Update docs: machine-caller identity resolution (CL-6286)

Document RouteDeps.callerResolver / createMemory({ callerResolver }) in
AGENTS.md's "authenticate nothing" invariant, ARCHITECTURE.md's identity
section, and CHANGELOG.md.

Author: TheGreatAxios

AGENTS.md

@@ -35,9 +35,14 @@ CI runs `typecheck` + `test` — both must pass before any push.
 
 ## Non-negotiable invariants
 
-1. **Authenticate nothing.** Identity is `c.get("principal")` from the
-   Interchange context; authorization goes through the host's grant store
-   (`@intx/authz`). Never add API keys, sessions, or OAuth here.
+1. **Authenticate nothing.** Identity defaults to `c.get("principal")` from
+   the Interchange context; a host may instead supply `callerResolver`
+   (`src/routes/deps.ts`) to resolve a non-browser caller (e.g. a
+   workflow-run child's own sidecar bearer token) — but resolving that
+   token is 100% host logic, called through the seam, never implemented
+   here. Either way authorization goes through the host's grant store
+   (`@intx/authz`) via the same `requireGrant` path. Never add API keys,
+   sessions, or OAuth here.
 2. **One Postgres**: `DATABASE_URL`, the engine's own vector plane, under the
    `memory` schema — never the host's control-plane DB. No foreign keys into
    control-plane tables; cross-refs (`tenant_id`, `principal_id`) are plain

ARCHITECTURE.md

@@ -45,9 +45,15 @@ helpers are optional multi-writer / backfill — not the primary path.
 - **Runtime**: Bun + Hono, mounted on the host app. **DB**: own pgvector
   Postgres (`DATABASE_URL`) unless `documentStore` is injected.
   **Types**: arktype at every route boundary.
-- **No auth of its own.** Interchange resolves the caller and puts `principal`
-  + `tenant` on context; routes read identity from there
-  (`tenantId = principal.tenantId`, `principalId = principal.id`).
+- **No auth of its own.** By default, Interchange resolves the caller and
+  puts `principal` + `tenant` on context; routes read identity from there
+  (`tenantId = principal.tenantId`, `principalId = principal.id`). A host
+  with a non-browser caller (e.g. a workflow-run child with its own sidecar
+  bearer token) may instead pass `callerResolver` (`RouteDeps` /
+  `createMemory`) — the host still does 100% of the authenticating, it just
+  hands the resolved `{ tenantId, principalId }` in through the seam instead
+  of setting context itself. Either way the resolved identity, never
+  anything from the request body, is what `grantGuard` authorizes.
 - **Grants delegate to the host.** Pass `grantStore` + `conditionRegistry`;
   routes use `createRequireGrant("memory", action)`.
 - **Dependencies**: `@intx/hub-api`, `@intx/authz`, `@intx/log`, Hono, Drizzle,

CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- `RouteDeps.callerResolver` / `createMemory({ callerResolver })` — an
+  optional host-supplied resolver from a request to a `{ tenantId,
+  principalId }` scope, for a caller that never goes through the host's
+  tenant-session middleware (e.g. a workflow-run child authenticating with
+  its own sidecar bearer token). Unset by default: every route still reads
+  identity from `c.get("principal")` exactly as before. When set, the
+  resolved identity is seated as the request's principal/tenant ahead of
+  `grantGuard`, so the same `requireGrant` authorization path applies to a
+  machine caller — never a separate, weaker one. Identity from the resolver
+  always wins over anything a request body claims.
+
 ### Fixed
 
 - Feed `nextCursor` advances past the examined raw page after grant-tag