CI MIRROR — do not merge - #5
Draft
JimCollinson wants to merge 52 commits into
Draft
Conversation
…etiring Owner Accepts the saorsa-labs#107 design proposal by @JimCollinson: authority is decided by role on the committed roster, never by creator identity; Owner is retired in favour of flat Admin + Member with a last-admin invariant; ownership transfer dissolves; migration via legacy alias (stored roster entries are never rewritten). Generalises ADR-0014's single-writer rekey to a deterministic committer among active admins, resolving its permanently-absent-owner open question. Equal-revision fork-choice is recorded as deferred future work. Refs saorsa-labs#107. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…point (ADR-0016 R2) No commit may leave a live (non-withdrawn) group with zero active members of rank >= Admin (legacy Owner counts as Admin via role rank). Enforced by one shared helper on both delivery paths: commit authoring (seal_commit) and apply-side validation (finalize_applied_commit, after the state-hash equality check so the validated roster is provably the commit's roster_root roster). Withdrawal (group-ending) commits are exempt — the last admin's exit valve. REST handlers whose acts can zero the admin set (remove, ban, role demotion; classic + TreeKEM variants) gain a friendly 409 pre-check with the ADR-0016 Phase 1 spec's exact error string, returned before any mutation or TreeKEM side effect. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
JimCollinson
added a commit
that referenced
this pull request
Jun 14, 2026
- Add reviewed fast local gate commands for feature and experiment branches - Declare draft mirror PR #5 as the CI green of record
- Flatten owner-only actions to admin-or-higher and seed new groups with Admin - Restrict role assignment to admin/member with exact ADR-0016 errors - Add gate-runnable owner-retirement tests for policy, role changes, genesis, and legacy Owner
- Add mixed Owner/Admin/Member legacy roster replay test - Pin legacy Owner roster serialization and roster-root hashes
- Remove creator/owner special-case gates from add, remove, and ban paths - Add gate-runnable membership authority coverage for REST semantics and gossip apply
- Add clone-first last-admin self-leave precheck for non-creator DELETE /groups/:id - Preserve legacy Moderator/Guest apply convergence while testing authoring and invariant boundaries
This reverts commit c7e91b2.
- Remove invite issue-side creator gate in favor of admin role lookup - Derive invite-join creator provenance from base-state roster history - Keep join-result routing keyed to inviter and add gate-runnable invite tests
JimCollinson
added a commit
that referenced
this pull request
Jun 16, 2026
- Record Slice 4 invite authority implementation evidence - Document PR #5 rerun failures and blocked arbiter status
- Seed invite joiner state from carried base roster/hash for all planes - Cover non-creator admin invite MemberAdded validation on non-TreeKEM groups
JimCollinson
added a commit
that referenced
this pull request
Jun 16, 2026
- Record non-TreeKEM invite base-state remediation evidence - Classify PR #5 CI reruns under daemon-startup flake arbiter
- Leave base-state joiner stubs at the invite authority roster/hash frontier - Strengthen non-TreeKEM admin invite regression for post-commit hash coherence
- Replace creator-only GroupCardPublished receive check with active Admin role lookup - Preserve stable group id and signed card verification checks
- Move expected join-result inviter storage from a process global onto AppState - Preserve TTL pruning and clear-after-use without holding locks across await
- Add real three-daemon REST flow for non-creator Admin invite issuance and join consumption - Assert admin-authored MemberAdded convergence and historical creator provenance
- Reuse the real three-daemon non-creator-admin invite proof across presets - Add private_secure coverage for expected-inviter TreeKEM join-result routing
- Make DELETE /groups/:id pure self-leave for creators, admins, owners, and members - Add group disband CLI over state withdrawal and preserve state-withdraw alias - Cover self-leave, last-admin rejection, withdrawal, and CLI alias behavior
- Emit existing GroupDeleted metadata/direct event from disband withdrawal - Complete local and receiver cleanup for terminal withdrawal - Update Slice 5 docs and disband authority coverage
- Preserve terminal withdrawn metadata while wiping group key material - Reject authoring and stale-card reanimation after disband
- Reject post-withdraw metadata and TreeKEM queue/catch-up paths before mutation - Require roster-admin authority before withdrawn card imports wipe live keyed groups - Mark same-stable aliases withdrawn/keyless and clean alias-scoped listeners/caches
- Remove TreeKEM snapshots and journals on terminal local cleanup paths - Reject withdrawn snapshot production and discard withdrawn replay journals
- Check durable named-groups state before replaying live TreeKEM journals - Preserve withdrawn same-stable aliases and wipe stale journal material
- Assert sole-admin DELETE self-leave is rejected with ADR-0016 error - Exercise explicit withdraw/disband and retained withdrawn shell
- Assert sole-admin DELETE rejects with ADR-0016 self-leave error - Preserve rejoin coverage by adding a backup admin before successful leave
- Assert sole-admin self-leave returns the ADR-0016 409 contract before rejoin setup - Install a backup admin before leave so invite rejoin still exercises the join path
- Recheck withdrawn same-stable terminality after secret-share and TreeKEM crypto before installing key material - Update stale withdrawn-card integration test to require signed terminal commits for live keyed groups
- Snapshot live TreeKEM state before inviter-side MemberJoined add - Roll back the live tree when epoch validation or terminality-guarded persist rejects - Add lost-race and same-stable withdrawn alias regressions
- Recheck and repair withdrawn named-groups state before durable TreeKEM rename - Serialize group-card imports with per-group membership locks - Add disk-level lost-race regression for late terminal withdrawal
- Route non-TreeKEM ban writes through withdrawn-aware store helper - Return conflict before save/publish if the group became withdrawn
- Add generated action-sequence property over REST-style and gossip-apply paths - Assert rejected actions leave state unchanged and withdrawal remains reachable
- Exercise production REST pre-check helpers and seal_commit rejections for zero-admin attempts - Track sequence outcomes and add deterministic accepted-action coverage
- Align API, CLI, GUI, and docs with flat Admin authority - Add role-help coverage and last-admin precheck assertion
- Use disband wording in GUI withdrawal feedback - Mark join-request listing as admin-only
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…point (ADR-0016 R2)
No commit may leave a live (non-withdrawn) group with zero active members of rank >= Admin (legacy Owner counts as Admin via role rank). Enforced by one shared helper on both delivery paths: commit authoring (seal_commit) and apply-side validation (finalize_applied_commit, after the state-hash equality check so the validated roster is provably the commit's roster_root roster). Withdrawal (group-ending) commits are exempt — the last admin's exit valve.
REST handlers whose acts can zero the admin set (remove, ban, role demotion; classic + TreeKEM variants) gain a friendly 409 pre-check with the ADR-0016 Phase 1 spec's exact error string, returned before any mutation or TreeKEM side effect.
Summary
Validation
cargo fmt --all -- --checkcargo clippy --all-targets --all-features -- -D warningscargo nextest run --all-features --workspaceCoverage
main:docs/coverage-exclusions.mdTest Quality Checklist
just coverage-summary.coverage-skip:comment and a matching register entry.