feat(moduleauthority): add gateway transport and audit declaration

AGENTS.md

@@ -88,7 +88,7 @@ workflow) and fails on any difference — the reproduction check from the
 | `settings/` | presence-aware `Field[M, T]` runtime; `JSONCodec` is the only typed↔ProtoJSON boundary |
 | `settings/catalog/` | Go / TypeScript / proto catalog renderers that `module-compose` calls |
 | `workcontext/` | callee-side verification: HTTP, Connect, gRPC middleware plus scope checks |
-| `moduleauthority/` | a module's own authority: Work Context mints at the gateway broker, exchanges on accounts' `authority` gRPC endpoint |
+| `moduleauthority/` | a module's own authority: gateway broker mints; direct Accounts exchanges or an explicitly selected gateway operation-authority bridge |
 | `gen/` | generated output. Regenerated, never edited |
 | `internal/apiboundary` | the public-API boundary gate, with fixtures that prove it still looks |
 | `internal/agentcontext` | the budget and frontmatter contract for this file and the skills |

CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## Unreleased — audit effect receipts
+
+- Added `moduleauthority.Client.EmitAuditEvent` and `LookupAuditEvent` with
+  complete intent, current module authority and preserved host error codes.
+- Empty receipts remain inconclusive; no automatic effect retry.
+- Regenerated from the exact local host commit in `SOURCE.txt`. Module version
+  remains 0.1.0; these contracts are not a published release.
+
+
+## Unreleased — runtime boundary attestation
+
+- Added `moduleauthority.Client.VerifyWorkContextRuntimeBoundary`, preserving the
+  forwarded capability and independently authenticating the consuming module.
+- Regenerated the complete API from the local host experiment recorded in
+  `SOURCE.txt`; module version remains 0.1.0. This is not a published release.
+
+
 ## Unreleased (targets 0.1.0)
 
 Regenerated `gen/` from `module-saas-starter` main (see `SOURCE.txt` for the

README.md

@@ -88,6 +88,23 @@ The SDK surfaces are:
   op, err := authority.MintModuleOperationContext(ctx, installedBindingID)
   // op.Token goes in x-codefly-work-context on the call to op.Audience.
   ```
+  `VerifyWorkContextRuntimeBoundary(ctx, forwarded)` uses the same independent
+  module authentication to attest an original viewer capability. Its result
+  (`TenantID`, `BoundaryID`) is a current observation, never a grant or a cached
+  proof: the consumer must compare both to its independently verified context
+  and enforce the context's scopes. The host requires an active registration
+  with both halves live and compatible. This method requires the unreleased
+  host contract recorded in `SOURCE.txt`.
+
+  `EmitAuditEvent(ctx, AuditEvent)` and `LookupAuditEvent(ctx, AuditEvent)` use
+  that authority seam for registered audit effects. Keep the complete event and
+  its stable key for recovery. A lookup returns `AuditReceipt.EventID` only for
+  matching intent under current host authority. An empty ID is inconclusive;
+  neither method automatically retries an uncertain effect. Host error codes
+  remain available through `connect.CodeOf(err)`, including failed preconditions
+  for changed intent or historical keys without a verifiable receipt. These
+  methods require the same unreleased host contract in `SOURCE.txt`.
+
 - **`settings/`** — the schema-agnostic typed-settings library every module and
   product depends on instead of vendoring a copy. It has two parts:
 
@@ -190,3 +207,17 @@ import (
     v1 "github.com/codefly-dev/saas-sdk-go/gen/saas/accounts/v1"
 )
 ```
+
+### Gateway-only operation authority
+
+`moduleauthority.NewGatewayAuthority(seams, credentials)` selects the host's
+`/modules/_authority` bridge for operation exchange, runtime-boundary verification,
+audit emission and receipt lookup. Leave `seams.Authority` empty; this constructor
+rejects a simultaneous direct endpoint and never falls back to one. It retains
+the normal credential validation, no-redirect HTTP client and one authentication
+refresh. Other authority methods are not exposed by this bounded bridge.
+The wire format is binary protobuf over Connect; the gateway forwards the
+canonical messages to Accounts without maintaining a second message schema.
+
+This constructor requires a host implementing that bridge. Its source tests cover
+transport behavior; they do not qualify a selected host release or composition.

SOURCE.txt

@@ -1,4 +1,4 @@
-gen/ generated from codefly-dev/module-saas-starter@c201081235a61da83500db4c30a8bbec7d391e1a
+gen/ generated from codefly-dev/module-saas-starter@cc7c530c9b09455bf00ac15f2558817363396c7b
 (accounts public proto: module/services/accounts/proto)
 
 module version: 0.1.0 (module/module.package.codefly.yaml)

datasource/types.go

@@ -10,6 +10,7 @@ import v1 "github.com/codefly-dev/saas-sdk-go/gen/saas/accounts/v1"
 // itself: a consumer who can hold the value but cannot name the type of one of
 // its fields is still forced to import the generated tree.
 type (
+	DatasourceLiveDelivery = v1.DatasourceLiveDelivery
 	// Datasource is the non-secret projection of a connected source.
 	Datasource = v1.Datasource
 	// DatasourceStatus is the ingestion status carried by a Datasource.
@@ -67,3 +68,11 @@ const (
 	ApiCredentialKindQuery       = v1.ApiCredentialKind_API_CREDENTIAL_KIND_QUERY
 	ApiCredentialKindOAuth2      = v1.ApiCredentialKind_API_CREDENTIAL_KIND_OAUTH2
 )
+
+const (
+	DatasourceLiveDeliveryUnspecified   = v1.DatasourceLiveDelivery_DATASOURCE_LIVE_DELIVERY_UNSPECIFIED
+	DatasourceLiveDeliveryNone          = v1.DatasourceLiveDelivery_DATASOURCE_LIVE_DELIVERY_NONE
+	DatasourceLiveDeliverySourceWebhook = v1.DatasourceLiveDelivery_DATASOURCE_LIVE_DELIVERY_SOURCE_WEBHOOK
+)
+
+const DatasourceLiveDeliveryAppWebhook = v1.DatasourceLiveDelivery_DATASOURCE_LIVE_DELIVERY_APP_WEBHOOK