ogar-rbac: mint the canonical RBAC authority, fed by ogar-auth's user

Cargo.toml

@@ -33,6 +33,7 @@ members = [
     "crates/ogar-render-typst",
     "crates/ogar-loco",
     "crates/ogar-r2il",
+    "crates/ogar-rbac",
     "crates/ogar-ro",
     "crates/ogar-elk",
     "crates/ogar-osm",

crates/ogar-auth/Cargo.toml

@@ -16,6 +16,13 @@ description = "OGAR auth arm: the reusable authentication SDK for OGAR consumers
 # in-workspace sibling.
 ogar-encryption = { path = "../ogar-encryption" }
 
+# The canonical identity envelope (`auth::ActorContext`) this crate PRODUCES.
+# Reused, never re-declared: a second (subject, tenant, roles) type is exactly
+# the parallel identity normalizer the ownership ruling forbids. Downward dep
+# only — the contract is zero-dep and never reaches back into OGAR. Same git
+# pattern as `ogar-class-view`.
+lance-graph-contract = { git = "https://github.com/AdaWorldAPI/lance-graph", branch = "claude/patient-identity-architecture-r8lhi5" }
+
 # Argon2id PHC hash+verify (the login-credential path — distinct from the
 # envelope KDF). Default features carry `password-hash` + `rand` (OsRng salt).
 argon2 = "0.5"

crates/ogar-auth/src/lib.rs

@@ -51,6 +51,7 @@
 pub mod legacy;
 pub mod password;
 pub mod totp;
+pub mod user;
 
 // ── Forward suite: re-exported via `ogar-encryption` ────────────────────────
 // Reused wholesale, never re-implemented (see crate docs). A consumer that
@@ -104,4 +105,12 @@ pub type AuthResult<T> = Result<T, AuthError>;
 /// The adapter itself (token validation, JWKS fetch, claim mapping) lands as a
 /// sibling crate under the `ogar-adapter-*` convention when the endgame is
 /// scheduled — it is out of scope for the local auth substrate this crate is.
+///
+/// **The convergence point is now shipped**, as [`crate::user`]: an adapter's
+/// job ends at producing an [`AuthBinding`](crate::user::AuthBinding), which
+/// [`UserStore::resolve`](crate::user::UserStore::resolve) maps to the canonical
+/// [`User`](crate::user::User); the envelope every path converges on is
+/// [`AuthenticatedUser::actor_context`](crate::user::AuthenticatedUser::actor_context).
+/// This module stays an empty marker: what is still out of scope here is
+/// unchanged — token validation, JWKS fetch and claim parsing.
 pub mod federation {}