docs(architecture): resolve review #002 Tiers 1-3 — mechanical and consistency fixes

Governance (Tier 2):
- Advance ADR-022 and ADR-023 from Proposed to Accepted (specs already
  depend on their types as source of truth)
- Amend ADR-015: mark Decision 3 and Assumption 6 as superseded by ADR-022;
  update handler_identity type to CompositionAuthority
- Amend ADR-002: note handle() signature revised by ADR-007 (BiStream → Connection)
- Amend ADR-004: note 'enrich/replace' AuthContext language superseded by
  ADR-011's immutability model; update to describe set_identity on Connection
- Update main README ADR table to show ADR-022/023 as Accepted

Spec-ADR consistency (Tier 3):
- Add abort_policy: AbortPolicy field to OperationContext struct (ADR-016
  Decision 6 mandated this but the spec omitted it)
- Define AbortPolicy enum (AbortDependents | ContinueRunning) with Default impl
- Add abort_policy to build_root_context and LocalOperationEnv::invoke()
- Define the OperationEnv trait explicitly with invoke() and
  invoke_with_policy() methods (was referenced as 'must remain a trait'
  but never defined)
- Specify From<StreamError> for HandlerError impl with exact variant mapping
- Add Connection::from_quinn() / from_iroh() constructors (was referenced
  as Connection::new() but never defined)
- Remove undefined CertAuthorityEntry placeholder from AuthPolicy v1 (will
  be added additively when alknet-ssh lands)
- Fix config.md key-differences table: rate limits are in DynamicConfig,
  not StaticConfig

Mechanical fixes (Tier 1):
- overview.md: 'closes the QUIC stream' → 'closes the connection' (stale
  from pre-ADR-007 model)
- overview.md: OQ-04 entry updated from stale 'defer to implementation'
  to 'resolved: static at startup'
- mnemonic-derivation.md: remove duplicate helper functions block (incomplete
  first copy, complete second copy)
- ADR-003: add iroh (feature-gated) to alknet-core dependency list, added
  by ADR-010
- ADR-021: fix ambiguous 'W1 drift issue from the vault review' cross-reference
- ADR-022: rephrase FromCall 'leaf locally' to 'leaf in the local registry'
- ADR-017: add error_schemas to from_call mirror list and services/schema
  step (inconsistency with ADR-023)
- ADR-016: fix self-referential citation ('ADR-016 Assumption 5' → 'Assumption 5')
- Add ScopedOperationEnv::empty(), allows(), new() and
  CompositionAuthority::none(), new() impl blocks (referenced but undefined)
- Add call.completed clarification for non-subscription calls
- Add services/schema leading-slash normalization note
- Crate README ADR tables: add missing ADR-013 (call), ADR-015 (core),
  ADR-006 + ADR-010 (vault)
- Vault README: add consolidated 'Known Source Drift' table tracking all
  four drift items (OsRng, unwrap, CURRENT_KEY_VERSION, spawn bug) in one
  place, including the two previously missing from README

docs/architecture/crates/core/README.md

@@ -1,6 +1,6 @@
 ---
 status: draft
-last_updated: 2026-06-21
+last_updated: 2026-06-22-21
 ---
 
 # alknet-core
@@ -29,6 +29,7 @@ Core library for ALPN-based protocol dispatch. Every handler crate depends on al
 | [009](../../decisions/009-one-way-door-decision-framework.md) | One-Way Door Framework | Decision classification |
 | [010](../../decisions/010-alpn-router-and-endpoint.md) | ALPN Router and Endpoint | Endpoint, HandlerRegistry, accept loop |
 | [011](../../decisions/011-authcontext-structure.md) | AuthContext Structure | AuthContext fields and resolution flow |
+| [015](../../decisions/015-privilege-model-and-authority-context.md) | Privilege Model and Authority Context | Per-request identity on OperationContext; admin scope for config reload |
 
 ## Relevant Open Questions
 

docs/architecture/crates/core/config.md

@@ -1,6 +1,6 @@
 ---
 status: draft
-last_updated: 2026-06-21
+last_updated: 2026-06-22-21
 ---
 
 # Configuration
@@ -115,19 +115,17 @@ pub struct AuthPolicy {
     /// Stored as strings to avoid russh dependency in core.
     pub authorized_fingerprints: HashSet<String>,
 
-    /// Certificate authorities for certificate-based auth.
-    /// The exact structure is TBD — it will be defined when alknet-ssh
-    /// is implemented. For now, this is a placeholder that reserves
-    /// the field. alknet-ssh will define `CertAuthorityEntry` with
-    /// the necessary fields (public key, principals, options).
-    pub cert_authorities: Vec<CertAuthorityEntry>,
-
     /// API keys for token-based auth.
     pub api_keys: Vec<ApiKeyEntry>,
 }
 ```
 
-`CertAuthorityEntry` is a placeholder type. Its fields will be defined when alknet-ssh is implemented and the certificate authority validation requirements are clear. For v1, `cert_authorities` will be an empty vector.
+Certificate authority entries for cert-based auth will be added when
+alknet-ssh is implemented. The `cert_authorities` field is omitted from v1
+to avoid referencing an undefined type. Adding it back is additive (a new
+field on `AuthPolicy` is non-breaking for existing config files that don't
+use it). alknet-ssh will define `CertAuthorityEntry` with the necessary
+fields (public key, principals, options).
 
 This replaces the reference implementation's `AuthPolicy` which depended on `russh::keys::PublicKey`. The new version stores fingerprints as strings, not russh types. This removes the russh dependency from alknet-core.
 
@@ -217,7 +215,7 @@ Simplified from the reference implementation. Removes proxy-specific errors (now
 
 | Aspect | Reference | New Model |
 |--------|-----------|-----------|
-| StaticConfig fields | SSH host key, stealth, transport_mode, listeners, proxy | listen_addr, TLS cert/key, drain_timeout, rate limits |
+| StaticConfig fields | SSH host key, stealth, transport_mode, listeners, proxy | listen_addr, TLS cert/key, drain_timeout |
 | DynamicConfig.auth | `HashSet<PublicKey>` (russh types) | `HashSet<String>` (fingerprint strings) |
 | ListenerConfig | Enum with Stream/Http/Dns variants | Eliminated — single endpoint, ALPN dispatch |
 | TransportMode | Tcp/Tls/Iroh | Eliminated — always QUIC+TLS |

docs/architecture/crates/core/core-types.md

@@ -1,6 +1,6 @@
 ---
 status: draft
-last_updated: 2026-06-16
+last_updated: 2026-06-22-16
 ---
 
 # Core Types
@@ -57,6 +57,14 @@ pub struct Connection {
 }
 
 impl Connection {
+    /// Construct from a quinn connection (feature-gated on quinn).
+    #[cfg(feature = "quinn")]
+    pub fn from_quinn(conn: quinn::Connection) -> Self;
+
+    /// Construct from an iroh connection (feature-gated on iroh).
+    #[cfg(feature = "iroh")]
+    pub fn from_iroh(conn: iroh::Connection) -> Self;
+
     pub async fn accept_bi(&self) -> Result<(SendStream, RecvStream), StreamError>;
     pub async fn open_bi(&self) -> Result<(SendStream, RecvStream), StreamError>;
     pub fn remote_alpn(&self) -> &[u8];
@@ -110,7 +118,7 @@ impl AsyncRead for RecvStream { ... }
 - `RecvStream` implements `AsyncRead`. Read bytes from the peer.
 - These are concrete wrapper types that use internal enum dispatch to delegate to the appropriate QUIC stream type (quinn or iroh) in production, and to test mocks in tests.
 
-Since the endpoint supports both quinn and iroh connection sources (ADR-010), streams may come from either. `Connection::new()` wraps the appropriate stream source based on where the connection came from.
+Since the endpoint supports both quinn and iroh connection sources (ADR-010), streams may come from either. `Connection::from_quinn()` / `Connection::from_iroh()` wrap the appropriate stream source based on where the connection came from.
 
 ## StreamError
 
@@ -138,6 +146,39 @@ When a handler encounters a `StreamError` and needs to return from `handle()`, i
 
 Handlers that manage multiple streams (SSH, call) may catch `StreamError::StreamClosed` per-stream and continue serving other streams on the same connection — only `ConnectionClosed` forces `handle()` to return.
 
+The mapping is provided as a `From` impl so handlers can use the `?` operator:
+
+```rust
+impl From<StreamError> for HandlerError {
+    fn from(e: StreamError) -> Self {
+        match e {
+            StreamError::ConnectionClosed => HandlerError::ConnectionClosed,
+            StreamError::StreamClosed => {
+                HandlerError::StreamError(io::Error::new(
+                    io::ErrorKind::ConnectionReset,
+                    "stream closed",
+                ))
+            }
+            StreamError::Timeout => {
+                HandlerError::StreamError(io::Error::new(
+                    io::ErrorKind::TimedOut,
+                    "stream timed out",
+                ))
+            }
+            StreamError::Internal(e) => HandlerError::StreamError(e),
+        }
+    }
+}
+```
+
+This `From` impl is the canonical conversion — handler examples that use
+`.await?` on `accept_bi()` / `open_bi()` rely on it. The `StreamError` →
+`HandlerError::StreamError(io::Error)` mapping is lossy by design: the
+distinction between stream-level and connection-level errors is preserved
+in `StreamError`, but once a handler propagates via `HandlerError`, the
+endpoint treats all variants as "close the connection" (one-ALPN-per-
+connection, ADR-006).
+
 ## Design Decisions
 
 | Decision | ADR | Summary |

docs/architecture/crates/core/endpoint.md

@@ -1,6 +1,6 @@
 ---
 status: draft
-last_updated: 2026-06-17
+last_updated: 2026-06-22-17
 ---
 
 # Endpoint
@@ -124,7 +124,7 @@ fn dispatch(connection) {
     match handlers.get(alpn) {
         Some(handler) => {
             let auth = AuthContext::from_connection(&connection);
-            let conn = Connection::new(connection);
+            let conn = Connection::from_quinn(connection); // or from_iroh
             tokio::spawn(async move {
                 if let Err(e) = handler.handle(conn, &auth).await {
                     // log error, connection closes