feat(cloudserver): authorize explicit prompt source attestations

[dnlrsls]

🔗 Linked Issue

Closes #1458

Third bounded child for explicit source reauthorization, based on open tracker #1464 at aee38de0, not main.

🏷️ PR Type

• type:feature — New feature

📝 Summary

• Add human-principal-only POST /sync/prompt-source-attestations, with strict bounded request, actor bound to the authenticated principal, and current grants on both asserted owner and prompt projects before accessing a global session identity.
• For an old source with no cloud binding, register asserted owner, claim exact pair, then append an audit attestation. Conflict/transport/storage failures report no success; local confirmation and deletes are not enabled.
• Document that the explicit assertion is neither proof of historical creation nor a delete grant.

📂 Changes

File	Change
internal/cloud/cloudserver/cloudserver.go	Route behind withAuth.
internal/cloud/cloudserver/prompt_source_attestation.go	Auth, dual-grant, exact source binding and fail-closed error handling.
internal/cloud/cloudserver/prompt_source_attestation_test.go	Grant/error/malformed cases plus real bearer-boundary test for human, missing, revoked, disabled, legacy and service credentials.
docs/codebase/prompt-inbox-provenance.md	Distinguish explicit assertion from local creation and delete authorization.

257 additions, 2 deletions. Partial remote registration/claim may persist if later audit insert fails; client sees failure and MUST NOT record local confirmation. Retry is idempotent for the binding and appends audit only on success.

🧪 Test Plan

• Test-first RED: focused test failed with 404 before route mount; GREEN after handler implementation (writer report). Bearer regression initially expected 403 for disabled principal but actual withAuth returned 401, expectation corrected before commit.
• Focused: go test ./internal/cloud/cloudserver -run '^TestPromptSourceAttestation(BearerBoundary|Admission)$' -count=1 — PASS (independent verifier).
• Affected package: go test ./internal/cloud/cloudserver -count=1 — PASS (independent verifier).
• Additional: go vet ./internal/cloud/cloudserver, gofmt listing for new files, git diff --cached --check — PASS. Storage-only exact-binding/append-only tests passed against disposable Postgres in preceding feat(cloudstore): record explicit prompt source attestations #1547; HTTP-to-Postgres path not yet verified. Native review review-59f121b5698420cc approved/acknowledged; nonblocking reliability advisory on fake-store identity assertions to revisit in integration tests.
• GitHub unit/E2E/plugin/lint/Windows/policy checks — pending at creation.

🤖 Automated Checks

CI pending. All required checks must pass before normal merge.

✅ Contributor Checklist

• Approved issue feat(store): preserve admitted prompt identity through sync and deletion #1458 linked; exactly one type:feature label.
• Focused/package/additional checks and missing integrated evidence recorded.
• Behavior docs updated; conventional commit without co-author trailer.
• Changed paths comply with transient-artifact policy.

💬 Notes for Reviewers

A confirmed human assertion plus current grants can authorize a cloud binding even for a formerly unregistered imported source; it never proves local creation. This route does not itself authorize autosync or any remote delete. Subsequent children need a local confirmed marker, one-source CLI with preview/confirmation, gated autosync, separate verified-delete policy and integrated validation before #1464 can be queued.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d773cf03-b5d5-4241-a446-2b80e0dabda3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}