fix: require persona stewards for enterprise domains

Human-Authorizer: ICE-GL∞
Persona-Executor: ICE-P-ZY001
Domain-Scope: ENTERPRISE-INFRASTRUCTURE-INTERFACE
Causal-Chain: HLDP://enterprise/domain-steward-interface/2026-07-30

server-tools/enterprise-lighthouse/lighthouse.py

@@ -82,6 +82,12 @@ def connection():
         action TEXT NOT NULL, target_node_id TEXT NOT NULL, map_hash TEXT NOT NULL,
         capsule_hash TEXT NOT NULL, created_at INTEGER NOT NULL, expires_at INTEGER NOT NULL
       );
+      CREATE TABLE IF NOT EXISTS domain_stewards (
+        domain_id TEXT PRIMARY KEY, human_steward_id TEXT NOT NULL,
+        persona_steward_id TEXT NOT NULL, persona_public_key TEXT NOT NULL,
+        runtime_node_id TEXT NOT NULL, authorization_receipt TEXT NOT NULL,
+        state TEXT NOT NULL, bound_at INTEGER NOT NULL
+      );
     """)
     observed_at = now()
     for domain_id, name in DOMAINS.items():
@@ -104,7 +110,7 @@ def connection():
             "UPDATE nodes SET state='ACTIVE', last_heartbeat=? WHERE id=?",
             (observed_at, node_id),
         )
-        db.execute("UPDATE domains SET state='HOSTED_ACTIVE' WHERE id=?", (domain_id,))
+        db.execute("UPDATE domains SET state='HOSTED_READ_ONLY' WHERE id=?", (domain_id,))
     db.commit()
     return db
 
@@ -232,6 +238,44 @@ def current_intent_state(db, principal_digest):
     ).fetchone()
 
 
+def active_domain_steward(db, domain_id):
+    return db.execute(
+        "SELECT * FROM domain_stewards WHERE domain_id=? AND state='ACTIVE'",
+        (domain_id,),
+    ).fetchone()
+
+
+def domain_statuses(db):
+    result = []
+    for row in db.execute("SELECT id,name,state FROM domains ORDER BY id"):
+        domain = dict(row)
+        if row["id"] in ENTERPRISE_MANAGED_DOMAINS:
+            steward = active_domain_steward(db, row["id"])
+            domain.update({
+                "access_state": "ONLINE_READ_ONLY",
+                "human_steward_id": steward["human_steward_id"] if steward else None,
+                "persona_steward_id": steward["persona_steward_id"] if steward else None,
+                "responsibility_state": "BOUND" if steward else "AWAITING_TEAM_ASSIGNMENT",
+                "steward_state": "ACTIVE" if steward else "UNBOUND",
+                "mutation_state": (
+                    "PERSONA_STEWARD_ACTIVE"
+                    if steward
+                    else "BLOCKED_UNTIL_PERSONA_STEWARD_BOUND"
+                ),
+            })
+        else:
+            domain.update({
+                "access_state": "EXTERNAL_PRIVATE_DOMAIN",
+                "human_steward_id": "ICE-GL∞",
+                "persona_steward_id": "ICE-P-ZY001",
+                "responsibility_state": "EXTERNAL_SOVEREIGN_BOUND",
+                "steward_state": "EXTERNAL_AUTHORITY",
+                "mutation_state": "OUTSIDE_ENTERPRISE_LIGHTHOUSE_AUTHORITY",
+            })
+        result.append(domain)
+    return result
+
+
 def valid_agent_unlock(db, unlock_id, principal_digest, agent_id, action, target_node_id):
     _, map_hash = navigation_map()
     intent = current_intent_state(db, principal_digest)
@@ -280,7 +324,7 @@ class Handler(BaseHTTPRequestHandler):
                     "node_id": "AW-GZ-001",
                     "host_state": "ONLINE",
                     "observed_at": now(),
-                    "domains": [dict(row) for row in db.execute("SELECT id,name,state FROM domains ORDER BY id")],
+                    "domains": domain_statuses(db),
                     "node_counts": counts,
                     "fixed_actions": sorted(FIXED_ACTIONS),
                     "raw_shell": "rejected",
@@ -394,6 +438,12 @@ class Handler(BaseHTTPRequestHandler):
                     return self.respond(400, {"ok": False, "error": "id, domain_id, display_name, and server_ip are required"})
                 if payload["domain_id"] not in ENTERPRISE_MANAGED_DOMAINS:
                     return self.respond(403, {"ok": False, "error": "this domain cannot be registered by the enterprise lighthouse"})
+                if not active_domain_steward(db, payload["domain_id"]):
+                    return self.respond(423, {
+                        "ok": False,
+                        "error": "a human-backed, explicitly authorized persona steward must be active before this domain can change",
+                        "required": "ACTIVE_HUMAN_BACKED_PERSONA_STEWARD",
+                    })
                 try:
                     ip_address(payload["server_ip"])
                 except ValueError: