[bokelley]

Refreshes the unique #7476 mutation safeguards on main de70d9952f229442668dc679916cc08f885923b0, after #7450 landed. The current source replaces the obsolete conflicted continuation; the original head 5654b799 remains a merge parent so this is the same PR and branch.

An Addie turn can assemble privileged tools, wait for the model or durable checkpoint, then dispatch after the authenticated credential loses authority. This change binds the final tool surface to the exact credential and rechecks positive local lifecycle, immutable request authority, live WorkOS identity/email, selected organization and conditional platform-admin/committee authority before and after reservation. Missing or uncertain authority fails closed. Web, all seven Slack reservations and Tavus retain committed row receipts; all four shared executors receive the authority check.

A denied action carries an application-owned no-dispatch receipt for its exact reservation. Database settlement and restart replay agree on row ID, tool and parameters. A pre-reservation denial cannot release an older unknown action; an ambiguous reservation commit stays fenced. Existing known local outcomes and typed GitHub receipts retain their current semantics.

Current guarded membership commits bump exact target epochs in their own transaction, including caller-owned deletions. Unchanged provider role/membership-ID refreshes do not invalidate every user's turn. Site-admin grant/revoke audits require exact persisted row receipts and preserve authenticated/canonical actor attribution. Inactive revoke targets return a distinct 409 rather than a misleading 404, retaining the guard and requiring reconciliation.

Validation: the full normal commit gate passed on parent 297f0162005f715656fbe43a28d7cfd4e4ea595b: 1,106 root tests and 12,593 server tests across 752 files, with 31 existing skips, plus both complete typechecks. Focused real PostgreSQL suites passed 331 tests, with final inactive-target and row-scoped replay suites passing 7 and 60 tests respectively. Focused dispatch/authority units passed 98 tests; final Tavus units passed 56. Inventory uses code version 2026.10.6. Earlier failed/interrupted gate receipts remain recorded; the isolated normal gate passed without timeout, assertion or hook changes.

Current head e2b039b29aa80353336300b404eefc733d9b2f45 adds only an integration-fixture correction: preserve the real admin-tool module exports while overriding the existing privilege mock. No production or unit-test bytes changed from the qualified parent. All 20 member-role-policy tests passed against real PostgreSQL; Haiku cleared the small diff. The latest normal commit gate passed 1,106 root tests and both complete typechecks; normal staged-scope detection skipped server units for this integration-only change. Normal pre-push checks passed. The prior CI integration shard failed on the fixture's missing ADMIN_TOOLS export; that failure remains recorded. Fresh exact-head GitHub CI is complete: 31 successful checks, one neutral check and the expected draft AI-review skip. All four canonical, server-unit and integration shards, plus their aggregates, passed. Historical or parent-head results do not substitute for that service gate.

Read-only Sonnet review found no Must Fix and cleared the inactive-target correction against primary contracts. Haiku found no Must Fix; it retains non-blocking review questions about selected-organization mismatch returning a conservative 503 and the shared compatibility type allowing a void reservation receipt. Current production reservers all return receipts; a missing receipt cannot release a reservation. Context hydration conflates definitive absence and lookup uncertainty, so this port preserves fail-closed provenance rather than returning forbidden from an untrusted/missing context. These automated readings are not human security approval.

No migrations, immutable releases, 3.3 or GCS rollout implementation changed. Already-landed positive lifecycle guards remain intact. Historical disabled merge/domain-auto-join/alias-consolidation flows and old credential-grant creation routes are not reintroduced. External WorkOS revocation and local handler entry cannot share a transaction; final live checks reduce but cannot eliminate that timing window. This PR does not close #6827.

Remain Draft. Auto-merge stays off. Do not merge or deploy before human security review and deployment approval.

Existing workspace.