feat(accounts): the host interfaces are decided by the shared authority core

.gitattributes

@@ -11,4 +11,3 @@ module/services/telemetry/code/pkg/gen/** linguist-generated=true
 # Build recipes emitted by the pinned Go service agent.
 module/services/accounts/builder/** linguist-generated=true
 module/services/auth-gateway/builder/** linguist-generated=true
-module/services/policy-log/builder/** linguist-generated=true

.github/workflows/ci.yml

@@ -366,6 +366,26 @@ jobs:
       - name: Qualify the scoped reader, writer and request pools
         run: python3 scripts/qualify-scoped-pools.py --postgres-bin "${{ steps.postgres.outputs.bindir }}"
 
+  # The shared host-interface conformance suite at codefly-dev/authority main,
+  # against accounts: the newest authority that contains accounts' pin, so a
+  # case the suite adds or a rule the authority core changes reaches accounts on
+  # its next pull request, never silently on the next re-pin. The same suite at
+  # the pinned revision runs with accounts' tests in the quality phases.
+  host-interface-conformance:
+    name: Host interface conformance (authority main)
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: "1.27.3"
+          cache-dependency-path: module/services/accounts/code/go.sum
+      - name: Install Codefly
+        run: bash scripts/ci/install-codefly.sh
+      - name: Run the shared suite at authority main against accounts
+        run: bash scripts/ci/host-interface-conformance-main.sh
+
   marketing:
     name: Marketing isolation
     runs-on: ubuntu-latest
@@ -1146,6 +1166,7 @@ jobs:
       - codefly-quality
       - codefly-supply-chain
       - docs-sync
+      - host-interface-conformance
       - kit-version
       - marketing
       - module-package

AGENTS.md

@@ -190,11 +190,11 @@ Skills in `.claude/skills/`, loaded when the task calls for them:
 - Canonical **service** gate: `codefly ci run`. It owns lint, compile/typecheck,
   tests, dependency/vuln audit, SBOM, and container build for every service in
   the graph. See [RELEASE_GATES.md](./RELEASE_GATES.md).
-- Beside it, CI runs nine repository-specific gates that no service owns — the
+- Beside it, CI runs ten repository-specific gates that no service owns — the
   module verification job, authorization coverage, the release-gate contract,
   interface docs and story tests, the kit's version, marketing isolation, the
   SDK boundary, the immutable module package, the scoped pools' database
-  authority. [RELEASE_GATES.md § Repository-specific
+  authority, and the shared host-interface conformance suite at authority main. [RELEASE_GATES.md § Repository-specific
   gates](./RELEASE_GATES.md#repository-specific-gates) says what each runs, and
   `release-gates.test.mjs` holds this prose to the enforced set.
 - More checks run as *steps* inside the `base-integrity` job than as gates of their

CLAIM_INVENTORY.md

@@ -73,7 +73,7 @@ must not be inferred from a row here. See
 | Claim | Source | Executable evidence | Status | Owner |
 | --- | --- | --- | --- | --- |
 | `codefly ci run` is the canonical **service** gate and provider YAML reimplements none of it | RELEASE_GATES.md; AGENTS.md | `.github/workflows/ci.yml` `codefly-quality` / `codefly-supply-chain` / `codefly-build` | implemented | Codefly |
-| ~~"GitHub Actions ... does not encode Go, Rust, Next.js, protobuf, dependency, container, or service-specific commands"~~ and ~~base integrity is "the one repository-specific gate"~~ | RELEASE_GATES.md, AGENTS.md, before this change | nine repository-specific jobs run `node --test`, `go test`, `buf breaking`, `python3` and `npm` directly | **corrected** | #541 |
+| ~~"GitHub Actions ... does not encode Go, Rust, Next.js, protobuf, dependency, container, or service-specific commands"~~ and ~~base integrity is "the one repository-specific gate"~~ | RELEASE_GATES.md, AGENTS.md, before this change | ten repository-specific jobs run `node --test`, `go test`, `buf breaking`, `python3` and `npm` directly | **corrected** | #541 |
 | The documented repository-specific gate list is the enforced one | RELEASE_GATES.md § Repository-specific gates; AGENTS.md | `release-gates.test.mjs` compares the table and both prose counts against `REQUIRED_GATES` | implemented | #541 |
 | The complete audit runs `--fail-on-vuln=false`; a separate step enforces first-party findings fail-closed | RELEASE_GATES.md § Vulnerability policy | `.github/workflows/ci.yml` `codefly-supply-chain` | configured | Codefly + this repo |
 | No artifact-writing job runs unless every mandatory gate actually succeeded | RELEASE_GATES.md § Publication gating | `scripts/ci/release-gates.mjs check` + `decide`, `release-gates.test.mjs` | implemented (#535) | this repo |

RELEASE_GATES.md

@@ -12,8 +12,8 @@ same gate as this repository.
 guard artifacts and contracts no single service owns: the canonical base
 manifest that seeds every consumer, the authorization catalog, the release
 gating graph itself, the interface docs, the published frontend kit's version,
-the marketing isolation build, the SDK boundary, and the
-immutable module package. They run
+the marketing isolation build, the SDK boundary, the
+immutable module package, and the host interfaces accounts serves. They run
 `node --test`, `go test`, `buf breaking`, and `npm` commands directly — see
 [Repository-specific gates](#repository-specific-gates) for the full list and
 why each one lives here rather than in a plugin.
@@ -65,6 +65,7 @@ base-integrity ───────┐
 authz-coverage ───────┤
 release-contract ─────┤
 docs-sync ────────────┤
+host-interface-conformance ┤
 kit-version ──────────┤
 marketing ────────────┤                     ┌─▶ publish-module-package  (module-package/v*)
 sdk-boundary ─────────┼─▶ release-gates ────┼─▶ publish-frontend-kit    (v*)
@@ -110,6 +111,7 @@ no per-track exemption.
 | `authz-coverage` | required | required | RBAC, audit, and no-broadening |
 | `release-contract` | required | required | this gating graph itself |
 | `docs-sync` | required | required | interface docs and story tests |
+| `host-interface-conformance` | required | required | the shared host-interface suite at authority main |
 | `kit-version` | required | required | published frontend kit version vs. content |
 | `marketing` | required | required | marketing isolation build |
 | `sdk-boundary` | required | required | Codefly SDK boundary and contracts |
@@ -441,6 +443,7 @@ reverse, fails the `release-contract` job.
 | `authz-coverage` | the generated authorization catalog: RBAC coverage, audit coverage, and permission no-broadening against `main` | `node module/tools/authz-coverage-gate.mjs`, plus `go test` for the gateway header-lockstep and adapter enforcement tests |
 | `release-contract` | this gating graph itself, and the Dependabot configuration that feeds it | `node --test scripts/ci/release-gates.test.mjs`, `node --test scripts/ci/dependabot-coverage.test.mjs`, `node scripts/ci/release-gates.mjs check`, `node scripts/ci/dependabot-coverage.mjs check` |
 | `docs-sync` | the generated interface docs and the story-trace tests (#516) | `node module/tools/interface-docs-gate.mjs check`, `node module/tools/story-trace-gate.mjs tests` |
+| `host-interface-conformance` | accounts serves the host interfaces (authority, composition, installation) exactly as the shared conformance suite of `codefly-dev/authority` states them, at authority's main whenever main contains the pinned revision, so a case authority adds reaches accounts on its next pull request | `bash scripts/ci/host-interface-conformance-main.sh`, which re-pins the authority libraries to main when main contains the pin and runs `go test -run '^TestAccountsPassesTheHostInterfaceConformanceSuite$' ./pkg/adapters` |
 | `kit-version` | the published frontend kit's version moves whenever its content does, since a registry version is immutable once served | `node --test scripts/ci/kit-version.test.mjs`, `node scripts/ci/kit-version.mjs check` |
 | `marketing` | the marketing runtime builds in isolation from the app, and the public config is current | `node module/tools/generate-public-config.mjs --check`, `node module/tools/marketing-extraction.mjs` |
 | `sdk-boundary` | the root module's own tests, the Codefly SDK boundary, single-invocation protocol generation, the exported API contract, and the published module-authority client against the real host | `go test ./...` **in the root module only**, `go test codefly_sdk_boundary_test.go`, `codefly generate contracts saas-starter --check`, `codefly generate runnables saas-starter --check`, `go test ./...` in `qualification/module-authority` |

libraries/source-read-sdk/library.codefly.yaml

@@ -12,7 +12,7 @@ sources:
       module: saas-starter
       service: accounts
       endpoint: authority
-      contract-digest: sha256:01434d2862c0bead380d184d1f9323c6349b5d228447d24be85b8be1b296cde3
+      contract-digest: sha256:b818c862dd556e37c7ef597ba2109798a6e6ff957046100ab809575ff165e6a3
       services:
         - ModuleCapabilitiesService
 generated-by:

module/AGENTS.md

@@ -59,8 +59,8 @@ adding a REST-enabled RPC means editing it. Do not go looking for a generator.
 
 ## Go suites
 
-Every Go service here carries **its own `go.mod`** — `accounts`, `auth-gateway`,
-`store` and `policy-log` — and `tools` is another, with **no `go.work`** tying them together. So
+Every Go service here carries **its own `go.mod`** — `accounts`, `auth-gateway`
+and `store` — and `tools` is another, with **no `go.work`** tying them together. So
 `go test ./...` only ever covers the module you run it in, and a service's suite
 is outside whatever you run from the tree root. The canonical repository adds its
 own root module (the module agent, the host, and the generated reference