Save this content to: .claude/skills/nvl-ownership/SKILL.md

# NVL Ownership

For major 6, use native Ownership for new isolated integrations and the installed
Ownership README/UPGRADING runbook for configured subclasses and reviewed adoption.
Ordinary unowned hosts keep unscoped declarations; installation does not enable
isolation. Tenant-specific APIs below apply only to the explicitly selected
deprecated Tenancy bridge; they never substitute for native owner admission.

Read the installed Ownership README and UPGRADING guide for exact API and rollout
steps. Major 6 integrates the stateful NVL graph, including Auth, Media, Pages,
Forms, Tasks, Mail, financial workflows and native translation overrides. NVL Auth/Tenancy are optional.

## Consumer model

The Media base already implements Ownable and HasOwnership. Configure its concrete
subclass before provider boot:

```php
namespace App\Models;

use Nvl\Media\Models\Media as BaseMedia;
use Nvl\Support\Ownership\ValueObjects\OwnershipDefinition;

final class Media extends BaseMedia
{
    public static function ownershipDefinition(): OwnershipDefinition
    {
        return OwnershipDefinition::column(Company::class, 'company_id');
    }
}
```

Set `nvl-media.models.media` to that class. Register native Company and Laravel
actor classes in `nvl-core.owners`. Supply matching native foreign keys. A concrete
primary pivot uses `OwnershipDefinition::pivot(Company::class, $table,
$mediaForeignKey, $companyForeignKey)` with one assignment per asset; grants express
sharing separately. Preserve native keys and Laravel morph identities.

## Admission and persistence

Bind `Nvl\Ownership\Contracts\OwnerAccess`; its default denies. Inject
`Nvl\Ownership\Contracts\OwnershipRunner` and call `run($company, $actor,
$callback)` before the source transaction. A direct Company Media target needs
HasNvlMedia/InteractsWithNvlMedia and declared slots, not a second ownership model.
Uploader attribution does not authorize Company access.

Media's public upload workflow coordinates its writer automatically. Custom roots
use `Nvl\Ownership\Services\OwnershipWriter::create()` with an
`Nvl\Ownership\ValueObjects\OwnershipAssignment` callback. The internal neutral
Core writer instead supplies an attribute array; do not mix these contracts.
Canonical persisted ownership governs reads, quiet saves, inherited relations and
native worker restoration; loaded relations and submitted ownership are untrusted.

## Adoption and queues

Choose vendor-loaded or published protocol migrations, never both. Under actual
authorized maintenance, drain processes, preserve physical store UUIDs, supply
explicit reviewed mappings, and prepare/backfill/verify/activate through
OwnershipAdoptionCoordinator. Resolve shared/orphaned rows explicitly. Partial
phases remain blocked. Disabling or removing the runtime is not rollback.

Mutable queued work uses OwnershipQueuedJob/CapturesOwnership and constructor
capture. Readonly facts initialize scalar OwnershipJobEnvelope directly in the
constructor. Retain full producer principal, owner and generation; never infer a
worker owner. Enabled runtime requires the transaction-committing capability.
Verify with `nvl:ownership:doctor`, negative isolation tests and actual backend/
worker tests; installation and provider registration do not prove readiness.

Use the reviewed `nvl:ownership:plan`, `prepare`, `backfill`, `verify`, `activate`
commands from the installed README. Plan and verify are read-only; preserve the
plan UUID. Audit actor strings never grant authority. Bind fresh host adoption
access only after authenticating the actual operator and checking producer/request/
queue drain. Release infrastructure certification remains separate from unit and
feature evidence. Never invent readiness or conservation markers.

## Canonical configuration ownership

Use `config/nvl-ownership.php` and `nvl-ownership.*` configuration only. Both
`enabled` and `migrations.enabled` default to false. Publish `nvl-ownership-config`,
`nvl-ownership-skills` and, only for host-managed protocol migrations,
`nvl-ownership-migrations`. Never load vendor and published migration copies
together. The host owns its native owner-column/pivot migrations and policies.
Configure subclass selectors in the owning domain package before provider boot.