feat(node): mint owner-bound share upload attestations

[samgbafa]

Summary\n- add the smallest Node upload-attestation adapter for Share\n- require the current OpenKey baseline capabilities/read invocation and body-digest fact\n- reuse invocation verification, delegation/revocation state, replay cache, canonical JSON, and the pinned derived Ed25519 Share signer\n- reject ambiguous origins, malformed or oversized metadata, invalid capability/time/replay, and invalid blob metadata\n\n## Verification\n- cargo check -p tinycloud-node\n- cargo test -p tinycloud-node upload_attestation\n- cargo clippy -p tinycloud-node -- -D warnings\n- rustfmt --edition 2021 --check tinycloud-node-server/src/routes/upload_attestation.rs\n

[samgbafa]

Node head 6e198bd pushed. Added mounted upload-route authorization matrix and production n4 profile output for the joined proof. cargo fmt, focused upload-attestation tests (6), and clippy pass.

[samgbafa]

Evidence update: pushed recipient-DID policy admission and canonical validation. Node cargo check and focused canonical-policy tests pass; current origin/main was merged into this feature branch before the repair.

[samgbafa]

Repair evidence: mounted production fixture now includes a canonical recipientDid policy case for downstream production-router coverage. cargo check -p tinycloud-node-production-e2e --features mounted-fixture, cargo fmt --check, and the mounted Rocket adversarial self-test passed. The required OpenKey interactive login/session ceremony remains intentionally outside this worker.

[samgbafa]

Audit follow-up: no Node source changes were required; existing production v2 route mounting and recipient-DID policy/session/invoke enforcement were rechecked. tinycloud-node library suite: 327 tests passed. Interactive OpenKey browser/passkey ceremony remains a separate orchestrator prerequisite.

[samgbafa]

R4 audit update: Node remains unchanged at 659560b. The existing shipped v2 verifier test passes; no Node changes were made because the required mounted production recipient-DID route matrix still needs a genuine success path, and I am not claiming that gap closed.

[samgbafa]

Audit update: pushed bd8621b. Node recipient-DID policy sessions now reject the legacy marker and require a cryptographically verified, live delegation whose exact bytes/CID match the durable delegation row and whose ancestry is not revoked; holder binding also covers target origin, audience, expiry, and presentation JTI. The mounted production-e2e self-test now exercises all four v2 HTTP route mounts through Rocket with origin and malformed-body checks. Full recipient-DID success/denial route matrix remains outstanding.

[samgbafa]

R5 follow-up pushed as 6fd8920. Removed the tautological mounted v2 route smoke; the live recipient-DID HTTP matrix is exercised by the Share joined harness against the exact-head mounted Node binary. Full cargo test passes: 328 library tests plus all integration, route, and doc suites. The remaining joined proof is blocked only at the intentionally synthetic OpenKey owner-delegation boundary.

[samgbafa]

R6 verification: no Node source changes were needed for the rejected majors. cargo fmt --all -- --check, the mounted upload-attestation missing/malformed credential test, the mounted production self-test, and a live mounted no-Authorization probe passed; the probe returned HTTP 401 with Rocket exact unauthorized body. Head remains 6fd8920.

[samgbafa]

R8 audit follow-up: shipped v2 policy/session now rejects absent, empty, or non-string recipient credential at the mounted production route with HTTP 401 and exact code recipient_credential_required before session deserialization. cargo test -p tinycloud-node share_v2 --lib: 40 passed; fmt and required CI are green. Current head b97b5a4.

[samgbafa]

R9 bounded pass pushed at 5b4883f. Upload attestation now enforces exact configured Node audience, roots baseline capability/authority expiry at the actual upstream delegation, and signs a separate stable delivery idempotency key. Full Node suite: 328 unit tests plus integration suites green; v2 suite: 40 tests green.

[samgbafa]

Verification update: pushed exact-head mounted Node listen-port repair 03f1e33. Formatting, build, focused upload-attestation tests, and current PR CI pass. Joined proof remains blocked in the packed CLI loopback fetch stage; no OpenKey ceremony was fabricated.

[samgbafa]

Boundary repair update: added a focused mounted share upload-attestation regression using a signed session invocation, persisted delegation and ability rows, canonical Node audience, request-body fact, replay storage, and the real route response. Focused cargo test passes. Commit 7c0e1f8 is pushed; no deployment or merge performed.