[jeremi]

Summary

Require current executor authority and the exact retained submission task grant for every new BReg Proposal application. Recheck status before Review/Evidence, validate the binding inside the mutation transaction, and enforce expiry through the final commit fence. Preserve completed receipt recovery and cancellation.

Require Get inspection and a single profile combining Cancel with Get or List when activating a successor package with pending Proposals. Expand human access reports to show actor, client, task, target, input, attachment, ownership and system-apply gates. Correct target-warning classification and source locations, and preserve bounded refusal diagnostics after timestamp-lock poisoning.

Keep the security catalog, PostgreSQL test inventories and shared test-helper lint annotations consistent with these checks. Add the release note for the shared P-256 security update already present in main.

Verification

Post-integration local checks:

• 140 focused BReg tests passed, including all 55 Proposal workflow tests, the 12 new PostgreSQL authority/recovery tests, and generated-identifier integration.
• 603 BReg CLI unit tests and 178 command-line journeys passed; four maintained unit tests remain ignored.
• Both bounded refusal-diagnostic unit regressions passed.
• BReg catalog validation and its 42 unit tests passed.
• All-target, all-feature Clippy passed for BReg and its CLI with warnings denied. Formatting, shell checks and independent integration reviews passed.

Current-head protected CI and merge-queue checks must finish before merge.

Earlier broad local verification had a timing-sensitive pagination failure that passed alone; the focused integration run above passed. Environment-dependent live/native/TLS journeys were not enabled locally.

Notes

No database migration or wire-format change. Security review notes, task-grant documentation and invariant traceability are updated. Remote revocation after status observation still cannot be atomic with a local PostgreSQL commit; local expiry is enforced. Static recovery validation establishes a permission path, while operators must provision an identity satisfying it.

DCO

• Every commit includes a Signed-off-by trailer.
• I reviewed the submitted changes and am responsible for the contribution.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T18:39:16.014640Z	a42a231	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.