tegwick a770ac67d0 Reconcile the canonical model and discovery with the runtime ... Closes gap G02 of the scope assessment for the client-registration and discovery surface. spec/canonical-model.yaml and domain/model.go both claimed to be the source of truth and disagreed: the spec restricted grants to authorization_code, required redirect URIs of every client, and omitted the audience, service subject, tenant, role, MFA and handoff fields the runtime reads. The durable part is the link, not the edit. A two-way conformance test compares the spec against the Go model by reflection and fails when a runtime field has no spec entry or a spec entry is not read by the runtime, the latter unless marked runtime: false. It found drift beyond the assessment's list on its first run -- User.tenant was undeclared -- which is the argument for the check over a one-time reconciliation. Discovery now advertises the core profile claims that appear on every token and derives scopes_supported from the registered clients rather than a fixed list. The Go model is stated as the runtime authority and the YAML as the reviewed contract, in both files. This covers client registration and discovery, not schema enforcement in general, which remains G06. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6		2026-09-07 00:22:49 +02:00
..
canonical-model.yaml	Reconcile the canonical model and discovery with the runtime	2026-09-07 00:22:49 +02:00
ldap-schema.yaml	feat: implement T01-T04 — Go module, canonical model, LDAP validator, error taxonomy	2026-03-13 01:27:54 +01:00