feat: validate local permissions and bind issuance to authority state

AGENTS.md

@@ -1,20 +1,26 @@
 # authority — agent instructions
 
 This repo is the **host authority interface** and its development implementation,
-the **authority gateway**. One sentence of responsibility: declare what a module or
+the **local authority**. One sentence of responsibility: declare what a module or
 solution calls on its host to be issued and checked authority, and provide the one
 small process that implements it on a laptop. If a change makes that sentence need
 another clause, it does not belong here.
 
-- **Owns:** the interface declaration; the authority gateway service; later, the
+- **Owns:** the interface declaration; the local authority service; later, the
   authority proto, verifier and conformance kit moved from core.
 - **Never contains:** a second implementation of sign-in, minting or grant
-  derivation (the authority gateway links the host's packages); a store the host does
+  derivation (the local authority links the host's packages); a store the host does
   not also use; any solution, customer or business-line name; a route of the
   product frontend; anything the CLI should do (rendering, per-process launcher
   credentials).
-- **Depends on:** the host's authority packages (codefly-dev/module-saas-starter)
-  and core's Work Context types until step 3 moves them here.
+- **Depends on today:** Core's Work Context authority/verifier, workload
+  attestation and composition packages, plus this repo's libraries. The local
+  service does not currently import module-saas-starter.
+
+The host-package reuse requirement above is an unresolved design obligation:
+the existing local issuer/state resolves fixture grants itself. Do not add a
+parallel resolver, infer that local tests prove SaaS parity, or silently erase
+that obligation to match the implementation. Reconcile it with the host owner.
 
 Rules, governed by https://github.com/obin-ai/handbook/blob/main/concepts/boundaries.md
 and the development contract at

interfaces/authority/interface.codefly.yaml

@@ -1,8 +1,8 @@
 kind: interface
 publisher: codefly.dev
 name: authority
-description: What a module or solution calls on its host to be issued, checked and verified authority. Implemented by accounts and by the authority gateway.
-version: 0.1.0
+description: What a module or solution calls on its host to be issued, checked and verified authority. Implemented by accounts and by the local authority.
+version: 0.2.0
 type: connect
 protobuf:
     package: host.authority.v1

interfaces/session/interface.codefly.yaml

@@ -2,7 +2,7 @@ kind: interface
 publisher: codefly.dev
 name: session
 description: A person signs in at the browser edge, and a page asks who the bearer it was handed is; a module never calls this.
-version: 0.1.0
+version: 0.2.0
 type: connect
 protobuf:
     package: host.session.v1

libraries/authority-client/contract/catalog.codefly.json

@@ -4,13 +4,13 @@
   "version": "0.0.0",
   "endpoints": [
     {
-      "service": "gateway",
+      "service": "local",
       "endpoint": "grpc",
       "api": "grpc",
       "kind": "protobuf",
       "package": "api",
       "path": "contract.binpb",
-      "digest": "sha256:89baa9ae5c5f7940f17b303afdb58824e913427d3fb826c81b24f78e5378d599",
+      "digest": "sha256:d2fcb57f3608ea6c57918565db2d83cc69d7e9cebee33edadf2160a3fee8d635",
       "services": [
         {
           "name": "GatewayService",

libraries/authority-client/go/README.md

@@ -0,0 +1,48 @@
+# Authority Go client
+
+Codefly generates the RPC bindings in `gen/`. The `workcontext` package adds a
+non-verifying projection using Core's maintained decoder and scope containment:
+
+```go
+import claims "github.com/codefly-dev/authority/libraries/authority-client/go/workcontext"
+
+// The reader requires incoming metadata and the run-delivered hop proof.
+md, _ := metadata.FromIncomingContext(ctx)
+c, err := claims.ReadClaims(md, proof)
+// Handle err, compare c.Audience() to this module's delivered audience, then:
+allowed := c.Allows(resourceKind, action, exactResourceID)
+```
+
+`Scopes()` returns deep copies of the final actor's grants, or the owner's grants
+when there is no actor. An empty final actor grants nothing. `Allows` evaluates
+each candidate independently. An empty requested resource ID asks for the entire
+kind; a restricted grant cannot satisfy it. Kind-wide grants cover named IDs.
+Actions are literal: no admin implication, wildcard expansion, prefix matching
+or union of one grant's actions with another's resources.
+
+The reader checks a bounded canonical envelope and 64-byte signature shape, then
+uses Core Decode. Go deliberately retains Core's stronger structural/schema and
+attenuation checks; the Python and TypeScript readers only project readable
+claims. All three agree on the shared Core-produced fixtures. None verifies a
+signature, current time, live revisions or replay. Even a digest-bound context
+may have been refused in warning mode. These claims alone never prove authority.
+Keep audience, installed-definition, ownership, resource and live-visibility
+checks at their existing owners. The exposed protobuf scopes are Core's current
+public types during the authority migration; do not mutate returned copies and
+expect to change the claims snapshot.
+
+From this directory, run `GOWORK=off go test -race ./...` and `go vet ./...`.
+The tests consume `../testdata/claims.json`, whose gateway-side oracle verifies
+Core-minted tokens at a fixed fixture clock. Synthetic mutated tokens in unit
+tests exercise parsing only and are not valid credentials.
+
+Handwritten code lives outside `gen/`, the directory Codefly replaces. The root
+module scaffold is preserved by `codefly generate client`.
+
+The shared `host.Dial` resolves the authority for edge and hop. Remote endpoints
+use verified HTTPS/TLS unless the composition asserts
+`internal-transport/mesh-protected=true` and the target is an in-cluster Service
+DNS name. Plaintext loopback is accepted only in a local Codefly environment.
+Configured endpoints and SDK-resolved fallbacks use the same rule. Unreadable or
+misspelled mesh assertions refuse before dialing; the shared host client owns
+this check for edge and hop, without reviving the retired SDK verifier.