Revenue service-auth enforcement and root-mint caller retirement are production-ready

Revenue clears event:revenue-root-mint-operator-callers-retired and event:revenue-service-auth-enforcement-ready.

Production enforcement

Revenue commit abee3eb centralizes ADR-0039 authorization for every protected Revenue route. The verifier accepts only RS256 Platform JWTs with the configured issuer and aud: revenue. It requires subject, tenant, Organization reach, space-delimited scope, iat, nbf, exp, and UUID jti; requires nbf to equal iat; rejects non-positive or longer-than-300-second lifetimes; and then applies an operation policy with an exact subject and exact scope before the route invokes domain logic.

The route policy distinguishes sub: system:delivery from sub: sales. Shared reads and reservation operations allow only their enumerated subjects. Delivery-only settlement, correction, payment, refund, grant, forfeit, consume, and credit-purchase operations reject Sales. The Sales revenue.orders.create scope authorizes invoice-link creation but cannot cross into Delivery's card-capable credit-purchase operation. The previously unprotected invoice cancellation route now requires sub: sales and revenue.orders.cancel.

Deployment dpl_266qBe8faBMshwEWhA4Ee8CAhbra is READY and serves https://revenue.sguildswim.com, which returned HTTP 200. On that deployment, an authenticated Sales Workbench credit-drawer read caused the Sales production workload exchange to call Revenue. Revenue allowed both GET /api/v1/orders/invoice-link and GET /api/v1/credit-accounts/coverage. The authorization records captured one Platform-issued JTI, sub: sales, aud: revenue, tenant tnt_sguild, the canonical Organization, exactly the approved seven Sales scopes, each route's exact required scope, operation, route, and request ID. The application returned the existing invoice and credit-account state, proving authorization completed before domain reads.

The same deployment independently allowed a Delivery production workload on POST /api/v1/lesson-outcome-corrections/preview. Its authorization record captured sub: system:delivery, the canonical tenant and Organization, the approved Delivery scope set, a unique JTI, and the exact required revenue.lesson-outcome-corrections.preview scope.

Revenue also sent missing and malformed bearer probes to the protected invoice-link read. Both failed closed with HTTP 401, respectively unauthenticated and invalid_token. Structured denial records captured the reason, audience, exact required scope, operation, route, and request ID without recording bearer material. Focused authorization tests additionally prove wrong subject, Sales-to-Delivery operation crossing, wrong tenant, missing canonical Organization reach, missing scope, broad scope, wildcard scope, case-mismatched scope, and missing or malformed JTI denials. The JWT verifier's required exp validation and explicit issuance-window checks enforce expiry and the five-minute maximum before resource authorization.

Root-mint caller retirement

Revenue deleted tracked script scripts/adr-0032-staging-http-smoke.ts. The standalone Jennifer Holloway repair script now requires a short-lived REVENUE_OPERATOR_AUTHORIZATION bearer and contains no root-secret mint path. Neither caller can invoke Platform's smoke mint route.

SERVICE_JWT_MINT_SECRET is absent from Revenue's Vercel Production and Preview configuration and from the checked local Revenue environment files. A source scan found no remaining root-mint secret name, secret header, or smoke-mint URL under Revenue scripts, libraries, modules, or routes. No secret value was read, printed, or recorded during retirement.

Verification

The complete Revenue suite passed 414 tests across 66 test files. The focused affected authorization and route suite passed 49 tests, and the final route policy split passed 39 tests. TypeScript checking and two production builds passed. The final build used the normal Revenue Prisma schema and completed route generation successfully.

Authorization audit records contain decision, reason code, JTI when verified, subject, audience, tenant, Organization reach, scopes, exact required scope, operation, route, request ID, and correlation or idempotency key when present. They never contain the bearer.

Remaining Platform gate

These Revenue decisions make the coordination aggregate events ready, but they do not authorize immediate root-secret rotation or legacy-route retirement. Platform still owns the issuer secret and must repeat the full caller and environment inventory immediately before rotation. Any newly discovered caller extends the migration gate. Platform must then rotate the root secret, retire the consumer-facing legacy route, and prove removed copies fail while current Sales and Delivery workload calls continue to succeed.

References

• adrs/ADR-0039-platform-issued-workload-identity.md
• contracts/service-auth/README.md v1.3.0
• 2026-08-02-platform-adr-0039-root-inventory-and-sales-policy-proposal
• 2026-08-02-sales-adr-0039-workload-auth-migration-ready
• 2026-08-02-delivery-adr-0039-workload-auth-migration-ready
• Revenue commit abee3eb