FSD-004 post-fold surface (rc5 authority triad) + registry-core fold build + PortalService GetUser authz

[emooreatx]

What & why

Three things, in three commits, all toward folding ciris-registry-core into CIRISServer.

1. Security fix (own commit): PortalService.GetUser / GetUserByEmail had no authorization. Any valid JWT could read any user record and all of that user's org memberships. Both RPCs now require the caller to be the user, a SYSTEM_ADMIN, or hold a role in an org the target belongs to (the visibility ListOrgMembers already grants at Viewer). Non-admins get the same PermissionDenied for not-found as for not-allowed, so ids and emails cannot be probed. Denials are audit-logged. Verified over gRPC against Postgres 16: stranger by id, by email and for a nonexistent id denied; self, shared-org Viewer and SYSTEM_ADMIN allowed.

2. FSD-004, the post-fold registry surface. No document in either repo specified what each registry route and RPC becomes once the slice composes into CIRISServer. FSD-004 maps every one to its post-fold path, substrate call, caller tier and node posture, and lists the decisions needed before any new route ships. It is revised for CC 1.0-rc5's authority triad (CC 2.4.1.2.1: licensure, grant, delegation are three objects, and only delegation chains):

• a licensing-authority caller tier (the authority_id key or its license-scoped delegate; an org names itself by its org UUID per CC 3.3.9 / licensure authority_id must be the org_id, not PartnerRecord.organization_id (CC 3.3.9 ruling, rc5) #139);
• RegisterPartner split into recognition (partner_record, steward quorum) and licence issuance (licensure:{authority_id} status rows, eight statuses, suspended reversible and revoked terminal, a set not a scalar);
• GET /v1/licensure/{key_id}?authority= returning the per-authority fold, with a stranger's row admitted as testimony only;
• §4.5: there is no community licence to issue (standing is the CC 3.2 T1 self-root; the bond stays off-wire), and CIRISPortal becomes CIRISClient CSDs, with the missing licensure/grant CSDs named;
• custodial signing (GenerateKeyPair / RequestSignature) settled as DROP under CC 4.1.1;
• two new decisions naming what rc5 still carries that contradicts this (partner_role community values, partner_record.license_type).

3. ciris-registry-core builds two ways. standalone (default, unchanged deployment) keeps sqlx, tonic, persist's postgres backend, the gRPC services and the full HTTP router. Built without default features it carries none of them, which is what CIRISServer can depend on; CI now fails if sqlx, tonic or tokio-postgres returns to that graph. fold::router(engine, node_key_id) serves the KEEP routes that already ran on persist alone (/v1/steward-key, /v1/trust-root/bundle, /v1/agent_files/{kind}); the standalone router mounts the same handlers, so the two cannot drift. tests/fold_router.rs mounts it on a SQLite Engine and passes in both builds. No wire change in the standalone build.

Found, not changed: POST /v1/integrity/auth reports authorized: true for any Bearer prefix without validating the token (FSD-004 §7). Its consumers need checking before the fix.

Issue

Relates to #62 (fold epic), #133, #139, #41. Fixes the GetUser authorization gap (no issue filed).

AI-assistance disclosure

• No substantial AI assistance, OR
• AI-assisted — disclosed here, human-reviewed: drafted with Claude Code (FSD text, feature split, fold router, authz fix, gRPC verification against Postgres 16). Human author to review and stand behind before merge.

Checklist

• A human author understands and stands behind this change
• If touching FSD/CEG/**: not touched; FSD-004 adds no wire fields
• Tests / build pass: cargo test --locked --workspace, cargo test -p ciris-registry-core --no-default-features, clippy clean in both builds

🤖 Generated with Claude Code

https://claude.ai/code/session_017Hhka84Xw4xHjSfBq1fuw8

---

Generated by Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.