feat(server): add environment-aware asset relay

[wizzoapp]

Summary

• add authenticated per-surface /_asset-relay/:claim handling with masking 404s
• extend signed private-asset claims with backward-decodable issuing audience and backend identity
• re-mint surface proof only server-side and forward remote claims to the exact registered issuer over the existing trusted peer channel
• require same-origin-relay-v1; no client URL rewrite, bearer URL, cross-site cookie, or browser redirect fallback is added

Binding design: /home/adam/.openclaw/reports/app-origin-asset-relay-design-2026-07-21.md

Verification

• vp test run packages/contracts/src/assetClaims.test.ts apps/server/src/http.test.ts apps/server/src/assets/AssetAccess.test.ts apps/server/src/server.test.ts — 4 files / 157 tests passed
• contracts and server tsgo --noEmit passed
• targeted formatting and lint passed
• factory pre-commit gate passed: static checks + clean Codex review
• explicit pinned Codex gpt-5.5 branch review passed after refuting one Effect-version false positive against the pinned API and a fresh typecheck
• full workspace run: every non-server package passed, including web (175 files / 1,651 tests); the final server Vitest worker exited without emitting a result and left its coordinator hung. A standalone full server-package rerun reproduced that runner failure after ~14 minutes without a failing assertion. The changed server integration file is included in the green 157-test focused run above.

Security assertions

• factory-ceiling session + private claim returns masking 404
• unauthenticated relay returns masking 404; same-surface/private-ceiling relay succeeds
• issuer routing uses exact environment ID and permits only server-held bearer plus optional Cloudflare service-token credentials
• browser-bound Cloudflare cookie/JWT credentials are rejected; upstream redirects, Set-Cookie, and Location are never propagated
• old-client/new-server issuance returns AssetClientUpgradeRequiredError

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6065c6cfc6

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 20655317ef

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[adamfgr]

Auto-approved by wizzo-approve: all policy conditions verified against HEAD 2065531.