feat(auth): authorize anonymous commands from loaded session

[cursor]

Why

PR #86 adds authorize_anonymous_session, but a transport can still build a matching ResourceScope from the anonymous proof and then command a different loaded assessment session. Tenant lives on the participant record, not on the session aggregate, so the resource must be derived from stored records.

What

• Keep the feat(auth): bind anonymous proof to exact session resource #86 exact-session resource authorization boundary.
• Add authorize_anonymous_session_command that builds the assessment-session resource from the loaded participant tenant/owner and loaded session reference.
• Reject a session owned by another loaded participant, a different session for the same owner, a foreign participant tenant, and zero/expired server time in documented order.
• Record the slice in CHANGELOG and TRACEABILITY as active work, not protected-main truth.

Architecture / scope

This completes the product-side anonymous command gate from ADR-0003 without changing Keyverse credentials, HTTP transport, persistence, or scoring. Callers must still verify the short-lived proof before constructing AnonymousSessionContext.

Verification

• cargo test --test anonymous_session_command_authorization --test anonymous_resource_authorization
• cargo test --test documentation_architecture_contract --test traceability_active_pr_contract
• cargo clippy --all-targets -- -D warnings
• cargo doc --no-deps

Independent non-author approval and required checks on the unchanged exact head remain merge gates.

Stacked on the #86 anonymous-session authorization head after the #85 account-link merge.

  

[cursor]

Command authorization on this head still has two contract holes that will fail a careful coverage or error-order review.

1. authorize_anonymous_session_command checks loaded session/participant ownership before tenant. A foreign-tenant participant plus a session owned by someone else returns OwnerMismatch and never CrossTenantDenied, which contradicts the command rustdoc order.
2. ResourceScope::participant_owned(...).map_err(|_| SessionMismatch) is unreachable from validated ParticipantRecord / AssessmentSession constructors. If it ever fired it would mislabel InvalidReference / ResourceOwnershipMismatch. That arm is the 100% branch-coverage hole.
3. CHANGELOG overclaims that a transport cannot invent a matching scope. That is true only for the new command/apply entry points. authorize_anonymous_session still takes a caller-built ResourceScope.
4. UML, SECURITY_AND_DATA, and ADR-0003 were not updated for the new public command API.

Successor #118 compares the actor to loaded records directly (tenant first), adds the missing command-path tests, persists/reloads anonymous assessment_participant so tenant is not reconstructed from the proof, and updates those viewpoints.

Do not merge this head. Independent non-author approval and green required checks remain merge gates on whichever successor is integrated.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

This loaded-pair check runs before tenant. A tenant_beta participant plus a session owned by another participant returns OwnerMismatch and never reaches CrossTenantDenied. Classify actor.tenant_ref() != participant.tenant_ref() first so the documented command error order holds.

[cursor]

This map_err(|_| SessionMismatch) arm is dead: participant_owned fails only on invalid refs or a tenant-only kind, and kind is hardcoded to AssessmentSession while the refs already passed ParticipantRecord / AssessmentSession constructors. Do not add a test that tries to hit it. Compare actor fields to the loaded records (or expect after documenting that validated aggregates cannot fail construction).

[cursor]

"a transport cannot invent a matching scope" is true only for authorize_anonymous_session_command / apply_anonymous_session_command. authorize_anonymous_session still accepts a caller-built ResourceScope. Say that the command entry point does not take a caller scope, and keep the lower-level exact-resource check separately.

[seonghobae]

Closing as a proven superseded predecessor. Fresh compare shows #104 head 458d21c5 is the merge base/ancestor of #159 head 5ee49d86; #159 carries the anonymous command authorization line forward and removes stale store-load claims/persist pointers, naming #158 as the actual persistence landing while preserving the supplied-record authorization boundary. #159 explicitly prefers this head over #104.