fix: require Trust allow before investment approval

[NewWorldVenture]

Approving a buy or sell order currently calls invest_decide_order when Trust requires approval or cannot read policies/grants. Require an explicit Trust allow before that RPC. Rejection and pending-order creation keep their existing behavior.

The new34-case suite executes the real Trust bridge and engine with an in-memory database and recording RPC. Against unchanged source,8 targeted cases failed and26 controls passed; after the one-line guard repair,34/34 pass. Related checks:222/222 across7 files; type generation, full TypeScript checking and changed-file lint pass. Healthy parent/adult permission, explicit policy/grant allow, rejection, nonmanager roles, foreign-family and already-filled controls are retained.

Scope: ACTION-142B5EB6AC00 / ACT-119 source admission only. No SQL or actual money is executed by these tests. DB-RPC-021 and direct ledger-write authority remain separate open boundaries; this does not complete the approval journey, settlement/RLS/provider acceptance or whole F-F07. No migration, ledger or shared-helper change.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
bubaly	Ignored		Oct 4, 2026 7:20am UTC

[NewWorldVenture]

Independent review of PR769 at frozen 71e8f88d52d9c7420c447e2ce3a9f92a0a71268a: 56/56 candidate cases PASS in the tested application admission boundary. Reversing only the explicit-allow guard yields 12 failing desired refusals /44 passing controls. Receipt 8f260d,clean exit0,2026-10-01 15:50:04.697–15:50:11.391Z.

Actual decideInvestOrderAction, Trust bridge/engine, message formatter and role helper execute against synthetic query state. Both buy and sell approvals refuse single-approval/two-parent requirements, unreadable policies/grants, explicit policy denial and per-member deny grants before the inert settlement RPC or successful revalidation. Additional controls preserve own-family policy isolation, ignore foreign-family policies/another member's grants/unrelated capabilities, and retain healthy parent/adult approval and rejection behavior.

Two distinct parent attempts under a two-parent policy each remain refused: two actor-specific Trust audit entries, zero settlement RPCs, revalidations or generic approval requests. An already-approved generic request likewise supplies no operation-bound authorization. This clears the previous require-approval-as-allow admission defect in this candidate; it does not establish a usable approval-to-settlement workflow.

Source comparison 2e8c4d,15:50:25.942Z: reversing the single guard makes the complete action byte-identical to base916961f7 and current main01b2. Canonical app/(app)/wallet/invest/actions.ts candidate 972704cb229ae4778b510f6a2e9e116e03b608d0,base/main 7b7721893b1bff94c67d78f0048e2e32542597d0; authored test e76c04f2d598fe3ab1100585a6a00082f958de12; lib/trust/server.ts 023d0d42f4b0d684351e89c66706980428902926; lib/trust/engine.ts 69e7a82c1078ef44c4ad19607e814e3b0b7c6011; query helper cf2384f3b7e403131097013bc1a9afb66c3459ea. Current head remains unchanged/open (3e3e0b).

Authentication/current membership, client creation, translations, cache invalidation, service-writer selection and RPC execution are substituted. The RPC records arguments and returns a synthetic answer: no settlement, SQL/RLS/provider/financial SDK/live Auth/browser/production effects. No new blocker in the reviewed guard; keep ACTION-142B5EB6AC00 / ACT-119 and DB-RPC-021 separately scoped. No whole F-F07 PASS or new ID/status credit.

Initial launcher failed before execution because a remembered dependency directory was absent (3f552e); existing temporary dependencies were located without installation. Reference remains clean b87faba0 on codex/twilio-ingress-fixture-boundary-20260930,unpublished0/0; no files, source, branches or shared-ledger changes.