fix(authority): run the local host on the authority core

AGENTS.md

@@ -17,10 +17,12 @@ another clause, it does not belong here.
   attestation and composition packages, plus this repo's libraries. The local
   service does not currently import module-saas-starter.
 
-The host-package reuse requirement above is an unresolved design obligation:
-the existing local issuer/state resolves fixture grants itself. Do not add a
-parallel resolver, infer that local tests prove SaaS parity, or silently erase
-that obligation to match the implementation. Reconcile it with the host owner.
+The local issuer now adapts requests to `libraries/authority-core/go`; its state
+adapter supplies fixture roles and delivery data to that shared core. This does
+not establish Accounts adoption or settle the host-package reuse requirement
+above. Do not add a parallel resolver, infer that local tests prove SaaS parity,
+or silently erase that obligation to match the implementation. Reconcile it with
+the host owner.
 
 Rules, governed by https://github.com/obin-ai/handbook/blob/main/concepts/boundaries.md
 and the development contract at

README.md

@@ -25,8 +25,11 @@ This repository holds two things, and only these two:
 
 **What is reused today.** The local implementation uses Core's Work Context
 authority/verifier, workload attestation and signed composition machinery.
-Its issuer/state resolves fixture grants; it does not currently link Accounts'
-sign-in or grant-derivation packages. The original host-package reuse requirement
+Its local issuer delegates issuance and grant derivation to this repository's
+shared authority core; the state adapter supplies fixture roles and delivery data.
+It does not currently link Accounts' sign-in or grant-derivation packages, and
+this adapter migration does not establish Accounts adoption of that core.
+The original host-package reuse requirement
 remains an unresolved design obligation with the host owner, not a guarantee
 established by this checkout. The shared conformance suite must run against both
 implementations; a local pass or a skipped provider scenario does not prove parity.
@@ -173,8 +176,10 @@ talks to. Against that:
   an endpoint on a cell), installations with the install step, module routes.
 
 **What remains is the interface.** Authority: `Issue`, `Check`, `Keys`.
-Composition: `ApplyManifest`. Installation: `Install`, `GrantToTeam`, `List`, and
-the install step callback. Sign-in at the browser edge only. Routing is the data
+Composition: `ApplyManifest`. Installation: `Install`, `GrantRole`, `RevokeRole`,
+`ListRoleGrants`, `List`, and the install step callback (installation 0.2.0: an
+installed solution is a principal, and a role grant to a person or a team is
+the access; `GrantToTeam` is gone). Sign-in at the browser edge only. Routing is the data
 plane, not a contract. 0.1.0 mirrors today's spellings so the local authority serves
 the SDKs as they are; the reduced shape is 0.2.0, a host contract change through a
 handbook proposal, after which the SDKs move once.
@@ -355,7 +360,7 @@ role through a granted team, and nothing from the organisation's roles. Another
 organisation's installation grants nothing. The values of real roles belong to
 each solution's manifest and arrive through the carrier: core's manifest carries
 no roles, so they travel in the authority's own document delivered with it
-(`AuthorityManifestV1.roles`, as the sketch's `ModuleManifestV1.roles`), bounded
+(`AuthorityManifestV1.roles`), bounded
 by the solution's own scope ceilings and the invoke/lookup scopes in the paired
 Core manifest. Consumed kinds do not become kinds the solution serves. This repository holds
 the contract and its evaluation, never a product's roles.
@@ -413,10 +418,14 @@ role narrowing/removal and binding narrowing/removal before resolution, during
 minting and after issuance. These checks do not choose a child-scope policy or
 qualify the separate accounts implementation.
 
-Installation administration (`List`, `Install`, `GrantToTeam`) requires an open
-session whose current person is an administrator or owner of the requested
-organization. Anonymous and invalid sessions are `Unauthenticated`; a member or
-an administrator of another organization receives `PermissionDenied`. This is
+Installation administration (`List`, `Install`) requires an open session whose
+current person is an administrator or owner of the requested organization; role
+grants (`GrantRole`, `RevokeRole`, `ListRoleGrants`) also admit the holder of the
+installer role on that installation. Anonymous and invalid sessions are
+`Unauthenticated`; anyone else receives `PermissionDenied`, and a caller of
+another organization is answered as if the installation did not exist. Every
+decision is the generic authority core's (`libraries/authority-core/go`); the
+local authority is a host over it. This is
 not the navigation API: a member probes each target with an empty-scope `Issue`.
 That call returns `FailedPrecondition` when the audience has no active
 installation in the person's organization, and `PermissionDenied` when installed
@@ -430,9 +439,8 @@ for exactly that scope and expects the answer. The local authority's fixture car
 two organisations, a person with no roles or teams and an automatically generated
 developer role; the test kit's composition document installs a solution under
 different roles in each. The host supplies its own matrix from its
-own fixture. When the fixture signs, the suite composes its solution as a carrier
-with the authority's document carrying its roles; the sketch remains for a
-fixture that does not sign.
+own fixture. The suite requires a signed carrier and authenticated delivery
+workload, with the paired authority document carrying the solution's roles.
 
 The fixture names only the authority's own vocabulary. A composing workspace
 adds what its modules and solutions need: grants on the fixture's roles,
@@ -867,8 +875,10 @@ results do not qualify later suite additions.
   keys it pins and reads the manifest from the verified document. The mini
   local authority pins the kit's release key and attests the carrier by the launcher's
   anchor; the host pins its release keys and attests the delivery service
-  account. The sketch (`manifest`) stays through the transition and is ignored
-  when a carrier is present. Not yet done: the host adapter behind it.
+  account. Public requests without a signed carrier and authenticated delivery
+  credential are refused before composition or pending installation work. The
+  old `manifest` wire field grants no authority. Trusted fixture seeding is a
+  host-only state API. Not yet done: the host adapter behind it.
 
 ## Local service name (2026-10-25)
 

interfaces/authority/interface.codefly.yaml

@@ -2,10 +2,10 @@ kind: interface
 publisher: codefly.dev
 name: authority
 description: What a module or solution calls on its host to be issued, checked and verified authority. Implemented by accounts and by the local authority.
-version: 0.2.0
+version: 0.3.0
 type: connect
 protobuf:
     package: host.authority.v1
     services:
         - name: AuthorityService
-          methods: [Issue, Check, Keys, ListResources, Delegate, RevokeDelegation, GetDelegation]
+          methods: [Issue, Check, Keys, ListResources, AuthorizeTransfer, Delegate, RevokeDelegation, GetDelegation]

interfaces/composition/interface.codefly.yaml

@@ -2,7 +2,7 @@ kind: interface
 publisher: codefly.dev
 name: composition
 description: How the host learns what is composed; the ceiling is the manifest.
-version: 0.1.0
+version: 0.2.0
 type: connect
 protobuf:
     package: host.composition.v1

interfaces/installation/interface.codefly.yaml

@@ -2,10 +2,10 @@ kind: interface
 publisher: codefly.dev
 name: installation
 description: What is installed at an organisation and who may use it.
-version: 0.1.0
+version: 0.2.0
 type: connect
 protobuf:
     package: host.installation.v1
     services:
         - name: InstallationService
-          methods: [Install, GrantToTeam, List]
+          methods: [Install, GrantRole, RevokeRole, ListRoleGrants, List]

libraries/authority-client/contract/catalog.codefly.json

@@ -10,7 +10,7 @@
       "kind": "protobuf",
       "package": "api",
       "path": "contract.binpb",
-      "digest": "sha256:05b735abdd6a67ad7365c54fcbd82b8b8412796735ada6323dd43d51bd5f3044",
+      "digest": "sha256:4d92544f5e186880be4d17079ad6dc056a6f9a84a0e1ebb298a2ff9b72863a46",
       "services": [
         {
           "name": "LocalService",