[antoinetoussaint-byte]

Merge only together with, or after, codefly-dev/cli#1189. With CLI #1189 (420c4f63) the strict permission preflight passes on platform-core #114's head. With CLI main 89c76fde it refuses this head with conflicting policies for GET /version, because main does not let a gateway route inherit its proto method's policy. #1189 adds that, and it also leaves out the local authority's host-interface methods on a saas host.

What this fixes

On a saas host, every module behind the hop stopped before start:

cannot admit service before runtime start: module authority declares no package manifest,
so it names no release: …/modules/authority/module.package.codefly.yaml: no such file

#28 made authority/hop module-identity: true. The CLI's run admission admits every identity module except the host's own. On a saas host that includes the authority module, which shipped no package manifest.

The change

• The package. modules/authority/module.package.codefly.yaml names the release codefly/authority 0.1.0 and the services the interface exports (local, hop, edge).

  • codefly generate contracts authority wrote each service's api-contracts, contracts/api/** and the catalog. --check is clean.
  • contracts.codefly.yaml and services/local/contract-surfaces.json are the inventory for the local authority's grpc listener, which spans packages. They follow the console's pattern.

• The hop's Version declares a policy. It is any_checked_caller, as the console's Version is.

  • A host that implements codefly.dev/composition receives the policy of every method of a module it fronts, and refuses a method with none.
  • The option is vendored at hop/proto/authority/hop/v1/policy.proto the console's way, with VENDORED.md and a drift test (code/vendored_test.go).
  • buf.gen.yaml takes api.proto as its one input, so the option's bindings stay the hop library's.
  • codefly generate proto wrote the bindings and codefly generate contracts wrote the contracts. The no-proxy gate's provenance manifest records the reviewed digests: the only changes are the option's import and descriptor bytes, and the doc comment.

• The hop's range. The hop declares codefly.dev/authority@>=0.3.3 <0.4.0, because RegisterAdmissionKey only exists from 0.3.3. Accounts at #114's saas pin implements 0.3.3.

• tools/packagegate, the package gate. It refuses:

  • a module-identity module with no package
  • a manifest, catalog and contract files that disagree (core's own loaders and validators)
  • contracts that are stale against their service's proto tree or OpenAPI document
  • any published method a host fronting the module receives with no policy. It reads methods the way #1189's HostMethodPolicies does: each served procedure, its google.api.http routes, and each OpenAPI operation. A gateway route inherits the policy of the proto method that binds it. A service that stands in for a host is left out: one that runs as no module identity and exports an endpoint implementing a Codefly interface, which here is local.

  The refusal cases are a missing manifest, a moved/added proto, a moved OpenAPI document, an edited contract, the hop's Version unmarked, an unbound route unmarked, and a host-interface service that runs as the module.

Fix or hack: fix. Each piece is at its owner: the release in the module, the policy on the hop's method, the host-stand-in rule in the CLI (#1189).
Reused:

• core's package and catalog loaders and validators
• the CLI's generate contracts and generate proto
• the console's vendored-policy pattern

The gate restates the CLI's policy read in about 200 lines because authority cannot import the CLI. It cites #1189 as its reference.

Proof

Strict preflight. Harness: gitops.CheckCompositionPermissions(strict=true), the call codefly deploy gitops makes. Workspace: platform-core #114 head 29e8d28, env local, host saas/accounts/connect, authority overridden in codefly.local.yaml to this branch.

CLI	authority	result
#1189 420c4f63	this PR ed10966	passed (also with the w-clipolicy-proof harness script)
main 89c76fde	this PR ed10966	refused: conflicting policies for GET /version
main 89c76fde	main 49101ae	passed (no package, so the module is undeclared)

Saas-hosted run. CLI #1189, platform-core 29e8d28, scope apkg50, same roots as scripts/composition-check.sh. There was no cannot admit service and no names no release. With the hop's policy declared, the run also printed no permission-preflight warning:

(INFO) (launcher.deliver) delivered module=authority workloads=1 disposition=accepted generation=2
(INFO) (launcher.deliver) applied module=authority generation=2
>> evaluation/registry: Running on :62720
>> tracing/tracing: Running on :56463

The run then stopped for a local reason: tracing's gRPC port was already taken on this machine (bind: address already in use), from port-hash collisions with other runs here. An earlier run (apkg31, before the policy) had annotations Running too.

Not in this PR (audit D3 and D4), and why

• The edge's installation range (>=0.2.0). Accounts at #114's pin implements installation 0.1.0. With the narrowed range the whole platform-core workspace fails to load (workspace_invalid … saas/accounts provides no version in range). It can narrow once accounts implements installation 0.2.0.
• OfferService / ArtifactService in an interface. Declaring them is a contract move: it needs a version, shared cases and a home. It belongs in a separate proposal. They stay in local's inventory, because that is what the listener serves. On a saas host local is left out as a host stand-in.

Interaction with #32

#32 changes services/local/proto/host/authority/v1/authority.proto, so whichever lands second must re-run codefly generate contracts authority. packagegate turns that drift red.

🤖 Generated with Claude Code