[01/14] Connection access: Inert grant contracts and persistence #2

Part of #1. User approved ticket execution on 2026-10-10.

Stack order: 01/14. Run one implementation session at a time by default.
Depends on: parent #1 approved scope. Earlier slices are transitive prerequisites.
Branch: access/01-contracts-storage. Initial fork PR base: feature/connection-resource-access. Restack against accepted preceding slice when necessary.

Purpose: Represent access without creating usable restricted credentials.

Likely files: packages/contracts/src/auth.ts, index.ts, new small authResourceAccess.ts helper/test; apps/server/src/persistence/AuthPairingLinks.ts, AuthSessions.ts, Migrations.ts, next migration; auth/EnvironmentAuth.ts, PairingGrantStore.ts, SessionStore.ts codecs.

Contract/storage: Add optional versioned resource grants: projects all/IDs; providers all/selected instance entries; nested models all/IDs. Keep scopes/permissions compatibility response fields. Add optional authority revision/device anchor metadata. Null legacy means unrestricted resources; malformed explicit stored grants fail closed, never decode as null. Keep helpers to set membership/intersection/subset only; canonical model resolution stays server-side. Migration defaults preserve existing records.

Install small service-level guard rejecting any externally requested non-all grant and any grant-edit/conversion path; no UI exposed. Only internal test fixture construction can persist restricted records for later tests. Accepting unknown grant input while ignoring it is forbidden. Grant-shaped data in early responses must not claim enforcement is active.

Acceptance: Round-trip all/explicit/empty; two instances same driver differ; future ID cases; deleted IDs remain inert; malformed stored JSON fails; old rows/tokens decode unrestricted; production pairing/update cannot create a usable restriction.

Focused checks: New helper test plus existing auth/storage tests.

vp test run packages/contracts/src/auth.test.ts packages/contracts/src/authResourceAccess.test.ts apps/server/src/auth/PairingGrantStore.test.ts apps/server/src/auth/SessionStore.test.ts
vp lint packages/contracts/src/auth.ts packages/contracts/src/authResourceAccess.ts apps/server/src/persistence/AuthPairingLinks.ts apps/server/src/persistence/AuthSessions.ts apps/server/src/auth/EnvironmentAuth.ts
vp run --filter @t3tools/contracts typecheck
vp run --filter t3 typecheck

Handoff: Document serialized null/all distinction, planned next migration and exact guard location. Safe to merge: Existing unrestricted flows unchanged; no usable restricted credential can be issued, converted or edited.

Session rules

• Reuse approved parent policy: manual pairing first; per-device project and configured-provider/model grants; queue-only interaction with another device's active run; grant cuts cancel/interrupt affected device work; no OS sandbox.
• V1 restricted scheduled tasks are denied, rather than implementing full restricted automation.
• Early slices remain inert. Restricted issuance/edit/conversion stays disabled until activation ticket.
• Focused checks only; exact test/file list may adjust after inspecting source. Do not run repo-wide checks, paid provider agents, dev servers, browsers or devices without explicit authorization.
• Configured git identity; no agent attribution or Co-Authored-By trailers. Plans/evidence stay outside repository.
• After focused checks, commit/push this fork branch and open one fork PR, link it to T3 session, and report validation plus remaining risks. Do not merge PR or start next ticket yourself; coordinating session handles readiness and dependency handoff.

Execution status

Implementation complete: commit 8698382, PR #16. Coordinator source review found no blocking issue. Focused validation: 110 tests, all touched-file lint, contracts/server typechecks and diff check passed.

Integration pending: fork CI jobs are queued for Blacksmith runners with no runner assigned. This issue remains open until integrated merge; parent checklist is updated at that milestone. Restricted issuance remains disabled.