[antoinetoussaint-byte]

The delivery half of codefly-dev/module-saas-starter#1083, rendered. Depends on codefly-dev/core#784. core#784 is merged; this branch pins its merge commit on core main as a pseudo-version (v0.19.2-0.20261012184621-7ab1214c1f03, 7ab1214c), whose tree is identical to the PR head reviewed. The host half is codefly-dev/module-saas-starter#1084.

What changes

pkg/gitops/authority.go: a module's authority request is a module contract either way. It is the contract the module publishes, or, for a composed solution, the one its scoped api.consumes amounts to (core's ConsumptionContract). Both go through the same Resolve against the composition, so a solution's audience is whatever the composition says that module verifies, exactly as for a module.

• The narrow read (B1). The solution manifest is read through core's LoadConsumption: the schema version and api.consumes, strictly, and nothing else. An invalid or unknown field in a consumption fails the render. A section the strict loader refuses for reasons unrelated to consumption, such as no agent block or a section core doesn't model, never fails the render of a solution that asks for no authority. Those solutions render exactly as before this PR; none of them needs a new tag. The run path's lenient read is unchanged.
• Refused at render, where the author reads it:
  • a scoped entry for a module the workspace does not compose;
  • one addressed to the solution itself, either by naming its own module or by a resolved audience equal to its principal. The host omits such a binding with only a logged reason.
• A contract plus scoped consumption is refused by name, including a contract that declares only destinations. Merging two declarations of one request is a decision nobody has made yet. Until then, a solution declares its consumption in one place.
• Unchanged: one module-identity service presents the request; a presence is required, and the no-presence path refuses either source; the principal is the composed name; the unit is <presence binding>:<entry id>:invoke.

Classification: fix, at the owner. The renderer consumes core's derivation and resolution, and reimplements neither.

Tests

pkg/gitops/solution_consumption_authority_test.go, with structural fixtures in testdata/consumption/:

• end to end, a solution renders one documents unit with its composition-resolved audience;
• the scoped-consumer fixture renders deterministically (byte-identical twice), from the reviewer's case;
• the audience follows the composition: model resolves to model-gateway, from the reviewer's case;
• unscoped solutions that Load refuses still render (agentless, undeclared section), from the reviewer's B1 case;
• no scopes means no authority;
• a module that isn't composed is refused (reviewer);
• a scope at itself is refused, by module and by resolved audience (reviewer);
• a contract plus consumption is refused, including destinations-only (the reviewer's case, inverted per the coordinator's decision);
• an invalid scope fails;
• a solution without module-identity is refused;
• two solutions in one composition get distinct units (reviewer).

Mutation: putting back the strict Load fails both B1 subtests. pkg/solutionrun's test compares ConsumedAPI with reflect.DeepEqual, because core#784 made it non-comparable.

Docs updated

docs/solution-host-bindings.md: the record table and the composed-solution section.

Verified, and not

• Green: go build ./...; go vet ./pkg/gitops ./pkg/solutionrun; golangci-lint run ./pkg/gitops/... ./pkg/solutionrun/... (0 issues, after fixing two gocritic rangeValCopy findings CI reported); go test ./pkg/gitops (full package), ./pkg/solutionrun, ./cmd/sync/....
• The conformance matrix declares the v0.19.2 line (pkg/conformance/matrix.json core, decided by the coordinator). TestMatrixCoreMatchesGoMod requires it to equal the release line of go.mod's pin, and the pin is a pseudo-version on v0.19.2. No generator exists for this field. The repository's documented procedure (docs/supported-matrix.md, "Updating the core pin") edits it in the same change, and I followed it. The line has no release yet. docs/supported-matrix.md now states that the pin is an unreleased main commit, and that the matrix declares a line ahead of its release until core v0.19.2 is cut. go test ./pkg/conformance/... ./pkg/gitops/... passes.
• Not run end to end: no render of a real composition, no publish, and no host admitting the document.

What a solution needs to reach the host's ceiling:

• schema v1, with audience and scopes on the entries it calls on a person's behalf;
• module-identity: true on the service that presents it;
• an envelope entry on the host for its principal, with workload identity and units;
• an organization installation made after that authority is delivered.

🤖 Generated with Claude Code