feat(sharing): add recipient onboarding journeys

[kunickiaj]

Description

Adds recipient-aware onboarding for Team members, direct Project recipients, and additional devices while keeping authorization changes deferred to PR 7.

• adds preview-first Team and add-device invitation journeys with current Projects, memory counts, future inheritance, and exclusions
• binds invitations to one Identity, device, and public-key fingerprint with fail-closed conflict handling
• persists IdentityDevice, TeamMembership, and exact direct ProjectRecipient intent without changing scopes, grants, mappings, epochs, or replication state
• bridges existing exact Project invitation acceptance into recipient-policy intent without creating Team membership
• adds explicit coordinator invite kinds and additive D1 migration 0009
• preserves legacy pairing and coordinator invitations as enrollment-only compatibility paths
• replaces the Sharing Invitations placeholder with accessible create/review/accept flows

Type of Change

• 🚀 Feature (new functionality)
• 🐛 Bug fix (fixes an issue)
• 📚 Documentation (docs-only change)
• 🔧 Maintenance (refactor, chore, CI, etc.)
• 🧪 Testing (test-only changes)

Testing

• Relevant checks pass locally (pnpm run tsc, pnpm run lint, pnpm run test)
• Added/updated tests for changes
• Manually verified changes work as expected

Additional validation:

• 2,921 tests passed; 3 existing todos
• Cloudflare Worker Node and integration suites passed
• Snyk scan of the onboarding engine: 0 high-severity issues
• independent security/correctness review: no remaining medium-or-higher findings
• cross-journey binding, stale-preview, replay conflict, authorization-negative, SQLite, and D1 coverage added

Checklist

• Code follows project style (pnpm run lint passes for touched files)
• Self-review completed
• Documentation impact reviewed; approved design and implementation plans already describe this slice
• No new warnings introduced

[kunickiaj]

• feat(sharing): promote Devices navigation and proof #1346
• feat(sharing): reconcile recipient policy access #1344
• fix(sharing): preserve inviter policy during acceptance #1345
• feat(sharing): add recipient onboarding journeys #1343 👈 (View in Graphite)
• feat(sharing): add bidirectional recipient management #1342
• feat(sharing): persist recipient policy intent #1341
• feat(sharing): add actionable migration review #1340
• feat(sharing): project legacy recipient policy #1339
• feat(sharing): define recipient policy contracts #1338
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6d44616fc6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d2fa61f4c7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 05eae6218d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: de48cb5539

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d043ba17a9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

codemem/packages/viewer-server/src/routes/sync.ts

Line 5305 in e77a38e

recipientActorId: store.actorId,

Adopt the target identity for add-device accepts

When an add-device invitation is accepted on a fresh profile, this explicit store.actorId overrides coordinatorImportInviteAction's fallback to the invite's target_identity_id; fresh evidence is that the viewer import route still supplies the fallback-local actor even though the core action now only adopts the target when no explicit/configured actor is present. In that common new-device flow the UI can inspect an add-device invite but import rejects it with invite_identity_conflict unless the profile was already configured with the invited identity, so pass the decoded target identity (or omit recipientActorId) for add_device invites.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kunickiaj]

Merge activity

• Jul 22, 9:25 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jul 22, 9:47 PM UTC: Graphite rebased this pull request as part of a merge.
• Jul 22, 9:54 PM UTC: @kunickiaj merged this pull request with Graphite.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6f5d627870

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Build recipient previews from invite data

When a Team-member invite is opened on a fresh recipient profile, this rebuilds the onboarding preview from the recipient's local policy tables via recipientInviteOnboardingPreview; that profile does not yet have the inviter's policy_teams/project_recipients rows, so the helper throws team_not_found (and similarly add-device can throw identity_not_found) before the user can review or accept the invite. The inspect path needs to use policy/team/project details carried by the invite/coordinator response, or otherwise seed enough data for the preview, rather than requiring the recipient to already have the policy state being invited into.

Useful? React with 👍 / 👎.