Implement authorization-fenced web workflows

docs/api/README.md

@@ -101,6 +101,11 @@ unauthorized, absent, and never-committed results are not exposed. The hard
 delete endpoint returns the durable deletion resource established by the
 architecture.
 
+Exact member access returns a non-cacheable time-limited URL after current
+authorization is revalidated. This JSON exchange lets a bearer-authenticated
+browser deliberately navigate to the target URL without relying on an
+unobservable cross-origin fetch redirect.
+
 Before hard deletion, job reads return the complete `job` projection. Once only
 the permanent minimal record remains, authorized reads and deleted-job pages use
 the distinct `tombstone` projection rather than inventing discarded job fields.

docs/api/openapi.yaml

@@ -120,22 +120,20 @@ paths:
           $ref: '#/components/schemas/OpaqueId'
     get:
       operationId: accessJobResultMember
-      description: Revalidates current authorization and redirects to a time-limited URL for the exact committed member identity.
+      description: Revalidates current authorization and returns a non-cacheable time-limited URL for the exact committed member identity.
       responses:
-        '307':
-          description: Temporary redirect to the exact committed member. The URL is sensitive and must not be logged or cached.
+        '200':
+          description: Time-limited exact-member access grant. The URL is sensitive and must not be logged or cached.
           headers:
-            Location:
-              description: Time-limited member URL.
-              required: true
-              schema:
-                type: string
-                format: uri
             Cache-Control:
-              description: Prevents caching of the credential-bearing redirect response.
+              description: Prevents caching of the credential-bearing response.
               required: true
               schema:
                 const: no-store
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ResultMemberAccess'
         '404':
           $ref: '#/components/responses/NotFound'
         '409':
@@ -1450,6 +1448,19 @@ components:
             $ref: '#/components/schemas/ResultMember'
         next_cursor:
           type: [string, 'null']
+    ResultMemberAccess:
+      type: object
+      additionalProperties: false
+      required: [url, expires_at]
+      properties:
+        url:
+          type: string
+          format: uri
+          pattern: '^https?://'
+          description: Sensitive time-limited HTTP(S) exact-object URL.
+        expires_at:
+          type: string
+          format: date-time
     Job:
       type: object
       additionalProperties: false
@@ -1546,7 +1557,7 @@ components:
     JobPage:
       type: object
       additionalProperties: false
-      required: [items, next_cursor, event_cursor]
+      required: [items, next_cursor, event_cursor, management_capabilities]
       properties:
         items:
           type: array
@@ -1557,6 +1568,16 @@ components:
         event_cursor:
           type: string
           minLength: 16
+        management_capabilities:
+          $ref: '#/components/schemas/ManagementCapabilities'
+    ManagementCapabilities:
+      type: object
+      additionalProperties: false
+      required: [revoke_execution_grants]
+      properties:
+        revoke_execution_grants:
+          type: boolean
+          description: Current caller may administratively revoke accepted execution grants.
     AttemptRecord:
       type: object
       additionalProperties: false