sync: align runtime source with GitHub main

app/security/scopes.py

@@ -89,7 +89,6 @@ DEFAULT_ROLE_SCOPES: dict[str, frozenset[str]] = {
             "jobs:cancel",
             "assets:read",
             "assets:write",
-            "assets:delete",
             "mcp:read",
             "mcp:execute",
             "system:read",
@@ -250,3 +249,25 @@ def effective_scopes(
     if "admin" in scopes:
         return ALL_SCOPES
     return frozenset(scopes)
+
+
+def membership_role_scopes(
+    role: str | None,
+    overrides: Mapping[str, Sequence[str]] | None = None,
+) -> frozenset[str]:
+    """Return the tenant-membership permission ceiling.
+
+    Membership roles and API-key roles are separate vocabularies. Owners and
+    administrators receive the full membership ceiling; ordinary members and
+    service principals receive the operator ceiling; viewers remain read-only.
+    The API-key role/scopes are intersected with this ceiling at authorization.
+    """
+    normalized = (role or "").strip().lower()
+    roles = configured_roles(overrides)
+    if normalized in {"owner", "admin"}:
+        return ALL_SCOPES
+    if normalized in {"member", "service"}:
+        return roles.get("operator", DEFAULT_ROLE_SCOPES["operator"])
+    if normalized == "viewer":
+        return roles.get("viewer", DEFAULT_ROLE_SCOPES["viewer"])
+    return frozenset()