matrx-orm 3.1.170__tar.gz → 3.1.172__tar.gz

{matrx_orm-3.1.170 → matrx_orm-3.1.172}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: matrx-orm
-Version: 3.1.170
+Version: 3.1.172
 Summary: Async-first PostgreSQL ORM with bidirectional migrations, schema introspection, many-to-many relationships, and built-in state caching
 Project-URL: Homepage, https://github.com/AI-Matrix-Engine/aidream-current
 Project-URL: Repository, https://github.com/AI-Matrix-Engine/aidream-current

{matrx_orm-3.1.170 → matrx_orm-3.1.172}/matrx_orm/core/rls_session.py

@@ -98,12 +98,28 @@ async def rls_session(
                 details={"role": role},
             )
         # Set the verified claims FIRST (while still the privileged role), then drop to
-        # the restricted role. Order mirrors PostgREST; both are transaction-local and
-        # survive the role switch within the same transaction.
-        await conn.execute("select set_config('request.jwt.claims', $1, true)", claims_json)
+        # the restricted role. Order mirrors PostgREST; all of them are transaction-local
+        # (`set_config(..., true)` IS `SET LOCAL`) and survive the role switch within the
+        # same transaction.
+        #
+        # ONE ROUND TRIP, NOT FOUR. These were four sequential `execute` calls, and a
+        # round trip to a hosted pooler is not free: measured 2026-09-19 against the main
+        # database, the three that always run cost 0.247 + 0.085 + 0.105 = 0.437 s
+        # separately and 0.192 s as one statement — so every RLS session on the platform
+        # paid a quarter of a second to say three things it could say at once. They are
+        # emitted in the SAME ORDER inside one target list, which is the order that
+        # matters: the claims land before the role drops. `SET LOCAL ROLE x` and
+        # `set_config('role', 'x', true)` are the same GUC write, so the role still
+        # changes here and nowhere else, and `role` stays LAST.
+        settings: list[str] = ["set_config('request.jwt.claims', $1, true)"]
+        bound: list[str] = [claims_json]
         if statement_timeout_ms is not None:
-            await conn.execute(f"SET LOCAL statement_timeout = {int(statement_timeout_ms)}")
+            bound.append(str(int(statement_timeout_ms)))
+            settings.append(f"set_config('statement_timeout', ${len(bound)}, true)")
         if lock_timeout_ms is not None:
-            await conn.execute(f"SET LOCAL lock_timeout = {int(lock_timeout_ms)}")
-        await conn.execute(f"SET LOCAL ROLE {role}")
+            bound.append(str(int(lock_timeout_ms)))
+            settings.append(f"set_config('lock_timeout', ${len(bound)}, true)")
+        bound.append(role)
+        settings.append(f"set_config('role', ${len(bound)}, true)")
+        await conn.execute("select " + ", ".join(settings), *bound)
         yield

{matrx_orm-3.1.170 → matrx_orm-3.1.172}/matrx_orm/secrets_battery/FEATURE.md

@@ -66,7 +66,7 @@ remains atomic.
 
 **Native source admission (`native_source.py`).** `validate_native_source` is the server reader of the provider's exact source-v1 byte format; Rust remains the encoder and authenticator. It requires an explicit positive source-size limit, preserves nullable names and bytes, rejects duplicate/noncanonical JSON and COSE, and derives public metadata only after maintained P-256 key-pair validation. The result is provider-custody data, never a response model or generic field. `repr` and fixed failures omit material. `scripts/check_native_source_parity.py --rust-core <native-vault-provider/core>` compares the real compiled Rust reader against the server corpus; no mocked oracle. This prerequisite adds no creator, materializer, database row or native readiness. Verified September19 against132 focused tests and525 cross-language cases.
 
-**Native lifecycle component (`native_lifecycle.py`).** The shared coordinator must supply locked parent/child projections from the exported field constants, current host management authority and its active transaction. Inspection locks the exact native metadata child; component delete/restore mutate only that child's tombstone and lifecycle. Deletion accepts active and restored-quarantined sources; recovery compares aware ISO manifest timestamps to database timestamps. Personal metadata provenance is enforced by the database guard, never inferred from the request scope. Coordinator/preview integration and actual aggregate database acceptance remain pending; these helpers alone do not enable protected recovery. Contract: [native lifecycle](../../../../../common-docs/projects/credential-sharing-browser-login/NATIVE-LIFECYCLE.md).
+**Native lifecycle component (`native_lifecycle.py`).** The shared coordinator must supply locked parent/child projections from the exported field constants, current host management authority and its active transaction. Inspection locks the exact native metadata child; component delete/restore mutate only that child's tombstone and lifecycle. Deletion accepts active and restored-quarantined sources; recovery compares aware ISO manifest timestamps to database timestamps, then parses the already-validated manifest instant only at the typed native restore mutation boundary. Personal metadata provenance is enforced by the database guard, never inferred from the request scope. Coordinator/preview integration and actual aggregate database acceptance remain pending; these helpers alone do not enable protected recovery. Contract: [native lifecycle](../../../../../common-docs/projects/credential-sharing-browser-login/NATIVE-LIFECYCLE.md).
 
 **`inject_into_sandbox=true` REQUIRES an env alias — refused otherwise.** A
 container environment is a NAME→value map, so a field with `key IS NULL` has
@@ -365,6 +365,8 @@ delete).
 
 ## Change Log
 
+- **2026-09-19** — Restored native lifecycle metadata with the parsed, timezone-aware manifest instant at the typed mutation boundary, preserving the manifest string for aggregate integrity checks.
+
 - **2026-09-19** — Added transaction-owned native lifecycle component operations, quarantine deletion and aware timestamp validation; aggregate coordinator integration remains open.
 
 - **2026-09-19** — Added `native_enable.py`, a transaction-required, value-free

{matrx_orm-3.1.170 → matrx_orm-3.1.172}/matrx_orm/secrets_battery/items.py

@@ -896,17 +896,26 @@ async def delete_credential_item(
         raw = await _lock_item_raw(item_id)
         from .attachments import soft_delete_item_attachments
 
+        # Keep the native lifecycle's complete locked projection here.  The
+        # classifier deliberately owns the metadata lock, while the aggregate
+        # coordinator remains the only author of parent/source changes.
+        from .native_lifecycle import (
+            NATIVE_LIFECYCLE_ATTACHMENT_FIELDS,
+            NATIVE_LIFECYCLE_FIELD_FIELDS,
+            delete_native_component,
+            inspect_native_lifecycle,
+        )
+
         fields = await (
             UserSecret.filter(credential_item_id=item_id, deleted_at__isnull=True)
-            .select_for_update().order_by("id")
-            .values("id", "is_active", "user_id", "organization_id")
+            .select_for_update().order_by("id").values(*NATIVE_LIFECYCLE_FIELD_FIELDS)
         )
         for child in fields:
             if child.get("user_id") != raw.get("user_id") or child.get("organization_id") != raw.get("organization_id"):
                 raise CredentialRestoreConflictError("credential field ownership does not match parent")
         attachments = await (
             CredentialAttachment.filter(credential_item_id=item_id, deleted_at__isnull=True)
-            .select_for_update().order_by("id").values("id")
+            .select_for_update().order_by("id").values(*NATIVE_LIFECYCLE_ATTACHMENT_FIELDS)
         )
         # A legacy field grant can otherwise survive a parent delete and become
         # usable if a future path reactivates the field.
@@ -916,6 +925,15 @@ async def delete_credential_item(
         ).values("id")]
         if bound_field_ids:
             await UserSecretGrant.delete_where(user_secret_id__in=bound_field_ids)
+        native_component = await inspect_native_lifecycle(
+            {**raw, "deleted_at": None}, fields, attachments, actor_id=actor_id,
+            audit_organization_id=audit_organization_id, state="live", deletion_timestamp=None,
+        )
+        if native_component is not None:
+            await delete_native_component(
+                native_component, parent_id=item_id, actor_id=actor_id,
+                audit_organization_id=audit_organization_id, deleted_at=now,
+            )
         await soft_delete_item_attachments(item_id, actor_id=actor_id, deleted_at=now)
         await UserSecret.update_where(
             {"credential_item_id": item_id, "deleted_at__isnull": True},
@@ -924,7 +942,7 @@ async def delete_credential_item(
             updated_at=now,
         )
         lifecycle = dict(raw.get("lifecycle") or {})
-        lifecycle["vault_recovery"] = {
+        manifest: dict[str, Any] = {
             "schema_version": 1,
             "deletion_id": str(uuid.uuid4()),
             "deleted_at": now.isoformat(),
@@ -933,6 +951,13 @@ async def delete_credential_item(
             "attachments": [{"id": str(row["id"])} for row in attachments],
             "state": "deleted",
         }
+        if native_component is not None:
+            manifest["schema_version"] = 2
+            manifest["native_passkeys"] = [{
+                "id": native_component.passkey_id,
+                "source_field_id": native_component.source_field_id,
+            }]
+        lifecycle["vault_recovery"] = manifest
         await CredentialItem.update_where(
             {"id": item_id, "deleted_at__isnull": True},
             deleted_at=now,
@@ -956,12 +981,13 @@ async def delete_credential_item(
 
 def _recovery_manifest(raw: dict[str, Any], deletion_id: str) -> dict[str, Any]:
     recovery = dict(raw.get("lifecycle") or {}).get("vault_recovery")
-    manifest_keys = {
+    manifest_v1_keys = {
         "schema_version", "deletion_id", "deleted_at", "prior_status",
         "fields", "attachments", "state",
     }
-    if not isinstance(recovery, dict) or type(recovery.get("schema_version")) is not int or recovery.get("schema_version") != 1:
+    if not isinstance(recovery, dict) or type(recovery.get("schema_version")) is not int or recovery.get("schema_version") not in {1, 2}:
         raise CredentialRestoreConflictError("automatic recovery is unavailable for this deletion")
+    manifest_keys = manifest_v1_keys | ({"native_passkeys"} if recovery["schema_version"] == 2 else set())
     if set(recovery) != manifest_keys:
         raise CredentialRestoreConflictError("deletion record has unexpected or missing fields")
     if not isinstance(recovery.get("deletion_id"), str) or recovery.get("deletion_id") != deletion_id:
@@ -1009,6 +1035,23 @@ def _recovery_manifest(raw: dict[str, Any], deletion_id: str) -> dict[str, Any]:
         attachment_ids.append(entry["id"])
     if len(set(field_ids)) != len(field_ids) or len(set(attachment_ids)) != len(attachment_ids):
         raise CredentialRestoreConflictError("deletion record contains duplicate components")
+    if recovery["schema_version"] == 2:
+        native = recovery.get("native_passkeys")
+        if not isinstance(native, list) or len(native) != 1:
+            raise CredentialRestoreConflictError("native deletion record is invalid")
+        entry = native[0]
+        if not isinstance(entry, dict) or set(entry) != {"id", "source_field_id"}:
+            raise CredentialRestoreConflictError("native deletion record is invalid")
+        try:
+            passkey_id, source_id = entry["id"], entry["source_field_id"]
+            if not isinstance(passkey_id, str) or not isinstance(source_id, str):
+                raise ValueError
+            if str(uuid.UUID(passkey_id)) != passkey_id or str(uuid.UUID(source_id)) != source_id:
+                raise ValueError
+        except (KeyError, TypeError, ValueError) as exc:
+            raise CredentialRestoreConflictError("native deletion record is invalid") from exc
+        if source_id not in field_ids:
+            raise CredentialRestoreConflictError("native source is absent from deletion fields")
     parent_deleted_at = raw.get("deleted_at")
     if recovery["state"] == "deleted":
         if parent_deleted_at is None or _iso(parent_deleted_at) != recovery["deleted_at"]:
@@ -1031,7 +1074,7 @@ async def restore_credential_item(
     async with transaction(PACKAGE_DB_NAME):
         raw = await _lock_restore_item_raw(item_id)
         manifest = _recovery_manifest(raw, deletion_id)
-        if manifest["state"] == "restored":
+        if manifest["state"] == "restored" and manifest["schema_version"] == 1:
             item = await get_credential_item(item_id)
             if item is None:  # pragma: no cover
                 raise CredentialRestoreConflictError("restore state is inconsistent")
@@ -1043,19 +1086,49 @@ async def restore_credential_item(
             raise CredentialRestoreConflictError("deletion record is incomplete")
         field_ids = sorted(entry["id"] for entry in field_entries)
         attachment_ids = sorted(entry["id"] for entry in attachment_entries)
+        from .native_lifecycle import (
+            NATIVE_LIFECYCLE_ATTACHMENT_FIELDS,
+            NATIVE_LIFECYCLE_FIELD_FIELDS,
+            inspect_native_lifecycle,
+            restore_native_component,
+        )
         fields = await UserSecret.filter(id__in=field_ids).select_for_update().order_by("id").values(
-            "id", "credential_item_id", "user_id", "organization_id", "deleted_at", "execution_purpose", "field_key"
+            *NATIVE_LIFECYCLE_FIELD_FIELDS
         ) if field_ids else []
         attachments = await CredentialAttachment.filter(id__in=attachment_ids).select_for_update().order_by("id").values(
-            "id", "credential_item_id", "deleted_at"
+            *NATIVE_LIFECYCLE_ATTACHMENT_FIELDS
         ) if attachment_ids else []
         if {str(row["id"]) for row in fields} != set(field_ids) or {str(row["id"]) for row in attachments} != set(attachment_ids):
             raise CredentialRestoreConflictError("a deleted component is no longer retained")
+        all_fields = await UserSecret.filter(credential_item_id=item_id).select_for_update().order_by("id").values(
+            *NATIVE_LIFECYCLE_FIELD_FIELDS
+        )
+        unrecorded_protected = [
+            field for field in all_fields
+            if field.get("execution_purpose") != GENERAL_EXECUTION_PURPOSE and str(field.get("id")) not in set(field_ids)
+        ]
+        if unrecorded_protected:
+            raise CredentialRestoreUnsupportedError("unrecorded protected component needs its owning recovery flow")
+        if manifest["state"] == "restored":
+            expected = manifest["native_passkeys"][0]
+            native_component = await inspect_native_lifecycle(
+                raw, all_fields, attachments, actor_id=actor_id,
+                audit_organization_id=audit_organization_id, state="live", deletion_timestamp=None,
+            )
+            if native_component is None or (
+                native_component.passkey_id != expected["id"]
+                or native_component.source_field_id != expected["source_field_id"]
+            ):
+                raise CredentialRestoreConflictError("native component no longer matches this deletion")
+            item = await get_credential_item(item_id)
+            if item is None:  # pragma: no cover
+                raise CredentialRestoreConflictError("restore state is inconsistent")
+            return item, 0, 0, True
         for field in fields:
             if (str(field.get("credential_item_id")) != item_id or field.get("user_id") != raw.get("user_id")
                     or field.get("organization_id") != raw.get("organization_id") or _iso(field.get("deleted_at")) != deleted_at):
                 raise CredentialRestoreConflictError("a field no longer matches this deletion")
-            if field.get("execution_purpose") != GENERAL_EXECUTION_PURPOSE or field.get("field_key") == PROTECTED_FIELD_KEY:
+            if manifest["schema_version"] == 1 and (field.get("execution_purpose") != GENERAL_EXECUTION_PURPOSE or field.get("field_key") == PROTECTED_FIELD_KEY):
                 raise CredentialRestoreUnsupportedError("passkey or protected field recovery needs its native recovery flow")
             if field.get("field_key") == "totp_seed":
                 await require_host_authorization(
@@ -1065,6 +1138,27 @@ async def restore_credential_item(
         for attachment in attachments:
             if str(attachment.get("credential_item_id")) != item_id or _iso(attachment.get("deleted_at")) != deleted_at:
                 raise CredentialRestoreConflictError("an attachment no longer matches this deletion")
+        native_component = None
+        if manifest["schema_version"] == 2:
+            native_component = await inspect_native_lifecycle(
+                raw, fields, attachments, actor_id=actor_id, audit_organization_id=audit_organization_id,
+                state="deleted", deletion_timestamp=deleted_at,
+            )
+        if manifest["schema_version"] == 2:
+            expected = manifest["native_passkeys"][0]
+            if native_component is None or (
+                native_component.passkey_id != expected["id"]
+                or native_component.source_field_id != expected["source_field_id"]
+            ):
+                raise CredentialRestoreConflictError("native component no longer matches this deletion")
+        if native_component is not None:
+            # The manifest persists an exact ISO string for integrity comparison;
+            # the typed native mutation owns a timestamptz equality predicate.
+            native_deleted_at = datetime.fromisoformat(deleted_at)
+            await restore_native_component(
+                native_component, parent_id=item_id, actor_id=actor_id,
+                audit_organization_id=audit_organization_id, deleted_at=native_deleted_at,
+            )
         # Do not turn a hidden uniqueness violation into a generic DB error.
         # Field-key identity is local to its credential item; environment
         # aliases are separately unique in the item's owner namespace.
@@ -1107,7 +1201,7 @@ async def restore_credential_item(
         await record_secret_audit(action="item_restored_quarantined", actor_id=actor_id,
             organization_id=audit_organization(record_organization_id=raw.get("organization_id"), request_organization_id=audit_organization_id, what=f"restore_credential_item(item_id={item_id})"),
             user_id=str(raw["user_id"]) if raw.get("user_id") else None,
-            metadata={"credential_item_id": item_id, "deletion_id": deletion_id, "restored_fields": len(fields), "restored_attachments": len(attachments)})
+            metadata={"credential_item_id": item_id, "deletion_id": deletion_id, "restored_fields": len(fields), "restored_attachments": len(attachments), "restored_native_passkeys": 1 if manifest["schema_version"] == 2 else 0})
     item = await get_credential_item(item_id)
     if item is None:  # pragma: no cover
         raise CredentialRestoreConflictError("restored item is unavailable")

{matrx_orm-3.1.170 → matrx_orm-3.1.172}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "matrx-orm"
-version = "3.1.170"
+version = "3.1.172"
 description = "Async-first PostgreSQL ORM with bidirectional migrations, schema introspection, many-to-many relationships, and built-in state caching"
 readme = "README.md"
 license = { text = "MIT" }

{matrx_orm-3.1.170 → matrx_orm-3.1.172}/tests/test_vault_aggregate_recovery_stateful.py

@@ -16,6 +16,7 @@ import pytest
 
 from matrx_orm.secrets_battery import attachments as attachments_mod
 from matrx_orm.secrets_battery import items as items_mod
+from matrx_orm.secrets_battery import native_lifecycle
 from matrx_orm.secrets_battery import service as service_mod
 
 
@@ -26,6 +27,7 @@ INACTIVE_FIELD = "00000000-0000-0000-0000-000000000012"
 OLD_FIELD = "00000000-0000-0000-0000-000000000013"
 ATTACHMENT = "00000000-0000-0000-0000-000000000021"
 OLD_ATTACHMENT = "00000000-0000-0000-0000-000000000022"
+PASSKEY = "00000000-0000-0000-0000-000000000031"
 
 
 class _Query:
@@ -57,6 +59,9 @@ class _Query:
             elif key.endswith("__in"):
                 if row.get(key[:-4]) not in expected:  # type: ignore[operator]
                     return False
+            elif isinstance(row.get(key), datetime) and isinstance(expected, str):
+                if row[key].isoformat() != expected:  # type: ignore[union-attr]
+                    return False
             elif row.get(key) != expected:
                 return False
         return True
@@ -119,10 +124,11 @@ class _Store:
                  "value_hint": "c", "value_version": 1, "is_active": False, "description": None,
                  "created_at": old, "updated_at": old, "deleted_at": old},
             ],
-            "attachments": [
+    "attachments": [
                 {"id": ATTACHMENT, "credential_item_id": ITEM, "deleted_at": None, "updated_at": now},
                 {"id": OLD_ATTACHMENT, "credential_item_id": ITEM, "deleted_at": old, "updated_at": old},
             ],
+            "passkeys": [],
             "grants": [
                 {"credential_item_id": ITEM, "user_secret_id": None, "user_id": "member"},
                 {"credential_item_id": None, "user_secret_id": ACTIVE_FIELD, "user_id": "legacy-member"},
@@ -167,6 +173,12 @@ def vault(monkeypatch: pytest.MonkeyPatch) -> _Store:
     monkeypatch.setattr(items_mod, "record_secret_audit", audit)
     monkeypatch.setattr(attachments_mod, "record_secret_audit", audit)
     monkeypatch.setattr(items_mod, "audit_organization", lambda **_kwargs: "audit-org")
+    passkeys = type("Passkeys", (_Model,), {"table": "passkeys", "store": store})
+    monkeypatch.setattr(native_lifecycle, "CredentialItem", item)
+    monkeypatch.setattr(native_lifecycle, "UserSecret", field)
+    monkeypatch.setattr(native_lifecycle, "PasskeyCredential", passkeys)
+    monkeypatch.setattr(native_lifecycle, "get_active_connection", lambda: object())
+    monkeypatch.setattr(native_lifecycle, "require_host_authorization", _native_allow)
     return store
 
 
@@ -190,11 +202,9 @@ async def test_actual_delete_then_restore_quarantines_only_children_in_manifest(
     assert all(row["deleted_at"].isoformat() == deleted_at for row in vault.tables["fields"][:2])  # type: ignore[union-attr]
     assert vault.tables["attachments"][0]["deleted_at"].isoformat() == deleted_at  # type: ignore[union-attr]
     assert vault.tables["grants"] == []
-
     restored, fields, attachments, already = await items_mod.restore_credential_item(
         ITEM, deletion_id=deletion_id, actor_id="owner", audit_organization_id="audit-org"
     )
-
     assert (fields, attachments, already) == (2, 1, False)
     assert restored.status == "disabled"
     assert parent["deleted_at"] is None and parent["access_mode"] == "restricted"
@@ -211,6 +221,113 @@ async def test_actual_delete_then_restore_quarantines_only_children_in_manifest(
     assert vault.tables["grants"] == []
 
 
+@pytest.mark.asyncio
+async def test_native_v2_coordinator_deletes_and_restores_exact_pair_with_auxiliaries(
+    vault: _Store, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """The aggregate coordinator, not a helper-only caller, owns v2 custody."""
+    vault.tables["items"][0].update(definition_key="native_passkey", access_mode="restricted")
+    source = vault.tables["fields"][0]
+    source.update(
+        field_key="passkey_private", execution_purpose="passkey_private", handling="sealed",
+        editable=False, inject_into_sandbox=False, key=None, value_hint=None,
+    )
+    vault.tables["passkeys"] = [{
+        "id": PASSKEY, "credential_item_id": ITEM, "source_field_id": ACTIVE_FIELD,
+        "organization_id": "owner-personal-org", "lifecycle": "saved_waiting_for_site",
+        "deleted_at": None,
+    }]
+    passkeys = type("Passkeys", (_Model,), {"table": "passkeys", "store": vault})
+    monkeypatch.setattr(native_lifecycle, "CredentialItem", items_mod.CredentialItem)
+    monkeypatch.setattr(native_lifecycle, "UserSecret", items_mod.UserSecret)
+    monkeypatch.setattr(native_lifecycle, "PasskeyCredential", passkeys)
+    monkeypatch.setattr(native_lifecycle, "get_active_connection", lambda: object())
+
+    async def authorize(*_args: object, **_kwargs: object) -> None:
+        return None
+
+    monkeypatch.setattr(native_lifecycle, "require_host_authorization", authorize)
+    deletion_id = await _delete(vault)
+    manifest = vault.tables["items"][0]["lifecycle"]["vault_recovery"]  # type: ignore[index]
+    assert manifest["schema_version"] == 2  # type: ignore[index]
+    assert manifest["native_passkeys"] == [{"id": PASSKEY, "source_field_id": ACTIVE_FIELD}]  # type: ignore[index]
+    assert vault.tables["passkeys"][0]["lifecycle"] == "retired"
+    assert vault.tables["passkeys"][0]["deleted_at"] == vault.tables["items"][0]["deleted_at"]
+    expected_native_deleted_at = datetime.fromisoformat(manifest["deleted_at"])  # type: ignore[arg-type]
+    native_restore_timestamps: list[datetime] = []
+    original_restore_native_component = native_lifecycle.restore_native_component
+
+    async def restore_with_typed_timestamp(*args: object, **kwargs: object) -> None:
+        deleted_at = kwargs["deleted_at"]
+        assert isinstance(deleted_at, datetime)
+        assert deleted_at.tzinfo is not None and deleted_at.utcoffset() is not None
+        native_restore_timestamps.append(deleted_at)
+        await original_restore_native_component(*args, **kwargs)  # type: ignore[arg-type]
+
+    monkeypatch.setattr(native_lifecycle, "restore_native_component", restore_with_typed_timestamp)
+
+    _, fields, attachments, already = await items_mod.restore_credential_item(
+        ITEM, deletion_id=deletion_id, actor_id="owner", audit_organization_id="audit-org"
+    )
+    assert (fields, attachments, already) == (2, 1, False)
+    assert native_restore_timestamps == [expected_native_deleted_at]
+    assert vault.tables["passkeys"][0]["deleted_at"] is None
+    assert vault.tables["passkeys"][0]["lifecycle"] == "saved_waiting_for_site"
+    assert vault.tables["fields"][0]["is_active"] is False
+    assert vault.tables["items"][0]["status"] == "disabled"
+    _, fields, attachments, already = await items_mod.restore_credential_item(
+        ITEM, deletion_id=deletion_id, actor_id="owner", audit_organization_id="audit-org"
+    )
+    assert (fields, attachments, already) == (0, 0, True)
+    vault.tables["fields"].append({
+        **vault.tables["fields"][0], "id": SECOND_ITEM, "field_key": "other_protected",
+        "deleted_at": None, "is_active": False,
+    })
+    before = deepcopy(vault.tables)
+    with pytest.raises(items_mod.CredentialRestoreUnsupportedError):
+        await items_mod.restore_credential_item(
+            ITEM, deletion_id=deletion_id, actor_id="owner", audit_organization_id="audit-org"
+        )
+    assert vault.tables == before
+    restore_audits = [event for event in vault.audits if event.get("action") == "item_restored_quarantined"]
+    assert restore_audits[-1]["metadata"]["restored_native_passkeys"] == 1  # type: ignore[index]
+
+
+@pytest.mark.asyncio
+async def test_native_v2_forged_pair_refuses_before_resurrecting_any_component(
+    vault: _Store, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """A forged native manifest cannot restore a parent, source, or auxiliary."""
+    vault.tables["items"][0].update(definition_key="native_passkey", access_mode="restricted")
+    vault.tables["fields"][0].update(
+        field_key="passkey_private", execution_purpose="passkey_private", handling="sealed",
+        editable=False, inject_into_sandbox=False, key=None, value_hint=None,
+    )
+    vault.tables["passkeys"] = [{
+        "id": PASSKEY, "credential_item_id": ITEM, "source_field_id": ACTIVE_FIELD,
+        "organization_id": "owner-personal-org", "lifecycle": "saved_waiting_for_site",
+        "deleted_at": None,
+    }]
+    passkeys = type("Passkeys", (_Model,), {"table": "passkeys", "store": vault})
+    monkeypatch.setattr(native_lifecycle, "CredentialItem", items_mod.CredentialItem)
+    monkeypatch.setattr(native_lifecycle, "UserSecret", items_mod.UserSecret)
+    monkeypatch.setattr(native_lifecycle, "PasskeyCredential", passkeys)
+    monkeypatch.setattr(native_lifecycle, "get_active_connection", lambda: object())
+    monkeypatch.setattr(native_lifecycle, "require_host_authorization", _native_allow)
+    deletion_id = await _delete(vault)
+    vault.tables["items"][0]["lifecycle"]["vault_recovery"]["native_passkeys"][0]["id"] = SECOND_ITEM  # type: ignore[index]
+    before = deepcopy(vault.tables)
+    with pytest.raises(items_mod.CredentialRestoreConflictError):
+        await items_mod.restore_credential_item(
+            ITEM, deletion_id=deletion_id, actor_id="owner", audit_organization_id="audit-org"
+        )
+    assert vault.tables == before
+
+
+async def _native_allow(*_args: object, **_kwargs: object) -> None:
+    return None
+
+
 @pytest.mark.asyncio
 @pytest.mark.parametrize("breakage", ["purged", "ownership_mismatch"])
 async def test_actual_restore_refuses_changed_child_without_partial_resurrection(vault: _Store, breakage: str) -> None: