Registry authorizer for room-token deployments. Room tokens bind to ONE
room, but the registry is project-scoped — the default authorizer asks
authenticate(token, '__layer_registry__'), a pseudo-room no real token
can ever match, locking the registry out entirely (same problem the blob
route solves with authorizeBlob). Verify signature/expiry/revocation
WITHOUT the room binding instead; writes additionally need editor/admin.
The principal is the token itself (token:<jti>): stable per link, so
provenance author-binding stays enforceable and revocation still bites.
Registry authorizer for room-token deployments. Room tokens bind to ONE room, but the registry is project-scoped — the default authorizer asks
authenticate(token, '__layer_registry__'), a pseudo-room no real token can ever match, locking the registry out entirely (same problem the blob route solves withauthorizeBlob). Verify signature/expiry/revocation WITHOUT the room binding instead; writes additionally need editor/admin. The principal is the token itself (token:<jti>): stable per link, so provenance author-binding stays enforceable and revocation still bites.