Package-level declarations

Who the operators are: it steps aside when CoSec decides (its policies of the actions); otherwise the operator role decides: a caller with the role OpsRoles.OPERATOR may act on an entry and send the framework's system commands, and no other caller may.

The commands no caller of the ops context's gateway may send, whoever it is: the records, ops.parked.RecordParked, RecordResolved and RecordActionRefused. The owning services' ledgers publish the first two through wow.ops.commands, whose intake no authorizer guards, and the saga derives the last from an owning service's refusal: none may be forged. They are internal commands too (@InternalCommand), so the public port serves none of their routes; this refuses them on the internal port. Every other command it has no objection to, as one of the node's authorizers (each must allow a command): an operator's action on an entry (ops.parked.Retry, Skip, MarkRecoverable, ApplyRetrySpec) and the framework's own system commands (wow.*) are decided by who the operators are, CoSec's policies of their actions where CoSec decides the commands, else OperatorRole.

The ops service's beans: who calls it, and what each caller may send.

The ops service's roles, which a caller lists in its attribute ROLES_ATTRIBUTE: from the identity the CoSec gateway verified and forwarded (the cosec profile, its operators' roles listed in wow.cosec.tenant-level.roles), or, in development, from the Wow-Roles header (the host's development callers). An entry is its tenant's, so no caller's owner restricts its reads: these roles do (ReaderRole), and a caller with neither reads nothing.

The ops service on the Wow host: the aggregation and operation surface of every service's failure ledger. The host finds the parked model and ParkedOperationSaga through ops-domain's binding index and serves the ops context's routes:

Who reads the entries where the roles decide: a caller with one of OpsRoles.READERS reads every entry of its tenant, and any other caller's read of them, a query of any model, a state read or a trace, is refused as wow.auth.forbidden, before anything is read; trusted in-process code, which reads with no caller, is not asked. Every aggregate this service serves is an entry.