Complete GH-WP-0001-T04 authority context contract

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a05e30-2884-71b0-98d7-7edd16ae737b

docs/adr/ADR-001-canonical-authority-context-contract.md

@@ -0,0 +1,83 @@
+# ADR-001 — Canonical authority context contract
+
+**Repository:** gate-house  
+**Status:** accepted  
+**Date:** 2026-09-01  
+**Workplan:** GH-WP-0001-T04
+
+## Context
+
+Gate House owns the vocabulary of an agentic authority request, while
+access-engine is NetKingdom's only policy decision point. The surviving
+`ArchitectureBlueprint.md` material named the required concepts, but left them
+inside an obsolete canonical authorization-request example that also portrayed
+Gate House as an in-path service.
+
+Without a standalone contract, consumers can collapse identity roles, infer an
+operating mode, treat caller-supplied context as verified fact, or implement
+incompatible field meanings. Conversely, prescribing an access-engine API or
+executable policy schema here would recreate the Staff/Engine boundary error
+resolved by GH-DEC-2026-001.
+
+## Decision
+
+Gate House publishes
+[`authority-context.v1`](../contracts/authority-context.md) as a logical claims
+contract.
+
+The contract defines eight claims:
+
+1. principal;
+2. actor;
+3. runtime identity;
+4. tenant;
+5. environment;
+6. mandate;
+7. task;
+8. operating mode.
+
+It defines their meanings, source and binding expectations, mode-specific
+requiredness, fail-closed conditions, evidence obligations, and versioning.
+
+The contract is deliberately not a wire format, token, API, policy package, or
+runtime resolver. Access-engine owns those representations and the
+deterministic interpretation of the context alongside verified identity
+claims, action, resource, approval, posture, and other policy inputs.
+
+No field grants authority by being present. Caller assertion and authoritative
+evidence must remain distinguishable, and security-critical resolution failure
+fails closed.
+
+## Consequences
+
+- Access-engine has a stable semantic target without Gate House taking a
+  runtime position.
+- Identity, tenancy, zone, and mandate sources remain owned by their respective
+  authorities; this contract only says what access-engine must be able to
+  express and bind.
+- Transport-specific schemas may differ, but their mappings must preserve the
+  logical claims and invariants.
+- New authorization-significant claims, modes, or semantic changes require a
+  new contract version and Gate House review.
+- The obsolete Blueprint example remains historical input until GH-WP-0001-T05
+  revises that document; this contract is the current authority-context record.
+
+## Alternatives rejected
+
+### Publish a Gate House `/authorize` schema
+
+Rejected because Gate House is Staff and holds no request-time position.
+Owning an endpoint or executable decision schema here would contradict
+GH-DEC-2026-001 and INV-02.
+
+### Let each consumer infer the vocabulary
+
+Rejected because principal/actor collapse, mode ambiguity, and unverified
+caller context are precisely the semantic failures the doctrine must prevent.
+
+### Put every claim into a credential
+
+Rejected because credentials are implementation artifacts of authorization,
+not the source of authority. The context need only remain linked across the
+authoritative systems and decision evidence.
+