[servicememeai]

Scope

• Schedule enterprise organization/role catalog reconciliation with existing cf_worker, default 600 s; no user or membership creation from ordinary ACL requests.
• Keep user/GroupUser projection at authenticated login only. Missing mapped org/role fails closed until scheduled/explicit catalog sync.
• Make native write authorization read fresh ACL facts, reuse one Authority per request, return a small write-only verdict (avoid 4 KB HTTP response cap).
• Scope login-time GroupUser refresh to the current user's mapped groups instead of locking every Provider group.
• Delta-sync catalog (unchanged organizations do not acquire per-group locks or CE RPC).

Product contract

• Catalog cadence 10 min != periodic refresh of every logged-in user's memberships. Changes in user membership require the next authenticated login or explicit admin sync.
• No new tables, scheduler service, cache tier, queue, or parallel permission engine.
• Changes limited to Hub hot paths. Server's two-stage final Branch transaction must be a separate coordinated PR.

Targeted tests

• Existing pure subject adapter / membership SQL mock / directory adapter / native HTTP tests updated; GitHub CI will determine runtime pass/fail.