Authorize server lookup of exact retained original files

SI
7d ago
+735-0

A server reopening an original needs the exact retained private location without exposing paths through ordinary receipt reads. This adds service-only get_context_original_retrieval, reusing Database #94's current actor/workspace and locked receipt/source/version checks before returning an internal bucket/path tuple. Withdrawal, removal and metadata mutation deny access; historical versions retain their own object locations. No new rows or public receipt changes.

Depends on separately unapproved Database #94; its reviewed commits are included until release, then refresh main to remove overlap. Original migration is unchanged; the new function is forward-only. No API caller, storage download/upload, signing, accepted analysis, rights or production migration. A future server must verify actual bytes and recheck current receipt before delivery. Locks end with the transaction; this is not immutable storage or a permanent access grant.

Validation: 7 new cases + 1 inherited execution; combined receipt/retrieval suite has 20 real transaction executions on each disposable PostgreSQL15/17, all pass. Six new cases failed before implementation. CI15/16 runs the combined pattern. Python compile/diff checks pass. Synthetic rows only, no hosted operations. tests/ORIGINAL-RETRIEVAL.md documents remaining byte verification, acquisition/orphan controls and URL limits.

Part of recoupable/app#2116 and recoupable/app#2140.

Summary by cubic

Adds service-only RPCs to register private original files and retrieve the exact retained object location without exposing storage paths through ordinary receipt reads.

  • New register_context_original stores a verified metadata receipt and get_context_original_retrieval returns the private bucket/path after reusing the existing actor/workspace, source/version, withdrawal, removal, and mutation checks.
  • Registration is forward-only, accepts canonical .original paths for PDF/CSV, and serializes source creation so cross-owner races return one receipt and a controlled denial instead of duplicate-key errors.
  • Retained receipts replay before source-lock acquisition, so retries survive contention without skipping authorization or integrity checks; contended source locks are nonblocking.
  • Withdrawn sources, removed versions, and mutated metadata deny access; historical versions keep their own object locations.
  • Adds regression tests on PostgreSQL 15/16 and depends on the separately reviewed Database #94 migration.