feat(core): add request-scoped action surfaces - #2811
Potential issues to review
Code Review Summary
Reviewed the latest incremental PR #2811 with three parallel code-review passes. The new request-context isolation guard is now present: request-scoped action surfaces reject the non-isolated fallback, and the prior authorization-leak comment was verified fixed and resolved. Durable continuations, organization binding, sandbox bridges, malformed persisted surfaces, and action-surface propagation showed no new confirmed regressions.
The previously reported fallback-test timeout remains reproducible when request-context-fallback.spec.ts is run in isolation with Vitest's default timeout; it was intentionally not reposted because its existing review comment remains open. No additional actionable issues were found in this incremental diff.
Risk assessment remains high because the feature controls per-request authorization boundaries.
🧪 Browser testing: Skipped — PR only modifies backend/config/docs, no UI impact