feat: add authorized account lookup without provisioning

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e747-8f27-7242-8df8-8bc44f88c929

workplans/USER-WP-0037-hub-authority-lookup.md

@@ -0,0 +1,70 @@
+---
+id: USER-WP-0037
+type: workplan
+title: "Read-only account authority for Hub integration"
+domain: communication
+repo: user-engine
+status: active
+owner: codex
+topic_slug: communication
+created: "2026-09-28"
+updated: "2026-09-28"
+related:
+  - HUB-WP-0012
+---
+
+# Hub authority lookup
+
+Owner-side implementation for HUB-WP-0012. Source work is authorized; real
+workload grants, root entitlements and deployment acceptance remain separate.
+
+## Existing account lookup without provisioning
+
+```task
+id: USER-WP-0037-T01
+status: done
+priority: high
+```
+
+Add an authorized service lookup for exact issuer/subject and scoped tenant.
+Authorize the caller separately before target lookup. Unknown identities never
+provision; return current global/scoped account state without roles or profile
+PII. Preserve source observation time and identity/account references.
+
+Implemented `UserEngineService.lookup_account_authority` with the separate
+`account.authority.read` action and a digest-bound issuer/subject/tenant resource.
+Caller identity is distinct from the target. Missing tenant-account state is
+explicit `None`, not active. AccountAuthority contains no root grant, token roles
+or profile/email data. Authorization denial may emit the existing audit record;
+this operation does not provision or mutate domain records.
+
+Validation: `make test` ran 270 tests successfully (eight optional skips), including
+six new lookup checks; layer conformance passed. No HTTP endpoint, live grant or
+production deployment was added. T02/T03 retain those outstanding owner gates.
+
+## Root entitlement and mapping disposition
+
+```task
+id: USER-WP-0037-T02
+status: todo
+priority: high
+```
+
+With NetKingdom, specify explicit current root-grant custody/revocation and
+platform:root to tenant:platform mapping. Do not derive a grant from JWT roles,
+a username, or Hub's configured root subject. Define retainable evidence for
+account and entitlement observations.
+
+## Authenticated workload transport and private acceptance
+
+```task
+id: USER-WP-0037-T03
+status: todo
+priority: high
+```
+
+Expose a narrowly scoped read API with an independently authenticated Hub
+workload, policy action account.authority.read, exact target binding and no
+end-user bearer forwarding. Add HTTP schema and denial/no-provisioning tests,
+then admit real caller credentials through their owner and verify withdrawal,
+outages and private Hub integration. A service method alone is not this gate.