Upstream Mike PR #333 review

[github-actions]

Automated-Upstream-Mike-Sync: true
Upstream-Risk: high

Promising access-consistency fix, but it changes a tenant/data boundary and requires explicit architectural approval plus migration validation.

Mike PR open-legal-products#333

• Outcome: needs-decision
• Capability: Canonicalize project-sharing email identities so access is case-insensitive and whitespace-safe across detail, listing, audit, overview, and export paths.
• Series: project-sharing-email-canonicalization
• Dependencies: Existing normalized POST/PATCH project-sharing writes, projects.shared_with JSONB containment queries and GIN index, Project overview/filter RPCs, Central project access helper
• Prerequisites: Inventory every project-sharing authorization and collection-query seam, Validate legacy shared_with data shape and normalization impact on a production-like database, Test owner/shared/non-member access across mixed-case, whitespace, duplicate, blank, and malformed entries, Confirm RPC and application checks use one canonical email rule, Review migration rollback, locking, query plans, and tenant-isolation behavior
• Reason: Current ROSS already normalizes new project-sharing writes and performs partial case-insensitive checks, but indexed collection queries and some routes still require exact stored values. PR fix: make project sharing email matching case-insensitive open-legal-products/mike#333 addresses that inconsistency, yet its data rewrite and authorization changes affect schema and tenant boundaries and cannot be safely adopted without explicit review.

Architecture brief

Define one ROSS email canonicalization contract at the authentication/access boundary, apply it consistently to project-sharing writes and all read/query seams, and backfill projects.shared_with with a reviewed idempotent migration. Preserve centralized checkProjectAccess authorization and JSONB index compatibility; separately assess whether tabular-review and workflow sharing belong to the same series.

Implementation plan

• Map all direct shared_with comparisons, containment filters, RPC parameters, exports, and audit queries in current ROSS.
• Add authorization-focused unit and integration tests proving identical decisions for canonical and mixed-case identities without cross-tenant access.
• Review and rehearse an idempotent legacy-data migration, including duplicate removal, malformed JSONB handling, locking, rollback, and query plans.
• Implement a shared canonicalization helper and route project detail access through checkProjectAccess; update collection/RPC seams only after their database contracts are verified.
• Run migration and access-control tests against a production-like snapshot, then obtain security/data-boundary approval before release.

Required human action

This is a draft state-only architecture record. Review the brief and implementation plan before any code is attempted.