diff --git a/README.md b/README.md
index d3c39008..c56cb832 100644
--- a/README.md
+++ b/README.md
@@ -103,6 +103,13 @@ the scaffold's proto, `authority` from ours) into one facade directory and fails
 its own build; the Go and Python clients that would replace the solution SDK wait
 on that fix.
 
+After changing a proto, regenerate its bindings and clients with `codefly
+generate` and review the output. For changed files already recorded in
+`tools/noproxygate/generated.json`, refresh their SHA-256 digests from that
+reviewed output; do not add exclusions or change the gate to accept a mismatch.
+Run `GOWORK=off go test -race -count=1 ./...` and `GOWORK=off go vet ./...`
+in `tools/noproxygate` before committing the generated change.
+
 **Where the thinking is.** The Platform Authority Primer (decisions 6 and 7) and the
 handbook proposal that will carry them. Run it with `codefly run` from the module.
 
@@ -866,7 +873,8 @@ the interface, with a suite line, or named as belonging elsewhere.
 | Which collections or resources a caller reads (saas `ListReadableSourceCollections`) | `ListResources`, by id, prefix or pattern | suite: the authority answers which resources a context covers |
 | Executable artifact approvals (`Approve`, `Authorize`, `RevokeExecutableArtifact`) | not authority: the signed release (handbook#146) | open |
 | Audit (`EmitAuditEvent`, `DeclareAuditEventTypes`) | not authority: an optional audit interface; with none injected, the module logs each event | the record store |
-| Notifications and the current installation (`NotifyUser`, `NotifyOrgAdmins`, `GetCurrentInstallation`) | not authority: host services, optional interfaces | open |
+| Notifications (`NotifyUser`, `NotifyOrgAdmins`) | host services, optional interfaces | open |
+| Current installation identity and authored namespace | `InstallationService.Current`, confined to the authenticated module in the parent organization | shared core and public RPC tests; host adoption pending |
 
 The local authority supplies these cases. Each host must run the current suite
 against its own provider; missing required fixtures fail. Earlier Accounts
@@ -1049,3 +1057,28 @@ leaving every module's verifier to refuse every call.
 The 0.3.1 authority version is an additive pre-stable revision selected for
 this refresh so existing `>=0.2.0 <0.4.0` consumers admit it. It retains 0.3.0's
 `AuthorizeTransfer` and adds attachment operations. Composition remains 0.2.0.
+
+## Current installation metadata for a module
+
+The installation interface advances to `0.3.0` for this additive capability.
+The in-repository edge accepts it; external compositions constrained below
+`0.3.0` need explicit consumer adoption before selecting this provider.
+
+`InstallationService.Current` accepts the caller's parent Work Context and the
+module's independently authenticated workload credential. Shared core verifies
+the parent for that module and returns only its active installation in the parent
+organization. A delegated child is sealed to its source actor; that seal is
+verified, never mistaken for the destination module installation.
+The projection contains id, organization, target, revision and authored namespace;
+it exposes no roles, grants or other installations. There are no tenant or
+installation selectors. It is a current metadata read, not content access,
+artifact consent or a lease; artifact approval and authorization remain separate.
+`List` remains administrator-only. Invalid credentials, foreign audiences and
+revoked authority refuse instead of returning an empty namespace.
+
+The scoped contract is carried by the handbook
+[installation and intent-selection decision](https://github.com/obin-ai/handbook/blob/main/decisions/authored-installation-and-intent-selection.md)
+(handbook#403).
+Shared-core tests exercise tenant/audience isolation and revocation; the shared
+conformance suite exercises the generated public RPC. Accounts must adopt this
+method and pass that suite before its consumer deployment is qualified.
diff --git a/interfaces/installation/interface.codefly.yaml b/interfaces/installation/interface.codefly.yaml
index ea5a47c6..1fca81ab 100644
--- a/interfaces/installation/interface.codefly.yaml
+++ b/interfaces/installation/interface.codefly.yaml
@@ -2,10 +2,10 @@ kind: interface
 publisher: codefly.dev
 name: installation
 description: What is installed at an organisation and who may use it.
-version: 0.2.0
+version: 0.3.0
 type: connect
 protobuf:
     package: host.installation.v1
     services:
         - name: InstallationService
-          methods: [Install, Review, GrantRole, RevokeRole, ListRoleGrants, List]
+          methods: [Current, Install, Review, GrantRole, RevokeRole, ListRoleGrants, List]
diff --git a/libraries/authority-client/contract/catalog.codefly.json b/libraries/authority-client/contract/catalog.codefly.json
index 749f8d97..e7d791d4 100644
--- a/libraries/authority-client/contract/catalog.codefly.json
+++ b/libraries/authority-client/contract/catalog.codefly.json
@@ -10,7 +10,7 @@
       "kind": "protobuf",
       "package": "api",
       "path": "contract.binpb",
-      "digest": "sha256:1c51ec903d141b1df6c0eff0fcaa10aa48b6633e0753a13718bef83d086dc0cb",
+      "digest": "sha256:54359a530ee98bd87f610c7f37efc6a32010357635f6dabb8ceabae78d8a9ec5",
       "services": [
         {
           "name": "LocalService",
diff --git a/libraries/authority-client/contract/contract.binpb b/libraries/authority-client/contract/contract.binpb
index 64bdfd23..06d1cd77 100644
Binary files a/libraries/authority-client/contract/contract.binpb and b/libraries/authority-client/contract/contract.binpb differ
diff --git a/libraries/authority-client/go/gen/host/installation/v1/installation.pb.go b/libraries/authority-client/go/gen/host/installation/v1/installation.pb.go
index 95b8dde9..d995da35 100644
--- a/libraries/authority-client/go/gen/host/installation/v1/installation.pb.go
+++ b/libraries/authority-client/go/gen/host/installation/v1/installation.pb.go
@@ -82,7 +82,136 @@ func (x Installation_Status) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use Installation_Status.Descriptor instead.
 func (Installation_Status) EnumDescriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{10, 0}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{12, 0}
+}
+
+type CurrentInstallationRequest struct {
+	state           protoimpl.MessageState `protogen:"open.v1"`
+	ParentToken     string                 `protobuf:"bytes,1,opt,name=parent_token,json=parentToken,proto3" json:"parent_token,omitempty"`
+	ActorCredential string                 `protobuf:"bytes,2,opt,name=actor_credential,json=actorCredential,proto3" json:"actor_credential,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
+}
+
+func (x *CurrentInstallationRequest) Reset() {
+	*x = CurrentInstallationRequest{}
+	mi := &file_host_installation_v1_installation_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CurrentInstallationRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CurrentInstallationRequest) ProtoMessage() {}
+
+func (x *CurrentInstallationRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_host_installation_v1_installation_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CurrentInstallationRequest.ProtoReflect.Descriptor instead.
+func (*CurrentInstallationRequest) Descriptor() ([]byte, []int) {
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *CurrentInstallationRequest) GetParentToken() string {
+	if x != nil {
+		return x.ParentToken
+	}
+	return ""
+}
+
+func (x *CurrentInstallationRequest) GetActorCredential() string {
+	if x != nil {
+		return x.ActorCredential
+	}
+	return ""
+}
+
+// CurrentInstallation is request-local metadata, never a lease or consent.
+type CurrentInstallation struct {
+	state          protoimpl.MessageState `protogen:"open.v1"`
+	Id             string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	OrganizationId string                 `protobuf:"bytes,2,opt,name=organization_id,json=organizationId,proto3" json:"organization_id,omitempty"`
+	Target         string                 `protobuf:"bytes,3,opt,name=target,proto3" json:"target,omitempty"`
+	Revision       uint64                 `protobuf:"varint,4,opt,name=revision,proto3" json:"revision,omitempty"`
+	Namespace      string                 `protobuf:"bytes,5,opt,name=namespace,proto3" json:"namespace,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
+}
+
+func (x *CurrentInstallation) Reset() {
+	*x = CurrentInstallation{}
+	mi := &file_host_installation_v1_installation_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CurrentInstallation) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CurrentInstallation) ProtoMessage() {}
+
+func (x *CurrentInstallation) ProtoReflect() protoreflect.Message {
+	mi := &file_host_installation_v1_installation_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CurrentInstallation.ProtoReflect.Descriptor instead.
+func (*CurrentInstallation) Descriptor() ([]byte, []int) {
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *CurrentInstallation) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *CurrentInstallation) GetOrganizationId() string {
+	if x != nil {
+		return x.OrganizationId
+	}
+	return ""
+}
+
+func (x *CurrentInstallation) GetTarget() string {
+	if x != nil {
+		return x.Target
+	}
+	return ""
+}
+
+func (x *CurrentInstallation) GetRevision() uint64 {
+	if x != nil {
+		return x.Revision
+	}
+	return 0
+}
+
+func (x *CurrentInstallation) GetNamespace() string {
+	if x != nil {
+		return x.Namespace
+	}
+	return ""
 }
 
 // InstallRequest asks to install one target at one organisation.
@@ -104,7 +233,7 @@ type InstallRequest struct {
 
 func (x *InstallRequest) Reset() {
 	*x = InstallRequest{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[0]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[2]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -116,7 +245,7 @@ func (x *InstallRequest) String() string {
 func (*InstallRequest) ProtoMessage() {}
 
 func (x *InstallRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[0]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[2]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -129,7 +258,7 @@ func (x *InstallRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InstallRequest.ProtoReflect.Descriptor instead.
 func (*InstallRequest) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{0}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *InstallRequest) GetOrganizationId() string {
@@ -178,7 +307,7 @@ type ReviewRequest struct {
 
 func (x *ReviewRequest) Reset() {
 	*x = ReviewRequest{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[1]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[3]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -190,7 +319,7 @@ func (x *ReviewRequest) String() string {
 func (*ReviewRequest) ProtoMessage() {}
 
 func (x *ReviewRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[1]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[3]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -203,7 +332,7 @@ func (x *ReviewRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReviewRequest.ProtoReflect.Descriptor instead.
 func (*ReviewRequest) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{1}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *ReviewRequest) GetOrganizationId() string {
@@ -237,7 +366,7 @@ type ConsentApproval struct {
 
 func (x *ConsentApproval) Reset() {
 	*x = ConsentApproval{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[2]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[4]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -249,7 +378,7 @@ func (x *ConsentApproval) String() string {
 func (*ConsentApproval) ProtoMessage() {}
 
 func (x *ConsentApproval) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[2]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[4]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -262,7 +391,7 @@ func (x *ConsentApproval) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ConsentApproval.ProtoReflect.Descriptor instead.
 func (*ConsentApproval) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{2}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *ConsentApproval) GetTargetId() string {
@@ -322,7 +451,7 @@ type GrantRoleRequest struct {
 
 func (x *GrantRoleRequest) Reset() {
 	*x = GrantRoleRequest{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[3]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -334,7 +463,7 @@ func (x *GrantRoleRequest) String() string {
 func (*GrantRoleRequest) ProtoMessage() {}
 
 func (x *GrantRoleRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[3]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -347,7 +476,7 @@ func (x *GrantRoleRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GrantRoleRequest.ProtoReflect.Descriptor instead.
 func (*GrantRoleRequest) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{3}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *GrantRoleRequest) GetOrganizationId() string {
@@ -404,7 +533,7 @@ type RevokeRoleRequest struct {
 
 func (x *RevokeRoleRequest) Reset() {
 	*x = RevokeRoleRequest{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[4]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[6]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -416,7 +545,7 @@ func (x *RevokeRoleRequest) String() string {
 func (*RevokeRoleRequest) ProtoMessage() {}
 
 func (x *RevokeRoleRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[4]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[6]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -429,7 +558,7 @@ func (x *RevokeRoleRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RevokeRoleRequest.ProtoReflect.Descriptor instead.
 func (*RevokeRoleRequest) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{4}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *RevokeRoleRequest) GetOrganizationId() string {
@@ -480,7 +609,7 @@ type ListRoleGrantsRequest struct {
 
 func (x *ListRoleGrantsRequest) Reset() {
 	*x = ListRoleGrantsRequest{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[5]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -492,7 +621,7 @@ func (x *ListRoleGrantsRequest) String() string {
 func (*ListRoleGrantsRequest) ProtoMessage() {}
 
 func (x *ListRoleGrantsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[5]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -505,7 +634,7 @@ func (x *ListRoleGrantsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListRoleGrantsRequest.ProtoReflect.Descriptor instead.
 func (*ListRoleGrantsRequest) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{5}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *ListRoleGrantsRequest) GetOrganizationId() string {
@@ -533,7 +662,7 @@ type ListRoleGrantsResponse struct {
 
 func (x *ListRoleGrantsResponse) Reset() {
 	*x = ListRoleGrantsResponse{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[6]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[8]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -545,7 +674,7 @@ func (x *ListRoleGrantsResponse) String() string {
 func (*ListRoleGrantsResponse) ProtoMessage() {}
 
 func (x *ListRoleGrantsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[6]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[8]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -558,7 +687,7 @@ func (x *ListRoleGrantsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListRoleGrantsResponse.ProtoReflect.Descriptor instead.
 func (*ListRoleGrantsResponse) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{6}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *ListRoleGrantsResponse) GetGrants() []*RoleGrant {
@@ -583,7 +712,7 @@ type RoleGrant struct {
 
 func (x *RoleGrant) Reset() {
 	*x = RoleGrant{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[7]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[9]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -595,7 +724,7 @@ func (x *RoleGrant) String() string {
 func (*RoleGrant) ProtoMessage() {}
 
 func (x *RoleGrant) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[7]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[9]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -608,7 +737,7 @@ func (x *RoleGrant) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RoleGrant.ProtoReflect.Descriptor instead.
 func (*RoleGrant) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{7}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *RoleGrant) GetRole() string {
@@ -643,7 +772,7 @@ type ListRequest struct {
 
 func (x *ListRequest) Reset() {
 	*x = ListRequest{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[8]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[10]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -655,7 +784,7 @@ func (x *ListRequest) String() string {
 func (*ListRequest) ProtoMessage() {}
 
 func (x *ListRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[8]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[10]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -668,7 +797,7 @@ func (x *ListRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListRequest.ProtoReflect.Descriptor instead.
 func (*ListRequest) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{8}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *ListRequest) GetOrganizationId() string {
@@ -689,7 +818,7 @@ type ListResponse struct {
 
 func (x *ListResponse) Reset() {
 	*x = ListResponse{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[9]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -701,7 +830,7 @@ func (x *ListResponse) String() string {
 func (*ListResponse) ProtoMessage() {}
 
 func (x *ListResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[9]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -714,7 +843,7 @@ func (x *ListResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListResponse.ProtoReflect.Descriptor instead.
 func (*ListResponse) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{9}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *ListResponse) GetInstallations() []*Installation {
@@ -757,7 +886,7 @@ type Installation struct {
 
 func (x *Installation) Reset() {
 	*x = Installation{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[10]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -769,7 +898,7 @@ func (x *Installation) String() string {
 func (*Installation) ProtoMessage() {}
 
 func (x *Installation) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[10]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -782,7 +911,7 @@ func (x *Installation) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Installation.ProtoReflect.Descriptor instead.
 func (*Installation) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{10}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *Installation) GetId() string {
@@ -859,7 +988,7 @@ type InstallationNotice struct {
 
 func (x *InstallationNotice) Reset() {
 	*x = InstallationNotice{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[11]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[13]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -871,7 +1000,7 @@ func (x *InstallationNotice) String() string {
 func (*InstallationNotice) ProtoMessage() {}
 
 func (x *InstallationNotice) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[11]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[13]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -884,7 +1013,7 @@ func (x *InstallationNotice) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InstallationNotice.ProtoReflect.Descriptor instead.
 func (*InstallationNotice) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{11}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *InstallationNotice) GetInstallation() *Installation {
@@ -903,7 +1032,7 @@ type InstallationAck struct {
 
 func (x *InstallationAck) Reset() {
 	*x = InstallationAck{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[12]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -915,7 +1044,7 @@ func (x *InstallationAck) String() string {
 func (*InstallationAck) ProtoMessage() {}
 
 func (x *InstallationAck) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[12]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -928,7 +1057,7 @@ func (x *InstallationAck) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InstallationAck.ProtoReflect.Descriptor instead.
 func (*InstallationAck) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{12}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{14}
 }
 
 // ListOffersRequest names the organization whose administrator reads.
@@ -941,7 +1070,7 @@ type ListOffersRequest struct {
 
 func (x *ListOffersRequest) Reset() {
 	*x = ListOffersRequest{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[13]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -953,7 +1082,7 @@ func (x *ListOffersRequest) String() string {
 func (*ListOffersRequest) ProtoMessage() {}
 
 func (x *ListOffersRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[13]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -966,7 +1095,7 @@ func (x *ListOffersRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListOffersRequest.ProtoReflect.Descriptor instead.
 func (*ListOffersRequest) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{13}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *ListOffersRequest) GetOrganizationId() string {
@@ -986,7 +1115,7 @@ type ListOffersResponse struct {
 
 func (x *ListOffersResponse) Reset() {
 	*x = ListOffersResponse{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[14]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -998,7 +1127,7 @@ func (x *ListOffersResponse) String() string {
 func (*ListOffersResponse) ProtoMessage() {}
 
 func (x *ListOffersResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[14]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1011,7 +1140,7 @@ func (x *ListOffersResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListOffersResponse.ProtoReflect.Descriptor instead.
 func (*ListOffersResponse) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{14}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *ListOffersResponse) GetOffers() []*Offer {
@@ -1034,7 +1163,7 @@ type Offer struct {
 
 func (x *Offer) Reset() {
 	*x = Offer{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[15]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1046,7 +1175,7 @@ func (x *Offer) String() string {
 func (*Offer) ProtoMessage() {}
 
 func (x *Offer) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[15]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1059,7 +1188,7 @@ func (x *Offer) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Offer.ProtoReflect.Descriptor instead.
 func (*Offer) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{15}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *Offer) GetTarget() string {
@@ -1100,7 +1229,7 @@ type ReviewedOffer struct {
 
 func (x *ReviewedOffer) Reset() {
 	*x = ReviewedOffer{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[16]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1112,7 +1241,7 @@ func (x *ReviewedOffer) String() string {
 func (*ReviewedOffer) ProtoMessage() {}
 
 func (x *ReviewedOffer) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[16]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1125,7 +1254,7 @@ func (x *ReviewedOffer) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReviewedOffer.ProtoReflect.Descriptor instead.
 func (*ReviewedOffer) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{16}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *ReviewedOffer) GetApproval() *ConsentApproval {
@@ -1183,7 +1312,7 @@ type OfferBinding struct {
 
 func (x *OfferBinding) Reset() {
 	*x = OfferBinding{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[17]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1195,7 +1324,7 @@ func (x *OfferBinding) String() string {
 func (*OfferBinding) ProtoMessage() {}
 
 func (x *OfferBinding) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[17]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1208,7 +1337,7 @@ func (x *OfferBinding) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OfferBinding.ProtoReflect.Descriptor instead.
 func (*OfferBinding) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{17}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *OfferBinding) GetBinding() string {
@@ -1246,7 +1375,7 @@ type OfferRole struct {
 
 func (x *OfferRole) Reset() {
 	*x = OfferRole{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[18]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1258,7 +1387,7 @@ func (x *OfferRole) String() string {
 func (*OfferRole) ProtoMessage() {}
 
 func (x *OfferRole) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[18]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1271,7 +1400,7 @@ func (x *OfferRole) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OfferRole.ProtoReflect.Descriptor instead.
 func (*OfferRole) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{18}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *OfferRole) GetName() string {
@@ -1311,7 +1440,7 @@ type OfferScope struct {
 
 func (x *OfferScope) Reset() {
 	*x = OfferScope{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[19]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1323,7 +1452,7 @@ func (x *OfferScope) String() string {
 func (*OfferScope) ProtoMessage() {}
 
 func (x *OfferScope) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[19]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1336,7 +1465,7 @@ func (x *OfferScope) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OfferScope.ProtoReflect.Descriptor instead.
 func (*OfferScope) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{19}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *OfferScope) GetResourceKind() string {
@@ -1384,7 +1513,7 @@ type OfferCapability struct {
 
 func (x *OfferCapability) Reset() {
 	*x = OfferCapability{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[20]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1396,7 +1525,7 @@ func (x *OfferCapability) String() string {
 func (*OfferCapability) ProtoMessage() {}
 
 func (x *OfferCapability) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[20]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1409,7 +1538,7 @@ func (x *OfferCapability) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OfferCapability.ProtoReflect.Descriptor instead.
 func (*OfferCapability) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{20}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *OfferCapability) GetModule() string {
@@ -1455,7 +1584,7 @@ type OfferTool struct {
 
 func (x *OfferTool) Reset() {
 	*x = OfferTool{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[21]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1467,7 +1596,7 @@ func (x *OfferTool) String() string {
 func (*OfferTool) ProtoMessage() {}
 
 func (x *OfferTool) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[21]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1480,7 +1609,7 @@ func (x *OfferTool) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OfferTool.ProtoReflect.Descriptor instead.
 func (*OfferTool) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{21}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *OfferTool) GetName() string {
@@ -1508,7 +1637,16 @@ var File_host_installation_v1_installation_proto protoreflect.FileDescriptor
 
 const file_host_installation_v1_installation_proto_rawDesc = "" +
 	"\n" +
-	"'host/installation/v1/installation.proto\x12\x14host.installation.v1\"\xd0\x01\n" +
+	"'host/installation/v1/installation.proto\x12\x14host.installation.v1\"j\n" +
+	"\x1aCurrentInstallationRequest\x12!\n" +
+	"\fparent_token\x18\x01 \x01(\tR\vparentToken\x12)\n" +
+	"\x10actor_credential\x18\x02 \x01(\tR\x0factorCredential\"\xa0\x01\n" +
+	"\x13CurrentInstallation\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\x12'\n" +
+	"\x0forganization_id\x18\x02 \x01(\tR\x0eorganizationId\x12\x16\n" +
+	"\x06target\x18\x03 \x01(\tR\x06target\x12\x1a\n" +
+	"\brevision\x18\x04 \x01(\x04R\brevision\x12\x1c\n" +
+	"\tnamespace\x18\x05 \x01(\tR\tnamespace\"\xd0\x01\n" +
 	"\x0eInstallRequest\x12'\n" +
 	"\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\x12\x16\n" +
 	"\x06target\x18\x02 \x01(\tR\x06target\x12\x12\n" +
@@ -1608,8 +1746,9 @@ const file_host_installation_v1_installation_proto_rawDesc = "" +
 	"\tOfferTool\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\x12\x18\n" +
 	"\abinding\x18\x02 \x01(\tR\abinding\x12\x14\n" +
-	"\x05write\x18\x03 \x01(\bR\x05write2\xb0\x04\n" +
-	"\x13InstallationService\x12S\n" +
+	"\x05write\x18\x03 \x01(\bR\x05write2\x98\x05\n" +
+	"\x13InstallationService\x12f\n" +
+	"\aCurrent\x120.host.installation.v1.CurrentInstallationRequest\x1a).host.installation.v1.CurrentInstallation\x12S\n" +
 	"\aInstall\x12$.host.installation.v1.InstallRequest\x1a\".host.installation.v1.Installation\x12T\n" +
 	"\x06Review\x12#.host.installation.v1.ReviewRequest\x1a%.host.installation.v1.ConsentApproval\x12W\n" +
 	"\tGrantRole\x12&.host.installation.v1.GrantRoleRequest\x1a\".host.installation.v1.Installation\x12Y\n" +
@@ -1638,68 +1777,72 @@ func file_host_installation_v1_installation_proto_rawDescGZIP() []byte {
 }
 
 var file_host_installation_v1_installation_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_host_installation_v1_installation_proto_msgTypes = make([]protoimpl.MessageInfo, 22)
+var file_host_installation_v1_installation_proto_msgTypes = make([]protoimpl.MessageInfo, 24)
 var file_host_installation_v1_installation_proto_goTypes = []any{
-	(Installation_Status)(0),       // 0: host.installation.v1.Installation.Status
-	(*InstallRequest)(nil),         // 1: host.installation.v1.InstallRequest
-	(*ReviewRequest)(nil),          // 2: host.installation.v1.ReviewRequest
-	(*ConsentApproval)(nil),        // 3: host.installation.v1.ConsentApproval
-	(*GrantRoleRequest)(nil),       // 4: host.installation.v1.GrantRoleRequest
-	(*RevokeRoleRequest)(nil),      // 5: host.installation.v1.RevokeRoleRequest
-	(*ListRoleGrantsRequest)(nil),  // 6: host.installation.v1.ListRoleGrantsRequest
-	(*ListRoleGrantsResponse)(nil), // 7: host.installation.v1.ListRoleGrantsResponse
-	(*RoleGrant)(nil),              // 8: host.installation.v1.RoleGrant
-	(*ListRequest)(nil),            // 9: host.installation.v1.ListRequest
-	(*ListResponse)(nil),           // 10: host.installation.v1.ListResponse
-	(*Installation)(nil),           // 11: host.installation.v1.Installation
-	(*InstallationNotice)(nil),     // 12: host.installation.v1.InstallationNotice
-	(*InstallationAck)(nil),        // 13: host.installation.v1.InstallationAck
-	(*ListOffersRequest)(nil),      // 14: host.installation.v1.ListOffersRequest
-	(*ListOffersResponse)(nil),     // 15: host.installation.v1.ListOffersResponse
-	(*Offer)(nil),                  // 16: host.installation.v1.Offer
-	(*ReviewedOffer)(nil),          // 17: host.installation.v1.ReviewedOffer
-	(*OfferBinding)(nil),           // 18: host.installation.v1.OfferBinding
-	(*OfferRole)(nil),              // 19: host.installation.v1.OfferRole
-	(*OfferScope)(nil),             // 20: host.installation.v1.OfferScope
-	(*OfferCapability)(nil),        // 21: host.installation.v1.OfferCapability
-	(*OfferTool)(nil),              // 22: host.installation.v1.OfferTool
+	(Installation_Status)(0),           // 0: host.installation.v1.Installation.Status
+	(*CurrentInstallationRequest)(nil), // 1: host.installation.v1.CurrentInstallationRequest
+	(*CurrentInstallation)(nil),        // 2: host.installation.v1.CurrentInstallation
+	(*InstallRequest)(nil),             // 3: host.installation.v1.InstallRequest
+	(*ReviewRequest)(nil),              // 4: host.installation.v1.ReviewRequest
+	(*ConsentApproval)(nil),            // 5: host.installation.v1.ConsentApproval
+	(*GrantRoleRequest)(nil),           // 6: host.installation.v1.GrantRoleRequest
+	(*RevokeRoleRequest)(nil),          // 7: host.installation.v1.RevokeRoleRequest
+	(*ListRoleGrantsRequest)(nil),      // 8: host.installation.v1.ListRoleGrantsRequest
+	(*ListRoleGrantsResponse)(nil),     // 9: host.installation.v1.ListRoleGrantsResponse
+	(*RoleGrant)(nil),                  // 10: host.installation.v1.RoleGrant
+	(*ListRequest)(nil),                // 11: host.installation.v1.ListRequest
+	(*ListResponse)(nil),               // 12: host.installation.v1.ListResponse
+	(*Installation)(nil),               // 13: host.installation.v1.Installation
+	(*InstallationNotice)(nil),         // 14: host.installation.v1.InstallationNotice
+	(*InstallationAck)(nil),            // 15: host.installation.v1.InstallationAck
+	(*ListOffersRequest)(nil),          // 16: host.installation.v1.ListOffersRequest
+	(*ListOffersResponse)(nil),         // 17: host.installation.v1.ListOffersResponse
+	(*Offer)(nil),                      // 18: host.installation.v1.Offer
+	(*ReviewedOffer)(nil),              // 19: host.installation.v1.ReviewedOffer
+	(*OfferBinding)(nil),               // 20: host.installation.v1.OfferBinding
+	(*OfferRole)(nil),                  // 21: host.installation.v1.OfferRole
+	(*OfferScope)(nil),                 // 22: host.installation.v1.OfferScope
+	(*OfferCapability)(nil),            // 23: host.installation.v1.OfferCapability
+	(*OfferTool)(nil),                  // 24: host.installation.v1.OfferTool
 }
 var file_host_installation_v1_installation_proto_depIdxs = []int32{
-	3,  // 0: host.installation.v1.InstallRequest.approval:type_name -> host.installation.v1.ConsentApproval
-	8,  // 1: host.installation.v1.ListRoleGrantsResponse.grants:type_name -> host.installation.v1.RoleGrant
-	11, // 2: host.installation.v1.ListResponse.installations:type_name -> host.installation.v1.Installation
+	5,  // 0: host.installation.v1.InstallRequest.approval:type_name -> host.installation.v1.ConsentApproval
+	10, // 1: host.installation.v1.ListRoleGrantsResponse.grants:type_name -> host.installation.v1.RoleGrant
+	13, // 2: host.installation.v1.ListResponse.installations:type_name -> host.installation.v1.Installation
 	0,  // 3: host.installation.v1.Installation.status:type_name -> host.installation.v1.Installation.Status
-	11, // 4: host.installation.v1.InstallationNotice.installation:type_name -> host.installation.v1.Installation
-	16, // 5: host.installation.v1.ListOffersResponse.offers:type_name -> host.installation.v1.Offer
-	3,  // 6: host.installation.v1.ReviewedOffer.approval:type_name -> host.installation.v1.ConsentApproval
-	19, // 7: host.installation.v1.ReviewedOffer.roles:type_name -> host.installation.v1.OfferRole
-	11, // 8: host.installation.v1.ReviewedOffer.installation:type_name -> host.installation.v1.Installation
-	18, // 9: host.installation.v1.ReviewedOffer.ceiling:type_name -> host.installation.v1.OfferBinding
-	20, // 10: host.installation.v1.OfferBinding.scopes:type_name -> host.installation.v1.OfferScope
-	20, // 11: host.installation.v1.OfferRole.scopes:type_name -> host.installation.v1.OfferScope
-	21, // 12: host.installation.v1.OfferRole.capabilities:type_name -> host.installation.v1.OfferCapability
-	20, // 13: host.installation.v1.OfferCapability.requires:type_name -> host.installation.v1.OfferScope
-	22, // 14: host.installation.v1.OfferCapability.tools:type_name -> host.installation.v1.OfferTool
-	1,  // 15: host.installation.v1.InstallationService.Install:input_type -> host.installation.v1.InstallRequest
-	2,  // 16: host.installation.v1.InstallationService.Review:input_type -> host.installation.v1.ReviewRequest
-	4,  // 17: host.installation.v1.InstallationService.GrantRole:input_type -> host.installation.v1.GrantRoleRequest
-	5,  // 18: host.installation.v1.InstallationService.RevokeRole:input_type -> host.installation.v1.RevokeRoleRequest
-	6,  // 19: host.installation.v1.InstallationService.ListRoleGrants:input_type -> host.installation.v1.ListRoleGrantsRequest
-	9,  // 20: host.installation.v1.InstallationService.List:input_type -> host.installation.v1.ListRequest
-	12, // 21: host.installation.v1.InstallableService.Install:input_type -> host.installation.v1.InstallationNotice
-	14, // 22: host.installation.v1.OfferService.ListOffers:input_type -> host.installation.v1.ListOffersRequest
-	2,  // 23: host.installation.v1.OfferService.ReviewOffer:input_type -> host.installation.v1.ReviewRequest
-	11, // 24: host.installation.v1.InstallationService.Install:output_type -> host.installation.v1.Installation
-	3,  // 25: host.installation.v1.InstallationService.Review:output_type -> host.installation.v1.ConsentApproval
-	11, // 26: host.installation.v1.InstallationService.GrantRole:output_type -> host.installation.v1.Installation
-	11, // 27: host.installation.v1.InstallationService.RevokeRole:output_type -> host.installation.v1.Installation
-	7,  // 28: host.installation.v1.InstallationService.ListRoleGrants:output_type -> host.installation.v1.ListRoleGrantsResponse
-	10, // 29: host.installation.v1.InstallationService.List:output_type -> host.installation.v1.ListResponse
-	13, // 30: host.installation.v1.InstallableService.Install:output_type -> host.installation.v1.InstallationAck
-	15, // 31: host.installation.v1.OfferService.ListOffers:output_type -> host.installation.v1.ListOffersResponse
-	17, // 32: host.installation.v1.OfferService.ReviewOffer:output_type -> host.installation.v1.ReviewedOffer
-	24, // [24:33] is the sub-list for method output_type
-	15, // [15:24] is the sub-list for method input_type
+	13, // 4: host.installation.v1.InstallationNotice.installation:type_name -> host.installation.v1.Installation
+	18, // 5: host.installation.v1.ListOffersResponse.offers:type_name -> host.installation.v1.Offer
+	5,  // 6: host.installation.v1.ReviewedOffer.approval:type_name -> host.installation.v1.ConsentApproval
+	21, // 7: host.installation.v1.ReviewedOffer.roles:type_name -> host.installation.v1.OfferRole
+	13, // 8: host.installation.v1.ReviewedOffer.installation:type_name -> host.installation.v1.Installation
+	20, // 9: host.installation.v1.ReviewedOffer.ceiling:type_name -> host.installation.v1.OfferBinding
+	22, // 10: host.installation.v1.OfferBinding.scopes:type_name -> host.installation.v1.OfferScope
+	22, // 11: host.installation.v1.OfferRole.scopes:type_name -> host.installation.v1.OfferScope
+	23, // 12: host.installation.v1.OfferRole.capabilities:type_name -> host.installation.v1.OfferCapability
+	22, // 13: host.installation.v1.OfferCapability.requires:type_name -> host.installation.v1.OfferScope
+	24, // 14: host.installation.v1.OfferCapability.tools:type_name -> host.installation.v1.OfferTool
+	1,  // 15: host.installation.v1.InstallationService.Current:input_type -> host.installation.v1.CurrentInstallationRequest
+	3,  // 16: host.installation.v1.InstallationService.Install:input_type -> host.installation.v1.InstallRequest
+	4,  // 17: host.installation.v1.InstallationService.Review:input_type -> host.installation.v1.ReviewRequest
+	6,  // 18: host.installation.v1.InstallationService.GrantRole:input_type -> host.installation.v1.GrantRoleRequest
+	7,  // 19: host.installation.v1.InstallationService.RevokeRole:input_type -> host.installation.v1.RevokeRoleRequest
+	8,  // 20: host.installation.v1.InstallationService.ListRoleGrants:input_type -> host.installation.v1.ListRoleGrantsRequest
+	11, // 21: host.installation.v1.InstallationService.List:input_type -> host.installation.v1.ListRequest
+	14, // 22: host.installation.v1.InstallableService.Install:input_type -> host.installation.v1.InstallationNotice
+	16, // 23: host.installation.v1.OfferService.ListOffers:input_type -> host.installation.v1.ListOffersRequest
+	4,  // 24: host.installation.v1.OfferService.ReviewOffer:input_type -> host.installation.v1.ReviewRequest
+	2,  // 25: host.installation.v1.InstallationService.Current:output_type -> host.installation.v1.CurrentInstallation
+	13, // 26: host.installation.v1.InstallationService.Install:output_type -> host.installation.v1.Installation
+	5,  // 27: host.installation.v1.InstallationService.Review:output_type -> host.installation.v1.ConsentApproval
+	13, // 28: host.installation.v1.InstallationService.GrantRole:output_type -> host.installation.v1.Installation
+	13, // 29: host.installation.v1.InstallationService.RevokeRole:output_type -> host.installation.v1.Installation
+	9,  // 30: host.installation.v1.InstallationService.ListRoleGrants:output_type -> host.installation.v1.ListRoleGrantsResponse
+	12, // 31: host.installation.v1.InstallationService.List:output_type -> host.installation.v1.ListResponse
+	15, // 32: host.installation.v1.InstallableService.Install:output_type -> host.installation.v1.InstallationAck
+	17, // 33: host.installation.v1.OfferService.ListOffers:output_type -> host.installation.v1.ListOffersResponse
+	19, // 34: host.installation.v1.OfferService.ReviewOffer:output_type -> host.installation.v1.ReviewedOffer
+	25, // [25:35] is the sub-list for method output_type
+	15, // [15:25] is the sub-list for method input_type
 	15, // [15:15] is the sub-list for extension type_name
 	15, // [15:15] is the sub-list for extension extendee
 	0,  // [0:15] is the sub-list for field type_name
@@ -1716,7 +1859,7 @@ func file_host_installation_v1_installation_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_host_installation_v1_installation_proto_rawDesc), len(file_host_installation_v1_installation_proto_rawDesc)),
 			NumEnums:      1,
-			NumMessages:   22,
+			NumMessages:   24,
 			NumExtensions: 0,
 			NumServices:   3,
 		},
diff --git a/libraries/authority-client/go/gen/host/installation/v1/installation_grpc.pb.go b/libraries/authority-client/go/gen/host/installation/v1/installation_grpc.pb.go
index 9d10a53d..0fdefdf1 100644
--- a/libraries/authority-client/go/gen/host/installation/v1/installation_grpc.pb.go
+++ b/libraries/authority-client/go/gen/host/installation/v1/installation_grpc.pb.go
@@ -26,6 +26,7 @@ import (
 const _ = grpc.SupportPackageIsVersion9
 
 const (
+	InstallationService_Current_FullMethodName        = "/host.installation.v1.InstallationService/Current"
 	InstallationService_Install_FullMethodName        = "/host.installation.v1.InstallationService/Install"
 	InstallationService_Review_FullMethodName         = "/host.installation.v1.InstallationService/Review"
 	InstallationService_GrantRole_FullMethodName      = "/host.installation.v1.InstallationService/GrantRole"
@@ -40,6 +41,10 @@ const (
 //
 // InstallationService is implemented by the host and by the local authority.
 type InstallationServiceClient interface {
+	// Current reads only the authenticated module's own active installation,
+	// in the tenant of a current parent addressed to that module. It grants no
+	// artifact approval or content access and exposes no roles or grants.
+	Current(ctx context.Context, in *CurrentInstallationRequest, opts ...grpc.CallOption) (*CurrentInstallation, error)
 	// Install composes an installation: its agent principal, its root scope and
 	// the row, pending until the target acknowledges its install step.
 	Install(ctx context.Context, in *InstallRequest, opts ...grpc.CallOption) (*Installation, error)
@@ -70,6 +75,16 @@ func NewInstallationServiceClient(cc grpc.ClientConnInterface) InstallationServi
 	return &installationServiceClient{cc}
 }
 
+func (c *installationServiceClient) Current(ctx context.Context, in *CurrentInstallationRequest, opts ...grpc.CallOption) (*CurrentInstallation, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CurrentInstallation)
+	err := c.cc.Invoke(ctx, InstallationService_Current_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *installationServiceClient) Install(ctx context.Context, in *InstallRequest, opts ...grpc.CallOption) (*Installation, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Installation)
@@ -136,6 +151,10 @@ func (c *installationServiceClient) List(ctx context.Context, in *ListRequest, o
 //
 // InstallationService is implemented by the host and by the local authority.
 type InstallationServiceServer interface {
+	// Current reads only the authenticated module's own active installation,
+	// in the tenant of a current parent addressed to that module. It grants no
+	// artifact approval or content access and exposes no roles or grants.
+	Current(context.Context, *CurrentInstallationRequest) (*CurrentInstallation, error)
 	// Install composes an installation: its agent principal, its root scope and
 	// the row, pending until the target acknowledges its install step.
 	Install(context.Context, *InstallRequest) (*Installation, error)
@@ -166,6 +185,9 @@ type InstallationServiceServer interface {
 // pointer dereference when methods are called.
 type UnimplementedInstallationServiceServer struct{}
 
+func (UnimplementedInstallationServiceServer) Current(context.Context, *CurrentInstallationRequest) (*CurrentInstallation, error) {
+	return nil, status.Error(codes.Unimplemented, "method Current not implemented")
+}
 func (UnimplementedInstallationServiceServer) Install(context.Context, *InstallRequest) (*Installation, error) {
 	return nil, status.Error(codes.Unimplemented, "method Install not implemented")
 }
@@ -205,6 +227,24 @@ func RegisterInstallationServiceServer(s grpc.ServiceRegistrar, srv Installation
 	s.RegisterService(&InstallationService_ServiceDesc, srv)
 }
 
+func _InstallationService_Current_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CurrentInstallationRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(InstallationServiceServer).Current(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: InstallationService_Current_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(InstallationServiceServer).Current(ctx, req.(*CurrentInstallationRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _InstallationService_Install_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(InstallRequest)
 	if err := dec(in); err != nil {
@@ -320,6 +360,10 @@ var InstallationService_ServiceDesc = grpc.ServiceDesc{
 	ServiceName: "host.installation.v1.InstallationService",
 	HandlerType: (*InstallationServiceServer)(nil),
 	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Current",
+			Handler:    _InstallationService_Current_Handler,
+		},
 		{
 			MethodName: "Install",
 			Handler:    _InstallationService_Install_Handler,
diff --git a/libraries/authority-client/library.codefly.yaml b/libraries/authority-client/library.codefly.yaml
index 71aa1236..c122b43c 100644
--- a/libraries/authority-client/library.codefly.yaml
+++ b/libraries/authority-client/library.codefly.yaml
@@ -20,10 +20,10 @@ sources:
       module: authority
       service: local
       endpoint: grpc
-      contract-digest: sha256:1c51ec903d141b1df6c0eff0fcaa10aa48b6633e0753a13718bef83d086dc0cb
+      contract-digest: sha256:54359a530ee98bd87f610c7f37efc6a32010357635f6dabb8ceabae78d8a9ec5
       services:
         - LocalService
 generated-by:
-    codefly: 0.1.215
+    codefly: development
     companion: ghcr.io/codefly-dev/proto:0.0.18
     facade: false
diff --git a/libraries/authority-client/python/authority_client/_gen/host/installation/v1/installation_pb2.py b/libraries/authority-client/python/authority_client/_gen/host/installation/v1/installation_pb2.py
index e250988e..350b7ee2 100644
--- a/libraries/authority-client/python/authority_client/_gen/host/installation/v1/installation_pb2.py
+++ b/libraries/authority-client/python/authority_client/_gen/host/installation/v1/installation_pb2.py
@@ -24,7 +24,7 @@
 
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\'host/installation/v1/installation.proto\x12\x14host.installation.v1\"\xd0\x01\n\x0eInstallRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\x12\x16\n\x06target\x18\x02 \x01(\tR\x06target\x12\x12\n\x04role\x18\x03 \x01(\tR\x04role\x12&\n\x0fowner_person_id\x18\x04 \x01(\tR\rownerPersonId\x12\x41\n\x08\x61pproval\x18\x05 \x01(\x0b\x32%.host.installation.v1.ConsentApprovalR\x08\x61pproval\"P\n\rReviewRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\x12\x16\n\x06target\x18\x02 \x01(\tR\x06target\"\xb6\x01\n\x0f\x43onsentApproval\x12\x1b\n\ttarget_id\x18\x01 \x01(\tR\x08targetId\x12\x1e\n\ngeneration\x18\x02 \x01(\x04R\ngeneration\x12+\n\x11\x65xpected_revision\x18\x03 \x01(\x04R\x10\x65xpectedRevision\x12!\n\x0coperation_id\x18\x04 \x01(\tR\x0boperationId\x12\x16\n\x06\x64igest\x18\x05 \x01(\tR\x06\x64igest\"\xae\x01\n\x10GrantRoleRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\x12\'\n\x0finstallation_id\x18\x02 \x01(\tR\x0einstallationId\x12\x12\n\x04role\x18\x03 \x01(\tR\x04role\x12\x1b\n\tperson_id\x18\x04 \x01(\tR\x08personId\x12\x17\n\x07team_id\x18\x05 \x01(\tR\x06teamId\"\xaf\x01\n\x11RevokeRoleRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\x12\'\n\x0finstallation_id\x18\x02 \x01(\tR\x0einstallationId\x12\x12\n\x04role\x18\x03 \x01(\tR\x04role\x12\x1b\n\tperson_id\x18\x04 \x01(\tR\x08personId\x12\x17\n\x07team_id\x18\x05 \x01(\tR\x06teamId\"i\n\x15ListRoleGrantsRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\x12\'\n\x0finstallation_id\x18\x02 \x01(\tR\x0einstallationId\"Q\n\x16ListRoleGrantsResponse\x12\x37\n\x06grants\x18\x01 \x03(\x0b\x32\x1f.host.installation.v1.RoleGrantR\x06grants\"U\n\tRoleGrant\x12\x12\n\x04role\x18\x01 \x01(\tR\x04role\x12\x1b\n\tperson_id\x18\x02 \x01(\tR\x08personId\x12\x17\n\x07team_id\x18\x03 \x01(\tR\x06teamId\"6\n\x0bListRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\"X\n\x0cListResponse\x12H\n\rinstallations\x18\x01 \x03(\x0b\x32\".host.installation.v1.InstallationR\rinstallations\"\xb0\x03\n\x0cInstallation\x12\x0e\n\x02id\x18\x01 \x01(\tR\x02id\x12\'\n\x0forganization_id\x18\x02 \x01(\tR\x0eorganizationId\x12\x16\n\x06target\x18\x03 \x01(\tR\x06target\x12\x41\n\x06status\x18\x04 \x01(\x0e\x32).host.installation.v1.Installation.StatusR\x06status\x12\x1a\n\x08revision\x18\x05 \x01(\x04R\x08revision\x12\x12\n\x04role\x18\x06 \x01(\tR\x04role\x12\x1c\n\tnamespace\x18\t \x01(\tR\tnamespace\x12!\n\x0cprincipal_id\x18\n \x01(\tR\x0bprincipalId\x12\x14\n\x05roles\x18\x0b \x03(\tR\x05roles\"[\n\x06Status\x12\x16\n\x12STATUS_UNSPECIFIED\x10\x00\x12\x12\n\x0eSTATUS_PENDING\x10\x01\x12\x11\n\rSTATUS_ACTIVE\x10\x02\x12\x12\n\x0eSTATUS_REVOKED\x10\x03J\x04\x08\x07\x10\x08J\x04\x08\x08\x10\tR\x08team_idsR\x12\x61gent_principal_id\"\\\n\x12InstallationNotice\x12\x46\n\x0cinstallation\x18\x01 \x01(\x0b\x32\".host.installation.v1.InstallationR\x0cinstallation\"\x11\n\x0fInstallationAck\"<\n\x11ListOffersRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\"I\n\x12ListOffersResponse\x12\x33\n\x06offers\x18\x01 \x03(\x0b\x32\x1b.host.installation.v1.OfferR\x06offers\"?\n\x05Offer\x12\x16\n\x06target\x18\x01 \x01(\tR\x06target\x12\x1e\n\ngeneration\x18\x02 \x01(\x04R\ngeneration\"\xce\x02\n\rReviewedOffer\x12\x41\n\x08\x61pproval\x18\x01 \x01(\x0b\x32%.host.installation.v1.ConsentApprovalR\x08\x61pproval\x12\x16\n\x06target\x18\x02 \x01(\tR\x06target\x12\x35\n\x05roles\x18\x03 \x03(\x0b\x32\x1f.host.installation.v1.OfferRoleR\x05roles\x12\x46\n\x0cinstallation\x18\x04 \x01(\x0b\x32\".host.installation.v1.InstallationR\x0cinstallation\x12<\n\x07\x63\x65iling\x18\x05 \x03(\x0b\x32\".host.installation.v1.OfferBindingR\x07\x63\x65iling\x12%\n\x0etools_composed\x18\x06 \x01(\x08R\rtoolsComposed\"z\n\x0cOfferBinding\x12\x18\n\x07\x62inding\x18\x01 \x01(\tR\x07\x62inding\x12\x16\n\x06module\x18\x02 \x01(\tR\x06module\x12\x38\n\x06scopes\x18\x03 \x03(\x0b\x32 .host.installation.v1.OfferScopeR\x06scopes\"\xa4\x01\n\tOfferRole\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\x12\x38\n\x06scopes\x18\x02 \x03(\x0b\x32 .host.installation.v1.OfferScopeR\x06scopes\x12I\n\x0c\x63\x61pabilities\x18\x03 \x03(\x0b\x32%.host.installation.v1.OfferCapabilityR\x0c\x63\x61pabilities\"\x93\x01\n\nOfferScope\x12#\n\rresource_kind\x18\x01 \x01(\tR\x0cresourceKind\x12\x18\n\x07\x61\x63tions\x18\x02 \x03(\tR\x07\x61\x63tions\x12#\n\rattached_only\x18\x03 \x01(\x08R\x0c\x61ttachedOnly\x12!\n\x0cresource_ids\x18\x04 \x03(\tR\x0bresourceIds\"\xbc\x01\n\x0fOfferCapability\x12\x16\n\x06module\x18\x01 \x01(\tR\x06module\x12\x1c\n\toperation\x18\x02 \x01(\tR\toperation\x12<\n\x08requires\x18\x03 \x03(\x0b\x32 .host.installation.v1.OfferScopeR\x08requires\x12\x35\n\x05tools\x18\x04 \x03(\x0b\x32\x1f.host.installation.v1.OfferToolR\x05tools\"O\n\tOfferTool\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\x12\x18\n\x07\x62inding\x18\x02 \x01(\tR\x07\x62inding\x12\x14\n\x05write\x18\x03 \x01(\x08R\x05write2\xb0\x04\n\x13InstallationService\x12S\n\x07Install\x12$.host.installation.v1.InstallRequest\x1a\".host.installation.v1.Installation\x12T\n\x06Review\x12#.host.installation.v1.ReviewRequest\x1a%.host.installation.v1.ConsentApproval\x12W\n\tGrantRole\x12&.host.installation.v1.GrantRoleRequest\x1a\".host.installation.v1.Installation\x12Y\n\nRevokeRole\x12\'.host.installation.v1.RevokeRoleRequest\x1a\".host.installation.v1.Installation\x12k\n\x0eListRoleGrants\x12+.host.installation.v1.ListRoleGrantsRequest\x1a,.host.installation.v1.ListRoleGrantsResponse\x12M\n\x04List\x12!.host.installation.v1.ListRequest\x1a\".host.installation.v1.ListResponse2p\n\x12InstallableService\x12Z\n\x07Install\x12(.host.installation.v1.InstallationNotice\x1a%.host.installation.v1.InstallationAck2\xc8\x01\n\x0cOfferService\x12_\n\nListOffers\x12\'.host.installation.v1.ListOffersRequest\x1a(.host.installation.v1.ListOffersResponse\x12W\n\x0bReviewOffer\x12#.host.installation.v1.ReviewRequest\x1a#.host.installation.v1.ReviewedOfferB5Z3gateway/pkg/gen/host/installation/v1;installationv1b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\'host/installation/v1/installation.proto\x12\x14host.installation.v1\"j\n\x1a\x43urrentInstallationRequest\x12!\n\x0cparent_token\x18\x01 \x01(\tR\x0bparentToken\x12)\n\x10\x61\x63tor_credential\x18\x02 \x01(\tR\x0f\x61\x63torCredential\"\xa0\x01\n\x13\x43urrentInstallation\x12\x0e\n\x02id\x18\x01 \x01(\tR\x02id\x12\'\n\x0forganization_id\x18\x02 \x01(\tR\x0eorganizationId\x12\x16\n\x06target\x18\x03 \x01(\tR\x06target\x12\x1a\n\x08revision\x18\x04 \x01(\x04R\x08revision\x12\x1c\n\tnamespace\x18\x05 \x01(\tR\tnamespace\"\xd0\x01\n\x0eInstallRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\x12\x16\n\x06target\x18\x02 \x01(\tR\x06target\x12\x12\n\x04role\x18\x03 \x01(\tR\x04role\x12&\n\x0fowner_person_id\x18\x04 \x01(\tR\rownerPersonId\x12\x41\n\x08\x61pproval\x18\x05 \x01(\x0b\x32%.host.installation.v1.ConsentApprovalR\x08\x61pproval\"P\n\rReviewRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\x12\x16\n\x06target\x18\x02 \x01(\tR\x06target\"\xb6\x01\n\x0f\x43onsentApproval\x12\x1b\n\ttarget_id\x18\x01 \x01(\tR\x08targetId\x12\x1e\n\ngeneration\x18\x02 \x01(\x04R\ngeneration\x12+\n\x11\x65xpected_revision\x18\x03 \x01(\x04R\x10\x65xpectedRevision\x12!\n\x0coperation_id\x18\x04 \x01(\tR\x0boperationId\x12\x16\n\x06\x64igest\x18\x05 \x01(\tR\x06\x64igest\"\xae\x01\n\x10GrantRoleRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\x12\'\n\x0finstallation_id\x18\x02 \x01(\tR\x0einstallationId\x12\x12\n\x04role\x18\x03 \x01(\tR\x04role\x12\x1b\n\tperson_id\x18\x04 \x01(\tR\x08personId\x12\x17\n\x07team_id\x18\x05 \x01(\tR\x06teamId\"\xaf\x01\n\x11RevokeRoleRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\x12\'\n\x0finstallation_id\x18\x02 \x01(\tR\x0einstallationId\x12\x12\n\x04role\x18\x03 \x01(\tR\x04role\x12\x1b\n\tperson_id\x18\x04 \x01(\tR\x08personId\x12\x17\n\x07team_id\x18\x05 \x01(\tR\x06teamId\"i\n\x15ListRoleGrantsRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\x12\'\n\x0finstallation_id\x18\x02 \x01(\tR\x0einstallationId\"Q\n\x16ListRoleGrantsResponse\x12\x37\n\x06grants\x18\x01 \x03(\x0b\x32\x1f.host.installation.v1.RoleGrantR\x06grants\"U\n\tRoleGrant\x12\x12\n\x04role\x18\x01 \x01(\tR\x04role\x12\x1b\n\tperson_id\x18\x02 \x01(\tR\x08personId\x12\x17\n\x07team_id\x18\x03 \x01(\tR\x06teamId\"6\n\x0bListRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\"X\n\x0cListResponse\x12H\n\rinstallations\x18\x01 \x03(\x0b\x32\".host.installation.v1.InstallationR\rinstallations\"\xb0\x03\n\x0cInstallation\x12\x0e\n\x02id\x18\x01 \x01(\tR\x02id\x12\'\n\x0forganization_id\x18\x02 \x01(\tR\x0eorganizationId\x12\x16\n\x06target\x18\x03 \x01(\tR\x06target\x12\x41\n\x06status\x18\x04 \x01(\x0e\x32).host.installation.v1.Installation.StatusR\x06status\x12\x1a\n\x08revision\x18\x05 \x01(\x04R\x08revision\x12\x12\n\x04role\x18\x06 \x01(\tR\x04role\x12\x1c\n\tnamespace\x18\t \x01(\tR\tnamespace\x12!\n\x0cprincipal_id\x18\n \x01(\tR\x0bprincipalId\x12\x14\n\x05roles\x18\x0b \x03(\tR\x05roles\"[\n\x06Status\x12\x16\n\x12STATUS_UNSPECIFIED\x10\x00\x12\x12\n\x0eSTATUS_PENDING\x10\x01\x12\x11\n\rSTATUS_ACTIVE\x10\x02\x12\x12\n\x0eSTATUS_REVOKED\x10\x03J\x04\x08\x07\x10\x08J\x04\x08\x08\x10\tR\x08team_idsR\x12\x61gent_principal_id\"\\\n\x12InstallationNotice\x12\x46\n\x0cinstallation\x18\x01 \x01(\x0b\x32\".host.installation.v1.InstallationR\x0cinstallation\"\x11\n\x0fInstallationAck\"<\n\x11ListOffersRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\"I\n\x12ListOffersResponse\x12\x33\n\x06offers\x18\x01 \x03(\x0b\x32\x1b.host.installation.v1.OfferR\x06offers\"?\n\x05Offer\x12\x16\n\x06target\x18\x01 \x01(\tR\x06target\x12\x1e\n\ngeneration\x18\x02 \x01(\x04R\ngeneration\"\xce\x02\n\rReviewedOffer\x12\x41\n\x08\x61pproval\x18\x01 \x01(\x0b\x32%.host.installation.v1.ConsentApprovalR\x08\x61pproval\x12\x16\n\x06target\x18\x02 \x01(\tR\x06target\x12\x35\n\x05roles\x18\x03 \x03(\x0b\x32\x1f.host.installation.v1.OfferRoleR\x05roles\x12\x46\n\x0cinstallation\x18\x04 \x01(\x0b\x32\".host.installation.v1.InstallationR\x0cinstallation\x12<\n\x07\x63\x65iling\x18\x05 \x03(\x0b\x32\".host.installation.v1.OfferBindingR\x07\x63\x65iling\x12%\n\x0etools_composed\x18\x06 \x01(\x08R\rtoolsComposed\"z\n\x0cOfferBinding\x12\x18\n\x07\x62inding\x18\x01 \x01(\tR\x07\x62inding\x12\x16\n\x06module\x18\x02 \x01(\tR\x06module\x12\x38\n\x06scopes\x18\x03 \x03(\x0b\x32 .host.installation.v1.OfferScopeR\x06scopes\"\xa4\x01\n\tOfferRole\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\x12\x38\n\x06scopes\x18\x02 \x03(\x0b\x32 .host.installation.v1.OfferScopeR\x06scopes\x12I\n\x0c\x63\x61pabilities\x18\x03 \x03(\x0b\x32%.host.installation.v1.OfferCapabilityR\x0c\x63\x61pabilities\"\x93\x01\n\nOfferScope\x12#\n\rresource_kind\x18\x01 \x01(\tR\x0cresourceKind\x12\x18\n\x07\x61\x63tions\x18\x02 \x03(\tR\x07\x61\x63tions\x12#\n\rattached_only\x18\x03 \x01(\x08R\x0c\x61ttachedOnly\x12!\n\x0cresource_ids\x18\x04 \x03(\tR\x0bresourceIds\"\xbc\x01\n\x0fOfferCapability\x12\x16\n\x06module\x18\x01 \x01(\tR\x06module\x12\x1c\n\toperation\x18\x02 \x01(\tR\toperation\x12<\n\x08requires\x18\x03 \x03(\x0b\x32 .host.installation.v1.OfferScopeR\x08requires\x12\x35\n\x05tools\x18\x04 \x03(\x0b\x32\x1f.host.installation.v1.OfferToolR\x05tools\"O\n\tOfferTool\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\x12\x18\n\x07\x62inding\x18\x02 \x01(\tR\x07\x62inding\x12\x14\n\x05write\x18\x03 \x01(\x08R\x05write2\x98\x05\n\x13InstallationService\x12\x66\n\x07\x43urrent\x12\x30.host.installation.v1.CurrentInstallationRequest\x1a).host.installation.v1.CurrentInstallation\x12S\n\x07Install\x12$.host.installation.v1.InstallRequest\x1a\".host.installation.v1.Installation\x12T\n\x06Review\x12#.host.installation.v1.ReviewRequest\x1a%.host.installation.v1.ConsentApproval\x12W\n\tGrantRole\x12&.host.installation.v1.GrantRoleRequest\x1a\".host.installation.v1.Installation\x12Y\n\nRevokeRole\x12\'.host.installation.v1.RevokeRoleRequest\x1a\".host.installation.v1.Installation\x12k\n\x0eListRoleGrants\x12+.host.installation.v1.ListRoleGrantsRequest\x1a,.host.installation.v1.ListRoleGrantsResponse\x12M\n\x04List\x12!.host.installation.v1.ListRequest\x1a\".host.installation.v1.ListResponse2p\n\x12InstallableService\x12Z\n\x07Install\x12(.host.installation.v1.InstallationNotice\x1a%.host.installation.v1.InstallationAck2\xc8\x01\n\x0cOfferService\x12_\n\nListOffers\x12\'.host.installation.v1.ListOffersRequest\x1a(.host.installation.v1.ListOffersResponse\x12W\n\x0bReviewOffer\x12#.host.installation.v1.ReviewRequest\x1a#.host.installation.v1.ReviewedOfferB5Z3gateway/pkg/gen/host/installation/v1;installationv1b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -32,56 +32,60 @@
 if not _descriptor._USE_C_DESCRIPTORS:
   _globals['DESCRIPTOR']._loaded_options = None
   _globals['DESCRIPTOR']._serialized_options = b'Z3gateway/pkg/gen/host/installation/v1;installationv1'
-  _globals['_INSTALLREQUEST']._serialized_start=66
-  _globals['_INSTALLREQUEST']._serialized_end=274
-  _globals['_REVIEWREQUEST']._serialized_start=276
-  _globals['_REVIEWREQUEST']._serialized_end=356
-  _globals['_CONSENTAPPROVAL']._serialized_start=359
-  _globals['_CONSENTAPPROVAL']._serialized_end=541
-  _globals['_GRANTROLEREQUEST']._serialized_start=544
-  _globals['_GRANTROLEREQUEST']._serialized_end=718
-  _globals['_REVOKEROLEREQUEST']._serialized_start=721
-  _globals['_REVOKEROLEREQUEST']._serialized_end=896
-  _globals['_LISTROLEGRANTSREQUEST']._serialized_start=898
-  _globals['_LISTROLEGRANTSREQUEST']._serialized_end=1003
-  _globals['_LISTROLEGRANTSRESPONSE']._serialized_start=1005
-  _globals['_LISTROLEGRANTSRESPONSE']._serialized_end=1086
-  _globals['_ROLEGRANT']._serialized_start=1088
-  _globals['_ROLEGRANT']._serialized_end=1173
-  _globals['_LISTREQUEST']._serialized_start=1175
-  _globals['_LISTREQUEST']._serialized_end=1229
-  _globals['_LISTRESPONSE']._serialized_start=1231
-  _globals['_LISTRESPONSE']._serialized_end=1319
-  _globals['_INSTALLATION']._serialized_start=1322
-  _globals['_INSTALLATION']._serialized_end=1754
-  _globals['_INSTALLATION_STATUS']._serialized_start=1621
-  _globals['_INSTALLATION_STATUS']._serialized_end=1712
-  _globals['_INSTALLATIONNOTICE']._serialized_start=1756
-  _globals['_INSTALLATIONNOTICE']._serialized_end=1848
-  _globals['_INSTALLATIONACK']._serialized_start=1850
-  _globals['_INSTALLATIONACK']._serialized_end=1867
-  _globals['_LISTOFFERSREQUEST']._serialized_start=1869
-  _globals['_LISTOFFERSREQUEST']._serialized_end=1929
-  _globals['_LISTOFFERSRESPONSE']._serialized_start=1931
-  _globals['_LISTOFFERSRESPONSE']._serialized_end=2004
-  _globals['_OFFER']._serialized_start=2006
-  _globals['_OFFER']._serialized_end=2069
-  _globals['_REVIEWEDOFFER']._serialized_start=2072
-  _globals['_REVIEWEDOFFER']._serialized_end=2406
-  _globals['_OFFERBINDING']._serialized_start=2408
-  _globals['_OFFERBINDING']._serialized_end=2530
-  _globals['_OFFERROLE']._serialized_start=2533
-  _globals['_OFFERROLE']._serialized_end=2697
-  _globals['_OFFERSCOPE']._serialized_start=2700
-  _globals['_OFFERSCOPE']._serialized_end=2847
-  _globals['_OFFERCAPABILITY']._serialized_start=2850
-  _globals['_OFFERCAPABILITY']._serialized_end=3038
-  _globals['_OFFERTOOL']._serialized_start=3040
-  _globals['_OFFERTOOL']._serialized_end=3119
-  _globals['_INSTALLATIONSERVICE']._serialized_start=3122
-  _globals['_INSTALLATIONSERVICE']._serialized_end=3682
-  _globals['_INSTALLABLESERVICE']._serialized_start=3684
-  _globals['_INSTALLABLESERVICE']._serialized_end=3796
-  _globals['_OFFERSERVICE']._serialized_start=3799
-  _globals['_OFFERSERVICE']._serialized_end=3999
+  _globals['_CURRENTINSTALLATIONREQUEST']._serialized_start=65
+  _globals['_CURRENTINSTALLATIONREQUEST']._serialized_end=171
+  _globals['_CURRENTINSTALLATION']._serialized_start=174
+  _globals['_CURRENTINSTALLATION']._serialized_end=334
+  _globals['_INSTALLREQUEST']._serialized_start=337
+  _globals['_INSTALLREQUEST']._serialized_end=545
+  _globals['_REVIEWREQUEST']._serialized_start=547
+  _globals['_REVIEWREQUEST']._serialized_end=627
+  _globals['_CONSENTAPPROVAL']._serialized_start=630
+  _globals['_CONSENTAPPROVAL']._serialized_end=812
+  _globals['_GRANTROLEREQUEST']._serialized_start=815
+  _globals['_GRANTROLEREQUEST']._serialized_end=989
+  _globals['_REVOKEROLEREQUEST']._serialized_start=992
+  _globals['_REVOKEROLEREQUEST']._serialized_end=1167
+  _globals['_LISTROLEGRANTSREQUEST']._serialized_start=1169
+  _globals['_LISTROLEGRANTSREQUEST']._serialized_end=1274
+  _globals['_LISTROLEGRANTSRESPONSE']._serialized_start=1276
+  _globals['_LISTROLEGRANTSRESPONSE']._serialized_end=1357
+  _globals['_ROLEGRANT']._serialized_start=1359
+  _globals['_ROLEGRANT']._serialized_end=1444
+  _globals['_LISTREQUEST']._serialized_start=1446
+  _globals['_LISTREQUEST']._serialized_end=1500
+  _globals['_LISTRESPONSE']._serialized_start=1502
+  _globals['_LISTRESPONSE']._serialized_end=1590
+  _globals['_INSTALLATION']._serialized_start=1593
+  _globals['_INSTALLATION']._serialized_end=2025
+  _globals['_INSTALLATION_STATUS']._serialized_start=1892
+  _globals['_INSTALLATION_STATUS']._serialized_end=1983
+  _globals['_INSTALLATIONNOTICE']._serialized_start=2027
+  _globals['_INSTALLATIONNOTICE']._serialized_end=2119
+  _globals['_INSTALLATIONACK']._serialized_start=2121
+  _globals['_INSTALLATIONACK']._serialized_end=2138
+  _globals['_LISTOFFERSREQUEST']._serialized_start=2140
+  _globals['_LISTOFFERSREQUEST']._serialized_end=2200
+  _globals['_LISTOFFERSRESPONSE']._serialized_start=2202
+  _globals['_LISTOFFERSRESPONSE']._serialized_end=2275
+  _globals['_OFFER']._serialized_start=2277
+  _globals['_OFFER']._serialized_end=2340
+  _globals['_REVIEWEDOFFER']._serialized_start=2343
+  _globals['_REVIEWEDOFFER']._serialized_end=2677
+  _globals['_OFFERBINDING']._serialized_start=2679
+  _globals['_OFFERBINDING']._serialized_end=2801
+  _globals['_OFFERROLE']._serialized_start=2804
+  _globals['_OFFERROLE']._serialized_end=2968
+  _globals['_OFFERSCOPE']._serialized_start=2971
+  _globals['_OFFERSCOPE']._serialized_end=3118
+  _globals['_OFFERCAPABILITY']._serialized_start=3121
+  _globals['_OFFERCAPABILITY']._serialized_end=3309
+  _globals['_OFFERTOOL']._serialized_start=3311
+  _globals['_OFFERTOOL']._serialized_end=3390
+  _globals['_INSTALLATIONSERVICE']._serialized_start=3393
+  _globals['_INSTALLATIONSERVICE']._serialized_end=4057
+  _globals['_INSTALLABLESERVICE']._serialized_start=4059
+  _globals['_INSTALLABLESERVICE']._serialized_end=4171
+  _globals['_OFFERSERVICE']._serialized_start=4174
+  _globals['_OFFERSERVICE']._serialized_end=4374
 # @@protoc_insertion_point(module_scope)
diff --git a/libraries/authority-client/python/authority_client/_gen/host/installation/v1/installation_pb2_grpc.py b/libraries/authority-client/python/authority_client/_gen/host/installation/v1/installation_pb2_grpc.py
index bfc11e86..aced0741 100644
--- a/libraries/authority-client/python/authority_client/_gen/host/installation/v1/installation_pb2_grpc.py
+++ b/libraries/authority-client/python/authority_client/_gen/host/installation/v1/installation_pb2_grpc.py
@@ -35,6 +35,11 @@ def __init__(self, channel):
         Args:
             channel: A grpc.Channel.
         """
+        self.Current = channel.unary_unary(
+                '/host.installation.v1.InstallationService/Current',
+                request_serializer=host_dot_installation_dot_v1_dot_installation__pb2.CurrentInstallationRequest.SerializeToString,
+                response_deserializer=host_dot_installation_dot_v1_dot_installation__pb2.CurrentInstallation.FromString,
+                _registered_method=True)
         self.Install = channel.unary_unary(
                 '/host.installation.v1.InstallationService/Install',
                 request_serializer=host_dot_installation_dot_v1_dot_installation__pb2.InstallRequest.SerializeToString,
@@ -71,6 +76,15 @@ class InstallationServiceServicer(object):
     """InstallationService is implemented by the host and by the local authority.
     """
 
+    def Current(self, request, context):
+        """Current reads only the authenticated module's own active installation,
+        in the tenant of a current parent addressed to that module. It grants no
+        artifact approval or content access and exposes no roles or grants.
+        """
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
     def Install(self, request, context):
         """Install composes an installation: its agent principal, its root scope and
         the row, pending until the target acknowledges its install step.
@@ -124,6 +138,11 @@ def List(self, request, context):
 
 def add_InstallationServiceServicer_to_server(servicer, server):
     rpc_method_handlers = {
+            'Current': grpc.unary_unary_rpc_method_handler(
+                    servicer.Current,
+                    request_deserializer=host_dot_installation_dot_v1_dot_installation__pb2.CurrentInstallationRequest.FromString,
+                    response_serializer=host_dot_installation_dot_v1_dot_installation__pb2.CurrentInstallation.SerializeToString,
+            ),
             'Install': grpc.unary_unary_rpc_method_handler(
                     servicer.Install,
                     request_deserializer=host_dot_installation_dot_v1_dot_installation__pb2.InstallRequest.FromString,
@@ -166,6 +185,33 @@ class InstallationService(object):
     """InstallationService is implemented by the host and by the local authority.
     """
 
+    @staticmethod
+    def Current(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(
+            request,
+            target,
+            '/host.installation.v1.InstallationService/Current',
+            host_dot_installation_dot_v1_dot_installation__pb2.CurrentInstallationRequest.SerializeToString,
+            host_dot_installation_dot_v1_dot_installation__pb2.CurrentInstallation.FromString,
+            options,
+            channel_credentials,
+            insecure,
+            call_credentials,
+            compression,
+            wait_for_ready,
+            timeout,
+            metadata,
+            _registered_method=True)
+
     @staticmethod
     def Install(request,
             target,
diff --git a/libraries/authority-client/typescript/src/gen/host/installation/v1/installation_pb.ts b/libraries/authority-client/typescript/src/gen/host/installation/v1/installation_pb.ts
index f68224eb..9287e565 100644
--- a/libraries/authority-client/typescript/src/gen/host/installation/v1/installation_pb.ts
+++ b/libraries/authority-client/typescript/src/gen/host/installation/v1/installation_pb.ts
@@ -16,7 +16,68 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file host/installation/v1/installation.proto.
  */
 export const file_host_installation_v1_installation: GenFile = /*@__PURE__*/
-  fileDesc("Cidob3N0L2luc3RhbGxhdGlvbi92MS9pbnN0YWxsYXRpb24ucHJvdG8SFGhvc3QuaW5zdGFsbGF0aW9uLnYxIpkBCg5JbnN0YWxsUmVxdWVzdBIXCg9vcmdhbml6YXRpb25faWQYASABKAkSDgoGdGFyZ2V0GAIgASgJEgwKBHJvbGUYAyABKAkSFwoPb3duZXJfcGVyc29uX2lkGAQgASgJEjcKCGFwcHJvdmFsGAUgASgLMiUuaG9zdC5pbnN0YWxsYXRpb24udjEuQ29uc2VudEFwcHJvdmFsIjgKDVJldmlld1JlcXVlc3QSFwoPb3JnYW5pemF0aW9uX2lkGAEgASgJEg4KBnRhcmdldBgCIAEoCSJ5Cg9Db25zZW50QXBwcm92YWwSEQoJdGFyZ2V0X2lkGAEgASgJEhIKCmdlbmVyYXRpb24YAiABKAQSGQoRZXhwZWN0ZWRfcmV2aXNpb24YAyABKAQSFAoMb3BlcmF0aW9uX2lkGAQgASgJEg4KBmRpZ2VzdBgFIAEoCSJ2ChBHcmFudFJvbGVSZXF1ZXN0EhcKD29yZ2FuaXphdGlvbl9pZBgBIAEoCRIXCg9pbnN0YWxsYXRpb25faWQYAiABKAkSDAoEcm9sZRgDIAEoCRIRCglwZXJzb25faWQYBCABKAkSDwoHdGVhbV9pZBgFIAEoCSJ3ChFSZXZva2VSb2xlUmVxdWVzdBIXCg9vcmdhbml6YXRpb25faWQYASABKAkSFwoPaW5zdGFsbGF0aW9uX2lkGAIgASgJEgwKBHJvbGUYAyABKAkSEQoJcGVyc29uX2lkGAQgASgJEg8KB3RlYW1faWQYBSABKAkiSQoVTGlzdFJvbGVHcmFudHNSZXF1ZXN0EhcKD29yZ2FuaXphdGlvbl9pZBgBIAEoCRIXCg9pbnN0YWxsYXRpb25faWQYAiABKAkiSQoWTGlzdFJvbGVHcmFudHNSZXNwb25zZRIvCgZncmFudHMYASADKAsyHy5ob3N0Lmluc3RhbGxhdGlvbi52MS5Sb2xlR3JhbnQiPQoJUm9sZUdyYW50EgwKBHJvbGUYASABKAkSEQoJcGVyc29uX2lkGAIgASgJEg8KB3RlYW1faWQYAyABKAkiJgoLTGlzdFJlcXVlc3QSFwoPb3JnYW5pemF0aW9uX2lkGAEgASgJIkkKDExpc3RSZXNwb25zZRI5Cg1pbnN0YWxsYXRpb25zGAEgAygLMiIuaG9zdC5pbnN0YWxsYXRpb24udjEuSW5zdGFsbGF0aW9uIt0CCgxJbnN0YWxsYXRpb24SCgoCaWQYASABKAkSFwoPb3JnYW5pemF0aW9uX2lkGAIgASgJEg4KBnRhcmdldBgDIAEoCRI5CgZzdGF0dXMYBCABKA4yKS5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb24uU3RhdHVzEhAKCHJldmlzaW9uGAUgASgEEgwKBHJvbGUYBiABKAkSEQoJbmFtZXNwYWNlGAkgASgJEhQKDHByaW5jaXBhbF9pZBgKIAEoCRINCgVyb2xlcxgLIAMoCSJbCgZTdGF0dXMSFgoSU1RBVFVTX1VOU1BFQ0lGSUVEEAASEgoOU1RBVFVTX1BFTkRJTkcQARIRCg1TVEFUVVNfQUNUSVZFEAISEgoOU1RBVFVTX1JFVk9LRUQQA0oECAcQCEoECAgQCVIIdGVhbV9pZHNSEmFnZW50X3ByaW5jaXBhbF9pZCJOChJJbnN0YWxsYXRpb25Ob3RpY2USOAoMaW5zdGFsbGF0aW9uGAEgASgLMiIuaG9zdC5pbnN0YWxsYXRpb24udjEuSW5zdGFsbGF0aW9uIhEKD0luc3RhbGxhdGlvbkFjayIsChFMaXN0T2ZmZXJzUmVxdWVzdBIXCg9vcmdhbml6YXRpb25faWQYASABKAkiQQoSTGlzdE9mZmVyc1Jlc3BvbnNlEisKBm9mZmVycxgBIAMoCzIbLmhvc3QuaW5zdGFsbGF0aW9uLnYxLk9mZmVyIisKBU9mZmVyEg4KBnRhcmdldBgBIAEoCRISCgpnZW5lcmF0aW9uGAIgASgEIo8CCg1SZXZpZXdlZE9mZmVyEjcKCGFwcHJvdmFsGAEgASgLMiUuaG9zdC5pbnN0YWxsYXRpb24udjEuQ29uc2VudEFwcHJvdmFsEg4KBnRhcmdldBgCIAEoCRIuCgVyb2xlcxgDIAMoCzIfLmhvc3QuaW5zdGFsbGF0aW9uLnYxLk9mZmVyUm9sZRI4CgxpbnN0YWxsYXRpb24YBCABKAsyIi5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb24SMwoHY2VpbGluZxgFIAMoCzIiLmhvc3QuaW5zdGFsbGF0aW9uLnYxLk9mZmVyQmluZGluZxIWCg50b29sc19jb21wb3NlZBgGIAEoCCJhCgxPZmZlckJpbmRpbmcSDwoHYmluZGluZxgBIAEoCRIOCgZtb2R1bGUYAiABKAkSMAoGc2NvcGVzGAMgAygLMiAuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJTY29wZSKIAQoJT2ZmZXJSb2xlEgwKBG5hbWUYASABKAkSMAoGc2NvcGVzGAIgAygLMiAuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJTY29wZRI7CgxjYXBhYmlsaXRpZXMYAyADKAsyJS5ob3N0Lmluc3RhbGxhdGlvbi52MS5PZmZlckNhcGFiaWxpdHkiYQoKT2ZmZXJTY29wZRIVCg1yZXNvdXJjZV9raW5kGAEgASgJEg8KB2FjdGlvbnMYAiADKAkSFQoNYXR0YWNoZWRfb25seRgDIAEoCBIUCgxyZXNvdXJjZV9pZHMYBCADKAkimAEKD09mZmVyQ2FwYWJpbGl0eRIOCgZtb2R1bGUYASABKAkSEQoJb3BlcmF0aW9uGAIgASgJEjIKCHJlcXVpcmVzGAMgAygLMiAuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJTY29wZRIuCgV0b29scxgEIAMoCzIfLmhvc3QuaW5zdGFsbGF0aW9uLnYxLk9mZmVyVG9vbCI5CglPZmZlclRvb2wSDAoEbmFtZRgBIAEoCRIPCgdiaW5kaW5nGAIgASgJEg0KBXdyaXRlGAMgASgIMrAEChNJbnN0YWxsYXRpb25TZXJ2aWNlElMKB0luc3RhbGwSJC5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsUmVxdWVzdBoiLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkluc3RhbGxhdGlvbhJUCgZSZXZpZXcSIy5ob3N0Lmluc3RhbGxhdGlvbi52MS5SZXZpZXdSZXF1ZXN0GiUuaG9zdC5pbnN0YWxsYXRpb24udjEuQ29uc2VudEFwcHJvdmFsElcKCUdyYW50Um9sZRImLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkdyYW50Um9sZVJlcXVlc3QaIi5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb24SWQoKUmV2b2tlUm9sZRInLmhvc3QuaW5zdGFsbGF0aW9uLnYxLlJldm9rZVJvbGVSZXF1ZXN0GiIuaG9zdC5pbnN0YWxsYXRpb24udjEuSW5zdGFsbGF0aW9uEmsKDkxpc3RSb2xlR3JhbnRzEisuaG9zdC5pbnN0YWxsYXRpb24udjEuTGlzdFJvbGVHcmFudHNSZXF1ZXN0GiwuaG9zdC5pbnN0YWxsYXRpb24udjEuTGlzdFJvbGVHcmFudHNSZXNwb25zZRJNCgRMaXN0EiEuaG9zdC5pbnN0YWxsYXRpb24udjEuTGlzdFJlcXVlc3QaIi5ob3N0Lmluc3RhbGxhdGlvbi52MS5MaXN0UmVzcG9uc2UycAoSSW5zdGFsbGFibGVTZXJ2aWNlEloKB0luc3RhbGwSKC5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb25Ob3RpY2UaJS5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb25BY2syyAEKDE9mZmVyU2VydmljZRJfCgpMaXN0T2ZmZXJzEicuaG9zdC5pbnN0YWxsYXRpb24udjEuTGlzdE9mZmVyc1JlcXVlc3QaKC5ob3N0Lmluc3RhbGxhdGlvbi52MS5MaXN0T2ZmZXJzUmVzcG9uc2USVwoLUmV2aWV3T2ZmZXISIy5ob3N0Lmluc3RhbGxhdGlvbi52MS5SZXZpZXdSZXF1ZXN0GiMuaG9zdC5pbnN0YWxsYXRpb24udjEuUmV2aWV3ZWRPZmZlckI1WjNnYXRld2F5L3BrZy9nZW4vaG9zdC9pbnN0YWxsYXRpb24vdjE7aW5zdGFsbGF0aW9udjFiBnByb3RvMw");
+  fileDesc("Cidob3N0L2luc3RhbGxhdGlvbi92MS9pbnN0YWxsYXRpb24ucHJvdG8SFGhvc3QuaW5zdGFsbGF0aW9uLnYxIkwKGkN1cnJlbnRJbnN0YWxsYXRpb25SZXF1ZXN0EhQKDHBhcmVudF90b2tlbhgBIAEoCRIYChBhY3Rvcl9jcmVkZW50aWFsGAIgASgJIm8KE0N1cnJlbnRJbnN0YWxsYXRpb24SCgoCaWQYASABKAkSFwoPb3JnYW5pemF0aW9uX2lkGAIgASgJEg4KBnRhcmdldBgDIAEoCRIQCghyZXZpc2lvbhgEIAEoBBIRCgluYW1lc3BhY2UYBSABKAkimQEKDkluc3RhbGxSZXF1ZXN0EhcKD29yZ2FuaXphdGlvbl9pZBgBIAEoCRIOCgZ0YXJnZXQYAiABKAkSDAoEcm9sZRgDIAEoCRIXCg9vd25lcl9wZXJzb25faWQYBCABKAkSNwoIYXBwcm92YWwYBSABKAsyJS5ob3N0Lmluc3RhbGxhdGlvbi52MS5Db25zZW50QXBwcm92YWwiOAoNUmV2aWV3UmVxdWVzdBIXCg9vcmdhbml6YXRpb25faWQYASABKAkSDgoGdGFyZ2V0GAIgASgJInkKD0NvbnNlbnRBcHByb3ZhbBIRCgl0YXJnZXRfaWQYASABKAkSEgoKZ2VuZXJhdGlvbhgCIAEoBBIZChFleHBlY3RlZF9yZXZpc2lvbhgDIAEoBBIUCgxvcGVyYXRpb25faWQYBCABKAkSDgoGZGlnZXN0GAUgASgJInYKEEdyYW50Um9sZVJlcXVlc3QSFwoPb3JnYW5pemF0aW9uX2lkGAEgASgJEhcKD2luc3RhbGxhdGlvbl9pZBgCIAEoCRIMCgRyb2xlGAMgASgJEhEKCXBlcnNvbl9pZBgEIAEoCRIPCgd0ZWFtX2lkGAUgASgJIncKEVJldm9rZVJvbGVSZXF1ZXN0EhcKD29yZ2FuaXphdGlvbl9pZBgBIAEoCRIXCg9pbnN0YWxsYXRpb25faWQYAiABKAkSDAoEcm9sZRgDIAEoCRIRCglwZXJzb25faWQYBCABKAkSDwoHdGVhbV9pZBgFIAEoCSJJChVMaXN0Um9sZUdyYW50c1JlcXVlc3QSFwoPb3JnYW5pemF0aW9uX2lkGAEgASgJEhcKD2luc3RhbGxhdGlvbl9pZBgCIAEoCSJJChZMaXN0Um9sZUdyYW50c1Jlc3BvbnNlEi8KBmdyYW50cxgBIAMoCzIfLmhvc3QuaW5zdGFsbGF0aW9uLnYxLlJvbGVHcmFudCI9CglSb2xlR3JhbnQSDAoEcm9sZRgBIAEoCRIRCglwZXJzb25faWQYAiABKAkSDwoHdGVhbV9pZBgDIAEoCSImCgtMaXN0UmVxdWVzdBIXCg9vcmdhbml6YXRpb25faWQYASABKAkiSQoMTGlzdFJlc3BvbnNlEjkKDWluc3RhbGxhdGlvbnMYASADKAsyIi5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb24i3QIKDEluc3RhbGxhdGlvbhIKCgJpZBgBIAEoCRIXCg9vcmdhbml6YXRpb25faWQYAiABKAkSDgoGdGFyZ2V0GAMgASgJEjkKBnN0YXR1cxgEIAEoDjIpLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkluc3RhbGxhdGlvbi5TdGF0dXMSEAoIcmV2aXNpb24YBSABKAQSDAoEcm9sZRgGIAEoCRIRCgluYW1lc3BhY2UYCSABKAkSFAoMcHJpbmNpcGFsX2lkGAogASgJEg0KBXJvbGVzGAsgAygJIlsKBlN0YXR1cxIWChJTVEFUVVNfVU5TUEVDSUZJRUQQABISCg5TVEFUVVNfUEVORElORxABEhEKDVNUQVRVU19BQ1RJVkUQAhISCg5TVEFUVVNfUkVWT0tFRBADSgQIBxAISgQICBAJUgh0ZWFtX2lkc1ISYWdlbnRfcHJpbmNpcGFsX2lkIk4KEkluc3RhbGxhdGlvbk5vdGljZRI4CgxpbnN0YWxsYXRpb24YASABKAsyIi5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb24iEQoPSW5zdGFsbGF0aW9uQWNrIiwKEUxpc3RPZmZlcnNSZXF1ZXN0EhcKD29yZ2FuaXphdGlvbl9pZBgBIAEoCSJBChJMaXN0T2ZmZXJzUmVzcG9uc2USKwoGb2ZmZXJzGAEgAygLMhsuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXIiKwoFT2ZmZXISDgoGdGFyZ2V0GAEgASgJEhIKCmdlbmVyYXRpb24YAiABKAQijwIKDVJldmlld2VkT2ZmZXISNwoIYXBwcm92YWwYASABKAsyJS5ob3N0Lmluc3RhbGxhdGlvbi52MS5Db25zZW50QXBwcm92YWwSDgoGdGFyZ2V0GAIgASgJEi4KBXJvbGVzGAMgAygLMh8uaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJSb2xlEjgKDGluc3RhbGxhdGlvbhgEIAEoCzIiLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkluc3RhbGxhdGlvbhIzCgdjZWlsaW5nGAUgAygLMiIuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJCaW5kaW5nEhYKDnRvb2xzX2NvbXBvc2VkGAYgASgIImEKDE9mZmVyQmluZGluZxIPCgdiaW5kaW5nGAEgASgJEg4KBm1vZHVsZRgCIAEoCRIwCgZzY29wZXMYAyADKAsyIC5ob3N0Lmluc3RhbGxhdGlvbi52MS5PZmZlclNjb3BlIogBCglPZmZlclJvbGUSDAoEbmFtZRgBIAEoCRIwCgZzY29wZXMYAiADKAsyIC5ob3N0Lmluc3RhbGxhdGlvbi52MS5PZmZlclNjb3BlEjsKDGNhcGFiaWxpdGllcxgDIAMoCzIlLmhvc3QuaW5zdGFsbGF0aW9uLnYxLk9mZmVyQ2FwYWJpbGl0eSJhCgpPZmZlclNjb3BlEhUKDXJlc291cmNlX2tpbmQYASABKAkSDwoHYWN0aW9ucxgCIAMoCRIVCg1hdHRhY2hlZF9vbmx5GAMgASgIEhQKDHJlc291cmNlX2lkcxgEIAMoCSKYAQoPT2ZmZXJDYXBhYmlsaXR5Eg4KBm1vZHVsZRgBIAEoCRIRCglvcGVyYXRpb24YAiABKAkSMgoIcmVxdWlyZXMYAyADKAsyIC5ob3N0Lmluc3RhbGxhdGlvbi52MS5PZmZlclNjb3BlEi4KBXRvb2xzGAQgAygLMh8uaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJUb29sIjkKCU9mZmVyVG9vbBIMCgRuYW1lGAEgASgJEg8KB2JpbmRpbmcYAiABKAkSDQoFd3JpdGUYAyABKAgymAUKE0luc3RhbGxhdGlvblNlcnZpY2USZgoHQ3VycmVudBIwLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkN1cnJlbnRJbnN0YWxsYXRpb25SZXF1ZXN0GikuaG9zdC5pbnN0YWxsYXRpb24udjEuQ3VycmVudEluc3RhbGxhdGlvbhJTCgdJbnN0YWxsEiQuaG9zdC5pbnN0YWxsYXRpb24udjEuSW5zdGFsbFJlcXVlc3QaIi5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb24SVAoGUmV2aWV3EiMuaG9zdC5pbnN0YWxsYXRpb24udjEuUmV2aWV3UmVxdWVzdBolLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkNvbnNlbnRBcHByb3ZhbBJXCglHcmFudFJvbGUSJi5ob3N0Lmluc3RhbGxhdGlvbi52MS5HcmFudFJvbGVSZXF1ZXN0GiIuaG9zdC5pbnN0YWxsYXRpb24udjEuSW5zdGFsbGF0aW9uElkKClJldm9rZVJvbGUSJy5ob3N0Lmluc3RhbGxhdGlvbi52MS5SZXZva2VSb2xlUmVxdWVzdBoiLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkluc3RhbGxhdGlvbhJrCg5MaXN0Um9sZUdyYW50cxIrLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkxpc3RSb2xlR3JhbnRzUmVxdWVzdBosLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkxpc3RSb2xlR3JhbnRzUmVzcG9uc2USTQoETGlzdBIhLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkxpc3RSZXF1ZXN0GiIuaG9zdC5pbnN0YWxsYXRpb24udjEuTGlzdFJlc3BvbnNlMnAKEkluc3RhbGxhYmxlU2VydmljZRJaCgdJbnN0YWxsEiguaG9zdC5pbnN0YWxsYXRpb24udjEuSW5zdGFsbGF0aW9uTm90aWNlGiUuaG9zdC5pbnN0YWxsYXRpb24udjEuSW5zdGFsbGF0aW9uQWNrMsgBCgxPZmZlclNlcnZpY2USXwoKTGlzdE9mZmVycxInLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkxpc3RPZmZlcnNSZXF1ZXN0GiguaG9zdC5pbnN0YWxsYXRpb24udjEuTGlzdE9mZmVyc1Jlc3BvbnNlElcKC1Jldmlld09mZmVyEiMuaG9zdC5pbnN0YWxsYXRpb24udjEuUmV2aWV3UmVxdWVzdBojLmhvc3QuaW5zdGFsbGF0aW9uLnYxLlJldmlld2VkT2ZmZXJCNVozZ2F0ZXdheS9wa2cvZ2VuL2hvc3QvaW5zdGFsbGF0aW9uL3YxO2luc3RhbGxhdGlvbnYxYgZwcm90bzM");
+
+/**
+ * @generated from message host.installation.v1.CurrentInstallationRequest
+ */
+export type CurrentInstallationRequest = Message<"host.installation.v1.CurrentInstallationRequest"> & {
+  /**
+   * @generated from field: string parent_token = 1;
+   */
+  parentToken: string;
+
+  /**
+   * @generated from field: string actor_credential = 2;
+   */
+  actorCredential: string;
+};
+
+/**
+ * Describes the message host.installation.v1.CurrentInstallationRequest.
+ * Use `create(CurrentInstallationRequestSchema)` to create a new message.
+ */
+export const CurrentInstallationRequestSchema: GenMessage<CurrentInstallationRequest> = /*@__PURE__*/
+  messageDesc(file_host_installation_v1_installation, 0);
+
+/**
+ * CurrentInstallation is request-local metadata, never a lease or consent.
+ *
+ * @generated from message host.installation.v1.CurrentInstallation
+ */
+export type CurrentInstallation = Message<"host.installation.v1.CurrentInstallation"> & {
+  /**
+   * @generated from field: string id = 1;
+   */
+  id: string;
+
+  /**
+   * @generated from field: string organization_id = 2;
+   */
+  organizationId: string;
+
+  /**
+   * @generated from field: string target = 3;
+   */
+  target: string;
+
+  /**
+   * @generated from field: uint64 revision = 4;
+   */
+  revision: bigint;
+
+  /**
+   * @generated from field: string namespace = 5;
+   */
+  namespace: string;
+};
+
+/**
+ * Describes the message host.installation.v1.CurrentInstallation.
+ * Use `create(CurrentInstallationSchema)` to create a new message.
+ */
+export const CurrentInstallationSchema: GenMessage<CurrentInstallation> = /*@__PURE__*/
+  messageDesc(file_host_installation_v1_installation, 1);
 
 /**
  * InstallRequest asks to install one target at one organisation.
@@ -65,7 +126,7 @@ export type InstallRequest = Message<"host.installation.v1.InstallRequest"> & {
  * Use `create(InstallRequestSchema)` to create a new message.
  */
 export const InstallRequestSchema: GenMessage<InstallRequest> = /*@__PURE__*/
-  messageDesc(file_host_installation_v1_installation, 0);
+  messageDesc(file_host_installation_v1_installation, 2);
 
 /**
  * ReviewRequest names the offer an administrator intends to review.
@@ -89,7 +150,7 @@ export type ReviewRequest = Message<"host.installation.v1.ReviewRequest"> & {
  * Use `create(ReviewRequestSchema)` to create a new message.
  */
 export const ReviewRequestSchema: GenMessage<ReviewRequest> = /*@__PURE__*/
-  messageDesc(file_host_installation_v1_installation, 1);
+  messageDesc(file_host_installation_v1_installation, 3);
 
 /**
  * ConsentApproval binds consent to an immutable target, its reviewed delivery and
@@ -132,7 +193,7 @@ export type ConsentApproval = Message<"host.installation.v1.ConsentApproval"> &
  * Use `create(ConsentApprovalSchema)` to create a new message.
  */
 export const ConsentApprovalSchema: GenMessage<ConsentApproval> = /*@__PURE__*/
-  messageDesc(file_host_installation_v1_installation, 2);
+  messageDesc(file_host_installation_v1_installation, 4);
 
 /**
  * GrantRoleRequest grants one role to exactly one person or team.
@@ -184,7 +245,7 @@ export type GrantRoleRequest = Message<"host.installation.v1.GrantRoleRequest">
  * Use `create(GrantRoleRequestSchema)` to create a new message.
  */
 export const GrantRoleRequestSchema: GenMessage<GrantRoleRequest> = /*@__PURE__*/
-  messageDesc(file_host_installation_v1_installation, 3);
+  messageDesc(file_host_installation_v1_installation, 5);
 
 /**
  * RevokeRoleRequest ends one grant, named as GrantRole named it.
@@ -233,7 +294,7 @@ export type RevokeRoleRequest = Message<"host.installation.v1.RevokeRoleRequest"
  * Use `create(RevokeRoleRequestSchema)` to create a new message.
  */
 export const RevokeRoleRequestSchema: GenMessage<RevokeRoleRequest> = /*@__PURE__*/
-  messageDesc(file_host_installation_v1_installation, 4);
+  messageDesc(file_host_installation_v1_installation, 6);
 
 /**
  * ListRoleGrantsRequest names one installation.
@@ -261,7 +322,7 @@ export type ListRoleGrantsRequest = Message<"host.installation.v1.ListRoleGrants
  * Use `create(ListRoleGrantsRequestSchema)` to create a new message.
  */
 export const ListRoleGrantsRequestSchema: GenMessage<ListRoleGrantsRequest> = /*@__PURE__*/
-  messageDesc(file_host_installation_v1_installation, 5);
+  messageDesc(file_host_installation_v1_installation, 7);
 
 /**
  * ListRoleGrantsResponse is every grant on the installation.
@@ -282,7 +343,7 @@ export type ListRoleGrantsResponse = Message<"host.installation.v1.ListRoleGrant
  * Use `create(ListRoleGrantsResponseSchema)` to create a new message.
  */
 export const ListRoleGrantsResponseSchema: GenMessage<ListRoleGrantsResponse> = /*@__PURE__*/
-  messageDesc(file_host_installation_v1_installation, 6);
+  messageDesc(file_host_installation_v1_installation, 8);
 
 /**
  * RoleGrant is one role held by one person or team.
@@ -317,7 +378,7 @@ export type RoleGrant = Message<"host.installation.v1.RoleGrant"> & {
  * Use `create(RoleGrantSchema)` to create a new message.
  */
 export const RoleGrantSchema: GenMessage<RoleGrant> = /*@__PURE__*/
-  messageDesc(file_host_installation_v1_installation, 7);
+  messageDesc(file_host_installation_v1_installation, 9);
 
 /**
  * ListRequest asks for one organisation's installations.
@@ -338,7 +399,7 @@ export type ListRequest = Message<"host.installation.v1.ListRequest"> & {
  * Use `create(ListRequestSchema)` to create a new message.
  */
 export const ListRequestSchema: GenMessage<ListRequest> = /*@__PURE__*/
-  messageDesc(file_host_installation_v1_installation, 8);
+  messageDesc(file_host_installation_v1_installation, 10);
 
 /**
  * ListResponse lists installations.
@@ -359,7 +420,7 @@ export type ListResponse = Message<"host.installation.v1.ListResponse"> & {
  * Use `create(ListResponseSchema)` to create a new message.
  */
 export const ListResponseSchema: GenMessage<ListResponse> = /*@__PURE__*/
-  messageDesc(file_host_installation_v1_installation, 9);
+  messageDesc(file_host_installation_v1_installation, 11);
 
 /**
  * Installation is one organisation's installation of one target.
@@ -442,7 +503,7 @@ export type Installation = Message<"host.installation.v1.Installation"> & {
  * Use `create(InstallationSchema)` to create a new message.
  */
 export const InstallationSchema: GenMessage<Installation> = /*@__PURE__*/
-  messageDesc(file_host_installation_v1_installation, 10);
+  messageDesc(file_host_installation_v1_installation, 12);
 
 /**
  * Status is the installation's lifecycle.
@@ -483,7 +544,7 @@ export enum Installation_Status {
  * Describes the enum host.installation.v1.Installation.Status.
  */
 export const Installation_StatusSchema: GenEnum<Installation_Status> = /*@__PURE__*/
-  enumDesc(file_host_installation_v1_installation, 10, 0);
+  enumDesc(file_host_installation_v1_installation, 12, 0);
 
 /**
  * InstallationNotice is what the host hands the solution's install step.
@@ -504,7 +565,7 @@ export type InstallationNotice = Message<"host.installation.v1.InstallationNotic
  * Use `create(InstallationNoticeSchema)` to create a new message.
  */
 export const InstallationNoticeSchema: GenMessage<InstallationNotice> = /*@__PURE__*/
-  messageDesc(file_host_installation_v1_installation, 11);
+  messageDesc(file_host_installation_v1_installation, 13);
 
 /**
  * InstallationAck acknowledges the install step.
@@ -519,7 +580,7 @@ export type InstallationAck = Message<"host.installation.v1.InstallationAck"> &
  * Use `create(InstallationAckSchema)` to create a new message.
  */
 export const InstallationAckSchema: GenMessage<InstallationAck> = /*@__PURE__*/
-  messageDesc(file_host_installation_v1_installation, 12);
+  messageDesc(file_host_installation_v1_installation, 14);
 
 /**
  * ListOffersRequest names the organization whose administrator reads.
@@ -538,7 +599,7 @@ export type ListOffersRequest = Message<"host.installation.v1.ListOffersRequest"
  * Use `create(ListOffersRequestSchema)` to create a new message.
  */
 export const ListOffersRequestSchema: GenMessage<ListOffersRequest> = /*@__PURE__*/
-  messageDesc(file_host_installation_v1_installation, 13);
+  messageDesc(file_host_installation_v1_installation, 15);
 
 /**
  * ListOffersResponse is every delivered solution, by name.
@@ -557,7 +618,7 @@ export type ListOffersResponse = Message<"host.installation.v1.ListOffersRespons
  * Use `create(ListOffersResponseSchema)` to create a new message.
  */
 export const ListOffersResponseSchema: GenMessage<ListOffersResponse> = /*@__PURE__*/
-  messageDesc(file_host_installation_v1_installation, 14);
+  messageDesc(file_host_installation_v1_installation, 16);
 
 /**
  * Offer is one delivered solution.
@@ -585,7 +646,7 @@ export type Offer = Message<"host.installation.v1.Offer"> & {
  * Use `create(OfferSchema)` to create a new message.
  */
 export const OfferSchema: GenMessage<Offer> = /*@__PURE__*/
-  messageDesc(file_host_installation_v1_installation, 15);
+  messageDesc(file_host_installation_v1_installation, 17);
 
 /**
  * ReviewedOffer is one solution's authority offer and the consent that names it.
@@ -643,7 +704,7 @@ export type ReviewedOffer = Message<"host.installation.v1.ReviewedOffer"> & {
  * Use `create(ReviewedOfferSchema)` to create a new message.
  */
 export const ReviewedOfferSchema: GenMessage<ReviewedOffer> = /*@__PURE__*/
-  messageDesc(file_host_installation_v1_installation, 16);
+  messageDesc(file_host_installation_v1_installation, 18);
 
 /**
  * OfferBinding is one declared call from the solution to a module.
@@ -674,7 +735,7 @@ export type OfferBinding = Message<"host.installation.v1.OfferBinding"> & {
  * Use `create(OfferBindingSchema)` to create a new message.
  */
 export const OfferBindingSchema: GenMessage<OfferBinding> = /*@__PURE__*/
-  messageDesc(file_host_installation_v1_installation, 17);
+  messageDesc(file_host_installation_v1_installation, 19);
 
 /**
  * OfferRole is one declared role and what a grant of it reaches.
@@ -707,7 +768,7 @@ export type OfferRole = Message<"host.installation.v1.OfferRole"> & {
  * Use `create(OfferRoleSchema)` to create a new message.
  */
 export const OfferRoleSchema: GenMessage<OfferRole> = /*@__PURE__*/
-  messageDesc(file_host_installation_v1_installation, 18);
+  messageDesc(file_host_installation_v1_installation, 20);
 
 /**
  * OfferScope is one declared scope.
@@ -745,7 +806,7 @@ export type OfferScope = Message<"host.installation.v1.OfferScope"> & {
  * Use `create(OfferScopeSchema)` to create a new message.
  */
 export const OfferScopeSchema: GenMessage<OfferScope> = /*@__PURE__*/
-  messageDesc(file_host_installation_v1_installation, 19);
+  messageDesc(file_host_installation_v1_installation, 21);
 
 /**
  * OfferCapability is one module operation a role's scopes cover.
@@ -786,7 +847,7 @@ export type OfferCapability = Message<"host.installation.v1.OfferCapability"> &
  * Use `create(OfferCapabilitySchema)` to create a new message.
  */
 export const OfferCapabilitySchema: GenMessage<OfferCapability> = /*@__PURE__*/
-  messageDesc(file_host_installation_v1_installation, 20);
+  messageDesc(file_host_installation_v1_installation, 22);
 
 /**
  * OfferTool is one tool-exposed Runnable of an operation.
@@ -821,7 +882,7 @@ export type OfferTool = Message<"host.installation.v1.OfferTool"> & {
  * Use `create(OfferToolSchema)` to create a new message.
  */
 export const OfferToolSchema: GenMessage<OfferTool> = /*@__PURE__*/
-  messageDesc(file_host_installation_v1_installation, 21);
+  messageDesc(file_host_installation_v1_installation, 23);
 
 /**
  * InstallationService is implemented by the host and by the local authority.
@@ -829,6 +890,18 @@ export const OfferToolSchema: GenMessage<OfferTool> = /*@__PURE__*/
  * @generated from service host.installation.v1.InstallationService
  */
 export const InstallationService: GenService<{
+  /**
+   * Current reads only the authenticated module's own active installation,
+   * in the tenant of a current parent addressed to that module. It grants no
+   * artifact approval or content access and exposes no roles or grants.
+   *
+   * @generated from rpc host.installation.v1.InstallationService.Current
+   */
+  current: {
+    methodKind: "unary";
+    input: typeof CurrentInstallationRequestSchema;
+    output: typeof CurrentInstallationSchema;
+  },
   /**
    * Install composes an installation: its agent principal, its root scope and
    * the row, pending until the target acknowledges its install step.
diff --git a/libraries/authority-core/go/authority/current.go b/libraries/authority-core/go/authority/current.go
new file mode 100644
index 00000000..18a3480f
--- /dev/null
+++ b/libraries/authority-core/go/authority/current.go
@@ -0,0 +1,40 @@
+package authority
+
+import (
+	"context"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+)
+
+// CurrentInstallation reads only the authenticated workload's installation
+// in its current parent's tenant. A child is sealed to its source actor, so
+// the seal is verified but is not the destination installation selector.
+func (s *Service) CurrentInstallation(ctx context.Context, parent string, actor Workload) (domain.Installation, error) {
+	var module domain.Module
+	err := s.store.Read(ctx, func(tx Tx) error {
+		var err error
+		module, err = tx.ModuleNamed(actor.Module)
+		return notFound(err)
+	})
+	if err != nil {
+		return domain.Installation{}, err
+	}
+	verified, _, err := s.Check(ctx, parent, module.Principal)
+	if err != nil {
+		return domain.Installation{}, err
+	}
+	claims := verified.Context()
+	var out domain.Installation
+	err = s.store.Read(ctx, func(tx Tx) error {
+		inst, err := installationOf(tx, claims.GetTenantId(), module.Name)
+		if err != nil {
+			return err
+		}
+		if inst.Status != domain.Active || inst.Target != module.Name {
+			return domain.Missing("the authenticated module has no active installation in the parent organization")
+		}
+		out = inst
+		return nil
+	})
+	return out, err
+}
diff --git a/libraries/authority-core/go/authority/current_test.go b/libraries/authority-core/go/authority/current_test.go
new file mode 100644
index 00000000..1dcf7676
--- /dev/null
+++ b/libraries/authority-core/go/authority/current_test.go
@@ -0,0 +1,59 @@
+package authority_test
+
+import (
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	resources "github.com/codefly-dev/authority/libraries/resources/go"
+	"testing"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/authority"
+)
+
+func TestCurrentInstallationIsConfinedToTheAuthenticatedAudience(t *testing.T) {
+	h := newHarness(t)
+	parent := h.must(h.root("rob", "store", sc(kind, "read")))
+	inst, err := h.svc.CurrentInstallation(h.ctx, parent.Token, authority.Workload{Module: "store"})
+	if err != nil || inst.ID != authority.StableInstallationID(acme, "store") || inst.Organization != acme || inst.Target != "store" {
+		t.Fatalf("current installation: %+v %v", inst, err)
+	}
+	for _, actor := range []string{"legacy-store", "a", "missing", ""} {
+		if _, err := h.svc.CurrentInstallation(h.ctx, parent.Token, authority.Workload{Module: actor}); err == nil {
+			t.Fatalf("foreign workload %q read an installation", actor)
+		}
+	}
+	if _, err := h.svc.CurrentInstallation(h.ctx, "forged", authority.Workload{Module: "store"}); err == nil {
+		t.Fatal("forged parent read an installation")
+	}
+	h.store.PutPerson(domain.Person{ID: "omar", Organization: globex, Roles: []string{"store-reader"}})
+	h.store.PutOrgRole(domain.OrgRole{Organization: globex, Name: "store-reader", Scopes: []domain.RoleScope{{Kind: kind, Actions: []string{"read"}, Resources: []resources.Grant{{ID: "store-x"}}}}})
+	foreign := h.must(h.root("omar", "store", sc(kind, "read")))
+	other, err := h.svc.CurrentInstallation(h.ctx, foreign.Token, authority.Workload{Module: "store"})
+	if err != nil || other.Organization != globex || other.ID == inst.ID {
+		t.Fatalf("tenant isolation: %+v %v", other, err)
+	}
+}
+
+func TestCurrentInstallationRechecksRevokedAuthority(t *testing.T) {
+	h := newHarness(t)
+	h.grant("a", "viewer", "maya")
+	parent := h.must(h.root("maya", "a"))
+	if _, err := h.svc.CurrentInstallation(h.ctx, parent.Token, authority.Workload{Module: "a"}); err != nil {
+		t.Fatal(err)
+	}
+	h.revoke("a", "viewer", "maya", "")
+	if _, err := h.svc.CurrentInstallation(h.ctx, parent.Token, authority.Workload{Module: "a"}); err == nil {
+		t.Fatal("revoked parent still read installation metadata")
+	}
+}
+
+func TestCurrentInstallationForAChildIsTheDestinationNotTheSource(t *testing.T) {
+	h := newHarness(t)
+	h.grant("a", "viewer", "maya")
+	child := h.must(h.through("maya", "a", "store"))
+	if child.Context.GetSeal().GetInstallationId() != h.inst(acme, "a").ID {
+		t.Fatal("fixture must carry a source-actor seal")
+	}
+	got, err := h.svc.CurrentInstallation(h.ctx, child.Token, authority.Workload{Module: "store"})
+	if err != nil || got.ID != authority.StableInstallationID(acme, "store") {
+		t.Fatalf("destination installation: %+v %v", got, err)
+	}
+}
diff --git a/libraries/conformance/go/README.md b/libraries/conformance/go/README.md
index 29a75683..c033af78 100644
--- a/libraries/conformance/go/README.md
+++ b/libraries/conformance/go/README.md
@@ -173,3 +173,8 @@ replay after revocation. The local core additionally rechecks the offer and
 administrator in the transaction that acknowledges the install step. Its digest
 covers the stored authority declarations, including roles, ceilings and bindings;
 it is opaque to callers. Host-owned fixture setup stays on `InstallAsHost`.
+
+`InstallationService.Current` is also required: an authenticated module reads its
+own current installation without an administrator session. The suite checks
+the returned association, namespace, invalid parent and foreign/missing workload
+credentials. This is metadata only; the installation inventory remains admin-only.
diff --git a/libraries/conformance/go/conformance.go b/libraries/conformance/go/conformance.go
index 6c397e18..bd6bfd90 100644
--- a/libraries/conformance/go/conformance.go
+++ b/libraries/conformance/go/conformance.go
@@ -263,6 +263,7 @@ func Run(t *testing.T, conn grpc.ClientConnInterface, descriptors []byte, f Fixt
 	c.admissionStatus(t, ctx, f)
 	c.solutionRoleCases(t, ctx, f)
 	c.installationIdentity(t, ctx, f)
+	c.currentInstallation(t, ctx, f)
 	c.sessionDisplayNames(t, ctx, f)
 	c.bindingRefusals(t, ctx, f)
 	c.forwardedContext(t, ctx, f)
diff --git a/libraries/conformance/go/current_installation.go b/libraries/conformance/go/current_installation.go
new file mode 100644
index 00000000..dba078de
--- /dev/null
+++ b/libraries/conformance/go/current_installation.go
@@ -0,0 +1,30 @@
+package conformance
+
+import (
+	"context"
+	"testing"
+
+	"google.golang.org/grpc/codes"
+)
+
+func (c *client) currentInstallation(t *testing.T, ctx context.Context, f Fixture) {
+	t.Run("a module reads only its current installation", func(t *testing.T) {
+		viewer := c.must(t, ctx, "host.session.v1.SessionService", "SignIn", map[string]any{"fixture_token": f.ViewerToken})
+		parent := c.must(t, as(ctx, viewer), "host.authority.v1.AuthorityService", "Issue", map[string]any{"person": map[string]any{}, "audience": f.WorkloadModule})
+		req := map[string]any{"parent_token": str(parent, "token"), "actor_credential": f.WorkloadCredential}
+		current := c.must(t, ctx, "host.installation.v1.InstallationService", "Current", req)
+		seal := msg(msg(parent, "context"), "seal")
+		if str(current, "id") != str(seal, "installation_id") || str(current, "organization_id") != f.Organization || str(current, "namespace") == "" || str(current, "target") == "" {
+			t.Fatalf("current installation differs from parent: %v", current)
+		}
+		for _, probe := range []struct {
+			credential string
+			code       codes.Code
+		}{{"", codes.PermissionDenied}, {"forged", codes.PermissionDenied}, {f.InstalledCredential, codes.Unauthenticated}} {
+			_, err := c.call(ctx, "host.installation.v1.InstallationService", "Current", map[string]any{"parent_token": str(parent, "token"), "actor_credential": probe.credential})
+			refused(t, err, probe.code, "")
+		}
+		_, err := c.call(ctx, "host.installation.v1.InstallationService", "Current", map[string]any{"parent_token": "forged", "actor_credential": f.WorkloadCredential})
+		refused(t, err, codes.Unauthenticated, "")
+	})
+}
diff --git a/modules/authority/contracts/api/catalog.codefly.json b/modules/authority/contracts/api/catalog.codefly.json
index e9fd90d6..aa4bb917 100644
--- a/modules/authority/contracts/api/catalog.codefly.json
+++ b/modules/authority/contracts/api/catalog.codefly.json
@@ -43,7 +43,7 @@
       "kind": "protobuf",
       "package": "",
       "path": "contracts/api/local/grpc/contract.binpb",
-      "digest": "sha256:1c51ec903d141b1df6c0eff0fcaa10aa48b6633e0753a13718bef83d086dc0cb",
+      "digest": "sha256:54359a530ee98bd87f610c7f37efc6a32010357635f6dabb8ceabae78d8a9ec5",
       "services": [
         {
           "name": "LocalService",
@@ -89,6 +89,7 @@
           "name": "InstallationService",
           "fullName": "host.installation.v1.InstallationService",
           "procedures": [
+            "/host.installation.v1.InstallationService/Current",
             "/host.installation.v1.InstallationService/GrantRole",
             "/host.installation.v1.InstallationService/Install",
             "/host.installation.v1.InstallationService/List",
diff --git a/modules/authority/contracts/api/local/grpc/contract.binpb b/modules/authority/contracts/api/local/grpc/contract.binpb
index 64bdfd23..06d1cd77 100644
Binary files a/modules/authority/contracts/api/local/grpc/contract.binpb and b/modules/authority/contracts/api/local/grpc/contract.binpb differ
diff --git a/modules/authority/contracts/api/local/grpc/proto/host/installation/v1/installation.proto b/modules/authority/contracts/api/local/grpc/proto/host/installation/v1/installation.proto
index a346fc14..c1ebefd9 100644
--- a/modules/authority/contracts/api/local/grpc/proto/host/installation/v1/installation.proto
+++ b/modules/authority/contracts/api/local/grpc/proto/host/installation/v1/installation.proto
@@ -10,6 +10,10 @@ option go_package = "gateway/pkg/gen/host/installation/v1;installationv1";
 
 // InstallationService is implemented by the host and by the local authority.
 service InstallationService {
+  // Current reads only the authenticated module's own active installation,
+  // in the tenant of a current parent addressed to that module. It grants no
+  // artifact approval or content access and exposes no roles or grants.
+  rpc Current(CurrentInstallationRequest) returns (CurrentInstallation);
   // Install composes an installation: its agent principal, its root scope and
   // the row, pending until the target acknowledges its install step.
   rpc Install(InstallRequest) returns (Installation);
@@ -32,6 +36,20 @@ service InstallationService {
   rpc List(ListRequest) returns (ListResponse);
 }
 
+message CurrentInstallationRequest {
+  string parent_token = 1;
+  string actor_credential = 2;
+}
+
+// CurrentInstallation is request-local metadata, never a lease or consent.
+message CurrentInstallation {
+  string id = 1;
+  string organization_id = 2;
+  string target = 3;
+  uint64 revision = 4;
+  string namespace = 5;
+}
+
 // InstallableService is implemented by a solution; the host calls it once per
 // installation and retries until it is acknowledged.
 service InstallableService {
diff --git a/modules/authority/module.codefly.yaml b/modules/authority/module.codefly.yaml
index ff165f99..adbe41b8 100644
--- a/modules/authority/module.codefly.yaml
+++ b/modules/authority/module.codefly.yaml
@@ -10,7 +10,7 @@ interface:
           implements:
               - codefly.dev/authority@0.3.3
               - codefly.dev/composition@0.2.0
-              - codefly.dev/installation@0.2.0
+              - codefly.dev/installation@0.3.0
               - codefly.dev/session@0.2.0
         # The REST face publishes the authority's keys as a JSON Web Key Set
         # (/.well-known/jwks.json), for a module that reads them by URL.
diff --git a/modules/authority/module.package.codefly.yaml b/modules/authority/module.package.codefly.yaml
index a0601f52..81515e85 100644
--- a/modules/authority/module.package.codefly.yaml
+++ b/modules/authority/module.package.codefly.yaml
@@ -26,7 +26,7 @@ services:
         kind: protobuf
         package: ""
         path: contracts/api/local/grpc/contract.binpb
-        digest: sha256:1c51ec903d141b1df6c0eff0fcaa10aa48b6633e0753a13718bef83d086dc0cb
+        digest: sha256:54359a530ee98bd87f610c7f37efc6a32010357635f6dabb8ceabae78d8a9ec5
       - endpoint: rest
         kind: openapi
         package: api.proto
diff --git a/modules/authority/services/edge/service.codefly.yaml b/modules/authority/services/edge/service.codefly.yaml
index 1e700caf..d938bf7b 100644
--- a/modules/authority/services/edge/service.codefly.yaml
+++ b/modules/authority/services/edge/service.codefly.yaml
@@ -17,7 +17,7 @@ agent:
 service-dependencies:
     - interface: codefly.dev/authority@>=0.2.0 <0.4.0
     - interface: codefly.dev/session@0.2.0
-    - interface: codefly.dev/installation@>=0.1.0 <0.3.0
+    - interface: codefly.dev/installation@>=0.1.0 <0.4.0
 workspace-configuration-dependencies:
     # The modules the edge routes to, their REST and Connect faces, and the
     # frontend every other path serves (code/main.go).
diff --git a/modules/authority/services/local/code/pkg/gen/host/installation/v1/installation.pb.go b/modules/authority/services/local/code/pkg/gen/host/installation/v1/installation.pb.go
index 8b607260..af3c9d53 100644
--- a/modules/authority/services/local/code/pkg/gen/host/installation/v1/installation.pb.go
+++ b/modules/authority/services/local/code/pkg/gen/host/installation/v1/installation.pb.go
@@ -82,7 +82,136 @@ func (x Installation_Status) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use Installation_Status.Descriptor instead.
 func (Installation_Status) EnumDescriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{10, 0}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{12, 0}
+}
+
+type CurrentInstallationRequest struct {
+	state           protoimpl.MessageState `protogen:"open.v1"`
+	ParentToken     string                 `protobuf:"bytes,1,opt,name=parent_token,json=parentToken,proto3" json:"parent_token,omitempty"`
+	ActorCredential string                 `protobuf:"bytes,2,opt,name=actor_credential,json=actorCredential,proto3" json:"actor_credential,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
+}
+
+func (x *CurrentInstallationRequest) Reset() {
+	*x = CurrentInstallationRequest{}
+	mi := &file_host_installation_v1_installation_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CurrentInstallationRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CurrentInstallationRequest) ProtoMessage() {}
+
+func (x *CurrentInstallationRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_host_installation_v1_installation_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CurrentInstallationRequest.ProtoReflect.Descriptor instead.
+func (*CurrentInstallationRequest) Descriptor() ([]byte, []int) {
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *CurrentInstallationRequest) GetParentToken() string {
+	if x != nil {
+		return x.ParentToken
+	}
+	return ""
+}
+
+func (x *CurrentInstallationRequest) GetActorCredential() string {
+	if x != nil {
+		return x.ActorCredential
+	}
+	return ""
+}
+
+// CurrentInstallation is request-local metadata, never a lease or consent.
+type CurrentInstallation struct {
+	state          protoimpl.MessageState `protogen:"open.v1"`
+	Id             string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	OrganizationId string                 `protobuf:"bytes,2,opt,name=organization_id,json=organizationId,proto3" json:"organization_id,omitempty"`
+	Target         string                 `protobuf:"bytes,3,opt,name=target,proto3" json:"target,omitempty"`
+	Revision       uint64                 `protobuf:"varint,4,opt,name=revision,proto3" json:"revision,omitempty"`
+	Namespace      string                 `protobuf:"bytes,5,opt,name=namespace,proto3" json:"namespace,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
+}
+
+func (x *CurrentInstallation) Reset() {
+	*x = CurrentInstallation{}
+	mi := &file_host_installation_v1_installation_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CurrentInstallation) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CurrentInstallation) ProtoMessage() {}
+
+func (x *CurrentInstallation) ProtoReflect() protoreflect.Message {
+	mi := &file_host_installation_v1_installation_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CurrentInstallation.ProtoReflect.Descriptor instead.
+func (*CurrentInstallation) Descriptor() ([]byte, []int) {
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *CurrentInstallation) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *CurrentInstallation) GetOrganizationId() string {
+	if x != nil {
+		return x.OrganizationId
+	}
+	return ""
+}
+
+func (x *CurrentInstallation) GetTarget() string {
+	if x != nil {
+		return x.Target
+	}
+	return ""
+}
+
+func (x *CurrentInstallation) GetRevision() uint64 {
+	if x != nil {
+		return x.Revision
+	}
+	return 0
+}
+
+func (x *CurrentInstallation) GetNamespace() string {
+	if x != nil {
+		return x.Namespace
+	}
+	return ""
 }
 
 // InstallRequest asks to install one target at one organisation.
@@ -104,7 +233,7 @@ type InstallRequest struct {
 
 func (x *InstallRequest) Reset() {
 	*x = InstallRequest{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[0]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[2]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -116,7 +245,7 @@ func (x *InstallRequest) String() string {
 func (*InstallRequest) ProtoMessage() {}
 
 func (x *InstallRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[0]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[2]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -129,7 +258,7 @@ func (x *InstallRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InstallRequest.ProtoReflect.Descriptor instead.
 func (*InstallRequest) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{0}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *InstallRequest) GetOrganizationId() string {
@@ -178,7 +307,7 @@ type ReviewRequest struct {
 
 func (x *ReviewRequest) Reset() {
 	*x = ReviewRequest{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[1]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[3]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -190,7 +319,7 @@ func (x *ReviewRequest) String() string {
 func (*ReviewRequest) ProtoMessage() {}
 
 func (x *ReviewRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[1]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[3]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -203,7 +332,7 @@ func (x *ReviewRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReviewRequest.ProtoReflect.Descriptor instead.
 func (*ReviewRequest) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{1}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *ReviewRequest) GetOrganizationId() string {
@@ -237,7 +366,7 @@ type ConsentApproval struct {
 
 func (x *ConsentApproval) Reset() {
 	*x = ConsentApproval{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[2]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[4]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -249,7 +378,7 @@ func (x *ConsentApproval) String() string {
 func (*ConsentApproval) ProtoMessage() {}
 
 func (x *ConsentApproval) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[2]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[4]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -262,7 +391,7 @@ func (x *ConsentApproval) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ConsentApproval.ProtoReflect.Descriptor instead.
 func (*ConsentApproval) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{2}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *ConsentApproval) GetTargetId() string {
@@ -322,7 +451,7 @@ type GrantRoleRequest struct {
 
 func (x *GrantRoleRequest) Reset() {
 	*x = GrantRoleRequest{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[3]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[5]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -334,7 +463,7 @@ func (x *GrantRoleRequest) String() string {
 func (*GrantRoleRequest) ProtoMessage() {}
 
 func (x *GrantRoleRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[3]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[5]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -347,7 +476,7 @@ func (x *GrantRoleRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GrantRoleRequest.ProtoReflect.Descriptor instead.
 func (*GrantRoleRequest) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{3}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *GrantRoleRequest) GetOrganizationId() string {
@@ -404,7 +533,7 @@ type RevokeRoleRequest struct {
 
 func (x *RevokeRoleRequest) Reset() {
 	*x = RevokeRoleRequest{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[4]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[6]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -416,7 +545,7 @@ func (x *RevokeRoleRequest) String() string {
 func (*RevokeRoleRequest) ProtoMessage() {}
 
 func (x *RevokeRoleRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[4]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[6]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -429,7 +558,7 @@ func (x *RevokeRoleRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RevokeRoleRequest.ProtoReflect.Descriptor instead.
 func (*RevokeRoleRequest) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{4}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *RevokeRoleRequest) GetOrganizationId() string {
@@ -480,7 +609,7 @@ type ListRoleGrantsRequest struct {
 
 func (x *ListRoleGrantsRequest) Reset() {
 	*x = ListRoleGrantsRequest{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[5]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -492,7 +621,7 @@ func (x *ListRoleGrantsRequest) String() string {
 func (*ListRoleGrantsRequest) ProtoMessage() {}
 
 func (x *ListRoleGrantsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[5]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -505,7 +634,7 @@ func (x *ListRoleGrantsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListRoleGrantsRequest.ProtoReflect.Descriptor instead.
 func (*ListRoleGrantsRequest) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{5}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *ListRoleGrantsRequest) GetOrganizationId() string {
@@ -533,7 +662,7 @@ type ListRoleGrantsResponse struct {
 
 func (x *ListRoleGrantsResponse) Reset() {
 	*x = ListRoleGrantsResponse{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[6]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[8]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -545,7 +674,7 @@ func (x *ListRoleGrantsResponse) String() string {
 func (*ListRoleGrantsResponse) ProtoMessage() {}
 
 func (x *ListRoleGrantsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[6]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[8]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -558,7 +687,7 @@ func (x *ListRoleGrantsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListRoleGrantsResponse.ProtoReflect.Descriptor instead.
 func (*ListRoleGrantsResponse) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{6}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *ListRoleGrantsResponse) GetGrants() []*RoleGrant {
@@ -583,7 +712,7 @@ type RoleGrant struct {
 
 func (x *RoleGrant) Reset() {
 	*x = RoleGrant{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[7]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[9]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -595,7 +724,7 @@ func (x *RoleGrant) String() string {
 func (*RoleGrant) ProtoMessage() {}
 
 func (x *RoleGrant) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[7]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[9]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -608,7 +737,7 @@ func (x *RoleGrant) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RoleGrant.ProtoReflect.Descriptor instead.
 func (*RoleGrant) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{7}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *RoleGrant) GetRole() string {
@@ -643,7 +772,7 @@ type ListRequest struct {
 
 func (x *ListRequest) Reset() {
 	*x = ListRequest{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[8]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[10]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -655,7 +784,7 @@ func (x *ListRequest) String() string {
 func (*ListRequest) ProtoMessage() {}
 
 func (x *ListRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[8]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[10]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -668,7 +797,7 @@ func (x *ListRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListRequest.ProtoReflect.Descriptor instead.
 func (*ListRequest) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{8}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *ListRequest) GetOrganizationId() string {
@@ -689,7 +818,7 @@ type ListResponse struct {
 
 func (x *ListResponse) Reset() {
 	*x = ListResponse{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[9]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -701,7 +830,7 @@ func (x *ListResponse) String() string {
 func (*ListResponse) ProtoMessage() {}
 
 func (x *ListResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[9]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -714,7 +843,7 @@ func (x *ListResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListResponse.ProtoReflect.Descriptor instead.
 func (*ListResponse) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{9}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *ListResponse) GetInstallations() []*Installation {
@@ -757,7 +886,7 @@ type Installation struct {
 
 func (x *Installation) Reset() {
 	*x = Installation{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[10]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -769,7 +898,7 @@ func (x *Installation) String() string {
 func (*Installation) ProtoMessage() {}
 
 func (x *Installation) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[10]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -782,7 +911,7 @@ func (x *Installation) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Installation.ProtoReflect.Descriptor instead.
 func (*Installation) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{10}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *Installation) GetId() string {
@@ -859,7 +988,7 @@ type InstallationNotice struct {
 
 func (x *InstallationNotice) Reset() {
 	*x = InstallationNotice{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[11]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[13]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -871,7 +1000,7 @@ func (x *InstallationNotice) String() string {
 func (*InstallationNotice) ProtoMessage() {}
 
 func (x *InstallationNotice) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[11]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[13]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -884,7 +1013,7 @@ func (x *InstallationNotice) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InstallationNotice.ProtoReflect.Descriptor instead.
 func (*InstallationNotice) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{11}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *InstallationNotice) GetInstallation() *Installation {
@@ -903,7 +1032,7 @@ type InstallationAck struct {
 
 func (x *InstallationAck) Reset() {
 	*x = InstallationAck{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[12]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -915,7 +1044,7 @@ func (x *InstallationAck) String() string {
 func (*InstallationAck) ProtoMessage() {}
 
 func (x *InstallationAck) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[12]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -928,7 +1057,7 @@ func (x *InstallationAck) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InstallationAck.ProtoReflect.Descriptor instead.
 func (*InstallationAck) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{12}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{14}
 }
 
 // ListOffersRequest names the organization whose administrator reads.
@@ -941,7 +1070,7 @@ type ListOffersRequest struct {
 
 func (x *ListOffersRequest) Reset() {
 	*x = ListOffersRequest{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[13]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -953,7 +1082,7 @@ func (x *ListOffersRequest) String() string {
 func (*ListOffersRequest) ProtoMessage() {}
 
 func (x *ListOffersRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[13]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -966,7 +1095,7 @@ func (x *ListOffersRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListOffersRequest.ProtoReflect.Descriptor instead.
 func (*ListOffersRequest) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{13}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *ListOffersRequest) GetOrganizationId() string {
@@ -986,7 +1115,7 @@ type ListOffersResponse struct {
 
 func (x *ListOffersResponse) Reset() {
 	*x = ListOffersResponse{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[14]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -998,7 +1127,7 @@ func (x *ListOffersResponse) String() string {
 func (*ListOffersResponse) ProtoMessage() {}
 
 func (x *ListOffersResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[14]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1011,7 +1140,7 @@ func (x *ListOffersResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListOffersResponse.ProtoReflect.Descriptor instead.
 func (*ListOffersResponse) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{14}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *ListOffersResponse) GetOffers() []*Offer {
@@ -1034,7 +1163,7 @@ type Offer struct {
 
 func (x *Offer) Reset() {
 	*x = Offer{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[15]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1046,7 +1175,7 @@ func (x *Offer) String() string {
 func (*Offer) ProtoMessage() {}
 
 func (x *Offer) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[15]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1059,7 +1188,7 @@ func (x *Offer) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Offer.ProtoReflect.Descriptor instead.
 func (*Offer) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{15}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *Offer) GetTarget() string {
@@ -1100,7 +1229,7 @@ type ReviewedOffer struct {
 
 func (x *ReviewedOffer) Reset() {
 	*x = ReviewedOffer{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[16]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1112,7 +1241,7 @@ func (x *ReviewedOffer) String() string {
 func (*ReviewedOffer) ProtoMessage() {}
 
 func (x *ReviewedOffer) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[16]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1125,7 +1254,7 @@ func (x *ReviewedOffer) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReviewedOffer.ProtoReflect.Descriptor instead.
 func (*ReviewedOffer) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{16}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *ReviewedOffer) GetApproval() *ConsentApproval {
@@ -1183,7 +1312,7 @@ type OfferBinding struct {
 
 func (x *OfferBinding) Reset() {
 	*x = OfferBinding{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[17]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1195,7 +1324,7 @@ func (x *OfferBinding) String() string {
 func (*OfferBinding) ProtoMessage() {}
 
 func (x *OfferBinding) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[17]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1208,7 +1337,7 @@ func (x *OfferBinding) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OfferBinding.ProtoReflect.Descriptor instead.
 func (*OfferBinding) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{17}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *OfferBinding) GetBinding() string {
@@ -1246,7 +1375,7 @@ type OfferRole struct {
 
 func (x *OfferRole) Reset() {
 	*x = OfferRole{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[18]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1258,7 +1387,7 @@ func (x *OfferRole) String() string {
 func (*OfferRole) ProtoMessage() {}
 
 func (x *OfferRole) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[18]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1271,7 +1400,7 @@ func (x *OfferRole) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OfferRole.ProtoReflect.Descriptor instead.
 func (*OfferRole) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{18}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *OfferRole) GetName() string {
@@ -1311,7 +1440,7 @@ type OfferScope struct {
 
 func (x *OfferScope) Reset() {
 	*x = OfferScope{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[19]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1323,7 +1452,7 @@ func (x *OfferScope) String() string {
 func (*OfferScope) ProtoMessage() {}
 
 func (x *OfferScope) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[19]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1336,7 +1465,7 @@ func (x *OfferScope) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OfferScope.ProtoReflect.Descriptor instead.
 func (*OfferScope) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{19}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *OfferScope) GetResourceKind() string {
@@ -1384,7 +1513,7 @@ type OfferCapability struct {
 
 func (x *OfferCapability) Reset() {
 	*x = OfferCapability{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[20]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1396,7 +1525,7 @@ func (x *OfferCapability) String() string {
 func (*OfferCapability) ProtoMessage() {}
 
 func (x *OfferCapability) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[20]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1409,7 +1538,7 @@ func (x *OfferCapability) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OfferCapability.ProtoReflect.Descriptor instead.
 func (*OfferCapability) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{20}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *OfferCapability) GetModule() string {
@@ -1455,7 +1584,7 @@ type OfferTool struct {
 
 func (x *OfferTool) Reset() {
 	*x = OfferTool{}
-	mi := &file_host_installation_v1_installation_proto_msgTypes[21]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1467,7 +1596,7 @@ func (x *OfferTool) String() string {
 func (*OfferTool) ProtoMessage() {}
 
 func (x *OfferTool) ProtoReflect() protoreflect.Message {
-	mi := &file_host_installation_v1_installation_proto_msgTypes[21]
+	mi := &file_host_installation_v1_installation_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1480,7 +1609,7 @@ func (x *OfferTool) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use OfferTool.ProtoReflect.Descriptor instead.
 func (*OfferTool) Descriptor() ([]byte, []int) {
-	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{21}
+	return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *OfferTool) GetName() string {
@@ -1508,7 +1637,16 @@ var File_host_installation_v1_installation_proto protoreflect.FileDescriptor
 
 const file_host_installation_v1_installation_proto_rawDesc = "" +
 	"\n" +
-	"'host/installation/v1/installation.proto\x12\x14host.installation.v1\"\xd0\x01\n" +
+	"'host/installation/v1/installation.proto\x12\x14host.installation.v1\"j\n" +
+	"\x1aCurrentInstallationRequest\x12!\n" +
+	"\fparent_token\x18\x01 \x01(\tR\vparentToken\x12)\n" +
+	"\x10actor_credential\x18\x02 \x01(\tR\x0factorCredential\"\xa0\x01\n" +
+	"\x13CurrentInstallation\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\x12'\n" +
+	"\x0forganization_id\x18\x02 \x01(\tR\x0eorganizationId\x12\x16\n" +
+	"\x06target\x18\x03 \x01(\tR\x06target\x12\x1a\n" +
+	"\brevision\x18\x04 \x01(\x04R\brevision\x12\x1c\n" +
+	"\tnamespace\x18\x05 \x01(\tR\tnamespace\"\xd0\x01\n" +
 	"\x0eInstallRequest\x12'\n" +
 	"\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\x12\x16\n" +
 	"\x06target\x18\x02 \x01(\tR\x06target\x12\x12\n" +
@@ -1608,8 +1746,9 @@ const file_host_installation_v1_installation_proto_rawDesc = "" +
 	"\tOfferTool\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\x12\x18\n" +
 	"\abinding\x18\x02 \x01(\tR\abinding\x12\x14\n" +
-	"\x05write\x18\x03 \x01(\bR\x05write2\xb0\x04\n" +
-	"\x13InstallationService\x12S\n" +
+	"\x05write\x18\x03 \x01(\bR\x05write2\x98\x05\n" +
+	"\x13InstallationService\x12f\n" +
+	"\aCurrent\x120.host.installation.v1.CurrentInstallationRequest\x1a).host.installation.v1.CurrentInstallation\x12S\n" +
 	"\aInstall\x12$.host.installation.v1.InstallRequest\x1a\".host.installation.v1.Installation\x12T\n" +
 	"\x06Review\x12#.host.installation.v1.ReviewRequest\x1a%.host.installation.v1.ConsentApproval\x12W\n" +
 	"\tGrantRole\x12&.host.installation.v1.GrantRoleRequest\x1a\".host.installation.v1.Installation\x12Y\n" +
@@ -1637,68 +1776,72 @@ func file_host_installation_v1_installation_proto_rawDescGZIP() []byte {
 }
 
 var file_host_installation_v1_installation_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_host_installation_v1_installation_proto_msgTypes = make([]protoimpl.MessageInfo, 22)
+var file_host_installation_v1_installation_proto_msgTypes = make([]protoimpl.MessageInfo, 24)
 var file_host_installation_v1_installation_proto_goTypes = []any{
-	(Installation_Status)(0),       // 0: host.installation.v1.Installation.Status
-	(*InstallRequest)(nil),         // 1: host.installation.v1.InstallRequest
-	(*ReviewRequest)(nil),          // 2: host.installation.v1.ReviewRequest
-	(*ConsentApproval)(nil),        // 3: host.installation.v1.ConsentApproval
-	(*GrantRoleRequest)(nil),       // 4: host.installation.v1.GrantRoleRequest
-	(*RevokeRoleRequest)(nil),      // 5: host.installation.v1.RevokeRoleRequest
-	(*ListRoleGrantsRequest)(nil),  // 6: host.installation.v1.ListRoleGrantsRequest
-	(*ListRoleGrantsResponse)(nil), // 7: host.installation.v1.ListRoleGrantsResponse
-	(*RoleGrant)(nil),              // 8: host.installation.v1.RoleGrant
-	(*ListRequest)(nil),            // 9: host.installation.v1.ListRequest
-	(*ListResponse)(nil),           // 10: host.installation.v1.ListResponse
-	(*Installation)(nil),           // 11: host.installation.v1.Installation
-	(*InstallationNotice)(nil),     // 12: host.installation.v1.InstallationNotice
-	(*InstallationAck)(nil),        // 13: host.installation.v1.InstallationAck
-	(*ListOffersRequest)(nil),      // 14: host.installation.v1.ListOffersRequest
-	(*ListOffersResponse)(nil),     // 15: host.installation.v1.ListOffersResponse
-	(*Offer)(nil),                  // 16: host.installation.v1.Offer
-	(*ReviewedOffer)(nil),          // 17: host.installation.v1.ReviewedOffer
-	(*OfferBinding)(nil),           // 18: host.installation.v1.OfferBinding
-	(*OfferRole)(nil),              // 19: host.installation.v1.OfferRole
-	(*OfferScope)(nil),             // 20: host.installation.v1.OfferScope
-	(*OfferCapability)(nil),        // 21: host.installation.v1.OfferCapability
-	(*OfferTool)(nil),              // 22: host.installation.v1.OfferTool
+	(Installation_Status)(0),           // 0: host.installation.v1.Installation.Status
+	(*CurrentInstallationRequest)(nil), // 1: host.installation.v1.CurrentInstallationRequest
+	(*CurrentInstallation)(nil),        // 2: host.installation.v1.CurrentInstallation
+	(*InstallRequest)(nil),             // 3: host.installation.v1.InstallRequest
+	(*ReviewRequest)(nil),              // 4: host.installation.v1.ReviewRequest
+	(*ConsentApproval)(nil),            // 5: host.installation.v1.ConsentApproval
+	(*GrantRoleRequest)(nil),           // 6: host.installation.v1.GrantRoleRequest
+	(*RevokeRoleRequest)(nil),          // 7: host.installation.v1.RevokeRoleRequest
+	(*ListRoleGrantsRequest)(nil),      // 8: host.installation.v1.ListRoleGrantsRequest
+	(*ListRoleGrantsResponse)(nil),     // 9: host.installation.v1.ListRoleGrantsResponse
+	(*RoleGrant)(nil),                  // 10: host.installation.v1.RoleGrant
+	(*ListRequest)(nil),                // 11: host.installation.v1.ListRequest
+	(*ListResponse)(nil),               // 12: host.installation.v1.ListResponse
+	(*Installation)(nil),               // 13: host.installation.v1.Installation
+	(*InstallationNotice)(nil),         // 14: host.installation.v1.InstallationNotice
+	(*InstallationAck)(nil),            // 15: host.installation.v1.InstallationAck
+	(*ListOffersRequest)(nil),          // 16: host.installation.v1.ListOffersRequest
+	(*ListOffersResponse)(nil),         // 17: host.installation.v1.ListOffersResponse
+	(*Offer)(nil),                      // 18: host.installation.v1.Offer
+	(*ReviewedOffer)(nil),              // 19: host.installation.v1.ReviewedOffer
+	(*OfferBinding)(nil),               // 20: host.installation.v1.OfferBinding
+	(*OfferRole)(nil),                  // 21: host.installation.v1.OfferRole
+	(*OfferScope)(nil),                 // 22: host.installation.v1.OfferScope
+	(*OfferCapability)(nil),            // 23: host.installation.v1.OfferCapability
+	(*OfferTool)(nil),                  // 24: host.installation.v1.OfferTool
 }
 var file_host_installation_v1_installation_proto_depIdxs = []int32{
-	3,  // 0: host.installation.v1.InstallRequest.approval:type_name -> host.installation.v1.ConsentApproval
-	8,  // 1: host.installation.v1.ListRoleGrantsResponse.grants:type_name -> host.installation.v1.RoleGrant
-	11, // 2: host.installation.v1.ListResponse.installations:type_name -> host.installation.v1.Installation
+	5,  // 0: host.installation.v1.InstallRequest.approval:type_name -> host.installation.v1.ConsentApproval
+	10, // 1: host.installation.v1.ListRoleGrantsResponse.grants:type_name -> host.installation.v1.RoleGrant
+	13, // 2: host.installation.v1.ListResponse.installations:type_name -> host.installation.v1.Installation
 	0,  // 3: host.installation.v1.Installation.status:type_name -> host.installation.v1.Installation.Status
-	11, // 4: host.installation.v1.InstallationNotice.installation:type_name -> host.installation.v1.Installation
-	16, // 5: host.installation.v1.ListOffersResponse.offers:type_name -> host.installation.v1.Offer
-	3,  // 6: host.installation.v1.ReviewedOffer.approval:type_name -> host.installation.v1.ConsentApproval
-	19, // 7: host.installation.v1.ReviewedOffer.roles:type_name -> host.installation.v1.OfferRole
-	11, // 8: host.installation.v1.ReviewedOffer.installation:type_name -> host.installation.v1.Installation
-	18, // 9: host.installation.v1.ReviewedOffer.ceiling:type_name -> host.installation.v1.OfferBinding
-	20, // 10: host.installation.v1.OfferBinding.scopes:type_name -> host.installation.v1.OfferScope
-	20, // 11: host.installation.v1.OfferRole.scopes:type_name -> host.installation.v1.OfferScope
-	21, // 12: host.installation.v1.OfferRole.capabilities:type_name -> host.installation.v1.OfferCapability
-	20, // 13: host.installation.v1.OfferCapability.requires:type_name -> host.installation.v1.OfferScope
-	22, // 14: host.installation.v1.OfferCapability.tools:type_name -> host.installation.v1.OfferTool
-	1,  // 15: host.installation.v1.InstallationService.Install:input_type -> host.installation.v1.InstallRequest
-	2,  // 16: host.installation.v1.InstallationService.Review:input_type -> host.installation.v1.ReviewRequest
-	4,  // 17: host.installation.v1.InstallationService.GrantRole:input_type -> host.installation.v1.GrantRoleRequest
-	5,  // 18: host.installation.v1.InstallationService.RevokeRole:input_type -> host.installation.v1.RevokeRoleRequest
-	6,  // 19: host.installation.v1.InstallationService.ListRoleGrants:input_type -> host.installation.v1.ListRoleGrantsRequest
-	9,  // 20: host.installation.v1.InstallationService.List:input_type -> host.installation.v1.ListRequest
-	12, // 21: host.installation.v1.InstallableService.Install:input_type -> host.installation.v1.InstallationNotice
-	14, // 22: host.installation.v1.OfferService.ListOffers:input_type -> host.installation.v1.ListOffersRequest
-	2,  // 23: host.installation.v1.OfferService.ReviewOffer:input_type -> host.installation.v1.ReviewRequest
-	11, // 24: host.installation.v1.InstallationService.Install:output_type -> host.installation.v1.Installation
-	3,  // 25: host.installation.v1.InstallationService.Review:output_type -> host.installation.v1.ConsentApproval
-	11, // 26: host.installation.v1.InstallationService.GrantRole:output_type -> host.installation.v1.Installation
-	11, // 27: host.installation.v1.InstallationService.RevokeRole:output_type -> host.installation.v1.Installation
-	7,  // 28: host.installation.v1.InstallationService.ListRoleGrants:output_type -> host.installation.v1.ListRoleGrantsResponse
-	10, // 29: host.installation.v1.InstallationService.List:output_type -> host.installation.v1.ListResponse
-	13, // 30: host.installation.v1.InstallableService.Install:output_type -> host.installation.v1.InstallationAck
-	15, // 31: host.installation.v1.OfferService.ListOffers:output_type -> host.installation.v1.ListOffersResponse
-	17, // 32: host.installation.v1.OfferService.ReviewOffer:output_type -> host.installation.v1.ReviewedOffer
-	24, // [24:33] is the sub-list for method output_type
-	15, // [15:24] is the sub-list for method input_type
+	13, // 4: host.installation.v1.InstallationNotice.installation:type_name -> host.installation.v1.Installation
+	18, // 5: host.installation.v1.ListOffersResponse.offers:type_name -> host.installation.v1.Offer
+	5,  // 6: host.installation.v1.ReviewedOffer.approval:type_name -> host.installation.v1.ConsentApproval
+	21, // 7: host.installation.v1.ReviewedOffer.roles:type_name -> host.installation.v1.OfferRole
+	13, // 8: host.installation.v1.ReviewedOffer.installation:type_name -> host.installation.v1.Installation
+	20, // 9: host.installation.v1.ReviewedOffer.ceiling:type_name -> host.installation.v1.OfferBinding
+	22, // 10: host.installation.v1.OfferBinding.scopes:type_name -> host.installation.v1.OfferScope
+	22, // 11: host.installation.v1.OfferRole.scopes:type_name -> host.installation.v1.OfferScope
+	23, // 12: host.installation.v1.OfferRole.capabilities:type_name -> host.installation.v1.OfferCapability
+	22, // 13: host.installation.v1.OfferCapability.requires:type_name -> host.installation.v1.OfferScope
+	24, // 14: host.installation.v1.OfferCapability.tools:type_name -> host.installation.v1.OfferTool
+	1,  // 15: host.installation.v1.InstallationService.Current:input_type -> host.installation.v1.CurrentInstallationRequest
+	3,  // 16: host.installation.v1.InstallationService.Install:input_type -> host.installation.v1.InstallRequest
+	4,  // 17: host.installation.v1.InstallationService.Review:input_type -> host.installation.v1.ReviewRequest
+	6,  // 18: host.installation.v1.InstallationService.GrantRole:input_type -> host.installation.v1.GrantRoleRequest
+	7,  // 19: host.installation.v1.InstallationService.RevokeRole:input_type -> host.installation.v1.RevokeRoleRequest
+	8,  // 20: host.installation.v1.InstallationService.ListRoleGrants:input_type -> host.installation.v1.ListRoleGrantsRequest
+	11, // 21: host.installation.v1.InstallationService.List:input_type -> host.installation.v1.ListRequest
+	14, // 22: host.installation.v1.InstallableService.Install:input_type -> host.installation.v1.InstallationNotice
+	16, // 23: host.installation.v1.OfferService.ListOffers:input_type -> host.installation.v1.ListOffersRequest
+	4,  // 24: host.installation.v1.OfferService.ReviewOffer:input_type -> host.installation.v1.ReviewRequest
+	2,  // 25: host.installation.v1.InstallationService.Current:output_type -> host.installation.v1.CurrentInstallation
+	13, // 26: host.installation.v1.InstallationService.Install:output_type -> host.installation.v1.Installation
+	5,  // 27: host.installation.v1.InstallationService.Review:output_type -> host.installation.v1.ConsentApproval
+	13, // 28: host.installation.v1.InstallationService.GrantRole:output_type -> host.installation.v1.Installation
+	13, // 29: host.installation.v1.InstallationService.RevokeRole:output_type -> host.installation.v1.Installation
+	9,  // 30: host.installation.v1.InstallationService.ListRoleGrants:output_type -> host.installation.v1.ListRoleGrantsResponse
+	12, // 31: host.installation.v1.InstallationService.List:output_type -> host.installation.v1.ListResponse
+	15, // 32: host.installation.v1.InstallableService.Install:output_type -> host.installation.v1.InstallationAck
+	17, // 33: host.installation.v1.OfferService.ListOffers:output_type -> host.installation.v1.ListOffersResponse
+	19, // 34: host.installation.v1.OfferService.ReviewOffer:output_type -> host.installation.v1.ReviewedOffer
+	25, // [25:35] is the sub-list for method output_type
+	15, // [15:25] is the sub-list for method input_type
 	15, // [15:15] is the sub-list for extension type_name
 	15, // [15:15] is the sub-list for extension extendee
 	0,  // [0:15] is the sub-list for field type_name
@@ -1715,7 +1858,7 @@ func file_host_installation_v1_installation_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_host_installation_v1_installation_proto_rawDesc), len(file_host_installation_v1_installation_proto_rawDesc)),
 			NumEnums:      1,
-			NumMessages:   22,
+			NumMessages:   24,
 			NumExtensions: 0,
 			NumServices:   3,
 		},
diff --git a/modules/authority/services/local/code/pkg/gen/host/installation/v1/installation_grpc.pb.go b/modules/authority/services/local/code/pkg/gen/host/installation/v1/installation_grpc.pb.go
index 9d10a53d..0fdefdf1 100644
--- a/modules/authority/services/local/code/pkg/gen/host/installation/v1/installation_grpc.pb.go
+++ b/modules/authority/services/local/code/pkg/gen/host/installation/v1/installation_grpc.pb.go
@@ -26,6 +26,7 @@ import (
 const _ = grpc.SupportPackageIsVersion9
 
 const (
+	InstallationService_Current_FullMethodName        = "/host.installation.v1.InstallationService/Current"
 	InstallationService_Install_FullMethodName        = "/host.installation.v1.InstallationService/Install"
 	InstallationService_Review_FullMethodName         = "/host.installation.v1.InstallationService/Review"
 	InstallationService_GrantRole_FullMethodName      = "/host.installation.v1.InstallationService/GrantRole"
@@ -40,6 +41,10 @@ const (
 //
 // InstallationService is implemented by the host and by the local authority.
 type InstallationServiceClient interface {
+	// Current reads only the authenticated module's own active installation,
+	// in the tenant of a current parent addressed to that module. It grants no
+	// artifact approval or content access and exposes no roles or grants.
+	Current(ctx context.Context, in *CurrentInstallationRequest, opts ...grpc.CallOption) (*CurrentInstallation, error)
 	// Install composes an installation: its agent principal, its root scope and
 	// the row, pending until the target acknowledges its install step.
 	Install(ctx context.Context, in *InstallRequest, opts ...grpc.CallOption) (*Installation, error)
@@ -70,6 +75,16 @@ func NewInstallationServiceClient(cc grpc.ClientConnInterface) InstallationServi
 	return &installationServiceClient{cc}
 }
 
+func (c *installationServiceClient) Current(ctx context.Context, in *CurrentInstallationRequest, opts ...grpc.CallOption) (*CurrentInstallation, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CurrentInstallation)
+	err := c.cc.Invoke(ctx, InstallationService_Current_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *installationServiceClient) Install(ctx context.Context, in *InstallRequest, opts ...grpc.CallOption) (*Installation, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Installation)
@@ -136,6 +151,10 @@ func (c *installationServiceClient) List(ctx context.Context, in *ListRequest, o
 //
 // InstallationService is implemented by the host and by the local authority.
 type InstallationServiceServer interface {
+	// Current reads only the authenticated module's own active installation,
+	// in the tenant of a current parent addressed to that module. It grants no
+	// artifact approval or content access and exposes no roles or grants.
+	Current(context.Context, *CurrentInstallationRequest) (*CurrentInstallation, error)
 	// Install composes an installation: its agent principal, its root scope and
 	// the row, pending until the target acknowledges its install step.
 	Install(context.Context, *InstallRequest) (*Installation, error)
@@ -166,6 +185,9 @@ type InstallationServiceServer interface {
 // pointer dereference when methods are called.
 type UnimplementedInstallationServiceServer struct{}
 
+func (UnimplementedInstallationServiceServer) Current(context.Context, *CurrentInstallationRequest) (*CurrentInstallation, error) {
+	return nil, status.Error(codes.Unimplemented, "method Current not implemented")
+}
 func (UnimplementedInstallationServiceServer) Install(context.Context, *InstallRequest) (*Installation, error) {
 	return nil, status.Error(codes.Unimplemented, "method Install not implemented")
 }
@@ -205,6 +227,24 @@ func RegisterInstallationServiceServer(s grpc.ServiceRegistrar, srv Installation
 	s.RegisterService(&InstallationService_ServiceDesc, srv)
 }
 
+func _InstallationService_Current_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CurrentInstallationRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(InstallationServiceServer).Current(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: InstallationService_Current_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(InstallationServiceServer).Current(ctx, req.(*CurrentInstallationRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _InstallationService_Install_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(InstallRequest)
 	if err := dec(in); err != nil {
@@ -320,6 +360,10 @@ var InstallationService_ServiceDesc = grpc.ServiceDesc{
 	ServiceName: "host.installation.v1.InstallationService",
 	HandlerType: (*InstallationServiceServer)(nil),
 	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Current",
+			Handler:    _InstallationService_Current_Handler,
+		},
 		{
 			MethodName: "Install",
 			Handler:    _InstallationService_Install_Handler,
diff --git a/modules/authority/services/local/code/pkg/gen/host/installation/v1/installationv1connect/installation.connect.go b/modules/authority/services/local/code/pkg/gen/host/installation/v1/installationv1connect/installation.connect.go
index ef038b54..c0e8167d 100644
--- a/modules/authority/services/local/code/pkg/gen/host/installation/v1/installationv1connect/installation.connect.go
+++ b/modules/authority/services/local/code/pkg/gen/host/installation/v1/installationv1connect/installation.connect.go
@@ -43,6 +43,9 @@ const (
 // reflection-formatted method names, remove the leading slash and convert the remaining slash to a
 // period.
 const (
+	// InstallationServiceCurrentProcedure is the fully-qualified name of the InstallationService's
+	// Current RPC.
+	InstallationServiceCurrentProcedure = "/host.installation.v1.InstallationService/Current"
 	// InstallationServiceInstallProcedure is the fully-qualified name of the InstallationService's
 	// Install RPC.
 	InstallationServiceInstallProcedure = "/host.installation.v1.InstallationService/Install"
@@ -73,6 +76,10 @@ const (
 
 // InstallationServiceClient is a client for the host.installation.v1.InstallationService service.
 type InstallationServiceClient interface {
+	// Current reads only the authenticated module's own active installation,
+	// in the tenant of a current parent addressed to that module. It grants no
+	// artifact approval or content access and exposes no roles or grants.
+	Current(context.Context, *connect.Request[v1.CurrentInstallationRequest]) (*connect.Response[v1.CurrentInstallation], error)
 	// Install composes an installation: its agent principal, its root scope and
 	// the row, pending until the target acknowledges its install step.
 	Install(context.Context, *connect.Request[v1.InstallRequest]) (*connect.Response[v1.Installation], error)
@@ -106,6 +113,12 @@ func NewInstallationServiceClient(httpClient connect.HTTPClient, baseURL string,
 	baseURL = strings.TrimRight(baseURL, "/")
 	installationServiceMethods := v1.File_host_installation_v1_installation_proto.Services().ByName("InstallationService").Methods()
 	return &installationServiceClient{
+		current: connect.NewClient[v1.CurrentInstallationRequest, v1.CurrentInstallation](
+			httpClient,
+			baseURL+InstallationServiceCurrentProcedure,
+			connect.WithSchema(installationServiceMethods.ByName("Current")),
+			connect.WithClientOptions(opts...),
+		),
 		install: connect.NewClient[v1.InstallRequest, v1.Installation](
 			httpClient,
 			baseURL+InstallationServiceInstallProcedure,
@@ -147,6 +160,7 @@ func NewInstallationServiceClient(httpClient connect.HTTPClient, baseURL string,
 
 // installationServiceClient implements InstallationServiceClient.
 type installationServiceClient struct {
+	current        *connect.Client[v1.CurrentInstallationRequest, v1.CurrentInstallation]
 	install        *connect.Client[v1.InstallRequest, v1.Installation]
 	review         *connect.Client[v1.ReviewRequest, v1.ConsentApproval]
 	grantRole      *connect.Client[v1.GrantRoleRequest, v1.Installation]
@@ -155,6 +169,11 @@ type installationServiceClient struct {
 	list           *connect.Client[v1.ListRequest, v1.ListResponse]
 }
 
+// Current calls host.installation.v1.InstallationService.Current.
+func (c *installationServiceClient) Current(ctx context.Context, req *connect.Request[v1.CurrentInstallationRequest]) (*connect.Response[v1.CurrentInstallation], error) {
+	return c.current.CallUnary(ctx, req)
+}
+
 // Install calls host.installation.v1.InstallationService.Install.
 func (c *installationServiceClient) Install(ctx context.Context, req *connect.Request[v1.InstallRequest]) (*connect.Response[v1.Installation], error) {
 	return c.install.CallUnary(ctx, req)
@@ -188,6 +207,10 @@ func (c *installationServiceClient) List(ctx context.Context, req *connect.Reque
 // InstallationServiceHandler is an implementation of the host.installation.v1.InstallationService
 // service.
 type InstallationServiceHandler interface {
+	// Current reads only the authenticated module's own active installation,
+	// in the tenant of a current parent addressed to that module. It grants no
+	// artifact approval or content access and exposes no roles or grants.
+	Current(context.Context, *connect.Request[v1.CurrentInstallationRequest]) (*connect.Response[v1.CurrentInstallation], error)
 	// Install composes an installation: its agent principal, its root scope and
 	// the row, pending until the target acknowledges its install step.
 	Install(context.Context, *connect.Request[v1.InstallRequest]) (*connect.Response[v1.Installation], error)
@@ -217,6 +240,12 @@ type InstallationServiceHandler interface {
 // and JSON codecs. They also support gzip compression.
 func NewInstallationServiceHandler(svc InstallationServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
 	installationServiceMethods := v1.File_host_installation_v1_installation_proto.Services().ByName("InstallationService").Methods()
+	installationServiceCurrentHandler := connect.NewUnaryHandler(
+		InstallationServiceCurrentProcedure,
+		svc.Current,
+		connect.WithSchema(installationServiceMethods.ByName("Current")),
+		connect.WithHandlerOptions(opts...),
+	)
 	installationServiceInstallHandler := connect.NewUnaryHandler(
 		InstallationServiceInstallProcedure,
 		svc.Install,
@@ -255,6 +284,8 @@ func NewInstallationServiceHandler(svc InstallationServiceHandler, opts ...conne
 	)
 	return "/host.installation.v1.InstallationService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.URL.Path {
+		case InstallationServiceCurrentProcedure:
+			installationServiceCurrentHandler.ServeHTTP(w, r)
 		case InstallationServiceInstallProcedure:
 			installationServiceInstallHandler.ServeHTTP(w, r)
 		case InstallationServiceReviewProcedure:
@@ -276,6 +307,10 @@ func NewInstallationServiceHandler(svc InstallationServiceHandler, opts ...conne
 // UnimplementedInstallationServiceHandler returns CodeUnimplemented from all methods.
 type UnimplementedInstallationServiceHandler struct{}
 
+func (UnimplementedInstallationServiceHandler) Current(context.Context, *connect.Request[v1.CurrentInstallationRequest]) (*connect.Response[v1.CurrentInstallation], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("host.installation.v1.InstallationService.Current is not implemented"))
+}
+
 func (UnimplementedInstallationServiceHandler) Install(context.Context, *connect.Request[v1.InstallRequest]) (*connect.Response[v1.Installation], error) {
 	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("host.installation.v1.InstallationService.Install is not implemented"))
 }
diff --git a/modules/authority/services/local/code/plugins/installation/plugin.go b/modules/authority/services/local/code/plugins/installation/plugin.go
index da8c5f2e..020da00f 100644
--- a/modules/authority/services/local/code/plugins/installation/plugin.go
+++ b/modules/authority/services/local/code/plugins/installation/plugin.go
@@ -48,6 +48,20 @@ func (p *Plugin) caller(ctx context.Context) (authority.Person, error) {
 	return p.State.Caller(authorityplugin.Bearer(ctx))
 }
 
+// Current authenticates the module independently; the core verifies its parent
+// and confines the read to its installation, without an admin session.
+func (p *Plugin) Current(ctx context.Context, req *installationv1.CurrentInstallationRequest) (*installationv1.CurrentInstallation, error) {
+	actor, err := p.State.VerifyWorkload(ctx, req.GetActorCredential())
+	if err != nil {
+		return nil, authorityplugin.Status(err)
+	}
+	inst, err := p.State.Service().CurrentInstallation(ctx, req.GetParentToken(), authority.Workload{Module: actor.Name})
+	if err != nil {
+		return nil, authorityplugin.Status(err)
+	}
+	return &installationv1.CurrentInstallation{Id: inst.ID, OrganizationId: inst.Organization, Target: inst.Target, Revision: inst.Revision, Namespace: state.Namespace(inst)}, nil
+}
+
 // Install installs a solution at the caller's organisation, which the caller
 // administers; owner_person_id names who installed it (the caller when
 // empty). Nobody holds a role on it until granted one.
diff --git a/modules/authority/services/local/contract-surfaces.json b/modules/authority/services/local/contract-surfaces.json
index 50f1ae55..17ba7986 100644
--- a/modules/authority/services/local/contract-surfaces.json
+++ b/modules/authority/services/local/contract-surfaces.json
@@ -49,6 +49,7 @@
         "/host.installation.v1.InstallationService/GrantRole",
         "/host.installation.v1.InstallationService/RevokeRole",
         "/host.installation.v1.InstallationService/ListRoleGrants",
+        "/host.installation.v1.InstallationService/Current",
         "/host.installation.v1.InstallationService/List"
       ]
     },
diff --git a/modules/authority/services/local/proto/host/installation/v1/installation.proto b/modules/authority/services/local/proto/host/installation/v1/installation.proto
index a346fc14..c1ebefd9 100644
--- a/modules/authority/services/local/proto/host/installation/v1/installation.proto
+++ b/modules/authority/services/local/proto/host/installation/v1/installation.proto
@@ -10,6 +10,10 @@ option go_package = "gateway/pkg/gen/host/installation/v1;installationv1";
 
 // InstallationService is implemented by the host and by the local authority.
 service InstallationService {
+  // Current reads only the authenticated module's own active installation,
+  // in the tenant of a current parent addressed to that module. It grants no
+  // artifact approval or content access and exposes no roles or grants.
+  rpc Current(CurrentInstallationRequest) returns (CurrentInstallation);
   // Install composes an installation: its agent principal, its root scope and
   // the row, pending until the target acknowledges its install step.
   rpc Install(InstallRequest) returns (Installation);
@@ -32,6 +36,20 @@ service InstallationService {
   rpc List(ListRequest) returns (ListResponse);
 }
 
+message CurrentInstallationRequest {
+  string parent_token = 1;
+  string actor_credential = 2;
+}
+
+// CurrentInstallation is request-local metadata, never a lease or consent.
+message CurrentInstallation {
+  string id = 1;
+  string organization_id = 2;
+  string target = 3;
+  uint64 revision = 4;
+  string namespace = 5;
+}
+
 // InstallableService is implemented by a solution; the host calls it once per
 // installation and retries until it is acknowledged.
 service InstallableService {
diff --git a/tools/noproxygate/generated.json b/tools/noproxygate/generated.json
index f9d6bdfc..4826fe79 100644
--- a/tools/noproxygate/generated.json
+++ b/tools/noproxygate/generated.json
@@ -8,8 +8,8 @@
   "libraries/authority-client/go/gen/host/authority/v1/work_context.pb.go": "c53b6b47355ee9a502441173931b3b809e510054168aa0cc2984b5152e771bf1",
   "libraries/authority-client/go/gen/host/composition/v1/composition.pb.go": "8fc4657b7b207b2fd80db74b238b10e5b0afd65b25851d56817cb0b960b1c750",
   "libraries/authority-client/go/gen/host/composition/v1/composition_grpc.pb.go": "acd95033d684741c23c74eb9f05021ebe487b9ab9e9cd81d549d44ab6c6d6162",
-  "libraries/authority-client/go/gen/host/installation/v1/installation.pb.go": "b4df1d07c1dcfcd5aae902b6c03bb79ce967524c188f6bd00c5eeeae53ba8dae",
-  "libraries/authority-client/go/gen/host/installation/v1/installation_grpc.pb.go": "a7f99943cdb98c272279de0259dab28ee7be7295a428cf5bf02e35a004f4b8d2",
+  "libraries/authority-client/go/gen/host/installation/v1/installation.pb.go": "0a0c6f78afe26ac0134835681d9a87b4d2c6645310c6bf3df933f9665931b88d",
+  "libraries/authority-client/go/gen/host/installation/v1/installation_grpc.pb.go": "b8e735626749e8aa55906dad618ea1e54a12dcdb06f19ef36839be3fb75b390e",
   "libraries/authority-client/go/gen/host/session/v1/session.pb.go": "509893bfa569a263d9c798672cc47760c4fc2b44d576f834008798048e54b926",
   "libraries/authority-client/go/gen/host/session/v1/session_grpc.pb.go": "c4177166bf12cacb6e171beb4f739e730b7f005d559669cbab8be51598796468",
   "libraries/hop/go/gen/authority/hop/v1/policy.pb.go": "24f2a486daac13ba590746ac7569d05839629b92ff9114f10932e1af8532f990",
@@ -47,9 +47,9 @@
   "modules/authority/services/local/code/pkg/gen/host/composition/v1/composition.pb.go": "c7a1220dc4bfeb3419485a4b41b5a8a5f8a9a35654180402b46010345f5094e4",
   "modules/authority/services/local/code/pkg/gen/host/composition/v1/composition_grpc.pb.go": "acd95033d684741c23c74eb9f05021ebe487b9ab9e9cd81d549d44ab6c6d6162",
   "modules/authority/services/local/code/pkg/gen/host/composition/v1/compositionv1connect/composition.connect.go": "d1c06a0ee8ffad586e36271b773e52a43737e49c4473207e1fa03b922f3fe88f",
-  "modules/authority/services/local/code/pkg/gen/host/installation/v1/installation.pb.go": "755c9f76a5227c670214f3cd4e186359b7e46f00fd426e116e6ca6f1f52047d6",
-  "modules/authority/services/local/code/pkg/gen/host/installation/v1/installation_grpc.pb.go": "a7f99943cdb98c272279de0259dab28ee7be7295a428cf5bf02e35a004f4b8d2",
-  "modules/authority/services/local/code/pkg/gen/host/installation/v1/installationv1connect/installation.connect.go": "965da88952471c06fb18a079f31587aa7890c38d076772760c623c03017c34d6",
+  "modules/authority/services/local/code/pkg/gen/host/installation/v1/installation.pb.go": "c2149ff966ddef0950aaf74300566631bc1d909bd9ebe0a31eda9fa2c2ea7426",
+  "modules/authority/services/local/code/pkg/gen/host/installation/v1/installation_grpc.pb.go": "b8e735626749e8aa55906dad618ea1e54a12dcdb06f19ef36839be3fb75b390e",
+  "modules/authority/services/local/code/pkg/gen/host/installation/v1/installationv1connect/installation.connect.go": "c990cc149d71e18f713aa5d9711e3f3d9fd3d7d6e48e608ece15992a918f5b1a",
   "modules/authority/services/local/code/pkg/gen/host/session/v1/session.pb.go": "a82b22fdddeb97f1e17651c5d1b965adf7db038374c913c41eb929792ba49208",
   "modules/authority/services/local/code/pkg/gen/host/session/v1/session.pb.gw.go": "8238f29baefd4a136fc299d6a5813eb8242f115063aecd99347bfa4786862d79",
   "modules/authority/services/local/code/pkg/gen/host/session/v1/session_grpc.pb.go": "c4177166bf12cacb6e171beb4f739e730b7f005d559669cbab8be51598796468",