- GatewayDispatch carries ownership_provider: Option<Arc<dyn
OwnershipProvider>> + with_ownership_provider (dispatcher-identical
builder); the shared root-context builder threads it, covering
invoke / invoke_streaming / invoke_sink. Default stays None (the
ADR-011 static fallback) — additive and opt-in, no context shape
change, no behavior change for existing consumers.
- Door contract documented in the ADR-048 amendment: doors serving ops
whose authorization truth is a revocable grant table must wire the
same provider the wire path consults (visible-surface =
authorized-surface). Anchored downstream by alkgit's LFS POC.
- The loud default (refuse resource_id_path ops with no provider
wired) is deferred, not decided — tracked in review 012, ruled on
after the door blast-radius survey; it belongs in the same release
batch.
- Release placement: committed unreleased — additive work rides the
next breaking batch (0.10.0's class) instead of publishing 0.9.1,
keeping the six-consumer downstream churn to one coordinated update.
Verification:
- cargo test --all-features (717 + stub_guard); fuzz/shared corpus
replay (5); clippy --all-features --all-targets -D warnings; fmt;
cargo doc --no-deps
- in-crate regression tests pin static-fallback behavior, live-table
override, revocation live on the gateway surface
- POC-L tests/gateway_gap.rs re-run against published 0.9.0 — green
glm-5.3-flash
d0b8124064