fix(auth): narrow alias verification token/alias atomicity containment - #7499

Narrow alias verification token/alias atomicity containment only. Verification holds the token lock through the alias write, ownership/evidence checks, and checked terminal token transition in one PostgreSQL transaction. Pre-commit failures roll back without an independent token reset; successful verified replay validates persisted evidence. The GET expiry update cannot regress a terminal token.

This is a DRAFT stacked on #7463, with base conductor/member-email-reconciliation-592 at cdef5b8e0c2dd45da9cb97cc29261ff654c1c08d. Publication is authorized for this exact reviewed candidate only; human approval and fresh exact-head CI are required. A maintainer review request is not approval. Do not mark ready, merge, enable auto-merge, or deploy on the strength of this Draft.

Scope and release limits:

• No migration. Migration 592 (592_email_mutations.sql) is preserved byte-for-byte, blob e726bbaaa214105df6a922773f7c208bb4919966 in both parent and candidate. No migration number is allocated by this PR.
• No claim of exclusive email ownership, recovery-grade identity linking, authority preservation, or Identity linking: isolate organization authorization to the authenticated credential #6827 closure.
• No current demonstrated cross-tenant escalation after fix(auth): disable automatic Google alias authority consolidation #7458: aliases are not an auth source and inbox proof is required. This PR addresses a narrower integrity/false-success defect.
• A known Medium cross-writer integrity race remains between unlocked users.email writers and alias claims. The users-email recheck does not establish a DB-wide normalized-email invariant. Separate migration 595 work for that invariant is in progress and is not included here.
• Must not deploy before fix(auth): disable automatic Google alias authority consolidation #7458 and fix(auth): contain destructive identity consolidation #7459. Both remain separate prerequisites. The stack base is fix(auth): guard member email mutations and break-glass access #7463, not main.
• Lost COMMIT acknowledgement remains ambiguous; subsequent replay checks persisted evidence. No historical identity/provenance repair is claimed.

Immutable candidate:

Exact commit · Exact parent-to-head diff

Exactly one feature commit and three changed files: 477 insertions, 55 deletions. No reviewed blob was rebased or changed for publication.

Validation on the unchanged candidate:

Total unit passes are 10,706. Focused/selection runs overlap the full suites and are not added again. Integration skips comprise one opt-in retained-GCS-evidence test and seven opt-in creative-agent comparisons. PostgreSQL 16 validation used disposable local Docker databases on loopback port 55432. The focused suite covers independent-session races and deterministic barriers, same-token replay, competing aliases, legacy state, current credential conflicts, INSERT/UPDATE exceptions and suppressed writes, cardinality tampering, persisted-state trigger tampering, rollback observations, and stale GET expiry. Provider credential methods were mocked and asserted unused.

Diagnosed baseline/harness behavior is retained in the evidence:

• An initial thread-detail fixture timed out resolving a Slack display name with inherited service credentials. Its unchanged suite passed 21/21 on both exact parent and candidate with those credentials removed. Initial stopped runs were excluded; final broad runs used a restricted environment.
• A fresh integration shard initially lacked the migrations its first ledger suite assumes CI already applied. After initializing the disposable database, the full shard was rerun.
• The unrelated private-ledger recovery race intermittently produced persistence_uncertain. Diagnostics captured PostgreSQL SQLSTATE 55P03 at its SHARE ROW EXCLUSIVE table lock with a 250 ms lock budget. This race failure also reproduced on the clean exact parent cdef5b8e0c2dd45da9cb97cc29261ff654c1c08d (tree 773728362a530bdf0274e008452cd17368957f9a). The full initialized batch-3 retry subsequently passed all 36 ledger tests. No ledger code, migration, or test repair is included here.

Independent exact-head review:

PASS for the requested narrow fix. No concrete security or integrity blockers identified.

The separate read-only reviewer /root/security_review verified the exact head/tree/parent/patch and changed blobs, inspected transaction/lock lifecycle and fault/replay paths, and independently checked the actual test logs, all 167 distinct integration files, strict typecheck exit 0, and the exact-parent 55P03 reproduction. The reviewer made no edits or database mutations. This narrow verdict does not establish the broader claims explicitly excluded above, replace human approval, or waive fresh exact-head CI.

Prior local logs and the review are retained in the publication workspace's gitignored .context/: commit-validation.log, alias-focused.log, reconciliation.log, final-integration-results.json, integration-1.log, integration-2.log, integration-3-retry.log, integration-4.log, test-typecheck-result.json, ledger-lock-diagnostic.log, ledger-exact-base.log, ledger-baseline-state.json, and security-review.md. These local results are not a claim that fresh GitHub CI has passed. Existing workflow base-branch filters may omit full build/security jobs on this stacked base; all required fresh exact-head CI remains a release gate.

Open workspace in Conductor

Draft disposition — 2026-10-09

• Existing author: @bokelley. Existing workspace.
• Workstream / hold: Existing dependency stack; stack dependency.
• Next action: Stacked on fix(auth): guard member email mutations and break-glass access #7463; do not deploy before fix(auth): disable automatic Google alias authority consolidation #7458 and fix(auth): contain destructive identity consolidation #7459 land; rerun review and CI after the stack is updated.

This draft is retained for the stated workstream. Continue on this existing branch; no parallel PR is needed. This disposition does not waive CI, review, migration, or release gates.