[antoinetoussaint-byte]

What we are trying to do

A person reading through a solution (the wiki) must reach the document store as the solution's installation allows, and nothing more. Since codefly-dev/authority#7, the authority issues a person's Work Context at a solution with every role scope selected to the installation's principal (resource_owner_id). It then holds a child of that context to what that owner holds there: a child is the owner's current grants intersected with the binding (authority-core decide.Issue / scope.Attenuates).

issueChild sent its ask without an owner. The authority reads an owner-blind ask as covering every owner's resources, so it refused every call relayed through a solution:

issuer: refused: a child widens what its owner holds through binding "documents": a capability issued through a solution is confined to its principal's data, and the person's own grants never flow into it

This was observed live in the wiki playground before the change.

What changed

• selectedOwner(wc) returns the one owner that a checked Work Context's effective scopes select. The effective scopes are the current actor's granted_scopes, or authority_scopes when no actor has hopped. If the scopes select no owner, or more than one, it returns "": the runtime never chooses between owners. In that case the authority refuses an ask that needed an owner, and says why.
• The viewer (requestViewer) records that owner from the authority's own Check answer (viewerGateway). The runtime still decodes nothing.
• issueChild names that owner on every scope a ForParent child asks for. A gateway built outside a request names no owner.
• The authority client and hop libraries move to authority main f41cc2ba for WorkScopeV1.resource_owner_id. go moves to 1.27.3 with them (the libraries require it).

Reused: the authority's generated client, the hop library's IssueForParent, and the Check answer the runtime already asks for on every request. Not added: any token decode, any second issue path, or any new scope field on the public Scope type.

Classification: fix, at the place that owns the behaviour. This runtime builds every child ask. The wiki's local proof had patched this function by replace, decoding the parent token; this PR replaces that patch with the authority's answer.

Tests

• TestTheSelectedOwnerIsTheOneTheEffectiveScopesSelect covers: no scopes; owner-blind scopes; one owner (repeated, mixed with owner-blind); two owners (none named); the current actor's grants winning over the authority scopes; an actor granted no owner.
• TestAChildNamesTheOwnerItsParentIsSelectedTo checks, through the stand-in authority:
  • a child of a person's context at an installation names the installation's principal on every scope, and keeps its ids;
  • a child of an owner-blind context names none;
  • a gateway with no checked viewer names none.
• TestThePassthroughRelaysAsTheViewer now also relays as a person at an installation and checks the owner on the child's ask.
• Mutation check: with ResourceOwnerId: owner dropped from issueChild, both owner tests fail.
• Gates: go test -race ./... -count=1, go vet ./..., gofmt -l . and go mod tidy -diff.

Proved end to end

obin-ai/core-solutions wiki playground (the companion PR, pinning this head 8ea6c260 with no replace), naming scope owf2, 2026-10-27T02:20Z. The run used document store aca93a1f (#594, owner-aware), robin 73620352, authority main f41cc2ba, and the CLI built from cli main c791071b. There were no local patches.

1. Dev, an Acme editor, uploads through the wiki: 200. The store logs collection attached to the installation it was created for installation=fc555ea7-… owner=32fa57d8-….
2. Dev's ListCollection returns 200 with the document, and Search returns 200 with the hit, both through the hop.
3. Omar and Zoë, through Globex's installation, get 403 on ListCollection of Acme's collection: documents.collection:read is limited to the collections 3c5ff48c-… owns. Search returns nothing.

Not verified / follow-ups

• No tag is cut because this PR is not merged. The wiki pins this branch head's pseudo-version, so please merge with a merge commit to keep 8ea6c260 reachable, then cut the release and re-pin the wiki.
• obin-ai/core-solutions solutions/proposals also pins e53e044. It moves when that solution relays through a binding under owner-selected roles; this PR does not touch it.

🤖 Generated with Claude Code