fix(gitops): deliver explicit owner-aware and installation-owned role scopes

cmd/generate/runnable_scopes_test.go

@@ -83,7 +83,7 @@ func TestOperationDocumentRoundTripsEveryCoreField(t *testing.T) {
 var undeclarableFields = map[protoreflect.FullName]string{
 	// An owner is the authority's to select for an installation (core#845);
 	// TestRunnablesRefusesADeclaredResourceOwner proves the refusal.
-	"codefly.base.v0.WorkScopeV1.resource_owner_id": "never declared",
+	"codefly.base.v0.WorkScopeV1.resource_owner_id": "never written into an operation",
 }
 
 // Descend into every message, including repeated scopes and slots. A future

cmd/run/launcher.go

@@ -604,8 +604,8 @@ func (cluster *launcher) newDeliverer(ctx context.Context) (*gitops.NativeDelive
 }
 
 // newCompositionDelivery speaks the composition interface over conn, reading
-// each module's method policies, scope ceilings and roles from the module as
-// the run composes it at the time of the delivery.
+// each module's method policies, scope ceilings, roles and owner-awareness
+// from the module as the run composes it at the time of the delivery.
 func (cluster *launcher) newCompositionDelivery(conn grpc.ClientConnInterface) *gitops.CompositionDelivery {
 	load := func(ctx context.Context, module string) (string, error) {
 		m, err := cluster.composed().LoadModuleFromName(ctx, module)
@@ -635,6 +635,13 @@ func (cluster *launcher) newCompositionDelivery(conn grpc.ClientConnInterface) *
 				return nil, err
 			}
 			return gitops.Roles(dir)
+		},
+		func(ctx context.Context, module string) (bool, error) {
+			dir, err := load(ctx, module)
+			if err != nil {
+				return false, err
+			}
+			return gitops.OwnerAware(dir)
 		})
 }
 

cmd/run/native_delivery_rpc_cancellation_test.go

@@ -53,7 +53,7 @@ func TestNativeDeliveryCancelsTheGeneratedCompositionRPC(t *testing.T) {
 			require.NoError(t, err)
 			signer, err := solutionhost.NewInMemorySigner("delivery-test", private)
 			require.NoError(t, err)
-			composition := gitops.NewCompositionDelivery(conn, signer, nil, nil, nil)
+			composition := gitops.NewCompositionDelivery(conn, signer, nil, nil, nil, nil)
 			native := &gitops.NativeDeliverer{Signer: signer, StateDir: t.TempDir(), Prepare: composition.Prepare,
 				Token: func(string) (string, error) { return "test-carrier", nil }}
 			manifest := &solutionhost.ModuleManifest{

cmd/run/native_delivery_schedule_test.go

@@ -140,7 +140,7 @@ func deliverTo(t *testing.T, target orchestration.GRPCTarget) func(context.Conte
 		conn, err := target.Dial()
 		require.NoError(t, err)
 		defer func() { _ = conn.Close() }()
-		composition := gitops.NewCompositionDelivery(conn, signer, nil, nil, nil)
+		composition := gitops.NewCompositionDelivery(conn, signer, nil, nil, nil, nil)
 		deliverer := &gitops.NativeDeliverer{Signer: signer, StateDir: t.TempDir(), Prepare: composition.Prepare, Token: func(string) (string, error) { return "token", nil }}
 		_, err = deliverer.Deliver(ctx, &solutionhost.ModuleManifest{
 			Schema: solutionhost.SchemaModuleManifestV1, Binding: "acme.local.model", Alias: "model", Kind: solutionhost.KindModule,

docs/module-manifests.md

@@ -303,6 +303,15 @@ that is not a prepared binding fails the render by key. A module that asks for
 nothing — no contract, no scoped consumption — gains nothing: the host grants
 it its envelope whole, and a request would change that.
 
+**Owner-aware enforcement is declared, never inferred.** A module that checks
+resource-owner selectors declares `owner_aware: true` at the top level of its
+`module.contract.codefly.yaml`. The composition delivery carries exactly that
+boolean in the signed `AuthorityManifestV1.owner_aware` (field 7). An omitted or
+false declaration stays false, including for solutions with roles or
+`installation_owned_scopes`; authority refuses person issuance to such a
+solution by name. The declaration participates in delivery generation changes
+and is omitted from withdrawals together with other live policy.
+
 **A solution's roles are part of its contract.** A unit a person uses declares
 the roles a person may hold on an installation of it in the same
 `module.contract.codefly.yaml`, as `roles` beside its `scope_ceilings`, under

go.mod

@@ -11,10 +11,11 @@ require (
 	github.com/asottile/dockerfile v3.1.0+incompatible
 	github.com/blang/semver v3.5.1+incompatible
 	github.com/briandowns/spinner v1.23.2
-	github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261025214748-c9cef7470d20
-	github.com/codefly-dev/authority/libraries/delivery/go v0.0.0-20261025214748-c9cef7470d20
+	github.com/codefly-dev/authority/libraries/authority-client/go v0.0.0-20261026143932-67b85b14a942
+	github.com/codefly-dev/authority/libraries/authority-core/go v0.0.0-20261026143932-67b85b14a942
+	github.com/codefly-dev/authority/libraries/delivery/go v0.0.0-20261026023425-000d44495d93
 	github.com/codefly-dev/authority/libraries/hop/go v0.0.0-20261025214748-c9cef7470d20
-	github.com/codefly-dev/core v0.19.7-0.20261026023455-8b5ddef6d55a
+	github.com/codefly-dev/core v0.19.7-0.20261026150808-7c0407679119
 	github.com/codefly-dev/golor v0.1.3
 	github.com/codefly-dev/llm v0.1.7
 	github.com/codefly-dev/sdk-go/workcontext v0.1.1-0.20261018052022-70dc7a546458
@@ -101,6 +102,7 @@ require (
 	github.com/clipperhouse/displaywidth v0.11.0 // indirect
 	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
 	github.com/cloudflare/circl v1.6.5 // indirect
+	github.com/codefly-dev/authority/libraries/resources/go v0.0.0-20261026023425-000d44495d93 // indirect
 	github.com/codefly-dev/gortk v0.2.0 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect