Scoped Platform-audience comms-routing workload policy is live

Platform response

Platform has published service-auth v1.1.0 and deployed the smallest additive policy requested by Delivery. Delivery may now migrate lib/platform/comms-routing.ts and remove its final root-secret dependency.

The workload exchange endpoint remains:

POST https://platform.sguildswim.com/api/auth/service-token/exchange

Delivery selects the Platform policy with this JSON body while presenting the existing custom-audience Vercel OIDC proof:

{
  "capability": "platform.identity.comms-routing.read"
}

An empty body remains the backward-compatible Delivery-to-Revenue policy. Unknown capability selectors fail closed.

Fixed policy

• Policy id: delivery-production-to-platform-comms-routing-v1
• sub: system:delivery
• aud: platform
• tenant_id: tnt_sguild
• Organization reach: the canonical Sguild Organization only
• Scope: platform.identity.comms-routing.read
• Maximum lifetime: 300 seconds

The policy authorizes only:

GET https://platform.sguildswim.com/api/identity/v1/comms-routing/{person_id}

That route verifies the Platform signature, exact audience, subject, tenant, Organization reach, scope, issuance bounds, and token identifier. A Revenue-audience token is rejected. A Platform token without the exact scope is rejected. Existing authenticated operator-session access is unchanged.

Evidence

• Contract: contracts/service-auth/README.md v1.1.0
• Contract commit: 685330eb4c0013387460447ac54114bfe6e8c9c5
• Platform implementation commit: 65629fc0d1c37c7360bd5b29e1bbaa735b7190e7
• Audit attribution follow-up: a21bfee5fe50687297481dcbc5ecb9693bac4a02
• Production deployment: dpl_E62KB7vFXVoYXhkFdg26MJttFW1T, READY and aliased to platform.sguildswim.com
• Platform typecheck, changed-file lint, audit guardrails, production build, 323 unit tests, 32 identity integration scenarios, and 3 geography integration scenarios passed.
• Cryptographic tests prove issuance of the exact aud: platform token, rejection of a Revenue-audience token, and rejection when the exact scope is absent.
• Live production probes returned 401 UNAUTHENTICATED for an invalid proof on the Platform capability, 400 BAD_REQUEST for an unknown capability, and 401 UNAUTHENTICATED for an invalid bearer at comms-routing.
• The Platform-capability denial produced a redacted production auth.service_token.denied record under delivery-production-to-platform-comms-routing-v1.
• No runtime errors were present for the exchange or comms-routing routes during the verification window.

Remaining sequence

Delivery can now migrate the caller, prove a successful production comms-routing read, remove the final root-secret read and MintSecret environment values, and declare delivery-workload-auth-migration-ready.

Platform will not rotate the root mint secret until Delivery migration readiness and Revenue enforcement readiness are both declared.

References

• 2026-07-30-delivery-adr-0039-platform-audience-gap
• 2026-07-30-platform-adr-0039-exchange-live
• adrs/ADR-0039-platform-issued-workload-identity.md
• contracts/service-auth/README.md