[antoinetoussaint-byte]

A solution declaring installation-owned role scopes could deliver those scopes but still fail person issuance: its module contract had no way to declare the owner-aware checking required by authority. Carry the explicit owner_aware: true declaration from Core's contract into the signed composition authority document, alongside each role's installation_owned_scopes.

owner_aware: true
roles:
  - name: viewer
    scopes:
      - {resource_kind: wiki.page, actions: [read]}
    installation_owned_scopes:
      - {resource_kind: documents.collection, actions: [read]}

Classification: fix at the owning seams. Core owns the contract and strict decoding; CLI owns projection into AuthorityManifestV1 and delivery. Reuses modulecontract.Load, the existing contract readers, signed CompositionDelivery, generation fingerprint and withdrawal path. No inferred declaration, CLI-side validation, alternate delivery mechanism or generated-file edits. The declaration participates in generation changes; withdrawals read and carry no live declaration.

Dependencies and merge order:

• Core companion fix(modulecontract): declare owner-aware scope enforcement core#851, head 7c040767911929cc40bcead3f56e72d435441ea6, pinned as v0.19.7-0.20261026150808-7c0407679119. Merge Core first with a merge commit as coordinated; that preserves this exact pinned head without a merge-commit repin.
• authority-client/go and test dependency authority-core/go now pin authority main 67b85b14a942 (v0.0.0-20261026143932-67b85b14a942). Core test: replace real names with generic placeholders #839 and authority impr: convert all CLI main into the Action framework #7 are already merged. Go minimum-version selection also raises delivery/go to 000d44495d93 and adds resources/go, required by the real authority library.

The regression delivers an actual contract over the existing gRPC composition test peer, decodes the received authority document, projects it into authority's domain and invokes the real authority-core issuer and verifier. A declared owner-aware solution issues for a person, preserving its installation seal and resource-owner selector; absent and false declarations refuse by name without a token. The delivered installation-owned role scope remains bounded to the installation's resource IDs. The transport peer is controlled; this test does not run authority's deployed composition plugin.

Verification at 9f501cdd8d61d206fae7a0c5510a176aa1e06a04:

• Full go vet ./... and golangci-lint run ./... pass (0 lint issues).
• Focused issuance, decoding, generation, role-delivery and withdrawal regressions pass.
• Red control: suppressing only the delivered owner_aware field makes the positive issuance test fail with shop does not declare owner-aware checking; the unmodified implementation passes.
• go test -race ./pkg/gitops ./cmd/run ./cmd/generate ./pkg/gitops/cellfile -count=1 passes. Local Git fixtures use native Git; every actual GitHub fetch/push uses the required private helper. CI is green on 9f501cdd8d61d206fae7a0c5510a176aa1e06a04: 15 passed, 1 skipped, including full race, coverage and lint.
• Core companion: full vet and module-contract race suite pass; no new lint findings against 590c2562. Core's full-repository lint baseline has 1,298 uncapped findings, reproduced identically before/after this change.

The existing adaptations to Core main remain: ProtobufProcedures receives its endpoint; contract-kit tests supply the required audience slots; the runnable-refusal assertion follows Core's current wording.

Follow-ups:

• CLI's existing Roles reader still projects literal roles rather than Resolved.Roles binding grants; that pre-existing delivery gap is owned by CLI.
• The existing composition transport uses generated protocol stubs; migration to the Codefly-generated client/Connect lifecycle is CLI-owned follow-up debt. This change reuses that transport and generates or hand-edits no client.
• Core owns its pre-existing lint backlog.

Not verified locally: full CLI race suite, deployed Kubernetes/native authority plugin, or hosted accounts integration. No PR is merged by this task.