orrery/write-authority-check

Verify an explicit write grant covers the intended path set.

/resolve?name=orrery/write-authority-check

Use this when

You need authorized/denied codes before applying a write
You have a grant_digest and optional signed witness envelope

Not for

Writing files or applying patches
Multi-party witness ceremonies
Inventing policy names outside explicit-paths@v1

Inputs / Outputs

Inputs

Name	Type	Notes
`manifest_digest` required	string	opaque hex digest
`authority` required	object	policy, allowed_paths, grant_digest, optional witness

Outputs

Name	Type	Notes
`authorized`	boolean	—
`codes`	array	—
`grant_digest`	string	—
`envelope`	signed-envelope	—

Example

{
  "method": "tools/call",
  "params": {
    "name": "check",
    "arguments": {
      "manifest_digest": "example",
      "authority": {}
    }
  }
}

Tools

check Verify an explicit write grant covers the intended path set (optional signed witness envelope) · schema

{
  "type": "object",
  "properties": {
    "manifest_digest": {
      "type": "string",
      "minLength": 64,
      "maxLength": 64
    },
    "authority": {
      "type": "object",
      "properties": {
        "policy": {
          "type": "string",
          "minLength": 1,
          "maxLength": 128
        },
        "allowed_paths": {
          "type": "array",
          "minItems": 1,
          "maxItems": 10000,
          "items": {
            "type": "string",
            "minLength": 1,
            "maxLength": 512
          }
        },
        "grant_digest": {
          "type": "string",
          "minLength": 64,
          "maxLength": 64
        },
        "witness": {
          "type": "object"
        },
        "witness_public_key": {
          "type": "string",
          "minLength": 64,
          "maxLength": 64
        }
      },
      "required": [
        "policy",
        "allowed_paths",
        "grant_digest"
      ],
      "additionalProperties": false
    }
  },
  "required": [
    "manifest_digest",
    "authority"
  ],
  "additionalProperties": false
}

In constellations

orrery/authorized-content-patchGoverned content edit path: readiness → write-authority → patch-capture → sealed composite (never applies patches)↗orrery/publish-gatePublication-authority seam: prior artifact envelope → publish-profile write-authority → optional witness → release seal (no deploy)↗