[antoinetoussaint-byte]

What we are doing

The owner's settled design: one host-independent authority core with unit tests, and the local authority and SaaS accounts as thin wrappers around it. The local authority already runs on libraries/authority-core/go. This PR adds what accounts needs to run on the same core (codefly-dev/module-saas-starter, the companion PR, which pins this branch), and moves the host-agnostic logic that still lived in the local authority's plugins into the core, so neither host keeps a copy.

What changed

Core extensions accounts needs, each host-agnostic and unit tested:

• Tx.Member(org, id). A person may belong to several organizations. Accounts has multi-organization users, and memstore assumed one organization per person. The core now reads what a person holds through Member. Person(id) only answers whether the principal is a person. A caller acts only in the organization their session was opened at (memberAs). memstore keeps one membership per (person, organization) and gains DeleteMember. Test: TestAPersonOfTwoOrganizationsActsOnlyAsTheMemberOfTheSessions.
• Config.Journal. Each change of authority is journaled inside the write transaction that makes it, so a host's audit record commits with the change or not at all. The changes are: module applied or withdrawn; installation requested, activated or uninstalled; role granted or revoked; delegation granted or revoked; resource attached, detached or transferred. A journal that refuses aborts the change. Test: TestEveryChangeIsJournaledInItsOwnTransaction.
• OrganizationAdded, ReconcileOrganizations. An organization created after the modules were delivered holds them, as earlier organizations do. The local fixture load now uses this.
• Config.HostInstallsModules (security review blocker 2). A host whose administrators install each module by their own consent sets it, and its store answers those installations from the host's records. The core then installs no module at delivery, for a new organization or when reconciling; withdrawal leaves the host's records to the host; UninstallAsHost refuses a module. A narrowing redelivery still raises the installation's revision, which the store applies to the host's record. Unset (the local authority), every composed module is installed at every organization, as before. Tests: TestAHostThatInstallsModulesIsTheOnlyOneThatDoes, TestAWorkloadIsIssuedOnlyWhereItsHostInstalledIt (table-driven, including a capability ending with its installation and staying dead after a reinstall).
• Workload.Organization. A workload bound to one organization (its credential's) is issued nothing at another, and an issue naming none acts there. A workload issue also refuses an installation that is not active.
• installationOf prefers the active installation of a target, so a host keeping retired installation records beside a new one seals to the live one.
• Resource-scoped organization roles (security review blocker 1, a2f1c56, ddc87c4). decide.OrgScopes carries a role's id matchers as the held scope's resource ids, so an ask beyond them, or for the whole kind, is refused and an empty ask carries exactly the held ids.
• GrantRoleAsHost. Trusted host setup decides a grant the way GrantRole decides it for the organization's administrator.
• Composed. Reads a composed module as it was delivered.
• domain.ErrAlreadyInstalled. The install refusal can be tested by sentinel.
• ReconcileOrganizations makes one read and writes only for an organization that is missing a module installation.
• storetest asserts that an empty id names no member. This caught a bug in accounts' Postgres store, fixed in the companion PR.
• Delegation rules. A delegation must name a module installed at the grantor's organization, and its purpose is at most 1024 characters. The grantor or an administrator of the delegation's organization may end it. Anyone else gets NotFound, never a Denied that would confirm the delegation exists. Accounts enforced these rules on its own before; they now live once in the core. The local test moves from ErrRefused to ErrUnknown.

Moved out of the local authority into the core, so accounts reuses them instead of keeping a second copy:

• Package delivered. Reads a verified delivery as the authority's module: FromCore, scope ceilings, roles, installation-owned roles, method policies, owner-aware, the pairing of the authority document with its carrier (VerifyDocument, Pair), and the withdrawal refusal. A host decodes its own generated AuthorityManifestV1 into delivered.Document. The core links no generated interface package, because a second registration of the same proto file panics. Tests: delivered/delivered_test.go.
• decide.AdmitMethod and Service.CheckMethod. Method admission and HTTP route matching. Advisory mode returns the same refusal that an enforced check reports. Table test: TestMethodAdmission, 26 rows.
• ApplyModule changes. It now refuses a delivery that names a resource owner anywhere, and joins the kinds a module's methods require to what it serves (decide.Served). These checks were in local's applyManifestLocked.

Package storetest. The contract every authority.Store must meet: transactions are all or nothing, a missing record wraps ErrNotFound, every record reads back as written, grants are idempotent, every revision and epoch only grows, and identity reads return what the host seeded. It runs on memstore here and on accounts' Postgres store in the companion PR. It uses fresh ids, so it can run against a database other tests share.

Conformance: two new cases every host runs. The local authority passes all 49 cases, and accounts passes the same 49.

• every installation call stays inside the caller's organization, and an absent installation answers as a foreign one:
  • an administrator gets PermissionDenied naming the organization from Review, Install, List, ListRoleGrants, GrantRole and RevokeRole at another organization;
  • an absent installation answers exactly as a foreign one does;
  • a module nobody composed is NotFound by name in Delegate and Review;
  • another organization's administrator can neither read nor end a delegation.
• only the hop registers an admission key, published apart from the Work Context keys:
  • the key id is stamp.KeyID and the purpose is hop-admission;
  • a renewal is idempotent;
  • the key is published exactly once among admission_keys and never among keys;
  • another workload is refused by name, and a 16-byte key is InvalidArgument.
• Fixture gains OtherAdminToken, HopCredential and InstallModule (a host that installs modules by consent installs the ones the suite delivers; SolutionPrincipalCase.InstallModule likewise). The admission-key case signs each registration (stamp.ProveRegistration, over the audience the hop's credential names), as interface 0.3.4 requires. The conformance module's authority-client pin moves to main (7b6569e1).
• Main merged (656d23bf, fix: hop registration proves possession; REST callers keep {"error"}; setup page hardened (#28, #30 follow-ups) #32): the local authority takes main's authority-client pin; generated contracts merged without conflict and the package gate passes.

Use cases → tests, on both hosts

The shared suite (conformance.Run) runs against the local authority (plugins/registry_test) and against accounts (pkg/adapters/host_interface_conformance_test.go). Each of the following passes on both.

Use case	Shared case(s)	Core unit tests
Sign-in and session	a fixture person signs in…, every fixture person listed…, Current names…, a page asks who its bearer is…	—
Issue for a person; child = current grants ∩ binding; narrowing never recovered; held = last actor's granted scopes	a person is issued, checked…; a child hop attenuates…; child target projection preserves explicit delegation restrictions; parent per-kind limits survive audience changes; a delegate chain inherits…; a lookup through a binding…	child_intersection_test, child_provenance_test, scope/model_test
Delegation	a delegation issues as its grantor…, a delegation is bounded…, isolation (another organization's delegation)	delegation_rules_test, journal_test
Solution roles, including installation_owned_scopes	a delivered solution role…, a solution role cannot exceed…, installation-owned role scopes cover only what the installation owns	decide/installation_owned_test, principal_test
Install with consent bound to target, generation, revision, digest and operation (replay, redelivery, supersede, revoke)	installation acknowledgement gates exposure and revocation ends authority; fresh approval supersedes pending attempt (accounts)	consent_test
Role grant and revoke to people and teams	a callee refuses what does not verify (revoke), a solution viewer reaches…, the lifecycle case (team grant)	revocation_test, organization_added_test (GrantRoleAsHost)
Installation-owned resources (create-attach, transfer-attach, detach, refusals by name)	installation-owned role scopes cover only what the installation owns	attachment_test
owner_aware delivery	a solution binding root…, a module tool binding…	r143_test, decide_test
Tool and operation checks per method policy	a check naming a method applies…, a delivered solution route…, a resource-limited scope passes method admission…	decide/method_test
Admission keys (hop only, purpose separation, renewal)	only the hop registers an admission key…	host unit tests: local issuer/admission_test, accounts host_interface_admission_test and the Postgres lease tests
Cross-tenant isolation	every installation call stays inside the caller's organization…; an installation issue cannot name a different organization; empty workload organization cases	membership_test
Absent installation or module	an installation issue verifies the installation exists; isolation (absent installation, not-composed module); every refusal reaches the caller…	r152_test
Store contract	—	storetest (memstore here, Postgres in accounts)

Fix or hack

Every item is a fix placed where the behaviour belongs.

• Reused, not rebuilt: the core's existing decisions, delivery.Verify and Digest, hop/go/routing.RouteMatches, and stamp.KeyID.
• Deliberately not done here: moving the hop-admission rule into the core. fix: hop registration proves possession; REST callers keep {"error"}; setup page hardened (#28, #30 follow-ups) #32 is changing that rule (proof of possession, per-instance pins), and moving it now would collide with fix: hop registration proves possession; REST callers keep {"error"}; setup page hardened (#28, #30 follow-ups) #32.

Evidence

At head e0b04b28:

• go vet ./... and go test -count=1 ./... (GOWORK=off) pass in all 12 Go modules, including tools/packagegate (contracts match codefly generate contracts) and tools/noproxygate.
• Local authority: the shared suite passes 50 of 50 (main's Current case included) and the solution-principal target passes.
• Accounts (feat(accounts): the host interfaces are decided by the shared authority core module-saas-starter#1257, pinned here): 50 of 50 shared cases, 18 of 18 target cases and 7 harness cases, with every module installed by administrator consent through InstallModule.

Not verified

• No composed playground run.
• The hop-admission rule (proof, per-instance pin) is still each host's own: the local authority's in memory, accounts' in Postgres. Moving it into the core is not done here.

🤖 Generated with Claude Code