ticket: close feature authority separation

work-items/closed/20260604-234844-feature-api-authority-separation/item.md

@@ -2,12 +2,12 @@
 id: 20260604-234844-feature-api-authority-separation
 slug: feature-api-authority-separation
 title: Feature API: separate internal modules from external-plugin authority model
-status: open
+status: closed
 kind: task
 priority: P1
 labels: [plugin, feature-registry, permissions, architecture]
 created_at: 2026-06-04T23:48:44Z
-updated_at: 2026-06-05T05:09:37Z
+updated_at: 2026-06-05T05:11:56Z
 assignee: null
 legacy_ticket: null
 ---

work-items/closed/20260604-234844-feature-api-authority-separation/resolution.md

@@ -0,0 +1,40 @@
+Feature API authority separation is complete and merged.
+
+Implementation:
+
+- `4fc361f refactor: name feature host authorities explicitly`
+- merge commit: `b46ea65 merge: clarify feature host authorities`
+
+Summary:
+
+- Renamed the generic feature authority API surface to explicit host-authority terminology:
+  - `AuthorityRequest` -> `HostAuthorityRequest`
+  - `AuthorityGrantSet` -> `HostAuthorityGrantSet`
+  - `AuthorityDenial` -> `HostAuthorityDenial`
+  - `requested_authorities` -> `requested_host_authorities`
+  - `required_authorities` -> `required_host_authorities`
+  - `granted_authorities` -> `host_authority_grants`
+  - `grants()` -> `host_authority_grants()`
+  - `FeatureInstallError::AuthorityDenied` -> `HostAuthorityDenied`
+- Preserved descriptor-first validation, duplicate tool rejection, undeclared contribution rejection, missing host-authority install failure, and built-in Task feature behavior.
+- Added/updated tests/comments to make contribution declarations separate from host authority grants.
+- Did not implement Ticket tools, external plugin loading, approval/resume protocol, MCP, WASM/sandbox runtime, feature crate extraction, Hook behavior changes, or Task behavior changes.
+
+Review:
+
+- External sibling reviewer approved with no blockers and no required non-blockers.
+- Residual note: `HostAuthorityGrantSet::grant_all(&descriptor.requested_host_authorities)` remains the existing builtin-only scaffold, not a real external-plugin approval resolver. This is unchanged and remains future work.
+
+Post-merge validation passed:
+
+- `cargo test -p pod feature --lib`
+- `cargo test -p pod task --lib`
+- `cargo test -p pod --lib`
+- `cargo test -p llm-worker --lib`
+- `cargo fmt --check`
+- `git diff --check`
+- `./tickets.sh doctor`
+- `cargo check --workspace --all-targets`
+- `nix build .#yoi --no-link`
+
+This clears the API naming prerequisite for `ticket-built-in-feature-tools`.

work-items/closed/20260604-234844-feature-api-authority-separation/thread.md

@@ -232,4 +232,52 @@ The existing `HostAuthorityGrantSet::grant_all(&descriptor.requested_host_author
 Yes. This clears the API naming prerequisite for `ticket-built-in-feature-tools`.
 
 
+---
+
+<!-- event: close author: hare at: 2026-06-05T05:11:56Z status: closed -->
+
+## Closed
+
+Feature API authority separation is complete and merged.
+
+Implementation:
+
+- `4fc361f refactor: name feature host authorities explicitly`
+- merge commit: `b46ea65 merge: clarify feature host authorities`
+
+Summary:
+
+- Renamed the generic feature authority API surface to explicit host-authority terminology:
+  - `AuthorityRequest` -> `HostAuthorityRequest`
+  - `AuthorityGrantSet` -> `HostAuthorityGrantSet`
+  - `AuthorityDenial` -> `HostAuthorityDenial`
+  - `requested_authorities` -> `requested_host_authorities`
+  - `required_authorities` -> `required_host_authorities`
+  - `granted_authorities` -> `host_authority_grants`
+  - `grants()` -> `host_authority_grants()`
+  - `FeatureInstallError::AuthorityDenied` -> `HostAuthorityDenied`
+- Preserved descriptor-first validation, duplicate tool rejection, undeclared contribution rejection, missing host-authority install failure, and built-in Task feature behavior.
+- Added/updated tests/comments to make contribution declarations separate from host authority grants.
+- Did not implement Ticket tools, external plugin loading, approval/resume protocol, MCP, WASM/sandbox runtime, feature crate extraction, Hook behavior changes, or Task behavior changes.
+
+Review:
+
+- External sibling reviewer approved with no blockers and no required non-blockers.
+- Residual note: `HostAuthorityGrantSet::grant_all(&descriptor.requested_host_authorities)` remains the existing builtin-only scaffold, not a real external-plugin approval resolver. This is unchanged and remains future work.
+
+Post-merge validation passed:
+
+- `cargo test -p pod feature --lib`
+- `cargo test -p pod task --lib`
+- `cargo test -p pod --lib`
+- `cargo test -p llm-worker --lib`
+- `cargo fmt --check`
+- `git diff --check`
+- `./tickets.sh doctor`
+- `cargo check --workspace --all-targets`
+- `nix build .#yoi --no-link`
+
+This clears the API naming prerequisite for `ticket-built-in-feature-tools`.
+
+
 ---