ogar-rbac: mint the canonical RBAC authority, fed by ogar-auth's user

[claude]

What

Establishes the ownership seam the ruling fixed:

ogar-auth  = canonical user + authentication bindings
ogar-rbac  = authorization over that canonical user

ogar-rbac depends on ogar-auth deliberately. The edge is the point: there is no way to ask this crate a question without first holding an AuthenticatedUser, which only ogar-auth can produce — so "RBAC does not accept an arbitrary parallel identity normalizer" is a property the compiler checks, not a convention.

ogar-auth::user realizes already-minted vocabulary

It invents no IAM model. The classes exist:

vocabulary	classid	here
auth_store	0x0B01	UserStore
project_actor	0x0104	User / UserId
project_role	0x0117	User::roles
project_membership	0x0108	User::memberships
auth_zitadel / auth_ory_keto …	0x0B02+	AuthBinding::provider

Providers stay data, exactly as auth_store's own is-a children already model them (claim_grammar as an attribute). ProviderId is an opaque label, never an enum — a new IdP is a preminted class with a different row, not a new match arm.

The envelope every path converges on is the contract's existing ActorContext — reused, not re-declared, which is what stops a second identity type appearing.

No secret aggregation

UserStore maps identities; it does not release secrets. User carries opaque KeyRefs and there is deliberately no aggregate accessor, so an identity lookup cannot quietly become unrestricted key retrieval.

Kiosk preserved

An unauthenticated kiosk user takes the same authorization path and yields the same decision — roles belong to the identity, never to the login method. a2ui-rs has zero files touched.

What did NOT move

• The generic authorize / authorize_scoped kernel stays in lance-graph-rbac — consumed, never cloned.
• lance-graph-contract stays zero-dep; OGAR only ever depends downward on it.
• CapabilityAuthority / hotplug untouched — orthogonal.

The authority is an object (OgarRbac), not impl ClassRbac for OgarClassView: that is E0117 from any third crate, and sharing a repository does not change Rust coherence.

Tests

ogar-auth 19/19, ogar-rbac 7/7, fmt + clippy -D warnings clean. Falsifiers covered: wide {1,7,92} projection, canonical-identity ownership, orphan legality, kiosk parity, provider ignorance (no provider branching), two bindings → one user, key-reference-not-material.

Depends on AdaWorldAPI/lance-graph#1206 (Axis-4 widening); the git deps point at that branch and move to main when it merges.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PGkLH5cYiiWM4QmNkvBBvf

---

Generated by Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.