Harden extensions v2 review workflows

[admdly]

Summary

Addresses all five findings from the pre-publication extensions v2 design and security review:

• make submission approval atomic and bind it to the captured ownership epoch
• bound submission payloads and pending backlog, reject duplicate pending targets globally, and add cursor pagination
• guard developer self-updates against ownership-transfer races
• bind developer approval to the exact content revision reviewed
• move transfer bearer tokens from URL paths into JSON request bodies and shorten expiry to one hour

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	api	f4a5b26	Commit Preview URL Branch Preview URL	Jul 26 2026, 11:21 PM

[cubic-dev-ai]

All reported issues were addressed across 7 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 4 files (changes from recent commits).

<sub>Requires human review: Database schema migration, payload size/backlog limits, token transfer changes, and ownership race guards introduce operational tradeoffs and security policy decisions requiring human sign-off.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 7 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

No issues found across 7 files

<sub>Requires human review: Includes a database migration and public contract changes (paginated responses, strict schemas, token body migration). Human review needed to verify correctness and backward compatibility.

Re-trigger cubic</sub>

[cubic-dev-ai]

No issues found across 7 files

<sub>Requires human review: Adds a database migration and schema change (new columns, indexes, data updates) for atomic approvals and duplicate rejection. Requires human review for data model changes.

Re-trigger cubic</sub>