From b666d2170258fefebb77d3fcff02be311089dcdc Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Mon, 26 Oct 2026 20:10:40 -0400
Subject: [PATCH 01/16] feat(authority-core): one membership per organization,
 the delivery reading, method admission and a store contract, shared by every
 host

A person may belong to several organizations: Tx.Member(org, id) is what the
core reads what they hold from, and a caller acts only in their session's
organization. The reading of a verified delivery (FromCore, ceilings, roles,
installation-owned roles, methods, owner-aware, the document's pairing) moves
from the local composition plugin into package delivered; method admission
moves from the local state into decide.AdmitMethod and Service.CheckMethod;
the owner refusal and the method-served kinds move into ApplyModule; module
installations at an organization added later are Service.OrganizationAdded.
Package storetest is the contract every Store meets, run here on memstore.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../authority-core/go/authority/check.go      |  32 +-
 .../authority-core/go/authority/consent.go    |  16 +-
 .../authority-core/go/authority/delegation.go |   4 +-
 .../authority-core/go/authority/issue.go      |   4 +-
 .../authority-core/go/authority/lifecycle.go  |  48 +-
 .../go/authority/membership_test.go           |  87 +++
 .../go/authority/organization_added_test.go   |  45 ++
 .../authority-core/go/authority/r152_test.go  |   6 +
 .../authority-core/go/authority/roles.go      |  16 +-
 .../authority-core/go/authority/service.go    |   4 +-
 .../authority-core/go/authority/store.go      |   6 +
 .../authority-core/go/authority/transfer.go   |   4 +-
 .../authority-core/go/decide/manifest.go      |  63 ++
 libraries/authority-core/go/decide/method.go  | 104 ++++
 .../authority-core/go/decide/method_test.go   | 145 +++++
 .../authority-core/go/delivered/delivered.go  | 217 +++++++
 .../go/delivered/delivered_test.go            | 171 ++++++
 libraries/authority-core/go/go.mod            |  38 +-
 libraries/authority-core/go/go.sum            | 205 ++++++-
 .../authority-core/go/memstore/memstore.go    |  43 +-
 .../go/storetest/memstore_test.go             |  33 +
 .../authority-core/go/storetest/storetest.go  | 577 ++++++++++++++++++
 .../local/code/pkg/business/issuer/issuer.go  |  13 +-
 .../pkg/business/issuer/parent_limits_test.go |   2 +-
 .../code/pkg/business/state/permissions.go    |   2 +-
 .../local/code/pkg/business/state/state.go    | 183 +-----
 .../local/code/plugins/composition/plugin.go  | 195 +-----
 .../code/plugins/composition/plugin_test.go   |  70 ---
 28 files changed, 1879 insertions(+), 454 deletions(-)
 create mode 100644 libraries/authority-core/go/authority/membership_test.go
 create mode 100644 libraries/authority-core/go/authority/organization_added_test.go
 create mode 100644 libraries/authority-core/go/decide/method.go
 create mode 100644 libraries/authority-core/go/decide/method_test.go
 create mode 100644 libraries/authority-core/go/delivered/delivered.go
 create mode 100644 libraries/authority-core/go/delivered/delivered_test.go
 create mode 100644 libraries/authority-core/go/storetest/memstore_test.go
 create mode 100644 libraries/authority-core/go/storetest/storetest.go
 delete mode 100644 modules/authority/services/local/code/plugins/composition/plugin_test.go

diff --git a/libraries/authority-core/go/authority/check.go b/libraries/authority-core/go/authority/check.go
index 087b1de1..69b72ff3 100644
--- a/libraries/authority-core/go/authority/check.go
+++ b/libraries/authority-core/go/authority/check.go
@@ -52,6 +52,36 @@ func (s *Service) Check(ctx context.Context, token, audience string) (*workconte
 	return verified, revision, nil
 }
 
+// CheckMethod is Check, then what the audience module's delivery declares
+// for method applied to what the call's current actor holds (the last hop's
+// grant, never the owner's authority above it): decide.AdmitMethod. An empty
+// method is Check alone. Advisory decides the method but does not enforce it:
+// a sound capability is answered with the method's refusal beside it, the
+// same refusal a check that enforces it returns as its error.
+func (s *Service) CheckMethod(ctx context.Context, token, audience, method string, advisory bool) (verified *workcontext.Verified, revision uint64, refusal error, err error) {
+	if audience == "" {
+		return nil, 0, nil, domain.Refuse("a check names the audience the caller is")
+	}
+	if verified, revision, err = s.Check(ctx, token, audience); err != nil || method == "" {
+		return verified, revision, nil, err
+	}
+	err = s.store.Read(ctx, func(tx Tx) error {
+		m, err := tx.Module(audience)
+		if err != nil {
+			return notFound(err)
+		}
+		refusal = decide.AdmitMethod(m, method, verified.EffectiveScopes())
+		return nil
+	})
+	if err != nil {
+		return nil, 0, nil, err
+	}
+	if refusal != nil && !advisory {
+		return nil, 0, nil, refusal
+	}
+	return verified, revision, refusal, nil
+}
+
 // Grant is one way a capability covers resources of a kind: a resource match
 // and, when set, the owner the resource must have.
 type Grant struct {
@@ -81,7 +111,7 @@ func (s *Service) ListResources(ctx context.Context, token, audience, kind, acti
 	err = s.store.Read(ctx, func(tx Tx) error {
 		rows := effective
 		if wc.GetOwnerPrincipalKind() == "human" {
-			p, err := tx.Person(wc.GetOwnerPrincipalId())
+			p, err := tx.Member(wc.GetTenantId(), wc.GetOwnerPrincipalId())
 			if err != nil {
 				return domain.Refuse("the owner %s is no longer a member", wc.GetOwnerPrincipalId())
 			}
diff --git a/libraries/authority-core/go/authority/consent.go b/libraries/authority-core/go/authority/consent.go
index 5c260599..17ba5877 100644
--- a/libraries/authority-core/go/authority/consent.go
+++ b/libraries/authority-core/go/authority/consent.go
@@ -13,16 +13,28 @@ import (
 )
 
 func administrator(tx Tx, caller Person, org string) error {
-	p, err := tx.Person(caller.ID)
+	p, err := memberAs(tx, caller, org)
 	if err != nil && !errors.Is(err, domain.ErrNotFound) {
 		return err
 	}
-	if caller.ID == "" || err != nil || p.Organization != org || !decide.IsAdministrator(p) {
+	if err != nil || !decide.IsAdministrator(p) {
 		return domain.Refuse("installation administration requires an administrator or owner of organization %q", org)
 	}
 	return nil
 }
 
+// memberAs is the caller as a member of org, read now. The caller acts in the
+// organization their session was opened at: a person who belongs to several
+// organizations administers or reads another one only from a session there,
+// so a session never carries one organization's authority into another.
+// Anything else is ErrNotFound, as an absent member is.
+func memberAs(tx Tx, caller Person, org string) (domain.Person, error) {
+	if caller.ID == "" || org == "" || caller.Organization != org {
+		return domain.Person{}, fmt.Errorf("%q acting at %q: %w", caller.ID, org, domain.ErrNotFound)
+	}
+	return tx.Member(org, caller.ID)
+}
+
 // offerDigest covers every authority declaration in the reviewed module. JSON
 // sorts map keys; the receipt therefore covers roles, ceilings and bindings too.
 func offerDigest(m domain.Module) (string, error) {
diff --git a/libraries/authority-core/go/authority/delegation.go b/libraries/authority-core/go/authority/delegation.go
index e737cdfa..bad602c4 100644
--- a/libraries/authority-core/go/authority/delegation.go
+++ b/libraries/authority-core/go/authority/delegation.go
@@ -15,7 +15,7 @@ import (
 func (s *Service) Delegate(ctx context.Context, who Person, module string, scopes Scopes, purpose string) (domain.Delegation, error) {
 	var d domain.Delegation
 	err := s.store.Write(ctx, func(tx Tx) error {
-		p, err := tx.Person(who.ID)
+		p, err := tx.Member(who.Organization, who.ID)
 		if err != nil {
 			return notFound(err)
 		}
@@ -138,7 +138,7 @@ func (s *Service) IssueForDelegation(ctx context.Context, id string, actor Workl
 		if through, err = decide.ScopesFor(binding, r.Operation, "invoke"); err != nil {
 			return err
 		}
-		p, err := tx.Person(d.Grantor)
+		p, err := tx.Member(d.Organization, d.Grantor)
 		if err != nil {
 			return domain.Refuse("the grantor %s is no longer a member", d.Grantor)
 		}
diff --git a/libraries/authority-core/go/authority/issue.go b/libraries/authority-core/go/authority/issue.go
index 4adde2a2..72b23cbf 100644
--- a/libraries/authority-core/go/authority/issue.go
+++ b/libraries/authority-core/go/authority/issue.go
@@ -181,7 +181,7 @@ func (s *Service) IssueForPerson(ctx context.Context, who Person, r IssueRequest
 		if audience, err = tx.Module(r.Audience); err != nil {
 			return notFound(err)
 		}
-		p, err := tx.Person(who.ID)
+		p, err := tx.Member(who.Organization, who.ID)
 		if err != nil || p.Organization != who.Organization {
 			return domain.Refuse("the session's person is no longer a member of %s", who.Organization)
 		}
@@ -475,7 +475,7 @@ func (s *Service) IssueChild(ctx context.Context, parent string, actor Workload,
 		bounded := false
 		switch claims.GetOwnerPrincipalKind() {
 		case "human":
-			p, err := tx.Person(claims.GetOwnerPrincipalId())
+			p, err := tx.Member(tenant, claims.GetOwnerPrincipalId())
 			if err != nil {
 				return domain.Refuse("the owner %s is no longer a member", claims.GetOwnerPrincipalId())
 			}
diff --git a/libraries/authority-core/go/authority/lifecycle.go b/libraries/authority-core/go/authority/lifecycle.go
index 91457e4c..d34e3310 100644
--- a/libraries/authority-core/go/authority/lifecycle.go
+++ b/libraries/authority-core/go/authority/lifecycle.go
@@ -19,6 +19,7 @@ func (s *Service) ApplyModule(ctx context.Context, m domain.Module) ([]string, e
 	if err := decide.ValidateModule(m); err != nil {
 		return nil, err
 	}
+	m.ResourceKinds = decide.Served(m)
 	var ids []string
 	err := s.store.Write(ctx, func(tx Tx) error {
 		ids = nil // a retried transaction starts over
@@ -131,6 +132,43 @@ func (s *Service) ApplyModule(ctx context.Context, m domain.Module) ([]string, e
 	return ids, err
 }
 
+// OrganizationAdded holds every composed module installed at an organization
+// the host created after those modules were delivered, as ApplyModule holds
+// them at every organization that existed then: the order of delivery and
+// sign-up never decides whether an organization may use a module. It is
+// idempotent, and a module installation an administrator or a withdrawal
+// retired stays retired. It answers the organization's module installations.
+func (s *Service) OrganizationAdded(ctx context.Context, org string) ([]string, error) {
+	var ids []string
+	err := s.store.Write(ctx, func(tx Tx) error {
+		ids = nil
+		if _, err := tx.Organization(org); err != nil {
+			return notFound(err)
+		}
+		modules, err := tx.Modules()
+		if err != nil {
+			return err
+		}
+		for _, m := range modules {
+			if m.Kind == domain.KindSolution {
+				continue
+			}
+			id := s.cfg.InstallationID(org, m.Name)
+			if _, err := tx.Installation(id); errors.Is(err, domain.ErrNotFound) {
+				if err := tx.PutInstallation(domain.Installation{ID: id, Organization: org, Target: m.Name, Status: domain.Active, Revision: 1}); err != nil {
+					return err
+				}
+			} else if err != nil {
+				return err
+			}
+			ids = append(ids, id)
+		}
+		slices.Sort(ids)
+		return nil
+	})
+	return ids, err
+}
+
 // WithdrawModule removes a module: its installations are revoked and the
 // delegations granted to it end.
 func (s *Service) WithdrawModule(ctx context.Context, name string) error {
@@ -229,7 +267,7 @@ func (s *Service) install(ctx context.Context, authorize func(Tx) error, caller
 		if _, ok := m.Roles[agentRole]; !ok {
 			return domain.Missing("role %q is not one %s declares", agentRole, target)
 		}
-		p, err := tx.Person(installedBy)
+		p, err := tx.Member(org, installedBy)
 		if err != nil && !errors.Is(err, domain.ErrNotFound) {
 			return err
 		}
@@ -360,13 +398,13 @@ func (s *Service) install(ctx context.Context, authorize func(Tx) error, caller
 // belong to host composition and cannot be uninstalled by a person.
 func (s *Service) Uninstall(ctx context.Context, caller Person, organization, installationID string) error {
 	return s.store.Write(ctx, func(tx Tx) error {
-		p, err := tx.Person(caller.ID)
+		p, err := memberAs(tx, caller, organization)
 		if err != nil && !errors.Is(err, domain.ErrNotFound) {
 			return err
 		}
 		// Authorize before reading the installation: unauthorized callers
 		// cannot tell a present installation from an absent one.
-		if caller.ID == "" || err != nil || p.Organization != organization || !decide.IsAdministrator(p) {
+		if err != nil || !decide.IsAdministrator(p) {
 			return decide.ForeignInstallation(installationID, organization)
 		}
 		inst, err := installationIn(tx, organization, installationID)
@@ -422,8 +460,8 @@ func (s *Service) revoke(tx Tx, inst domain.Installation) error {
 func (s *Service) Installations(ctx context.Context, caller Person, org string) ([]domain.Installation, error) {
 	var out []domain.Installation
 	err := s.store.Read(ctx, func(tx Tx) error {
-		p, err := tx.Person(caller.ID)
-		if err != nil || p.Organization != org || !decide.IsAdministrator(p) {
+		p, err := memberAs(tx, caller, org)
+		if err != nil || !decide.IsAdministrator(p) {
 			return domain.Refuse("installation administration requires an administrator or owner of organization %q", org)
 		}
 		out, err = tx.Installations(org)
diff --git a/libraries/authority-core/go/authority/membership_test.go b/libraries/authority-core/go/authority/membership_test.go
new file mode 100644
index 00000000..3bd663c3
--- /dev/null
+++ b/libraries/authority-core/go/authority/membership_test.go
@@ -0,0 +1,87 @@
+package authority_test
+
+import (
+	"testing"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/authority"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+)
+
+// A person may belong to several organizations. What they hold, administer
+// and may be granted is read from their membership of the organization the
+// session was opened at, never from another one.
+func TestAPersonOfTwoOrganizationsActsOnlyAsTheMemberOfTheSessions(t *testing.T) {
+	h := newHarness(t)
+	h.store.PutOrgRole(domain.OrgRole{Organization: globex, Name: "store-writer", Scopes: []domain.RoleScope{{Kind: kind, Actions: []string{"write"}}}})
+	h.store.PutOrgRole(domain.OrgRole{Organization: acme, Name: "store-plain-reader", Scopes: []domain.RoleScope{{Kind: kind, Actions: []string{"read"}}}})
+	h.store.PutPerson(domain.Person{ID: "pat", Organization: acme, Roles: []string{"store-plain-reader"}})
+	h.store.PutPerson(domain.Person{ID: "pat", Organization: globex, Roles: []string{"admin", "store-writer"}})
+	atAcme := authority.Person{ID: "pat", Organization: acme, SessionID: "s-acme"}
+	atGlobex := authority.Person{ID: "pat", Organization: globex, SessionID: "s-globex"}
+	read, write := []*basev0.WorkScopeV1{sc(kind, "read")}, []*basev0.WorkScopeV1{sc(kind, "write")}
+
+	for _, tc := range []struct {
+		name    string
+		who     authority.Person
+		scopes  []*basev0.WorkScopeV1
+		allowed bool
+	}{
+		{"acme's role at acme", atAcme, read, true},
+		{"globex's role does not reach acme", atAcme, write, false},
+		{"globex's role at globex", atGlobex, write, true},
+		{"acme's role does not reach globex", atGlobex, read, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := h.svc.IssueForPerson(h.ctx, tc.who, authority.IssueRequest{Audience: "store", Scopes: tc.scopes})
+			if tc.allowed && err != nil {
+				t.Fatal(err)
+			}
+			if !tc.allowed {
+				code(t, err, domain.Denied)
+			}
+		})
+	}
+
+	t.Run("administration is the session organization's", func(t *testing.T) {
+		if _, err := h.svc.Installations(h.ctx, atGlobex, globex); err != nil {
+			t.Fatal(err)
+		}
+		_, err := h.svc.Installations(h.ctx, atAcme, globex)
+		refused(t, err, "requires an administrator")
+		_, err = h.svc.Installations(h.ctx, atAcme, acme)
+		refused(t, err, "requires an administrator")
+		_, err = h.svc.Review(h.ctx, atAcme, globex, "b")
+		refused(t, err, "requires an administrator")
+		_, err = h.svc.GrantRole(h.ctx, atAcme, authority.RoleRequest{Organization: globex, InstallationID: h.inst(globex, "a").ID, Role: "viewer", PersonID: "pat"})
+		refused(t, err, "another organization")
+	})
+
+	t.Run("a role granted at one organization's installation counts there alone", func(t *testing.T) {
+		h.grant("a", "viewer", "pat")
+		if _, err := h.svc.IssueForPerson(h.ctx, atAcme, authority.IssueRequest{Audience: "a"}); err != nil {
+			t.Fatal(err)
+		}
+		_, err := h.svc.IssueForPerson(h.ctx, atGlobex, authority.IssueRequest{Audience: "a"})
+		refused(t, err, "holds no role")
+	})
+
+	t.Run("a person is granted a role only as a member of the installation's organization", func(t *testing.T) {
+		_, err := h.svc.GrantRole(h.ctx, h.person("alex"), authority.RoleRequest{Organization: acme, InstallationID: h.inst(acme, "a").ID, Role: "viewer", PersonID: "omar"})
+		refused(t, err, "is not a member of")
+	})
+
+	t.Run("leaving one organization leaves the other membership standing", func(t *testing.T) {
+		h.store.DeleteMember(acme, "pat")
+		_, err := h.svc.IssueForPerson(h.ctx, atAcme, authority.IssueRequest{Audience: "store", Scopes: read})
+		refused(t, err, "no longer a member")
+		if _, err := h.svc.IssueForPerson(h.ctx, atGlobex, authority.IssueRequest{Audience: "store", Scopes: write}); err != nil {
+			t.Fatal(err)
+		}
+	})
+
+	t.Run("a session with no organization acts nowhere", func(t *testing.T) {
+		_, err := h.svc.Installations(h.ctx, authority.Person{ID: "pat"}, globex)
+		refused(t, err, "requires an administrator")
+	})
+}
diff --git a/libraries/authority-core/go/authority/organization_added_test.go b/libraries/authority-core/go/authority/organization_added_test.go
new file mode 100644
index 00000000..909383d6
--- /dev/null
+++ b/libraries/authority-core/go/authority/organization_added_test.go
@@ -0,0 +1,45 @@
+package authority_test
+
+import (
+	"testing"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/authority"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+)
+
+// An organization created after the modules were delivered holds each of
+// them as an organization that existed then does; a retired installation
+// stays retired, and asking twice changes nothing.
+func TestAnOrganizationAddedLaterHoldsEveryComposedModule(t *testing.T) {
+	h := newHarness(t)
+	const initech = "initech"
+	h.store.PutOrganization(domain.Organization{ID: initech, Name: initech})
+	h.store.PutPerson(domain.Person{ID: "ivy", Organization: initech})
+	h.store.PutOrgRole(domain.OrgRole{Organization: initech, Name: "reader", Scopes: []domain.RoleScope{{Kind: kind, Actions: []string{"read"}}}})
+	h.store.PutPerson(domain.Person{ID: "ivy", Organization: initech, Roles: []string{"reader"}})
+	ivy := authority.Person{ID: "ivy", Organization: initech, SessionID: "s-ivy"}
+	_, err := h.svc.IssueForPerson(h.ctx, ivy, authority.IssueRequest{Audience: "store", Scopes: []*basev0.WorkScopeV1{sc(kind, "read")}})
+	code(t, err, domain.Precondition)
+
+	ids, err := h.svc.OrganizationAdded(h.ctx, initech)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(ids) != 2 { // store and legacy-store; solutions are installed explicitly
+		t.Fatalf("module installations %v", ids)
+	}
+	if _, err := h.svc.IssueForPerson(h.ctx, ivy, authority.IssueRequest{Audience: "store", Scopes: []*basev0.WorkScopeV1{sc(kind, "read")}}); err != nil {
+		t.Fatal(err)
+	}
+	if err := h.svc.UninstallAsHost(h.ctx, initech, authority.StableInstallationID(initech, "store")); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := h.svc.OrganizationAdded(h.ctx, initech); err != nil {
+		t.Fatal(err)
+	}
+	_, err = h.svc.IssueForPerson(h.ctx, ivy, authority.IssueRequest{Audience: "store", Scopes: []*basev0.WorkScopeV1{sc(kind, "read")}})
+	code(t, err, domain.Precondition)
+	_, err = h.svc.OrganizationAdded(h.ctx, "nobody")
+	code(t, err, domain.NotFound)
+}
diff --git a/libraries/authority-core/go/authority/r152_test.go b/libraries/authority-core/go/authority/r152_test.go
index d4218da4..346ae3cf 100644
--- a/libraries/authority-core/go/authority/r152_test.go
+++ b/libraries/authority-core/go/authority/r152_test.go
@@ -86,6 +86,12 @@ func (t lifecycleOutageTx) Person(id string) (domain.Person, error) {
 	}
 	return t.Tx.Person(id)
 }
+func (t lifecycleOutageTx) Member(org, id string) (domain.Person, error) {
+	if t.fail == "person" {
+		return domain.Person{}, t.err
+	}
+	return t.Tx.Member(org, id)
+}
 func (t lifecycleOutageTx) Installation(id string) (domain.Installation, error) {
 	if t.fail == "installation" {
 		return domain.Installation{}, t.err
diff --git a/libraries/authority-core/go/authority/roles.go b/libraries/authority-core/go/authority/roles.go
index 9c59d4f9..deb45d06 100644
--- a/libraries/authority-core/go/authority/roles.go
+++ b/libraries/authority-core/go/authority/roles.go
@@ -25,11 +25,11 @@ func decideRoleChange(tx Tx, caller Person, r RoleRequest, list, revoke bool) (d
 	// it: the foreign answer comes before any installation is read. Then the
 	// installation is resolved by (organization, id): another organization's
 	// and an absent one answer alike, having done the same work.
-	c, err := tx.Person(caller.ID)
+	c, err := memberAs(tx, caller, r.Organization)
 	if err != nil && !errors.Is(err, domain.ErrNotFound) {
 		return domain.Installation{}, err
 	}
-	if caller.ID == "" || err != nil || c.Organization != r.Organization {
+	if err != nil {
 		return domain.Installation{}, decide.ForeignInstallation(r.InstallationID, r.Organization)
 	}
 	inst, err := tx.Installation(r.InstallationID)
@@ -50,7 +50,7 @@ func decideRoleChange(tx Tx, caller Person, r RoleRequest, list, revoke bool) (d
 	change := decide.RoleChange{RequestOrganization: r.Organization, RequestedID: r.InstallationID, Installation: inst, Solution: solution,
 		Caller: c, CallerRoles: decide.HeldRoles(c, inst, grants), List: list, Revoke: revoke, Role: r.Role, PersonID: r.PersonID, TeamID: r.TeamID}
 	if r.PersonID != "" {
-		if p, err := tx.Person(r.PersonID); err == nil {
+		if p, err := tx.Member(inst.Organization, r.PersonID); err == nil {
 			change.Subject = &p
 		}
 	}
@@ -135,13 +135,3 @@ func (s *Service) PersonChanged(ctx context.Context, person string) error {
 	return s.store.Write(ctx, func(tx Tx) error { return tx.BumpPersonEpoch(person) })
 }
 
-// callerOrganization is the organization the caller belongs to now, read from
-// the store.
-func callerOrganization(tx Tx, caller Person) string {
-	if p, err := tx.Person(caller.ID); err == nil {
-		return p.Organization
-	}
-	// A caller the store no longer knows belongs to no organization: they get
-	// the foreign answer, whatever their session says.
-	return ""
-}
diff --git a/libraries/authority-core/go/authority/service.go b/libraries/authority-core/go/authority/service.go
index 5be0cdcd..857cfb2a 100644
--- a/libraries/authority-core/go/authority/service.go
+++ b/libraries/authority-core/go/authority/service.go
@@ -224,8 +224,8 @@ func (src sources) holds(tx Tx, principal string, inst domain.Installation) (boo
 	} else if !errors.Is(err, domain.ErrNotFound) {
 		return false, err
 	}
-	if p, err := tx.Person(principal); err == nil {
-		return p.Organization == inst.Organization, nil
+	if _, err := tx.Member(inst.Organization, principal); err == nil {
+		return true, nil
 	} else if !errors.Is(err, domain.ErrNotFound) {
 		return false, err
 	}
diff --git a/libraries/authority-core/go/authority/store.go b/libraries/authority-core/go/authority/store.go
index ab370bca..82d5362b 100644
--- a/libraries/authority-core/go/authority/store.go
+++ b/libraries/authority-core/go/authority/store.go
@@ -27,7 +27,13 @@ var ErrConflict = errors.New("authority: the transaction conflicted with another
 type Tx interface {
 	Organizations() ([]domain.Organization, error)
 	Organization(id string) (domain.Organization, error)
+	// Person answers whether id names a person at all, in any organization.
+	// A person may belong to several organizations, so the authority reads
+	// nothing else from it: what a person holds is read through Member.
 	Person(id string) (domain.Person, error)
+	// Member is a person as a member of one organization: their roles and
+	// teams there. A person who is not a member of it is ErrNotFound.
+	Member(organization, id string) (domain.Person, error)
 	People(organization string) ([]domain.Person, error)
 	OrgRole(organization, name string) (domain.OrgRole, error)
 
diff --git a/libraries/authority-core/go/authority/transfer.go b/libraries/authority-core/go/authority/transfer.go
index 174c9e7f..c004b8ac 100644
--- a/libraries/authority-core/go/authority/transfer.go
+++ b/libraries/authority-core/go/authority/transfer.go
@@ -72,7 +72,7 @@ func (s *Service) AuthorizeTransfer(ctx context.Context, r TransferRequest) (Tra
 		if t.OwnerKind != "human" {
 			return decide.AuthorizeTransfer(t)
 		}
-		p, err := tx.Person(wc.GetOwnerPrincipalId())
+		p, err := tx.Member(wc.GetTenantId(), wc.GetOwnerPrincipalId())
 		if err != nil {
 			return domain.Refuse("the owner %s is no longer a member", wc.GetOwnerPrincipalId())
 		}
@@ -92,7 +92,7 @@ func (s *Service) AuthorizeTransfer(ctx context.Context, r TransferRequest) (Tra
 		} else if !errors.Is(err, domain.ErrNotFound) {
 			return err
 		}
-		if fp, err := tx.Person(r.From); err == nil {
+		if fp, err := tx.Member(wc.GetTenantId(), r.From); err == nil {
 			t.FromPerson = &fp
 		}
 		roles, err := orgRoles(tx, p)
diff --git a/libraries/authority-core/go/decide/manifest.go b/libraries/authority-core/go/decide/manifest.go
index 9e9324cd..828c5e60 100644
--- a/libraries/authority-core/go/decide/manifest.go
+++ b/libraries/authority-core/go/decide/manifest.go
@@ -8,6 +8,7 @@ import (
 	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
 	"github.com/codefly-dev/authority/libraries/authority-core/go/scope"
 	delivery "github.com/codefly-dev/authority/libraries/delivery/go"
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
 )
 
 // ValidateModule holds a delivered module to its contract: a principal, a
@@ -15,6 +16,13 @@ import (
 // a module declares no roles; a solution declares installer, and every role
 // stays within what it serves or consumes through invoke/lookup bindings.
 func ValidateModule(m domain.Module) error {
+	if err := validateModule(m); err != nil {
+		return err
+	}
+	return noOwners(m)
+}
+
+func validateModule(m domain.Module) error {
 	if m.Name == "" || m.Principal == "" || m.Generation == 0 {
 		return domain.Refuse("a manifest names its module, its principal and a generation")
 	}
@@ -119,3 +127,58 @@ func Narrowed(previous, next domain.Module) bool {
 	}
 	return false
 }
+
+// noOwners refuses a delivery naming a resource owner where none belongs: in
+// what a module serves, in a binding's scopes, in a role or in a method's
+// requirement. An owner is the authority's to select per installation; read
+// owner-blind, it would widen to the whole kind, so it is refused by name.
+func noOwners(m domain.Module) error {
+	check := func(where string, scopes Scopes) error {
+		for _, sc := range scopes {
+			if sc.GetResourceOwnerId() != "" {
+				return domain.Refuse("%s: %s names resource owner %q; a delivery never selects an owner", where, sc.GetResourceKind(), sc.GetResourceOwnerId())
+			}
+		}
+		return nil
+	}
+	if err := check(m.Name+" serves", m.ResourceKinds); err != nil {
+		return err
+	}
+	for _, id := range slices.Sorted(maps.Keys(m.Bindings)) {
+		b := m.Bindings[id]
+		for _, scopes := range []Scopes{b.InvokeScopes, b.HeadlessScopes, b.LookupScopes} {
+			if err := check(m.Name+" binding "+id, scopes); err != nil {
+				return err
+			}
+		}
+	}
+	for _, name := range slices.Sorted(maps.Keys(m.Roles)) {
+		if err := check(m.Name+" role "+name, m.Roles[name]); err != nil {
+			return err
+		}
+	}
+	for _, name := range slices.Sorted(maps.Keys(m.OwnedRoles)) {
+		if err := check(m.Name+" installation-owned role "+name, m.OwnedRoles[name]); err != nil {
+			return err
+		}
+	}
+	for _, method := range slices.Sorted(maps.Keys(m.Methods)) {
+		if err := check(m.Name+" method "+method, m.Methods[method].Requires); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// Served is what a module serves: the kinds it declares, joined to every
+// (kind, action) its methods require of a call, read from its own method
+// declarations.
+func Served(m domain.Module) Scopes {
+	served := slices.Clone(m.ResourceKinds)
+	for _, method := range slices.Sorted(maps.Keys(m.Methods)) {
+		for _, required := range m.Methods[method].Requires {
+			served = append(served, &basev0.WorkScopeV1{ResourceKind: required.GetResourceKind(), Actions: slices.Clone(required.GetActions())})
+		}
+	}
+	return scope.Normalize(served)
+}
diff --git a/libraries/authority-core/go/decide/method.go b/libraries/authority-core/go/decide/method.go
new file mode 100644
index 00000000..6803c332
--- /dev/null
+++ b/libraries/authority-core/go/decide/method.go
@@ -0,0 +1,104 @@
+package decide
+
+import (
+	"fmt"
+	"slices"
+	"strings"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/scope"
+	"github.com/codefly-dev/authority/libraries/hop/go/routing"
+)
+
+// AdmitMethod applies what the module m (the audience a call is checked for)
+// declares for method to the scopes the checked call holds. A method that m
+// does not declare is NotFound; a module that declares no method policy, a
+// method declaring nothing, or one declaring both that it requires scopes and
+// that it requires none, is refused: an absent or ambiguous declaration is
+// never read as permission. Method admission checks kinds and actions only:
+// the module still checks each resource, and its owner, against the
+// unchanged scopes.
+//
+// method is a full protobuf procedure, or an HTTP request "<VERB> <path>"
+// admitted under the one route template "<VERB> <template>" its path is an
+// instance of; two matching templates are refused rather than guessed between.
+func AdmitMethod(m domain.Module, method string, held Scopes) error {
+	audience := m.Principal
+	if m.Methods == nil {
+		return domain.Refuse("%s's delivery declares no method policy, so %s is refused", audience, method)
+	}
+	p, ok := m.Methods[method]
+	if !ok {
+		var err error
+		if p, ok, err = routeOf(m.Methods, method); err != nil {
+			return domain.Refuse("%s: %v", audience, err)
+		}
+	}
+	switch {
+	case !ok:
+		return domain.Missing("%s serves no method %s", audience, method)
+	case p.AnyCheckedCaller && len(p.Requires) > 0:
+		return domain.Refuse("%s declares for %s both that it requires scopes and that it requires none", audience, method)
+	case p.AnyCheckedCaller:
+		return nil
+	case len(p.Requires) == 0:
+		return domain.Refuse("%s declares no policy for %s", audience, method)
+	}
+	var missing []string
+	for _, r := range p.Requires {
+		for _, action := range r.GetActions() {
+			if !scope.HoldsAction(held, r.GetResourceKind(), action) {
+				missing = append(missing, r.GetResourceKind()+":"+action)
+			}
+		}
+	}
+	if len(missing) > 0 {
+		return domain.Refuse("%s requires %s for %s, which the call does not hold (it holds %s)",
+			audience, strings.Join(missing, ", "), method, describe(held))
+	}
+	return nil
+}
+
+// routeOf is the route a module declares that an HTTP request "<VERB> <path>"
+// is for.
+func routeOf(methods map[string]domain.MethodPolicy, request string) (domain.MethodPolicy, bool, error) {
+	verb, path, ok := strings.Cut(request, " ")
+	if !ok || !strings.HasPrefix(path, "/") {
+		return domain.MethodPolicy{}, false, nil
+	}
+	var found []string
+	for declared := range methods {
+		if v, template, ok := strings.Cut(declared, " "); ok && v == verb && routing.RouteMatches(template, path) {
+			found = append(found, declared)
+		}
+	}
+	switch len(found) {
+	case 0:
+		return domain.MethodPolicy{}, false, nil
+	case 1:
+		return methods[found[0]], true, nil
+	}
+	slices.Sort(found)
+	return domain.MethodPolicy{}, false, fmt.Errorf("%s matches more than one declared route (%s)", request, strings.Join(found, ", "))
+}
+
+// describe names what a call holds, for a refusal.
+func describe(held Scopes) string {
+	var out []string
+	for _, h := range held {
+		for _, a := range h.GetActions() {
+			permission := h.GetResourceKind() + ":" + a
+			switch {
+			case h.GetResourceOwnerId() != "":
+				permission += " (owner-selected)"
+			case len(h.GetResourceIds()) > 0:
+				permission += " (resource-limited)"
+			}
+			out = append(out, permission)
+		}
+	}
+	if len(out) == 0 {
+		return "nothing"
+	}
+	return strings.Join(out, ", ")
+}
diff --git a/libraries/authority-core/go/decide/method_test.go b/libraries/authority-core/go/decide/method_test.go
new file mode 100644
index 00000000..0b3c9030
--- /dev/null
+++ b/libraries/authority-core/go/decide/method_test.go
@@ -0,0 +1,145 @@
+package decide_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/decide"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/scope"
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+)
+
+func ws(kind string, ids []string, actions ...string) *basev0.WorkScopeV1 {
+	return &basev0.WorkScopeV1{ResourceKind: kind, Actions: actions, ResourceIds: ids}
+}
+
+func reads(kind string) domain.MethodPolicy {
+	return domain.MethodPolicy{Requires: []*basev0.WorkScopeV1{ws(kind, nil, "read")}}
+}
+
+// Every rule of method admission, allowed and refused, with the refusal's
+// code: a method not declared is NotFound, every other refusal Denied.
+func TestMethodAdmission(t *testing.T) {
+	gauge := domain.Module{Name: "gauge", Principal: "gauge", Methods: map[string]domain.MethodPolicy{
+		"/gauge.Service/List":                      reads("gauge.items"),
+		"/gauge.Service/Edit":                      {Requires: []*basev0.WorkScopeV1{ws("gauge.items", nil, "read", "write")}},
+		"/gauge.Service/Ping":                      {AnyCheckedCaller: true},
+		"/gauge.Service/Both":                      {AnyCheckedCaller: true, Requires: []*basev0.WorkScopeV1{ws("gauge.items", nil, "read")}},
+		"/gauge.Service/Empty":                     {},
+		"GET /v1/gauge/profiles":                   reads("gauge.profiles"),
+		"GET /v1/gauge/profiles/{ref}":             reads("gauge.profiles"),
+		"POST /v1/gauge/matches/{match_id}:settle": {Requires: []*basev0.WorkScopeV1{ws("gauge.profiles", nil, "write")}},
+		"GET /v1/gauge/{a}/x":                      {AnyCheckedCaller: true},
+		"GET /v1/gauge/{b}/x":                      {AnyCheckedCaller: true},
+		"GET /v1/gauge/sources/{repo=**}":          reads("gauge.profiles"),
+		"POST /v1/gauge/sources/{repo=**}:settle":  reads("gauge.profiles"),
+		"/gauge.v1.GaugeService/ListProfiles":      reads("gauge.profiles"),
+	}}
+	read := []*basev0.WorkScopeV1{ws("gauge.profiles", nil, "read")}
+	type want int
+	const (
+		allow want = iota
+		denied
+		missing
+	)
+	for _, tc := range []struct {
+		name, method string
+		held         []*basev0.WorkScopeV1
+		want         want
+		reason       string
+	}{
+		{"one resource", "/gauge.Service/List", []*basev0.WorkScopeV1{ws("gauge.items", []string{"one"}, "read")}, allow, ""},
+		{"several resource scopes", "/gauge.Service/List", []*basev0.WorkScopeV1{ws("gauge.items", []string{"one"}, "read"), ws("gauge.items", []string{"two"}, "read")}, allow, ""},
+		{"restricted wildcard", "/gauge.Service/List", []*basev0.WorkScopeV1{ws("gauge.items", []string{"one"}, scope.AnyAction)}, allow, ""},
+		{"whole kind", "/gauge.Service/List", []*basev0.WorkScopeV1{ws("gauge.items", nil, "read")}, allow, ""},
+		{"whole wildcard", "/gauge.Service/Edit", []*basev0.WorkScopeV1{ws("gauge.items", nil, scope.AnyAction)}, allow, ""},
+		{"whole read restricted write", "/gauge.Service/Edit", []*basev0.WorkScopeV1{ws("gauge.items", nil, "read"), ws("gauge.items", []string{"one"}, "write")}, allow, ""},
+		{"checked caller", "/gauge.Service/Ping", nil, allow, ""},
+		{"missing write names the restriction", "/gauge.Service/Edit", []*basev0.WorkScopeV1{ws("gauge.items", []string{"one"}, "read")}, denied, "resource-limited"},
+		{"nothing held", "/gauge.Service/List", nil, denied, "it holds nothing"},
+		{"owner-selected is named", "/gauge.Service/Edit", []*basev0.WorkScopeV1{{ResourceKind: "gauge.items", Actions: []string{"read"}, ResourceOwnerId: "p"}}, denied, "owner-selected"},
+		{"both requires and any caller", "/gauge.Service/Both", read, denied, "both that it requires"},
+		{"a policy declaring nothing", "/gauge.Service/Empty", read, denied, "declares no policy"},
+		{"an undeclared method", "/gauge.Service/Gone", read, missing, "serves no method"},
+		{"route", "GET /v1/gauge/profiles", read, allow, ""},
+		{"route template", "GET /v1/gauge/profiles/pro-1", read, allow, ""},
+		{"route matched, write not held", "POST /v1/gauge/matches/m-1:settle", read, denied, "gauge.profiles:write"},
+		{"extra segment", "GET /v1/gauge/profiles/pro-1/extra", read, missing, ""},
+		{"other verb", "DELETE /v1/gauge/profiles/pro-1", read, missing, ""},
+		{"an empty segment", "POST /v1/gauge/matches/:settle", read, missing, ""},
+		{"two templates match", "GET /v1/gauge/ambiguous/x", read, denied, "more than one declared route"},
+		{"rest of path", "GET /v1/gauge/sources/github.com/acme/repo", read, allow, ""},
+		{"empty rest of path", "GET /v1/gauge/sources/", read, missing, ""},
+		{"verb after the rest", "POST /v1/gauge/sources/github.com/acme/repo:settle", read, allow, ""},
+		{"HTTP never borrows a protobuf policy", "POST /gauge.v1.GaugeService/ListProfiles", read, missing, ""},
+		{"a procedure", "/gauge.v1.GaugeService/ListProfiles", read, allow, ""},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			err := decide.AdmitMethod(gauge, tc.method, tc.held)
+			switch tc.want {
+			case allow:
+				if err != nil {
+					t.Fatal(err)
+				}
+				return
+			case denied:
+				wantCode(t, err, domain.Denied)
+			case missing:
+				wantCode(t, err, domain.NotFound)
+			}
+			if !strings.Contains(err.Error(), tc.reason) {
+				t.Fatalf("refusal %q does not name %q", err, tc.reason)
+			}
+		})
+	}
+	t.Run("a module declaring no method policy admits nothing", func(t *testing.T) {
+		err := decide.AdmitMethod(domain.Module{Principal: "oracle"}, "/oracle/Read", read)
+		wantCode(t, err, domain.Denied)
+		if !strings.Contains(err.Error(), "no method policy") {
+			t.Fatal(err)
+		}
+	})
+}
+
+func wantCode(t *testing.T, err error, want domain.Code) {
+	t.Helper()
+	if got, ok := domain.CodeOf(err); !ok || got != want {
+		t.Fatalf("want code %v, got %v (%v)", want, got, err)
+	}
+}
+
+// A delivery never selects an owner: anywhere one appears is refused by name,
+// and what a module serves includes every kind its methods require.
+func TestADeliveryNamesNoOwnerAndServesWhatItsMethodsRequire(t *testing.T) {
+	owner := &basev0.WorkScopeV1{ResourceKind: "k", Actions: []string{"read"}, ResourceOwnerId: "u"}
+	base := func() domain.Module {
+		return domain.Module{Name: "m", Principal: "m", Kind: domain.KindModule, Generation: 1, Bindings: map[string]domain.Binding{}}
+	}
+	for name, mutate := range map[string]func(*domain.Module){
+		"serves": func(m *domain.Module) { m.ResourceKinds = []*basev0.WorkScopeV1{owner} },
+		"invoke": func(m *domain.Module) {
+			m.Bindings["b"] = domain.Binding{ID: "b", Audience: "x", InvokeScopes: []*basev0.WorkScopeV1{owner}}
+		},
+		"lookup": func(m *domain.Module) {
+			m.Bindings["b"] = domain.Binding{ID: "b", Audience: "x", InvokeScopes: []*basev0.WorkScopeV1{ws("k", nil, "read")}, LookupScopes: []*basev0.WorkScopeV1{owner}}
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			m := base()
+			mutate(&m)
+			err := decide.ValidateModule(m)
+			wantCode(t, err, domain.Denied)
+			if !strings.Contains(err.Error(), "never selects an owner") {
+				t.Fatal(err)
+			}
+		})
+	}
+	m := base()
+	m.ResourceKinds = []*basev0.WorkScopeV1{ws("own", nil, "read")}
+	m.Methods = map[string]domain.MethodPolicy{"/m/Write": {Requires: []*basev0.WorkScopeV1{ws("other", nil, "write")}}, "/m/Read": reads("own")}
+	served := decide.Served(m)
+	if !scope.Same(served, scope.Normalize([]*basev0.WorkScopeV1{ws("other", nil, "write"), ws("own", nil, "read")})) {
+		t.Fatalf("served %v", served)
+	}
+}
diff --git a/libraries/authority-core/go/delivered/delivered.go b/libraries/authority-core/go/delivered/delivered.go
new file mode 100644
index 00000000..69590154
--- /dev/null
+++ b/libraries/authority-core/go/delivered/delivered.go
@@ -0,0 +1,217 @@
+// Package delivered reads a verified delivery as the authority's module: core's
+// signed module manifest and, beside it, the authority's own document
+// (codefly.dev/composition AuthorityManifestV1). Every host composes a module
+// from the same two documents, so this is where the reading lives; a host
+// verifies the carrier (it holds the release keys) and decodes the document
+// from its own generated binding into Document, and nothing else.
+package delivered
+
+import (
+	"crypto"
+	"slices"
+	"strings"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/scope"
+	delivery "github.com/codefly-dev/authority/libraries/delivery/go"
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+	"github.com/codefly-dev/core/solutionhost"
+)
+
+// Scopes is a scope list.
+type Scopes = []*basev0.WorkScopeV1
+
+// Document is the authority's own document delivered with a manifest, as a
+// host decodes it.
+type Document struct {
+	Module             string
+	Generation         uint64
+	CoreManifestDigest string
+	ScopeCeilings      Scopes
+	Methods            []Method
+	Roles              []Role
+	OwnerAware         bool
+}
+
+// Method is one method's declaration in the document.
+type Method struct {
+	Method           string
+	Requires         Scopes
+	AnyCheckedCaller bool
+}
+
+// Role is one of a solution's roles: its scopes, and those it declares
+// installation-owned (resolved to the ids each installation owns).
+type Role struct {
+	Name                      string
+	Scopes, InstallationOwned Scopes
+}
+
+// VerifyDocument checks the document's signature against the pinned release
+// keys and that the key which signed it is the one that signed the carrier, so
+// a delivery cannot pair one release's manifest with another's declarations.
+func VerifyDocument(document, envelope []byte, keys map[string]crypto.PublicKey, carrierSigner string) error {
+	keyID, err := delivery.Verify(document, envelope, keys)
+	if err != nil {
+		return domain.Refuse("the authority's document does not verify: %v", err)
+	}
+	if keyID != carrierSigner {
+		return domain.Refuse("the authority's document is signed by %q and the manifest by %q", keyID, carrierSigner)
+	}
+	return nil
+}
+
+// Pair holds a verified document to the carrier it was delivered with: the
+// same module, the same generation, and the carrier's own digest.
+func Pair(doc Document, carrierDocument []byte, manifest *solutionhost.ModuleManifest) error {
+	switch {
+	case doc.Module != manifest.Alias:
+		return domain.Refuse("the authority's document is for %q, the manifest for %q", doc.Module, manifest.Alias)
+	case doc.Generation != manifest.Generation:
+		return domain.Refuse("the authority's document is at generation %d, the manifest at %d", doc.Generation, manifest.Generation)
+	case doc.CoreManifestDigest != delivery.Digest(carrierDocument):
+		return domain.Refuse("the authority's document names another manifest than the one delivered with it")
+	}
+	return nil
+}
+
+// Module is what a verified delivery composes: core's manifest (FromCore),
+// narrowed and completed by the document paired with it, when one was. A
+// withdrawal carries no live declaration.
+func Module(manifest *solutionhost.ModuleManifest, doc *Document) (domain.Module, error) {
+	m := FromCore(manifest)
+	if doc == nil {
+		return m, nil
+	}
+	if manifest.Removed && (len(doc.Methods) > 0 || len(doc.Roles) > 0 || len(doc.ScopeCeilings) > 0) {
+		return m, domain.Malformed("a withdrawal carries no live authority declarations")
+	}
+	var err error
+	if m.Methods, err = methods(doc.Methods); err != nil {
+		return m, err
+	}
+	for _, ceiling := range doc.ScopeCeilings {
+		if ceiling.GetResourceOwnerId() != "" {
+			return m, domain.Refuse("%s: scope ceiling %s names resource owner %q; a delivery never selects an owner", m.Name, ceiling.GetResourceKind(), ceiling.GetResourceOwnerId())
+		}
+	}
+	if m, err = Ceiled(m, doc.ScopeCeilings); err != nil {
+		return m, err
+	}
+	if m.Roles, m.OwnedRoles, err = roles(doc.Roles); err != nil {
+		return m, err
+	}
+	m.OwnerAware = doc.OwnerAware
+	return m, nil
+}
+
+// methods reads what each method declares.
+func methods(in []Method) (map[string]domain.MethodPolicy, error) {
+	out := make(map[string]domain.MethodPolicy, len(in))
+	for _, method := range in {
+		if _, twice := out[method.Method]; twice || method.Method == "" {
+			return nil, domain.Malformed("the authority's document lists method %q twice or unnamed", method.Method)
+		}
+		out[method.Method] = domain.MethodPolicy{Requires: method.Requires, AnyCheckedCaller: method.AnyCheckedCaller}
+	}
+	return out, nil
+}
+
+// roles reads the roles a solution declares, by name, and the scopes of each
+// it declares installation-owned. Core holds them to the role contract when
+// the module is applied (decide.ValidateModule).
+func roles(in []Role) (map[string]Scopes, map[string]Scopes, error) {
+	owned := map[string]Scopes{}
+	if len(in) == 0 {
+		return nil, owned, nil
+	}
+	out := make(map[string]Scopes, len(in))
+	for _, role := range in {
+		if _, twice := out[role.Name]; twice || role.Name == "" {
+			return nil, nil, domain.Malformed("the authority's document lists role %q twice or unnamed", role.Name)
+		}
+		out[role.Name] = scope.Normalize(role.Scopes)
+		if len(role.InstallationOwned) > 0 {
+			owned[role.Name] = role.InstallationOwned
+		}
+	}
+	return out, owned, nil
+}
+
+// Ceiled gives each of the module's own kinds the actions its document
+// declares on it, in place of the any-action kind core's manifest leaves it
+// with. A ceiling naming a kind core's manifest does not declare is refused:
+// the document narrows what core's manifest composes, never adds to it.
+func Ceiled(m domain.Module, ceilings Scopes) (domain.Module, error) {
+	if len(ceilings) == 0 {
+		return m, nil
+	}
+	declared := map[string]bool{}
+	for _, kind := range m.ResourceKinds {
+		declared[kind.GetResourceKind()] = true
+	}
+	ceiled := map[string]bool{}
+	for _, ceiling := range ceilings {
+		if !declared[ceiling.GetResourceKind()] {
+			return m, domain.Malformed("the authority's document ceils %s, which %s's manifest does not declare", ceiling.GetResourceKind(), m.Name)
+		}
+		if len(ceiling.GetActions()) == 0 {
+			return m, domain.Malformed("the authority's document ceils %s with no action", ceiling.GetResourceKind())
+		}
+		ceiled[ceiling.GetResourceKind()] = true
+	}
+	kinds := slices.Clone(ceilings)
+	for _, kind := range m.ResourceKinds {
+		if !ceiled[kind.GetResourceKind()] {
+			kinds = append(kinds, kind)
+		}
+	}
+	m.ResourceKinds = scope.Normalize(kinds)
+	return m, nil
+}
+
+// FromCore reads core's module manifest as the authority's module. Core's
+// manifest carries no roles; a solution's arrive in the document delivered
+// with it. The manifest is the ceiling here: a resource kind declared with no
+// actions serves whatever the roles grant on it, a binding's operations are
+// its scopes, each "<resource kind>:<action>" as core's manifest writes them.
+func FromCore(in *solutionhost.ModuleManifest) domain.Module {
+	m := domain.Module{Name: in.Alias, Principal: in.Alias, Kind: string(in.Kind), Generation: in.Generation, Bindings: map[string]domain.Binding{}}
+	if in.Authority == nil {
+		return m
+	}
+	if in.Authority.Principal != "" {
+		m.Principal = in.Authority.Principal
+	}
+	for _, kind := range in.Authority.ResourceKinds {
+		m.ResourceKinds = append(m.ResourceKinds, &basev0.WorkScopeV1{ResourceKind: kind, Actions: []string{scope.AnyAction}})
+	}
+	m.ResourceKinds = scope.Normalize(m.ResourceKinds)
+	for _, b := range in.Authority.Bindings {
+		m.Bindings[b.ID] = domain.Binding{ID: b.ID, Audience: b.Audience, InvokeScopes: scopesOf(b.Operations["invoke"]),
+			HeadlessScopes: scopesOf(b.Operations["headless"]), LookupScopes: scopesOf(b.Operations["lookup"])}
+	}
+	return m
+}
+
+// scopesOf reads one operation's scopes, grouped by kind. An entry without a
+// colon names nothing and is skipped; the manifest's own validation refuses it.
+func scopesOf(entries []string) Scopes {
+	byKind := map[string][]string{}
+	var kinds []string
+	for _, entry := range entries {
+		kind, action, ok := strings.Cut(entry, ":")
+		if !ok || kind == "" || action == "" {
+			continue
+		}
+		if _, seen := byKind[kind]; !seen {
+			kinds = append(kinds, kind)
+		}
+		byKind[kind] = append(byKind[kind], action)
+	}
+	var out Scopes
+	for _, kind := range kinds {
+		out = append(out, &basev0.WorkScopeV1{ResourceKind: kind, Actions: byKind[kind]})
+	}
+	return scope.Normalize(out)
+}
diff --git a/libraries/authority-core/go/delivered/delivered_test.go b/libraries/authority-core/go/delivered/delivered_test.go
new file mode 100644
index 00000000..911d3e24
--- /dev/null
+++ b/libraries/authority-core/go/delivered/delivered_test.go
@@ -0,0 +1,171 @@
+package delivered_test
+
+import (
+	"crypto"
+	"crypto/ed25519"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/delivered"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/scope"
+	delivery "github.com/codefly-dev/authority/libraries/delivery/go"
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+	"github.com/codefly-dev/core/solutionhost"
+)
+
+func ws(kind string, actions ...string) *basev0.WorkScopeV1 {
+	return &basev0.WorkScopeV1{ResourceKind: kind, Actions: actions}
+}
+
+func code(t *testing.T, err error, want domain.Code) {
+	t.Helper()
+	if got, ok := domain.CodeOf(err); !ok || got != want {
+		t.Fatalf("want code %v, got %v (%v)", want, got, err)
+	}
+}
+
+// Core's manifest writes a binding's operations as operation → "<kind>:<action>"
+// entries; they are read as invoke, headless and lookup scopes.
+func TestCoreBindingOperationsAreReadAsScopesPerOperation(t *testing.T) {
+	m := delivered.FromCore(&solutionhost.ModuleManifest{Alias: "robin", Kind: solutionhost.KindModule, Generation: 3,
+		Authority: &solutionhost.Authority{Principal: "robin-principal", ResourceKinds: []string{"robin.chat"}, Bindings: []solutionhost.AuthorityBinding{{
+			ID: "model", Audience: "model",
+			Operations: map[string][]string{
+				"invoke":   {"modelservice.profiles:invoke", "modelservice.profiles:read", "malformed"},
+				"lookup":   {"modelservice.profiles:read"},
+				"headless": {"modelservice.profiles:read"},
+			},
+		}}}})
+	if m.Name != "robin" || m.Principal != "robin-principal" || m.Kind != domain.KindModule || m.Generation != 3 {
+		t.Fatalf("module %+v", m)
+	}
+	if !scope.Same(m.ResourceKinds, scope.Normalize([]*basev0.WorkScopeV1{ws("robin.chat", scope.AnyAction)})) {
+		t.Fatalf("a declared kind serves any action until ceiled: %v", m.ResourceKinds)
+	}
+	b := m.Bindings["model"]
+	if b.Audience != "model" || !scope.Same(b.InvokeScopes, scope.Normalize([]*basev0.WorkScopeV1{ws("modelservice.profiles", "invoke", "read")})) ||
+		!scope.Same(b.HeadlessScopes, scope.Normalize([]*basev0.WorkScopeV1{ws("modelservice.profiles", "read")})) || !scope.Same(b.LookupScopes, b.HeadlessScopes) {
+		t.Fatalf("binding %+v", b)
+	}
+	if bare := delivered.FromCore(&solutionhost.ModuleManifest{Alias: "bare", Generation: 1}); bare.Principal != "bare" || len(bare.Bindings) != 0 {
+		t.Fatalf("a manifest without authority composes its alias alone: %+v", bare)
+	}
+}
+
+func TestScopeCeilingsGiveTheModulesKindsTheirActions(t *testing.T) {
+	m := delivered.FromCore(&solutionhost.ModuleManifest{Alias: "runtime", Kind: solutionhost.KindModule, Generation: 1,
+		Authority: &solutionhost.Authority{Principal: "runtime", ResourceKinds: []string{"runtime.tasks", "runtime.queues"}}})
+	got, err := delivered.Ceiled(m, []*basev0.WorkScopeV1{ws("runtime.tasks", "start", "execute")})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !scope.Same(got.ResourceKinds, scope.Normalize([]*basev0.WorkScopeV1{ws("runtime.tasks", "execute", "start"), ws("runtime.queues", scope.AnyAction)})) {
+		t.Fatalf("served %v", got.ResourceKinds)
+	}
+	for name, ceilings := range map[string][]*basev0.WorkScopeV1{
+		"a kind core does not declare": {ws("records.records", "write")},
+		"a kind with no action":        {ws("runtime.tasks")},
+	} {
+		_, err := delivered.Ceiled(m, ceilings)
+		code(t, err, domain.Invalid)
+		if !strings.Contains(err.Error(), "ceils") {
+			t.Errorf("%s: %v", name, err)
+		}
+	}
+}
+
+func solutionManifest() *solutionhost.ModuleManifest {
+	return &solutionhost.ModuleManifest{Alias: "pages", Kind: solutionhost.KindSolution, Generation: 2,
+		Authority: &solutionhost.Authority{Principal: "pages", ResourceKinds: []string{"pages.page"}}}
+}
+
+func TestADocumentCompletesTheModule(t *testing.T) {
+	doc := &delivered.Document{Module: "pages", Generation: 2, OwnerAware: true,
+		ScopeCeilings: []*basev0.WorkScopeV1{ws("pages.page", "read", "write")},
+		Methods:       []delivered.Method{{Method: "GET /p/{id}", Requires: []*basev0.WorkScopeV1{ws("pages.page", "read")}}, {Method: "/x/Ping", AnyCheckedCaller: true}},
+		Roles: []delivered.Role{{Name: "installer", Scopes: []*basev0.WorkScopeV1{ws("pages.page", "write", "read")}},
+			{Name: "viewer", Scopes: []*basev0.WorkScopeV1{ws("pages.page", "read")}, InstallationOwned: []*basev0.WorkScopeV1{ws("store.item", "read")}}},
+	}
+	m, err := delivered.Module(solutionManifest(), doc)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !m.OwnerAware || len(m.Methods) != 2 || !m.Methods["/x/Ping"].AnyCheckedCaller || len(m.Roles) != 2 ||
+		!slices.Equal(m.Roles["installer"][0].GetActions(), []string{"read", "write"}) || len(m.OwnedRoles["viewer"]) != 1 || len(m.OwnedRoles["installer"]) != 0 {
+		t.Fatalf("module %+v", m)
+	}
+	if !scope.Same(m.ResourceKinds, scope.Normalize([]*basev0.WorkScopeV1{ws("pages.page", "read", "write")})) {
+		t.Fatalf("served %v", m.ResourceKinds)
+	}
+	plain, err := delivered.Module(solutionManifest(), nil)
+	if err != nil || plain.Roles != nil || plain.OwnerAware {
+		t.Fatalf("no document: %+v %v", plain, err)
+	}
+}
+
+func TestADocumentIsRefusedByName(t *testing.T) {
+	removed := solutionManifest()
+	removed.Removed = true
+	for _, tc := range []struct {
+		name     string
+		manifest *solutionhost.ModuleManifest
+		doc      delivered.Document
+		code     domain.Code
+		reason   string
+	}{
+		{"a method twice", solutionManifest(), delivered.Document{Methods: []delivered.Method{{Method: "/a"}, {Method: "/a"}}}, domain.Invalid, "twice or unnamed"},
+		{"an unnamed method", solutionManifest(), delivered.Document{Methods: []delivered.Method{{}}}, domain.Invalid, "twice or unnamed"},
+		{"a role twice", solutionManifest(), delivered.Document{Roles: []delivered.Role{{Name: "r"}, {Name: "r"}}}, domain.Invalid, "twice or unnamed"},
+		{"a ceiling naming an owner", solutionManifest(), delivered.Document{ScopeCeilings: []*basev0.WorkScopeV1{{ResourceKind: "pages.page", Actions: []string{"read"}, ResourceOwnerId: "u"}}}, domain.Denied, "never selects an owner"},
+		{"a withdrawal declaring roles", removed, delivered.Document{Roles: []delivered.Role{{Name: "installer"}}}, domain.Invalid, "withdrawal"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := delivered.Module(tc.manifest, &tc.doc)
+			code(t, err, tc.code)
+			if !strings.Contains(err.Error(), tc.reason) {
+				t.Fatal(err)
+			}
+		})
+	}
+}
+
+// A document is signed by the key that signed the carrier, and names the
+// carrier's module, generation and digest.
+func TestADocumentIsPairedWithItsCarrier(t *testing.T) {
+	public, private, err := ed25519.GenerateKey(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, otherPrivate, _ := ed25519.GenerateKey(nil)
+	sign := func(key ed25519.PrivateKey) func([]byte) ([]byte, error) {
+		return func(b []byte) ([]byte, error) { return ed25519.Sign(key, b), nil }
+	}
+	keys := map[string]crypto.PublicKey{"release": public}
+	document := []byte("the authority's document")
+	envelope, err := delivery.Sign(document, "release", sign(private))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := delivered.VerifyDocument(document, envelope, keys, "release"); err != nil {
+		t.Fatal(err)
+	}
+	code(t, delivered.VerifyDocument(document, envelope, keys, "another"), domain.Denied)
+	forged, _ := delivery.Sign(document, "release", sign(otherPrivate))
+	code(t, delivered.VerifyDocument(document, forged, keys, "release"), domain.Denied)
+
+	carrier := []byte("core's manifest")
+	m := solutionManifest()
+	good := delivered.Document{Module: "pages", Generation: 2, CoreManifestDigest: delivery.Digest(carrier)}
+	if err := delivered.Pair(good, carrier, m); err != nil {
+		t.Fatal(err)
+	}
+	for name, doc := range map[string]delivered.Document{
+		"another module":     {Module: "other", Generation: 2, CoreManifestDigest: good.CoreManifestDigest},
+		"another generation": {Module: "pages", Generation: 1, CoreManifestDigest: good.CoreManifestDigest},
+		"another manifest":   {Module: "pages", Generation: 2, CoreManifestDigest: delivery.Digest([]byte("other"))},
+	} {
+		t.Run(name, func(t *testing.T) { code(t, delivered.Pair(doc, carrier, m), domain.Denied) })
+	}
+}
diff --git a/libraries/authority-core/go/go.mod b/libraries/authority-core/go/go.mod
index 9ad50f8f..d9ae5158 100644
--- a/libraries/authority-core/go/go.mod
+++ b/libraries/authority-core/go/go.mod
@@ -4,6 +4,7 @@ go 1.27.3
 
 require (
 	github.com/codefly-dev/authority/libraries/delivery/go v0.0.0-20261026023425-000d44495d93
+	github.com/codefly-dev/authority/libraries/hop/go v0.0.0-20261026193714-49101ae11a7f
 	github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261026023425-000d44495d93
 	github.com/codefly-dev/core v0.19.7-0.20261026092055-b23dc13543b2
 	github.com/google/uuid v1.6.0
@@ -15,10 +16,43 @@ require (
 	buf.build/go/protovalidate v1.4.0 // indirect
 	cel.dev/cel-go v0.32.0 // indirect
 	cel.dev/expr v0.25.3 // indirect
+	github.com/Masterminds/semver v1.5.0 // indirect
+	github.com/Masterminds/semver/v3 v3.5.0 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
+	github.com/go-openapi/analysis v1.0.0 // indirect
+	github.com/go-openapi/errors v0.22.9 // indirect
+	github.com/go-openapi/jsonpointer v1.0.1 // indirect
+	github.com/go-openapi/jsonreference v1.0.2 // indirect
+	github.com/go-openapi/loads v0.25.3 // indirect
+	github.com/go-openapi/spec v1.0.1 // indirect
+	github.com/go-openapi/strfmt v0.27.2 // indirect
+	github.com/go-openapi/swag/conv v0.29.2 // indirect
+	github.com/go-openapi/swag/jsonutils v0.29.2 // indirect
+	github.com/go-openapi/swag/loading v0.29.2 // indirect
+	github.com/go-openapi/swag/mangling v0.29.2 // indirect
+	github.com/go-openapi/swag/pools v0.29.2 // indirect
+	github.com/go-openapi/swag/stringutils v0.29.2 // indirect
+	github.com/go-openapi/swag/typeutils v0.29.2 // indirect
+	github.com/go-openapi/swag/yamlutils v0.29.2 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
+	github.com/gofrs/flock v0.13.1 // indirect
+	github.com/google/go-github/v89 v89.0.0 // indirect
+	github.com/google/go-querystring v1.2.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/oklog/ulid/v2 v2.1.2 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 // indirect
+	github.com/yoheimuta/go-protoparser/v4 v4.14.2 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba // indirect
+	golang.org/x/net v0.60.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/term v0.46.0 // indirect
 	golang.org/x/text v0.42.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20261019180522-ce908d29299b // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20261012220534-4341edf3f941 // indirect
+	google.golang.org/grpc v1.84.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/libraries/authority-core/go/go.sum b/libraries/authority-core/go/go.sum
index dff267a3..f1dc59c3 100644
--- a/libraries/authority-core/go/go.sum
+++ b/libraries/authority-core/go/go.sum
@@ -6,33 +6,230 @@ cel.dev/cel-go v0.32.0 h1:irvpFKr5EuGPyxeME03ERh0rii1TX+BDAnB9eL3IvNk=
 cel.dev/cel-go v0.32.0/go.mod h1:DnVip7tpJSsgZymwfT+m1tnEVy3ivAjSMXPx12YrMkU=
 cel.dev/expr v0.25.3 h1:A2jO8jwOugrrovveCWfj0KEZOfqiLgAcwjpHPhzIGw0=
 cel.dev/expr v0.25.3/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
+github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
+github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
+github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
+github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
+github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/VividCortex/ewma v1.2.0 h1:f58SaIzcDXrSy3kWaHNvuJgJ3Nmz59Zji6XoJR/q1ow=
+github.com/VividCortex/ewma v1.2.0/go.mod h1:nz4BbCtbLyFDeC9SUHbtcT5644juEuWfUAUnGx7j5l4=
 github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
 github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw=
+github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
+github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
+github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
+github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
 github.com/brianvoe/gofakeit/v6 v6.28.0 h1:Xib46XXuQfmlLS2EXRuJpqcw8St6qSZz75OUo0tgAW4=
 github.com/brianvoe/gofakeit/v6 v6.28.0/go.mod h1:Xj58BMSnFqcn/fAQeSK+/PLtC5kSb7FJIq4JyGa8vEs=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cheggaaa/pb/v3 v3.2.1 h1:aprZbFRG+B7+ug76S8QZ6Y1PW168UHzOmbC3wa+aU6I=
+github.com/cheggaaa/pb/v3 v3.2.1/go.mod h1:U9hSVxoKqJrZIE3PkFG1xXXNaK/Ilzg+EF/scpXzEdw=
+github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
+github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/codefly-dev/authority/libraries/delivery/go v0.0.0-20261026023425-000d44495d93 h1:PnhgA9wkib67bJnc5hkhkc80J2ch5uYiq+9/NiD/XFU=
 github.com/codefly-dev/authority/libraries/delivery/go v0.0.0-20261026023425-000d44495d93/go.mod h1:XsOFnO2MQdr37vM3ULa0Uwi8ZWptyVx7hRSUyIdaZ1Q=
+github.com/codefly-dev/authority/libraries/hop/go v0.0.0-20261026193714-49101ae11a7f h1:oobjjGqbBaFjYLPYculFD74BOdN5+UZ6eyYl6mOsT7I=
+github.com/codefly-dev/authority/libraries/hop/go v0.0.0-20261026193714-49101ae11a7f/go.mod h1:NqCbvIWbkbCzSpUUYQjP8Jv+LpFnDRbVhPdAj67DHhE=
 github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261026023425-000d44495d93 h1:4EygH7/J0E6aM7hUPdbQGfit1rsLUNCtWJ8kMh2b9PE=
 github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261026023425-000d44495d93/go.mod h1:1rmjrVyr0h7zOuwOHS9i+BoeS9dr3XNvtupLZFwY6As=
 github.com/codefly-dev/core v0.19.7-0.20261026092055-b23dc13543b2 h1:I1wL0ANXhTdQuEAnxXF+s4+rKILlBu/QHILq4Skyi3I=
 github.com/codefly-dev/core v0.19.7-0.20261026092055-b23dc13543b2/go.mod h1:1ina3kP+YSAL4tlZvnEYd4P8bFGnJECfkP86ojeeF1A=
+github.com/codefly-dev/gortk v0.2.0 h1:7bOlS5valYz2zil+fZctQNcPCYBcPj86abcw9N8h1hQ=
+github.com/codefly-dev/gortk v0.2.0/go.mod h1:dDWUMFgAP063OCGhTEpV7FFUj9+zTcxxO/nV80VKEwg=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
+github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/docker/docker v28.5.2+incompatible h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM=
+github.com/docker/docker v28.5.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/go-connections v0.8.2 h1:9d9DEokx5W7qlr0shkFXIxEA7+TTD+llwzcykSlxMNc=
+github.com/docker/go-connections v0.8.2/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
+github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
+github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
+github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
+github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
+github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=
+github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
+github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
+github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
+github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
+github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
+github.com/go-openapi/analysis v1.0.0 h1:sNvbAGCJqUTqIAodr9IVqJMmuZas3YS9ms1dGK9yiJ4=
+github.com/go-openapi/analysis v1.0.0/go.mod h1:NhYjJ57fnE+bcE7UwrJyMkhWA3Dfz7TdiBfTVAnos4Y=
+github.com/go-openapi/errors v0.22.9 h1:HI9+SyVYiRzyeBQGv0CbWbQa+u2S0nny7G7AhY+UMiM=
+github.com/go-openapi/errors v0.22.9/go.mod h1:R73q66sXP2smzAGgFOI4nqtusRK2xN5pYCjsij+KX58=
+github.com/go-openapi/jsonpointer v1.0.1 h1:2KxywRmNwJkT/FMBa3iRNHEaAxSJvjqoufQZy3au1Mg=
+github.com/go-openapi/jsonpointer v1.0.1/go.mod h1:wI7ZYsFmbIi9nBXOZqgDaS/bqOchRGZjqxFli7FBYxY=
+github.com/go-openapi/jsonreference v1.0.2 h1:oS4et8FOf3p3UQxEo4Xt0esijmBUM+F259Xl72OSZsc=
+github.com/go-openapi/jsonreference v1.0.2/go.mod h1:TbUNSOo+fcorZjFaNoiSDSoaNnnZtqJtLGR1PuvE/Cs=
+github.com/go-openapi/loads v0.25.3 h1:V+jKy/thXWdLJUuYC8sZX2dICyAa8M3DokF70jj34P0=
+github.com/go-openapi/loads v0.25.3/go.mod h1:LgLyCSOLBL2Qnj0Ps1oo2YH8jZoEKsMeVZCc+ALIxFo=
+github.com/go-openapi/spec v1.0.1 h1:lj2vdGpNDcVgwRc6qXdw6qt/KQpCtSa9tnUH6vpDPDk=
+github.com/go-openapi/spec v1.0.1/go.mod h1:M//GWQGtDUAjnP37gE6fInLgaczB+FatoipV3H1fYw8=
+github.com/go-openapi/strfmt v0.27.2 h1:SG32SlbwNy92s0KJiVxt2joJeFdqIYHvwrA0OU6HqzQ=
+github.com/go-openapi/strfmt v0.27.2/go.mod h1:M4CKsMO0Fb8qR10+1Ra75wCKNNquy+Vj+4LWZrhTo2E=
+github.com/go-openapi/swag v0.29.2 h1:9n8frkcsuQRA0INU31VbxNxt1zBaHxrHYGEf5BUjFi4=
+github.com/go-openapi/swag v0.29.2/go.mod h1:RkCiX1gCVXWgLOavDXE3ALJrQ/VO2ziiIzOUs3z10xo=
+github.com/go-openapi/swag/cmdutils v0.29.2 h1:cXEzX/nWCODon251f+1HgL75/R4XXML5IZxgLCWMoro=
+github.com/go-openapi/swag/cmdutils v0.29.2/go.mod h1:XziaSVzYqkDvpWXzASfWajw2YvJrLscq610O2XiyqJw=
+github.com/go-openapi/swag/conv v0.29.2 h1:8c9shoB8l0QRSR6ymq1llHdBWDqpIgJfjTGHx3Vuhm0=
+github.com/go-openapi/swag/conv v0.29.2/go.mod h1:AZS0YigTNf8qNtD6WqJz/N4RUNmpr76SyjFGkq4+p6Q=
+github.com/go-openapi/swag/fileutils v0.29.2 h1:mdUL+Vw5ah1fO1AvFCoHeIyv7YZsCz2MN3KNqd/lLVI=
+github.com/go-openapi/swag/fileutils v0.29.2/go.mod h1:7QKmmodjAebaq61lGVJa8ldLdGeMF4DSgYv8tXOGGo0=
+github.com/go-openapi/swag/jsonutils v0.29.2 h1:uZNSD2/rJDYAfvsLYkykTzXuyxM3QpDKV9jhRHrMu6k=
+github.com/go-openapi/swag/jsonutils v0.29.2/go.mod h1:ONTdNvj3Y+IXRzfa17E+Rgt2ns/qiSOYjIo2K7v2yDs=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.29.2 h1:w+Fd6EBOMGlC74GYGHqCLGyb3Bpams8TtNrgM/SG4jo=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.29.2/go.mod h1:HC2egPORFzbj/gf05Zrfgz8Mgplx3oW7hgGi7pjZVhM=
+github.com/go-openapi/swag/loading v0.29.2 h1:QU1ry24e6r6Shoxe380Nx0X5iKkpRO+hJffsyJ2dVlY=
+github.com/go-openapi/swag/loading v0.29.2/go.mod h1:DqilDjuiJKETecsS4TRopWG1acUDsfqN39ZmQhPu6uI=
+github.com/go-openapi/swag/mangling v0.29.2 h1:ltdo3K0tTP4P6zWhVVWDU9D37/YYBuMJRdZxiS2Dtog=
+github.com/go-openapi/swag/mangling v0.29.2/go.mod h1:RjDi4TnItAenS3cgCXSpIl1kKbjG7il6pnmQVl/8bp8=
+github.com/go-openapi/swag/netutils v0.29.2 h1:dBli6jyUa93sDS/XYWShJzf4+nnVfFKfvY9SLUaUzB8=
+github.com/go-openapi/swag/netutils v0.29.2/go.mod h1:1pM6Xg/Um8E1eps3umWl8Hme3ByWXOtHsvFC0CULHUE=
+github.com/go-openapi/swag/pools v0.29.2 h1:PlGoDRF8WtSyXkedZZkpW3f9wDhFf3u8KtaBcmgmh8c=
+github.com/go-openapi/swag/pools v0.29.2/go.mod h1:V3lhxVT4qDYRqc2MRSSbLsTYIYV/2HlHafhyEkmzLIc=
+github.com/go-openapi/swag/stringutils v0.29.2 h1:lcnBxwAaysT3bMUVBfn9V/PkfVqkurpqufKU6rTUMGk=
+github.com/go-openapi/swag/stringutils v0.29.2/go.mod h1:i9cdh7sGaa0nm3CqIvH5IM5h2QClk1wns2ktKeILvRI=
+github.com/go-openapi/swag/typeutils v0.29.2 h1:O7aVvkTs3pXwikgtrPLenigEMdQFgONKRooQA9pgf2I=
+github.com/go-openapi/swag/typeutils v0.29.2/go.mod h1:7+GDG+uz9Ke+eVt4rClZg7wklSDp8hT/mKNh/pC26TE=
+github.com/go-openapi/swag/yamlutils v0.29.2 h1:IFKFFeDnuIwzfsuWRQU+rI8iL3g4XyAYjV/RlnlxPLM=
+github.com/go-openapi/swag/yamlutils v0.29.2/go.mod h1:7MGqtcrK73sxQ4ceiyIf8qiXS/s09JLMdR5esK5euYQ=
+github.com/go-openapi/testify/enable/yaml/v2 v2.7.0 h1:wPW6YRgx3+SID1yUy/Xwa17L8kFEaEKod2VRbJDZNUs=
+github.com/go-openapi/testify/enable/yaml/v2 v2.7.0/go.mod h1:mI1M88etYbc3PhgHsWQK2kwvNwW5aGFqMPbmib+SGIs=
+github.com/go-openapi/testify/v2 v2.8.0 h1:19QDx5b57p8KjO2E4sgs/woL4Akp+FGLRlVm2xn0Rho=
+github.com/go-openapi/testify/v2 v2.8.0/go.mod h1:4gUN8jC+RqOE2qjW/vDmfyTvl5BCht4qL7oca0odrak=
+github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
+github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/gofrs/flock v0.13.1 h1:jjREztyBeSKBZYAC+mgc1laB+xsgy4kYMf3FbKF2UBo=
+github.com/gofrs/flock v0.13.1/go.mod h1:sf4BFiHwnvgxa25DlQoDqXQnwRMEOwqxRq37P6MzzmE=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/gnostic-models v0.7.1 h1:SisTfuFKJSKM5CPZkffwi6coztzzeYUhc3v4yxLWH8c=
+github.com/google/gnostic-models v0.7.1/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/go-github/v89 v89.0.0 h1:35bEK5XoEcF3PZrlVbl9XN63f5BcJRA/UGkxeC9xPg0=
+github.com/google/go-github/v89 v89.0.0/go.mod h1:QLcbU0ipeAqQuR5KSg8c2lql4Qk1EwJ2dWz/0rP4Nho=
+github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
+github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/lufia/plan9stats v0.0.0-20260330125221-c963978e514e h1:Q6MvJtQK/iRcRtzAscm/zF23XxJlbECiGPyRicsX+Ak=
+github.com/lufia/plan9stats v0.0.0-20260330125221-c963978e514e/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
+github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
+github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
+github.com/mattn/go-runewidth v0.0.27 h1:Feg/Oou5zI/wnpgDF6omIU0OokC9GxLC/WRknhVlIR0=
+github.com/mattn/go-runewidth v0.0.27/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8=
+github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
+github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
+github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
+github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U=
+github.com/moby/patternmatcher v0.6.1/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
+github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
+github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
+github.com/oklog/ulid/v2 v2.1.2 h1:IEclFb9JNvzYA6MW2SCxbLzcHTVsfqm3PrqGQJH5zec=
+github.com/oklog/ulid/v2 v2.1.2/go.mod h1:rcEKHmBBKfef9DhnvX7y1HZBYxjXb0cP5ExxNsTT1QQ=
+github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
+github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
+github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/rodaine/protogofakeit v0.1.1 h1:ZKouljuRM3A+TArppfBqnH8tGZHOwM/pjvtXe9DaXH8=
 github.com/rodaine/protogofakeit v0.1.1/go.mod h1:pXn/AstBYMaSfc1/RqH3N82pBuxtWgejz1AlYpY1mI0=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/shirou/gopsutil/v3 v3.24.5 h1:i0t8kL+kQTvpAYToeuiVk3TgDeKOFioZO3Ztz/iZ9pI=
+github.com/shirou/gopsutil/v3 v3.24.5/go.mod h1:bsoOS1aStSs9ErQ1WWfxllSeS1K5D+U30r2NfcubMVk=
+github.com/shoenig/go-m1cpu v0.2.1 h1:yqRB4fvOge2+FyRXFkXqsyMoqPazv14Yyy+iyccT2E4=
+github.com/shoenig/go-m1cpu v0.2.1/go.mod h1:KkDOw6m3ZJQAPHbrzkZki4hnx+pDRR1Lo+ldA56wD5w=
 github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
 github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+github.com/tklauser/go-sysconf v0.4.0 h1:7H0uAN+7RkwWRaxhYXDLqa5V3LPrJeV8wmD9dRUgPQU=
+github.com/tklauser/go-sysconf v0.4.0/go.mod h1:8mTNWyog7H+MpKijp4VmKJAd2bbYQ2zuUwkYRbUArPI=
+github.com/tklauser/numcpus v0.12.0 h1:NR85qdvHA9pFse3x3weVZ0r0ST8R6l5RHbZrlRaqob4=
+github.com/tklauser/numcpus v0.12.0/go.mod h1:ABHeXzJnr/qqwguhClkZKT1/8VABcYrsyUiUGobwWJg=
+github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
+github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
+github.com/yoheimuta/go-protoparser/v4 v4.14.2 h1:/P/LlX1CF9NaTWEltGcIZVvNlPbhABuAnBtAWpb3+74=
+github.com/yoheimuta/go-protoparser/v4 v4.14.2/go.mod h1:AHNNnSWnb0UoL4QgHPiOAg2BniQceFscPI5X/BZNHl8=
+github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
+github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.72.0 h1:Tq+E65HaNbZTeqcLw6QUhsV+/EIWdkfUH2CQzcrlE5M=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.72.0/go.mod h1:A+EVhDakAj1waJBPhmTszZaSr08ww8MRRKy1nB1rqck=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 h1:3g7B90UzBltIDKq1/5mrTGxTnOFDV0ICOhLoxiZ8jlg=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0/go.mod h1:Ef8SuTh59BT7+ofpDxN9z+yOlc4t2GjLmKDgYNJL/NU=
+go.opentelemetry.io/otel v1.47.0 h1:j7ALJ/zgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM=
+go.opentelemetry.io/otel v1.47.0/go.mod h1:8wS9O2qfXrYrzp6hIF/HOYJJf/wIhFPhR2xLuP+iXQU=
+go.opentelemetry.io/otel/log v1.47.0 h1:cOTS1CcLbSQeZKanGJ+0JpF/+t4PELi3O3bbl2lqCcI=
+go.opentelemetry.io/otel/log v1.47.0/go.mod h1:9byitSQ5pLC6PpqwGXjqdMKya6ZTswHRZh2vvXT33nw=
+go.opentelemetry.io/otel/metric v1.47.0 h1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY=
+go.opentelemetry.io/otel/metric v1.47.0/go.mod h1:ADGSXxRrXM6bjbvLo535EstVFlPpPYZm4LBKixjDHwU=
+go.opentelemetry.io/otel/trace v1.47.0 h1:JOjX/Oci8K94QHddo+bbfya/Ai/nf6/dt9ZfrFNWSrM=
+go.opentelemetry.io/otel/trace v1.47.0/go.mod h1:jNaSLa2PZEYFG6fRjJABAu+bw4FS08uDmPg28lTghu0=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba h1:Ck8QetSgk912qxWLMCKxd0in+aiyBQyDSMae6e/xmpU=
 golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba/go.mod h1:50RgIsmK7OwqzTTeqcSXQW8SswW0o8fRcDxmqGluJ8E=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
+golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
 golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
 golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
-google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc h1:rZHRz0ogq4Pid1IKtA/ivHi8XONVF5tqUQXA2TtgpkE=
-google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:K/n0XLazCJHjD73YuMyNJsN38BPPy1kfFnKxUXaThFU=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc h1:4bNTbnb44EqGVy9HaQxSY2jnafSUdgV3qHtedvNpDKg=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
+google.golang.org/genproto/googleapis/api v0.0.0-20261019180522-ce908d29299b h1:nB3spRIaSPtxJpxb0k41yljROvm2Jrwfs2pSNdKS5y8=
+google.golang.org/genproto/googleapis/api v0.0.0-20261019180522-ce908d29299b/go.mod h1:9N4vtjEwvgQKEdlFVQO0M44ErhecQ9DCSQfGoZ51M6w=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20261012220534-4341edf3f941 h1:QG6hS4zFplRZvOQedzei4t2pT/zkQc3VR1u+S9/rcAw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20261012220534-4341edf3f941/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc=
+google.golang.org/grpc v1.84.0 h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=
+google.golang.org/grpc v1.84.0/go.mod h1:ljCht0DrxQrXBDRTZp52Qxh3Ffk8CdYm2sj4O2QN2C0=
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
 google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
+gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I=
+sigs.k8s.io/kustomize/api v0.21.1 h1:lzqbzvz2CSvsjIUZUBNFKtIMsEw7hVLJp0JeSIVmuJs=
+sigs.k8s.io/kustomize/api v0.21.1/go.mod h1:f3wkKByTrgpgltLgySCntrYoq5d3q7aaxveSagwTlwI=
+sigs.k8s.io/kustomize/kyaml v0.21.1 h1:IVlbmhC076nf6foyL6Taw4BkrLuEsXUXNpsE+ScX7fI=
+sigs.k8s.io/kustomize/kyaml v0.21.1/go.mod h1:hmxADesM3yUN2vbA5z1/YTBnzLJ1dajdqpQonwBL1FQ=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/libraries/authority-core/go/memstore/memstore.go b/libraries/authority-core/go/memstore/memstore.go
index f6fb428b..d732f547 100644
--- a/libraries/authority-core/go/memstore/memstore.go
+++ b/libraries/authority-core/go/memstore/memstore.go
@@ -21,7 +21,7 @@ import (
 type Store struct {
 	mu            sync.RWMutex
 	orgs          map[string]domain.Organization
-	people        map[string]domain.Person
+	people        map[string]map[string]domain.Person // id → organization → membership
 	roles         map[string]domain.OrgRole // organization/name
 	modules       map[string]domain.Module  // name
 	installations map[string]domain.Installation
@@ -37,7 +37,7 @@ type Store struct {
 // New is an empty store.
 func New() *Store {
 	return &Store{
-		orgs: map[string]domain.Organization{}, people: map[string]domain.Person{}, roles: map[string]domain.OrgRole{},
+		orgs: map[string]domain.Organization{}, people: map[string]map[string]domain.Person{}, roles: map[string]domain.OrgRole{},
 		modules: map[string]domain.Module{}, installations: map[string]domain.Installation{}, grants: map[string][]domain.RoleGrant{},
 		revisions: map[string]uint64{}, personEpochs: map[string]uint64{}, grantEpochs: map[string]uint64{},
 		ownerAware: map[string]uint64{}, delegations: map[string]domain.Delegation{}, tombstones: map[string]domain.Tombstone{},
@@ -109,20 +109,34 @@ func (s *Store) PutOrganization(o domain.Organization) {
 	s.orgs[o.ID] = o
 }
 
-// PutPerson records a person.
+// PutPerson records a person's membership of p.Organization; a person may
+// be a member of several organizations, each recorded by its own call.
 func (s *Store) PutPerson(p domain.Person) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	s.people[p.ID] = clonePerson(p)
+	if s.people[p.ID] == nil {
+		s.people[p.ID] = map[string]domain.Person{}
+	}
+	s.people[p.ID][p.Organization] = clonePerson(p)
 }
 
-// DeletePerson removes a person.
+// DeletePerson removes a person from every organization.
 func (s *Store) DeletePerson(id string) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	delete(s.people, id)
 }
 
+// DeleteMember removes a person from one organization.
+func (s *Store) DeleteMember(organization, id string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	delete(s.people[id], organization)
+	if len(s.people[id]) == 0 {
+		delete(s.people, id)
+	}
+}
+
 // PutOrgRole records an organization role.
 func (s *Store) PutOrgRole(r domain.OrgRole) {
 	s.mu.Lock()
@@ -160,18 +174,29 @@ func (t tx) Organization(id string) (domain.Organization, error) {
 	return o, nil
 }
 
+// Person answers a person by id: their membership of the first of their
+// organizations, by id. The authority reads only that the person exists.
 func (t tx) Person(id string) (domain.Person, error) {
-	p, ok := t.s.people[id]
+	memberships := t.s.people[id]
+	if len(memberships) == 0 {
+		return domain.Person{}, missing("person", id)
+	}
+	orgs := slices.Sorted(maps.Keys(memberships))
+	return clonePerson(memberships[orgs[0]]), nil
+}
+
+func (t tx) Member(org, id string) (domain.Person, error) {
+	p, ok := t.s.people[id][org]
 	if !ok {
-		return p, missing("person", id)
+		return p, missing("member of "+org, id)
 	}
 	return clonePerson(p), nil
 }
 
 func (t tx) People(org string) ([]domain.Person, error) {
 	var out []domain.Person
-	for _, p := range t.s.people {
-		if p.Organization == org {
+	for _, memberships := range t.s.people {
+		if p, ok := memberships[org]; ok {
 			out = append(out, clonePerson(p))
 		}
 	}
diff --git a/libraries/authority-core/go/storetest/memstore_test.go b/libraries/authority-core/go/storetest/memstore_test.go
new file mode 100644
index 00000000..995bb54a
--- /dev/null
+++ b/libraries/authority-core/go/storetest/memstore_test.go
@@ -0,0 +1,33 @@
+package storetest_test
+
+import (
+	"testing"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/authority"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/memstore"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/storetest"
+)
+
+// The in-memory store meets the contract every host's store meets.
+func TestTheMemoryStoreMeetsTheStoreContract(t *testing.T) {
+	storetest.Run(t, func(t *testing.T, id storetest.Identity) authority.Store {
+		s := memstore.New()
+		for _, o := range id.Organizations {
+			s.PutOrganization(o)
+		}
+		for _, m := range id.Members {
+			p := domain.Person{ID: m.Person, Organization: m.Organization, Teams: m.Teams}
+			if m.Administrator {
+				p.Roles = append(p.Roles, "admin")
+			}
+			if len(m.Scopes) > 0 {
+				role := "storetest-" + m.Person
+				s.PutOrgRole(domain.OrgRole{Organization: m.Organization, Name: role, Scopes: m.Scopes})
+				p.Roles = append(p.Roles, role)
+			}
+			s.PutPerson(p)
+		}
+		return s
+	})
+}
diff --git a/libraries/authority-core/go/storetest/storetest.go b/libraries/authority-core/go/storetest/storetest.go
new file mode 100644
index 00000000..d0ed0557
--- /dev/null
+++ b/libraries/authority-core/go/storetest/storetest.go
@@ -0,0 +1,577 @@
+// Package storetest is the contract every authority.Store must meet, run
+// against the in-memory store here and against each host's own store there
+// (the accounts Postgres store, the local authority's): one transaction is all
+// or nothing, a missing record wraps domain.ErrNotFound, every record reads
+// back as written, grants are idempotent, every revision and epoch only grows,
+// and identity reads answer what the host seeded.
+//
+// Every id a run uses is fresh, so a host may run it against a store other
+// tests share.
+package storetest
+
+import (
+	"context"
+	"errors"
+	"slices"
+	"sort"
+	"testing"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/authority"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/decide"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/scope"
+	resources "github.com/codefly-dev/authority/libraries/resources/go"
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+	"github.com/google/uuid"
+)
+
+// Identity is what a host seeds before its store is opened: organizations and
+// their members. Identity is the host's own data; the store only reads it.
+type Identity struct {
+	Organizations []domain.Organization
+	Members       []Member
+}
+
+// Member is one person's membership of one organization: an administrator
+// or not, their teams there, and the organization-role scopes they hold
+// there. A person may be a member of several organizations.
+type Member struct {
+	Organization, Person string
+	Administrator        bool
+	Teams                []string
+	Scopes               []domain.RoleScope
+}
+
+// Open seeds id into a store and opens it.
+type Open func(t *testing.T, id Identity) authority.Store
+
+// Run proves the contract against the stores open opens.
+func Run(t *testing.T, open Open) {
+	t.Helper()
+	ctx := context.Background()
+	f := newFixture()
+	store := open(t, f.identity)
+	read := func(t *testing.T, fn func(authority.Tx) error) {
+		t.Helper()
+		if err := store.Read(ctx, fn); err != nil {
+			t.Fatal(err)
+		}
+	}
+	write := func(t *testing.T, fn func(authority.Tx) error) {
+		t.Helper()
+		if err := store.Write(ctx, fn); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	t.Run("identity reads answer what the host seeded", func(t *testing.T) {
+		read(t, func(tx authority.Tx) error {
+			all, err := tx.Organizations()
+			if err != nil {
+				return err
+			}
+			for _, want := range f.identity.Organizations {
+				got, err := tx.Organization(want.ID)
+				if err != nil || got.ID != want.ID || got.Name != want.Name {
+					t.Errorf("organization %s: %+v %v", want.ID, got, err)
+				}
+				if !slices.ContainsFunc(all, func(o domain.Organization) bool { return o.ID == want.ID }) {
+					t.Errorf("Organizations omits %s", want.ID)
+				}
+			}
+			for _, m := range f.identity.Members {
+				p, err := tx.Member(m.Organization, m.Person)
+				if err != nil {
+					t.Errorf("member %s of %s: %v", m.Person, m.Organization, err)
+					continue
+				}
+				if p.ID != m.Person || p.Organization != m.Organization || decide.IsAdministrator(p) != m.Administrator || !sameSet(p.Teams, m.Teams) {
+					t.Errorf("member %s of %s reads %+v, want %+v", m.Person, m.Organization, p, m)
+				}
+				if !m.Administrator {
+					held, err := heldScopes(tx, p)
+					if err != nil {
+						return err
+					}
+					if want := points(m.Scopes); !samePoints(held, want) {
+						t.Errorf("member %s of %s holds %v, want %v", m.Person, m.Organization, held, want)
+					}
+				}
+				if _, err := tx.Person(m.Person); err != nil {
+					t.Errorf("person %s: %v", m.Person, err)
+				}
+			}
+			for _, org := range f.identity.Organizations {
+				people, err := tx.People(org.ID)
+				if err != nil {
+					return err
+				}
+				var got, want []string
+				for _, p := range people {
+					got = append(got, p.ID)
+					if p.Organization != org.ID {
+						t.Errorf("People(%s) answered %s as a member of %s", org.ID, p.ID, p.Organization)
+					}
+				}
+				for _, m := range f.identity.Members {
+					if m.Organization == org.ID {
+						want = append(want, m.Person)
+					}
+				}
+				if !sameSet(got, want) {
+					t.Errorf("People(%s) = %v, want %v", org.ID, got, want)
+				}
+			}
+			if _, err := tx.Member(f.orgB, f.onlyA); !errors.Is(err, domain.ErrNotFound) {
+				t.Errorf("a person is no member of an organization they do not belong to: %v", err)
+			}
+			return nil
+		})
+	})
+
+	t.Run("a missing record wraps ErrNotFound", func(t *testing.T) {
+		absent := "storetest-absent-" + uuid.NewString()
+		read(t, func(tx authority.Tx) error {
+			for name, err := range map[string]error{
+				"organization":    second(tx.Organization(uuid.NewString())),
+				"person":          second(tx.Person(uuid.NewString())),
+				"member":          second(tx.Member(f.orgA, uuid.NewString())),
+				"module":          second(tx.Module(absent)),
+				"module by name":  second(tx.ModuleNamed(absent)),
+				"tombstone":       second(tx.Tombstone(absent)),
+				"tomb principal":  second(tx.TombstoneByPrincipal(absent)),
+				"installation":    second(tx.Installation(uuid.NewString())),
+				"by principal":    second(tx.InstallationByPrincipal(uuid.NewString())),
+				"empty principal": second(tx.InstallationByPrincipal("")),
+				"delegation":      second(tx.Delegation(uuid.NewString())),
+			} {
+				if !errors.Is(err, domain.ErrNotFound) {
+					t.Errorf("%s: %v", name, err)
+				}
+			}
+			return nil
+		})
+	})
+
+	t.Run("a module reads back as written, by name and by principal", func(t *testing.T) {
+		m := f.module("solution")
+		write(t, func(tx authority.Tx) error { return tx.PutModule(m) })
+		read(t, func(tx authority.Tx) error {
+			byName, err := tx.ModuleNamed(m.Name)
+			if err != nil {
+				return err
+			}
+			byPrincipal, err := tx.Module(m.Principal)
+			if err != nil {
+				return err
+			}
+			sameModule(t, byName, m)
+			sameModule(t, byPrincipal, m)
+			all, err := tx.Modules()
+			if err != nil {
+				return err
+			}
+			if !slices.ContainsFunc(all, func(x domain.Module) bool { return x.Name == m.Name }) ||
+				!sort.SliceIsSorted(all, func(a, b int) bool { return all[a].Name < all[b].Name }) {
+				t.Errorf("Modules omits %s or is not sorted by name", m.Name)
+			}
+			return nil
+		})
+		m.Generation = 2
+		m.OwnerAware = false
+		write(t, func(tx authority.Tx) error { return tx.PutModule(m) })
+		read(t, func(tx authority.Tx) error {
+			got, err := tx.ModuleNamed(m.Name)
+			sameModule(t, got, m)
+			return err
+		})
+		write(t, func(tx authority.Tx) error { return tx.DeleteModule(m.Name) })
+		read(t, func(tx authority.Tx) error {
+			if _, err := tx.ModuleNamed(m.Name); !errors.Is(err, domain.ErrNotFound) {
+				t.Errorf("a deleted module still reads: %v", err)
+			}
+			return nil
+		})
+	})
+
+	t.Run("a tombstone reads back by name and by principal", func(t *testing.T) {
+		tomb := domain.Tombstone{Name: f.name("withdrawn"), Principal: f.name("withdrawn-principal"), Generation: 7}
+		write(t, func(tx authority.Tx) error { return tx.PutTombstone(tomb) })
+		read(t, func(tx authority.Tx) error {
+			a, err := tx.Tombstone(tomb.Name)
+			if err != nil {
+				return err
+			}
+			b, err := tx.TombstoneByPrincipal(tomb.Principal)
+			if err != nil {
+				return err
+			}
+			if a != tomb || b != tomb {
+				t.Errorf("tombstone %+v %+v, want %+v", a, b, tomb)
+			}
+			return nil
+		})
+	})
+
+	t.Run("an installation reads back as written", func(t *testing.T) {
+		inst := domain.Installation{ID: uuid.NewString(), Organization: f.orgA, Target: f.name("target"), Status: domain.Pending, Revision: 3,
+			AgentRole: "viewer", PrincipalID: uuid.NewString(), InstalledBy: f.onlyA,
+			Consent: domain.ConsentReceipt{OperationID: uuid.NewString(), Intent: "intent", Revision: 3},
+			Owned:   map[string][]string{"store.item": {"a", "b"}}}
+		module := domain.Installation{ID: uuid.NewString(), Organization: f.orgB, Target: f.name("module"), Status: domain.Active, Revision: 1}
+		write(t, func(tx authority.Tx) error {
+			if err := tx.PutInstallation(inst); err != nil {
+				return err
+			}
+			return tx.PutInstallation(module)
+		})
+		read(t, func(tx authority.Tx) error {
+			got, err := tx.Installation(inst.ID)
+			if err != nil {
+				return err
+			}
+			sameInstallation(t, got, inst)
+			byPrincipal, err := tx.InstallationByPrincipal(inst.PrincipalID)
+			if err != nil {
+				return err
+			}
+			sameInstallation(t, byPrincipal, inst)
+			got, err = tx.Installation(module.ID)
+			if err != nil {
+				return err
+			}
+			sameInstallation(t, got, module)
+			ofA, err := tx.Installations(f.orgA)
+			if err != nil {
+				return err
+			}
+			if !slices.ContainsFunc(ofA, func(i domain.Installation) bool { return i.ID == inst.ID }) || slices.ContainsFunc(ofA, func(i domain.Installation) bool { return i.ID == module.ID }) {
+				t.Errorf("Installations(%s) answers another organization's or omits its own: %v", f.orgA, ofA)
+			}
+			every, err := tx.Installations("")
+			if err != nil {
+				return err
+			}
+			if !slices.ContainsFunc(every, func(i domain.Installation) bool { return i.ID == inst.ID }) || !slices.ContainsFunc(every, func(i domain.Installation) bool { return i.ID == module.ID }) ||
+				!sort.SliceIsSorted(every, func(a, b int) bool { return every[a].ID < every[b].ID }) {
+				t.Error("Installations(\"\") omits one or is not sorted by id")
+			}
+			return nil
+		})
+		inst.Status, inst.Revision, inst.Owned = domain.Revoked, 4, nil
+		write(t, func(tx authority.Tx) error { return tx.PutInstallation(inst) })
+		read(t, func(tx authority.Tx) error {
+			got, err := tx.Installation(inst.ID)
+			sameInstallation(t, got, inst)
+			return err
+		})
+	})
+
+	t.Run("role grants are idempotent and kept per installation", func(t *testing.T) {
+		a, b := uuid.NewString(), uuid.NewString()
+		person := domain.RoleGrant{InstallationID: a, Role: "viewer", PersonID: f.onlyA}
+		team := domain.RoleGrant{InstallationID: a, Role: "viewer", TeamID: f.team}
+		other := domain.RoleGrant{InstallationID: b, Role: "editor", PersonID: f.onlyA}
+		write(t, func(tx authority.Tx) error {
+			for _, g := range []domain.RoleGrant{person, person, team, other} {
+				if err := tx.PutRoleGrant(g); err != nil {
+					return err
+				}
+			}
+			return nil
+		})
+		grants := func(id string) []domain.RoleGrant {
+			var out []domain.RoleGrant
+			read(t, func(tx authority.Tx) (err error) { out, err = tx.RoleGrants(id); return err })
+			return out
+		}
+		if got := grants(a); len(got) != 2 || !slices.Contains(got, person) || !slices.Contains(got, team) {
+			t.Fatalf("grants of a: %v", got)
+		}
+		write(t, func(tx authority.Tx) error {
+			if err := tx.DeleteRoleGrant(person); err != nil {
+				return err
+			}
+			return tx.DeleteRoleGrant(person)
+		})
+		if got := grants(a); len(got) != 1 || got[0] != team {
+			t.Fatalf("after revoking the person: %v", got)
+		}
+		write(t, func(tx authority.Tx) error { return tx.DeleteRoleGrants(a) })
+		if got := grants(a); len(got) != 0 {
+			t.Fatalf("after clearing a: %v", got)
+		}
+		if got := grants(b); len(got) != 1 || got[0] != other {
+			t.Fatalf("clearing a touched b: %v", got)
+		}
+	})
+
+	t.Run("every revision and epoch only grows, each keyed as it is named", func(t *testing.T) {
+		inst := uuid.NewString()
+		audience := f.name("audience")
+		type counters struct{ org, otherOrg, person, otherPerson, grant, otherGrant, aware uint64 }
+		now := func() (c counters) {
+			read(t, func(tx authority.Tx) error {
+				var err error
+				for _, v := range []struct {
+					dst *uint64
+					get func() (uint64, error)
+				}{
+					{&c.org, func() (uint64, error) { return tx.AuthorizationRevision(f.orgA) }},
+					{&c.otherOrg, func() (uint64, error) { return tx.AuthorizationRevision(f.orgB) }},
+					{&c.person, func() (uint64, error) { return tx.PersonEpoch(f.onlyA) }},
+					{&c.otherPerson, func() (uint64, error) { return tx.PersonEpoch(f.both) }},
+					{&c.grant, func() (uint64, error) { return tx.GrantEpoch(f.onlyA, inst) }},
+					{&c.otherGrant, func() (uint64, error) { return tx.GrantEpoch(f.both, inst) }},
+					{&c.aware, func() (uint64, error) { return tx.OwnerAwareRevision(audience) }},
+				} {
+					if *v.dst, err = v.get(); err != nil {
+						return err
+					}
+				}
+				return nil
+			})
+			return c
+		}
+		before := now()
+		if before.org == 0 {
+			t.Error("an organization's authorization revision starts above zero")
+		}
+		write(t, func(tx authority.Tx) error {
+			for _, bump := range []func() error{
+				func() error { return tx.BumpAuthorizationRevision(f.orgA) },
+				func() error { return tx.BumpPersonEpoch(f.onlyA) },
+				func() error { return tx.BumpGrantEpoch(f.onlyA, inst) },
+				func() error { return tx.BumpOwnerAwareRevision(audience) },
+			} {
+				if err := bump(); err != nil {
+					return err
+				}
+			}
+			return nil
+		})
+		after := now()
+		if after.org <= before.org || after.person <= before.person || after.grant <= before.grant || after.aware <= before.aware {
+			t.Errorf("a bump did not grow its counter: before %+v after %+v", before, after)
+		}
+		if after.otherOrg != before.otherOrg || after.otherPerson != before.otherPerson || after.otherGrant != before.otherGrant {
+			t.Errorf("a bump moved another key's counter: before %+v after %+v", before, after)
+		}
+		read(t, func(tx authority.Tx) error {
+			if _, err := tx.AuthorizationRevision(uuid.NewString()); !errors.Is(err, domain.ErrNotFound) {
+				t.Errorf("an absent organization has no revision: %v", err)
+			}
+			return nil
+		})
+	})
+
+	t.Run("a delegation reads back as written", func(t *testing.T) {
+		d := domain.Delegation{ID: uuid.NewString(), Organization: f.orgA, Grantor: f.onlyA, Module: f.name("module"), Purpose: "a purpose",
+			Scopes: []*basev0.WorkScopeV1{{ResourceKind: "k", Actions: []string{"read"}, ResourceIds: []string{"a"}}}}
+		write(t, func(tx authority.Tx) error { return tx.PutDelegation(d) })
+		d.Revoked = true
+		write(t, func(tx authority.Tx) error { return tx.PutDelegation(d) })
+		read(t, func(tx authority.Tx) error {
+			got, err := tx.Delegation(d.ID)
+			if err != nil {
+				return err
+			}
+			if got.ID != d.ID || got.Organization != d.Organization || got.Grantor != d.Grantor || got.Module != d.Module || got.Purpose != d.Purpose ||
+				!got.Revoked || !scope.Same(got.Scopes, d.Scopes) {
+				t.Errorf("delegation %+v, want %+v", got, d)
+			}
+			all, err := tx.Delegations()
+			if err != nil {
+				return err
+			}
+			if !slices.ContainsFunc(all, func(x domain.Delegation) bool { return x.ID == d.ID }) ||
+				!sort.SliceIsSorted(all, func(a, b int) bool { return all[a].ID < all[b].ID }) {
+				t.Error("Delegations omits it or is not sorted by id")
+			}
+			return nil
+		})
+	})
+
+	t.Run("a failed transaction leaves nothing behind", func(t *testing.T) {
+		m := f.module("module")
+		inst := domain.Installation{ID: uuid.NewString(), Organization: f.orgA, Target: m.Name, Status: domain.Active, Revision: 1}
+		var before uint64
+		read(t, func(tx authority.Tx) (err error) { before, err = tx.AuthorizationRevision(f.orgA); return err })
+		failure := errors.New("the decision refused")
+		err := store.Write(ctx, func(tx authority.Tx) error {
+			if err := tx.PutModule(m); err != nil {
+				return err
+			}
+			if err := tx.PutInstallation(inst); err != nil {
+				return err
+			}
+			if err := tx.PutRoleGrant(domain.RoleGrant{InstallationID: inst.ID, Role: "viewer", PersonID: f.onlyA}); err != nil {
+				return err
+			}
+			if err := tx.BumpAuthorizationRevision(f.orgA); err != nil {
+				return err
+			}
+			// What a transaction wrote, it reads.
+			if _, err := tx.ModuleNamed(m.Name); err != nil {
+				return err
+			}
+			return failure
+		})
+		if !errors.Is(err, failure) {
+			t.Fatalf("the transaction's own error is returned: %v", err)
+		}
+		read(t, func(tx authority.Tx) error {
+			if _, err := tx.ModuleNamed(m.Name); !errors.Is(err, domain.ErrNotFound) {
+				t.Errorf("the module survived: %v", err)
+			}
+			if _, err := tx.Installation(inst.ID); !errors.Is(err, domain.ErrNotFound) {
+				t.Errorf("the installation survived: %v", err)
+			}
+			if grants, err := tx.RoleGrants(inst.ID); err != nil || len(grants) != 0 {
+				t.Errorf("the grant survived: %v %v", grants, err)
+			}
+			if after, err := tx.AuthorizationRevision(f.orgA); err != nil || after != before {
+				t.Errorf("the revision moved: %d → %d %v", before, after, err)
+			}
+			return nil
+		})
+	})
+}
+
+type fixture struct {
+	identity                Identity
+	run                     string
+	orgA, orgB, onlyA, both string
+	team                    string
+}
+
+func newFixture() *fixture {
+	f := &fixture{run: uuid.NewString()[:8], orgA: uuid.NewString(), orgB: uuid.NewString(), onlyA: uuid.NewString(), both: uuid.NewString(), team: uuid.NewString()}
+	reader := []domain.RoleScope{{Kind: "storetest.item", Actions: []string{"read"}}, {Kind: "storetest.note", Actions: []string{"write"}, Resources: []resources.Grant{{ID: "note-1"}}}}
+	f.identity = Identity{
+		Organizations: []domain.Organization{{ID: f.orgA, Name: "Storetest A " + f.run}, {ID: f.orgB, Name: "Storetest B " + f.run}},
+		Members: []Member{
+			{Organization: f.orgA, Person: f.onlyA, Teams: []string{f.team}, Scopes: reader},
+			{Organization: f.orgA, Person: f.both, Administrator: true},
+			{Organization: f.orgB, Person: f.both, Scopes: []domain.RoleScope{{Kind: "storetest.item", Actions: []string{"write"}}}},
+		},
+	}
+	return f
+}
+
+func (f *fixture) name(what string) string { return "storetest-" + what + "-" + f.run }
+
+func (f *fixture) module(kind string) domain.Module {
+	read := []*basev0.WorkScopeV1{{ResourceKind: "storetest.item", Actions: []string{"read"}}}
+	m := domain.Module{Name: f.name(kind), Principal: f.name(kind + "-principal"), Kind: kind, Generation: 1, OwnerAware: true,
+		ResourceKinds: []*basev0.WorkScopeV1{{ResourceKind: "storetest.item", Actions: []string{"read", "write"}}},
+		Bindings:      map[string]domain.Binding{"store": {ID: "store", Audience: "store", InvokeScopes: read, HeadlessScopes: read, LookupScopes: read}},
+		Methods:       map[string]domain.MethodPolicy{"/s.S/Read": {Requires: read}, "GET /open": {AnyCheckedCaller: true}}}
+	if kind == domain.KindSolution {
+		m.Roles = map[string][]*basev0.WorkScopeV1{domain.InstallerRole: read, "viewer": read}
+		m.OwnedRoles = map[string][]*basev0.WorkScopeV1{"viewer": {{ResourceKind: "store.item", Actions: []string{"read"}}}}
+	}
+	return m
+}
+
+func second[T any](_ T, err error) error { return err }
+
+func sameSet(a, b []string) bool {
+	return slices.Equal(slices.Sorted(slices.Values(slices.Clone(a))), slices.Sorted(slices.Values(slices.Clone(b))))
+}
+
+func sameScopes(a, b []*basev0.WorkScopeV1) bool {
+	return scope.Same(scope.Normalize(a), scope.Normalize(b))
+}
+
+func sameModule(t *testing.T, got, want domain.Module) {
+	t.Helper()
+	ok := got.Name == want.Name && got.Principal == want.Principal && got.Kind == want.Kind && got.Generation == want.Generation &&
+		got.StandIn == want.StandIn && got.OwnerAware == want.OwnerAware && sameScopes(got.ResourceKinds, want.ResourceKinds) &&
+		len(got.Bindings) == len(want.Bindings) && len(got.Roles) == len(want.Roles) && len(got.OwnedRoles) == len(want.OwnedRoles) && len(got.Methods) == len(want.Methods)
+	for id, b := range want.Bindings {
+		g := got.Bindings[id]
+		ok = ok && g.ID == b.ID && g.Audience == b.Audience && sameScopes(g.InvokeScopes, b.InvokeScopes) && sameScopes(g.HeadlessScopes, b.HeadlessScopes) && sameScopes(g.LookupScopes, b.LookupScopes)
+	}
+	for name, scopes := range want.Roles {
+		ok = ok && sameScopes(got.Roles[name], scopes)
+	}
+	for name, scopes := range want.OwnedRoles {
+		ok = ok && sameScopes(got.OwnedRoles[name], scopes)
+	}
+	for method, p := range want.Methods {
+		g := got.Methods[method]
+		ok = ok && g.AnyCheckedCaller == p.AnyCheckedCaller && sameScopes(g.Requires, p.Requires)
+	}
+	if !ok {
+		t.Errorf("module reads %+v, want %+v", got, want)
+	}
+}
+
+func sameInstallation(t *testing.T, got, want domain.Installation) {
+	t.Helper()
+	ok := got.ID == want.ID && got.Organization == want.Organization && got.Target == want.Target && got.Status == want.Status &&
+		got.Revision == want.Revision && got.AgentRole == want.AgentRole && got.PrincipalID == want.PrincipalID &&
+		got.InstalledBy == want.InstalledBy && got.Consent == want.Consent && len(got.Owned) == len(nonEmpty(want.Owned))
+	for k, ids := range nonEmpty(want.Owned) {
+		ok = ok && slices.Equal(got.Owned[k], ids)
+	}
+	if !ok {
+		t.Errorf("installation reads %+v, want %+v", got, want)
+	}
+}
+
+func nonEmpty(m map[string][]string) map[string][]string {
+	out := map[string][]string{}
+	for k, v := range m {
+		if len(v) > 0 {
+			out[k] = v
+		}
+	}
+	return out
+}
+
+// point is one (kind, action, resource matcher) an organization role grants.
+type point struct{ kind, action, resource string }
+
+func points(scopes []domain.RoleScope) map[point]bool {
+	out := map[point]bool{}
+	for _, sc := range scopes {
+		for _, a := range sc.Actions {
+			if len(sc.Resources) == 0 {
+				out[point{sc.Kind, a, ""}] = true
+			}
+			for _, r := range sc.Resources {
+				out[point{sc.Kind, a, r.ID + "|" + r.Prefix + "|" + r.Pattern}] = true
+			}
+		}
+	}
+	return out
+}
+
+func heldScopes(tx authority.Tx, p domain.Person) (map[point]bool, error) {
+	var all []domain.RoleScope
+	for _, name := range p.Roles {
+		r, err := tx.OrgRole(p.Organization, name)
+		if errors.Is(err, domain.ErrNotFound) {
+			continue
+		}
+		if err != nil {
+			return nil, err
+		}
+		all = append(all, r.Scopes...)
+	}
+	return points(all), nil
+}
+
+func samePoints(a, b map[point]bool) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for k := range a {
+		if !b[k] {
+			return false
+		}
+	}
+	return true
+}
diff --git a/modules/authority/services/local/code/pkg/business/issuer/issuer.go b/modules/authority/services/local/code/pkg/business/issuer/issuer.go
index 3b9f5a0b..fc131212 100644
--- a/modules/authority/services/local/code/pkg/business/issuer/issuer.go
+++ b/modules/authority/services/local/code/pkg/business/issuer/issuer.go
@@ -135,18 +135,15 @@ func (i *Issuer) checked(ctx context.Context, token, audience, method string, ad
 	if audience == "" {
 		return nil, fmt.Errorf("%w: a check names the audience the caller is", ErrRefused)
 	}
-	verified, revision, err := i.svc.Check(ctx, token, audience)
+	verified, revision, denied, err := i.svc.CheckMethod(ctx, token, audience, method, advisory)
 	if err != nil {
 		return nil, err
 	}
 	refusal := ""
-	if method != "" {
-		if err := i.state.AdmitMethod(audience, method, verified.EffectiveScopes()); err != nil {
-			if !advisory {
-				return nil, err
-			}
-			refusal = err.Error()
-		}
+	if denied != nil {
+		// The advisory answer names the refusal exactly as an enforced check
+		// reports it.
+		refusal = classify(denied).Error()
 	}
 	wc, err := ToWire(verified.Context())
 	if err != nil {
diff --git a/modules/authority/services/local/code/pkg/business/issuer/parent_limits_test.go b/modules/authority/services/local/code/pkg/business/issuer/parent_limits_test.go
index 12ad39e8..08b4114b 100644
--- a/modules/authority/services/local/code/pkg/business/issuer/parent_limits_test.go
+++ b/modules/authority/services/local/code/pkg/business/issuer/parent_limits_test.go
@@ -167,7 +167,7 @@ func TestDisjointTargetScopeStaysDeniedAfterLaterHops(t *testing.T) {
 				if _, err := k.Issuer.Check(t.Context(), parent.Token, "model", "/model.Service/ReadDocument"); err != nil {
 					t.Fatal(err)
 				}
-				if _, err := k.Issuer.Check(t.Context(), parent.Token, "model", "/model.Service/ReadProfile"); !errors.Is(err, state.ErrForbidden) {
+				if _, err := k.Issuer.Check(t.Context(), parent.Token, "model", "/model.Service/ReadProfile"); !errors.Is(err, issuer.ErrRefused) {
 					t.Fatalf("denied kind admitted by policy: %v", err)
 				}
 				if _, err := k.Issuer.ListResources(t.Context(), parent.Token, "model", "modelservice.profiles", "read"); !errors.Is(err, issuer.ErrRefused) {
diff --git a/modules/authority/services/local/code/pkg/business/state/permissions.go b/modules/authority/services/local/code/pkg/business/state/permissions.go
index 042efef9..47a2ee2c 100644
--- a/modules/authority/services/local/code/pkg/business/state/permissions.go
+++ b/modules/authority/services/local/code/pkg/business/state/permissions.go
@@ -147,7 +147,7 @@ func (s *State) PermissionReport() []string {
 			covered := false
 			for role, scopes := range roles {
 				result := "covered statically; identity, installation and resource checks still apply"
-				if err := admitMethod(m, m.Principal, method, scopes); err != nil {
+				if err := classify(decide.AdmitMethod(m, method, scopes)); err != nil {
 					result = err.Error()
 				} else {
 					covered = true
diff --git a/modules/authority/services/local/code/pkg/business/state/state.go b/modules/authority/services/local/code/pkg/business/state/state.go
index 0902cde7..f928e53a 100644
--- a/modules/authority/services/local/code/pkg/business/state/state.go
+++ b/modules/authority/services/local/code/pkg/business/state/state.go
@@ -11,16 +11,14 @@ import (
 	"crypto/ed25519"
 	"errors"
 	"fmt"
-	"maps"
 	"slices"
-	"strings"
 	"sync"
 
 	"github.com/codefly-dev/authority/libraries/authority-core/go/authority"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/decide"
 	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
 	"github.com/codefly-dev/authority/libraries/authority-core/go/memstore"
 	"github.com/codefly-dev/authority/libraries/authority-core/go/scope"
-	"github.com/codefly-dev/authority/libraries/hop/go/routing"
 	resources "github.com/codefly-dev/authority/libraries/resources/go"
 	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
 	"github.com/codefly-dev/core/workloadidentity"
@@ -373,32 +371,19 @@ func compileScopes(r Role) error {
 	return nil
 }
 
-// ensureModuleInstallations holds a module installation at every organisation.
+// ensureModuleInstallations holds every composed module installed at every
+// organisation, through the core.
 func (s *State) ensureModuleInstallations() error {
-	return s.write(func(tx authority.Tx) error {
-		modules, err := tx.Modules()
-		if err != nil {
-			return err
-		}
-		orgs, err := tx.Organizations()
-		if err != nil {
+	var orgs []domain.Organization
+	if err := s.read(func(tx authority.Tx) (err error) { orgs, err = tx.Organizations(); return err }); err != nil {
+		return err
+	}
+	for _, org := range orgs {
+		if _, err := s.svc.OrganizationAdded(context.Background(), org.ID); err != nil {
 			return err
 		}
-		for _, m := range modules {
-			if m.Kind == domain.KindSolution {
-				continue
-			}
-			for _, org := range orgs {
-				id := InstallationID(org.ID, m.Name)
-				if _, err := tx.Installation(id); errors.Is(err, domain.ErrNotFound) {
-					if err := tx.PutInstallation(domain.Installation{ID: id, Organization: org.ID, Target: m.Name, Status: domain.Active, Revision: 1}); err != nil {
-						return err
-					}
-				}
-			}
-		}
-		return nil
-	})
+	}
+	return nil
 }
 
 // performInstall installs what the fixture names through the core, then
@@ -556,13 +541,10 @@ func (s *State) ApplyManifest(m Manifest) ([]string, error) {
 	return ids, nil
 }
 
-// applyManifestLocked applies m through the core, what its methods require
-// joined to what it serves. Caller holds mu.
+// applyManifestLocked applies m through the core, which refuses an owner
+// anywhere in it and joins what its methods require to what it serves.
+// Caller holds mu.
 func (s *State) applyManifestLocked(m Manifest) ([]string, []FixtureInstallation, error) {
-	if err := noOwners(m); err != nil {
-		return nil, nil, err
-	}
-	m.ResourceKinds = Normalize(append(slices.Clone(m.ResourceKinds), servedByMethods(m.Methods)...))
 	ids, err := s.svc.ApplyModule(context.Background(), m)
 	if err != nil {
 		return nil, nil, classify(err)
@@ -571,55 +553,6 @@ func (s *State) applyManifestLocked(m Manifest) ([]string, []FixtureInstallation
 	return ids, s.takePendingInstalls(m.Name), nil
 }
 
-// noOwners refuses a delivery naming a resource owner where none belongs: in
-// what a module serves, in a binding's scopes, in a role or in a method's
-// requirement. An owner is the authority's to select per installation; read
-// owner-blind, it would widen to the whole kind, so it is refused by name.
-func noOwners(m Manifest) error {
-	check := func(where string, scopes []*basev0.WorkScopeV1) error {
-		for _, sc := range scopes {
-			if sc.GetResourceOwnerId() != "" {
-				return fmt.Errorf("%w: %s: %s names resource owner %q; a delivery never selects an owner", ErrForbidden, where, sc.GetResourceKind(), sc.GetResourceOwnerId())
-			}
-		}
-		return nil
-	}
-	if err := check(m.Name+" serves", m.ResourceKinds); err != nil {
-		return err
-	}
-	for _, id := range slices.Sorted(maps.Keys(m.Bindings)) {
-		b := m.Bindings[id]
-		for _, scopes := range [][]*basev0.WorkScopeV1{b.InvokeScopes, b.HeadlessScopes, b.LookupScopes} {
-			if err := check(m.Name+" binding "+id, scopes); err != nil {
-				return err
-			}
-		}
-	}
-	for _, name := range slices.Sorted(maps.Keys(m.Roles)) {
-		if err := check(m.Name+" role "+name, m.Roles[name]); err != nil {
-			return err
-		}
-	}
-	for _, method := range slices.Sorted(maps.Keys(m.Methods)) {
-		if err := check(m.Name+" method "+method, m.Methods[method].Requires); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// servedByMethods is every (kind, action) a module's methods require of a
-// call: what the module serves, read from its own method declarations.
-func servedByMethods(methods map[string]MethodPolicy) []*basev0.WorkScopeV1 {
-	var served []*basev0.WorkScopeV1
-	for _, policy := range methods {
-		for _, required := range policy.Requires {
-			served = append(served, &basev0.WorkScopeV1{ResourceKind: required.GetResourceKind(), Actions: slices.Clone(required.GetActions())})
-		}
-	}
-	return served
-}
-
 // takePendingInstalls removes and returns the fixture installations waiting
 // for target. Caller holds mu.
 func (s *State) takePendingInstalls(target string) []FixtureInstallation {
@@ -751,95 +684,11 @@ func (s *State) VerifyWorkload(ctx context.Context, credential string) (Manifest
 }
 
 // AdmitMethod applies what the module at audience declares for method to the
-// scopes a checked call holds. A method that declares nothing, or both that it
-// requires something and nothing, is refused: an absent or ambiguous
-// declaration is never read as permission.
+// scopes a checked call holds: the core's decide.AdmitMethod.
 func (s *State) AdmitMethod(audience, method string, held []*basev0.WorkScopeV1) error {
 	m, err := s.ModuleByPrincipal(audience)
 	if err != nil {
 		return err
 	}
-	return admitMethod(m, audience, method, held)
-}
-
-func admitMethod(m Manifest, audience, method string, held []*basev0.WorkScopeV1) error {
-	var err error
-	if m.Methods == nil {
-		return fmt.Errorf("%w: %s's delivery declares no method policy, so %s is refused", ErrForbidden, audience, method)
-	}
-	p, ok := m.Methods[method]
-	if !ok {
-		if p, ok, err = routeOf(m.Methods, method); err != nil {
-			return fmt.Errorf("%w: %s: %w", ErrForbidden, audience, err)
-		}
-	}
-	switch {
-	case !ok:
-		return fmt.Errorf("%w: %s serves no method %s", ErrUnknown, audience, method)
-	case p.AnyCheckedCaller && len(p.Requires) > 0:
-		return fmt.Errorf("%w: %s declares for %s both that it requires scopes and that it requires none", ErrForbidden, audience, method)
-	case p.AnyCheckedCaller:
-		return nil
-	case len(p.Requires) == 0:
-		return fmt.Errorf("%w: %s declares no policy for %s", ErrForbidden, audience, method)
-	}
-	// Method admission checks the kind and action; the module still checks
-	// each resource, and its owner, against the unchanged scopes.
-	var missing []string
-	for _, r := range p.Requires {
-		for _, action := range r.GetActions() {
-			if !HoldsAction(held, r.GetResourceKind(), action) {
-				missing = append(missing, r.GetResourceKind()+":"+action)
-			}
-		}
-	}
-	if len(missing) > 0 {
-		return fmt.Errorf("%w: %s requires %s for %s, which the call does not hold (it holds %s)",
-			ErrForbidden, audience, strings.Join(missing, ", "), method, describe(held))
-	}
-	return nil
-}
-
-// routeOf is the route a module declares that an HTTP request "<VERB> <path>"
-// is for; two templates matching one path is an ambiguous declaration,
-// refused rather than guessed between.
-func routeOf(methods map[string]MethodPolicy, request string) (MethodPolicy, bool, error) {
-	verb, path, ok := strings.Cut(request, " ")
-	if !ok || !strings.HasPrefix(path, "/") {
-		return MethodPolicy{}, false, nil
-	}
-	var found []string
-	for declared := range methods {
-		if v, template, ok := strings.Cut(declared, " "); ok && v == verb && routing.RouteMatches(template, path) {
-			found = append(found, declared)
-		}
-	}
-	switch len(found) {
-	case 0:
-		return MethodPolicy{}, false, nil
-	case 1:
-		return methods[found[0]], true, nil
-	}
-	slices.Sort(found)
-	return MethodPolicy{}, false, fmt.Errorf("%s matches more than one declared route (%s)", request, strings.Join(found, ", "))
-}
-
-func describe(held []*basev0.WorkScopeV1) string {
-	var out []string
-	for _, h := range held {
-		for _, a := range h.GetActions() {
-			permission := h.GetResourceKind() + ":" + a
-			switch {
-			case h.GetResourceOwnerId() != "":
-				permission += " (owner-selected)"
-			case len(h.GetResourceIds()) > 0:
-				permission += " (resource-limited)"
-			}
-			out = append(out, permission)
-		}
-	}
-	if len(out) == 0 {
-		return "nothing"
-	}
-	return strings.Join(out, ", ")
+	return classify(decide.AdmitMethod(m, method, held))
 }
diff --git a/modules/authority/services/local/code/plugins/composition/plugin.go b/modules/authority/services/local/code/plugins/composition/plugin.go
index d0765ff5..1824eec0 100644
--- a/modules/authority/services/local/code/plugins/composition/plugin.go
+++ b/modules/authority/services/local/code/plugins/composition/plugin.go
@@ -7,10 +7,9 @@ import (
 	"gateway/pkg/framework"
 	"gateway/pkg/wiring"
 	"log"
-	"strings"
 
-	delivery "github.com/codefly-dev/authority/libraries/delivery/go"
-	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/delivered"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
 	"github.com/codefly-dev/core/solutionhost"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
@@ -65,44 +64,23 @@ func (p *Plugin) ApplyManifest(ctx context.Context, req *compositionv1.ApplyMani
 		return nil, err
 	}
 	var sidecar []byte
-	delivered, err := carrier.Manifest()
+	manifest, err := carrier.Manifest()
 	if err != nil {
 		return nil, status.Errorf(codes.InvalidArgument, "manifest: %v", err)
 	}
-	m := FromCore(delivered)
+	var doc *delivered.Document
 	if req.GetAuthority() != nil {
-		doc, err := p.document(req.GetAuthority(), req.GetCarrier(), delivered, carrier.Signer().KeyID)
-		if err != nil {
-			return nil, err
-		}
-		if delivered.Removed && (len(doc.GetMethods()) > 0 || len(doc.GetRoles()) > 0 || len(doc.GetScopeCeilings()) > 0) {
-			return nil, status.Error(codes.InvalidArgument, "a withdrawal carries no live authority declarations")
+		if doc, err = p.document(req.GetAuthority(), req.GetCarrier(), manifest, carrier.Signer().KeyID); err != nil {
+			return nil, authorityplugin.Status(err)
 		}
 		sidecar = req.GetAuthority().GetDocument()
 		if sidecar == nil {
 			sidecar = []byte{}
 		}
-		if m.Methods, err = methodsOf(doc); err != nil {
-			return nil, err
-		}
-		for _, ceiling := range doc.GetScopeCeilings() {
-			if ceiling.GetResourceOwnerId() != "" {
-				return nil, status.Errorf(codes.PermissionDenied, "%s: scope ceiling %s names resource owner %q; a delivery never selects an owner", m.Name, ceiling.GetResourceKind(), ceiling.GetResourceOwnerId())
-			}
-		}
-		if m, err = ceiled(m, issuer.FromWire(doc.GetScopeCeilings())); err != nil {
-			return nil, err
-		}
-		m.OwnedRoles = map[string][]*basev0.WorkScopeV1{}
-		for _, role := range doc.GetRoles() {
-			if len(role.GetInstallationOwnedScopes()) > 0 {
-				m.OwnedRoles[role.GetName()] = issuer.FromWire(role.GetInstallationOwnedScopes())
-			}
-		}
-		if m.Roles, err = rolesOf(doc); err != nil {
-			return nil, err
-		}
-		m.OwnerAware = doc.GetOwnerAware()
+	}
+	m, err := delivered.Module(manifest, doc)
+	if err != nil {
+		return nil, authorityplugin.Status(err)
 	}
 	ids, err := p.State.ApplyDelivered(ctx, p.Coordinate, carrier, sidecar, m)
 	if err != nil {
@@ -139,144 +117,35 @@ func (p *Plugin) verified(ctx context.Context, carrier *compositionv1.SignedMani
 
 // document reads the authority's document delivered with a verified carrier:
 // signed by the key that signed the carrier, for the same module and
-// generation, naming the carrier's digest. Anything else is refused, so a
-// delivery cannot pair one release's manifest with another's method policy.
-func (p *Plugin) document(signed, carrier *compositionv1.SignedManifestV1, core *solutionhost.ModuleManifest, signer string) (*compositionv1.AuthorityManifestV1, error) {
-	keyID, err := delivery.Verify(signed.GetDocument(), signed.GetEnvelope(), p.Keys)
-	if err != nil {
-		return nil, status.Errorf(codes.PermissionDenied, "the authority's document does not verify: %v", err)
-	}
-	if keyID != signer {
-		return nil, status.Errorf(codes.PermissionDenied, "the authority's document is signed by %q and the manifest by %q", keyID, signer)
-	}
-	var doc compositionv1.AuthorityManifestV1
-	if err := proto.Unmarshal(signed.GetDocument(), &doc); err != nil {
-		return nil, status.Errorf(codes.InvalidArgument, "the authority's document does not read: %v", err)
-	}
-	switch {
-	case doc.GetModule() != core.Alias:
-		return nil, status.Errorf(codes.PermissionDenied, "the authority's document is for %q, the manifest for %q", doc.GetModule(), core.Alias)
-	case doc.GetGeneration() != core.Generation:
-		return nil, status.Errorf(codes.PermissionDenied, "the authority's document is at generation %d, the manifest at %d", doc.GetGeneration(), core.Generation)
-	case doc.GetCoreManifestDigest() != delivery.Digest(carrier.GetDocument()):
-		return nil, status.Errorf(codes.PermissionDenied, "the authority's document names another manifest than the one delivered with it")
-	}
-	return &doc, nil
-}
-
-// methodsOf reads what each method declares.
-func methodsOf(doc *compositionv1.AuthorityManifestV1) (map[string]state.MethodPolicy, error) {
-	methods := make(map[string]state.MethodPolicy, len(doc.GetMethods()))
-	for _, method := range doc.GetMethods() {
-		if _, twice := methods[method.GetMethod()]; twice || method.GetMethod() == "" {
-			return nil, status.Errorf(codes.InvalidArgument, "the authority's document lists method %q twice or unnamed", method.GetMethod())
-		}
-		methods[method.GetMethod()] = state.MethodPolicy{Requires: issuer.FromWire(method.GetRequires()), AnyCheckedCaller: method.GetAnyCheckedCaller()}
-	}
-	return methods, nil
-}
-
-// rolesOf reads the roles a solution declares, by name. The state holds them to
-// the role contract: a solution declares an installer and every role stays
-// within what it serves or explicitly consumes through invoke/lookup bindings,
-// and a module declares none, so a
-// module's delivery listing any is refused there by name.
-func rolesOf(doc *compositionv1.AuthorityManifestV1) (map[string][]*basev0.WorkScopeV1, error) {
-	if len(doc.GetRoles()) == 0 {
-		return nil, nil
-	}
-	roles := make(map[string][]*basev0.WorkScopeV1, len(doc.GetRoles()))
-	for _, role := range doc.GetRoles() {
-		if _, twice := roles[role.GetName()]; twice || role.GetName() == "" {
-			return nil, status.Errorf(codes.InvalidArgument, "the authority's document lists role %q twice or unnamed", role.GetName())
-		}
-		roles[role.GetName()] = state.Normalize(issuer.FromWire(role.GetScopes()))
-	}
-	return roles, nil
-}
-
-// ceiled gives each of the module's own kinds the actions its contract declares
-// on it, in place of the any-action kind core's manifest leaves it with. A
-// ceiling naming a kind core's manifest does not declare is refused: the
-// authority's document narrows what core's manifest composes, never adds to it.
-func ceiled(m state.Manifest, ceilings []*basev0.WorkScopeV1) (state.Manifest, error) {
-	if len(ceilings) == 0 {
-		return m, nil
-	}
-	declared := map[string]bool{}
-	for _, kind := range m.ResourceKinds {
-		declared[kind.GetResourceKind()] = true
-	}
-	ceiled := map[string]bool{}
-	for _, ceiling := range ceilings {
-		if !declared[ceiling.GetResourceKind()] {
-			return m, status.Errorf(codes.InvalidArgument, "the authority's document ceils %s, which %s's manifest does not declare", ceiling.GetResourceKind(), m.Name)
-		}
-		if len(ceiling.GetActions()) == 0 {
-			return m, status.Errorf(codes.InvalidArgument, "the authority's document ceils %s with no action", ceiling.GetResourceKind())
-		}
-		ceiled[ceiling.GetResourceKind()] = true
-	}
-	kinds := append([]*basev0.WorkScopeV1(nil), ceilings...)
-	for _, kind := range m.ResourceKinds {
-		if !ceiled[kind.GetResourceKind()] {
-			kinds = append(kinds, kind)
-		}
-	}
-	m.ResourceKinds = state.Normalize(kinds)
-	return m, nil
-}
-
-// FromCore reads core's module manifest as the state's. Core's manifest carries
-// no roles; a solution's arrive in the authority's document delivered with it
-// (rolesOf), so a solution delivered as a carrier with none is refused. The
-// manifest is the ceiling here: a resource kind declared with no actions serves
-// whatever the roles grant on it, a binding's invoke scopes are its operations,
-// and a module acting alone holds what it may invoke. The host narrows each of
-// these by its release-signed envelope; the local authority has no second
-// document.
-func FromCore(in *solutionhost.ModuleManifest) state.Manifest {
-	m := state.Manifest{Name: in.Alias, Principal: in.Alias, Kind: string(in.Kind), Generation: in.Generation, Bindings: map[string]state.Binding{}}
-	if in.Authority == nil {
-		return m
-	}
-	if in.Authority.Principal != "" {
-		m.Principal = in.Authority.Principal
+// generation, naming the carrier's digest (delivered.VerifyDocument and
+// delivered.Pair). Anything else is refused, so a delivery cannot pair one
+// release's manifest with another's method policy.
+func (p *Plugin) document(signed, carrier *compositionv1.SignedManifestV1, core *solutionhost.ModuleManifest, signer string) (*delivered.Document, error) {
+	if err := delivered.VerifyDocument(signed.GetDocument(), signed.GetEnvelope(), p.Keys, signer); err != nil {
+		return nil, err
 	}
-	for _, kind := range in.Authority.ResourceKinds {
-		m.ResourceKinds = append(m.ResourceKinds, &basev0.WorkScopeV1{ResourceKind: kind, Actions: []string{state.AnyAction}})
+	var wire compositionv1.AuthorityManifestV1
+	if err := proto.Unmarshal(signed.GetDocument(), &wire); err != nil {
+		return nil, domain.Malformed("the authority's document does not read: %v", err)
 	}
-	m.ResourceKinds = state.Normalize(m.ResourceKinds)
-	for _, b := range in.Authority.Bindings {
-		invoke := scopesOf(b.Operations["invoke"])
-		headless := scopesOf(b.Operations["headless"])
-		lookup := scopesOf(b.Operations["lookup"])
-		m.Bindings[b.ID] = state.Binding{ID: b.ID, Audience: b.Audience, InvokeScopes: invoke, HeadlessScopes: headless, LookupScopes: lookup}
+	doc := DocumentOf(&wire)
+	if err := delivered.Pair(*doc, carrier.GetDocument(), core); err != nil {
+		return nil, err
 	}
-	return m
+	return doc, nil
 }
 
-// scopesOf reads one operation's requested scopes, each "<resource kind>:<action>"
-// as core's manifest writes them, into scopes grouped by kind. An entry without
-// a colon names nothing and is skipped; the manifest's own validation refuses it.
-func scopesOf(entries []string) []*basev0.WorkScopeV1 {
-	byKind := map[string][]string{}
-	var kinds []string
-	for _, entry := range entries {
-		kind, action, ok := strings.Cut(entry, ":")
-		if !ok || kind == "" || action == "" {
-			continue
-		}
-		if _, seen := byKind[kind]; !seen {
-			kinds = append(kinds, kind)
-		}
-		byKind[kind] = append(byKind[kind], action)
+// DocumentOf reads this host's binding of the authority's document as the core's.
+func DocumentOf(in *compositionv1.AuthorityManifestV1) *delivered.Document {
+	doc := &delivered.Document{Module: in.GetModule(), Generation: in.GetGeneration(), CoreManifestDigest: in.GetCoreManifestDigest(),
+		ScopeCeilings: issuer.FromWire(in.GetScopeCeilings()), OwnerAware: in.GetOwnerAware()}
+	for _, m := range in.GetMethods() {
+		doc.Methods = append(doc.Methods, delivered.Method{Method: m.GetMethod(), Requires: issuer.FromWire(m.GetRequires()), AnyCheckedCaller: m.GetAnyCheckedCaller()})
 	}
-	var out []*basev0.WorkScopeV1
-	for _, kind := range kinds {
-		out = append(out, &basev0.WorkScopeV1{ResourceKind: kind, Actions: byKind[kind]})
+	for _, r := range in.GetRoles() {
+		doc.Roles = append(doc.Roles, delivered.Role{Name: r.GetName(), Scopes: issuer.FromWire(r.GetScopes()), InstallationOwned: issuer.FromWire(r.GetInstallationOwnedScopes())})
 	}
-	return state.Normalize(out)
+	return doc
 }
 
 // New is the registry's constructor: the plugin over what Configure wired.
diff --git a/modules/authority/services/local/code/plugins/composition/plugin_test.go b/modules/authority/services/local/code/plugins/composition/plugin_test.go
deleted file mode 100644
index 011e9a6a..00000000
--- a/modules/authority/services/local/code/plugins/composition/plugin_test.go
+++ /dev/null
@@ -1,70 +0,0 @@
-package composition
-
-import (
-	"slices"
-	"testing"
-
-	"gateway/pkg/business/state"
-
-	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
-	"github.com/codefly-dev/core/solutionhost"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-)
-
-// Core's manifest writes a binding's operations as operation → "<kind>:<action>"
-// entries; the state reads invoke and headless scopes from them.
-func TestCoreBindingOperationsAreReadAsScopesPerOperation(t *testing.T) {
-	m := FromCore(&solutionhost.ModuleManifest{Alias: "robin", Kind: solutionhost.KindModule, Generation: 1,
-		Authority: &solutionhost.Authority{Principal: "robin", Bindings: []solutionhost.AuthorityBinding{{
-			ID: "model", Audience: "model",
-			Operations: map[string][]string{
-				"invoke":   {"modelservice.profiles:invoke", "modelservice.profiles:read"},
-				"lookup":   {"modelservice.profiles:read"},
-				"headless": {"modelservice.profiles:read"},
-			},
-		}}}})
-	b, ok := m.Bindings["model"]
-	if !ok || b.Audience != "model" {
-		t.Fatalf("binding: %+v", m.Bindings)
-	}
-	if len(b.InvokeScopes) != 1 || b.InvokeScopes[0].GetResourceKind() != "modelservice.profiles" || len(b.InvokeScopes[0].GetActions()) != 2 {
-		t.Fatalf("invoke scopes: %v", b.InvokeScopes)
-	}
-	if len(b.HeadlessScopes) != 1 || b.HeadlessScopes[0].GetActions()[0] != "read" {
-		t.Fatalf("headless scopes: %v", b.HeadlessScopes)
-	}
-}
-
-// A module's own kinds come from core's manifest as names; the authority's
-// document gives each the actions the contract declares, so a person who holds
-// everything there is granted those actions rather than an action nobody can
-// enumerate.
-func TestScopeCeilingsGiveTheModulesKindsTheirActions(t *testing.T) {
-	m := FromCore(&solutionhost.ModuleManifest{Alias: "runtime", Kind: solutionhost.KindModule, Generation: 1,
-		Authority: &solutionhost.Authority{Principal: "runtime", ResourceKinds: []string{"runtime.tasks", "runtime.queues"}}})
-	got, err := ceiled(m, []*basev0.WorkScopeV1{{ResourceKind: "runtime.tasks", Actions: []string{"start", "execute"}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	actions := map[string][]string{}
-	for _, kind := range got.ResourceKinds {
-		actions[kind.GetResourceKind()] = kind.GetActions()
-	}
-	if len(actions["runtime.tasks"]) != 2 || slices.Contains(actions["runtime.tasks"], state.AnyAction) {
-		t.Fatalf("runtime.tasks serves %v", actions["runtime.tasks"])
-	}
-	// A kind the document does not ceil keeps what core's manifest gave it.
-	if !slices.Equal(actions["runtime.queues"], []string{state.AnyAction}) {
-		t.Fatalf("runtime.queues serves %v", actions["runtime.queues"])
-	}
-	// The document narrows what core composes and never adds a kind.
-	for name, ceilings := range map[string][]*basev0.WorkScopeV1{
-		"a kind core does not declare": {{ResourceKind: "records.records", Actions: []string{"write"}}},
-		"a kind with no action":        {{ResourceKind: "runtime.tasks"}},
-	} {
-		if _, err := ceiled(m, ceilings); status.Code(err) != codes.InvalidArgument {
-			t.Errorf("%s: %v", name, err)
-		}
-	}
-}

From fa3794fd63c025d871f74e01b9f24d170ad6e9e4 Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Mon, 26 Oct 2026 20:10:46 -0400
Subject: [PATCH 02/16] style: gofmt

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 libraries/authority-core/go/authority/roles.go   | 1 -
 libraries/authority-core/go/memstore/memstore.go | 4 ++--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/libraries/authority-core/go/authority/roles.go b/libraries/authority-core/go/authority/roles.go
index deb45d06..eef27368 100644
--- a/libraries/authority-core/go/authority/roles.go
+++ b/libraries/authority-core/go/authority/roles.go
@@ -134,4 +134,3 @@ func (s *Service) ListRoleGrants(ctx context.Context, caller Person, organizatio
 func (s *Service) PersonChanged(ctx context.Context, person string) error {
 	return s.store.Write(ctx, func(tx Tx) error { return tx.BumpPersonEpoch(person) })
 }
-
diff --git a/libraries/authority-core/go/memstore/memstore.go b/libraries/authority-core/go/memstore/memstore.go
index d732f547..a058456f 100644
--- a/libraries/authority-core/go/memstore/memstore.go
+++ b/libraries/authority-core/go/memstore/memstore.go
@@ -22,8 +22,8 @@ type Store struct {
 	mu            sync.RWMutex
 	orgs          map[string]domain.Organization
 	people        map[string]map[string]domain.Person // id → organization → membership
-	roles         map[string]domain.OrgRole // organization/name
-	modules       map[string]domain.Module  // name
+	roles         map[string]domain.OrgRole           // organization/name
+	modules       map[string]domain.Module            // name
 	installations map[string]domain.Installation
 	grants        map[string][]domain.RoleGrant
 	revisions     map[string]uint64

From 2ad39f7395b047309ade947d4909613d8f883185 Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Mon, 26 Oct 2026 20:21:13 -0400
Subject: [PATCH 03/16] feat(authority-core): every organization holds every
 composed module, and the host grants a role as the administrator would

ReconcileOrganizations holds every composed module at every organization (what
a host runs at start; the local authority's fixture load now calls it), and
GrantRoleAsHost is trusted host setup deciding a grant as GrantRole decides it
for the organization's administrator.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../authority-core/go/authority/lifecycle.go  | 18 +++++++
 .../go/authority/organization_added_test.go   | 49 +++++++++++++++++++
 .../authority-core/go/authority/roles.go      | 42 +++++++++++-----
 .../local/code/pkg/business/state/state.go    | 11 +----
 4 files changed, 99 insertions(+), 21 deletions(-)

diff --git a/libraries/authority-core/go/authority/lifecycle.go b/libraries/authority-core/go/authority/lifecycle.go
index d34e3310..0b209b51 100644
--- a/libraries/authority-core/go/authority/lifecycle.go
+++ b/libraries/authority-core/go/authority/lifecycle.go
@@ -3,6 +3,7 @@ package authority
 import (
 	"context"
 	"errors"
+	"fmt"
 	"maps"
 	"slices"
 
@@ -169,6 +170,23 @@ func (s *Service) OrganizationAdded(ctx context.Context, org string) ([]string,
 	return ids, err
 }
 
+// ReconcileOrganizations holds every composed module at every organization
+// (OrganizationAdded at each): what a host runs when it starts, so an
+// organization created while the authority could not record it still holds
+// the modules it may use.
+func (s *Service) ReconcileOrganizations(ctx context.Context) error {
+	var orgs []domain.Organization
+	if err := s.store.Read(ctx, func(tx Tx) (err error) { orgs, err = tx.Organizations(); return err }); err != nil {
+		return err
+	}
+	for _, org := range orgs {
+		if _, err := s.OrganizationAdded(ctx, org.ID); err != nil {
+			return fmt.Errorf("organization %s: %w", org.ID, err)
+		}
+	}
+	return nil
+}
+
 // WithdrawModule removes a module: its installations are revoked and the
 // delegations granted to it end.
 func (s *Service) WithdrawModule(ctx context.Context, name string) error {
diff --git a/libraries/authority-core/go/authority/organization_added_test.go b/libraries/authority-core/go/authority/organization_added_test.go
index 909383d6..659e8248 100644
--- a/libraries/authority-core/go/authority/organization_added_test.go
+++ b/libraries/authority-core/go/authority/organization_added_test.go
@@ -42,4 +42,53 @@ func TestAnOrganizationAddedLaterHoldsEveryComposedModule(t *testing.T) {
 	code(t, err, domain.Precondition)
 	_, err = h.svc.OrganizationAdded(h.ctx, "nobody")
 	code(t, err, domain.NotFound)
+
+	// Reconciling every organization holds what is missing and nothing more.
+	const hooli = "hooli"
+	h.store.PutOrganization(domain.Organization{ID: hooli, Name: hooli})
+	if err := h.svc.ReconcileOrganizations(h.ctx); err != nil {
+		t.Fatal(err)
+	}
+	ids, err = h.svc.OrganizationAdded(h.ctx, hooli)
+	if err != nil || len(ids) != 2 {
+		t.Fatalf("reconciled module installations %v %v", ids, err)
+	}
+	_, err = h.svc.IssueForPerson(h.ctx, ivy, authority.IssueRequest{Audience: "store", Scopes: []*basev0.WorkScopeV1{sc(kind, "read")}})
+	code(t, err, domain.Precondition)
+}
+
+// The host's own setup grants a role as the organization's administrator
+// would: on an active installation of that organization, a declared role, to
+// a member or a team of it.
+func TestTheHostGrantsARoleAsTheAdministratorWould(t *testing.T) {
+	h := newHarness(t)
+	inst := h.inst(acme, "a").ID
+	for _, tc := range []struct {
+		name string
+		r    authority.RoleRequest
+		code domain.Code
+	}{
+		{"another organization's installation", authority.RoleRequest{Organization: globex, InstallationID: inst, Role: "viewer", PersonID: "omar"}, domain.Denied},
+		{"an undeclared role", authority.RoleRequest{Organization: acme, InstallationID: inst, Role: "owner", PersonID: "maya"}, domain.NotFound},
+		{"no subject", authority.RoleRequest{Organization: acme, InstallationID: inst, Role: "viewer"}, domain.Invalid},
+		{"a person of another organization", authority.RoleRequest{Organization: acme, InstallationID: inst, Role: "viewer", PersonID: "omar"}, domain.Denied},
+		{"a team of another organization", authority.RoleRequest{Organization: acme, InstallationID: inst, Role: "viewer", TeamID: "ops"}, domain.Denied},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := h.svc.GrantRoleAsHost(h.ctx, tc.r)
+			code(t, err, tc.code)
+		})
+	}
+	if _, err := h.svc.GrantRoleAsHost(h.ctx, authority.RoleRequest{Organization: acme, InstallationID: inst, Role: "viewer", PersonID: "maya"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := h.root("maya", "a"); err != nil {
+		t.Fatalf("the granted role is held: %v", err)
+	}
+	if _, err := h.svc.GrantRoleAsHost(h.ctx, authority.RoleRequest{Organization: acme, InstallationID: inst, Role: "viewer", TeamID: "team"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := h.root("tam", "a"); err != nil {
+		t.Fatalf("the team's role is held: %v", err)
+	}
 }
diff --git a/libraries/authority-core/go/authority/roles.go b/libraries/authority-core/go/authority/roles.go
index eef27368..61cd1941 100644
--- a/libraries/authority-core/go/authority/roles.go
+++ b/libraries/authority-core/go/authority/roles.go
@@ -19,18 +19,23 @@ func (r RoleRequest) grant() domain.RoleGrant {
 	return domain.RoleGrant{InstallationID: r.InstallationID, Role: r.Role, PersonID: r.PersonID, TeamID: r.TeamID}
 }
 
-// decideRoleChange reads what decide.ChangeRole needs.
-func decideRoleChange(tx Tx, caller Person, r RoleRequest, list, revoke bool) (domain.Installation, error) {
+// decideRoleChange reads what decide.ChangeRole needs. A nil caller is the
+// host's own setup, deciding as the organization's administrator would.
+func decideRoleChange(tx Tx, caller *Person, r RoleRequest, list, revoke bool) (domain.Installation, error) {
 	// A caller of another organization than the one named learns nothing of
 	// it: the foreign answer comes before any installation is read. Then the
 	// installation is resolved by (organization, id): another organization's
 	// and an absent one answer alike, having done the same work.
-	c, err := memberAs(tx, caller, r.Organization)
-	if err != nil && !errors.Is(err, domain.ErrNotFound) {
-		return domain.Installation{}, err
-	}
-	if err != nil {
-		return domain.Installation{}, decide.ForeignInstallation(r.InstallationID, r.Organization)
+	c := domain.Person{Organization: r.Organization, Roles: []string{"admin"}}
+	if caller != nil {
+		var err error
+		c, err = memberAs(tx, *caller, r.Organization)
+		if err != nil && !errors.Is(err, domain.ErrNotFound) {
+			return domain.Installation{}, err
+		}
+		if err != nil {
+			return domain.Installation{}, decide.ForeignInstallation(r.InstallationID, r.Organization)
+		}
 	}
 	inst, err := tx.Installation(r.InstallationID)
 	if errors.Is(err, domain.ErrNotFound) || (err == nil && inst.Organization != r.Organization) {
@@ -70,7 +75,22 @@ func (s *Service) GrantRole(ctx context.Context, caller Person, r RoleRequest) (
 	var inst domain.Installation
 	err := s.store.Write(ctx, func(tx Tx) error {
 		var err error
-		if inst, err = decideRoleChange(tx, caller, r, false, false); err != nil {
+		if inst, err = decideRoleChange(tx, &caller, r, false, false); err != nil {
+			return err
+		}
+		return tx.PutRoleGrant(r.grant())
+	})
+	return inst, err
+}
+
+// GrantRoleAsHost is for trusted host setup (a fixture's installations),
+// never a request handler: it grants a role with no caller, decided as
+// GrantRole decides it for the organization's administrator.
+func (s *Service) GrantRoleAsHost(ctx context.Context, r RoleRequest) (domain.Installation, error) {
+	var inst domain.Installation
+	err := s.store.Write(ctx, func(tx Tx) error {
+		var err error
+		if inst, err = decideRoleChange(tx, nil, r, false, false); err != nil {
 			return err
 		}
 		return tx.PutRoleGrant(r.grant())
@@ -85,7 +105,7 @@ func (s *Service) RevokeRole(ctx context.Context, caller Person, r RoleRequest)
 	var inst domain.Installation
 	err := s.store.Write(ctx, func(tx Tx) error {
 		var err error
-		if inst, err = decideRoleChange(tx, caller, r, false, true); err != nil {
+		if inst, err = decideRoleChange(tx, &caller, r, false, true); err != nil {
 			return err
 		}
 		if err := tx.DeleteRoleGrant(r.grant()); err != nil {
@@ -118,7 +138,7 @@ func (s *Service) RevokeRole(ctx context.Context, caller Person, r RoleRequest)
 func (s *Service) ListRoleGrants(ctx context.Context, caller Person, organization, installationID string) ([]domain.RoleGrant, error) {
 	var out []domain.RoleGrant
 	err := s.store.Read(ctx, func(tx Tx) error {
-		if _, err := decideRoleChange(tx, caller, RoleRequest{Organization: organization, InstallationID: installationID}, true, false); err != nil {
+		if _, err := decideRoleChange(tx, &caller, RoleRequest{Organization: organization, InstallationID: installationID}, true, false); err != nil {
 			return err
 		}
 		var err error
diff --git a/modules/authority/services/local/code/pkg/business/state/state.go b/modules/authority/services/local/code/pkg/business/state/state.go
index f928e53a..b67119e3 100644
--- a/modules/authority/services/local/code/pkg/business/state/state.go
+++ b/modules/authority/services/local/code/pkg/business/state/state.go
@@ -374,16 +374,7 @@ func compileScopes(r Role) error {
 // ensureModuleInstallations holds every composed module installed at every
 // organisation, through the core.
 func (s *State) ensureModuleInstallations() error {
-	var orgs []domain.Organization
-	if err := s.read(func(tx authority.Tx) (err error) { orgs, err = tx.Organizations(); return err }); err != nil {
-		return err
-	}
-	for _, org := range orgs {
-		if _, err := s.svc.OrganizationAdded(context.Background(), org.ID); err != nil {
-			return err
-		}
-	}
-	return nil
+	return s.svc.ReconcileOrganizations(context.Background())
 }
 
 // performInstall installs what the fixture names through the core, then

From de8beb534925988caafbfc915d60783b2bcb9c7b Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Mon, 26 Oct 2026 20:26:36 -0400
Subject: [PATCH 04/16] feat(authority-core): every change of authority is
 journaled in the transaction that makes it

Config.Journal receives each change (a module applied or withdrawn, an
installation requested, activated or uninstalled, a role granted or revoked, a
delegation granted or revoked, a resource attached, detached or transferred)
inside its write transaction; a journal that refuses aborts the change. A host
maps it onto its audit record; nil journals nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../authority-core/go/authority/attachment.go |  6 +-
 .../authority-core/go/authority/delegation.go | 12 ++-
 .../go/authority/journal_test.go              | 97 +++++++++++++++++++
 .../authority-core/go/authority/lifecycle.go  | 44 ++++++++-
 .../authority-core/go/authority/roles.go      | 17 +++-
 .../authority-core/go/authority/service.go    | 11 +++
 .../authority-core/go/authority/transfer.go   |  3 +-
 libraries/authority-core/go/domain/domain.go  | 33 +++++++
 8 files changed, 210 insertions(+), 13 deletions(-)
 create mode 100644 libraries/authority-core/go/authority/journal_test.go

diff --git a/libraries/authority-core/go/authority/attachment.go b/libraries/authority-core/go/authority/attachment.go
index 5663e01f..291bea67 100644
--- a/libraries/authority-core/go/authority/attachment.go
+++ b/libraries/authority-core/go/authority/attachment.go
@@ -96,7 +96,8 @@ func (s *Service) AttachResource(ctx context.Context, r AttachmentRequest) (stri
 			return err
 		}
 		owner = inst.ID
-		return nil
+		return s.journal(ctx, tx, domain.Event{Kind: domain.ResourceAttached, Organization: inst.Organization, Actor: r.Store.Module, Subject: inst.ID,
+			Detail: map[string]string{"kind": r.Kind, "resource": r.ResourceID}})
 	})
 	return owner, err
 }
@@ -136,7 +137,8 @@ func (s *Service) DetachResource(ctx context.Context, caller Workload, org, kind
 				return err
 			}
 			owner = inst.ID
-			return nil
+			return s.journal(ctx, tx, domain.Event{Kind: domain.ResourceDetached, Organization: org, Actor: caller.Module, Subject: inst.ID,
+				Detail: map[string]string{"kind": kind, "resource": id}})
 		}
 		return nil
 	})
diff --git a/libraries/authority-core/go/authority/delegation.go b/libraries/authority-core/go/authority/delegation.go
index bad602c4..9594bf85 100644
--- a/libraries/authority-core/go/authority/delegation.go
+++ b/libraries/authority-core/go/authority/delegation.go
@@ -51,7 +51,11 @@ func (s *Service) Delegate(ctx context.Context, who Person, module string, scope
 			return domain.Refuse("%s delegates what they do not hold", p.ID)
 		}
 		d = domain.Delegation{ID: s.cfg.NewID(), Organization: p.Organization, Grantor: p.ID, Module: m.Name, Purpose: purpose, Scopes: scope.Normalize(scopes)}
-		return tx.PutDelegation(d)
+		if err := tx.PutDelegation(d); err != nil {
+			return err
+		}
+		return s.journal(ctx, tx, domain.Event{Kind: domain.DelegationGranted, Organization: d.Organization, Actor: d.Grantor, Subject: d.ID,
+			Detail: map[string]string{"module": d.Module, "purpose": d.Purpose}})
 	})
 	return d, err
 }
@@ -75,7 +79,11 @@ func (s *Service) RevokeDelegation(ctx context.Context, who Person, id string) (
 		if err := tx.PutDelegation(d); err != nil {
 			return err
 		}
-		return tx.BumpAuthorizationRevision(d.Organization)
+		if err := tx.BumpAuthorizationRevision(d.Organization); err != nil {
+			return err
+		}
+		return s.journal(ctx, tx, domain.Event{Kind: domain.DelegationRevoked, Organization: d.Organization, Actor: who.ID, Subject: d.ID,
+			Detail: map[string]string{"module": d.Module}})
 	})
 	return d, err
 }
diff --git a/libraries/authority-core/go/authority/journal_test.go b/libraries/authority-core/go/authority/journal_test.go
new file mode 100644
index 00000000..6a9ac3ab
--- /dev/null
+++ b/libraries/authority-core/go/authority/journal_test.go
@@ -0,0 +1,97 @@
+package authority_test
+
+import (
+	"context"
+	"errors"
+	"slices"
+	"testing"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/authority"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+)
+
+// Every change of authority is journaled in the transaction that makes it,
+// naming where it happened, who acted and what changed; a journal that
+// refuses aborts the change.
+func TestEveryChangeIsJournaledInItsOwnTransaction(t *testing.T) {
+	h := newHarness(t)
+	var events []domain.Event
+	refuse := false
+	cfg := h.cfg
+	cfg.Journal = func(_ context.Context, _ authority.Tx, e domain.Event) error {
+		if refuse {
+			return errors.New("the journal is unavailable")
+		}
+		events = append(events, e)
+		return nil
+	}
+	svc, err := authority.New(h.store, cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	alex := h.person("alex")
+	inst := h.inst(acme, "a").ID
+	viewer := authority.RoleRequest{Organization: acme, InstallationID: inst, Role: "viewer", PersonID: "maya"}
+	steps := []struct {
+		name string
+		do   func() error
+		want domain.Event
+	}{
+		{"a role granted", func() error { _, err := svc.GrantRole(h.ctx, alex, viewer); return err },
+			domain.Event{Kind: domain.RoleGranted, Organization: acme, Actor: "alex", Subject: inst}},
+		{"a role revoked", func() error { _, err := svc.RevokeRole(h.ctx, alex, viewer); return err },
+			domain.Event{Kind: domain.RoleRevoked, Organization: acme, Actor: "alex", Subject: inst}},
+		{"a delegation granted", func() error {
+			_, err := svc.Delegate(h.ctx, h.person("rob"), "store", []*basev0.WorkScopeV1{sc(kind, "read")}, "a purpose")
+			return err
+		}, domain.Event{Kind: domain.DelegationGranted, Organization: acme, Actor: "rob"}},
+		{"an installation uninstalled", func() error { return svc.Uninstall(h.ctx, alex, acme, inst) },
+			domain.Event{Kind: domain.InstallationUninstalled, Organization: acme, Actor: "alex", Subject: inst}},
+		{"an installation requested and activated", func() error {
+			_, err := svc.Install(h.ctx, alex, acme, "a", "author", "alex", h.approval(acme, "a"), nil)
+			return err
+		}, domain.Event{Kind: domain.InstallationActivated, Organization: acme, Actor: "alex", Subject: inst}},
+		{"a module applied", func() error {
+			m := solution("d", true)
+			_, err := svc.ApplyModule(h.ctx, m)
+			return err
+		}, domain.Event{Kind: domain.ModuleApplied, Subject: "d"}},
+		{"a module withdrawn", func() error { return svc.WithdrawModule(h.ctx, "d") }, domain.Event{Kind: domain.ModuleWithdrawn, Subject: "d"}},
+	}
+	for _, step := range steps {
+		t.Run(step.name, func(t *testing.T) {
+			before := len(events)
+			if err := step.do(); err != nil {
+				t.Fatal(err)
+			}
+			if len(events) == before {
+				t.Fatal("nothing was journaled")
+			}
+			got := events[len(events)-1]
+			if got.Kind != step.want.Kind || got.Organization != step.want.Organization || got.Actor != step.want.Actor ||
+				(step.want.Subject != "" && got.Subject != step.want.Subject) {
+				t.Fatalf("journaled %+v, want %+v", got, step.want)
+			}
+		})
+	}
+	if !slices.ContainsFunc(events, func(e domain.Event) bool { return e.Kind == domain.InstallationRequested }) {
+		t.Fatal("the pending attempt was not journaled")
+	}
+
+	t.Run("a journal that refuses aborts the change", func(t *testing.T) {
+		refuse = true
+		defer func() { refuse = false }()
+		_, err := svc.GrantRole(h.ctx, alex, authority.RoleRequest{Organization: acme, InstallationID: inst, Role: "viewer", PersonID: "remi"})
+		if err == nil {
+			t.Fatal("the grant committed without its journal entry")
+		}
+		grants, err := h.svc.ListRoleGrants(h.ctx, alex, acme, inst)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if slices.ContainsFunc(grants, func(g domain.RoleGrant) bool { return g.PersonID == "remi" }) {
+			t.Fatal("the refused journal left the grant behind")
+		}
+	})
+}
diff --git a/libraries/authority-core/go/authority/lifecycle.go b/libraries/authority-core/go/authority/lifecycle.go
index 0b209b51..1121dbfd 100644
--- a/libraries/authority-core/go/authority/lifecycle.go
+++ b/libraries/authority-core/go/authority/lifecycle.go
@@ -97,6 +97,9 @@ func (s *Service) ApplyModule(ctx context.Context, m domain.Module) ([]string, e
 		if err := tx.PutModule(m); err != nil {
 			return err
 		}
+		if err := s.journal(ctx, tx, domain.Event{Kind: domain.ModuleApplied, Subject: m.Name, Detail: map[string]string{"principal": m.Principal, "kind": m.Kind, "generation": fmt.Sprint(m.Generation)}}); err != nil {
+			return err
+		}
 		if m.Kind == domain.KindSolution {
 			return nil
 		}
@@ -224,6 +227,9 @@ func (s *Service) WithdrawModule(ctx context.Context, name string) error {
 		if err := tx.PutTombstone(domain.Tombstone{Name: m.Name, Principal: m.Principal, Generation: m.Generation}); err != nil {
 			return err
 		}
+		if err := s.journal(ctx, tx, domain.Event{Kind: domain.ModuleWithdrawn, Subject: m.Name, Detail: map[string]string{"principal": m.Principal, "generation": fmt.Sprint(m.Generation)}}); err != nil {
+			return err
+		}
 		return tx.DeleteModule(name)
 	})
 }
@@ -325,7 +331,10 @@ func (s *Service) install(ctx context.Context, authorize func(Tx) error, caller
 					return err
 				}
 				inst = existing
-				return tx.PutInstallation(existing)
+				if err := tx.PutInstallation(existing); err != nil {
+					return err
+				}
+				return s.journal(ctx, tx, requested(caller, existing))
 			}
 			inst = existing
 			return nil
@@ -362,7 +371,10 @@ func (s *Service) install(ctx context.Context, authorize func(Tx) error, caller
 		if err := tx.DeleteRoleGrants(id); err != nil {
 			return err
 		}
-		return tx.PutInstallation(inst)
+		if err := tx.PutInstallation(inst); err != nil {
+			return err
+		}
+		return s.journal(ctx, tx, requested(caller, inst))
 	})
 	if err != nil {
 		return inst, err
@@ -405,11 +417,22 @@ func (s *Service) install(ctx context.Context, authorize func(Tx) error, caller
 		}
 		current.Status = domain.Active
 		inst = current
-		return tx.PutInstallation(current)
+		if err := tx.PutInstallation(current); err != nil {
+			return err
+		}
+		return s.journal(ctx, tx, domain.Event{Kind: domain.InstallationActivated, Organization: current.Organization, Actor: caller.ID, Subject: current.ID,
+			Detail: map[string]string{"target": current.Target, "revision": fmt.Sprint(current.Revision)}})
 	})
 	return inst, err
 }
 
+// requested is the journal entry of an installation attempt recorded pending.
+func requested(caller Person, inst domain.Installation) domain.Event {
+	return domain.Event{Kind: domain.InstallationRequested, Organization: inst.Organization, Actor: caller.ID, Subject: inst.ID,
+		Detail: map[string]string{"target": inst.Target, "role": inst.AgentRole, "principal": inst.PrincipalID, "installed_by": inst.InstalledBy,
+			"revision": fmt.Sprint(inst.Revision), "operation": inst.Consent.OperationID}}
+}
+
 // Uninstall disables a solution installation and its principal at once, clears
 // its grants and revokes capabilities sealed to it or its organization. The
 // caller must currently administer the organization. Module installations
@@ -434,7 +457,10 @@ func (s *Service) Uninstall(ctx context.Context, caller Person, organization, in
 		if inst.PrincipalID == "" || inst.InstalledBy == "" {
 			return domain.Refuse("%s is a module, installed by composition: it is withdrawn, never uninstalled", inst.Target)
 		}
-		return s.revoke(tx, inst)
+		if err := s.revoke(tx, inst); err != nil {
+			return err
+		}
+		return s.journal(ctx, tx, uninstalled(caller.ID, inst))
 	})
 }
 
@@ -447,10 +473,18 @@ func (s *Service) UninstallAsHost(ctx context.Context, organization, installatio
 		if err != nil {
 			return err
 		}
-		return s.revoke(tx, inst)
+		if err := s.revoke(tx, inst); err != nil {
+			return err
+		}
+		return s.journal(ctx, tx, uninstalled("", inst))
 	})
 }
 
+func uninstalled(actor string, inst domain.Installation) domain.Event {
+	return domain.Event{Kind: domain.InstallationUninstalled, Organization: inst.Organization, Actor: actor, Subject: inst.ID,
+		Detail: map[string]string{"target": inst.Target, "revision": fmt.Sprint(inst.Revision + 1)}}
+}
+
 func installationIn(tx Tx, organization, installationID string) (domain.Installation, error) {
 	inst, err := tx.Installation(installationID)
 	if errors.Is(err, domain.ErrNotFound) || (err == nil && inst.Organization != organization) {
diff --git a/libraries/authority-core/go/authority/roles.go b/libraries/authority-core/go/authority/roles.go
index 61cd1941..767e3a4a 100644
--- a/libraries/authority-core/go/authority/roles.go
+++ b/libraries/authority-core/go/authority/roles.go
@@ -78,11 +78,19 @@ func (s *Service) GrantRole(ctx context.Context, caller Person, r RoleRequest) (
 		if inst, err = decideRoleChange(tx, &caller, r, false, false); err != nil {
 			return err
 		}
-		return tx.PutRoleGrant(r.grant())
+		if err := tx.PutRoleGrant(r.grant()); err != nil {
+			return err
+		}
+		return s.journal(ctx, tx, r.event(domain.RoleGranted, caller.ID))
 	})
 	return inst, err
 }
 
+func (r RoleRequest) event(kind domain.EventKind, actor string) domain.Event {
+	return domain.Event{Kind: kind, Organization: r.Organization, Actor: actor, Subject: r.InstallationID,
+		Detail: map[string]string{"role": r.Role, "person": r.PersonID, "team": r.TeamID}}
+}
+
 // GrantRoleAsHost is for trusted host setup (a fixture's installations),
 // never a request handler: it grants a role with no caller, decided as
 // GrantRole decides it for the organization's administrator.
@@ -93,7 +101,10 @@ func (s *Service) GrantRoleAsHost(ctx context.Context, r RoleRequest) (domain.In
 		if inst, err = decideRoleChange(tx, nil, r, false, false); err != nil {
 			return err
 		}
-		return tx.PutRoleGrant(r.grant())
+		if err := tx.PutRoleGrant(r.grant()); err != nil {
+			return err
+		}
+		return s.journal(ctx, tx, r.event(domain.RoleGranted, ""))
 	})
 	return inst, err
 }
@@ -129,7 +140,7 @@ func (s *Service) RevokeRole(ctx context.Context, caller Person, r RoleRequest)
 				return err
 			}
 		}
-		return nil
+		return s.journal(ctx, tx, r.event(domain.RoleRevoked, caller.ID))
 	})
 	return inst, err
 }
diff --git a/libraries/authority-core/go/authority/service.go b/libraries/authority-core/go/authority/service.go
index 857cfb2a..a21397fc 100644
--- a/libraries/authority-core/go/authority/service.go
+++ b/libraries/authority-core/go/authority/service.go
@@ -48,6 +48,9 @@ type Config struct {
 	Replay workcontext.ReplayStore
 	// Grants answers approval grants; nil refuses every grant capability.
 	Grants workcontext.GrantSource
+	// Journal records each change of authority in the transaction that makes
+	// it; an error aborts the change. nil journals nothing.
+	Journal func(ctx context.Context, tx Tx, e domain.Event) error
 }
 
 var (
@@ -102,6 +105,14 @@ func New(store Store, cfg Config) (*Service, error) {
 	return s, nil
 }
 
+// journal records e in tx, when the host journals.
+func (s *Service) journal(ctx context.Context, tx Tx, e domain.Event) error {
+	if s.cfg.Journal == nil {
+		return nil
+	}
+	return s.cfg.Journal(ctx, tx, e)
+}
+
 // Seals and Revisions answer core's verifier and minter from the store.
 func (s *Service) Seals() workcontext.SealSource         { return s.src }
 func (s *Service) Revisions() workcontext.RevisionSource { return s.src }
diff --git a/libraries/authority-core/go/authority/transfer.go b/libraries/authority-core/go/authority/transfer.go
index c004b8ac..59ed1364 100644
--- a/libraries/authority-core/go/authority/transfer.go
+++ b/libraries/authority-core/go/authority/transfer.go
@@ -130,7 +130,8 @@ func (s *Service) AuthorizeTransfer(ctx context.Context, r TransferRequest) (Tra
 			return err
 		}
 		decision = TransferDecision{PrincipalID: r.To, AuthorizedBy: p.ID}
-		return nil
+		return s.journal(ctx, tx, domain.Event{Kind: domain.ResourceTransferred, Organization: target.Organization, Actor: p.ID, Subject: target.ID,
+			Detail: map[string]string{"kind": r.Kind, "resource": r.ResourceID, "from": r.From, "to": r.To, "store": r.Store.Module}})
 	})
 	return decision, err
 }
diff --git a/libraries/authority-core/go/domain/domain.go b/libraries/authority-core/go/domain/domain.go
index b7fb1dca..21639b98 100644
--- a/libraries/authority-core/go/domain/domain.go
+++ b/libraries/authority-core/go/domain/domain.go
@@ -194,3 +194,36 @@ type ConsentReceipt struct {
 	OperationID, Intent string
 	Revision            uint64
 }
+
+// EventKind names one change of authority the core makes.
+type EventKind string
+
+// The changes a host journals.
+const (
+	ModuleApplied           EventKind = "module.applied"
+	ModuleWithdrawn         EventKind = "module.withdrawn"
+	InstallationRequested   EventKind = "installation.requested"
+	InstallationActivated   EventKind = "installation.activated"
+	InstallationUninstalled EventKind = "installation.uninstalled"
+	RoleGranted             EventKind = "role.granted"
+	RoleRevoked             EventKind = "role.revoked"
+	DelegationGranted       EventKind = "delegation.granted"
+	DelegationRevoked       EventKind = "delegation.revoked"
+	ResourceAttached        EventKind = "resource.attached"
+	ResourceDetached        EventKind = "resource.detached"
+	ResourceTransferred     EventKind = "resource.transferred"
+)
+
+// Event is one change of authority, journaled by the host in the transaction
+// that makes it: the journal and the change commit together or not at all.
+type Event struct {
+	Kind EventKind
+	// Organization is where it happened; empty for a module's delivery.
+	Organization string
+	// Actor is the person who acted, or the module whose workload did; empty
+	// for the host's own setup and a delivery.
+	Actor string
+	// Subject is what changed: an installation, a delegation, a module.
+	Subject string
+	Detail  map[string]string
+}

From 827d29c41aa1e0f3d60d735b523753a346777d8c Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Mon, 26 Oct 2026 20:30:25 -0400
Subject: [PATCH 05/16] feat(authority-core): read a composed module as
 delivered

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 libraries/authority-core/go/authority/lifecycle.go     | 10 ++++++++++
 .../go/authority/organization_added_test.go            | 10 ++++++++++
 2 files changed, 20 insertions(+)

diff --git a/libraries/authority-core/go/authority/lifecycle.go b/libraries/authority-core/go/authority/lifecycle.go
index 1121dbfd..efd261a5 100644
--- a/libraries/authority-core/go/authority/lifecycle.go
+++ b/libraries/authority-core/go/authority/lifecycle.go
@@ -521,3 +521,13 @@ func (s *Service) Installations(ctx context.Context, caller Person, org string)
 	})
 	return out, err
 }
+
+// Composed answers a composed module by name, as its delivery declared it.
+func (s *Service) Composed(ctx context.Context, name string) (domain.Module, error) {
+	var m domain.Module
+	err := s.store.Read(ctx, func(tx Tx) (err error) {
+		m, err = tx.ModuleNamed(name)
+		return notFound(err)
+	})
+	return m, err
+}
diff --git a/libraries/authority-core/go/authority/organization_added_test.go b/libraries/authority-core/go/authority/organization_added_test.go
index 659e8248..33bf6cff 100644
--- a/libraries/authority-core/go/authority/organization_added_test.go
+++ b/libraries/authority-core/go/authority/organization_added_test.go
@@ -92,3 +92,13 @@ func TestTheHostGrantsARoleAsTheAdministratorWould(t *testing.T) {
 		t.Fatalf("the team's role is held: %v", err)
 	}
 }
+
+func TestAComposedModuleReadsAsDelivered(t *testing.T) {
+	h := newHarness(t)
+	m, err := h.svc.Composed(h.ctx, "a")
+	if err != nil || m.Principal != "a" || m.Kind != domain.KindSolution || len(m.Roles) != 4 {
+		t.Fatalf("composed %+v %v", m, err)
+	}
+	_, err = h.svc.Composed(h.ctx, "absent")
+	code(t, err, domain.NotFound)
+}

From 7d2dfd1db934169b0cfadb2c83d2b5e101b87070 Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Mon, 26 Oct 2026 20:36:46 -0400
Subject: [PATCH 06/16] feat(authority-core): a delegation is to an installed
 module with a bounded purpose, and an administrator may end it

A delegation names a module installed at the grantor's organization (nothing
could issue from one to a module installed nowhere there) and a purpose of at
most 1024 characters. Its grantor or an administrator of its organization,
acting there, ends it; anyone else learns nothing of it, not even that it
exists (NotFound, no longer a Denied that confirmed it).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../authority-core/go/authority/delegation.go | 25 ++++++-
 .../go/authority/delegation_rules_test.go     | 67 +++++++++++++++++++
 .../pkg/business/issuer/delegation_test.go    |  4 +-
 3 files changed, 92 insertions(+), 4 deletions(-)
 create mode 100644 libraries/authority-core/go/authority/delegation_rules_test.go

diff --git a/libraries/authority-core/go/authority/delegation.go b/libraries/authority-core/go/authority/delegation.go
index 9594bf85..c7272151 100644
--- a/libraries/authority-core/go/authority/delegation.go
+++ b/libraries/authority-core/go/authority/delegation.go
@@ -2,6 +2,7 @@ package authority
 
 import (
 	"context"
+	"errors"
 
 	"github.com/codefly-dev/authority/libraries/authority-core/go/decide"
 	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
@@ -26,6 +27,14 @@ func (s *Service) Delegate(ctx context.Context, who Person, module string, scope
 		if len(scopes) == 0 {
 			return domain.Refuse("a delegation names what it grants")
 		}
+		if len(purpose) > MaxDelegationPurpose {
+			return domain.Malformed("a delegation's purpose is at most %d characters, not %d", MaxDelegationPurpose, len(purpose))
+		}
+		// A module not installed at the grantor's organization could never
+		// issue from the delegation: it is refused rather than recorded.
+		if inst, err := installationOf(tx, p.Organization, m.Name); err != nil || inst.Status != domain.Active {
+			return domain.NotNow("module %q is not installed in organization %s, so nothing could issue from a delegation to it", m.Name, p.Organization)
+		}
 		holdings, err := held(tx, p, m)
 		if err != nil {
 			return err
@@ -60,8 +69,12 @@ func (s *Service) Delegate(ctx context.Context, who Person, module string, scope
 	return d, err
 }
 
-// RevokeDelegation ends a delegation; only its grantor may. Its capabilities
-// are refused at once.
+// MaxDelegationPurpose bounds the purpose a delegation records.
+const MaxDelegationPurpose = 1024
+
+// RevokeDelegation ends a delegation: its grantor may, and so may an
+// administrator of its organization acting there. Anyone else learns nothing,
+// not even that it exists. Its capabilities are refused at once.
 func (s *Service) RevokeDelegation(ctx context.Context, who Person, id string) (domain.Delegation, error) {
 	var d domain.Delegation
 	err := s.store.Write(ctx, func(tx Tx) error {
@@ -70,7 +83,13 @@ func (s *Service) RevokeDelegation(ctx context.Context, who Person, id string) (
 			return notFound(err)
 		}
 		if d.Grantor != who.ID {
-			return domain.Refuse("only the grantor of %s may revoke it", id)
+			admin, err := memberAs(tx, who, d.Organization)
+			if err != nil && !errors.Is(err, domain.ErrNotFound) {
+				return err
+			}
+			if err != nil || !decide.IsAdministrator(admin) {
+				return domain.Missing("delegation %q", id)
+			}
 		}
 		if d.Revoked {
 			return nil
diff --git a/libraries/authority-core/go/authority/delegation_rules_test.go b/libraries/authority-core/go/authority/delegation_rules_test.go
new file mode 100644
index 00000000..64126e39
--- /dev/null
+++ b/libraries/authority-core/go/authority/delegation_rules_test.go
@@ -0,0 +1,67 @@
+package authority_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/authority"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+)
+
+// A delegation is to a module installed at the grantor's organization, with a
+// bounded purpose; its grantor or an administrator of its organization ends
+// it, and anyone else learns nothing of it.
+func TestDelegationRules(t *testing.T) {
+	h := newHarness(t)
+	read := []*basev0.WorkScopeV1{sc(kind, "read")}
+	rob := h.person("rob")
+
+	t.Run("a purpose past its bound is malformed", func(t *testing.T) {
+		_, err := h.svc.Delegate(h.ctx, rob, "store", read, strings.Repeat("p", authority.MaxDelegationPurpose+1))
+		code(t, err, domain.Invalid)
+	})
+	t.Run("a module not installed at the grantor's organization is refused", func(t *testing.T) {
+		if err := h.svc.UninstallAsHost(h.ctx, acme, authority.StableInstallationID(acme, "store")); err != nil {
+			t.Fatal(err)
+		}
+		_, err := h.svc.Delegate(h.ctx, rob, "store", read, "a job")
+		code(t, err, domain.Precondition)
+		refused(t, err, "is not installed")
+	})
+}
+
+func TestADelegationIsEndedByItsGrantorOrAnAdministratorAlone(t *testing.T) {
+	h := newHarness(t)
+	read := []*basev0.WorkScopeV1{sc(kind, "read")}
+	rob, maya, alex, zoe := h.person("rob"), h.person("maya"), h.person("alex"), h.person("zoe")
+	for _, tc := range []struct {
+		name   string
+		who    authority.Person
+		ok     bool
+		reason domain.Code
+	}{
+		{"another member", maya, false, domain.NotFound},
+		{"another organization's administrator", zoe, false, domain.NotFound},
+		{"an administrator of its organization", alex, true, 0},
+		{"its grantor", rob, true, 0},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			d, err := h.svc.Delegate(h.ctx, rob, "store", read, "a job")
+			if err != nil {
+				t.Fatal(err)
+			}
+			ended, err := h.svc.RevokeDelegation(h.ctx, tc.who, d.ID)
+			if !tc.ok {
+				code(t, err, tc.reason)
+				return
+			}
+			if err != nil || !ended.Revoked {
+				t.Fatalf("revoked %+v %v", ended, err)
+			}
+			if again, err := h.svc.RevokeDelegation(h.ctx, tc.who, d.ID); err != nil || !again.Revoked {
+				t.Fatalf("revoking twice answers the delegation as it stands: %+v %v", again, err)
+			}
+		})
+	}
+}
diff --git a/modules/authority/services/local/code/pkg/business/issuer/delegation_test.go b/modules/authority/services/local/code/pkg/business/issuer/delegation_test.go
index a9b32d29..586359af 100644
--- a/modules/authority/services/local/code/pkg/business/issuer/delegation_test.go
+++ b/modules/authority/services/local/code/pkg/business/issuer/delegation_test.go
@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"gateway/pkg/business/issuer"
+	"gateway/pkg/business/state"
 	"gateway/pkg/business/testkit"
 	authorityv1 "gateway/pkg/gen/host/authority/v1"
 )
@@ -81,7 +82,8 @@ func TestADelegationIssuesAsItsGrantorUntilRevoked(t *testing.T) {
 	if _, err := issue("documents"); !errors.Is(err, issuer.ErrRefused) {
 		t.Fatalf("another module presents the delegation: %v", err)
 	}
-	if _, err := k.Issuer.RevokeDelegation(person(t, k, "fixture-maya"), d.ID); !errors.Is(err, issuer.ErrRefused) {
+	// Someone else, neither its grantor nor an administrator, learns nothing of it.
+	if _, err := k.Issuer.RevokeDelegation(person(t, k, "fixture-maya"), d.ID); !errors.Is(err, state.ErrUnknown) {
 		t.Fatalf("someone else revokes it: %v", err)
 	}
 	if _, err := k.Issuer.RevokeDelegation(remi, d.ID); err != nil {

From f8e81ae7a857681b86e4255da5efde6bcb7c3e62 Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Mon, 26 Oct 2026 21:06:16 -0400
Subject: [PATCH 07/16] test(conformance): every installation call stays in its
 organization, and only the hop registers an admission key

Two cases every host now runs: an administrator acts on no organization but
the session's (Review, Install, List, ListRoleGrants, GrantRole, RevokeRole),
an absent installation answers as a foreign one, a module nobody composed is
NotFound by name, and another organization's delegation is never read or
ended; and only the hop registers an admission key, published once among the
admission keys with the hop-admission purpose and never among the Work
Context keys, renewed by registering it again, refused by name to another
workload and for a key that is not 32 bytes. Fixture gains OtherAdminToken and
HopCredential; the local authority passes both (49 cases).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 libraries/conformance/go/conformance.go       |   7 +
 libraries/conformance/go/go.mod               |   2 +-
 libraries/conformance/go/go.sum               |   4 +-
 libraries/conformance/go/isolation.go         | 129 ++++++++++++++++++
 modules/authority/services/local/code/go.mod  |   2 +-
 modules/authority/services/local/code/go.sum  |   4 +-
 .../registry_test/local_authority_test.go     |   8 +-
 7 files changed, 147 insertions(+), 9 deletions(-)
 create mode 100644 libraries/conformance/go/isolation.go

diff --git a/libraries/conformance/go/conformance.go b/libraries/conformance/go/conformance.go
index 6c397e18..b809d92f 100644
--- a/libraries/conformance/go/conformance.go
+++ b/libraries/conformance/go/conformance.go
@@ -60,6 +60,11 @@ type Fixture struct {
 	Lifecycle *InstallationLifecycleCase
 	// OwnerToken is a member with the organization owner role, not admin.
 	OwnerToken string
+	// OtherAdminToken signs in an administrator of another organization.
+	OtherAdminToken string
+	// HopCredential is the workload credential of the composition's hop, the
+	// one workload that registers admission keys.
+	HopCredential string
 
 	// SolutionTools exercises a module binding to a solution with distinct person entitlements.
 	SolutionTools *SolutionToolsCase
@@ -833,6 +838,8 @@ func Run(t *testing.T, conn grpc.ClientConnInterface, descriptors []byte, f Fixt
 	})
 	c.resourceMethod(t, ctx, f)
 	c.installationLifecycle(t, ctx, f)
+	c.organizationIsolation(t, ctx, f)
+	c.admissionKeys(t, ctx, f)
 }
 
 // scopeActions is a context's actions on kind, comma-joined.
diff --git a/libraries/conformance/go/go.mod b/libraries/conformance/go/go.mod
index 2b37d00c..a102e95a 100644
--- a/libraries/conformance/go/go.mod
+++ b/libraries/conformance/go/go.mod
@@ -3,7 +3,7 @@ module github.com/codefly-dev/authority/libraries/conformance/go
 go 1.27.3
 
 require (
-	github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026180113-c5b5e23960ab
+	github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026193714-49101ae11a7f
 	github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261023203940-e720ad2851c7
 	github.com/codefly-dev/core v0.19.7-0.20261026092055-b23dc13543b2
 	github.com/google/uuid v1.6.0
diff --git a/libraries/conformance/go/go.sum b/libraries/conformance/go/go.sum
index a665ca1f..1aeb7d2c 100644
--- a/libraries/conformance/go/go.sum
+++ b/libraries/conformance/go/go.sum
@@ -28,8 +28,8 @@ github.com/cheggaaa/pb/v3 v3.2.1 h1:aprZbFRG+B7+ug76S8QZ6Y1PW168UHzOmbC3wa+aU6I=
 github.com/cheggaaa/pb/v3 v3.2.1/go.mod h1:U9hSVxoKqJrZIE3PkFG1xXXNaK/Ilzg+EF/scpXzEdw=
 github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
-github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026180113-c5b5e23960ab h1:2c2+mvN0H0AvfH0gSLR8Iyi/WqP31TX8uE3IV64mpDk=
-github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026180113-c5b5e23960ab/go.mod h1:4hRjiWuJOKzrEk8AS87pbWCbpiEmhEvQBGQaJo5Hmkg=
+github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026193714-49101ae11a7f h1:XIIL76qWDaSv0QWQX7AKgihTQU073x1aM9/QQBE39ls=
+github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026193714-49101ae11a7f/go.mod h1:4hRjiWuJOKzrEk8AS87pbWCbpiEmhEvQBGQaJo5Hmkg=
 github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261023203940-e720ad2851c7 h1:7vdTj6aLQVyFf0MWWgUnR/otX1v9xN6AbFKC2cHrQjE=
 github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261023203940-e720ad2851c7/go.mod h1:1rmjrVyr0h7zOuwOHS9i+BoeS9dr3XNvtupLZFwY6As=
 github.com/codefly-dev/core v0.19.7-0.20261026092055-b23dc13543b2 h1:I1wL0ANXhTdQuEAnxXF+s4+rKILlBu/QHILq4Skyi3I=
diff --git a/libraries/conformance/go/isolation.go b/libraries/conformance/go/isolation.go
new file mode 100644
index 00000000..9cf16ee5
--- /dev/null
+++ b/libraries/conformance/go/isolation.go
@@ -0,0 +1,129 @@
+package conformance
+
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/sha256"
+	"testing"
+
+	"github.com/codefly-dev/authority/libraries/authority-client/go/stamp"
+	"google.golang.org/grpc/codes"
+)
+
+// organizationIsolation: an administrator acts on no organization but their
+// session's, and an installation the request's organization does not hold
+// answers alike whether another organization holds it or nobody does, so no
+// caller learns which installations exist. A module nobody composed is
+// NotFound by name wherever it is named.
+func (c *client) organizationIsolation(t *testing.T, ctx context.Context, f Fixture) {
+	t.Run("every installation call stays inside the caller's organization, and an absent installation answers as a foreign one", func(t *testing.T) {
+		if f.InstalledSolution == "" {
+			t.Fatal("required conformance fixture missing: an active installation")
+		}
+		admin := as(ctx, c.must(t, ctx, "host.session.v1.SessionService", "SignIn", map[string]any{"fixture_token": f.AdminToken}))
+		const foreign, absent = "conformance-another-org", "conformance-absent-installation"
+		person := str(c.must(t, ctx, "host.session.v1.SessionService", "SignIn", map[string]any{"fixture_token": f.ViewerToken}), "person_id")
+		for _, tc := range []struct {
+			name, method string
+			fields       map[string]any
+			reason       string
+		}{
+			{"review at another organization", "Review", map[string]any{"organization_id": foreign, "target": f.InstalledAudience}, "organization"},
+			{"install at another organization", "Install", map[string]any{"organization_id": foreign, "target": f.InstalledAudience, "role": "viewer"}, "organization"},
+			{"list another organization", "List", map[string]any{"organization_id": foreign}, "organization"},
+			{"grants at another organization", "ListRoleGrants", map[string]any{"organization_id": foreign, "installation_id": f.InstalledSolution}, "organization"},
+			{"grant at another organization", "GrantRole", map[string]any{"organization_id": foreign, "installation_id": f.InstalledSolution, "role": "viewer", "person_id": person}, "organization"},
+			{"revoke at another organization", "RevokeRole", map[string]any{"organization_id": foreign, "installation_id": f.InstalledSolution, "role": "viewer", "person_id": person}, "organization"},
+			{"grants of an absent installation", "ListRoleGrants", map[string]any{"organization_id": f.Organization, "installation_id": absent}, "another organization"},
+			{"grant on an absent installation", "GrantRole", map[string]any{"organization_id": f.Organization, "installation_id": absent, "role": "viewer", "person_id": person}, "another organization"},
+			{"revoke on an absent installation", "RevokeRole", map[string]any{"organization_id": f.Organization, "installation_id": absent, "role": "viewer", "person_id": person}, "another organization"},
+		} {
+			t.Run(tc.name, func(t *testing.T) {
+				_, err := c.call(admin, "host.installation.v1.InstallationService", tc.method, tc.fields)
+				refused(t, err, codes.PermissionDenied, tc.reason)
+			})
+		}
+		t.Run("a module nobody composed is named as such", func(t *testing.T) {
+			viewer := as(ctx, c.must(t, ctx, "host.session.v1.SessionService", "SignIn", map[string]any{"fixture_token": f.ViewerToken}))
+			_, err := c.call(viewer, "host.authority.v1.AuthorityService", "Delegate", map[string]any{"module": "conformance-not-composed", "purpose": "a job",
+				"scopes": []any{map[string]any{"resource_kind": f.ReadKind, "actions": []any{"read"}}}})
+			refused(t, err, codes.NotFound, "conformance-not-composed")
+			_, err = c.call(admin, "host.installation.v1.InstallationService", "Review", map[string]any{"organization_id": f.Organization, "target": "conformance-not-composed"})
+			refused(t, err, codes.NotFound, "conformance-not-composed")
+		})
+		t.Run("another organization's delegation is never read or ended", func(t *testing.T) {
+			if f.Delegation == nil || f.OtherAdminToken == "" {
+				t.Fatal("required conformance fixture missing: a delegation and another organization's administrator")
+			}
+			grantor := as(ctx, c.must(t, ctx, "host.session.v1.SessionService", "SignIn", map[string]any{"fixture_token": f.Delegation.Token}))
+			d := c.must(t, grantor, "host.authority.v1.AuthorityService", "Delegate", map[string]any{"module": f.Delegation.Module, "purpose": "isolation",
+				"scopes": []any{map[string]any{"resource_kind": f.Delegation.Kind, "actions": []any{f.Delegation.Action}}}})
+			other := as(ctx, c.must(t, ctx, "host.session.v1.SessionService", "SignIn", map[string]any{"fixture_token": f.OtherAdminToken}))
+			for _, method := range []string{"GetDelegation", "RevokeDelegation"} {
+				_, err := c.call(other, "host.authority.v1.AuthorityService", method, map[string]any{"delegation_id": str(d, "delegation_id")})
+				refused(t, err, codes.NotFound, "delegation")
+			}
+			c.must(t, grantor, "host.authority.v1.AuthorityService", "RevokeDelegation", map[string]any{"delegation_id": str(d, "delegation_id")})
+		})
+	})
+}
+
+// admissionKeys: only the hop registers the key it signs call admissions with;
+// Keys publishes it among the admission keys with the hop-admission purpose,
+// never among the Work Context keys; registering it again renews the one
+// entry; any other workload, and a key that is not an Ed25519 public key, is
+// refused by name.
+func (c *client) admissionKeys(t *testing.T, ctx context.Context, f Fixture) {
+	t.Run("only the hop registers an admission key, published apart from the Work Context keys", func(t *testing.T) {
+		if f.HopCredential == "" {
+			t.Fatal("required conformance fixture missing: the hop's workload credential")
+		}
+		seed := sha256.Sum256([]byte("conformance hop admission"))
+		public := ed25519.NewKeyFromSeed(seed[:]).Public().(ed25519.PublicKey)
+		register := func(credential string, key []byte) (string, error) {
+			out, err := c.call(ctx, "host.authority.v1.AuthorityService", "RegisterAdmissionKey", map[string]any{
+				"actor": map[string]any{"credential": credential}, "public_key": key})
+			if err != nil {
+				return "", err
+			}
+			key0 := msg(out, "key")
+			if str(key0, "purpose") != stamp.Purpose {
+				t.Fatalf("a registered key's purpose is %q, want %q", str(key0, "purpose"), stamp.Purpose)
+			}
+			return str(key0, "key_id"), nil
+		}
+		id, err := register(f.HopCredential, public)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if id != stamp.KeyID(public) {
+			t.Fatalf("the registered key id is %q, want stamp.KeyID %q", id, stamp.KeyID(public))
+		}
+		again, err := register(f.HopCredential, public)
+		if err != nil || again != id {
+			t.Fatalf("registering the key again renews it: %q %v", again, err)
+		}
+		keys := c.must(t, ctx, "host.authority.v1.AuthorityService", "Keys", map[string]any{})
+		published := 0
+		for _, k := range listMsgs(keys, "admission_keys") {
+			if str(k, "key_id") == id {
+				published++
+				if str(k, "purpose") != stamp.Purpose || string(field(k, "public_key").Bytes()) != string(public) {
+					t.Fatalf("published admission key %v", k)
+				}
+			}
+		}
+		if published != 1 {
+			t.Fatalf("the hop's key is published %d times among the admission keys, want once", published)
+		}
+		for _, k := range listMsgs(keys, "keys") {
+			if str(k, "key_id") == id || str(k, "purpose") != "work-context" {
+				t.Fatalf("an admission key is never a Work Context key: %v", k)
+			}
+		}
+		_, err = register(f.WorkloadCredential, public)
+		refused(t, err, codes.PermissionDenied, "hop")
+		_, err = register(f.HopCredential, public[:16])
+		refused(t, err, codes.InvalidArgument, "32")
+	})
+}
diff --git a/modules/authority/services/local/code/go.mod b/modules/authority/services/local/code/go.mod
index ff78cb89..5f273bc3 100644
--- a/modules/authority/services/local/code/go.mod
+++ b/modules/authority/services/local/code/go.mod
@@ -7,7 +7,7 @@ require (
 	buf.build/go/protovalidate v1.4.0
 	connectrpc.com/connect v1.21.0
 	connectrpc.com/vanguard v0.4.0
-	github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026184108-e1966db4fe66
+	github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026193714-49101ae11a7f
 	github.com/codefly-dev/authority/libraries/authority-core/go v0.0.0
 	github.com/codefly-dev/authority/libraries/conformance/go v0.0.0
 	github.com/codefly-dev/authority/libraries/delivery/go v0.0.0
diff --git a/modules/authority/services/local/code/go.sum b/modules/authority/services/local/code/go.sum
index daa295ed..227d746c 100644
--- a/modules/authority/services/local/code/go.sum
+++ b/modules/authority/services/local/code/go.sum
@@ -38,8 +38,8 @@ github.com/cheggaaa/pb/v3 v3.2.1 h1:aprZbFRG+B7+ug76S8QZ6Y1PW168UHzOmbC3wa+aU6I=
 github.com/cheggaaa/pb/v3 v3.2.1/go.mod h1:U9hSVxoKqJrZIE3PkFG1xXXNaK/Ilzg+EF/scpXzEdw=
 github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
-github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026184108-e1966db4fe66 h1:hUN9kDZaqaTDJROIfQHzXOawIwKtH7mWm4dTwA0P81Q=
-github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026184108-e1966db4fe66/go.mod h1:4hRjiWuJOKzrEk8AS87pbWCbpiEmhEvQBGQaJo5Hmkg=
+github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026193714-49101ae11a7f h1:XIIL76qWDaSv0QWQX7AKgihTQU073x1aM9/QQBE39ls=
+github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026193714-49101ae11a7f/go.mod h1:4hRjiWuJOKzrEk8AS87pbWCbpiEmhEvQBGQaJo5Hmkg=
 github.com/codefly-dev/core v0.19.7-0.20261026092055-b23dc13543b2 h1:I1wL0ANXhTdQuEAnxXF+s4+rKILlBu/QHILq4Skyi3I=
 github.com/codefly-dev/core v0.19.7-0.20261026092055-b23dc13543b2/go.mod h1:1ina3kP+YSAL4tlZvnEYd4P8bFGnJECfkP86ojeeF1A=
 github.com/codefly-dev/gortk v0.2.0 h1:7bOlS5valYz2zil+fZctQNcPCYBcPj86abcw9N8h1hQ=
diff --git a/modules/authority/services/local/code/plugins/registry_test/local_authority_test.go b/modules/authority/services/local/code/plugins/registry_test/local_authority_test.go
index 4f4def99..d56059d5 100644
--- a/modules/authority/services/local/code/plugins/registry_test/local_authority_test.go
+++ b/modules/authority/services/local/code/plugins/registry_test/local_authority_test.go
@@ -177,9 +177,11 @@ people:
 			Ambiguous: conformance.WorkloadOrganizationCase{Credential: k.Credential(t, "org-directory"), Module: "org-directory", Binding: "records", Audience: "records"},
 			None:      conformance.WorkloadOrganizationCase{Credential: k.Credential(t, "runtime"), Module: "runtime", Binding: "model", Audience: "model"},
 		},
-		LocalAdvisory: true,
-		OwnerToken:    "fixture-owner",
-		SlowChecks:    true,
+		LocalAdvisory:   true,
+		OwnerToken:      "fixture-owner",
+		OtherAdminToken: "fixture-zoe",
+		HopCredential:   k.HopCredential(t),
+		SlowChecks:      true,
 		SolutionRoles: &conformance.SolutionRoleCase{
 			Solution: "wiki", Credential: k.Credential(t, "wiki"), Token: "fixture-maya", Outsider: "fixture-no-roles",
 			OwnKind: "wiki.page", OwnActions: []string{"read", "write", "publish"},

From 8093104c42fcd83781bcfe0235a39c8cbbb8783c Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Mon, 26 Oct 2026 21:10:22 -0400
Subject: [PATCH 08/16] feat(authority-core): an install of a target already
 installed names it (domain.ErrAlreadyInstalled)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 libraries/authority-core/go/authority/lifecycle.go     |  2 +-
 .../go/authority/organization_added_test.go            | 10 ++++++++++
 libraries/authority-core/go/domain/domain.go           |  4 ++++
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/libraries/authority-core/go/authority/lifecycle.go b/libraries/authority-core/go/authority/lifecycle.go
index efd261a5..9afea13b 100644
--- a/libraries/authority-core/go/authority/lifecycle.go
+++ b/libraries/authority-core/go/authority/lifecycle.go
@@ -340,7 +340,7 @@ func (s *Service) install(ctx context.Context, authorize func(Tx) error, caller
 			return nil
 		}
 		if err == nil && existing.Status != domain.Revoked {
-			return domain.Refuse("%s is already installed at %s", target, org)
+			return &domain.Refusal{Code: domain.Denied, Cause: domain.ErrAlreadyInstalled, Reason: fmt.Sprintf("%s is already installed at %s", target, org)}
 		}
 		principal := s.cfg.PrincipalID(org, target)
 		if _, err := tx.Module(principal); err == nil {
diff --git a/libraries/authority-core/go/authority/organization_added_test.go b/libraries/authority-core/go/authority/organization_added_test.go
index 33bf6cff..c1f06bfd 100644
--- a/libraries/authority-core/go/authority/organization_added_test.go
+++ b/libraries/authority-core/go/authority/organization_added_test.go
@@ -1,6 +1,7 @@
 package authority_test
 
 import (
+	"errors"
 	"testing"
 
 	"github.com/codefly-dev/authority/libraries/authority-core/go/authority"
@@ -102,3 +103,12 @@ func TestAComposedModuleReadsAsDelivered(t *testing.T) {
 	_, err = h.svc.Composed(h.ctx, "absent")
 	code(t, err, domain.NotFound)
 }
+
+func TestInstallingAnInstalledTargetNamesIt(t *testing.T) {
+	h := newHarness(t)
+	_, err := h.svc.InstallAsHost(h.ctx, acme, "a", "author", "alex", nil)
+	code(t, err, domain.Denied)
+	if !errors.Is(err, domain.ErrAlreadyInstalled) {
+		t.Fatalf("an installed target's refusal names it: %v", err)
+	}
+}
diff --git a/libraries/authority-core/go/domain/domain.go b/libraries/authority-core/go/domain/domain.go
index 21639b98..31aa67cd 100644
--- a/libraries/authority-core/go/domain/domain.go
+++ b/libraries/authority-core/go/domain/domain.go
@@ -154,6 +154,10 @@ func (r *Refusal) Unwrap() error { return r.Cause }
 // ErrNoInstallerRole names a solution that declares no installer role.
 var ErrNoInstallerRole = errors.New("a solution declares an installer role")
 
+// ErrAlreadyInstalled names an install of a target its organization holds
+// active already.
+var ErrAlreadyInstalled = errors.New("already installed")
+
 // ErrNotFound is what a store answers for a missing record.
 var ErrNotFound = errors.New("not found")
 

From 62f9b2ede5fcb7b4c0bb127e452d356768136cdc Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Mon, 26 Oct 2026 21:27:02 -0400
Subject: [PATCH 09/16] perf(authority-core): reconciling organizations writes
 only where a module installation is missing

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../authority-core/go/authority/lifecycle.go  | 39 ++++++++++++++++---
 1 file changed, 34 insertions(+), 5 deletions(-)

diff --git a/libraries/authority-core/go/authority/lifecycle.go b/libraries/authority-core/go/authority/lifecycle.go
index 9afea13b..23a23432 100644
--- a/libraries/authority-core/go/authority/lifecycle.go
+++ b/libraries/authority-core/go/authority/lifecycle.go
@@ -178,13 +178,42 @@ func (s *Service) OrganizationAdded(ctx context.Context, org string) ([]string,
 // organization created while the authority could not record it still holds
 // the modules it may use.
 func (s *Service) ReconcileOrganizations(ctx context.Context) error {
-	var orgs []domain.Organization
-	if err := s.store.Read(ctx, func(tx Tx) (err error) { orgs, err = tx.Organizations(); return err }); err != nil {
+	// One read finds the organizations missing a module installation, so a
+	// host with many organizations writes only where something is missing.
+	var missing []string
+	if err := s.store.Read(ctx, func(tx Tx) error {
+		missing = nil
+		orgs, err := tx.Organizations()
+		if err != nil {
+			return err
+		}
+		modules, err := tx.Modules()
+		if err != nil {
+			return err
+		}
+		all, err := tx.Installations("")
+		if err != nil {
+			return err
+		}
+		held := map[string]bool{}
+		for _, inst := range all {
+			held[inst.ID] = true
+		}
+		for _, org := range orgs {
+			for _, m := range modules {
+				if m.Kind != domain.KindSolution && !held[s.cfg.InstallationID(org.ID, m.Name)] {
+					missing = append(missing, org.ID)
+					break
+				}
+			}
+		}
+		return nil
+	}); err != nil {
 		return err
 	}
-	for _, org := range orgs {
-		if _, err := s.OrganizationAdded(ctx, org.ID); err != nil {
-			return fmt.Errorf("organization %s: %w", org.ID, err)
+	for _, org := range missing {
+		if _, err := s.OrganizationAdded(ctx, org); err != nil {
+			return fmt.Errorf("organization %s: %w", org, err)
 		}
 	}
 	return nil

From 8846431f503a4ed46913e2197ee4821274780c7a Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Mon, 26 Oct 2026 21:30:53 -0400
Subject: [PATCH 10/16] test(storetest): an empty id names no member

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 libraries/authority-core/go/storetest/storetest.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libraries/authority-core/go/storetest/storetest.go b/libraries/authority-core/go/storetest/storetest.go
index d0ed0557..1f0aa03c 100644
--- a/libraries/authority-core/go/storetest/storetest.go
+++ b/libraries/authority-core/go/storetest/storetest.go
@@ -125,6 +125,9 @@ func Run(t *testing.T, open Open) {
 			if _, err := tx.Member(f.orgB, f.onlyA); !errors.Is(err, domain.ErrNotFound) {
 				t.Errorf("a person is no member of an organization they do not belong to: %v", err)
 			}
+			if p, err := tx.Member(f.orgA, ""); !errors.Is(err, domain.ErrNotFound) {
+				t.Errorf("an empty id names no member, not %+v: %v", p, err)
+			}
 			return nil
 		})
 	})

From a2f1c56b172ecc17a924be0fd7bdb601becf7ef3 Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Mon, 26 Oct 2026 22:37:48 -0400
Subject: [PATCH 11/16] core: a resource-scoped organization role is issued on
 its ids, never the whole kind

decide.OrgScopes dropped RoleScope.Resources, so a person holding
collection:read on store-x alone held the whole kind at Issue: an empty
ask was issued kind-wide, an ask naming store-y was issued on store-y,
and every child inherited it. Only ListResources answered correctly, so
any module deciding from the token's claims over-granted.

OrgScopes now carries a role's ID matchers as the held scope's resource
ids (a scope naming none, or All, stays the whole kind and absorbs), so
Issue refuses any other id or the whole kind and an empty ask carries
exactly the held ids. A token cannot carry a prefix or a pattern, so one
holds only the ids the decision names (the ask, or the parent capability
of a hop or a delegation) that it matches: an empty ask carries none of
it, fail closed. held/throughSolutions pass what each decision names.

The shared suite's "which resources a context covers" case now issues on
the covered ids, requires an empty ask never to carry the kind whole, and
requires an ask naming an uncovered id (beside a covered one) or the
whole kind to be refused. Local tests that encoded the kind-wide token
are updated to the new contract; decide and authority tests cover exact
ids, asks beyond, children, patterns, whole-kind roles and mixed roles.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md                                     |  19 ++-
 .../authority-core/go/authority/delegation.go |   8 +-
 .../go/authority/delegation_rules_test.go     |   3 +-
 .../authority-core/go/authority/issue.go      |  29 +++-
 .../go/authority/journal_test.go              |   2 +-
 .../go/authority/resource_scoped_role_test.go |  43 +++++
 libraries/authority-core/go/decide/decide.go  |  59 ++++++-
 .../authority-core/go/decide/decide_test.go   |   4 +-
 .../go/decide/org_scopes_test.go              | 159 ++++++++++++++++++
 libraries/conformance/go/conformance.go       |  58 +++++--
 .../code/pkg/business/issuer/issuer_test.go   |   7 +-
 .../pkg/business/issuer/resources_test.go     |  38 ++++-
 .../pkg/business/state/composition_test.go    |  12 +-
 .../code/pkg/business/state/permissions.go    |   2 +-
 .../local/code/pkg/business/testkit/person.go |  20 ++-
 .../testkit/testdata/composition.yaml         |   6 +-
 .../local/fixture-composition.yaml            |   8 +-
 17 files changed, 408 insertions(+), 69 deletions(-)
 create mode 100644 libraries/authority-core/go/authority/resource_scoped_role_test.go
 create mode 100644 libraries/authority-core/go/decide/org_scopes_test.go

diff --git a/README.md b/README.md
index 6fec267b..c0e7c878 100644
--- a/README.md
+++ b/README.md
@@ -777,15 +777,22 @@ the suite, and by any module deciding which of its own resources a caller sees.
 The authority knows resources by id only; each module maps ids onto its own.
 
 On the local authority a role's scope may carry `resources`. A scope with
-none covers the whole kind. A person's answer is what her roles grant. A
-module's or an installation's own work is bounded by its capability alone. A
-capability narrowed to named ids covers only the ones the owner's grants also
-cover. A capability that does not hold the action is refused.
+none covers the whole kind. A scope with resources is never issued as the
+whole kind (2026-10-26): its ids are the capability's resource ids, so an ask
+naming none is issued on exactly those ids, and an ask naming any other id, or
+the whole kind, is refused, at the root and at every hop. A token cannot carry
+a prefix or a pattern, so one holds only the ids an ask (or the capability a
+hop derives from) names that it matches, and an ask naming none carries none
+of it. A person's answer is what her roles grant, cut to the ids her
+capability names. A module's or an installation's own work is bounded by its
+capability alone. A capability that does not hold the action is refused.
 
 The suite line "the authority answers which resources a context covers, by
 grant" holds an implementation to a fixture's covered and uncovered ids, an
-unheld action, and a narrowed capability. It fails on an implementation that
-answers every resource.
+unheld action, an empty ask that never carries the whole kind, and the refusal
+of an ask naming an uncovered id or the whole kind. It fails on an
+implementation that answers every resource or issues a resource-scoped role as
+the whole kind.
 
 Building it exposed an attenuation bug: the local authority's scope operations dropped
 resource ids, so a capability asked for two named resources was issued for the
diff --git a/libraries/authority-core/go/authority/delegation.go b/libraries/authority-core/go/authority/delegation.go
index c7272151..72888bde 100644
--- a/libraries/authority-core/go/authority/delegation.go
+++ b/libraries/authority-core/go/authority/delegation.go
@@ -35,7 +35,7 @@ func (s *Service) Delegate(ctx context.Context, who Person, module string, scope
 		if inst, err := installationOf(tx, p.Organization, m.Name); err != nil || inst.Status != domain.Active {
 			return domain.NotNow("module %q is not installed in organization %s, so nothing could issue from a delegation to it", m.Name, p.Organization)
 		}
-		holdings, err := held(tx, p, m)
+		holdings, err := held(tx, p, m, scopes)
 		if err != nil {
 			return err
 		}
@@ -44,12 +44,12 @@ func (s *Service) Delegate(ctx context.Context, who Person, module string, scope
 			if err != nil {
 				continue
 			}
-			there, _, _, err := throughSolutions(tx, p, target, []string{m.Principal})
+			there, _, _, err := throughSolutions(tx, p, target, []string{m.Principal}, scopes)
 			if err != nil {
 				return err
 			}
 			if m.Kind != domain.KindSolution {
-				if there, err = held(tx, p, target); err != nil {
+				if there, err = held(tx, p, target, scopes); err != nil {
 					return err
 				}
 			}
@@ -169,7 +169,7 @@ func (s *Service) IssueForDelegation(ctx context.Context, id string, actor Workl
 		if err != nil {
 			return domain.Refuse("the grantor %s is no longer a member", d.Grantor)
 		}
-		h, _, _, err := throughSolutions(tx, p, audience, []string{am.Principal})
+		h, _, _, err := throughSolutions(tx, p, audience, []string{am.Principal}, d.Scopes)
 		if err != nil {
 			return err
 		}
diff --git a/libraries/authority-core/go/authority/delegation_rules_test.go b/libraries/authority-core/go/authority/delegation_rules_test.go
index 64126e39..7ec67454 100644
--- a/libraries/authority-core/go/authority/delegation_rules_test.go
+++ b/libraries/authority-core/go/authority/delegation_rules_test.go
@@ -33,7 +33,8 @@ func TestDelegationRules(t *testing.T) {
 
 func TestADelegationIsEndedByItsGrantorOrAnAdministratorAlone(t *testing.T) {
 	h := newHarness(t)
-	read := []*basev0.WorkScopeV1{sc(kind, "read")}
+	// Rob reads store-x alone: he delegates that, never the whole kind.
+	read := []*basev0.WorkScopeV1{owned(kind, "", []string{"read"}, "store-x")}
 	rob, maya, alex, zoe := h.person("rob"), h.person("maya"), h.person("alex"), h.person("zoe")
 	for _, tc := range []struct {
 		name   string
diff --git a/libraries/authority-core/go/authority/issue.go b/libraries/authority-core/go/authority/issue.go
index 72b23cbf..47d19cf9 100644
--- a/libraries/authority-core/go/authority/issue.go
+++ b/libraries/authority-core/go/authority/issue.go
@@ -32,8 +32,9 @@ type Issued struct {
 
 // held is what a person holds at an audience: at a solution, the scopes of the
 // roles granted them on its installation, owned by its principal; at a
-// module, their organization roles within what it serves.
-func held(tx Tx, p domain.Person, audience domain.Module) (Scopes, error) {
+// module, their organization roles within what it serves, resource-scoped
+// roles holding the ids their matchers select of named (decide.OrgScopes).
+func held(tx Tx, p domain.Person, audience domain.Module, named Scopes) (Scopes, error) {
 	if audience.Kind == domain.KindSolution {
 		inst, err := installationOf(tx, p.Organization, audience.Name)
 		if errors.Is(err, domain.ErrNotFound) {
@@ -56,7 +57,7 @@ func held(tx Tx, p domain.Person, audience domain.Module) (Scopes, error) {
 	if err != nil {
 		return nil, err
 	}
-	return decide.OrgScopes(roles, audience), nil
+	return decide.OrgScopes(roles, audience, named), nil
 }
 
 // solutionCeiling intersects the current roles of each solution the verified
@@ -101,18 +102,18 @@ func solutionCeiling(tx Tx, p domain.Person, principals []string) (ceiling Scope
 // throughSolutions is what a person holds at audience on a path through
 // principals: the solutions' roles alone when a solution is on the path
 // (confined to its principal's data), the person's own grants otherwise.
-func throughSolutions(tx Tx, p domain.Person, audience domain.Module, principals []string) (h, ceiling Scopes, bounded bool, err error) {
+func throughSolutions(tx Tx, p domain.Person, audience domain.Module, principals []string, named Scopes) (h, ceiling Scopes, bounded bool, err error) {
 	if ceiling, bounded, err = solutionCeiling(tx, p, principals); err != nil {
 		return
 	}
 	if !bounded {
-		h, err = held(tx, p, audience)
+		h, err = held(tx, p, audience, named)
 		return
 	}
 	h = scope.Intersect(ceiling, audience.ResourceKinds)
 	if audience.Kind == domain.KindSolution {
 		var target Scopes
-		if target, err = held(tx, p, audience); err != nil {
+		if target, err = held(tx, p, audience, named); err != nil {
 			return
 		}
 		h = scope.Intersect(h, target)
@@ -120,6 +121,16 @@ func throughSolutions(tx Tx, p domain.Person, audience domain.Module, principals
 	return
 }
 
+// namedBy is what a hop decides about: its ask and every scope its parent
+// carries, so a prefix or a pattern holds the ids the parent was issued on.
+func namedBy(asked Scopes, parent *basev0.WorkContextV1) Scopes {
+	named := append(slices.Clone(asked), parent.GetAuthorityScopes()...)
+	for _, actor := range parent.GetActorChain() {
+		named = append(named, actor.GetGrantedScopes()...)
+	}
+	return named
+}
+
 // solutionPrincipals are the current actor and the services of a verified chain.
 func solutionPrincipals(wc *basev0.WorkContextV1, current string) []string {
 	out := []string{current}
@@ -192,7 +203,7 @@ func (s *Service) IssueForPerson(ctx context.Context, who Person, r IssueRequest
 		if f, err = s.src.fenceIn(tx, p.Organization, p.ID, inst.ID); err != nil {
 			return err
 		}
-		if heldHere, err = held(tx, p, audience); err != nil {
+		if heldHere, err = held(tx, p, audience, r.Scopes); err != nil {
 			return err
 		}
 		if audience.Kind == domain.KindSolution && !audience.OwnerAware {
@@ -210,7 +221,7 @@ func (s *Service) IssueForPerson(ctx context.Context, who Person, r IssueRequest
 			if err != nil {
 				return notFound(err)
 			}
-			there, _, _, err := throughSolutions(tx, p, target, []string{audience.Principal})
+			there, _, _, err := throughSolutions(tx, p, target, []string{audience.Principal}, r.Scopes)
 			if err != nil {
 				return err
 			}
@@ -479,7 +490,7 @@ func (s *Service) IssueChild(ctx context.Context, parent string, actor Workload,
 			if err != nil {
 				return domain.Refuse("the owner %s is no longer a member", claims.GetOwnerPrincipalId())
 			}
-			if heldHere, sourceCeiling, bounded, err = throughSolutions(tx, p, audience, solutionPrincipals(claims, am.Principal)); err != nil {
+			if heldHere, sourceCeiling, bounded, err = throughSolutions(tx, p, audience, solutionPrincipals(claims, am.Principal), namedBy(r.Scopes, claims)); err != nil {
 				return err
 			}
 		case "agent":
diff --git a/libraries/authority-core/go/authority/journal_test.go b/libraries/authority-core/go/authority/journal_test.go
index 6a9ac3ab..ac9272e7 100644
--- a/libraries/authority-core/go/authority/journal_test.go
+++ b/libraries/authority-core/go/authority/journal_test.go
@@ -43,7 +43,7 @@ func TestEveryChangeIsJournaledInItsOwnTransaction(t *testing.T) {
 		{"a role revoked", func() error { _, err := svc.RevokeRole(h.ctx, alex, viewer); return err },
 			domain.Event{Kind: domain.RoleRevoked, Organization: acme, Actor: "alex", Subject: inst}},
 		{"a delegation granted", func() error {
-			_, err := svc.Delegate(h.ctx, h.person("rob"), "store", []*basev0.WorkScopeV1{sc(kind, "read")}, "a purpose")
+			_, err := svc.Delegate(h.ctx, h.person("rob"), "store", []*basev0.WorkScopeV1{owned(kind, "", []string{"read"}, "store-x")}, "a purpose")
 			return err
 		}, domain.Event{Kind: domain.DelegationGranted, Organization: acme, Actor: "rob"}},
 		{"an installation uninstalled", func() error { return svc.Uninstall(h.ctx, alex, acme, inst) },
diff --git a/libraries/authority-core/go/authority/resource_scoped_role_test.go b/libraries/authority-core/go/authority/resource_scoped_role_test.go
new file mode 100644
index 00000000..3404dafa
--- /dev/null
+++ b/libraries/authority-core/go/authority/resource_scoped_role_test.go
@@ -0,0 +1,43 @@
+package authority_test
+
+import (
+	"testing"
+
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+)
+
+// Rob reads store-x alone through his organization role. What he is issued,
+// and every hop below it, names store-x and nothing else of the kind: a
+// module deciding from the token's claims never sees the whole kind.
+func TestAResourceScopedOrganizationRoleIssuesItsIDsAlone(t *testing.T) {
+	h := newHarness(t)
+	read := []string{"read"}
+	ids := func(of ...string) *basev0.WorkScopeV1 { return owned(kind, "", read, of...) }
+
+	root := h.must(h.root("rob", "store"))
+	exactly(t, root, kind, "", read, "store-x")
+	if err := h.check(root); err != nil {
+		t.Fatal(err)
+	}
+	grants, err := h.svc.ListResources(h.ctx, root.Token, "store", kind, "read")
+	if err != nil || len(grants) != 1 || grants[0].ID != "store-x" {
+		t.Fatalf("listed %v %v", grants, err)
+	}
+
+	for name, ask := range map[string]*basev0.WorkScopeV1{
+		"another id":         ids("store-y"),
+		"a held and another": ids("store-x", "store-y"),
+		"the whole kind":     sc(kind, "read"),
+	} {
+		t.Run("an ask naming "+name+" is refused", func(t *testing.T) {
+			_, err := h.root("rob", "store", ask)
+			refused(t, err, "widens")
+		})
+		t.Run("a child naming "+name+" is refused", func(t *testing.T) {
+			_, err := h.hop(root, "self", ask)
+			refused(t, err, "widens")
+		})
+	}
+	exactly(t, h.must(h.hop(root, "self")), kind, "", read, "store-x")
+	exactly(t, h.must(h.root("rob", "store", ids("store-x"))), kind, "", read, "store-x")
+}
diff --git a/libraries/authority-core/go/decide/decide.go b/libraries/authority-core/go/decide/decide.go
index e30025c7..c137347d 100644
--- a/libraries/authority-core/go/decide/decide.go
+++ b/libraries/authority-core/go/decide/decide.go
@@ -23,23 +23,72 @@ func IsAdministrator(p domain.Person) bool {
 
 // OrgScopes is what a person's organization roles grant at audience: the
 // union of their scopes (AnyKind spanning every served kind) within what the
-// audience serves. Resource matchers are ListResources' (ResourceGrants).
-func OrgScopes(roles []domain.OrgRole, audience domain.Module) Scopes {
+// audience serves. A role scope naming no resource holds the whole kind; one
+// naming resources holds exactly the ids its matchers select (heldIDs), never
+// the whole kind, so Issue refuses an ask naming any other id and an empty
+// ask carries those ids. named is what the decision is about: the ask, and
+// the capability a hop or a delegation derives from.
+func OrgScopes(roles []domain.OrgRole, audience domain.Module, named Scopes) Scopes {
 	var held Scopes
 	for _, role := range roles {
 		for _, sc := range role.Scopes {
+			kinds := []string{sc.Kind}
 			if sc.Kind == scope.AnyKind {
+				kinds = kinds[:0]
 				for _, kind := range audience.ResourceKinds {
-					held = append(held, &basev0.WorkScopeV1{ResourceKind: kind.GetResourceKind(), Actions: slices.Clone(sc.Actions)})
+					kinds = append(kinds, kind.GetResourceKind())
 				}
-				continue
 			}
-			held = append(held, &basev0.WorkScopeV1{ResourceKind: sc.Kind, Actions: slices.Clone(sc.Actions)})
+			for _, kind := range kinds {
+				ids, all := heldIDs(sc.Resources, kind, named)
+				if !all && len(ids) == 0 {
+					// No row: a row naming no id is the whole kind.
+					continue
+				}
+				held = append(held, &basev0.WorkScopeV1{ResourceKind: kind, Actions: slices.Clone(sc.Actions), ResourceIds: ids})
+			}
 		}
 	}
 	return scope.Intersect(scope.Normalize(held), audience.ResourceKinds)
 }
 
+// heldIDs is what a role scope's matchers hold of kind: every resource when
+// they name none or All; otherwise each ID matcher's id, and of a prefix or a
+// pattern only the ids named on kind that it matches. A token cannot carry a
+// prefix or a pattern, and carrying it as the whole kind would hand a module
+// reading the token every resource of the kind, so an ask naming no id holds
+// none of it: the person names the ids they act on. Matchers that do not
+// compile hold nothing.
+func heldIDs(grants []resources.Grant, kind string, named Scopes) (ids []string, all bool) {
+	if len(grants) == 0 {
+		return nil, true
+	}
+	m, err := resources.Compile(grants)
+	if err != nil {
+		return nil, false
+	}
+	if m.All() {
+		return nil, true
+	}
+	for _, g := range grants {
+		if g.ID != "" {
+			ids = append(ids, g.ID)
+		}
+	}
+	for _, sc := range named {
+		if sc.GetResourceKind() != kind {
+			continue
+		}
+		for _, id := range sc.GetResourceIds() {
+			if m.Matches(id) {
+				ids = append(ids, id)
+			}
+		}
+	}
+	slices.Sort(ids)
+	return slices.Compact(ids), false
+}
+
 // ResourceGrants are the resource matchers of every organization-role scope
 // holding action on kind, or every resource for a scope that names none.
 func ResourceGrants(roles []domain.OrgRole, kind, action string) []resources.Grant {
diff --git a/libraries/authority-core/go/decide/decide_test.go b/libraries/authority-core/go/decide/decide_test.go
index 94fca055..8c4049e2 100644
--- a/libraries/authority-core/go/decide/decide_test.go
+++ b/libraries/authority-core/go/decide/decide_test.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/codefly-dev/authority/libraries/authority-core/go/decide"
 	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/scope"
 	resources "github.com/codefly-dev/authority/libraries/resources/go"
 	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
 )
@@ -217,7 +218,8 @@ func TestATransferIsDecidedInOrder(t *testing.T) {
 func TestOrganizationGrantsAndModules(t *testing.T) {
 	audience := domain.Module{ResourceKinds: []*basev0.WorkScopeV1{sc("doc", "read", "admin")}}
 	roles := []domain.OrgRole{{Name: "r", Scopes: []domain.RoleScope{{Kind: "*", Actions: []string{"read"}}, {Kind: "doc", Actions: []string{"admin"}, Resources: []resources.Grant{{ID: "x"}}}}}}
-	if got := decide.OrgScopes(roles, audience); len(got) != 1 || len(got[0].GetActions()) != 2 {
+	// read holds the whole kind; admin holds x alone, never the kind.
+	if got := decide.OrgScopes(roles, audience, nil); !scope.Same(got, []*basev0.WorkScopeV1{sc("doc", "read"), owned("doc", "", []string{"admin"}, "x")}) {
 		t.Fatalf("org scopes %v", got)
 	}
 	if got := decide.ResourceGrants(roles, "doc", "admin"); len(got) != 1 || got[0].ID != "x" {
diff --git a/libraries/authority-core/go/decide/org_scopes_test.go b/libraries/authority-core/go/decide/org_scopes_test.go
new file mode 100644
index 00000000..20d8070a
--- /dev/null
+++ b/libraries/authority-core/go/decide/org_scopes_test.go
@@ -0,0 +1,159 @@
+package decide_test
+
+import (
+	"testing"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/decide"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/scope"
+	resources "github.com/codefly-dev/authority/libraries/resources/go"
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+)
+
+var store = domain.Module{Name: "store", Principal: "store", Kind: domain.KindModule,
+	ResourceKinds: []*basev0.WorkScopeV1{sc("collection", "read", "write"), sc("note", "read")}}
+
+func role(scopes ...domain.RoleScope) []domain.OrgRole {
+	return []domain.OrgRole{{Organization: "acme", Name: "r", Scopes: scopes}}
+}
+
+func collectionRead(grants ...resources.Grant) domain.RoleScope {
+	return domain.RoleScope{Kind: "collection", Actions: []string{"read"}, Resources: grants}
+}
+
+func ids(actions []string, of ...string) []*basev0.WorkScopeV1 {
+	return []*basev0.WorkScopeV1{owned("collection", "", actions, of...)}
+}
+
+func same(t *testing.T, got, want []*basev0.WorkScopeV1) {
+	t.Helper()
+	if !scope.Same(got, scope.Normalize(want)) {
+		t.Fatalf("got %v, want %v", got, want)
+	}
+}
+
+// A role naming resources by id holds exactly those ids: an empty ask is
+// issued on them, never on the whole kind.
+func TestAResourceScopedRoleHoldsExactlyItsIDs(t *testing.T) {
+	held := decide.OrgScopes(role(collectionRead(resources.Grant{ID: "store-x"}, resources.Grant{ID: "store-z"})), store, nil)
+	same(t, held, ids([]string{"read"}, "store-x", "store-z"))
+	issued, err := decide.Issue(nil, held)
+	if err != nil {
+		t.Fatal(err)
+	}
+	same(t, issued, ids([]string{"read"}, "store-x", "store-z"))
+	if issued, err = decide.Issue(ids([]string{"read"}, "store-x"), held); err != nil {
+		t.Fatal(err)
+	}
+	same(t, issued, ids([]string{"read"}, "store-x"))
+}
+
+// An ask naming any id the role does not select, or the whole kind, is
+// refused by name, even beside an id it does select.
+func TestAnAskBeyondARolesIDsIsRefused(t *testing.T) {
+	roles := role(collectionRead(resources.Grant{ID: "store-x"}))
+	for name, ask := range map[string][]*basev0.WorkScopeV1{
+		"another id":         ids([]string{"read"}, "store-y"),
+		"a held and another": ids([]string{"read"}, "store-x", "store-y"),
+		"the whole kind":     {sc("collection", "read")},
+	} {
+		t.Run(name, func(t *testing.T) {
+			_, err := decide.Issue(ask, decide.OrgScopes(roles, store, ask))
+			refused(t, err, domain.Denied, "widens")
+		})
+	}
+}
+
+// A hop's ceiling is what the person holds now, read against its ask and its
+// parent's ids: a child naming an id the person does not hold is not within it.
+func TestAChildCannotWidenAResourceScopedRole(t *testing.T) {
+	roles := role(collectionRead(resources.Grant{ID: "store-x"}))
+	parent, _ := decide.Issue(nil, decide.OrgScopes(roles, store, nil))
+	for _, ask := range [][]*basev0.WorkScopeV1{ids([]string{"read"}, "store-y"), {sc("collection", "read")}} {
+		ceiling := scope.Intersect(decide.OrgScopes(roles, store, append(ask, parent...)), parent)
+		if scope.Attenuates(ask, ceiling) {
+			t.Fatalf("a child asking %v is within %v", ask, ceiling)
+		}
+	}
+	same(t, scope.Intersect(decide.OrgScopes(roles, store, parent), parent), ids([]string{"read"}, "store-x"))
+}
+
+// A token cannot carry a prefix or a pattern, so neither ever holds the whole
+// kind: it holds only the ids an ask (or a parent) names that it matches. An
+// empty ask therefore carries none of it; this is the fail-closed choice, and
+// a person holding nothing else is refused by name.
+func TestAPatternOrPrefixRoleFailsClosed(t *testing.T) {
+	roles := role(collectionRead(resources.Grant{Prefix: "derived/"}, resources.Grant{Pattern: "shared-[a-z]+"}))
+	held := decide.OrgScopes(roles, store, nil)
+	if len(held) != 0 {
+		t.Fatalf("an empty ask holds %v of a pattern", held)
+	}
+	_, err := decide.Issue(nil, held)
+	refused(t, err, domain.Denied, "holds nothing")
+
+	ask := ids([]string{"read"}, "derived/wiki", "shared-finance")
+	issued, err := decide.Issue(ask, decide.OrgScopes(roles, store, ask))
+	if err != nil {
+		t.Fatal(err)
+	}
+	same(t, issued, ask)
+
+	ask = ids([]string{"read"}, "shared-finance", "finance")
+	_, err = decide.Issue(ask, decide.OrgScopes(roles, store, ask))
+	refused(t, err, domain.Denied, "widens")
+
+	ask = []*basev0.WorkScopeV1{sc("collection", "read")}
+	_, err = decide.Issue(ask, decide.OrgScopes(roles, store, ask))
+	refused(t, err, domain.Denied, "beyond")
+
+	// Ids named on another kind are not this kind's.
+	if held := decide.OrgScopes(roles, store, []*basev0.WorkScopeV1{owned("note", "", []string{"read"}, "shared-finance")}); len(held) != 0 {
+		t.Fatalf("a pattern holds %v from another kind's ids", held)
+	}
+	// Beside an id matcher, an empty ask carries the id alone.
+	same(t, decide.OrgScopes(role(collectionRead(resources.Grant{Pattern: "shared-[a-z]+"}, resources.Grant{ID: "store-x"})), store, nil), ids([]string{"read"}, "store-x"))
+	// A matcher that does not compile holds nothing.
+	if held := decide.OrgScopes(role(collectionRead(resources.Grant{Pattern: "(a"})), store, ask); len(held) != 0 {
+		t.Fatalf("an invalid matcher holds %v", held)
+	}
+}
+
+// A role naming no resource, or every resource, holds the whole kind as before.
+func TestAWholeKindRoleIsUnchanged(t *testing.T) {
+	for name, scopes := range map[string]domain.RoleScope{
+		"no matcher":    collectionRead(),
+		"all":           collectionRead(resources.Grant{All: true}),
+		"all and an id": collectionRead(resources.Grant{ID: "store-x"}, resources.Grant{All: true}),
+	} {
+		t.Run(name, func(t *testing.T) {
+			held := decide.OrgScopes(role(scopes), store, nil)
+			same(t, held, []*basev0.WorkScopeV1{sc("collection", "read")})
+			issued, err := decide.Issue(nil, held)
+			if err != nil {
+				t.Fatal(err)
+			}
+			same(t, issued, []*basev0.WorkScopeV1{sc("collection", "read")})
+		})
+	}
+}
+
+// One role holding the whole kind and another an id of it, for the same
+// action: the person holds the whole kind, whichever comes first.
+func TestAWholeKindRoleAbsorbsAResourceScopedOne(t *testing.T) {
+	whole, scoped := collectionRead(), collectionRead(resources.Grant{ID: "store-x"})
+	for _, roles := range [][]domain.OrgRole{
+		{{Name: "a", Scopes: []domain.RoleScope{whole}}, {Name: "b", Scopes: []domain.RoleScope{scoped}}},
+		{{Name: "b", Scopes: []domain.RoleScope{scoped}}, {Name: "a", Scopes: []domain.RoleScope{whole}}},
+	} {
+		same(t, decide.OrgScopes(roles, store, nil), []*basev0.WorkScopeV1{sc("collection", "read")})
+	}
+	// A different action keeps its own ids.
+	writes := domain.RoleScope{Kind: "collection", Actions: []string{"write"}, Resources: []resources.Grant{{ID: "store-x"}}}
+	same(t, decide.OrgScopes(role(whole, writes), store, nil), []*basev0.WorkScopeV1{sc("collection", "read"), owned("collection", "", []string{"write"}, "store-x")})
+}
+
+// A role scope on every kind naming an id holds that id on each served kind.
+func TestAnAnyKindRoleNamingIDsHoldsThemOnEachKind(t *testing.T) {
+	held := decide.OrgScopes(role(domain.RoleScope{Kind: scope.AnyKind, Actions: []string{"read"}, Resources: []resources.Grant{{ID: "x"}}}), store, nil)
+	same(t, held, []*basev0.WorkScopeV1{owned("collection", "", []string{"read"}, "x"), owned("note", "", []string{"read"}, "x")})
+}
diff --git a/libraries/conformance/go/conformance.go b/libraries/conformance/go/conformance.go
index b809d92f..97425ef9 100644
--- a/libraries/conformance/go/conformance.go
+++ b/libraries/conformance/go/conformance.go
@@ -133,8 +133,9 @@ type Hop struct {
 }
 
 // ResourceCase is one ListResources expectation: a person signed in with Token
-// and issued at Audience covers each id of Covered and none of Uncovered for
-// Action on Kind, and does not hold Unheld on Kind at all.
+// and issued at Audience on Covered covers each id of Covered and none of
+// Uncovered for Action on Kind, and does not hold Unheld on Kind at all. An
+// ask naming an id of Uncovered, or the whole kind, is refused.
 type ResourceCase struct {
 	Token     string
 	Audience  string
@@ -706,12 +707,12 @@ func Run(t *testing.T, conn grpc.ClientConnInterface, descriptors []byte, f Fixt
 			t.Fatal("required conformance fixture missing: the fixture states no resource case")
 		}
 		sess := c.must(t, ctx, "host.session.v1.SessionService", "SignIn", map[string]any{"fixture_token": rc.Token})
-		issue := func(scopes []any) string {
+		issue := func(scopes []any) (protoreflect.Message, error) {
 			fields := map[string]any{"person": map[string]any{}, "audience": rc.Audience}
 			if scopes != nil {
 				fields["scopes"] = scopes
 			}
-			return str(c.must(t, as(ctx, sess), "host.authority.v1.AuthorityService", "Issue", fields), "token")
+			return c.call(as(ctx, sess), "host.authority.v1.AuthorityService", "Issue", fields)
 		}
 		list := func(token, action string) (*resources.Matcher, error) {
 			out, err := c.call(ctx, "host.authority.v1.AuthorityService", "ListResources", map[string]any{
@@ -721,7 +722,13 @@ func Run(t *testing.T, conn grpc.ClientConnInterface, descriptors []byte, f Fixt
 			}
 			return resources.Compile(grantsOf(out))
 		}
-		covered, err := list(issue(nil), rc.Action)
+		// A context asking for the covered ids carries them: the authority
+		// answers each covered and none of the uncovered.
+		out, err := issue([]any{scopeAsk(rc.Kind, []string{rc.Action}, rc.Covered)})
+		if err != nil {
+			t.Fatalf("issue on the covered ids: %v", err)
+		}
+		covered, err := list(str(out, "token"), rc.Action)
 		if err != nil {
 			t.Fatalf("list %s:%s: %v", rc.Kind, rc.Action, err)
 		}
@@ -735,20 +742,41 @@ func Run(t *testing.T, conn grpc.ClientConnInterface, descriptors []byte, f Fixt
 				t.Errorf("%s is covered", id)
 			}
 		}
-		if _, err := list(issue(nil), rc.Unheld); status.Code(err) != codes.PermissionDenied {
+		if covered.All() {
+			t.Error("a context on named ids covers the whole kind")
+		}
+		if _, err := list(str(out, "token"), rc.Unheld); status.Code(err) != codes.PermissionDenied {
 			t.Fatalf("an action the context does not hold: %v", err)
 		}
-		if len(rc.Covered) > 0 && len(rc.Uncovered) > 0 {
-			// A context narrowed to two ids covers the one the person holds.
-			narrowed, err := list(issue([]any{map[string]any{"resource_kind": rc.Kind, "actions": []any{rc.Action},
-				"resource_ids": []any{rc.Covered[0], rc.Uncovered[0]}}}), rc.Action)
-			if err != nil {
-				t.Fatalf("narrowed: %v", err)
-			}
-			if !narrowed.Matches(rc.Covered[0]) || narrowed.Matches(rc.Uncovered[0]) || narrowed.All() {
-				t.Fatalf("a narrowed context covers exactly the held id it names")
+		// An empty ask never carries the kind whole: a module deciding from
+		// the context's claims would read it as every resource. Each row of
+		// the kind it carries names ids, none of them uncovered.
+		if out, err := issue(nil); err == nil {
+			for _, row := range listMsgs(msg(out, "context"), "authority_scopes") {
+				if str(row, "resource_kind") != rc.Kind || field(row, "actions").List().Len() == 0 {
+					continue
+				}
+				ids := field(row, "resource_ids").List()
+				if ids.Len() == 0 {
+					t.Fatalf("an empty ask carries the whole of %s", rc.Kind)
+				}
+				for i := 0; i < ids.Len(); i++ {
+					if slices.Contains(rc.Uncovered, ids.Get(i).String()) {
+						t.Fatalf("an empty ask carries %s, which the person does not hold", ids.Get(i).String())
+					}
+				}
 			}
+		} else if status.Code(err) != codes.PermissionDenied {
+			t.Fatalf("an empty ask: %v", err)
+		}
+		// An ask naming an uncovered id is refused, even beside a covered one,
+		// and so is an ask for the whole kind.
+		if len(rc.Covered) > 0 && len(rc.Uncovered) > 0 {
+			_, err := issue([]any{scopeAsk(rc.Kind, []string{rc.Action}, []string{rc.Covered[0], rc.Uncovered[0]})})
+			refused(t, err, codes.PermissionDenied, "widens")
 		}
+		_, err = issue([]any{scopeAsk(rc.Kind, []string{rc.Action}, nil)})
+		refused(t, err, codes.PermissionDenied, "what the owner holds")
 	})
 	t.Run("a lookup through a binding carries only the binding's lookup scopes", func(t *testing.T) {
 		lc := f.Lookup
diff --git a/modules/authority/services/local/code/pkg/business/issuer/issuer_test.go b/modules/authority/services/local/code/pkg/business/issuer/issuer_test.go
index 89620672..4de469b0 100644
--- a/modules/authority/services/local/code/pkg/business/issuer/issuer_test.go
+++ b/modules/authority/services/local/code/pkg/business/issuer/issuer_test.go
@@ -140,8 +140,9 @@ func TestAPersonIsIssuedWhatHerRolesHoldAtTheAudienceAndNoMore(t *testing.T) {
 	if wc.GetOwnerPrincipalId() != "maya" || wc.GetTenantId() != "acme" || wc.GetAudience() != "documents" {
 		t.Fatalf("context = %v", wc)
 	}
-	// The viewer reads documents, and reads collections at the kind: which
-	// collections is the authority's answer to ListResources, not the token's.
+	// The viewer reads documents. She reads collections only by prefix and
+	// pattern, which a token cannot carry and never carries as the whole
+	// kind: an ask naming no collection carries none.
 	got := map[string]string{}
 	for _, sc := range wc.GetAuthorityScopes() {
 		got[sc.GetResourceKind()] = strings.Join(sc.GetActions(), ",")
@@ -149,7 +150,7 @@ func TestAPersonIsIssuedWhatHerRolesHoldAtTheAudienceAndNoMore(t *testing.T) {
 			t.Fatalf("the token names no resource: %v", sc)
 		}
 	}
-	if len(got) != 2 || got["documents"] != "read" || got["documents.collection"] != "read" {
+	if len(got) != 1 || got["documents"] != "read" {
 		t.Fatalf("viewer scopes = %v", wc.GetAuthorityScopes())
 	}
 	if wc.GetSeal().GetInstallationId() != state.InstallationID("acme", "documents") {
diff --git a/modules/authority/services/local/code/pkg/business/issuer/resources_test.go b/modules/authority/services/local/code/pkg/business/issuer/resources_test.go
index b98fb72b..6aed7531 100644
--- a/modules/authority/services/local/code/pkg/business/issuer/resources_test.go
+++ b/modules/authority/services/local/code/pkg/business/issuer/resources_test.go
@@ -3,9 +3,11 @@ package issuer_test
 import (
 	"context"
 	"errors"
-	"github.com/codefly-dev/authority/libraries/authority-core/go/authority"
+	"strings"
 	"testing"
 
+	"github.com/codefly-dev/authority/libraries/authority-core/go/authority"
+
 	resources "github.com/codefly-dev/authority/libraries/resources/go"
 	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
 
@@ -41,12 +43,16 @@ func covered(t *testing.T, owned []authority.Grant) *resources.Matcher {
 	return m
 }
 
-// The authority answers which collections a person reads from her roles, now;
-// the token carries the kind alone.
+// The authority answers which collections a person reads from her roles, now.
+// Maya reads by prefix and pattern, which a token cannot carry: she names the
+// collections she acts on, and an ask naming none carries none of the kind.
 func TestTheAuthorityAnswersWhichResourcesAContextCovers(t *testing.T) {
 	k := testkit.New(t)
 	ctx := context.Background()
-	maya, err := k.Issuer.ListResources(ctx, issued(t, k, "fixture-maya", nil), "documents", "documents.collection", "read")
+	named := issued(t, k, "fixture-maya", []*authorityv1.WorkScopeV1{
+		{ResourceKind: "documents.collection", Actions: []string{"read"}, ResourceIds: []string{"derived\x1fdirectory", "shared-finance"}},
+	})
+	maya, err := k.Issuer.ListResources(ctx, named, "documents", "documents.collection", "read")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -56,24 +62,38 @@ func TestTheAuthorityAnswersWhichResourcesAContextCovers(t *testing.T) {
 			t.Errorf("maya %q: want %v", id, want)
 		}
 	}
+	if m.All() {
+		t.Error("maya reads every collection")
+	}
+	if _, err := k.Issuer.ListResources(ctx, issued(t, k, "fixture-maya", nil), "documents", "documents.collection", "read"); !errors.Is(err, issuer.ErrRefused) {
+		t.Fatalf("an ask naming no collection carried the kind: %v", err)
+	}
 	remi, err := k.Issuer.ListResources(ctx, issued(t, k, "fixture-remi", nil), "documents", "documents.collection", "read")
 	if err != nil || !covered(t, remi).All() {
 		t.Fatalf("an editor reads every collection: %v %v", remi, err)
 	}
-	if _, err := k.Issuer.ListResources(ctx, issued(t, k, "fixture-maya", nil), "documents", "documents.collection", "admin"); !errors.Is(err, issuer.ErrRefused) {
+	if _, err := k.Issuer.ListResources(ctx, named, "documents", "documents.collection", "admin"); !errors.Is(err, issuer.ErrRefused) {
 		t.Fatalf("an action the context does not hold: %v", err)
 	}
-	if _, err := k.Issuer.ListResources(ctx, issued(t, k, "fixture-maya", nil), "documents", "documents.nothing", "read"); err == nil {
+	if _, err := k.Issuer.ListResources(ctx, named, "documents", "documents.nothing", "read"); err == nil {
 		t.Fatal("a kind the module does not serve")
 	}
 }
 
-// A capability narrowed to named resources covers only those the owner's
-// grants cover: asking for an id never widens.
+// Asking for an id never widens: an ask naming one the owner's grants do not
+// cover is refused, even beside one they do, and a capability narrowed to
+// named resources covers exactly those.
 func TestANarrowedContextCoversOnlyTheIDsItNamesThatTheOwnerHolds(t *testing.T) {
 	k := testkit.New(t)
+	_, err := k.Issuer.Issue(person(t, k, "fixture-maya"), &authorityv1.IssueRequest{
+		As: &authorityv1.IssueRequest_Person{Person: &authorityv1.PersonSession{}}, Audience: "documents",
+		Scopes: []*authorityv1.WorkScopeV1{{ResourceKind: "documents.collection", Actions: []string{"read"}, ResourceIds: []string{"derived\x1fdirectory", "secret"}}},
+	})
+	if !errors.Is(err, issuer.ErrRefused) || !strings.Contains(err.Error(), "widens") {
+		t.Fatalf("an ask naming an id the owner does not hold: %v", err)
+	}
 	token := issued(t, k, "fixture-maya", []*authorityv1.WorkScopeV1{
-		{ResourceKind: "documents.collection", Actions: []string{"read"}, ResourceIds: []string{"derived\x1fdirectory", "secret"}},
+		{ResourceKind: "documents.collection", Actions: []string{"read"}, ResourceIds: []string{"derived\x1fdirectory"}},
 	})
 	grants, err := k.Issuer.ListResources(context.Background(), token, "documents", "documents.collection", "read")
 	if err != nil {
diff --git a/modules/authority/services/local/code/pkg/business/state/composition_test.go b/modules/authority/services/local/code/pkg/business/state/composition_test.go
index d0e01042..bb3447f3 100644
--- a/modules/authority/services/local/code/pkg/business/state/composition_test.go
+++ b/modules/authority/services/local/code/pkg/business/state/composition_test.go
@@ -82,10 +82,18 @@ roles:
 	if err := k.State.AdmitMethod("ledger", "/ledger/Approve", mustHeld(t, k, "remi")); err == nil {
 		t.Error("the editor was admitted to the admin's method")
 	}
-	grants, err := k.ResourceGrants(t, "maya", "ledger", "ledger.entry", "read")
-	if err != nil || len(grants) != 1 || grants[0].Prefix != "public-" {
+	// The viewer's grant keeps its prefix: she is issued an id it matches and
+	// refused one it does not, and an ask naming none carries none of it.
+	grants, err := k.ResourceGrants(t, "maya", "ledger", "ledger.entry", "read", "public-1")
+	if err != nil || len(grants) != 1 || grants[0].ID != "public-1" {
 		t.Errorf("the viewer's grant keeps its resources: %v %v", grants, err)
 	}
+	if _, err := k.ResourceGrants(t, "maya", "ledger", "ledger.entry", "read", "private-1"); err == nil || !strings.Contains(err.Error(), "what the owner holds") {
+		t.Errorf("the viewer's grant widened past its prefix: %v", err)
+	}
+	if _, err := k.ResourceGrants(t, "maya", "ledger", "ledger.entry", "read"); err == nil {
+		t.Error("an empty ask carried the viewer's prefix as the whole kind")
+	}
 	// The fixture's own vocabulary stays.
 	if scopes := k.State.RoleScopes("acme", "viewer"); !state.Attenuates([]*basev0.WorkScopeV1{testkit.Scope("console.identity", "read")}, scopes) {
 		t.Errorf("the fixture's console grant was lost: %v", scopes)
diff --git a/modules/authority/services/local/code/pkg/business/state/permissions.go b/modules/authority/services/local/code/pkg/business/state/permissions.go
index 47a2ee2c..7ccab5e5 100644
--- a/modules/authority/services/local/code/pkg/business/state/permissions.go
+++ b/modules/authority/services/local/code/pkg/business/state/permissions.go
@@ -140,7 +140,7 @@ func (s *State) PermissionReport() []string {
 			}
 		} else {
 			for _, role := range orgRoles {
-				roles[role.Name] = decide.OrgScopes([]domain.OrgRole{role}, m)
+				roles[role.Name] = decide.OrgScopes([]domain.OrgRole{role}, m, nil)
 			}
 		}
 		for method := range m.Methods {
diff --git a/modules/authority/services/local/code/pkg/business/testkit/person.go b/modules/authority/services/local/code/pkg/business/testkit/person.go
index e378ef6d..a1aa0c27 100644
--- a/modules/authority/services/local/code/pkg/business/testkit/person.go
+++ b/modules/authority/services/local/code/pkg/business/testkit/person.go
@@ -13,9 +13,10 @@ import (
 	authorityv1 "gateway/pkg/gen/host/authority/v1"
 )
 
-// PersonIssue is what person is issued at audience asking for everything
-// they hold there, through the wire: signed in by their fixture token.
-func (k *Kit) PersonIssue(t *testing.T, person, audience string) (*authorityv1.IssueResponse, error) {
+// PersonIssue is what person is issued at audience asking for scopes, or
+// everything they hold there when none, through the wire: signed in by their
+// fixture token.
+func (k *Kit) PersonIssue(t *testing.T, person, audience string, scopes ...*authorityv1.WorkScopeV1) (*authorityv1.IssueResponse, error) {
 	t.Helper()
 	token := ""
 	for _, p := range k.State.FixturePeople() {
@@ -28,7 +29,7 @@ func (k *Kit) PersonIssue(t *testing.T, person, audience string) (*authorityv1.I
 		t.Fatalf("sign in %s: %v", person, err)
 	}
 	return k.Issuer.Issue(issuer.WithSession(context.Background(), sess.ID), &authorityv1.IssueRequest{
-		As: &authorityv1.IssueRequest_Person{Person: &authorityv1.PersonSession{}}, Audience: audience})
+		As: &authorityv1.IssueRequest_Person{Person: &authorityv1.PersonSession{}}, Audience: audience, Scopes: scopes})
 }
 
 // PersonScopes is what person holds at audience now: the effective scopes of
@@ -48,10 +49,15 @@ func (k *Kit) PersonScopes(t *testing.T, person, audience string) ([]*basev0.Wor
 }
 
 // ResourceGrants is which resources of kind person may act on with action at
-// audience, as the authority answers it for their capability.
-func (k *Kit) ResourceGrants(t *testing.T, person, audience, kind, action string) ([]authority.Grant, error) {
+// audience, as the authority answers it for their capability: one asking for
+// action on ids when it names any, else for everything they hold.
+func (k *Kit) ResourceGrants(t *testing.T, person, audience, kind, action string, ids ...string) ([]authority.Grant, error) {
 	t.Helper()
-	out, err := k.PersonIssue(t, person, audience)
+	var ask []*authorityv1.WorkScopeV1
+	if len(ids) > 0 {
+		ask = append(ask, &authorityv1.WorkScopeV1{ResourceKind: kind, Actions: []string{action}, ResourceIds: ids})
+	}
+	out, err := k.PersonIssue(t, person, audience, ask...)
 	if err != nil {
 		return nil, err
 	}
diff --git a/modules/authority/services/local/code/pkg/business/testkit/testdata/composition.yaml b/modules/authority/services/local/code/pkg/business/testkit/testdata/composition.yaml
index 539f3abb..98ecc5f5 100644
--- a/modules/authority/services/local/code/pkg/business/testkit/testdata/composition.yaml
+++ b/modules/authority/services/local/code/pkg/business/testkit/testdata/composition.yaml
@@ -19,8 +19,10 @@ roles:
       - {kind: evaluation.runs, actions: [read]}
       - {kind: evaluation.online, actions: [read]}
       # A viewer reads only some document collections: the directory's, the
-      # wiki's, and every shared one. The authority answers this when asked
-      # (ListResources); the token carries the kind alone. A collection's id
+      # wiki's, and every shared one. A token cannot carry a prefix or a
+      # pattern, and never carries them as the whole kind: the viewer is issued
+      # the collections an ask names that they match, and an ask naming none
+      # carries none of the kind. A collection's id
       # is the store's namespace, "derived" and its producer joined by a unit
       # separator (\x1f).
       - kind: documents.collection
diff --git a/playground/configurations/local/fixture-composition.yaml b/playground/configurations/local/fixture-composition.yaml
index 38dc5fbd..f48c0b84 100644
--- a/playground/configurations/local/fixture-composition.yaml
+++ b/playground/configurations/local/fixture-composition.yaml
@@ -12,9 +12,11 @@ roles:
       - {kind: records.types, actions: [read]}
       - {kind: directory.entry, actions: [read]}
       # A viewer reads only some document collections: the directory's and every
-      # shared one. The authority answers this when asked (ListResources); the
-      # token carries the kind alone. A collection's id is the store's namespace,
-      # "derived" and its producer joined by a unit separator (\x1f).
+      # shared one. A token cannot carry a prefix or a pattern, and never carries
+      # them as the whole kind: the viewer is issued the collections an ask names
+      # that they match, and an ask naming none carries none of the kind. A
+      # collection's id is the store's namespace, "derived" and its producer
+      # joined by a unit separator (\x1f).
       - kind: documents.collection
         actions: [read]
         resources:

From ddc87c44d511cab4b652f389f05779bcd38e6a8e Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Mon, 26 Oct 2026 22:45:14 -0400
Subject: [PATCH 12/16] test(authority-core): current installation asks for the
 store-x its readers hold

TestCurrentInstallationIsConfinedToTheAuthenticatedAudience (from main,
#34) issued rob and omar whole-kind read though their role reads store-x
alone: the escalation the previous commit closes. The test is about
installation confinement, so each asks for what they hold.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 libraries/authority-core/go/authority/current_test.go | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/libraries/authority-core/go/authority/current_test.go b/libraries/authority-core/go/authority/current_test.go
index 1dcf7676..ee107a37 100644
--- a/libraries/authority-core/go/authority/current_test.go
+++ b/libraries/authority-core/go/authority/current_test.go
@@ -10,7 +10,8 @@ import (
 
 func TestCurrentInstallationIsConfinedToTheAuthenticatedAudience(t *testing.T) {
 	h := newHarness(t)
-	parent := h.must(h.root("rob", "store", sc(kind, "read")))
+	// rob and omar read store-x alone: each asks for what they hold.
+	parent := h.must(h.root("rob", "store", owned(kind, "", []string{"read"}, "store-x")))
 	inst, err := h.svc.CurrentInstallation(h.ctx, parent.Token, authority.Workload{Module: "store"})
 	if err != nil || inst.ID != authority.StableInstallationID(acme, "store") || inst.Organization != acme || inst.Target != "store" {
 		t.Fatalf("current installation: %+v %v", inst, err)
@@ -25,7 +26,7 @@ func TestCurrentInstallationIsConfinedToTheAuthenticatedAudience(t *testing.T) {
 	}
 	h.store.PutPerson(domain.Person{ID: "omar", Organization: globex, Roles: []string{"store-reader"}})
 	h.store.PutOrgRole(domain.OrgRole{Organization: globex, Name: "store-reader", Scopes: []domain.RoleScope{{Kind: kind, Actions: []string{"read"}, Resources: []resources.Grant{{ID: "store-x"}}}}})
-	foreign := h.must(h.root("omar", "store", sc(kind, "read")))
+	foreign := h.must(h.root("omar", "store", owned(kind, "", []string{"read"}, "store-x")))
 	other, err := h.svc.CurrentInstallation(h.ctx, foreign.Token, authority.Workload{Module: "store"})
 	if err != nil || other.Organization != globex || other.ID == inst.ID {
 		t.Fatalf("tenant isolation: %+v %v", other, err)

From b5a4a69c66b2be2691dec7a47c30551237777832 Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Mon, 26 Oct 2026 22:46:40 -0400
Subject: [PATCH 13/16] feat(authority-core): a host that installs modules by
 consent is the only one that does

Config.HostInstallsModules says the host decides which organizations hold
each composed module, by its own administrators' consent, and its store
answers those installations from the host's records. The core then installs
no module at delivery, for a new organization or when reconciling; withdrawal
leaves the host's records to the host; UninstallAsHost refuses a module. A
narrowing redelivery still raises the installation's revision, which the
store applies to the host's record. Unset, every composed module is installed
at every organization, as before.

Workload.Organization binds a workload to the organization its credential is
bound to: an issue naming another is refused, and an issue naming none acts
there. A workload issue also refuses an installation that is not active.

installationOf prefers an organization's active installation of a target, so
a host that keeps the records of retired installations beside the one it made
again seals capabilities to the live one; a capability sealed to the retired
one stays refused after the reinstall.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../authority/host_installs_modules_test.go   | 185 ++++++++++++++++++
 .../authority-core/go/authority/issue.go      |   9 +-
 .../authority-core/go/authority/lifecycle.go  |  30 ++-
 .../authority-core/go/authority/service.go    |  32 ++-
 4 files changed, 244 insertions(+), 12 deletions(-)
 create mode 100644 libraries/authority-core/go/authority/host_installs_modules_test.go

diff --git a/libraries/authority-core/go/authority/host_installs_modules_test.go b/libraries/authority-core/go/authority/host_installs_modules_test.go
new file mode 100644
index 00000000..25ccd114
--- /dev/null
+++ b/libraries/authority-core/go/authority/host_installs_modules_test.go
@@ -0,0 +1,185 @@
+package authority_test
+
+import (
+	"testing"
+
+	"github.com/codefly-dev/authority/libraries/authority-core/go/authority"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/domain"
+	"github.com/codefly-dev/authority/libraries/authority-core/go/memstore"
+	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+)
+
+// hostInstalled is a core whose host decides which organizations hold each
+// module (Config.HostInstallsModules): its store answers the host's own
+// records, which a test writes as the host would.
+type hostInstalled struct {
+	*harness
+	svc   *authority.Service
+	store *memstore.Store
+}
+
+func newHostInstalled(t *testing.T) *hostInstalled {
+	t.Helper()
+	h := newHarness(t)
+	cfg := h.cfg
+	cfg.HostInstallsModules = true
+	store := memstore.New()
+	svc, err := authority.New(store, cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, org := range []string{acme, globex} {
+		store.PutOrganization(domain.Organization{ID: org, Name: org})
+	}
+	store.PutOrgRole(domain.OrgRole{Organization: acme, Name: "admin"})
+	store.PutPerson(domain.Person{ID: "alex", Organization: acme, Roles: []string{"admin"}})
+	if _, err := svc.ApplyModule(h.ctx, domain.Module{Name: "store", Principal: "store", Kind: domain.KindModule, Generation: 1,
+		ResourceKinds: []*basev0.WorkScopeV1{sc(kind, "read", "write")},
+		Bindings: map[string]domain.Binding{"self": {ID: "self", Audience: "store",
+			InvokeScopes: []*basev0.WorkScopeV1{sc(kind, "read", "write")}, HeadlessScopes: []*basev0.WorkScopeV1{sc(kind, "read")}}},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	return &hostInstalled{harness: h, svc: svc, store: store}
+}
+
+// record writes the host's own installation record of the store module.
+func (h *hostInstalled) record(org, id string, status domain.Status, revision uint64) {
+	h.t.Helper()
+	if err := h.store.Write(h.ctx, func(tx authority.Tx) error {
+		return tx.PutInstallation(domain.Installation{ID: id, Organization: org, Target: "store", Status: status, Revision: revision})
+	}); err != nil {
+		h.t.Fatal(err)
+	}
+}
+
+func (h *hostInstalled) issue(w authority.Workload, org string) (authority.Issued, error) {
+	return h.svc.IssueForWorkload(h.ctx, w, authority.IssueRequest{Binding: "self", Organization: org})
+}
+
+func (h *hostInstalled) installations() []domain.Installation {
+	h.t.Helper()
+	var all []domain.Installation
+	if err := h.store.Read(h.ctx, func(tx authority.Tx) error {
+		var err error
+		all, err = tx.Installations("")
+		return err
+	}); err != nil {
+		h.t.Fatal(err)
+	}
+	return all
+}
+
+// The core installs no module by itself: not at delivery, not for a new
+// organization, not when reconciling; and the host's record is never retired
+// by the core, by withdrawal or by host setup.
+func TestAHostThatInstallsModulesIsTheOnlyOneThatDoes(t *testing.T) {
+	h := newHostInstalled(t)
+	if all := h.installations(); len(all) != 0 {
+		t.Fatalf("delivery installed %v", all)
+	}
+	ids, err := h.svc.OrganizationAdded(h.ctx, acme)
+	if err != nil || len(ids) != 0 {
+		t.Fatalf("a new organization was given %v (%v)", ids, err)
+	}
+	if err := h.svc.ReconcileOrganizations(h.ctx); err != nil {
+		t.Fatal(err)
+	}
+	if all := h.installations(); len(all) != 0 {
+		t.Fatalf("reconciling installed %v", all)
+	}
+	_, err = h.svc.OrganizationAdded(h.ctx, "nobody")
+	code(t, err, domain.NotFound)
+
+	h.record(acme, "host-1", domain.Active, 1)
+	// A redelivery that narrows the module raises the host's record's
+	// revision, so what was issued under the wider module ends.
+	if _, err := h.svc.ApplyModule(h.ctx, domain.Module{Name: "store", Principal: "store", Kind: domain.KindModule, Generation: 2,
+		ResourceKinds: []*basev0.WorkScopeV1{sc(kind, "read")},
+		Bindings: map[string]domain.Binding{"self": {ID: "self", Audience: "store",
+			InvokeScopes: []*basev0.WorkScopeV1{sc(kind, "read")}, HeadlessScopes: []*basev0.WorkScopeV1{sc(kind, "read")}}},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if all := h.installations(); len(all) != 1 || all[0].Revision != 2 || all[0].Status != domain.Active {
+		t.Fatalf("a narrowing left the host's record at %v", all)
+	}
+	err = h.svc.UninstallAsHost(h.ctx, acme, "host-1")
+	code(t, err, domain.Denied)
+	if err := h.svc.WithdrawModule(h.ctx, "store"); err != nil {
+		t.Fatal(err)
+	}
+	all := h.installations()
+	if len(all) != 1 || all[0].Status != domain.Active || all[0].Revision != 2 {
+		t.Fatalf("the host's record moved: %v", all)
+	}
+}
+
+// A workload is issued only where its host recorded an installation, never
+// past the organization its credential is bound to, and nothing once the host
+// retires the installation: its capabilities fail their next check.
+func TestAWorkloadIsIssuedOnlyWhereItsHostInstalledIt(t *testing.T) {
+	store := authority.Workload{Module: "store"}
+	for _, tc := range []struct {
+		name   string
+		setup  func(h *hostInstalled)
+		w      authority.Workload
+		org    string
+		want   domain.Code
+		issued bool
+	}{
+		{name: "no installation anywhere", w: store, org: acme, want: domain.Precondition},
+		{name: "no installation and no organization named", w: store, want: domain.Denied},
+		{name: "installed elsewhere", setup: func(h *hostInstalled) { h.record(globex, "host-g", domain.Active, 1) }, w: store, org: acme, want: domain.Precondition},
+		{name: "installed here", setup: func(h *hostInstalled) { h.record(acme, "host-1", domain.Active, 1) }, w: store, org: acme, issued: true},
+		{name: "the only installation, no organization named", setup: func(h *hostInstalled) { h.record(acme, "host-1", domain.Active, 1) }, w: store, issued: true},
+		{name: "retired by the host", setup: func(h *hostInstalled) { h.record(acme, "host-1", domain.Revoked, 2) }, w: store, org: acme, want: domain.Precondition},
+		{name: "bound to another organization", setup: func(h *hostInstalled) { h.record(acme, "host-1", domain.Active, 1) },
+			w: authority.Workload{Module: "store", Organization: globex}, org: acme, want: domain.Denied},
+		{name: "bound here, organization implied", setup: func(h *hostInstalled) { h.record(acme, "host-1", domain.Active, 1) },
+			w: authority.Workload{Module: "store", Organization: acme}, issued: true},
+		{name: "bound to an organization that has no installation", setup: func(h *hostInstalled) { h.record(acme, "host-1", domain.Active, 1) },
+			w: authority.Workload{Module: "store", Organization: globex}, want: domain.Precondition},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			h := newHostInstalled(t)
+			if tc.setup != nil {
+				tc.setup(h)
+			}
+			issued, err := h.issue(tc.w, tc.org)
+			if !tc.issued {
+				code(t, err, tc.want)
+				return
+			}
+			if err != nil {
+				t.Fatal(err)
+			}
+			if got := issued.Context.GetTenantId(); got != acme {
+				t.Fatalf("issued at %q", got)
+			}
+			if _, _, err := h.svc.Check(h.ctx, issued.Token, "store"); err != nil {
+				t.Fatal(err)
+			}
+		})
+	}
+
+	t.Run("a capability ends when the host retires the installation, and stays ended after a reinstall", func(t *testing.T) {
+		h := newHostInstalled(t)
+		h.record(acme, "host-1", domain.Active, 1)
+		issued, err := h.issue(store, acme)
+		if err != nil {
+			t.Fatal(err)
+		}
+		h.record(acme, "host-1", domain.Revoked, 2)
+		if _, _, err := h.svc.Check(h.ctx, issued.Token, "store"); err == nil {
+			t.Fatal("a capability survived its installation's retirement")
+		}
+		h.record(acme, "host-2", domain.Active, 1)
+		if _, _, err := h.svc.Check(h.ctx, issued.Token, "store"); err == nil {
+			t.Fatal("a reinstall revived a capability sealed to the retired installation")
+		}
+		if _, err := h.issue(store, acme); err != nil {
+			t.Fatal(err)
+		}
+	})
+}
diff --git a/libraries/authority-core/go/authority/issue.go b/libraries/authority-core/go/authority/issue.go
index 47d19cf9..d96bbab6 100644
--- a/libraries/authority-core/go/authority/issue.go
+++ b/libraries/authority-core/go/authority/issue.go
@@ -268,6 +268,13 @@ func (s *Service) IssueForWorkload(ctx context.Context, w Workload, r IssueReque
 			return notFound(err)
 		}
 		org = r.Organization
+		if w.Organization != "" {
+			// A credential bound to one organization acts there and nowhere else.
+			if org != "" && org != w.Organization {
+				return domain.Refuse("workload %s is bound to organization %s; it is issued nothing at %s", w.Module, w.Organization, org)
+			}
+			org = w.Organization
+		}
 		if org == "" {
 			var orgs []string
 			all, err := tx.Installations("")
@@ -302,7 +309,7 @@ func (s *Service) IssueForWorkload(ctx context.Context, w Workload, r IssueReque
 			return err
 		}
 		inst, err := installationOf(tx, org, module.Name)
-		if err != nil {
+		if err != nil || inst.Status != domain.Active {
 			return domain.NotNow("%s is not installed at %s", module.Name, org)
 		}
 		instID = inst.ID
diff --git a/libraries/authority-core/go/authority/lifecycle.go b/libraries/authority-core/go/authority/lifecycle.go
index 23a23432..310edf3f 100644
--- a/libraries/authority-core/go/authority/lifecycle.go
+++ b/libraries/authority-core/go/authority/lifecycle.go
@@ -13,7 +13,8 @@ import (
 )
 
 // ApplyModule records a delivered module at a newer generation and holds a
-// module installation at every organization (a solution is installed
+// module installation at every organization, unless the host installs
+// modules itself (Config.HostInstallsModules; a solution is installed
 // explicitly). A narrowing invalidates the capabilities issued before it; a
 // withdrawn owner-aware declaration refuses its owner-selected ones for good.
 func (s *Service) ApplyModule(ctx context.Context, m domain.Module) ([]string, error) {
@@ -100,7 +101,7 @@ func (s *Service) ApplyModule(ctx context.Context, m domain.Module) ([]string, e
 		if err := s.journal(ctx, tx, domain.Event{Kind: domain.ModuleApplied, Subject: m.Name, Detail: map[string]string{"principal": m.Principal, "kind": m.Kind, "generation": fmt.Sprint(m.Generation)}}); err != nil {
 			return err
 		}
-		if m.Kind == domain.KindSolution {
+		if m.Kind == domain.KindSolution || s.cfg.HostInstallsModules {
 			return nil
 		}
 		orgs, err := tx.Organizations()
@@ -149,6 +150,9 @@ func (s *Service) OrganizationAdded(ctx context.Context, org string) ([]string,
 		if _, err := tx.Organization(org); err != nil {
 			return notFound(err)
 		}
+		if s.cfg.HostInstallsModules {
+			return nil // the host installs a module where its administrators consent
+		}
 		modules, err := tx.Modules()
 		if err != nil {
 			return err
@@ -174,10 +178,13 @@ func (s *Service) OrganizationAdded(ctx context.Context, org string) ([]string,
 }
 
 // ReconcileOrganizations holds every composed module at every organization
-// (OrganizationAdded at each): what a host runs when it starts, so an
+// (OrganizationAdded at each), and does nothing when the host installs modules: what a host runs when it starts, so an
 // organization created while the authority could not record it still holds
 // the modules it may use.
 func (s *Service) ReconcileOrganizations(ctx context.Context) error {
+	if s.cfg.HostInstallsModules {
+		return nil // nothing is installed by the core to reconcile
+	}
 	// One read finds the organizations missing a module installation, so a
 	// host with many organizations writes only where something is missing.
 	var missing []string
@@ -227,8 +234,13 @@ func (s *Service) WithdrawModule(ctx context.Context, name string) error {
 		if err != nil {
 			return err
 		}
+		withdrawn, err := tx.ModuleNamed(name)
+		if err != nil {
+			return notFound(err)
+		}
+		hostOwned := s.cfg.HostInstallsModules && withdrawn.Kind != domain.KindSolution
 		for _, inst := range all {
-			if inst.Target == name && inst.Status != domain.Revoked {
+			if inst.Target == name && inst.Status != domain.Revoked && !hostOwned {
 				if err := s.revoke(tx, inst); err != nil {
 					return err
 				}
@@ -249,10 +261,7 @@ func (s *Service) WithdrawModule(ctx context.Context, name string) error {
 				}
 			}
 		}
-		m, err := tx.ModuleNamed(name)
-		if err != nil {
-			return notFound(err)
-		}
+		m := withdrawn
 		if err := tx.PutTombstone(domain.Tombstone{Name: m.Name, Principal: m.Principal, Generation: m.Generation}); err != nil {
 			return err
 		}
@@ -502,6 +511,11 @@ func (s *Service) UninstallAsHost(ctx context.Context, organization, installatio
 		if err != nil {
 			return err
 		}
+		if s.cfg.HostInstallsModules && inst.PrincipalID == "" {
+			if m, err := tx.ModuleNamed(inst.Target); err == nil && m.Kind != domain.KindSolution {
+				return domain.Refuse("%s is a module installed by its host's consent; the host uninstalls it", inst.Target)
+			}
+		}
 		if err := s.revoke(tx, inst); err != nil {
 			return err
 		}
diff --git a/libraries/authority-core/go/authority/service.go b/libraries/authority-core/go/authority/service.go
index a21397fc..61457442 100644
--- a/libraries/authority-core/go/authority/service.go
+++ b/libraries/authority-core/go/authority/service.go
@@ -51,6 +51,16 @@ type Config struct {
 	// Journal records each change of authority in the transaction that makes
 	// it; an error aborts the change. nil journals nothing.
 	Journal func(ctx context.Context, tx Tx, e domain.Event) error
+	// HostInstallsModules says the host decides which organizations hold each
+	// composed module, by its own administrators' consent, and its store
+	// answers those installations from the host's own records. The core then
+	// never installs, reactivates or revokes a module installation itself:
+	// delivery, a new organization and reconciliation install nothing,
+	// withdrawal leaves the host's records to the host, and UninstallAsHost
+	// refuses a module. It still raises a module installation's revision when
+	// a redelivery narrows the module, which the store applies to the host's
+	// record. false: every composed module is installed at every organization.
+	HostInstallsModules bool
 }
 
 var (
@@ -128,6 +138,10 @@ type Person struct {
 // Workload is an attested module workload.
 type Workload struct {
 	Module string
+	// Organization is the organization the workload's credential is bound to,
+	// empty when it serves every organization that installed it. A workload
+	// bound to one is issued nothing at another.
+	Organization string
 }
 
 func (s *Service) verifier(ctx context.Context, audience string) (*workcontext.Verifier, error) {
@@ -343,16 +357,28 @@ func (src sources) OperationBinding(ctx context.Context, id string) (workcontext
 	return out, err
 }
 
-// installationOf is an organization's installation of target.
+// installationOf is an organization's installation of target: its active one
+// when it has one, since a host that installs modules keeps the records of the
+// installations it retired beside the one it made again.
 func installationOf(tx Tx, org, target string) (domain.Installation, error) {
 	all, err := tx.Installations(org)
 	if err != nil {
 		return domain.Installation{}, err
 	}
-	for _, inst := range all {
-		if inst.Target == target {
+	var found *domain.Installation
+	for i, inst := range all {
+		if inst.Target != target {
+			continue
+		}
+		if inst.Status == domain.Active {
 			return inst, nil
 		}
+		if found == nil {
+			found = &all[i]
+		}
+	}
+	if found != nil {
+		return *found, nil
 	}
 	return domain.Installation{}, fmt.Errorf("installation of %s at %s: %w", target, org, domain.ErrNotFound)
 }

From 52951b628e4a93eab6b37d15c596bbf406126239 Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Mon, 26 Oct 2026 22:53:23 -0400
Subject: [PATCH 14/16] test(storetest): a failed transaction's installation is
 a solution's, which every host's store writes

A host that installs modules by consent keeps a module's installations in its
own records (Config.HostInstallsModules), so the contract proves atomicity on
the installation the core writes for every host.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 libraries/authority-core/go/storetest/storetest.go | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libraries/authority-core/go/storetest/storetest.go b/libraries/authority-core/go/storetest/storetest.go
index 1f0aa03c..5aa434c7 100644
--- a/libraries/authority-core/go/storetest/storetest.go
+++ b/libraries/authority-core/go/storetest/storetest.go
@@ -396,7 +396,10 @@ func Run(t *testing.T, open Open) {
 	})
 
 	t.Run("a failed transaction leaves nothing behind", func(t *testing.T) {
-		m := f.module("module")
+		// A solution: the core writes its installations whatever the host, where
+		// a module's may be the host's own records (Config.HostInstallsModules).
+		m := f.module(domain.KindSolution)
+		m.Name, m.Principal = f.name("failed"), f.name("failed-principal")
 		inst := domain.Installation{ID: uuid.NewString(), Organization: f.orgA, Target: m.Name, Status: domain.Active, Revision: 1}
 		var before uint64
 		read(t, func(tx authority.Tx) (err error) { before, err = tx.AuthorizationRevision(f.orgA); return err })

From e9b9c696712458db89fe030b1bccc6c726fedcbb Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Mon, 26 Oct 2026 23:05:57 -0400
Subject: [PATCH 15/16] feat(conformance): a host that installs modules by
 consent installs the ones the suite delivers

Fixture.InstallModule (and SolutionPrincipalCase.InstallModule) has a host
whose administrators install each module by their own consent install a
module the suite just composed, through the host's own path. nil keeps
delivery installing a module at every organization, as the local authority
does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 libraries/conformance/go/conformance.go       | 24 +++++++++++++++++--
 .../conformance/go/solution_principal.go      |  7 ++++--
 2 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/libraries/conformance/go/conformance.go b/libraries/conformance/go/conformance.go
index d77f8a0a..15219bb0 100644
--- a/libraries/conformance/go/conformance.go
+++ b/libraries/conformance/go/conformance.go
@@ -76,6 +76,12 @@ type Fixture struct {
 	HostDomain         string
 	SignManifest       func(document []byte) (envelope []byte, err error)
 	DeliveryCredential func(module string) string
+	// InstallModule, for a host whose administrators install each module by
+	// their own consent, installs one the suite just delivered at the
+	// organizations the suite uses, through the host's own path; it must be
+	// idempotent, since a module is delivered again at newer generations. nil:
+	// delivery installs a module at every organization.
+	InstallModule func(ctx context.Context, module string) error
 	// Resources is required and states what a person covers on one kind.
 	Resources *ResourceCase
 	// Lookup is a binding whose lookup scopes are narrower than its invoke
@@ -231,7 +237,7 @@ func (c *client) deliver(ctx context.Context, f Fixture, alias, kind string, gen
 	request := map[string]any{
 		"carrier": map[string]any{"document": carrier, "envelope": envelope}, "credential": f.DeliveryCredential(alias)}
 	if document == nil {
-		return c.call(ctx, "host.composition.v1.CompositionService", "ApplyManifest", request)
+		return installed(ctx, f, alias, kind)(c.call(ctx, "host.composition.v1.CompositionService", "ApplyManifest", request))
 	}
 	d, err := c.files.FindDescriptorByName("host.composition.v1.AuthorityManifestV1")
 	if err != nil {
@@ -255,7 +261,21 @@ func (c *client) deliver(ctx context.Context, f Fixture, alias, kind string, gen
 		return nil, err
 	}
 	request["authority"] = map[string]any{"document": authority, "envelope": signed}
-	return c.call(ctx, "host.composition.v1.CompositionService", "ApplyManifest", request)
+	return installed(ctx, f, alias, kind)(c.call(ctx, "host.composition.v1.CompositionService", "ApplyManifest", request))
+}
+
+// installed has the host install a module it just composed, when its
+// administrators install modules by consent (Fixture.InstallModule).
+func installed(ctx context.Context, f Fixture, alias, kind string) func(protoreflect.Message, error) (protoreflect.Message, error) {
+	return func(out protoreflect.Message, err error) (protoreflect.Message, error) {
+		if err != nil || kind != "module" || f.InstallModule == nil {
+			return out, err
+		}
+		if err := f.InstallModule(ctx, alias); err != nil {
+			return nil, fmt.Errorf("the host installing %s: %w", alias, err)
+		}
+		return out, nil
+	}
 }
 
 // Run drives the suite over one connection, from the published descriptors.
diff --git a/libraries/conformance/go/solution_principal.go b/libraries/conformance/go/solution_principal.go
index 78d7de27..1bfe41d3 100644
--- a/libraries/conformance/go/solution_principal.go
+++ b/libraries/conformance/go/solution_principal.go
@@ -90,7 +90,9 @@ type SolutionPrincipalCase struct {
 	RemoveFromOrganization                         func(ctx context.Context, personID string) error
 	SignManifest, SignAuthority                    func(document []byte) ([]byte, error)
 	DeliveryCredential                             func(module string) string
-	HostCoordinate, HostDomain                     string
+	// InstallModule is Fixture.InstallModule, for the modules this suite delivers.
+	InstallModule              func(ctx context.Context, module string) error
+	HostCoordinate, HostDomain string
 }
 
 // SolutionUnderTest is one solution the suite delivers and installs.
@@ -634,7 +636,8 @@ func (sp *principalSuite) deliverStore(t *testing.T, ownerAware bool) {
 }
 
 func (sp *principalSuite) delivery() Fixture {
-	return Fixture{SignManifest: sp.f.SignManifest, SignAuthority: sp.f.SignAuthority, DeliveryCredential: sp.f.DeliveryCredential, HostCoordinate: sp.f.HostCoordinate, HostDomain: sp.f.HostDomain}
+	return Fixture{SignManifest: sp.f.SignManifest, SignAuthority: sp.f.SignAuthority, DeliveryCredential: sp.f.DeliveryCredential, HostCoordinate: sp.f.HostCoordinate, HostDomain: sp.f.HostDomain,
+		InstallModule: sp.f.InstallModule}
 }
 
 func countOf(list []string, want string) int {

From e0b04b282bfe7dfc5b1220ca830135d2adfd521c Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Mon, 26 Oct 2026 23:12:39 -0400
Subject: [PATCH 16/16] test(conformance): an admission key registration
 carries its proof, as interface 0.3.4 requires

After main's per-instance hop admission key (#32), RegisterAdmissionKey
requires a fresh proof signed by the key it registers over the credential and
the authority's audience. The case signs each registration
(stamp.ProveRegistration) with the audience the hop's credential names, and
the library takes main's authority-client.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 libraries/conformance/go/go.mod       |  2 +-
 libraries/conformance/go/go.sum       |  4 +--
 libraries/conformance/go/isolation.go | 52 ++++++++++++++++++++++++++-
 3 files changed, 54 insertions(+), 4 deletions(-)

diff --git a/libraries/conformance/go/go.mod b/libraries/conformance/go/go.mod
index a102e95a..79ba82ae 100644
--- a/libraries/conformance/go/go.mod
+++ b/libraries/conformance/go/go.mod
@@ -3,7 +3,7 @@ module github.com/codefly-dev/authority/libraries/conformance/go
 go 1.27.3
 
 require (
-	github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026193714-49101ae11a7f
+	github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026232801-7b6569e1f285
 	github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261023203940-e720ad2851c7
 	github.com/codefly-dev/core v0.19.7-0.20261026092055-b23dc13543b2
 	github.com/google/uuid v1.6.0
diff --git a/libraries/conformance/go/go.sum b/libraries/conformance/go/go.sum
index 1aeb7d2c..6e2c3808 100644
--- a/libraries/conformance/go/go.sum
+++ b/libraries/conformance/go/go.sum
@@ -28,8 +28,8 @@ github.com/cheggaaa/pb/v3 v3.2.1 h1:aprZbFRG+B7+ug76S8QZ6Y1PW168UHzOmbC3wa+aU6I=
 github.com/cheggaaa/pb/v3 v3.2.1/go.mod h1:U9hSVxoKqJrZIE3PkFG1xXXNaK/Ilzg+EF/scpXzEdw=
 github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
-github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026193714-49101ae11a7f h1:XIIL76qWDaSv0QWQX7AKgihTQU073x1aM9/QQBE39ls=
-github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026193714-49101ae11a7f/go.mod h1:4hRjiWuJOKzrEk8AS87pbWCbpiEmhEvQBGQaJo5Hmkg=
+github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026232801-7b6569e1f285 h1:evq/BoytmbddnA/r7thGb25PMrveFZp0HP0OiVXyO9I=
+github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026232801-7b6569e1f285/go.mod h1:4hRjiWuJOKzrEk8AS87pbWCbpiEmhEvQBGQaJo5Hmkg=
 github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261023203940-e720ad2851c7 h1:7vdTj6aLQVyFf0MWWgUnR/otX1v9xN6AbFKC2cHrQjE=
 github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261023203940-e720ad2851c7/go.mod h1:1rmjrVyr0h7zOuwOHS9i+BoeS9dr3XNvtupLZFwY6As=
 github.com/codefly-dev/core v0.19.7-0.20261026092055-b23dc13543b2 h1:I1wL0ANXhTdQuEAnxXF+s4+rKILlBu/QHILq4Skyi3I=
diff --git a/libraries/conformance/go/isolation.go b/libraries/conformance/go/isolation.go
index 9cf16ee5..cfc8508c 100644
--- a/libraries/conformance/go/isolation.go
+++ b/libraries/conformance/go/isolation.go
@@ -4,7 +4,13 @@ import (
 	"context"
 	"crypto/ed25519"
 	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"strings"
 	"testing"
+	"time"
 
 	"github.com/codefly-dev/authority/libraries/authority-client/go/stamp"
 	"google.golang.org/grpc/codes"
@@ -80,9 +86,24 @@ func (c *client) admissionKeys(t *testing.T, ctx context.Context, f Fixture) {
 		}
 		seed := sha256.Sum256([]byte("conformance hop admission"))
 		public := ed25519.NewKeyFromSeed(seed[:]).Public().(ed25519.PublicKey)
+		signer, err := stamp.NewSigner(hex.EncodeToString(seed[:]))
+		if err != nil {
+			t.Fatal(err)
+		}
+		// Each registration carries a fresh proof, signed by the key it
+		// registers, over the credential presented and the authority the
+		// credential is addressed to (stamp.ProveRegistration).
 		register := func(credential string, key []byte) (string, error) {
+			audience, err := credentialAudience(credential)
+			if err != nil {
+				t.Fatal(err)
+			}
+			proof, err := signer.ProveRegistration(credential, audience, time.Now())
+			if err != nil {
+				t.Fatal(err)
+			}
 			out, err := c.call(ctx, "host.authority.v1.AuthorityService", "RegisterAdmissionKey", map[string]any{
-				"actor": map[string]any{"credential": credential}, "public_key": key})
+				"actor": map[string]any{"credential": credential}, "public_key": key, "proof": proof})
 			if err != nil {
 				return "", err
 			}
@@ -127,3 +148,32 @@ func (c *client) admissionKeys(t *testing.T, ctx context.Context, f Fixture) {
 		refused(t, err, codes.InvalidArgument, "32")
 	})
 }
+
+// credentialAudience is the one audience a workload credential (a compact JWS)
+// is issued for: the authority a registration proof names. It verifies
+// nothing; the authority attests the credential.
+func credentialAudience(credential string) (string, error) {
+	parts := strings.Split(credential, ".")
+	if len(parts) != 3 {
+		return "", errors.New("the hop's credential is not a compact JWS, so it names no audience to prove a registration to")
+	}
+	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return "", err
+	}
+	var claims struct {
+		Audience json.RawMessage `json:"aud"`
+	}
+	if err := json.Unmarshal(payload, &claims); err != nil {
+		return "", err
+	}
+	var one string
+	var many []string
+	switch {
+	case json.Unmarshal(claims.Audience, &one) == nil && one != "":
+		return one, nil
+	case json.Unmarshal(claims.Audience, &many) == nil && len(many) == 1 && many[0] != "":
+		return many[0], nil
+	}
+	return "", errors.New("the hop's credential names no single audience")
+}