[antoinetoussaint-byte]

What we are doing

On a composed run against saas 3c530337, every reconcile pass logged the authority core: "<solution>" is not a composed solution; a module is installed by composition. A member of the declaring organization reached the solution, but the role they hold there never arrived in the core. Their upload was refused with a child widens what its owner holds through binding "documents" … the person's own grants never flow into it.

Root cause

• ApplyComposition (pkg/business/authority_delivery.go) records the carrier, runs a reconcile pass, and only after that pass returns composes the module in the authority core (applyCoreModule).
• The reconcile pass ends by converging the fixture's declared installations (AfterEachPass, work.go). That convergence ran before the module had been composed in the core, so each core install was refused (authority-core lifecycle.go:326, install: "not a composed solution").
• As a result, the solution's core installation, and its owner's and teams' role grants, were never made.

The fix

• SolutionHostBindingReconciler.RunOnce (pkg/business/solution_host_bindings.go) composes each binding it applies in the core right after applying it. It reads the inbox's exact applied generation and its signed authority document (composeAppliedDelivery, refactored out of reconcileAuthorityCore). This happens before the module registry is derived and before the fixture installations converge.
  • It covers every delivery path.
  • ApplyComposition's own composition after the pass becomes a replay that changes nothing.
• Fixture convergence (fixtures/installations.go) treats a target the core has not composed yet as something to wait for: it keeps the row for the next pass instead of reporting a refusal. A module's installation stays accounts' own record alone.

Tests

• The conformance harness case "a solution delivered to a running host is installed where the fixture declares it" covers a fixture that declares a solution delivered after boot, with its Finance team. The pass that applies the delivery installs it in the core, active at Acme and absent at Globex, and the Finance team holds its viewer role. It fails without the change.
• The control-plane call-site inventory is regenerated (composeAppliedDelivery replaces reconcileAuthorityCore as the site).

Not addressed here

• accounts' own installation row for a solution stays pending until the solution's install step is acknowledged by its consumer. Until then GrantInstallationToTeam refuses (is not an active installation in this organization, pkg/infra/postgres_installations.go). The core installation and its role grants, which the host interfaces decide with, no longer depend on it.
• The revision churn the same retries caused is fixed separately in fix(accounts): ensuring a derived role that is already as declared writes nothing #1259.
• I did not repeat the composed run against this branch.

Fix or hack

A fix, at the reconcile pass that applies deliveries. Reused: applyCoreModule (idempotent on a generation the core holds), the inbox's stored documents, and the fixture's install path.

🤖 Generated with Claude Code