Add file tracking via Drive Properties (origin, acl, permitted_by)

[44103]

Summary

Track myg file operations using Drive PRIVATE Properties to record creation, access control, and who last set the permission.

Motivation

• Know which files were created via myg (created=y)
• Track what level of access myg has been granted (acl)
• Know who last changed the access level and when (permitted_*)
• Foundation for future access control (Phase 2)

Properties Schema

Key	Value	Description	Mutable?
created	y	File was created via myg. Absent means created externally.	No
acl	w / r / -	Current permission level. w implies read. - means explicitly denied.	Yes
permitted_local	email local part	Who last set/changed the acl	Yes (overwritten on acl change)
permitted_domain	email domain part	Same as above	Yes (overwritten on acl change)
permitted_at	ISO timestamp	When acl was last set/changed	Yes (overwritten on acl change)

• All properties use visibility: PRIVATE (only accessible from this GAS project)
• created=y is set only at creation time, immutable
• permitted_* is overwritten whenever acl is set or changed (records last modifier)

Commands

myg file props id=<FILE_ID>    # Show myg tracking properties

Tracked Operations

Creation (sets created=y, acl=w, permitted_*):

• doc create, spreadsheet create, file upload, file mkdir, slide create, form create

Write (sets acl=w if not already w, updates permitted_*):

• doc append, doc overwrite, sheet write, slide addtext, slide overwrite, slide note set/clear

Read (sets acl=r only if acl does not exist yet, updates permitted_*):

• file (download)

Future (Phase 2)

• Block access to files without acl property (require explicit myg file permit)
• myg file permit id=<FILE_ID> acl=w with mandatory stdin confirmation
• acl=- to explicitly deny access
• Reset: delete only the acl property (created and permitted_* remain) to return to unconfirmed state
• Check parent folder properties for inherited access control
• Drive Labels API integration (pending GCP admin approval)