Draft: Enforce existing token permissions in Orbit

What does this MR do and why?

Dependency: keep this MR in Draft until the protocol gem is published and the GKG behavior MR is deployed.

Pipeline 2824915813 fails on the unpublished protocol fields. The failing specs require the new permission, boundary-check, and graph-status fields. Local tests use generated bindings; the committed gem pin still needs a release.

Fine-grained personal access tokens limit Orbit data to the token's existing resource and feature permissions. The existing Authz::RedactionService checks user abilities and token permissions. It loads each resource type once across abilities. Workhorse returns each decision with its matching ability. No separate Knowledge Graph authorization service is needed.

Fine-grained token request flow

1. Rails authenticates the token and sends Orbit a signed JWT with token_authorization_required: true. The JWT contains no raw token or grants.
2. Orbit identifies the required permissions and asks Rails to check them through Workhorse.
3. Workhorse forwards the original credentials to the internal Rails callback.
4. Rails checks the token’s saved grants and returns allow/deny decisions for each permission and resource.
5. Orbit uses those decisions to filter query inputs. Final resource checks also enforce the user’s existing abilities.

References

• Relates to issue 992.
• Depends on protocol MR !2408.
• Requires deployment of GKG MR !2409.
• Adds end-to-end coverage in Robot MR !2411.
• Uses the Workhorse stream pattern from GitLab MR !229394.
• Relates to the hidden aggregate-input risk in Orbit issue 347.
• Replaces the approach in closed MR !247199.

Screenshots or screen recordings

This section does not apply because the change has no UI.

How to set up and validate locally

1. Merge the protocol MR and publish its Ruby gem through the normal release process.
2. Deploy the GKG behavior MR before this Rails and Workhorse change.
3. Update the Ruby gem to the published version before this MR leaves Draft. The committed branch keeps the current ~> 0.105.0 constraint.
4. Run the focused Rails specs. The suite completes 619 examples with no failures and 26 pending cases. The pending cases are not applicable shared examples.
5. Run RuboCop on the changed Ruby files. It reports no offenses on 16 changed Ruby files.
6. Run the Workhorse Orbit package tests. They pass with remote protocol pin v0.115.1-0.20260906215729-5ac4d8c406a3 and no Go replacement.

The Go dependency update has three additions and three deletions. It contains no unrelated dependency upgrade.

The GDK run against the shared service recorded 122 HTTP observations. All 50 formal assertions passed.

Batch authorization uses 19 SQL queries for one or ten projects, with one or two permissions. Classic resource query counts match the original service. The service contract comment and example are retained.

The Robot run passed all 20 cases: five smoke cases and 15 fine-grained token cases. Local Rails validation used a generated gem through a temporary path. That path is not committed. MR CI for the new Ruby fields must wait for the published gem.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist.

This bug fix has a changelog trailer and regression coverage. It needs Application Security review. The MR remains blocked by its protocol release and deployment dependencies.