Mint the 0x0B AuthStore class family (keystone §7, confirmed by OGIT shape)

[AdaWorldAPI]

What this is

Autoattended resolution of ISS-RBAC-AUTHORIZE-BY-CLASSID. The operator's
insight — "having our vision and already the canonical OGIT shape it's
easy" — is correct: OGAR's keystone §7 and the canonical OGIT Auth shape
converge 1:1, so the tractable, spec-ratified part ships now while the
enforcement stays behind the keystone's own probe gate.

The convergence that makes it a reservation, not an invention

OGIT Auth (canonical shape, upstream)	keystone §7	Zitadel
Account (the sub)	actor 0x0104	User
Application	class scope	Project/App
Role	role 0x0117	Project-Role
RoleAssignment	membership tuple 0x0108/0x0118	Grant
Organization/OrgDomain	row-scope (axis 3)	Org
Configuration (keyed org/app/account/scope IDs + configurationData)	auth_store 0x0B01	the IdP config record

arago's January-2026 NTO/Auth/Configuration entity is the keystone's
auth_store, built upstream independently. The vision and the upstream
shape agree.

What ships (the mint — reservations only)

Per docs/CLASSID-RBAC-KEYSTONE-SPEC.md §7, in ogar-vocab + ogar-class-view:

• CODEBOOK + class_ids consts + ALL: auth_store 0x0B01,
  auth_zitadel 0x0B02, auth_zanzibar 0x0B03, auth_ory_keto 0x0B04.
• ConceptDomain::Auth + canonical_concept_domain(0x0B) => Auth.
• all_promoted_classes() builders: auth_store() (base — carries
  the three claim-name slots + maps_actor/maps_role family edges) +
  the three provider profiles (is-a AuthStore, claim_grammar attr).
• ogar-class-view::all_canonical_classes() registration + imports.
• Tests: auth_domain_concepts_resolve_and_route +
  concepts_in_domain(Auth).count()==4; domain test asserts
  0x0B → Auth, 0x0C → Unassigned.

"Reserving costs nothing" — these are registry reservations, not
enforcement.

What stays gated (the keystone's own gates, not caution)

• The authorize() enforcement (ClassRbac trait impl + the
  bit-for-bit decision) — gated on PROBE-OGAR-RBAC-AUTHORIZE (§10).
  Security-review-class.
• The woa-rs WoaMembraneGate mirror — different repo; mirrors smb floor: fix non-exhaustive errors in surrealql adapter + add compile CI #29
  when woa work is picked up. Unblocked, not gated.
• project_role.permissions: text → typed-grant Core change (§6) —
  lands per keystone §11 build order, after the probe.

The decision (recorded in .claude/board/ISSUES.md)

• Canonical end-state: keystone v2 (classid-keyed authorize,
  AuthStore profiles). Hardened; confirmed by the OGIT shape.
• Interim (ship now, unblocks woa): mirror smb floor: fix non-exhaustive errors in surrealql adapter + add compile CI #29's MembraneGate
  — the shipped pattern, not a *Bridge stopgap.
• Sequencing: the probe orders them; they don't compete.

Method note: autoattended autonomy means honoring the project's ratified
gates (the probe, the 5+3-hardened keystone), not bulldozing them. The
mint is spec-ratified + OGIT-confirmed, so it ships; the enforcement has
an explicit probe gate, so it waits.

Docs

• .claude/board/ISSUES.md (new) — ISS-RBAC-AUTHORIZE-BY-CLASSID RESOLVED.
• .claude/board/EPIPHANIES.md — the 1:1 convergence table + the
  autoattended-decision method note.
• docs/CLASSID-RBAC-KEYSTONE-SPEC.md §7 — MINTED + CONFIRMED block.

Tests

298/0 workspace; 106 in the touched crates (ogar-vocab 93 + ogar-class-view
13) + 2 doctests. fmt-clean; no new clippy warnings (the ports.rs delta is
fmt-normalization of pre-existing drift).

---

Generated by Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.