feat(auth): enforce protected routing and fail-safe invalidation

[cea-block]

Why

Protected-route inventory and durable invalidation must land as one fail-safe review unit so a protected surface cannot outlive its authorization posture. Fresh migration and DELETE trigger paths must use an authority function that already exists and must never read an unassigned transition record.

What

• Keep a complete protected-route inventory and fail closed at the shared router boundary.
• Persist monotonic invalidation floors, operation receipts, and authority epochs.
• Select OLD.community_id for DELETE and NEW.community_id for INSERT or UPDATE in the shared authority trigger.
• Install the three kind-30617 authority triggers in 0042_authorization_authority_epochs.sql after the function definition.
• Enforce server-owned enrollment, typed provider-installation provenance, and explicit deny_protected behavior.
• Keep the CD migration range linear from 0040_authorization_invalidation_floors.sql through 0042_authorization_authority_epochs.sql.

Risk Assessment

Medium. Protected requests deny when routing or invalidation authority is absent, ambiguous, or stale. Defaults remain disabled, and this draft does not deploy or activate enforcement.

References

• Three-PR stack: feat(db): add durable identity binding lifecycle #4772 → feat(auth): harden trusted evidence and protected objects #4783 (O4AB) → feat(auth): enforce protected routing and fail-safe invalidation #4789 (O4CD) → feat(auth): install runtime status and session conformance #4790 (O4EF).
• Exact base: cea/o4-protected-transports at 5727152d4eece55ee621d46475372af4a74b9bb3.
• Exact head: cea/o4-invalidation-failsafe at 2b8e29ecbf686ecb00433f2109144be697368f68 (tree d2a1677af90f71a061e23aca78a908bc51f9e136).
• Gate status: PostgreSQL 42883 and project-tombstone DELETE failures are preserved as red evidence; the repair passed gap-free migration, targeted formatting, whitespace, disclosure, scope, and DCO checks. Replacement CI: https://github.com/block/buzz/actions/runs/30962126434.

Generated with Codex