[antoinetoussaint-byte]

The delivery half of codefly-dev/module-saas-starter#1083, core's part. The render is codefly-dev/cli#972; the host half is codefly-dev/module-saas-starter#1084.

Why

A host bounds the capability a person's delegated client mints by what the consumer it was delivered to declares it consumes. It reads that from the consumer's registry grant, which is derived from the consumer's signed authority document. A renderer derives authority documents only from module.contract.codefly.yaml. A composed solution declares what it consumes in solution.codefly.yaml's api.consumes, which named module, service and endpoint, and no audience or scopes. So a solution had no authority document at all.

The shape (revised after review)

schema_version: codefly.solution-manifest/v1   # a request needs v1; v0 is still read
api:
  consumes:
    - id: documents
      protocol: rest
      module: documents
      service: documents
      endpoint: rest
      as: documents                              # the runtime's facade name; no rule ties it to anything
      audience: {from: documents/documents-prefix}   # a slot, resolved like a contract's
      revision: 2                                # optional, default 1
      scopes:                                    # optional; present means non-empty
        - resource_kind: documents.passages
          actions: [read]

• Manifest.ConsumptionContract(principal) turns the scoped entries into a modulecontract.Contract: one invoke binding per entry, with the entry's ID, its audience slot, its revision, and the declared scopes as explicit ceiling scopes. Namespaces, queues, ceilings and destinations are written as empty lists. The request is then judged by the module contract's own rules: grammar of kinds and actions, a slot key that names its meaning (*-audience/*-prefix), and revision. Its audience is resolved by the module contract's own Resolve, with the same secret and ambiguity refusals. Nothing is reimplemented; the earlier copied grammar and the Resolved built outside the package's rules are gone.
• The audience is the composition's to say. A module composed as model may verify modelservice. The earlier rule tying as to module is gone, and so is "audience = composed name".
• LoadConsumption(data) reads the schema version and api.consumes, strictly, and nothing else. A renderer that derives authority from the consumption must not fail on a section it does not read. A manifest that Load refuses for its agent block, or for a section this core does not model, asks for no authority because of that.
• The runtime projection carries the scopes. ConsumedAPI.Scopes is projected into CODEFLY__API_CONSUMES, so a runtime can refuse a mint outside what it declared. The scopes are written once, in the YAML.
• Refused:
  • scopes: [], rather than read as absent;
  • audience or revision without scopes;
  • scopes without an audience;
  • scopes on an unbound entry or on an exposed API;
  • a request in a v0 manifest. An older reader would read it as asking for nothing, so v1 makes it refuse the version by name instead.
• modulecontract.Slot gains MarshalJSON ({"from": …}), so a manifest's canonical JSON spells a slot the way its YAML does.

One open question for the owners: merging a solution's derived consumption with a module contract it also publishes, for example for its destinations. The CLI refuses that combination by name for now.

Classification: fix, at the owner.

API changes callers will see:

• ConsumedAPI now holds a slice, so it is no longer comparable with ==. The CLI's one test that compared it moves to reflect.DeepEqual in cli#972. solution-runtime-go has no such comparison in its tree; I checked with grep only, not a build.
• ConsumptionAuthority, from the first revision of this PR, is replaced by ConsumptionContract and was never released.

Tests

solution/manifest/consumption_authority_test.go, with structural fixtures in testdata/consumption/ and no downstream names:

• a scoped entry is one invoke binding, and the audience is resolved from the composition;
• a module whose audience differs from its composed name is addressed through as (the reviewer's case);
• an unresolved audience fails with ErrUnresolvedSlot;
• two scoped endpoints of one module give two bindings at one audience;
• the revision can be bumped;
• no scopes means nil, and the digest does not depend on order;
• the runtime projection carries the scopes (the reviewer's case);
• every refusal is checked through both Load and LoadConsumption;
• one grammar: a corpus of kinds is accepted or refused exactly as modulecontract.Parse does (the reviewer's case);
• LoadConsumption reads an agentless manifest and one with an undeclared section, which Load refuses, as asking for nothing, and gives the same contract as Load for a scoped one.

Verified, and not

• Green: go test ./contracts/... ./solution/... ./internal/... and go vet ./solution/manifest. Earlier full ./... runs were green except two packages that pass alone and do not import this one.
• Not run this round: the race job, the sandbox tags and coverage.
• This branch was rebased onto current main and force-pushed with lease.

Order

1. fix(accounts): the confined mint's ceiling is the consumer's delivered authority (host half of #1083) module-saas-starter#1084 (host half).
2. This PR.
3. feat(gitops): derive a composed solution's authority document from its scoped api.consumes cli#972, pinned to this PR's merge commit on core main as a pseudo-version. No core tag is cut here; a tag is a release and needs the owner's say-so. cli#972 explains why its conformance-matrix test needs a release line.

🤖 Generated with Claude Code