[first-assist]

AI public metadata projections are graphql-orm entities with current-principal, owner/tenant, scope/session and host entity/row/field authorization. Trusted private source entities propagate after commit through the session/message/run/attachment projection graph. Generated Changed delivery uses #195's authorization and serialization fences. Protected content and custody remain private; ordinary generated writes are absent.

The fixed private session-activity read view retains ownership, field, backup and policy metadata while omitting three known virtual projection edges by generated publicMetadata name. The companion assertion now matches that name; the backend-coexistence fixture lock records AI 0.110.0. Root-relayed companions job 120603815278 then passed the AI library but found two public-entity tests returning AUTHORIZATION_MISCONFIGURED: count and relation pages use callback-only row authorization and lacked a bounded authorized scan. Their disposable SQLite fixture now installs a test-only AuthorizedScanConfig; the host prerequisite is documented. The native result on this successor is pending.

Rebased directly onto merged #195 main ec0c46aacb528c3e102f655db148a39970429ab5; #195 passed 18/18 hosted checks. Proposed ORM/macros 0.65.0, AI 0.110.0 and owned schema module 0.73.0 remain unreleased. Full #184/#191 privacy, backend and owned no-DDL acceptance is incomplete; draft #189 is incomplete. Source-only documentation 210, generated inventory, package release policy, diff and all seven lockfile external-identity checks pass. No local Cargo, Rust, formatter, test or backend command ran. Keep draft; GentleCarp alone merges.

Root-relayed workspace-integrity job 120619560554 found one rustfmt layout hunk in the bounded test fixture; it was applied source-only. Root-relayed companions job 120645173780 then found missing_docs from generated filter/order inputs and read-only operation types/methods under the AI crate deny; the macro now scopes a missing-docs allowance to generated input structs and documents generated query/page APIs. Root-relayed orm job 120645173694 found Clippy cmp_owned in the aggregate SDL test; the comparison now uses Name::as_str() and ORM checks are green on the prior head. Root-relayed companions job 120670128634 narrowed the remaining missing_docs errors to one generated public mutation placeholder and one public repository key method per AI projection. The macro now documents the empty read-only/composite mutation root and all generated key read methods. Fresh exact-head hosted CI remains pending. No local formatter or Rust command ran.

Current source: 71d6376c456d439972af61df55bb112b78a32c86 (tree be888d573a8afecbc6c74eda51cb69e3b108edfe).

Documentation impact

• Documentation updated
• No documentation impact