Implement authenticated custody observations and durable root-grant baseline

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29

tests/test_account_authority.py

@@ -62,8 +62,25 @@ class AccountAuthorityTests(unittest.TestCase):
         self.store.find_identity = checked
         with self.assertRaises(AuthorizationDenied): self.lookup()
 
+    def test_custody_mapping_only_after_independent_authorization(self):
+        calls = []
+        class Custody:
+            def observe(inner, **values):
+                calls.append(values)
+                return {"fixture": "observed-fact"} if values["tenant"] == "platform" else None
+        self.service.custody = Custody()
+        result = self.lookup(tenant="platform")
+        self.assertEqual(result.root_grant, {"fixture": "observed-fact"})
+        self.assertEqual(calls[-1], {"issuer": self.session.actor.issuer, "subject": self.session.actor.subject, "tenant": "platform"})
+        self.policy.effect = AuthorizationEffect.DENY
+        with self.assertRaises(AuthorizationDenied):
+            self.lookup(tenant="platform")
+        self.assertEqual(len(calls), 1)
+
+
     def test_does_not_emit_root_grants_or_profile_details(self):
         result = self.lookup()
+        self.assertIsNone(result.root_grant)
         self.assertFalse(hasattr(result,'root_entitled'))
         self.assertFalse(hasattr(result,'roles'))
         self.assertFalse(hasattr(result,'primary_email'))