feat(api): retrieve stored export authorization by idempotency key

CHANGELOG.d/export-idempotency-lookup-stored-request-get.md

@@ -0,0 +1 @@
+- `GET /v1/exports/by-idempotency/{idempotency_key}/request` returns the stored naruon export-authorization request on `tepp-loopback` (ADR 0099). Dual identity of stored-request GET (`export_id`). Zero and ambiguous matches fail closed. `tepp.scientific_acceptance.v1` never appears. LineageWeave refused. `NaruonLiveService` stays POST-only. Does not re-open cancel lineages. Not GAP-010 Figma/export, not persistence.

DOCUMENTATION.md

@@ -75,6 +75,7 @@ TEPP's approved PRD v0.4 and implementation plan are the primary product baselin
 | Unicode canonical-identity doctoring | [`docs/research/unicode-canonical-identity.md`](docs/research/unicode-canonical-identity.md) |
 | Export idempotency-key lookup HTTP doctoring | [`docs/research/export-idempotency-lookup-http.md`](docs/research/export-idempotency-lookup-http.md) |
 | Export idempotency-key lookup CLI doctoring | [`docs/research/export-idempotency-lookup-cli.md`](docs/research/export-idempotency-lookup-cli.md) |
+| Export idempotency-key lookup stored-request GET doctoring | [`docs/research/export-idempotency-lookup-stored-request-http.md`](docs/research/export-idempotency-lookup-stored-request-http.md) |
 | Change history | [`CHANGELOG.md`](CHANGELOG.md) |
 
 ## Maturity vocabulary

crates/tepp_api/src/analysis_run_live.rs

@@ -5,6 +5,8 @@
 //! boundaries needed by Naruon and `LineageWeave`. Naruon may also POST and
 //! GET `/v1/exports/{export_id}` for metric-free purpose-bound retrieval
 //! and `GET /v1/exports/by-idempotency/{idempotency_key}` for key lookup.
+//! `GET /v1/exports/by-idempotency/{idempotency_key}/request` returns the stored
+//! export-authorization request of that unique accepted export.
 //! It accepts transport acknowledgements, temporal evidence context, and
 //! export identities only; completed psychometric results remain outside this
 //! crate.
@@ -18,6 +20,10 @@ use crate::export_idempotency_lookup_http::{
     ExportIdempotencyLookup, export_idempotency_lookup_path_key,
     refuse_metrics_on_export_idempotency_lookup_payload,
 };
+use crate::export_idempotency_lookup_stored_request_http::{
+    export_idempotency_lookup_stored_request_path_key,
+    refuse_metrics_on_export_lookup_stored_request_payload,
+};
 use crate::lineageweave_http::{
     LINEAGEWEAVE_CONSUMER_CODE, NARUON_CONSUMER_CODE, consumer_is_supported,
 };
@@ -167,6 +173,12 @@ impl AnalysisRunLiveService {
         let (method, path) = parse_request_line(lines.next().unwrap_or(""))?;
         let headers = parse_headers(&mut lines)?;
         if method == "GET" {
+            if matches!(
+                export_idempotency_lookup_stored_request_path_key(path),
+                Ok(_) | Err(ApiError::LimitExceeded)
+            ) {
+                return self.lookup_export_stored_request_by_idempotency(path, &headers, body);
+            }
             if matches!(
                 export_idempotency_lookup_path_key(path),
                 Ok(_) | Err(ApiError::LimitExceeded)
@@ -392,6 +404,40 @@ impl AnalysisRunLiveService {
         Ok(json_response(200, "OK", response_body))
     }
 
+    fn lookup_export_stored_request_by_idempotency(
+        &self,
+        path: &str,
+        headers: &HashMap<String, String>,
+        body: &str,
+    ) -> Result<NaruonLiveResponse, ApiError> {
+        let idempotency_key = export_idempotency_lookup_stored_request_path_key(path)?;
+        if !body.trim().is_empty() {
+            return Err(ApiError::InvalidWirePayload);
+        }
+        let consumer = require_headers(headers, self.bound_addr, false)?;
+        if consumer != NARUON_CONSUMER_CODE {
+            return Err(ApiError::InvalidWirePayload);
+        }
+        refuse_metrics_on_export_lookup_stored_request_payload(body)?;
+        let prefix = format!("{consumer}\u{1f}");
+        let mut matches: Vec<&StoredExport> = self
+            .authorized_exports
+            .iter()
+            .filter(|(replay_key, stored)| {
+                replay_key.starts_with(&prefix)
+                    && stored.retrieval.idempotency_key == idempotency_key
+            })
+            .map(|(_, stored)| stored)
+            .collect();
+        if matches.len() != 1 {
+            return Err(ApiError::InvalidWirePayload);
+        }
+        let stored = matches.remove(0);
+        let response_body = crate::wire::to_json(&stored.request)?;
+        refuse_metrics_on_export_lookup_stored_request_payload(&response_body)?;
+        Ok(json_response(200, "OK", response_body))
+    }
+
     fn response_from_error(&mut self, error: ApiError) -> NaruonLiveResponse {
         let request_id = format!("analysis-run-live-{}", self.next_request_serial);
         self.next_request_serial += 1;