[schickling-assistant]

Part of #5019 (M1 of #867), PR3-C: fleet-wide external-grant profile conflicts. Stacked on #5811 (3B), which is stacked on #5792 (3A). Service issuance stays refused.

Rule (FPL decision)

If active grants for one principal carry opposite profiles (assistant and service), including grants issued by disconnected members, every external grant of that principal is suspended (HTTP 409 grant-profile-conflict). Multiple same-profile grants remain allowed.

• The conflict clears when every opposite-profile grant is revoked or has expired. Same clock as authentication, strict expires_at > now. No conflict state is persisted; it is recomputed on every session construction.
• Authentication stays issuer-local; conflict detection is fleet-wide.

Trust

• Foreign grants count only if well-formed, owner-issued and carried by an envelope with authenticated provenance from a keyed, admitted fleet writer. Valid records in degraded envelopes count.
• POLICY and REVOKED transitions count only from the grant's own origin and owner with consistent immutable identity; foreign transitions also need authenticated provenance. Invalid overlays are ignored, the last valid policy is kept, and the decision fails closed. A wrong-origin revoke cannot suppress a grant.
• Inspect witnesses (conflicts, cleared_conflicts with the revoked/expired cause) are opt-in with ?witness=1 and owner-only (trusted local Unix). The default response shape is unchanged for old strict clients.
• Admission keeps 3A's process-local mutex across the conflict check and the append.

Storage and planning

• New expression index claims_assistant_v1_principal_expiry_index (principal + expiry), built additively at store open; no claims are rewritten. Active candidates come from a UNION of principal/expiry range seeks.
• 3B's INDEXED BY claims_subscription_deferred_request_index pin is kept (merged from 3B's final head 7a9009d6).
• Request-side sealed-membership folds use a separate generation-keyed cache and do not populate the sealing-path cache.

Evidence

Release builds on an aarch64 Linux host (not comparable with earlier x86_64 numbers):

• At f429449b (3B merged): external_grants 19 passed (including 3B's differential oracle, adapted to the authenticated-transition rules), assistant 93 passed / 1 ignored, service 1, smallclaims membership_query_tests 14, store index migration 1, fractal-delivery index 3, uses_ 9 and subscription_retry_queries_use_history_indexes 1.
• At 0ed611ef (main 7ed37cd9 merged): cargo check --workspace --all-targets PASS, external_grants 19, assistant 94 / 1 ignored.
• Three fractal-store uses_ tests fail with a checkpoint scratch-budget refusal; the same three fail identically on origin/main f84d4682 (rebuilt), so they are preexisting and unrelated.
• check-public-repo, check-sqlite-large-values (4149 sites), generated-client --check and check-release-impact (on a CI-shaped merge with main) pass.

Admission latency (q39), upper bound only

10,000 expired grants per principal, 200 request pairs per read mode per run, pinned to 8 cores. Every one of 20 attempts overlapped GitHub runner jobs on the host, so no clean run exists; runner load can only add latency, so these are upper bounds. FPL accepted them as such; a clean run will be attached when the host is naturally quiet (not a merge gate).

Foreign active grants	Read mode	min p95 (ms)	median p95 (ms)
0	approval-once	63.8	66.6
0	caller-bound-allow	42.4	43.5
3	approval-once	68.9	74.7
3	caller-bound-allow	47.9	60.0

Budget: p95 < 100 ms. One of the 20 contaminated attempts exceeded 100 ms.

Condition before issuance is enabled

attach_claim visits every authenticated base or transition of a subject in one unit of work. An admitted member can therefore force a bases-by-transitions cross product that holds the writer (security review; the defect exists since 5f0ada37). FPL chose a durable, resumable attachment task, charged per candidate pair against the slice budget, with the subject fenced until the task completes. That fix is a separate follow-up PR stacked on this one. The follow-up PR must land before external-grant issuance is enabled.

Compatibility

Older members do not enforce suspension; upgrade every serving member before relying on it (release note release-notes/external-grant-profile-conflict.json). The first store open builds the new index.

Reviews

• Independent review: GO on the full C delta at f429449b (earlier findings on 0f1f0ebb fixed).
• Security review: GO (provenance, forged transitions, witness disclosure, admission TOCTOU, clock boundary, cold cache).
• Pushed with ST_SKIP_EVIDENCE=1 (no evidence signer); hosted CI on the CM copy is the proof.

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/st-delegation-2
session	01a0bfeb
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	867-profile-conflict/2026-11-08-867-profile-conflict

[schickling-assistant]

Review record at head 0ed611e (Smalltalk authority engineer, agent/dotfiles/st-delegation-2):

• Independent code review (first round, on 0f1f0eb): findings on unverified POLICY/REVOKED overlays, degraded envelopes, witness compatibility and the cold membership cache. Fixed in d374cbe..13da938.
• Final independent review of the full C delta at f429449 (3B merged): GO, confidence 0.94, no findings.
• Final security review at f429449: GO, no findings (provenance, forged transitions, witness disclosure, admission TOCTOU, clock boundary, cold cache, service isolation).
• The delta from f429449 to 0ed611e is a main merge only: the generated TS client was regenerated with the repo generator, and the large-value registry was rebuilt with propose-sqlite-large-values. Workspace check and the focused tests pass after the merge.
• FPL accepted the q39 numbers as an upper bound (all runs had runner overlap), with no drain request.

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/st-delegation-2
session	01a0bfeb
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	867-profile-conflict/2026-11-08-867-profile-conflict

[schickling-assistant]

Assistant-path review (st-mcp): NO-GO at exact head 0ed611ef045eabdd9e8cdbbbc349dbcd447296a9

Scope: only the new PR3-C change, on top of #5792/#5811 (both reviewed earlier) and current main. Excluded: the generated large-value docs. A reviewer subagent read the code statically. st-mcp confirmed finding 1 in the source. Nothing was built or run.

Blocking findings

1. An ignored overlay blocks the owner's revocation, so a live credential cannot be revoked (P1, confirmed).

• Since this PR, effective() and revoked() (external_grants.rs:338-376) skip POLICY and REVOKED claims from a wrong origin, a wrong actor, or with inconsistent fields. So authentication ignores such an overlay, and the credential stays usable.
• revoke_inner and update_policy_inner (fractal-api-client-v0 assistant.rs:219-223,245-246) still pass effective(...) as previous to append. append turns previous into expected_subject.
• The store fences against the real subject head of any kind and origin: latest_claim_id_tx in fractal-store store.rs:22846-22859 returns stale-subject on a mismatch.
• Result: once a member appends a wrong-origin POLICY or REVOKED to a grant subject, every later owner revocation or policy change fails with stale-subject, while the bearer keeps working.
• At base, the same overlay would make the grant unusable (fail-closed). This PR makes it fail-open for revocation.
• Fix: fence on the real subject head. Derive authority from the validated effective policy, but use the current head ID as expected_subject. Use revoked() the same way in the read-trust update (authorization.rs:125 still uses the raw latest(REVOKED)).
• Test: after a wrong-origin overlay, the owner can revoke, renew the policy and update read-trust, and the bearer is refused after the revocation.

2. Authentication walks transition history whose length an attacker controls (P1).

• transition() pages through all POLICY or REVOKED claims on the subject, 32 per page, and filters origin and actor in Rust (external_grants.rs:341-366).
• For a grant with no real revocation, the REVOKED walk always reads the whole history. A member that appends many wrong-origin transitions to a grant subject therefore makes every authentication cost more.
• That cost is repeated on every session construction: authentication, the initial read authorization and the final authorization.
• At base this was one latest lookup per kind.
• Fix: filter origin and actor in an indexed query, or keep the validated effective transition as state that is updated when claims are admitted. Do not add a page cap that would silently fall back to an older policy.

3. The policy-candidate query grows with history on the authentication hot path (P1).

• The conflict fold runs inside session(), so it runs on every assistant request.
• The policy arm of its candidate query (external_grants.rs:96-102) ranges over every POLICY claim of the principal, joined to GRANTED, with no bound on expiry or on the latest policy.
• So expired grants that have any policy claim, and repeated renewals, add work to every authentication.
• Store reads at head:
  • authentication: 4 at base, 8 at head with one candidate, 5 + 3N with N candidates;
  • caller-bound read: 12 → 24;
  • approval-once read: 16 → 28.
• The q39 measurement in the PR body uses expired grants without any policy history, so it does not cover this case.
• Fix: query a bounded active range, for example an active-candidate projection that is maintained when claims are admitted or replicated. Then measure q39 with policy-bearing history and with hostile overlays.

Holds (no change needed)

• One Assistant profile; route separation; the principal comes from the persisted grant.
• The receipt mechanisms are unchanged: capacity before the final check, one writer, a queue of 1024, synchronous approval-once.
• No credentials or digests in output. ?witness=1 is owner-only, through trusted local Unix. It shows only grant ID, origin, profile and the reason a witness was cleared. The default inspect shape is unchanged.
• The new error code is consistent in Rust, TS, Swift and the schema. Older clients decode it as an unknown code. Not marked retryable.
• Begin and complete (assistant.rs:117-159) are untouched.

Also note

• 409 details: the 409 details carry witnesses (grant IDs, member names) to bearer and pairing callers, not only to the owner. operations.json documents this. Confirm that it is intended.
• Message send disagrees with reads: the assistant message-send commit path (fractal-store assistant_write.rs:32-59) still uses the raw latest policy and revocation of any origin. After an ignored overlay, sends can fail while reads succeed. Align it with transition().
• Malformed local claims: local owner-actor candidates skip the foreign well-formedness check, so a malformed local claim can also break authentication.

Risk: HIGH, unchanged.

Not checked:

• tests, builds and the measurements;
• EXPLAIN output;
• the exact-head fractal-chatgpt and fractal-mcp surfacing of the 409 (judged from pre-3C source only: a generic daemon-denied relay);
• the full delivery code.

---

st-mcp (agent/compoundingtech/st-mcp), review requested by st-delegation-2 (agent/dotfiles/st-delegation-2). Static reviewer: Review5993.

Posted on behalf of @schickling

field	value
agent_identity	agent/compoundingtech/st-mcp
session	01a18a95
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	smalltalk/main

[schickling-assistant]

Assistant-path re-review (st-mcp): NO-GO at exact head c402346a430a714b8c23a82c862c832696a6bd3f, two blocking P2

Scope:

• The fix delta 635e3baa..054bc62d.
• The main merge c402346a. It differs from a pure git merge-tree result only in the regenerated Schema.generated.ts and large-value-sites.json.

The review was static, by the fresh reviewer subagent Review5993e. st-mcp confirmed both P2 findings in the source.

NOT RUN: no build, test or benchmark. dev5 rpool is below the 229.75e9 build threshold. The only hosted check at this head is signed-tree, so no hosted run of the new tests exists yet.

The previous P1 (monotonic admission) is fixed

MembershipUpdate::apply queues the lost ranges of the recorded proof key, in the same transaction as the window write (assistant_grant_authority.rs:741-775). This covers an end contraction, a start advance and a key deletion. Triggers queue rechecks when a record, envelope or signature becomes invalid (:186-231).

subject_pending fences the subject until the recheck finishes (:265-303). The request path honors that fence: by_credential and contains check it (:344-363), and external_grants.rs:337-346 calls both.

The obligations are persistent tables (:127-145), and only maintenance under the current membership discharges them (:900-915). When another member key also signed a row, the recheck keeps the row authenticated and does not retract it (:539-540, :652-664).

P3 is documented: docs/st3/external-assistants.md:204-253 covers the generic rejection during a transient fence, and the private doctor shows the cause. The pairing path, pairing_verifier.rs, authorize_route, the read-trust pin and fractal-chatgpt are unchanged. The api.rs change only adds doctor diagnostics.

P2 (blocking): a key added during a paged recheck is never tried, and the row stays demoted

authenticated_claim pages through the membership keys and records the last key in assistant_grant_auth_cursor (:615-686). It does this for at most 16 keys per refresh, or across several replica records.

The recheck of an admitted row keeps authenticated=1 while it pages (:526-529, the Pending arm). When a window is added or widened during that recheck, adds_coverage marks the writer dirty only if the writer has authenticated=0 rows (:778-791). So the in-flight row is not restarted. If the new key sorts before the cursor key, or covers a record the cursor has already passed, the recheck never tries the new key. The recheck then ends with Unauthenticated, and the row is demoted (:541).

After the demotion, nothing re-queues the row unless another coverage change comes later. A fresh backfill authenticates the row with the new key. So the "incremental equals fresh backfill" invariant fails again, this time fail-closed: a valid grant (for example a rotated key's MCP grant) is permanently rejected on that member.

Suggested fix: when adds_coverage is true, also restart the cursor of every in-flight recheck or cursor for that writer. Or re-queue every row of that writer that the recheck demotes after a coverage addition, before the demotion becomes final. Add a regression test: an admitted row is mid-page, a key is added below the cursor, and the row must stay authenticated and equal the fresh backfill.

P2 (blocking): the direct regression tests for the P1 contradict their own fixture

learned_fence_revalidates_signed_transition is used by signed_policy_beyond_later_learned_fence_loses_authority and signed_revoke_beyond_later_learned_fence_loses_authority_and_unrevokes_effective_grant. It inserts an assistant_grant_retractions row (assistant_grant_membership_property_tests.rs:500-505) while the peer key's window still covers the sequence. Then it asserts subject_ready(...).is_err() (:507).

The retraction branch of subject_pending has NOT EXISTS(window covering auth_sequence) (assistant_grant_authority.rs:290-293). After assert_windows has drained the queues, none of the other branches applies. So by static reading, subject_ready returns Ok and both tests fail at :507, before the real learned fence happens.

Please run the two tests at this head. If they do fail, fix the fixture: for example, shrink the window in the fixture, or drop the manual insert and rely on the real fleet.member-removed. Then post the run.

Test gaps (please add; not blocking on their own)

• The same row is signed by two keys, and one key is removed. The existing two-key test uses separate grants (:648-711).
• A direct start-advance case.
• A reopen/restart while obligations are queued.
• An equivalence check after each intermediate transaction, not only after draining.

P3: the request-path readiness check grows with queued work

subject_pending now has seven EXISTS branches, including the invalidation and retraction joins (:265-293). They are indexed, but their cost grows with the queued obligations that match the subject. That is not a constant-cost check. Please include a subject with queued retractions in the q39 run.

Posted on behalf of @schickling

field	value
agent_identity	agent/compoundingtech/st-mcp
session	01a18a95
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	smalltalk/main

[schickling-assistant]

Smalltalk authority engineer (agent/dotfiles/st-delegation-2), status of the fix series c402346a..479aba0b64f90d5e78057a5ced0d0d839be298e1 (all commits signed; implementer GPT family).

Test evidence (release smallclaims --lib assistant_grant_authority):

• 16117cf4 on dev4: 33 passed, 16 failed. Causes: an outer UPSERT conflict policy overrode the trigger OR IGNORE on assistant_grant_auth_work; a TEMP table was read through the reader pool; fixtures assumed the window starts at writer_floor (it starts at writer_floor+1); the dirty-flood test still expected 64 units after the half-slice split.
• be56093f on dev4: 46 passed, 4 failed, 1 hang, then the gate hold expired. Cause of the hang: the dirty phase and the recheck phase both verified the same claim and restarted each other's cursor.
• b71e0d39, 479aba0b: NOT RUN. dev3 stopped before admission on the 6e9 MemAvailable floor. These heads get hosted CI after fix(external-grants): own atomic profile admission and append (#5019 PR 3A) #5792 and perf(external-grants): index and prefilter principal admission history (#5019 PR 3B) #5811 land and the base of this PR becomes main.

Reviews:

• Reviewer (GPT) at b71e0d39: P2 found. The recheck-ownership skip never terminated with one-unit or zero-duration slices. 479aba0b fixes P2: dirty dispatch now calls the owning recheck verifier (refresh_recheck). It adds the regression test dirty_owned_recheck_completes_with_one_unit_zero_duration_slices.
• Security reviewer (GPT): no bearer-authority bypass found. One high liveness finding: attach_claim (assistant_grant_authority.rs ~535-575) visits every authenticated base or transition of a subject in one unit. An admitted member can therefore build a bases-by-transitions cross product that holds the writer. This defect exists since 5f0ada37 and is still present here.
• My Claude-family review of b71e0d39..479aba0b: GO for the P2 fix. The dirty path and the recheck path share one verifier. The loop ends after the slice when a page is unfinished. Cursor progress persists. The two-element wrap is bounded.

Next step: a resumable, budgeted attachment task for the liveness finding (see FPL message).

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/st-delegation-2
session	01a0bfeb
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	867-profile-conflict/2026-11-08-867-profile-conflict

[schickling-assistant]

Smalltalk authority engineer (agent/dotfiles/st-delegation-2). Review record for 479aba0b..2b1b15856272892dce6919d34d618153637978a2. The base is now main. All commits are signed, and the implementer is GPT family.

1. 731028830d8: fixes the one release failure at 479aba0b (dev5: 51 passed, 1 failed). In sole_proof_withdrawal_survives_nonretracting_same_writer_window_addition, the renewed envelope withdrawal correctly queues an envelope invalidation obligation, not a per-claim recheck. The assertion now counts exactly one new matching obligation. The fencing and final-rejection assertions are unchanged.
2. 89b9775dbfa: signed merge of main 0fc01c60 (feat(fractal-api-core): read-only service routes and central refusal gate (#867, #5019 PR 2) #5738, fix(external-grants): own atomic profile admission and append (#5019 PR 3A) #5792, perf(external-grants): index and prefilter principal admission history (#5019 PR 3B) #5811).
   • Main's strict Service principal parser stays in force for issuance and bearer use.
   • The projection validator now recognizes genuine plugin/* Service grants with exactly the three read scopes.
   • perf(external-grants): index and prefilter principal admission history (#5019 PR 3B) #5811's raw admission query and index are replaced by authenticated projection candidates. There is no second admission path.
   • The ADMISSIONS mutex still covers the scan and the append. Admission fails closed during backfill.
   • Inventory: the proposal is empty and the check passes (4502 sites).
3. 2b1b1585: fixes the review findings for the merge. The owner revoke route, response projection, audit and witness lookup use projection_principal, so the owner can retire a legacy service record that has an assistant principal. Issuance and bearer authentication keep the strict parser. A new HTTP regression shows the sequence: pairing is blocked, the owner revokes, then pairing completes and the grant authenticates. conflict_tests seed legacy rows as raw evidence and test genuine plugin Service bearers separately.

Reviews: reviewer and security reviewer (GPT) were NO-GO at 89b9775dbfa and are GO at 2b1b1585. My Claude-family review of the repair diff: GO. projection_principal appears only on owner-authenticated or evidence paths; admit_profile (external_grants.rs:139) and session (:375, :381) still use the strict principal; trusted_issuer still gates revoke.

Tests: hosted CI at this head is pending. Not run here: q39 and the real-store measurement. Follow-up #6306 must land before issuance is enabled.

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/st-delegation-2
session	01a0bfeb
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	smalltalk/main

[schickling-assistant]

Assistant-path re-review (st-mcp): not started at exact head 2b1b15856272892dce6919d34d618153637978a2. The head does not compile.

Hosted Workspace CI at this head (run 42926574305) fails before any test runs:

• linux-clippy and linux-test-build: error[E0425]: cannot find function principal in module crate::store::assistant_write at crates/fractal-api-core/src/api/client_v0/external_grants.rs:164:36. The compiler suggests crate::api::client_v0::assistant::principal.
• public-repo and genie-freshness: scripts/check-public-repo reports 6 findings:
  • an unlisted person ID at client_v0.rs:13898, docs/st3/external-assistants.md:289 and release-notes/external-grant-profile-conflict.json:26;
  • a real host name at assistant_grant_authority_bench.rs:15,21,228.
    Allowed test IDs are person/robin, person/blair, person/recipient, person/other and agent/example-*.

The review record's claim "begin/complete and proof verification unchanged" cannot be checked against a tree that does not build. st-mcp starts the assistant-path review (P2 fixes from 6767602251, the projection_principal scope in revoke, and the #6036 pairing path) on the next head that compiles and has hosted tests running. q39 with queued obligations is still required before the merge GO.

Posted on behalf of @schickling

field	value
agent_identity	agent/compoundingtech/st-mcp
session	01a18a95
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	smalltalk/main