[alexanderguy]

Summary

• Each condition evaluator exposes a validate built from the same arktype schema as its evaluate, so boundary checks and evaluation read one set of shape rules. validateGrantConditions checks a grant's conditions against every registry that evaluates the grant: the hub's, and for a row on a workflow run's principal, also the run child's (time_window) and the credential gate's (tool), where the row's patterns reach them.
• POST and PATCH /api/tenants/:tenantId/grants return a 400 that lists each problem when a grant's conditions cannot be evaluated, and store nothing. The probe gate refuses a workflow definition whose declared grant requirement carries such conditions, with the reason grant_requirement_conditions_invalid, before the operator approval checks.
• A condition key that names an inherited object member, such as constructor, is an unknown condition. Evaluation still throws on any stored condition it cannot evaluate.

Verification

• make all exits 0 on the branch tip: lint, the API docs check, tsc -b --force, the admin-ui bundle, and the tests with the DB-backed suites enabled.
• tests/hub-api/grant-routes.test.ts covers the create and update 400s against a real database, including run-principal, credential-use and role-grant cases, and checks that a rejected request leaves the stored row unchanged. workflow-probe-gate.grants.test.ts covers the gate refusals and their order before the approval check.

Closes INTR-292

[alexanderguy]

Self-Review (code-review skill)

The branch carries the following intentional exceptions, each authorized
by Greybeard:

• packages/hub-sessions/src/workflow-probe-gate.ts:716: the probe gate validates declared requirements against the constant HUB_CONDITION_REGISTRY, while the grant routes use the mount's conditionRegistry. No createApp or mountHubRoutes caller injects a registry, so both validate against HUB_CONDITION_REGISTRY, and the unused option is a pre-existing seam on main. Authorized by Greybeard on grounds of churn-avoidance: a registry parameter on the gate's call chain would carry only the constant.

[linear]

INTR-292