feat(contract): role watch and capability cmd.exchange

[frahlg]

Step 2 of ADR 0009. contract/registry.yaml is copied byte for byte from srcfl/ftw-webapp#84, and go generate ./internal/... adds RoleWatch, its scopes and CapCmdExchange:

• Role watch: ftw.live.read, ftw.plan.read, ftw.events.read and ftw.dispatch.write.
• Capability cmd.exchange: the box opens the relay's exchange socket and mints watch codes.

The box claims neither name yet.

• DefaultCaps() lists its capabilities by hand, so cmd.exchange stays unsaid until step 5.
• knownRole reads the generated RoleScopes. With watch in that table, the LAN page could mint a watch code or change a phone into a watch: a watch with no phone above it. appLinkRoleAllowed now refuses watch at both doors with 403. Step 3 replaces that refusal with decision 4: over a session, from an owner, with step-up, bound to the calling phone.

TestNoDoorHandsOutAWatchYet runs against the real appenroll.Identity. Without the guard, a scanned watch code from the LAN answers 200 with "role":"watch".

Contract-pair: srcfl/ftw-webapp@feat/watch-registry

Paired pull requests. All three carry the same file, byte for byte.

• srcfl/ftw-webapp: srcfl/ftw-webapp#84, the source copy. Its CI compares against this branch.
• srcfl/ftw-app: srcfl/ftw-app#40

Merge this one and srcfl/ftw-webapp#84 together: while both are open, each CI compares against the other's branch.

Tests

make verify                                       verify: vet + test + build clean
go test ./internal/api/ -run TestNoDoorHandsOutAWatchYet
  without the guard: FAIL, "a scanned watch code from the LAN answered 200"
  with it:           ok
cmp contract/registry.yaml against the ftw-webapp and ftw-app branches   identical

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T08:19:13.631214Z	498f26c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 498f26c7f1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject persisted watches until parent authorization exists

After a site enrolls a watch on a later milestone and then uses ftw rollback with the current data, appenroll.load preserves the watch row and appuplink admits its key because the role is now known. ScopesForRole then grants the watch unconditional ftw.dispatch.write, without the parent intersection or cascading revocation required by ADR 0009, so a watch can continue controlling energy even after its phone is demoted or removed. Keep this role inadmissible at session construction until parent-aware authorization ships, not merely blocked at the pairing API.

Useful? React with 👍 / 👎.