Implements `openspec/changes/migrate-role-routing-to-or-rbac/` — strict-validates. Role-routing computation stays app-side (ADR-023), enforcement moves to OR's rbac-scopes. Add `ncGroupId` property to roleType schema; map roleType UUIDs → OR authorization blocks. RoleMutationListener (cache invalidation) stays — already compliant. **Umbrella**: hydra/consume-or-rbac-fleet-wide **Depends on**: none (OR auth-system + rbac-scopes are shipped) **Strict-validates**: ✓
Implements
openspec/changes/migrate-role-routing-to-or-rbac/— strict-validates. Role-routing computation stays app-side (ADR-023), enforcement moves to OR's rbac-scopes. AddncGroupIdproperty to roleType schema; map roleType UUIDs → OR authorization blocks. RoleMutationListener (cache invalidation) stays — already compliant.Umbrella: hydra/consume-or-rbac-fleet-wide
Depends on: none (OR auth-system + rbac-scopes are shipped)
Strict-validates: ✓