[JaeTierce31]

Purpose

Stacked on PROP-OPS-AUTHZ-HARDEN-001, this PR introduces one implementation-independent authorization oracle for Property Ops and an adversarial Vitest fixture suite.

The oracle encodes DB-derived authority and explicitly proves that client-controlled role/org/property/unit hints cannot change authorization decisions when authoritative actor/resource state is unchanged.

Added

• src/security/authz-oracle.ts
• src/test/authz-oracle.test.ts
• docs/evidence/J3S-AUTHZ-ORACLE-001.md
• isolated J3S-AUTHZ-ORACLE-001 Verification workflow

Initial executable invariants

• active-membership fail-closed behavior
• organization boundary
• resident-of-record + unit scope
• manager property scope
• worker assignment scope
• scoped membership visibility
• ops-only direct outbox visibility
• bounded same-org outbox enqueue
• forged authority-input noninterference
• cross-property/cross-unit IDOR denial

Governance state

CANDIDATE / merge-blocked.

This PR does not promote AUTHZ-HARDEN to PASS. It still requires parity adapters that execute the same oracle cases against:

1. application authorization behavior;
2. PostgreSQL RLS (USING + WITH CHECK mutation semantics);
3. the authenticated /api/property-ops/* surface with real signed identities.

The existing signed-token, true two-connection audit-lineage, closed-loop plumbing, observability, PITR, and rollback blockers remain in force.