feat: atomically journal and deliver authorized native operation outcomes

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e747-8f27-7242-8df8-8bc44f88c929

hub_core/security/boundary.py

@@ -10,7 +10,7 @@ import hashlib
 import json
 import math
 import time
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 from importlib.resources import files
 from typing import Protocol
 from uuid import uuid4
@@ -20,6 +20,7 @@ from starlette.responses import JSONResponse
 from starlette.routing import Match
 
 from hub_core.security.identity import AccessFailure, Actor
+from hub_core.security.context import current_authorization
 
 PROFILE = "hub-core.access/1.0.0"
 
@@ -59,6 +60,9 @@ class Authorization:
     facts: LiveFacts
     correlation_id: str
     request_digest: str
+    decision_id: str = ""
+    policy_version: str = ""
+    policy_caller: str = ""
 
 
 @dataclass(frozen=True)
@@ -156,7 +160,8 @@ class AccessController:
             raise AccessFailure(401, "expired_access_token")
         if time.time() - facts.checked_at > 5:
             raise AccessFailure(503, "facts_expired_during_authorization")
-        return context
+        return replace(context, decision_id=decision.decision_id,
+                       policy_version=decision.policy_version, policy_caller=decision.caller)
 
 
 def route_key(route, method: str) -> str:
@@ -312,4 +317,8 @@ class AccessBoundary:
                                            (b"x-correlation-id", correlation.encode())])
             await send(message)
 
-        await self.app(scope, replay, protected_send)
+        binding = current_authorization.set(context)
+        try:
+            await self.app(scope, replay, protected_send)
+        finally:
+            current_authorization.reset(binding)