[intel352]

Auth63 is accepted on main 8cdbeec07d3431d2830d9bb0fd58385384d9c69a. This consolidates the remaining wrapped current-policy handling, mobile scope wrapping, finite canonical preview-query authorization and reviewed whole-second UTC owner expiry into one main-targeted PR.

Exact candidate: 47338ad69fd10eb10a1f5eb915e64e8248e4c50b; tree 9141fca123397bcdb55f37d80e8c35362374567d. All ten changed files reproduce frozen Auth64–67 source. Each ordinary cherry-pick has the same complete tree as its original commit; the final tree equals frozen Auth67 8a3d10561fc64a0498786c5fa5904ddf483bd8cb. Original PRs/refs and source/CI receipts are preserved. This is the smallest complete remaining Auth merge set; the original stacked PRs remain source history.

Independent full ten-file source review reports no findings across all fifteen classes. New exact-head CI38101006191 passes race/vet, all seven native PostgreSQL17 groups, both wrapped-current-policy regressions, both finite-query tests and thirteen query negatives:211 top-level PASS,356 PASS events,zero SKIP/FAIL. Contracts, gRPC sync and configured CodeQL actions/aggregate also pass:all five checks terminal SUCCESS. Actual synthetic merge d8ac732d41d490e70c9ff25df192c5cac5764990 has parents main8cd plus head473 and exactly the reviewed tree9141. Native synthetic fixture execution is distinct from JavaScript/browser or deployed managed-issuer acceptance.

Immutable independent receipts: verification/auth-agent-combined-independent-review-47338ad-2026-10-11.md SHA256 b1dd390a7223af3e6b321d15bc3d3bde79aadd2cce7945280b92cf11d2e0faab; verification/auth-agent-combined-independent-ci-47338ad-38101006191-2026-10-11.json SHA256 c50399ec0037682c8568e09b8666cb157add22253bb5d565c956d6359844dd5f. Exact matched consumer source add047c runs separate native/browser/repeated-build checks; its earlier8c receipts remain historical.

This draft retains normal review and protection gates. It has zero human reviews and requires one GitHub approval. Jon's completed override explicitly applied only to Auth63 169e5e6; it does not authorize bypassing Auth68's missing review or any other protection. No further override, merge, tag, credential/grant creation or activation occurred. A changed head/base requires fresh tree/check acceptance.

Proposed next stable release:v0.5.0. Latest stable Auth is v0.4.0; v0.5.0 was absent at the current read and is not reserved. After exact-source acceptance, verify actual-main tree/CI and use the existing tag-triggered contract/runtime/GoReleaser release workflow. It supplies manifest/build version and download metadata from intentional source templates. Actual capability execution, all four platform archives, checksums and manifest are required. Stable Auth/Compute-owned Workflow/CMSv0.1.9 consumer integration, matched deployment and explicit custody/profile/grant approval remain separate activation gates.