fix(server): authorize project mutations and deletion cascades

[alimek]

Summary

Project mutations and force-delete cascades could reach stored receipts, hydration, and writes without the current credential's resource admission. Require shared authority at service entry and each actual project/child SQL commit.

HTTP / WS current authority | explicit internal trust
  raw target + receipt + root policy
  existing project/workspace/thread locks
  plan / hydrate outside SQL
  SQL: current grant + scope + actual membership -> write / replay
  publish and effects after commit

Canonical-admitted launch children and server-created Scratch folders carry one command-specific path association through pending attachment claims and real commits, rechecked against current SQL roots without bypassing external authority. The two new sink invariant failures carry structured domain causes. Restricted credentials retain permitted project title/defaults and deletion flows. Root/project creation, setup-script/root retarget and foreign direct thread workspace bindings fail before effects. Final project deletion and thread snapshot writes prevent concurrent create/move from leaving live children under a deleted project.

Refs #5, #1. Only approved 04b3; base is accepted 04b2 (PR21). Grant gate remains closed. General workspace/Git (04c), assets (06), provider execution (07), durable origin/revocation (08), MCP inheritance (09), automation (10), and clients remain deferred.

Evidence

• Before: project sink methods lacked authority and force deletion imported children before trusted commits. Coordinator controls then caught direct child/Scratch launches and pending-upload child launch regressions.
  After: the pending-upload child control fails before and passes after. 98 focused tests pass across admission, attachment claims, intake and launch service: persisted workspace/initial attachment bytes, replay/cleanup, Deferred before-copy scope/grant/root/source/receipt cuts, actual commit cuts, raw/cross-project/symlink denial, and lost-result durable bytes. The launch test harness now registers its mock projects in real SQL; the production live-parent guard remains.
• Named server typecheck, four-file touched lint (one existing warning), format and git diff --check pass. Earlier project mutation/cascade and structured-error evidence is retained in the 04b3 audit. No repo-wide checks or live client/provider sessions.

Current repaired head: ffe46fbbc871915dd346a7e09a05a022e66b9474; immediate parent: bae7674e24a02905a8a0315a8c05b6c342411125; accepted PR base remains 46a884c07e996fd4ab0076a1c5adf0114a581b16. Coordinator source re-review required; no acceptance claimed.

Merge Danger

Door: two-way

No schema migration. Rollback restores previous admission behavior; already committed deletions retain existing durability.

Blast Radius: server

Project mutation/bootstrap callers and direct thread workspace bindings share the boundary. Background clone completion and MCP remain explicitly trusted under their later slices.

Model: gpt-6.1-sol. Harness: Codex.

[alimek]

Consolidated into #30 at the same accepted final source tree (b66e06e), now targeting feature/connection-resource-access. Closing this individual stack PR as superseded; its commits, review record and branch remain preserved. No feature activation or main/upstream merge. Tracking issues remain open until integration verification.