[intel352]

Scoped preview viewing must cover a specifically approved request such as /contact?interest=voice-study without granting arbitrary query variants. Keep PreviewGrant.Paths as finite exact canonical request targets. Keep Resource.Path as the matched bare path and add a preview-only raw Query binding. Authorization compares the complete target against both the current persisted grant and the tenant declaration; a bare path grants no query variants.

Validate targets during declaration, durable grant validation/loading and resource use. Bound target/query sizes and key count; require unique sorted literal unreserved keys/values. Refuse encoded aliases, duplicate/extra keys, empty values, fragments and unexpected methods/tenant/origin/audience. API and history path/query handling remains separate. No schema, token issuer, owner/session or credential behavior changes.

Meaningful service tests exercise exact GET/HEAD authorization, current-grant narrowing, independent tenant ceilings, API query refusal, invalid declarations and invalid stored-grant exchange. Local checks are formatting and git diff --check; exact-head native CI and independent source review remain required. No local Go/Docker/build or hosted writes occurred.

This branch preserves reviewed Auth63/64/65 and adds the query extension on exact Auth65 05097c9d8967dc81a975f8f2b3c0764c25fe5c34. It targets current main to run ordinary upstream native CI for the complete source. The original prerequisite heads/branches are unchanged; the authorized prerequisite merge chain and normal protection/retarget checks remain separate. CMS must also declare its finite per-tenant query ceiling, and the host must bind the actual raw query. Keys, grants and activation remain held.

[intel352]

Closing as incorporated by merged #63/#68 (#68). Rechecked exact predecessor head 7971f869c9dfadf39f9cc29c02d672c89dfa4438. Accepted integration commit fc6471e910bbb069b3c9d00905eae7cfc15e7f11 has the identical complete tree 0ce49a9627becb396225f8ec7c7cf12536f4419c. No unique source work remains in this predecessor. The branch, commits and historical receipts are retained; this closure grants no credential or hosted activation authority.