[antoinetoussaint-byte]

The solution-side receiver for a pending installation's setup. It runs on the existing listener and is verified only by the Authority's dedicated installation-step verifier. Full evidence: .lazybox/artifacts/installation-receiver/report.md in the runtime73 worktree.

What

Request. POST /_codefly/installations is SaaS's existing delivery path and Authority's InstallationStepHTTPMethod.

• Exactly one x-codefly-work-context.
• The body is exactly {installation_id, organization_id, revision}. A scope or any other member is refused 400.
• x-codefly-installation-id and -revision must equal the body.

Verification. The runtime calls AuthorityService.Check at that exact method, with its own delivered principal as the audience and never in advisory mode. Before the step runs or any cached ack is answered, the verified context must match:

• organization and tenant;
• the installation seal and its revision;
• the audience.

It must also have a non-empty task_id, no actor chain, and the sole scope installations:install:[id].

The step. OnInstall(func(ctx, Installation) error) gets Installation{ID, OrganizationID, Revision, OperationID} and no Gateway. With no OnInstall the answer is 409, never 204. An explicit no-op acknowledges.

Once-ledger. Keyed by (installation, revision, consent operation), per process. It answers only after a fresh successful Check on every request.

Answers.

• 204: done.
• 409 {reason}, with one generic reason when the authority refused:
  • RefuseInstall;
  • PermissionDenied, InvalidArgument, Unauthenticated or NotFound;
  • a refusal returned beside the context;
  • a mismatch;
  • no declared step.
• 401: no single credential was carried.
• 400: a malformed body or carriers.
• 503: FailedPrecondition, Canceled, DeadlineExceeded, Unavailable, Internal, or a failed step.

Classification

Fix, at the owner of the behaviour. Authority verifies, and the runtime compares and runs the step. Not revived from the deleted legacy handler: success from a parsed carrier alone, a nil-step acknowledgement, or the step acting under the carried capability.

Reuse

Reused: SaaS's existing delivery path and statuses, the existing Check RPC and hostAuthority, and the deleted handler's bounded once-ledger and sanitizer. There is no new RPC, pin or proto change. Not added: a runtime generation slot, since Authority checks generation through its signed binding and current state.

Owner contract and qualification

Authority. Authority10882's contract is at codefly-dev/authority 21ce6d9 (tree 86e128ec), which includes the step verifier and its maintained generation. This PR selects authority-client/go v0.1.1-0.20261029092314-21ce6d9284ed, the confirmed coordinate. hop is unchanged.

Receiver against Authority's real local plugin at 21ce6d9. Both in process and as the installreceiver process booted through Serve and reached over HTTP:

• 409 for a wrong audience, a tampered credential, another revision/org/installation, and no step;
• refuse → 409, fail → 503;
• ack → 204, then 204 on redelivery, recorded once;
• 503 after activation.

Paired crossing, SaaS10887, PASS. TestCanonicalCombinedInstallQueueThroughRuntime covers native PostgreSQL → combined review/install → SQL claim → Accounts HostAuthorityServer.Check → this receiver at e6809f5 as a process → finish → final transaction:

• ack → active;
• refuse 409 and fail 503 → pending;
• a cached-ACK redelivery → 204;
• post-active → 503.

Evidence: runtime73's .lazybox/artifacts/installation-receiver/HANDOFF.md, and SaaS's install-final-qualification/canonical-queue-receiver-3.log.

Docs

README.md ("The install step"), AGENTS.md and CHANGELOG.md.

Tests

installation_test.go runs against a stand-in authority. Nine production mutations each turn it red; the list is in the artifact. Out of tree, a scratch go.work ran the receiver against Authority10882's frozen uncommitted candidate, using its real local AuthorityService plugin and a real IssueInstallationStep. Results:

• 204, with the step run once on the verified facts;
• every mismatch refused before the step runs;
• a redelivery answered from the ledger after a fresh Check;
• after core.Install activated, the same credential got 503 (FailedPrecondition), and the cached 204 was not replayed.

go test -race ./..., vet and gofmt are green.

Not verified

• No deployed gateway, cell or live composition. SaaS's crossing used the gateway's request shape from a test.
• The receiver binary's hash is not recorded in SaaS's artifacts.
• Consumers adopt this by pinning v0.0.17-0.20261029092559-e6809f537977. Product117 consumes it locally before merge.

🤖 Generated with Claude Code