graph: accept a meta.sr.ht token, so /query can be federated api.sr.ht forwards ONE client Authorization header to every service a federated query touches — AuthMiddleware copies it verbatim into the request context, and the Internal credential it can mint is used only to fetch schemas at startup. So a federated caller arrives here holding whatever credential the client had, and the only credential that works across the whole instance is a meta.sr.ht personal access token. /query refused those, which made federating it one `api-origin=` line that would produce 401s. api-meta.json was the stronger half of the same refusal: with an empty scope list meta.sr.ht renders no checkbox for this service, so no PAT could be scoped for it even in principle — no amount of code in graph/ could have worked around that. It now publishes SPECS, derived from authn.ScopeRead rather than spelled twice, with a test on each side asserting the two agree. A scope published and not checked admits what should be refused, one checked and not published cannot be minted at all, and neither is visible from inside one file. The plane is built in cmd/specsrht beside the graph.New call and NOT on the *authn.Resolver every surface shares, which is the whole scope of the exception: the REST write plane, /mcp and the push hook resolve through that resolver, which knows nothing of PlaneMeta, so a PAT is not a way around the tokens.sr.ht grant they require. Routing is metapat.PlaneOf on the presented credential rather than a fall-through from a failed plane, because an instance with no [tokens.sr.ht] section has no working-token validator to fail first. Two things this service needs that the cov and bench donors did not. MetaAuth is told the instance owner and refuses a PAT belonging to anybody else with the same ErrNotInstanceOwner a foreign working token gets: a PAT is the credential every account on the instance can mint for itself, so without that check the widest credential in existence would have been the one that skipped the narrowest identity rule, and any user could have read the corpus. And a PAT resolves to KindAgent, never KindOwner, so webhook management and proposal approval stay with the human at a browser. The sentinels are spec's own — ErrMissingScope, ErrInvalidPersonalToken, ErrMetaUnavailable — rather than reuses of bearer's, because bearer's prose names tokens.sr.ht and every word of it is wrong for this plane; an operator reading "tokens.sr.ht could not be reached" while that daemon is up goes looking in the wrong place. What must agree between the planes is the status, not the wording, and StatusFor is the one table that decides it for both. The two vocabularies do not overlap and are refused differently, which the tests pin: a PAT naming spec.sr.ht/spec:read is a well-formed OAuth grant for a scope this service does not publish (403), while a working token naming spec.sr.ht/SPECS does not parse as a grant string at all (401). A 403 names the permission of the plane the caller actually used — telling a PAT holder to obtain "spec:read" would send them looking for a checkbox meta.sr.ht cannot render. cmd/specsrht's api-meta assertion is not Postgres-gated here, unlike the bench donor's: it ran locally and went red on the stale empty-list assertion, rather than hiding until CI.
authn: remove the local agent-token plane The agent_token table and everything that minted, verified, listed or revoked it. Agent credentials are tokens.sr.ht working tokens now: signed, expiring, owned by a meta.sr.ht account and carrying grants, verified locally by sr-ht-ecore's bearer package. One door, and nothing behind it — a credential the instance plane refuses is refused, where it used to be offered to a second store that might say yes. DEPLOY GATE: do not deploy this until every agent configured with the shared secret holds a tokens.sr.ht token with spec:propose (spec:read to read). Migration 0005 drops the table, migrate-on-upgrade runs it on deploy, and deploying early locks out every agent at once — including the SSH push path. hooks/ no longer reads agent_token directly. The push path goes through the same authn.Resolver the HTTP surfaces use and demands spec:propose, because a push by an agent is a proposal by another transport. The refs rule and the provenance requirement are untouched on both counts: a universal grant is still only an agent to the receive path, and X-Agent / X-Agent-Session are still mandatory on every agent write. bearer.ErrNotOurs is now a permanent refusal. A meta.sr.ht PAT used to fall through to the local store and miss there; with no store to fall through to it earns a 401 rather than the 503 an unclassified error would. [tokens.sr.ht] origin becomes a required config key: with no issuer there is no credential to check, so the daemon fails startup instead of serving reads and refusing every agent write one request at a time. /tokens redirects to the daemon that issues (tokens SPEC ch. 7).
authn: accept tokens.sr.ht working tokens beside the agent token A second agent credential plane, next to the existing one rather than in place of it. The agent_token table, every agent configured with it, and the refs rule and provenance requirement around it are untouched; the local plane is removed in a later phase, not this one. The resolver tries the instance plane first and falls back to the local store on exactly two refusals, bearer.ErrInvalid and bearer.ErrNotOurs. spec's local token has no prefix to discriminate on — it is 32 random bytes in base64, which is precisely what "did not decode as one of ours" looks like — so the fallback replaces the shape test bench and cover can afford. ErrRevoked, ErrForbidden and ErrUnavailable are terminal: a withdrawn credential must not get a second chance at the old door, and an unreachable daemon must not silently degrade into the legacy plane. Grants ride on the principal and are checked where the action is known, never in the middleware, which runs upstream of the router: spec:propose in service.Propose, below both write surfaces, and spec:read in each read surface's gate. /mcp checks per tool rather than at its Gate, because one endpoint carries both kinds and a surface-wide read grant would refuse a propose-only token at initialize. Principal.Authorize is a no-op off the instance plane, which is what keeps the local token working. The instance plane brings an owner where the local token had none, so a working token belonging to anybody but [sr.ht] owner-name is refused rather than admitted as a second identity: Principal.Owner is read by the provenance committer, the refs rule's principal kind and the coreauth AuthContext, all written for one human. StatusFor is the one status table. ErrUnavailable is 503 and never 401 — reading "I could not ask tokens.sr.ht" as "revoked" would refuse every live instance token while a daemon that is deliberately off the hot path restarts. An instance with no [tokens.sr.ht] section builds no instance plane and starts anyway, serving its own agent token as before.
feat(authn): unified-login identity, agent token validation, provenance trailers Cookie identity is fail-open to anonymous: a missing, tampered or foreign-key cookie yields no user rather than an error, so anonymous browsing never breaks on a bad cookie. Agent tokens are the opposite. A bad bearer is a permanent 401, a store outage a transient 503, and revoked rows are returned so operators can distinguish a killed token from one that never existed. TokenStore is declared here rather than imported from db/, so the two packages can be built in parallel and service/ wires them together.