[lukazhupa]

A module can now read the complete source set permitted by one effective executable-artifact policy for one exact current installation through Client.ListExecutableArtifactSources. The SDK preserves independent module and human-parent proofs, checks the returned policy/installation association, and exposes zero/one/many choices without choosing a source or granting approval.

This is a fix at the SDK owner, reusing callAsModule, the maintained generated client, the existing sealed-token structural check and current-installation identity validation. It adds no verifier, source registry, mint, fallback bearer transport or launcher. The consumer still checks its independently verified tenant, applies its source grammar/reserved-name rules and explicitly selects/checks a source; later actions recheck authority.

Contract and provenance

• Depends on public host PR1195 at exact f9321b94d91eb91252e7611d571d5bf99cca370a; this remains a development candidate, not a released contract.
• SOURCE.txt records that exact ref and unchanged upstream module package version0.1.0. No release/tag is created.
• The documented SDK Buf1.73.0 recipe and unchanged protoc-gen-go1.36.11 / protoc-gen-connect-go1.20.0 regenerate the complete saas/ tree; no generated files are hand-edited or partially kept. Core descriptors remain owned by Core.
• Unchanged-input control reproduces all86 committed generated files byte-for-byte. A second full generation reproduces the candidate tree exactly. All upstream contract changes are retained, including unrelated delivered-presence changes. CHANGELOG documents removed mutable backend-registration types/fields and workload mint Upstream/Manifest fields, plus earlier SessionId removals.
• Explicit Codefly191 generator controls were retained locally as diagnostic evidence; they add import-format churn even without proto changes. This PR follows the repository's maintained native Buf workflow, which its unchanged gen-drift CI enforces. It does not migrate that pipeline.

Verification and blocking dependency

Passed locally with GOWORK=off: complete build, vet, test and race walks, including API-boundary and agent-context gates; authored gofmt and diff checks; exact full-tree generation reproduction. New serialized gRPC tests cover independent credentials and exact selectors, zero/one/many results, malformed association/set rejection and refusal without fallback/approval.

Real-host gateway conformance did not compile: unchanged moduleauthority/verifier_sources.go references Core's removed ErrNoApprovedBuild when the host's selected Core revision enters the composed build. Owner issue #46 records the exact command/revisions. Existing draft #45 owns Core/host migration and uncached organization minting, but currently selects earlier Core v0.19.4 and reports merge conflicts; this PR does not duplicate that migration or lifecycle API. Reconcile that owner work and rerun the unchanged conformance guard before readiness.

No live Accounts admission, production h2c/mesh path, installation provisioning, consumer publish/validate/activate/execute loop or deployed behavior has been qualified. Member disclosure and complete-set semantics still require canonical owner acceptance. Fresh independent review of exactc56e570 confirms the authored read logic and focused transport/API tests, and independently reproduces the complete generated tree. It found one P2 inherited upstream documentation contradiction: SealsNoBinding prose claims immediate refusal of omitted assertions while the selected host preserves phase-one legacy compatibility. Host owner issue1196 records the source correction and full regeneration required; generated Go must not be patched. Keep this PR draft until that owner correction, compatibility, contract acceptance and composed qualification are resolved.

[lukazhupa]

Closing for now: this is outside the current focus and overlaps the in-flight SDK refresh in #45. The accessor can be re-derived from the host change if this capability is picked up again.