feat(hierarchy): M4-1b-ii hierarchy command family, grant evaluation, visibility

Conversation 1 Commits 2 Files Changed 20

+8407 -132

2 Commits

Author	SHA1	Message	Date
fred	f55d62cf92	fix(m4-1b-ii): complete §1.1 retirement in MCP content filters + review-round-1 witnesses ci/woodpecker/pr/ci Pipeline was successful Details GLM round-1 findings on PR #1465: - BLOCKING 1: remove role-keyed content widening from mcp.service.ts — isGlobalAdminActor/isTenantAdminActor/matchesTenant and every short-circuit keyed on users.role are gone; project/mission/task visibility is ownership + derived membership only, task create scope is unconditional. Spec test rewritten to witness that admin-role and platform-admin-role actors see only owned content. - MINOR 2: writer-coverage header updated to the non-empty allowlist. - MINOR 3: §6.9 witness — a directory-listed company still refuses non-granted callers (granted-read exclusion + mutation oracle). - MINOR 4: §6.4 commit legs for renameCompany (previousName in the audited event) and direct revokeGrant (row deletion + grant_revoke).	2026-08-28 20:22:03 -05:00
fred	a3446a13e2	feat(hierarchy): M4-1b-ii hierarchy command family, grant evaluation, visibility ci/woodpecker/pr/ci Pipeline was successful Details Implements the ratified hierarchy command surface per contract 1 (hierarchy-schema.md) and contract 2 (rbac-grant-model.md), brief M4-1B-II: - HierarchyRepository: the closed command family (company/estate/ platform-project create/rename/transfer/delete, grant create/change/ revoke, directory + granted-companies reads). Every mutation runs in one transaction through the M4-1b-i audit machinery (event + outbox, idempotency-key replay, causation-linked composite operations). - HierarchyGrantEvaluationService: live deny-by-default evaluation — effective role is the max over ancestor-chain user grants, fail-closed, team subjects suspended (§1.4), platform admin confers no tenant access (§1.1). - companies.visibility column (private default, directory carve-out) with migration 0020, admin-only audited visibility_change (§5.5), closed-field directory listing (§2.8), no-existence-oracle refusals (§6.7). - hierarchy_grants role CHECK pinned to the ratified vocabulary; namespaced serialized roles (hierarchy:*, §4.5). - §1.1 bypass retirement: role-derived MCP scope elevation and hasScope admin shortcuts removed; specs updated to the granted-scope path. - Witnesses: schema-level (role CHECK, visibility class/default), §6.3 closed route inventory, §6.4 per-mutation-class commit+rollback legs, §6.5 authorization, §6.7 oracle indistinguishability, §6.9 visibility, grant-evaluation semantics (chain inheritance, max-role, live revocation).	2026-08-28 19:59:17 -05:00

Author

SHA1

Message

Date

fred

f55d62cf92

fix(m4-1b-ii): complete §1.1 retirement in MCP content filters + review-round-1 witnesses

ci/woodpecker/pr/ci Pipeline was successful

Details

GLM round-1 findings on PR #1465:
- BLOCKING 1: remove role-keyed content widening from mcp.service.ts —
  isGlobalAdminActor/isTenantAdminActor/matchesTenant and every
  short-circuit keyed on users.role are gone; project/mission/task
  visibility is ownership + derived membership only, task create scope
  is unconditional. Spec test rewritten to witness that admin-role and
  platform-admin-role actors see only owned content.
- MINOR 2: writer-coverage header updated to the non-empty allowlist.
- MINOR 3: §6.9 witness — a directory-listed company still refuses
  non-granted callers (granted-read exclusion + mutation oracle).
- MINOR 4: §6.4 commit legs for renameCompany (previousName in the
  audited event) and direct revokeGrant (row deletion + grant_revoke).

2026-08-28 20:22:03 -05:00

fred

a3446a13e2

feat(hierarchy): M4-1b-ii hierarchy command family, grant evaluation, visibility

ci/woodpecker/pr/ci Pipeline was successful

Details

Implements the ratified hierarchy command surface per contract 1
(hierarchy-schema.md) and contract 2 (rbac-grant-model.md), brief M4-1B-II:

- HierarchyRepository: the closed command family (company/estate/
  platform-project create/rename/transfer/delete, grant create/change/
  revoke, directory + granted-companies reads). Every mutation runs in one
  transaction through the M4-1b-i audit machinery (event + outbox,
  idempotency-key replay, causation-linked composite operations).
- HierarchyGrantEvaluationService: live deny-by-default evaluation —
  effective role is the max over ancestor-chain user grants, fail-closed,
  team subjects suspended (§1.4), platform admin confers no tenant access
  (§1.1).
- companies.visibility column (private default, directory carve-out) with
  migration 0020, admin-only audited visibility_change (§5.5), closed-field
  directory listing (§2.8), no-existence-oracle refusals (§6.7).
- hierarchy_grants role CHECK pinned to the ratified vocabulary; namespaced
  serialized roles (hierarchy:*, §4.5).
- §1.1 bypass retirement: role-derived MCP scope elevation and hasScope
  admin shortcuts removed; specs updated to the granted-scope path.
- Witnesses: schema-level (role CHECK, visibility class/default), §6.3
  closed route inventory, §6.4 per-mutation-class commit+rollback legs,
  §6.5 authorization, §6.7 oracle indistinguishability, §6.9 visibility,
  grant-evaluation semantics (chain inheritance, max-role, live
  revocation).

2026-08-28 19:59:17 -05:00

feat(hierarchy): M4-1b-ii hierarchy command family, grant evaluation, visibility #1465