[EPIC] Strip NyxID organization concept — owner-only goals/sessions

[chronoai-shining]

Summary

Remove the NyxID-organization concept (NyxID's user-grouping for shared resources) entirely from fkst-hosted, leaving a pure OWNER-ONLY model. Goals and sessions become owned by owner_user_id only. Authorization collapses to: admin-permission bypass → owner == caller → legacy-ownerless allow → deny. No org ownership, no org sharing, no org-membership authz, and no NyxID GET /api/v1/orgs call anywhere.

This tracks the milestone Strip NyxID organization concept (owner-only model) and follows the just-shipped v0.2.2 owner-only credential redesign (the NyxID service account + RFC8693 token-exchange were already removed; authz already dropped the SA-based org_role/org_exists/user_exists). The remaining user-token-based org logic (user_orgs / visible_org_ids / require_org_writer / org_id DTO+model plumbing) must now ALSO go.

Owner-only end state

• GoalDoc / SessionDoc carry only owner_user_id (+ existing non-org fields). No org_id.
• The object-layer predicate is allows(ctx, Ownership { owner_user_id }, action) — a pure, IO-free owner+admin+legacy check with no NyxID coupling and no Unavailable failure mode.
• POST /api/v1/goals, GET /api/v1/goals, POST /api/v1/goals/:id/trigger, POST /api/v1/goals/submit, POST /api/v1/repos/:owner/:name/fkst-setup make no org membership/visibility calls; a non-owner non-admin gets a plain 403/404.
• The goal-issue hidden marker (v:1) no longer writes org_id; already-filed goal issues that carry org_id remain forward-readable (parse-and-ignore, no version bump, no migration).
• NyxIdClient no longer has user_orgs/orgs_cache/cache_ttl; the nyxid_org_cache_ttl_secs config knob is gone.

Live bug fixed by this work (note in #271 and #270)

Today GET /api/v1/goals hard-503s authorization service unavailable: visible_org_ids calls NyxIdClient::user_orgs, which deserializes a bare Vec<OrgSummary> while prod NyxID actually returns {"orgs":[...]}; the serde error maps to AppError::Unavailable. The in-file test masks it by mocking the wrong bare-array shape. Removing the whole path eliminates the 503 — do NOT merely patch the deserialization.

OUT OF SCOPE — KEEP INTACT (do NOT touch)

These match an org grep but are the GitHub-organization repo-placement feature, unrelated to NyxID orgs:

• goals/repo_create.rs create.org_login + POST /orgs/{org}/repos; repo_create_classify.rs SSO-org URL parsing.
• routes/goals.rs CreateRepoSpecBody.org_login, CreateRepoSpec.org_login, is_org_repo, install_hint_message wording.
• routes/repos.rs SetupRepoRef, SetupResponse.repo, the owner/name path params, validate_repo_ref.
• The literal role string "org-admin" test fixtures in auth/identity.rs and auth/middleware.rs (a NyxID role-claim, not an org).

Sub-issues (depends/blocks ordering)

Ordered so the workspace compiles and all tests pass at every commit (CLAUDE.md). The cross-crate field deletions (GoalDoc.org_id, SessionDoc.org_id, Ownership.org_id) and the NyxIdClient::new signature change have consumers in several crates, so the consumer-side edits must land with or before the definition removals.

• Strip NyxID-org authz: remove visible_org_ids/require_org_writer/OrgRole branches (owner-only) #270 — authz owner-only (type:refactor, sa:downstream-authz): drop Ownership.org_id, the org_role param + Rule-3 from allows(), delete visible_org_ids() and require_org_writer(), simplify all four call sites (goals::create/list/trigger, goals_submit::authorize_object, repos::fkst_setup), drop the SetupRequest.org_id field, adjust GoalIssueStore::list to drop visible_org_ids. This alone kills the 503. Blocks Remove user_orgs/OrgSummary/OrgRole/orgs_cache from fkst-shared + nyxid_org_cache_ttl_secs #271.
• Remove user_orgs/OrgSummary/OrgRole/orgs_cache from fkst-shared + nyxid_org_cache_ttl_secs #271 — remove org transport from fkst-shared (type:chore): delete user_orgs/OrgSummary/OrgRole/CachedOrgs/orgs_cache/ORGS_PATH, drop cache_ttl from NyxIdClient::new, cascade to startup.rs/main.rs/config.rs (nyxid_org_cache_ttl_secs). Depends on Strip NyxID-org authz: remove visible_org_ids/require_org_writer/OrgRole branches (owner-only) #270 (which removes the last OrgRole/user_orgs/cache_ttl consumers).
• Remove org_id from goal/session models, DTOs (OpenAPI), and the goal-issue marker #272 — remove org_id from goal/session models + DTOs + marker persistence (type:refactor): delete GoalDoc.org_id, SessionDoc.org_id (cross-crate), CreateGoalRequest.org_id, GoalView.org_id, SessionView.org_id, the GoalMarker.org_id (parse-and-ignore back-compat, NO version bump), and every internal carrier (GoalTriggerInfo, SessionOwner, build_goal, the two GoalView/SessionView mappings). Depends on Strip NyxID-org authz: remove visible_org_ids/require_org_writer/OrgRole branches (owner-only) #270 (it removes Ownership.org_id so the ownership-builder edits compile).
• Drop the no-op org_id pass-through params from vault/codex_provider/session dispatch #273 — sessions/dispatch/codex_provider/vault org_id pass-through removal (type:refactor): drop the already-no-op org_id params from vault::list_for_scope, codex_provider::{is_chrono_llm_connected,resolve_provider_choice,resolve_from_entries}, and the session.org_id.as_deref() call sites in service.rs. Depends on Remove org_id from goal/session models, DTOs (OpenAPI), and the goal-issue marker #272 (it removes SessionDoc.org_id, the source of these args). May be merged into Remove org_id from goal/session models, DTOs (OpenAPI), and the goal-issue marker #272 if scoping prefers.
• Final org_id test + OpenAPI sweep and owner-only regression guards #274 — test + OpenAPI sweep & regression guard (type:chore): repo-wide grep -rn org_id must return only org_login/GitHub-org hits; add the GET /api/v1/goals no-503 regression, the owner-only trigger/submit-Forbidden tests, the parse-and-ignore marker test, and optionally a negative OpenAPI guard that no schema exposes org_id. Depends on Remove org_id from goal/session models, DTOs (OpenAPI), and the goal-issue marker #272 and Drop the no-op org_id pass-through params from vault/codex_provider/session dispatch #273.

Definition of Done (epic)

• All sub-issues closed and merged into develop.
• grep -rn org_id backend/ returns only GitHub-org_login / repo-placement hits and the org-admin role-string fixtures.
• cargo test -p fkst-control-plane -p fkst-shared green; cargo build -p fkst-worker green (no utoipa, no org symbols); tests/openapi.rs green.
• GET /api/v1/goals no longer 503s; goals/sessions are owner-only.
• GitHub-org org_login repo placement is verifiably untouched.

Labels: epic