[codex] Harden Staff identity provisioning anchors

[SadPossum]

Summary

Hardens Staff identity provisioning for Workspace onboarding as an exact, durable, fail-closed cross-module protocol.

The implementation gives Staff ownership of the provisioning anchor and its one-time resolution coordinate, gives Workspaces ownership of the continuation coordinate and local convergence ledger, and serializes lifecycle/access mutations so retries, crashes, stale events, subject changes, and concurrent suspend/resume/depart paths cannot silently grant or resurrect access.

What changed

• Persist Staff-owned random resolution event coordinates and Workspaces-owned random continuation coordinates; remove algebraically derived cross-domain IDs.
• Enforce exact anchor, target, event, application-version, disposition, and causal-time relationships in application code and PostgreSQL.
• Add two-pass onboarding convergence with redaction before property reconciliation/grant, exact replay, terminal resolution, and later Staff observation.
• Fence Staff lifecycle and Workspaces access processes across Active, Suspended, Departed, Anonymised, mismatch, and missing-authority outcomes.
• Persist restoration disposition (NotApplicable, RestoreSnapshot, Suppressed) and prevent automatic access resurrection after negative subject-bound resolution.
• Block Staff auth-subject changes while any Workspace-onboarding anchor exists; retain governed resolved anonymisation as the narrow exception.
• Add the bounded recurring identity-anchor sweep with monotonic ordinals, fixed high-water cycles, fresh transaction scopes, repair of lost continuation/resolution delivery, status, worker wiring, and crash/retry isolation.
• Add exact Staff/Workspaces cutover inspection and bounded Organizations evidence export for migration/backfill reconciliation.
• Add serialized onboarding profile-read/mutation authority checks, privacy-minimal actionable projections, tenant-wide subject mutation fences, and fail-closed bulk export preflight.
• Add governed historical no-provision review receipts, Admin CLI operations, append-only proof, cutover/sweep exclusions, export, and destruction lifecycle.
• Extend personal-data catalogs, inventories, Data Rights exports, tenant-termination exports, retention/destruction stages, module metadata, and operational documentation.
• Add provider-level concurrency, migration, replay, rollback, lifecycle, cutover, export, anonymisation, and destruction proofs.

Dependencies and stacking

• This branch currently contains the four commits from draft BunkFy PR [codex] Harden workspace onboarding withdrawal recovery #11 because that branch was the starting point. Land or rebase the stack deliberately; do not count those commits twice.
• The Organizations submodule intentionally points to e2d0755e6b3b6f765f120029e40bdbd69e9120ac from [codex] Expose exact membership lifecycle snapshot GMA-Module-Organizations#14. That draft PR supplies the exact membership lifecycle snapshot API consumed here.
• perf(organizations): index membership scope export GMA-Module-Organizations#15 is the pending membership-export index/performance prerequisite. It is not yet represented by the recorded submodule pointer; refresh to the combined Organizations dev after [codex] Pin patched SSH.NET across backend test harness #14 and [codex] Add bounded manual Inventory block groups #15 land.
• [codex] Scope JetStream dedupe by subject GMA-Framework#22 is the pending subject-qualified JetStream deduplication hardening. It is not yet represented by the recorded Framework pointer and should land before production rollout.

All four dependency PRs (#11, Organizations #14/#15, Framework #22) are currently draft/open with green checks. This PR does not merge them.

Current draft CI state

• Security Baseline and Trivy are green.
• Ubuntu and Windows fast validation currently stop at the intentional GMA submodule dev-head gate: Organizations is recorded at PR [codex] Pin patched SSH.NET across backend test harness #14 commit e2d0755, while that module's origin/dev is still 50f736d.
• This is a dependency-order block, not a product-test failure; later CI validation steps are not reached.
• Do not bypass or weaken the submodule guard. Land Organizations [codex] Pin patched SSH.NET across backend test harness #14 (and [codex] Add bounded manual Inventory block groups #15 for the export index), refresh this repository to the resulting Organizations dev commit, then rerun the full PR checks.

Database and deployment contract

New protocol migrations:

• Staff: 20260811110753_AddStaffIdentityProvisioningAnchors
• Workspaces: 20260811205004_AddWorkspaceStaffIdentityProvisioningAnchors

This is intentionally not rolling-compatible with predecessor writers. Production rollout must follow the stop/drain contract in docs/architecture/workspaces-and-onboarding.md:

1. stop and drain all affected API, Admin, Worker, and direct-writer processes;
2. apply the Staff migration, then the Workspaces migration, from the same artifact;
3. deploy all affected processes together and prohibit old binaries after cutover;
4. verify anchor/sweep/ledger/backlog exit criteria before reopening writes;
5. retain backup/restore and guarded downgrade evidence.

The repository documents this procedure, but this PR contains no evidence that it has been executed in a hosted environment. No deployment or migration was performed by this work.

Verification on final commit b4e3865b

• Fresh solution build: 0 warnings, 0 errors.
• All 42 test projects with fresh builds and Category!=Docker: 5,482/5,482 passed, 0 failed, 0 skipped.
• Affected real-PostgreSQL matrix: 41/41 passed, including both migrations, writer races, lifecycle interleavings, subject/profile fences, sweep transaction isolation, cutover, Data Rights, anonymisation, and destruction.
• Architecture: 103/103 passed.
• EF migration drift: 21/21 projects clean.
• Solution sync, source-package, repository-security, release, and diff gates passed.
• NuGet vulnerability scan: all 296/296 projects reported no known vulnerable direct or transitive packages.
• Submodule gate: 9/10 aligned with module dev; the only intentional nonzero is Organizations [codex] Pin patched SSH.NET across backend test harness #14 described above.

The final Workspaces migration body is pinned by SHA-256 54517bfd15b9a2ba4f54eca8c6afcbfe25ae514e412643b595f52af8991a671f in the local verification record.

Readiness boundary

This is a code-and-local-provider proof, not a production-readiness or launch claim. Before marking ready, resolve the stacked/dependency PRs, refresh the Organizations/Framework pointers, execute and record the stop/drain migration rehearsal, backup/restore proof, deployed smoke tests, worker/sweep health, and operational approval.

Draft only. Do not merge or deploy from this PR yet.