Collaboration API contracts

These additive gRPC methods are defined in proto/arraybridge.proto on WorkspaceService. Generate the client bindings from the server’s protocol and inspect GetServerInfo.capabilities; protocol number alone does not establish support. All methods require the caller’s identity and project authorization. The private browser gateway exposes a deliberately limited subset.

Method	Contract
`ListAssetRevisions`	Read-authorized descending history, up to 100 entries; use the returned before-revision cursor for older pages. Bulk scientific values are fetched separately.
`PutOriginalChunk`	Member-authorized project/publisher upload keyed by SHA256 and total length. A zero-length chunk queries progress. Maximum 16 MiB, 256 KiB chunks; exact retries resume. Completion verifies SHA256.
`GetOriginalChunk`	Read by an exact published asset revision and offset, with current access checks. Staged unattached bytes are not exposed.
`SaveReviewScene`	Member-authorized save of 1–16 distinct exact same-project asset revisions. Uses expected revision and command ID; a stale expected revision fails.
`ListReviewScenes` / `GetReviewScene`	Current scene catalogue or exact saved scene revision; read-authorized. Pilot maximum 128 scene identities per project.
`AddReviewComment`	A project reader, including a viewer, appends a comment to an exact asset revision with an idempotent command ID. Body maximum 4,000 UTF-8 bytes.
`ListReviewComments`	Latest 100 comments for an exact revision, with `has_older`; not a full-history export API.

Publication sequence

host GUI: choose a saved file, unit and contribution binding
    |
background capture: validate grid/meaning, hash and snapshot
    |
persist pending command + exact expected head locally
    |
register an explicitly retained external source
    |
[optional LAS original: upload/resume chunks and verify completion]
    |
publish snapshot with stable source identity + next source version
    |
platform commits immutable revision -> notification hint
    |
persist binding receipt; clear pending command

After a lost reply, retry the saved command rather than inventing a new version. A retained original’s original_sha256 must refer to a completed upload by that publisher before the snapshot can become available. The QGIS publisher currently retains the numerical snapshot, not the original GeoTIFF.

An event is a hint to fetch an exact authorized revision; it is not the scientific payload or the source of truth. Reconcile current state on reconnection. A follower may coalesce intermediate hints; a pinned reader keeps its exact revision.

QGIS-derived parent metadata is declared by the user. Do not present it as instrumented execution lineage. Platform-run operators separately record exact inputs, operator version, parameters and run provenance. These distinctions must survive exports and connector transformations.