Story: Generate HTTP routes from the models

ores.http serves every component through routes generated from that component's models, with one uniform security model, and ores.assets is the first component landed through it.

The gateway's routes generate from the models. A codegen facet, ores.cpp.http-route, projects an entity or an operation model onto a route unit with a header, an implementation and a test. Three components are landed, each in its own part beside the hand-written aggregator, and each with its hand-written route file deleted rather than kept in parallel: ores.http.assets (image, tag, image_tag), ores.http.refdata (currency) and ores.http.iam (account, role, permission, session, login_info, and nineteen operations). Ninety-two routes generate in total, and the gateway serves 99 endpoints: those 92, the 5 storage and 1 variability routes that stay hand-written, and the server's own /api/v1/info.

The gateway is a protocol gateway. A generated route builds the canonical request, sends it over NATS and maps the reply to an HTTP response, so it depends on the target's wire protocol and not on its service library. The server stopped linking three component libraries.

Security is one declaration and one enforcement point. The route forwards the caller's bearer token by delegation, so the service's own permission check governs the real caller, and it states its authentication position from the model. A route that states neither position cannot be built or registered, and a gate fails the build if any registered route is silent. The storage routes were public by omission and are now authenticated.

Verification on the merged head af159c1084:

• ctest -R 'http|storage' is 8 of 8.
• pytest projects/ores.codegen/tests is 787 passed.
• check_component_drift.py --all --dry-run reports no drift.
• check_route_auth_declarations.py passes, and handler permissions, model drift, protocol twin coverage, populate references and the shell recipe inventory are all green.
• validate_docs.sh reports all 40 components pass, and compass lint passes.

Live checks, run against the systemd fleet while the branch was open: a generated entity route answered 401 without a token, a generated public operation answered 200, an unexposed operation answered 404, and an unknown path answered 404.

Three failures remained and none belonged to this story. The whole tree did not build: ores.trading.core and ores.workflow.core included ores.dq.api/messaging/fsm_protocol.hpp, which dd131c388b split into fsm_state_protocol.hpp and fsm_transition_protocol.hpp without migrating the including sites. Two other components owned those files, so the repair went there, and main has since repaired it: the whole tree builds again. regenerate_cmake_component_files.py --all --check reports stale lists in ores.workspace. ores.iam.core.tests fails against the restored database because its stored ores_iam_accounts_insert_fn() predates the tree's SQL and reads a column the SQL no longer has; the tree's SQL is correct.

• A codegen facet generates a route unit per entity, with a header, an implementation and a test, from the entity's model.
• The generated route speaks the canonical NATS protocol and carries the caller's session, so the service's own permission check governs access.
• Every route that needs a session is behind one by construction, declared in the model rather than by hand at the call site.
• The hand-written route file for ores.assets is deleted, and its endpoints still answer.

Recorded rather than done, each with its reason:

• storage keeps its five routes hand-written. Four are file operations on {bucket}/{key} and the fifth lists a bucket, so there is no entity to generate from.
• variability keeps its one route hand-written. It has no models, so it has nothing for the facet to read.
• The whole tree build, at the time. It failed on a pre-existing break in other components: ores.trading.core and ores.workflow.core included ores.dq.api/messaging/fsm_protocol.hpp, which dd131c388b split into two headers and did not migrate the including sites. Both components had active owners, so the repair belonged there, and main has since repaired it. No CI job builds the tree, which is how main broke without a check noticing.
• The trade and market series export handlers carry the reporting service's token, not the end user's, because the reporting service calls them without delegation. Authorization there is service-level; propagating the caller needs a reporting-side change.
• The compute wrapper has its own HTTP client and holds no JWT, so its storage transfers still receive 401. No credential exists to give it.
• A trailing {key} GET shadows the versions path beneath it, so /roles/{name} hides /roles/{name}/versions. Assets has the same shape with images. Pre-existing and worth its own fix.
• journey_sign_up.org still names POST /api/v1/auth/signup, which now answers 404. It is a journey document, not a client.