open tracker #1464, based on its latest head e7f5c14d. Target feat/prompt-inbox-foundation-tracker only; do not merge directly to main or queue tracker yet.

🏷️ PR Type

• type:bug — Bug fix
• type:feature — New feature
• type:question — Question requiring tracked work
• type:docs — Documentation only
• type:refactor — Code refactoring
• type:chore — Maintenance
• type:breaking-change — Breaking change

📝 Summary

• Preflight a keyed prompt mutation using exact independently stored local prompt and live session provenance; register the session owner then claim the source pair with owner and prompt projects before any push.
• Failed registration/claim or missing evidence leaves that entry pending, without push or ack; healthy later outbound pages progress within a fixed eligible target-scoped journal high-water.
• Document boundaries: imported/old sources are not implicitly authorized, and cloud deletes are not enabled here.

📂 Changes

File	Change
internal/cloud/autosync/manager.go	Fail-closed keyed prompt preflight and bounded outbound pages.
internal/cloud/autosync/manager_test.go	Regressions for exact provenance, failures, later-page progress and stale sync-state counter.
cmd/engram/autosync_e2e_test.go	Fake journal paging compatibility in CLI tests.
docs/codebase/prompt-inbox-provenance.md	Current provenance requirements and explicit older-source boundary.

345 additions + 41 deletions = 386 changed lines. No duplicate store helper; it arrived through PR #1539.

🧪 Test Plan

• Focused autosync cases for preflight/no implicit authority/stale state/blocked first page — PASS.
• go test ./internal/cloud/autosync ./cmd/engram ./internal/store -count=1 — writer and independent verifier PASS.
• go vet on these packages; gofmt listing and git diff --check — PASS.
• Native single-lens review review-a9bd33e5ba6528a1 approved and acknowledged; two non-blocking advisories to inspect in follow-up.
• GitHub unit/E2E/plugin/lint/Windows/policy checks — pending at PR creation.

🤖 Automated Checks

Pending until CI runs; do not infer from local evidence. Performance ratchet and CodeRabbit may skip on this non-default base.

✅ Contributor Checklist

• Approved issue feat(store): preserve admitted prompt identity through sync and deletion #1458 linked; one type:feature label.
• Tests and codebase documentation accompany behavior; commit is Conventional Commit without co-author trailer.
• No transient artifact in changed paths, and this slice stays below 400 lines.
• CI/branch protection must pass before normal merge.

💬 Notes for Reviewers

Important follow-up before tracker/main validation: independent verification found that the existing cycle() skips pull for any push failure. With this new fail-closed preflight, a permanently unverified keyed prompt can now keep inbound pull stalled on retries, even though later outbound entries progress. Tracked as T4b3a2c, a separate ≤400-line child to distinguish per-entry authorization failures from transport failures, permit safe pull, preserve failed outbound status and pending/no ack, and update the legacy skip-pull regression. This slice is not a claim that inbound starvation is solved. Do not queue #1464 until T4b3a2c, explicit per-source CLI reauthorization (T4b3b), cloud delete admission (T4c) and integrated validation (T5) are complete.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 8354ec4b-a926-4d19-8be9-d171018d134d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}