feat(approvals): expire grants after ten minutes

[gnanirahulnutakki]

Summary

• mint one immutable PostgreSQL-clock expiry exactly 10 minutes after each new approval
• enforce the half-open lifetime in the same conditional update that guarantees single use
• bind expiry into evidence version 2 and audit format 3 while retaining mixed-format offline verification
• keep legacy, expired, missing, foreign, mismatched, and replayed grants fail closed behind one unavailable result

Security and failure behavior

• callers cannot supply approval or consumption timestamps
• expired refusal leaves the row unconsumed and appends no success audit record
• migration 0013 backfills legacy rows transactionally, marks them ineligible for the new evidence contract, and restores forced RLS before commit
• application privileges still permit updating only consumed_at
• no MCP transport, PDP, credential minting, connector execution, dispatch, shell, filesystem, generic apply, or production mutation is added

Rollout

Apply migration 0013 before format-3 writers. Upgrade verifier-capable instances before enabling approval traffic. Older writers fail closed because the new immutable columns have no permissive defaults. Sith currently exposes no supported runtime approval or dispatch API, so this ordering does not interrupt an existing write surface.

Verification

• go mod verify
• govulncheck ./...: no vulnerabilities
• make ci
• make e2e-postgres with the digest-pinned PostgreSQL 18.4 image under race: 73.0% hubdb coverage
• focused race suites
• two 50,000-execution evidence and export fuzz campaigns
• make e2e-isolation ISOLATION_FUZZ_BUDGET=100000x: 76.7% hubdb coverage plus two 100,000-execution tenant-isolation fuzz campaigns
• make release-check: reproducible archives, SPDX SBOMs, Homebrew formula, and two-platform OCI layout
• make e2e-kind KIND=/Volumes/EXTENDED/MacData/tools/bin/kind
• CodeRabbit CLI 0.6.5 second full review: no findings

Closes #299
Tracks bounded F5.9b work under #23; it does not complete parent F5.9.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 23dba32d-5a3e-4083-8a44-9227b35c618a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch gnanirahulnutakki/approval-expiry-20260721

---

_{Comment @coderabbitai help to get the list of available commands.}