feat: publish fail-closed RBAC authority (TIN-2822)

[Jess Sullivan (Jesssullivan)]

Summary

• publish a frozen, versioned RBAC authority from the auth package
• deny unknown roles, prototype keys, untrusted translation maps, and explicit-grant bypasses
• require factory-created, exhaustive role translation contracts for realm-local aliases and collisions
• make role ranking and permission accessors fail closed and return detached data
• document the embedded invitation 0.2.5 hierarchy as non-canonical

Boundary

DRAFT / SOURCE-ONLY / DO NOT MERGE, TAG, RELEASE, OR ADOPT YET.

This is stacked on #41 and implements only the tinyland-auth source half of TIN-2822. The invitation package still needs its embedded default authority removed in favor of injected structural authority, with custom hooks restricted to narrowing policy. Cross-package packed-artifact parity, consumer translation maps, TIN-2831, and the coordinated 0.8 release remain outstanding. tinyland.dev #731 remains held.

Tracks TIN-2822; does not close it.

Validation

• pnpm typecheck
• focused RBAC/permission suites: 115/115
• full Vitest suite: 471/471
• pnpm build
• pnpm check:package
• pnpm check:release-metadata
• pnpm check:invitation-authority
• Bazel //:test and //:typecheck
• independent adversarial review: no remaining source-draft blockers

Signed commit: 0e73d22

[Jess Sullivan (Jesssullivan)]

Live 2026-07-13 reconciliation against tinyland-invitation 0.2.5 confirms this PR's source boundary and the next interoperability work:

• The old permissive default was fixed in invitation fix(ci): use tinyland-inc scope for GitHub Packages #4, but the package still embeds a non-canonical order (editor, event_manager, then moderator), so its default can authorize those specialists to mint a moderator invite.
• createdByRole remains caller-supplied mint input. Injecting canManageRole is necessary but not sufficient; the invitation package/application boundary must reload the authenticated actor and derive the role from durable authority.
• Acceptance serialization is explicitly process-local. A distributed consumer still needs a storage-backed compare-and-set plus an atomic user/invitation receipt; claim-first currently consumes the token before password hashing/user persistence.
• temporaryTotpSecret is still stored on the invitation record. TOTP enrollment custody should stay outside the invitation lifecycle contract.

Recommended sequence remains: land the auth-owned versioned RBAC source contract after #41; replace invitation's embedded hierarchy with injected structural authority and trusted actor resolution; add distributed accept CAS/receipt; then add a canonical assignRole transaction with actor/target reload, last-super-admin protection, grant validation, and session revocation/auth epoch. No release or adoption claim is made here.

[Jess Sullivan (Jesssullivan)]

Restack evidence (2026-07-14)

• Base: hardened bootstrap head eafdbb9e056677347a608a449b6fff143e3069be
• New signed RBAC head: 7f19df6c2f8aa4724d7b247e61e180b65318d8ea (GitHub signature valid)
• 507 tests passed
• Typecheck, build, invitation-authority check, release-metadata check, package lint, and diff check passed

Boundary: this remains a source-only draft at package version 0.7.1. It does not release auth 0.8, implement PostgreSQL/Redis adapters, prove invitation parity, adopt the graph in tinyland.dev, migrate sessions, run a canary, or unfreeze production.