[antoinetoussaint-byte]

What

The required case "a callee refuses what does not verify" checks staleness by granting InstalledSolution to a team, which moves the organisation's authority. The suite made the team id up (callee-probe-<revision>). Accounts validates team ids and refuses that one as invalid subject id, so on saas the case failed because of the fixture, not because of the behaviour it is named for.

The fixture now supplies the team, the same way Lifecycle.Team already does. The new field is Fixture.UnexposedTeam: a real team of Organization that InstalledSolution is not yet exposed to, created or found through the host's own fixture path. The case is still required. An empty UnexposedTeam fails as a missing fixture.

• libraries/conformance/go/conformance.go: adds the field and makes the probe grant f.UnexposedTeam.
• libraries/conformance/go/README.md: one paragraph on the field.
• Local fixtures (local_authority_test.go, live_test.go): UnexposedTeam: "auditors". Local team ids are the strings people carry, so a team no person carries is a real team with no members.

Why not reuse Lifecycle.Team: on both hosts it names Finance, and the installed solution already reaches Finance. Granting a team that is already exposed is an idempotent no-op, so the revision never moves.

Classification

This is a fix, made in the suite, which is where the fixture-reason failure came from. It reuses the fixture's existing way of supplying a team (Lifecycle.Team / teamNamed on Accounts) and adds no team-creation path to the suite.

Evidence

• go vet ./... && go test -race ./... in libraries/conformance/go: passes. The package has no test files, so this is a compile and vet check.
• go test -race ./plugins/registry_test in modules/authority/services/local/code: ok gateway/plugins/registry_test 35.3s. TestTheLocalAuthorityPassesTheSuiteEveryImplementationMustPass passes, including a_callee_refuses_what_does_not_verify,_by_name (32.04s). TestARunningLocalAuthorityPassesTheSuite was skipped because AUTHORITY_GRPC_ADDR was not set.
• Negative check: with UnexposedTeam: "finance", which wiki already reaches, the probe fails at conformance.go:408: ... is stale, refused as PermissionDenied: <nil>. This confirms the case still tests staleness and is not passing by construction.

Not verified: I did not run the suite against Accounts. The Accounts fixture (host_interface_conformance_test.go) must set UnexposedTeam. A team with no members, created through its store, is the safe choice, because the probe leaves the grant in place for the rest of the run. Until it sets the field, this case fails on Accounts as a missing fixture, which names the gap honestly. Today it fails as an invalid subject id.

Overlap with open PRs

The diff stays small on purpose. All three PRs touch libraries/conformance/go/conformance.go:

• fix: modules authenticate the forwarded Work Context (signature, issuer, audience, window) #6 (verifier) adds one line at Run's case list, around line 264. No hunk overlap.
• feat: role scopes limited to what an installation owns #7 (installation-owned scopes) adds a Fixture field around line 92, a case around line 589, and a README table row. This PR's field goes after InstalledAudience (line 51), its probe edit is around line 397, and its README paragraph comes after the Lifecycle paragraph. No hunk overlap is expected, but whichever lands second should rebase.

🤖 Generated with Claude Code