[aibeshkov]

Andrei's decision (2026-10-17): a caller with zero grants gets an EMPTY 200 from a list route (lists are filtered by permission); a single-object read without a grant is 403; a bad or expired token is 401. Found by MACHINE-IDENT-DENY-1.

Item 1: zero-grant list case (all four SDKs)

The "machine identity token" case now asserts ListProjects succeeds with an empty list for a zero-grant token (was: expects 403/ForbiddenError). A new bad-token case asserts 401/AuthError, so the token-authenticates proof stays.

Item 2: single-object 403 (all four SDKs)

New case: GET /projects/{id} with a zero-grant token is forbidden (403). The SDKs have no GetProject method, so it uses a raw HTTP GET like the existing helpers.

Item 3: COMPATIBILITY.md

States the rule: list = filtered (empty 200), single object = 403, bad token = 401.

Item 4: results against a local keyorix-server built from current main (SQLite)

• Go: PASS (10/10 subtests)
• Node: PASS (15 passed, 0 failed)
• Python: PASS (10 tests OK)
• Java: NOT RUN locally. The sandbox cannot write ~/.m2 and Maven Central is not on the network allowlist. CI's Java contract step is the first real run.

CI note (needs coordinator)

Current main defaults security.require_mfa on (ADR-112), so the admin session used by the contract suites is confined to MFA enrolment and gets 403 on every /api/v1 call. Locally I ran with security.require_mfa: false in a copy of .github/contract-server/keyorix.yaml. That file needs the same line under security: for the Contract job to go green. It is under .github/**, which this PR does not touch, so it needs its own PR. Without it the Contract job fails on main as well, independent of this change.

Session: SDK-ZERO-GRANT-1