[SaladDay]

Executor credential issuance, rotation and revocation, native Environment installation and Environment file writes move out of store into sessions and sessionpg. This completes PR 17; #336 moved Environments and devices.

What changes

• Executor credentials: sessions.Service use cases for:

  • the CLI principal's Issue, Rotate and Revoke;
  • the Project's Issue (with rotate) and Revoke.

  sessionpg applies them. The Core-key Project operations record their admin audit entry in the same transaction. The Project credential state is a reader method, which api reads through EnvironmentsReader.

• Native installation: Authorize, Validate and Claim are sessions use cases. sessions builds and parses the token, and sessionpg.Store signs and verifies it with the credential key, so the key stays in the adapter. The token format and signature are unchanged, so tokens issued before this change still verify.

• File writes: reservation and settlement are lease-bound ExecutionOperations (the EnvironmentExecution family). The file-write lookup is internal to sessionpg.

• Wiring: cmd/environment-key builds a keyless Session service and no longer imports store.

• Removed from store:

  • environment_installation.go
  • environment_executor_credentials.go
  • executor_credential_target.go
  • environment_executor_management.go
  • environment_file_writes.go
  • ListProjectExecutorCredentials

• Docs:

  • IMPLEMENTATION.md names the new owners.
  • sessionpg.LoadSessionEnvironment had no external caller, so it is unexported.

Behavior

• Missing credential key: it now returns 503 credential_storage_unavailable.
  • Before, installation authorize returned 500, and the grant validate and claim routes returned 401.
  • The same 503 applies to the Core installation read and to /v1 Session retrieve and update for a self_hosted Session.
  • The contract doc and route annotations say so. The generated OpenAPI changes only by those response codes.
• CLI revoke: it runs in a transaction.
• File writes: the pre-reads run inside the lease transaction, and settling an unknown write returns not found.
• Unchanged: everything else. That covers lock order, the executor-credential conflict rules, audit rows, file-write receipts and write audit, and error precedence.

Checks

• go build ./..., go vet ./services/core/..., make openapi (the committed diff is only the response codes above) and scripts/check-names.py.
• sessions and sessionpg in full.
• store -run on the touched tests: 46 pass, including the official-client and environment-key binary tests.
• api -run on the Environment, installation, executor and error-mapping tests.
• execution -run 'Environment|FileWrite'.
• cmd/environment-key and cmd/server in full.

The blind review found no blockers or majors. Its three minor findings are fixed in this commit: the undocumented 503, an overclaim about which operations are audited, and a stale comment.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}