Add durable, revocable processing consent

[salmonumbrella]

What changed

Docbank now records immutable processing grants and revocations against the current vault incarnation, exact profile and disclosure fingerprints, permitted input classes, and retained artifact classes. Expiry and the revocation fence are checked again before provider access and publication, so a later grant cannot revive work leased under older authority.

Every new or restored vault gets a fresh processing incarnation. Backup JSONL keeps prior consent as history, but restored grants cannot authorize new network activity.

Why

Restoring a vault must not silently restore permission to send its bytes somewhere. Consent needs to be durable enough to audit and narrow enough to fail closed when the endpoint, deployment, disclosure, inputs, retained outputs, expiry, or revocation state changes.

Usage

Runtime integrations grant or revoke an exact provider operation through the store boundary, then recheck that authority immediately before egress and publication. No operator-facing command is added here; later application surfaces call this contract.

Part of #176 (R4). Stacks on #191.

[roborev-ci]

roborev: Combined Review (b656adf)

High-severity authorization and purge-suppression flaws must be fixed before merge.

High

• internal/processing/artifacts.go:96 — PublishRendition can publish artifacts and serving heads without calling AuthorizeProviderOperation. Because it carries neither the initial authorization receipt nor the operation’s consent scope, a revoked or expired grant may still publish after provider work completes. Carry the exact consent request and prior authorization into publication, then reauthorize immediately before the atomic head update; reject revoked, expired, or mismatched authority.

• internal/store/derivative_suppression.go:258 — Purge suppression includes the candidate build ID, so regenerating the same purged source/profile under another build ID bypasses suppression. AuthorizeDerivativeRebuild also records a specific SupersedingBuildID, but staging and attachment do not enforce it. Check suppression independently of the candidate ID and permit only the explicitly authorized superseding build.

Medium

• document/media/inspect.go:460 — ODF semantic limits are undercounted: ODP slide elements are not counted, and ODS repeated rows/cells count as one regardless of table:number-*-repeated. Oversized documents can therefore pass preflight. Add namespace-aware counting for draw:page and overflow-safe expansion of repeated row, column, and cell attributes before applying limits.

---

Reviewers: 2 done | Synthesis: codex, 11s | Total: 18m2s

[roborev-ci]

roborev: Combined Review (aff1627)

High-severity authorization race and three medium-severity policy/limit issues must be addressed before merge.

High

• Authorization is neither required nor atomically revalidated — internal/processing/artifacts.go:160, internal/store/search.go:631
  Renditions can be published without a grant, and a separate AuthorizeProviderOperation check can race with revocation before the head transaction commits. Require authorization before invoking the provider, then pass the exact authority request and receipt into publication and revalidate the incarnation, fence, grant, and expiry within the same write transaction that publishes the heads.

Medium

• Incomplete rendition-policy identity check — internal/processing/artifacts.go:221
  Publication compares only MaxSegmentRunes; differing normalization or sanitization policies can be cataloged under an unrelated EvidenceLexicalFingerprint, breaking immutable policy identity and deduplication. Derive the executable policy from its registered canonical identity or compare a deterministic fingerprint covering all relevant settings.

• Transport limit incorrectly applied to retained artifacts — internal/processing/artifacts.go:231
MaxResponseBytes limits the provider response, but publication applies it to all retained artifacts, including locally generated normalized evidence and sanitized Markdown. Enforce it while reading the provider response and use a separate budget for aggregate stored bytes if needed.

• Authorization lacks a semantic-unit limit — document/provider.go:128
ValidateRenditionResult permits up to the package-wide 100,000 evidence units even when the processing profile authorizes fewer, delaying rejection until after provider work and result processing. Add MaxUnits to RenditionAuthorization and enforce it during result validation.

---

Reviewers: 2 done | Synthesis: codex, 12s | Total: 26m19s

[roborev-ci]

roborev: Combined Review (d1dc010)

Verdict: Changes requested — one high-severity consent race and one medium-severity preflight-limit bypass remain.

High

• Revoked provider work can still be published — internal/processing/artifacts.go:160, internal/store/search.go:631

  Final rendition publication does not carry or transactionally revalidate the original authorization, consent request, grant incarnation, revocation fence, and expiry. Consent can be revoked after a worker’s last check but before publication, allowing provider output and lexical heads to become active and searchable afterward.

  Pass the original authorization receipt and exact consent request into publication, then reauthorize within the same storage transaction immediately before activating the rendition and lexical heads. Reject expired or replaced grants and changed incarnations or revocation fences. Add a concurrency test covering revocation between provider completion and publication.

Medium

• ODS repetition attributes bypass the cell limit — document/media/inspect.go:536

  Cell measurement counts each <table-cell> element once while ignoring number-columns-repeated and number-rows-repeated. Compact ODS files can therefore expand beyond MaxCells while passing preflight.

  Parse both repetition attributes, calculate expanded counts with checked arithmetic, reject files exceeding MaxCells, and add tests for repeated rows and columns.

---

Reviewers: 2 done | Synthesis: codex, 14s | Total: 30m24s