Authorize milestone release commands by escrow role

[mikewheeleer]

Summary

Service endpoints must not allow an arbitrary authenticated user to trigger a value-moving release.

Why this matters

This closes a correctness, security, or operability gap in the TalentTrust backend and makes the behavior explicit under retries, chain inconsistency, authorization, and failure.

Requirements

• Repository scope: Talenttrust/Talenttrust-Backend only.
• Resolve the escrow role from canonical contract metadata; enforce actor authorization before enqueueing work; audit denied attempts.
• Preserve tenant isolation, structured errors, auditability, and existing API compatibility unless this issue explicitly requires a contract change.
• Add focused unit and integration coverage for the new behavior.

Technical guidance

• Follow the repository's existing service, queue, persistence, logging, authentication, and error-envelope conventions.
• Keep side effects bounded and make retries, ordering, authorization, and failure handling explicit.
• Document non-obvious operational and security decisions in the PR.

Edge cases — each must have a test

• authorized owner
• unauthorized user
• missing role
• role changed during request
• tenant mismatch

Acceptance criteria

• Every requirement and edge case above is implemented and tested
• Unit and integration tests cover success, failure, retry, authorization, and boundary paths
• Existing tests pass with no regressions
• Errors and logs are structured and do not leak secrets or internal stack details
• npm run lint, npm test, and npm run build passes locally
• Code follows existing conventions with no duplication or dead code
• Documentation or concise comments explain non-obvious decisions
• PR description explains the approach, includes test evidence and security notes, and references Closes #

Out of scope

• client-side-only authorization

[Alisadev-dev]

@Alisadev-dev has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I’m a software developer with strong experience in Rust and TypeScript, alongside broader software development. I’d be a great fit for this issue and can get it solved with the quality it requires.
‎

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Alisadev-dev to this issue.

[drips-wave]

Congratulations, @Alisadev-dev! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @Alisadev-dev: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊