[lukazhupa]

What

StartTask takes operation_bindings: binding ids of the audience module. The host
resolves each one the way the module's delegated exchange will
(ModuleOperationAudience: the binding as installed at the organization, narrowed
by that installation). It adds the binding's invoke scopes beside authority_scopes,
keeps each resource only if the person holds it, and refuses by name a binding the
person holds nothing under.

Why

A module that exchanges through a source binding must today name the source ids in
the parent it requests for the person. Those ids are per organization and live in
the installation, so a consumer has to learn them first, and a static configuration
value works for one organization only. With this change the consumer names the
binding, and the ids come from the installation. The parent then carries exactly
what the exchange will redeem.

Classification

Fix at the owner. The installation already holds the narrowing and the exchange
already resolves the binding; the parent's mint now uses that same resolution
instead of each consumer re-deriving it.

Reuse

• Service.ModuleOperationAudience: the delegated exchange's binding resolution, unchanged.
• resolveAuthority and workContextScopes: the per-permission check every mint makes.
• The rest of StartTask runs unchanged on the expanded scopes.

Deliberately not added: a discovery read for consumers to learn source ids, or a new
slot mode in core or the CLI.

Limits

• Direct human-owned mints only. An actor's mint and a resource-confined mint refuse
  operation_bindings, because their ceilings are decided on caller-named scopes.
• Invoke scopes only. A lookup-only parent still names its scopes.
• One authority read per resource id, once per parent.

Verification

• New adapter tests cover:

  • the parent carries the installed scopes, and the exchange redeems them;
  • a scope named twice is carried once;
  • refusals for an uninstalled binding, for an installation narrowed away from the
    binding's sources, for a person holding nothing under it (by name), and for an
    actor's mint.

  Each fails with the change reversed. Disabling the expansion fails 4 tests;
  disabling deduplication gives a duplicate-scope refusal.

• go test ./pkg/business/... ./pkg/adapters/... ./pkg/cataloggen/... passes.

• Regenerated with the documented pipeline, with the unchanged tree regenerated
  clean first:

  • codefly generate proto (CLI 0.1.185);
  • go generate;
  • codefly generate contracts and runnables, both clean under --check.

• The naming gate and scripts/check-boundaries.sh are clean.

Not verified

• No composed run, and no consumer sets the field yet. The published Go client
  needs regenerating first.
• codefly ci run was not run locally; CI covers it.

🤖 Generated with Claude Code

https://claude.ai/code/session_012qqzbsVZ4vDaPMecQ4FT8w

[antoinetoussaint-byte]

Independent review (fresh context, read at 8d83e9d6e against main, nothing run). Verdict: safe, do not merge as is.

No authority widening. The binding's scopes join authorityScopes and pass through the ordinary workContextScopes and the final resolveAuthority over every permission, so a binding never adds more than the caller could have named explicitly; resource ids come from the installation, never the request; a revision moving between the pre-filter and the final check refuses rather than widens. Actor and resource-confined mints are refused before any resolution; API keys, impersonation and forwarded sessions reach the same checks as before.

Major, fix before merge. start_task_operation_bindings.go:73, 107-118 against delegated_read_audience.go:219: a parent narrowed to part of a binding cannot be exchanged. The exchange asks for the binding's full invoke scopes and attenuateEffective narrows only a scope naming no ids, so a binding over sources [A, B] held at A only mints a parent with [A] and every exchange then fails as "audience exchange widens authority". Same when the person holds one of a binding's two scopes. Fails closed, but the PR's promise that the parent carries exactly what the exchange will redeem holds only for "holds all of it", and the error surfaces at the wrong step. Either refuse unless the person holds the whole binding, or make the exchange intersect with the parent; held == 0 matches neither.

Major/minor. :69: two scopes of one resource kind break the exchange, since de-duplication is exact proto.Equal and core's ScopeContained decides on the first scope of that kind; a caller scope source_operation:read [X] plus the binding's invoke,read [Y] mints and then refuses on exchange.

Minor. :88 pre-filters with mintContentReads where the mint uses the wider eligible, so a content-read binding held through a grant or share is refused as "holds nothing" although the mint would admit it. :107-115 runs one resolveAuthority read per resource id inside the authority span (bound ~32,000 reads per request). :52 builds an unauthenticated ModuleCaller, so module-caller refusal texts (another tenant's id, raw database errors, "not a registered module principal" for a solution audience) now reach people. Dropped ids and scopes are dropped silently and refusals in withOperationBindingScopes are not logged, unlike the exchange path. saas-sdk/generated/library.codefly.yaml:55 moves generated-by.codefly from 0.1.191 back to 0.1.185: regenerate with the newer CLI.

Tests missing. Partial hold of ids and of scopes (the fixture binding has one id, which hid the major), a resource-confined mint refused, another module's binding name, a same-kind non-equal caller scope, a headless-only binding, service == nil.

Interface consequence (from the authority work): the person shape of the interface's Issue would need the same operation_bindings field, additively, or the mini gateway and the host drift the day this lands.

[antoinetoussaint-byte]

Superseded by #1257 (3c53033): child issuance is rule A in the shared authority core, which accounts adopted, with the per-installation binding ceiling of codefly-dev/authority#36. Closed in the 2026-10-27 clean-up on the owner's instruction.