Carry the tenant claim's provenance, and correct a guard the ruling voided

GH-DEC-2026-013 §5 is a finding nobody asked for and ours to implement: tenant is
a bare string, so a consumer cannot tell a zone the directory asserted about the
person from one a registration supplied about the client they came through.
approval-engine exact-matches that string while its contract reads as though it
relies on the first -- the check is sound and the property a reader infers from
it is absent. gate-house named the property and left the mechanism to us.

Every token now carries tenant_source beside tenant: directory, registration or
default. Advertised in claims_supported, and asserted at the token level on both
grants rather than only in the resolution function, since the claim a consumer
reads is the thing under obligation.

Three values where the ruling names two, which is the judgement here. Labelling
an unasserted profile default as directory would reproduce the same defect one
level down -- a consumer reading an assertion the identity layer never made. The
ruling cites GH-DEC-2026-011 §3 on unknown versus absent for the case it
examined; the same rule applies to our own fallback. The agreement case resolves
to directory deliberately: if a registration declares the zone the directory also
assigned, the directory did assert it, and reporting the weaker source would
understate what is known.

Also corrects the guard shipped in 5f516a0. Its failure message offered two ways
out of adding dynamic registration, and condition (b) voids the second: admitting
dynamic registration voids the registration-bound shape that day, whatever state
the adapter is in. The message named an inadmissible resolution in the exact
place someone would read it while making that change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713576@bnt-lap001
Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6

src/internal/server/oidc/tenant_precondition_test.go

@@ -22,6 +22,14 @@ import (
 // lifted while the capability is present, and its failure message says what to do
 // about it rather than merely reporting the endpoint.
 //
+// gate-house GH-DEC-2026-013 condition (b) then strengthened the rule against us.
+// We had written that it "must be revisited" if the exclusion is lifted; the
+// ruling holds that revisited implies the answer might survive review, and it
+// would not. Admitting dynamic registration voids the registration-bound shape
+// outright. The failure message says that, because the earlier wording offered a
+// way out the ruling forbids, in the exact place someone would read it while
+// making the change.
+//
 // The two halves are asserted together on purpose. Whichever is removed first,
 // the test points at the other.
 
@@ -59,8 +67,81 @@ func TestRegistrationBoundTenantRequiresStaticRegistration(t *testing.T) {
 		t.Fatal("dynamic client registration is advertised while a client registration " +
 			"may declare its users' tenant. That combination lets anyone who can register " +
 			"a client relabel the users who log in through it into a zone of their choosing. " +
-			"Resolve it deliberately: either drop the registration-bound tenant, or gate it " +
-			"so only statically configured registrations may declare one. See " +
-			"docs/tenant-claim-contract.md, 'How a human token's tenant is resolved'.")
+			"Per gate-house GH-DEC-2026-013 condition (b) this is not a trade-off to " +
+			"rebalance: admitting dynamic registration VOIDS the registration-bound tenant " +
+			"that day, and the directory becomes the only source, whatever state the " +
+			"directory adapter is in. Gating the capability to statically configured " +
+			"registrations is not an available answer. Remove the client-declared tenant, " +
+			"or do not admit dynamic registration. See docs/tenant-claim-contract.md, " +
+			"'How a human token's tenant is resolved'.")
 	}
 }
+
+// GH-DEC-2026-013 §5: the claim must carry its provenance, so a consumer can
+// tell a zone the identity layer asserted about the person from one a
+// registration supplied about the client they came through. The unit rule is
+// covered in human_tenant_test.go; this asserts the claim actually reaches
+// issued tokens, on both grants, which is what a consumer reads.
+func TestIssuedTokensCarryTenantProvenance(t *testing.T) {
+	t.Run("human, registration-supplied", func(t *testing.T) {
+		sessions := oidc.NewSessionStore()
+		h, _ := newTokenHandler(t, sessions, &mockUserRepo{users: map[string]*domain.User{"alice": aliceUser()}})
+		h.ClientConfig["test-client"].Tenant = "tenant:platform"
+		claims := issueHumanToken(t, h, sessions)
+		if claims["tenant"] != "tenant:platform" || claims["tenant_source"] != oidc.TenantSourceRegistration {
+			t.Fatalf("tenant %v / source %v", claims["tenant"], claims["tenant_source"])
+		}
+	})
+
+	t.Run("human, directory-asserted", func(t *testing.T) {
+		user := aliceUser()
+		user.Tenant = "tenant:friendly:binky"
+		sessions := oidc.NewSessionStore()
+		h, _ := newTokenHandler(t, sessions, &mockUserRepo{users: map[string]*domain.User{"alice": user}})
+		claims := issueHumanToken(t, h, sessions)
+		if claims["tenant"] != "tenant:friendly:binky" || claims["tenant_source"] != oidc.TenantSourceDirectory {
+			t.Fatalf("tenant %v / source %v", claims["tenant"], claims["tenant_source"])
+		}
+	})
+
+	// Nobody asserted a zone. Reporting "directory" here would be the same defect
+	// one level down: a consumer reading an assertion the directory never made.
+	t.Run("human, nobody asserted", func(t *testing.T) {
+		sessions := oidc.NewSessionStore()
+		h, _ := newTokenHandler(t, sessions, &mockUserRepo{users: map[string]*domain.User{"alice": aliceUser()}})
+		claims := issueHumanToken(t, h, sessions)
+		if claims["tenant_source"] != oidc.TenantSourceDefault {
+			t.Fatalf("source %v, want %v", claims["tenant_source"], oidc.TenantSourceDefault)
+		}
+	})
+
+	t.Run("service is always registration-supplied", func(t *testing.T) {
+		h := serviceTokenHandler(t)
+		req := tokenRequest(url.Values{"grant_type": {"client_credentials"}, "scope": {"finance.qonto.read"}})
+		req.SetBasicAuth("rapp-qonto", "test-service-secret")
+		w := httptest.NewRecorder()
+		h.ServeHTTP(w, req)
+		if w.Code != http.StatusOK {
+			t.Fatalf("status %d", w.Code)
+		}
+		claims := parseJWTPayload(t, decodeTokenResponse(t, w.Body.String())["access_token"].(string))
+		if claims["tenant_source"] != oidc.TenantSourceRegistration {
+			t.Fatalf("source %v, want %v", claims["tenant_source"], oidc.TenantSourceRegistration)
+		}
+	})
+}
+
+func issueHumanToken(t *testing.T, h *oidc.TokenHandler, sessions *oidc.SessionStore) map[string]interface{} {
+	t.Helper()
+	verifier := "test-verifier"
+	code := seededSession(sessions, verifier)
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, codeExchange(t, url.Values{
+		"grant_type": {"authorization_code"}, "client_id": {"test-client"},
+		"code": {code}, "code_verifier": {verifier}, "redirect_uri": {seededRedirectURI},
+	}))
+	if w.Code != http.StatusOK {
+		t.Fatalf("status %d: %s", w.Code, w.Body.String())
+	}
+	return parseJWTPayload(t, decodeTokenResponse(t, w.Body.String())["access_token"].(string))
+}