user-engine/workplans/USER-WP-0037-hub-authority-lookup.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	state_hub_workstream_id
USER-WP-0037	workplan	Read-only account authority for Hub integration	communication	user-engine	blocked	codex	communication	2026-09-28	2026-09-28	HUB-WP-0012	54d99faf-4c53-5927-a82c-feca41de2cf3

Hub authority lookup

Owner-side implementation for HUB-WP-0012. Source work is authorized; real workload grants, root entitlements and deployment acceptance remain separate.

Existing account lookup without provisioning

id: USER-WP-0037-T01
status: done
priority: high
state_hub_task_id: "eb4c1a6c-3cf2-5195-9388-cb9db3190197"

Add an authorized service lookup for exact issuer/subject and scoped tenant. Authorize the caller separately before target lookup. Unknown identities never provision; return current global/scoped account state without roles or profile PII. Preserve source observation time and identity/account references.

Implemented UserEngineService.lookup_account_authority with the separate account.authority.read action and a digest-bound issuer/subject/tenant resource. Caller identity is distinct from the target. Missing tenant-account state is explicit None, not active. AccountAuthority contains no root grant, token roles or profile/email data. Authorization denial may emit the existing audit record; this operation does not provision or mutate domain records.

Validation: make test ran 270 tests successfully (eight optional skips), including six new lookup checks; layer conformance passed. No HTTP endpoint, live grant or production deployment was added. T02/T03 retain those outstanding owner gates.

Root entitlement and mapping disposition

id: USER-WP-0037-T02
status: wait
blocked_on: message-from:net-kingdom
blocking_reason: "Specify with NetKingdom the root-grant custody/revocation and platform:root to tenant:platform mapping."
priority: high
state_hub_task_id: "23a5c211-277b-561e-a4b3-0f8e99537cac"

With NetKingdom, specify explicit current root-grant custody/revocation and platform:root to tenant:platform mapping. Do not derive a grant from JWT roles, a username, or Hub's configured root subject. Define retainable evidence for account and entitlement observations.

Blocked 2026-09-28: this is a NetKingdom canon decision, not a user-engine implementation choice. net-kingdom/docs/platform-root-custody.md covers OpenBao/king-credential bootstrap custody but does not yet define how a workload-facing root-grant fact is derived, represented, or revoked for a consumer like the Hub. Requested via State Hub message 379d266b-b738-4772-82c0-318e67a50bc8 to net-kingdom. AccountAuthority deliberately still carries no root-grant field pending that decision.

Authenticated workload transport and private acceptance

id: USER-WP-0037-T03
status: wait
depends_on: [USER-WP-0037-T02]
blocked_on: message-from:net-kingdom
blocking_reason: "Real caller credentials are admitted through their owner after the T02 contract."
priority: high
state_hub_task_id: "c5d67725-c685-50f6-9db8-28114a34014b"

Expose a narrowly scoped read API with an independently authenticated Hub workload, policy action account.authority.read, exact target binding and no end-user bearer forwarding. Add HTTP schema and denial/no-provisioning tests, then admit real caller credentials through their owner and verify withdrawal, outages and private Hub integration. A service method alone is not this gate.

Implemented 2026-09-28: POST /api/v1/platform/account-authority/lookup (src/user_engine/web.py), gated by a dedicated hub_authority_caller / hub_authority_token pair distinct from trusted_proxy_secret and end-user OIDC claims — a bearer mismatch or unconfigured route denies/404s before any domain lookup runs. Wired in runtime.py behind USER_ENGINE_HUB_AUTHORITY_TOKEN (+ _ISSUER/_SUBJECT/_TENANT), unset by default so the route stays absent until provisioned. Schema, denial, and no-provisioning tests: tests/test_web_account_authority.py (7 tests, all green against make test, 277 tests total).

Blocked 2026-09-28 on the remaining half of this gate: admitting a real Hub workload credential is a credential-routing matter (.claude/rules/credential-routing.md) — OpenBao/ops-warden issue it, this repo only consumes it. Requested via State Hub message f3bcc516-7241-4050-ba52-5723bb174936 to state-hub. Withdrawal, outage, and private-integration verification with the real credential are still owed once it exists.