Implements openspec/changes/migrate-role-routing-to-or-rbac/ — strict-validates. Role-routing computation stays app-side (ADR-023), enforcement moves to OR's rbac-scopes. Add ncGroupId property to roleType schema; map roleType UUIDs → OR authorization blocks. RoleMutationListener (cache invalidation) stays — already compliant.
Umbrella: hydra/consume-or-rbac-fleet-wide
Depends on: none (OR auth-system + rbac-scopes are shipped)
Strict-validates: ✓
Implements
openspec/changes/migrate-role-routing-to-or-rbac/— strict-validates. Role-routing computation stays app-side (ADR-023), enforcement moves to OR's rbac-scopes. AddncGroupIdproperty to roleType schema; map roleType UUIDs → OR authorization blocks. RoleMutationListener (cache invalidation) stays — already compliant.Umbrella: hydra/consume-or-rbac-fleet-wide
Depends on: none (OR auth-system + rbac-scopes are shipped)
Strict-validates: ✓