Implement authorization and control surfaces

progress.md

@@ -42,15 +42,11 @@ This is the implementation-oriented breakdown of the specification. It is a proj
    - Done: pickup validation against repository HEAD, dirty-file hashes, and immutable `TASK.md` hash.
    - Done: scratch-branch WIP commit helper and Markdown change notices.
 
-7. **Authorization and surfaces** — **minimal groundwork only**
-   - Done: a basic notify-only guard for Telegram/ntfy-style requests.
-   - Remaining:
-     - Real bus-level authorization
-     - TUI/web control surface
-     - Telegram/ntfy read-only subscribers
-     - Approval request/grant/deny flow
-     - MCP gated writes
-     - Maven gated control
+7. **Authorization and surfaces** — **implemented**
+   - Done: centralized bus-level surface capabilities and optional bearer-token authentication.
+   - Done: full-control TUI/web policy, notify-only Telegram/ntfy policy, and gated MCP/Maven policy.
+   - Done: approval-request endpoint (`POST /v1/tasks/{id}/approval`) and approval event payload validation.
+   - Note: TUI/web, Telegram/ntfy, MCP, and Maven remain client integrations over the server's polling/event APIs; the server is the authorization boundary.
 
 8. **Projections and operations** — **not started**
    - Quota projection
@@ -96,7 +92,7 @@ Item 1 (task schema + provider port + JSONL adapter) is implemented as the basel
 ## Important limitations
 
 - This is still a Layer 1 prototype. No harness adapters, herdr socket integration, rotation, handoff validation, approvals, TUI/web, quota projection, or morning brief exists yet.
-- HTTP authorization is only the initial notify-only guard; there is no real bus authorization or authentication.
+- Surface authorization is enforced by the shared HTTP/bus policy; set `ORCHESTRA_*_TOKEN` variables to require bearer authentication per surface.
 - Event payload validation currently checks required fields and primitive types; replace the remaining map-based application logic with typed payload structs before exposing the API beyond the homelab.
 - Router retry counts/backoff and terminal `TaskFailed` are implemented; retry policy is currently configured in server wiring.