feat: consume account authority and refresh blocked dependencies

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a0e747-8f27-7242-8df8-8bc44f88c929

docs/owner-access-integration.md

@@ -35,7 +35,10 @@ or use `/me` as an account-provisioning side effect.
 The follow-up [owner facts contract](owner-facts-contract.md) pins the re-reviewed
 sources and owner decisions needed for actual HTTP readers. `PlatformFacts` now
 provides the typed, bounded Hub-side join with live revocation and evidence
-binding; it intentionally has no fabricated network endpoints or default grants.
+binding. As of 2026-10-04, `UserEngineAccountReader` implements the actual
+owner HTTP route and accepted custody observation contract. Tenant HTTP admission,
+real Hub credentials and complete live composition remain open; see the updated
+contract for the exact dependencies. No default grant is supplied.
 
 ## Audit Core adapter and sender admission
 

docs/owner-facts-contract.md

@@ -1,9 +1,12 @@
 # Platform authority facts: owner review contract
 
-HUB-WP-0012 T01/T02, 2026-09-28. Proposed owner contract and implemented Hub-side
-composition; **no admitted HTTP adapter or production authority source**.
+HUB-WP-0012 T01/T02, reviewed 2026-10-04. Hub-side composition and User Engine
+HTTP client are implemented; **no real Hub caller admission or complete live
+account/tenant composition is claimed**. The current client contract and remaining
+owner requirements are in [the October 4 update](#implemented-account-reader--2026-10-04);
+the earlier sections preserve the initial review.
 
-## Reviewed source
+## Historical source review — 2026-09-28
 
 - User Engine `b4cef6446bc10555b598ea74de1743bc9b03e7ba`:
   `service.py::me` creates user/account/tenant-account/identity records for unknown
@@ -33,7 +36,7 @@ This closes the read-only **service primitive**, not the wire contract or admitt
 Hub workload. USER-WP-0037 owns root-grant/mapping disposition and authenticated
 HTTP exposure/private acceptance. No database, live grant or credential changed.
 
-## Contract for owner disposition
+## Initial contract for owner disposition — 2026-09-28
 
 | Requirement | Owning decision |
 | --- | --- |
@@ -51,7 +54,7 @@ The Python types below are an internal normalization seam, **not a proposed
 HTTP endpoint that already exists**. Missing/unknown/ambiguous results must raise
 and deny; they must never synthesize an active account.
 
-## Implemented composition
+## Initial composition — 2026-09-28
 
 `hub_core.security.facts.PlatformFacts` implements `FactSource` with injected
 `AccountReader` and `TenantReader`. The account reader returns a typed
@@ -81,7 +84,7 @@ and mapping references. Readers/owners must retain the referenced evidence for
 reconstruction; this hash is a join identifier, not a signature or independent
 proof of owner authenticity. No account payload or credential enters the join.
 
-## Acceptance cases and remaining work
+## Initial acceptance cases and remaining work — 2026-09-28
 
 Local tests cover exact bindings, malformed state, stale/future observations,
 oldest-timestamp preservation, bounded outages, repeated lookup, entitlement and
@@ -93,3 +96,77 @@ real authenticated readers, and isolated owner-source integration tests proving
 unknown lookups create nothing. Private acceptance must then demonstrate root
 allow, ordinary/forged identity denial, next-request revocation and owner outages
 with real admitted callers. No public exposure follows from this contract.
+
+## Implemented account reader — 2026-10-04
+
+The historical missing-endpoint assessment above is superseded by User Engine
+`a9360842f84fae89857c2b1a298efc64d079ee7b`, USER-WP-0037 and accepted
+NetKingdom ADR-0017 revision 2 (`45a189a39167eef62709df0e857309f7ddc59029`).
+`UserEngineAccountReader` implements the existing
+`POST /api/v1/platform/account-authority/lookup` wire contract. Its independently
+configured bearer maps to the fixed admitted workload at User Engine; it never
+forwards the human's Hub token or invents root entitlement.
+
+A host injects a `UserEngineAccountReader(base_url=..., token_file=Path(...),
+client=...)` into `PlatformFacts(accounts=..., tenants=reviewed_tenant_reader,
+account_tenant="platform", mapping_evidence="NK-ADR-0017:2")`. The HTTP client
+must be lifecycle-owned, with `trust_env=False` and no ambient authorization or
+cookies (as in the existing security composition). The token file is dedicated
+to this User Engine caller, not the PDP/audit/browser credential. Nothing is
+automatically enabled by environment variables or this documentation example.
+
+The reviewed custody adapter and its real service integration fixture require
+lookup tenant **`platform`**. This differs from User Engine's legacy operator
+context `platform:root`; neither is silently normalized by the reader. The
+canonical Hub actor/target remains `tenant:platform`. Before live enablement,
+owners must confirm the real account has the intended scoped account and that
+this exact mapping is admitted; a missing scoped account is inactive.
+
+The response must bind issuer, subject and lookup tenant, identity/account/user
+references, decision reference, known global/scoped status, and timezone-aware
+observation time. `root_grant:null` means no entitlement. A non-null grant must
+match exact issuer/subject, `scope_type:tenant`, `scope_id:platform`, relation
+`platform-root-custodian`, owner `net-kingdom-custody`, source record
+`nk-custody:platform-root`, positive integer revision and valid timestamps.
+Unknown/expired/revoked or differently scoped observations fail closed.
+
+Hub deliberately keeps its stricter five-second source age on every read/write,
+even though the canon permits up to fifteen minutes elsewhere. The earliest
+account/custody timestamp is retained, and the grant's absolute expiry travels
+through AccountObservation and LiveFacts to the final post-audit check. The
+reader trusts User Engine's authenticated observation; User Engine owns durable
+custody revision/rollback validation. A content digest identifies retained
+account/grant evidence but does not independently authenticate the publisher.
+No producer aliases are supplied by this contract, so the result has none.
+
+Every call rereads a bounded workload credential, uses non-local HTTPS and a
+three-second total budget, limits the response to 64 KiB, rejects redirects,
+compressed responses and nonzero Age headers, and exposes sanitized failures.
+No caching or same-token fallback exists. User Engine's current environment-based
+receiver credential rotation still needs an owner rollout/revocation receipt.
+
+## Remaining dependencies — 2026-10-04
+
+| Hub tasks | Owner and required artifact | What unblocks Hub |
+| --- | --- | --- |
+| 0012-T01 | net-kingdom, user-engine, tenant-engine, access-engine and platform surface owners: reviewed action/audience/tenant/enforcement matrix with disputed rows resolved | Signed-off source/profile mapping; executable per-owner acceptance cases |
+| 0012-T02 | user-engine USER-WP-0037-T03 + railiance-platform/rapp-user-engine: actual Hub workload identity, dedicated credential delivery/rotation reference, TLS origin and scoped account mapping | Wire this implemented client to an admitted private endpoint and prove allow/deny/withdrawal/outage without owner payloads or credentials in evidence |
+| 0012-T02 | tenant-engine + deployment owner: authenticated Hub caller binding for authoritative lifecycle read, canonical identifier/record version and observation time | Implement TenantReader against that admitted response; do not treat actor query text or roles/live as workload authentication |
+| 0012-T02 | net-kingdom/KeyCape + custody owner: actual immutable root identity, approved nonempty custody grant where intended, Hub audience/redirect registration and attended AAL2/recovery/revocation receipts | Real positive root journey; the accepted empty custody source proves denial only |
+| 0012-T03 | access-engine + platform owner: Hub protected-system policy, authenticated workload grant, pinned trusted public keys and credential delivery; audit-core + platform owner: Hub sender classes including hub.operation.committed, operational custody and rotation/failure receipts | Compose real PDP/audit dependencies; existing FLEX-WP-0024/0025 source completion does not admit Hub |
+| 0012-T04 | rapp-core-hub plus T02/T03 owners: pinned private image/migration/composition, network boundary, explicit owner-bound messaging/event producer aliases and rollback | Execute real browser/API/MCP, direct-service bypass, revocation and audit-outage acceptance |
+| 0012-T05 | ops-hub first, other inventoried extensions, activity-core/Repo Manager/inbox caller owners: per-audience identity/delegation/tenant contract and host enforcement | Root and workload allow plus anonymous/non-root/wrong-audience/tenant denial with separate attribution |
+| 0012-T06 | platform/Railiance owners after T04/T05: attended per-surface management and audit receipts | M1 requires every inventory row, not a navigation link or broad provisioning decision |
+| 0012-T07 | rapp-core-hub RAPPCOREHUB-WP-0002-T05 after M1: explicit public-enable authorization, TLS/bypass/rollback packet | Package and enable only the reviewed public release |
+| 0012-T08 | identity/tenant/policy owners after M1: roles, delegated principals and stored tenant provenance | Phase 2 implementation can start without inferring tenant authority from legacy data |
+
+These requirements update the existing workplans; they are not messages claiming
+external owners have accepted new work. No control was relaxed or live credential
+retrieved in this review. Workplans 0006/0011 independently retain A5/A4 cutover
+and inbox source-feed/retention/reader-admission requirements.
+
+Local verification: `make ci-check` covers normalization, transport refusal,
+rotation, withdrawal and post-audit expiry. To exercise the actual owner route
+and serializer with synthetic authority, run
+`HUB_CORE_USER_ENGINE_SOURCE=/home/worsch/user-engine .venv/bin/python -m pytest -q tests/test_user_engine_owner_contract.py`.
+The owner suite is explicit opt-in and does not contact a live endpoint.