Derive runtime authority decisions from an executable action-class matrix

[samovers]

Parent Tracking Epic: #175

Dependencies already merged: #172, #173, #174

Existing draft PR: #359. Design revision 9 remains at 7de8a2c4cf6eb1f293560af67e69565122c42f25. The focused review and the second re-review report zero Blockers at this exact head: B2 closed and F3 addressed, with no additional corrective patch requested. Non-blocking F4 is recorded under the existing G2/G3-READ work below. The reviewed RFC bytes and complete two-action scope are unchanged. These reviews do not close G2/G3, grant G4 approval, authorize runtime work or close this Delivery issue.

F4 — non-blocking dependency question under existing G2/G3-READ

Revision 9's focused review records F4 as a Follow-up, not a Blocker. Canonical PR #11 section 12.3 permits an action-level policy to derive required evidence from the exact effectIntentDigest. G2 must supply the actual rule-selected policy before G3 decides whether an additional attempt-carried reference input is needed.

Closure evidence belongs to the existing work: exact admitted policy ref/digest, the rule for identifying required evidence, eligible evidence kinds and source bindings, and the actual same-snapshot/order mapping. If the policy derives the required references, do not commission an extra reference carrier solely to populate the provisional frame. If it needs owner-supplied references, identify and verify that real input producer. Either way, required evidence must exist through its governed sources and be resolved and eligibility-checked by the provider; deriving references does not manufacture proof or eliminate the underlying evidence producer.

This records a conditional interface question, not a new canonical rule, producer, Delivery issue or approval gate. F4 remains open with G2/G3-READ. It does not reopen B2/F3, narrow the two complete selected rules or waive the source-history checkpoint. The reviewed RFC bytes and head are unchanged.

Status: first-release scope aligned 2026-09-11 with Renewed canonical Phase A approval at exact PR #11 head 4494924998183fe3fa7bc1b63b76a85893335044. The September 7 scope amendment and previous body remain history. This is the current Delivery definition, not OFARM2 implementation approval. Canonical readiness, concrete production interfaces and the later exact OFARM2 decision approval remain required. The issue stays open and PR #359 stays draft.

Outcome

Deliver one production authorization provider that derives restrictions from the exact admitted canonical action-rule bundle and evaluates an authenticated principal and validated effect intent against complete tenant-bound facts. A trusted runtime consumer receives a current decision, complete prepared evidence and explicit guard obligations. Callers cannot select a weaker stage, actor posture, target proof, inheritance rule or policy.

The provider prepares evidence; it does not save the decision, consume authority, perform the protected action or claim a durable outcome. Those operations belong to the transaction consumer.

Primary trust boundary

Production authorization evaluation: the boundary that turns trusted identity, the canonical action rule, validated intent and current governed evidence into a truthful allow or refuse evaluation and complete prepared decision evidence.

Authority map

• Canonical OFARM owns action semantics, rules, source/evidence contracts, outcomes, finalization requirements and hash projections. Code executes verified canonical bytes; it does not author a second policy matrix.
• Existing authentication, principal, tenant-binding and selection owners supply their admitted trusted inputs; the provider cannot mint missing identity, representation, CP3 or policy-selection authority.
• The provider owns rule interpretation, complete proof evaluation, projections/comparisons required by the selected rules, deterministic path selection, prepared request/result/full trace, and authorization read/guard obligations. Human-approval preparation, prospective-human candidates and challenge/final equality execution remain deferred under [M1/Security] Enforce the Authority Action Matrix through a governed control plane #175, not successful first-release methods.
• [M1/Correctness] Make command idempotency tenant-scoped, content-bound, and result-complete #178 and applicable transaction consumers own complete commit guards, atomic evidence/effect/result persistence, successful single use, durable refusal, uncertainty reconciliation and original-result recovery. Prepared evidence is not a durable trace.
• Domain validators own protected-effect validity and mappings. The provider binds their contracts but does not apply an effect.
• Callers supply an action and intent, not authoritative restrictions or mirrored proof. [M1/Security] Enforce the Authority Action Matrix through a governed control plane #175 follow-on issues retain grant/delegation mutation and bootstrap; [M1/Security] Enforce complete sharing and output-authorization semantics #177 retains output/disclosure work.

Acceptance criteria

• One immutable, digest-verified canonical rule representation covers every admitted action class exactly once. A compiled view must be demonstrably equivalent to the canonical bytes, not an independently authored policy.
• Rule-selected ingress validation and extraction derive the stage, actor/finalization posture, authority target, typed inputs, effect subject, scope, inheritance and delegability. Public or internal callers cannot choose authoritative restrictions or substitute a second authorization view.
• Unknown or excluded actions, missing/duplicate/extra or digest-invalid rules, invalid bindings and unsupported evidence fail closed under the canonical ingress/evaluation rules. Exact admitted-set and resolved-rule membership must match; no runtime subset repair, caller-selected package or legacy/full-policy fallback is permitted. Ingress rejection is not fabricated authorization evidence.
• Principal kind, representation, CP3 posture and human finalization are independently proven. Adding or omitting AI-assistance metadata cannot change authority; sponsor status or an organization alone cannot manufacture natural-person eligibility.
• Every target, source, scope and applicable sharing/revocation fact is proven from complete, current tenant-bound evidence. Missing, ambiguous, foreign, stale or incomplete facts cannot authorize an action. Inheritance follows the exact rule; no local lineage expansion is introduced.
• The provider returns complete schema-checked, digest-verifiable prepared request/result/full trace and snapshot/basis evidence, bound to the current attempt, exclusive cutoffs and full read/guard footprint. It makes no persistence, effect, consumption, durable refusal or receipt claim.
• Deliver complete evaluation coverage for every rule in the exact admitted first-release canonical package: ASSERT_OPERATION_CLAIM and RECEIVE_READ_DATA. Derive the set from verified canonical bytes, not an independently maintained local matrix. Preserve all selected-rule resource alternatives and authority paths, including applicable representation, CP3, delegation, sharing, revocation, currentness, snapshot, evidence and read/disclosure obligations. One positive claim example, a claim-only read evaluator or blanket non-ALLOW is not completion. The other eighteen action evaluations and their applicable human-finalization capabilities remain explicit later work under [M1/Security] Enforce the Authority Action Matrix through a governed control plane #175.
• The provider is independently usable through the real production composition and typed tenant-bound UnitOfWork entry. Its concrete trusted input/read/guard interface and exact reviewed facade/architecture and size-budget outcome must be settled before implementation approval.
• Production-path positive and hostile tests cover the complete selected scope, real tenant-bound reads and every applicable AUTH invariant in Derive production authority from canonical action rules #359's newly reviewed first-release design. AUTH-001 requires exact selected-set coverage; AUTH-002–014 remain; AUTH-015–017 and AUTH-019 human-finalization execution are deferred, not passed; AUTH-018 retains attempt/mode isolation and truthful exact-write retry behavior while human-act-specific cases are deferred. Both selected rules use NOT_REQUIRED: no synthetic approval evidence or successful preparation/finalization stub. Committed exact write retries do not re-evaluate or repeat the original protected write; current read/disclosure authority still applies to protected saved information. Test plans or caller-authored proof dictionaries are not executed evidence.
• Quarantined legacy/SI code and behavior remain unchanged. Legacy migration or SI-equivalence work is not this issue's completion criterion; no legacy fallback becomes a production authority path. Governed public commands remain closed.
• The handoff explicitly assigns the complete atomic persistence/consumption/result set and commit-before-durable-response protocol to [M1/Correctness] Make command idempotency tenant-scoped, content-bound, and result-complete #178 or the applicable consumer. Provider completion must be independently testable without claiming that the later consumer already exists. Consumer integration still needs its own proof before a protected action is enabled.

Primary risk and containment

The risk is ALLOW based on caller-selected restrictions, unproved scope, stale approval or incomplete current evidence. Containment is one exact canonical rule binding, complete tenant-bound proof, deterministic canonical evaluation, complete selected-rule evaluation, and an attempt-bound handoff that grants no independent effect or commit authority.

Non-goals

• No creation, narrowing, revocation, rotation, or recovery of grants or delegations.
• No production tenant/root-authority bootstrap or break-glass ceremony.
• No sharing-grant mutation, output redaction plan, or delivery authorization from [M1/Security] Enforce complete sharing and output-authorization semantics #177.
• No new action class, broader authority, OFARM law/contract change, schema migration, profile activation, capability claim, deployment, or production-readiness claim.
• No legacy/SI migration, durable authorization ledger, transaction/lock/isolation owner, receipt or consumption writer, domain writer, identity/CP3 issuance change, selection-authority change, retention/key custody or public command activation.

Delivery rule

This issue owns one independently reviewable production-provider capability in one primary trust boundary and at most one merged implementation PR. Keep existing draft PR #359. The Phase A design, implementation, typed read/facade integration, tests, documentation and necessary mechanical evidence for that boundary travel together. No extra process-only issue or PR is required for this scope amendment.

Stop and split if implementation requires grant mutation, bootstrap custody, sharing/output authorization, a new action class, or another durable authority owner.

Remaining implementation gates

• Resolve canonical prerequisite materialization, binding review, accepted law, hostile conformance, current/default promotion and byte-identical extraction under OFARM #21 and approved PR M2 G3: generic reference-resolution & verification-trace mechanism #11 section 24. Semantic candidate approval alone is insufficient.
• Settle G3 with both [M1/Correctness] Make command idempotency tenant-scoped, content-bound, and result-complete #178's write coordinator and the separately owned governed-read consumer. Their real attempt/deadline/read/guard producers must precede the provider's use of them; a write attempt cannot stand in for a buffered read. Resolve ordering without a blanket dependency cycle, invented proof or type-only companion. The exact facade, architecture and size-budget outcome remain a review gate, not mere wiring.
• Keep PR M2 G3: generic reference-resolution & verification-trace mechanism #11 section 24.1's source-history completeness and historical-admission question open. CP2A-DEP01 and its PR D1: SI active profile loader design memo #32/PR D1: SI active profile runtime loader #33/PR [codex] Add SI evidence policy display design memo #34 dependencies are not satisfied by inactive writing, empty lookup or permanent UNAVAILABLE. Stop for separately reviewed scope if closure requires another action; no qualifying writer is added here.
• Include this amended scope in a complete reviewed OFARM2 decision card for PR Derive production authority from canonical action rules #359 and obtain the exact later task-user approval before runtime implementation. The scope-editing instruction is not that approval.

Previous issue body — superseded scope history, captured 2026-09-11

This is the complete previous body. Its scope, source pins and next-step wording are historical; the amended current text above controls. Prior decisions and approvals remain attached to their original revisions.

Parent Tracking Epic: #175

Dependencies already merged: #172, #173, #174

Existing draft PR: #359, design revision 4 at 263cd32722ff2b482910bd7bb880f91aa8391838.

Status: issue-scope alignment recorded in the amendment record. This is the current work definition, not implementation approval. Canonical readiness, concrete production interfaces and the later exact OFARM2 decision approval remain required. The issue stays open and PR #359 stays draft.

Outcome

Deliver one production authorization provider that derives restrictions from the exact admitted canonical action-rule bundle and evaluates an authenticated principal and validated effect intent against complete tenant-bound facts. A trusted runtime consumer receives a current decision, complete prepared evidence and explicit guard obligations. Callers cannot select a weaker stage, actor posture, target proof, inheritance rule or policy.

The provider prepares evidence; it does not save the decision, consume authority, perform the protected action or claim a durable outcome. Those operations belong to the transaction consumer.

Primary trust boundary

Production authorization evaluation: the boundary that turns trusted identity, the canonical action rule, validated intent and current governed evidence into a truthful allow or refuse evaluation and complete prepared decision evidence.

Authority map

• Canonical OFARM owns action semantics, rules, source/evidence contracts, outcomes, finalization requirements and hash projections. Code executes verified canonical bytes; it does not author a second policy matrix.
• Existing authentication, principal, tenant-binding and selection owners supply their admitted trusted inputs; the provider cannot mint missing identity, representation, CP3 or policy-selection authority.
• The provider owns rule interpretation, complete proof evaluation, the rule-selected relevant-state projection/comparison, deterministic path selection, prepared request/result/full trace, and authorization read/guard obligations.
• [M1/Correctness] Make command idempotency tenant-scoped, content-bound, and result-complete #178 and applicable transaction consumers own complete commit guards, atomic evidence/effect/result persistence, successful single use, durable refusal, uncertainty reconciliation and original-result recovery. Prepared evidence is not a durable trace.
• Domain validators own protected-effect validity and mappings. The provider binds their contracts but does not apply an effect.
• Callers supply an action and intent, not authoritative restrictions or mirrored proof. [M1/Security] Enforce the Authority Action Matrix through a governed control plane #175 follow-on issues retain grant/delegation mutation and bootstrap; [M1/Security] Enforce complete sharing and output-authorization semantics #177 retains output/disclosure work.

Acceptance criteria

• One immutable, digest-verified canonical rule representation covers every admitted action class exactly once. A compiled view must be demonstrably equivalent to the canonical bytes, not an independently authored policy.
• Rule-selected ingress validation and extraction derive the stage, actor/finalization posture, authority target, typed inputs, effect subject, scope, inheritance and delegability. Public or internal callers cannot choose authoritative restrictions or substitute a second authorization view.
• Unknown actions, missing/duplicate or digest-invalid rules, invalid bindings and unsupported evidence fail closed under the canonical ingress/evaluation rules. Ingress rejection is not fabricated authorization evidence.
• Principal kind, representation, CP3 posture and human finalization are independently proven. Adding or omitting AI-assistance metadata cannot change authority; sponsor status or an organization alone cannot manufacture natural-person eligibility.
• Every target, source, scope and applicable sharing/revocation fact is proven from complete, current tenant-bound evidence. Missing, ambiguous, foreign, stale or incomplete facts cannot authorize an action. Inheritance follows the exact rule; no local lineage expansion is introduced.
• The provider returns complete schema-checked, digest-verifiable prepared request/result/full trace and snapshot/basis evidence, bound to the current attempt, exclusive cutoffs and full read/guard footprint. It makes no persistence, effect, consumption, durable refusal or receipt claim.
• Full admitted action-rule and evaluation coverage is required, including applicable sharing and rule-selected human-finalization branches. Fresh approval includes provider-owned relevant-state comparison, complete prospective-evidence construction inputs and exact candidate/final basis/window checks. A single operation-claim case or blanket non-ALLOW is not completion.
• The provider is independently usable through the real production composition and typed tenant-bound UnitOfWork entry. Its concrete trusted input/read/guard interface and exact reviewed facade/architecture and size-budget outcome must be settled before implementation approval.
• Production-path positive and hostile tests cover AUTH-001–019 in the reviewed RFC, including real tenant-bound reads, complete valid prospective approval, relevant-change refusal, unrelated-history success and admitted exact-retry cases. Test plans or caller-authored proof dictionaries are not executed evidence.
• Quarantined legacy/SI code and behavior remain unchanged. Legacy migration or SI-equivalence work is not this issue's completion criterion; no legacy fallback becomes a production authority path. Governed public commands remain closed.
• The handoff explicitly assigns the complete atomic persistence/consumption/result set and commit-before-durable-response protocol to [M1/Correctness] Make command idempotency tenant-scoped, content-bound, and result-complete #178 or the applicable consumer. Provider completion must be independently testable without claiming that the later consumer already exists. Consumer integration still needs its own proof before a protected action is enabled.

Primary risk and containment

The risk is ALLOW based on caller-selected restrictions, unproved scope, stale approval or incomplete current evidence. Containment is one exact canonical rule binding, complete tenant-bound proof, deterministic canonical evaluation, provider-owned challenge-state comparison where required, and an attempt-bound handoff that grants no independent effect or commit authority.

Non-goals

• No creation, narrowing, revocation, rotation, or recovery of grants or delegations.
• No production tenant/root-authority bootstrap or break-glass ceremony.
• No sharing-grant mutation, output redaction plan, or delivery authorization from [M1/Security] Enforce complete sharing and output-authorization semantics #177.
• No new action class, broader authority, OFARM law/contract change, schema migration, profile activation, capability claim, deployment, or production-readiness claim.
• No legacy/SI migration, durable authorization ledger, transaction/lock/isolation owner, receipt or consumption writer, domain writer, identity/CP3 issuance change, selection-authority change, retention/key custody or public command activation.

Delivery rule

This issue owns one independently reviewable production-provider capability in one primary trust boundary and at most one merged implementation PR. Keep existing draft PR #359. The Phase A design, implementation, typed read/facade integration, tests, documentation and necessary mechanical evidence for that boundary travel together. No extra process-only issue or PR is required for this scope amendment.

Stop and split if implementation requires grant mutation, bootstrap custody, sharing/output authorization, a new action class, or another durable authority owner.

Remaining implementation gates

• Resolve canonical prerequisite materialization, binding review, accepted law, hostile conformance, current/default promotion and byte-identical extraction under OFARM #21 and approved PR M2 G3: generic reference-resolution & verification-trace mechanism #11 section 24. Semantic candidate approval alone is insufficient.
• Settle the concrete trusted production interfaces and independently useful provider-completion proof described by RFC gate G3. Do not label the facade extension or a new authority source as mere wiring.
• Include this amended scope in a complete reviewed OFARM2 decision card for PR Derive production authority from canonical action rules #359 and obtain the exact later task-user approval before runtime implementation. The scope-editing instruction is not that approval.

What is next: resolve the existing canonical and concrete-interface prerequisites, then present the complete named-PR decision card. Do not implement, request an expensive baseline or merge from this issue-scope update.

What is next: review the first-release revision in existing #359, close G2/G3 and obtain the fresh named-PR OFARM2 decision approval before implementation. No expensive baseline or merge is authorized by this scope update.

[samovers]

Proposed #353 scope alignment for the production provider — review required

The existing draft PR #359 now contains Phase A revision 2 at 1473a4c16d8e716b03a3c36c2e36114e6e9fb255, based on current main fcac9ba505226e7e2fa2ede0aedb7585721b1841.

Primary trust boundary: production authorization evaluation.

The revision returns this issue to the implementation sequence that motivated canonical OFARM #25 / PR #26: #353 authorization, then #178 durable command coordination/idempotency, then a separately selected #176 temporal Delivery.

It explicitly proposes these acceptance-criteria changes for steward review:

1. Execute exact canonical content-addressed action rules instead of authoring a second code-owned policy matrix.
2. Deliver the real production provider and typed tenant-bound entry point. The old evaluator/SI callers are quarantined legacy, not production; leave them unchanged in this PR.
3. Deliver complete prepared authorization evidence and explicit guard obligations, while the transaction consumer owns the durable decision/effect/consumption/receipt set and commit-before-response protocol.
4. Preserve full admitted action-rule and evaluation coverage. ASSERT_OPERATION_CLAIM is the first concrete consumer, not a silent reduction of the whole issue.

These amendments are proposed, not approved. This comment does not replace the issue body or mark its original acceptance criteria satisfied. In particular, prepared evidence is not a durable trace. #353 cannot close under the original durability criterion while that responsibility is waiting on #178. If the steward retains provider-owned durability, the boundary must be re-planned rather than expanded implicitly.

The design also records the actual READ COMMITTED transaction, the missing trusted snapshot/deadline/guard interface, all nine prior review findings, the exact canonical source heads, and the incompatible old command binding that currently forbids AssertionRecord.

Canonical PR #26's semantic approval does not finish the executable schema/manifest, accepted-law, conformance, current/default and extraction gates controlled by OFARM #21 and PR #11 section 24.

Only the existing RFC changed against current main. Package, architecture, temporal-candidate, decision-log and whitespace checks pass. Runtime implementation, expensive baseline admission, semantic approval, merge and deployment remain unauthorized. No new issue or competing PR was created.

What is next: review the proposed criterion amendments together with PR #359's revised Phase A, resolve its canonical and concrete-interface gates, then obtain a fresh named-PR decision approval before implementation.

[samovers]

Issue-scope amendment record — production authorization provider

The task user directed applying the four-point scope-only amendment after it was presented in this task: canonical rules rather than a second policy table; the real production provider with legacy/SI unchanged; complete prepared evidence with durable saving left to the transaction owner; and full action-rule coverage.

This records an instruction to amend the issue definition, not the exact OFARM2 semantic-decision approval required before implementation. No such decision approval, baseline admission, merge, canonical change, promotion or deployment is supplied by this comment or by the user's “go”.

Primary trust boundary: production authorization evaluation. The amendment is the scope alignment already proposed in the original scope comment and RFC section 2 at the reviewed PR #359 head.

The focused revision-4 review closed B1 at the design level and requested no further correction at that head. It did not close canonical or concrete-interface prerequisites.

The amended acceptance criteria replace the independently authored code-owned matrix, legacy caller migration/SI-equivalence work, and provider-owned durable-trace requirement. They require the complete production provider and independently usable tests; they do not make an RFC, prepared-evidence type, single working action or blanket refusal sufficient to close #353. Applicable transaction owners retain atomic persistence, successful single use, durable refusal and original-result recovery.

The issue remains open and PR #359 remains draft at 263cd32722ff2b482910bd7bb880f91aa8391838. No repository file or reviewed technical design is changed by this issue-scope/status update. The later complete decision card must include the amended scope, and G2/G3 remain prerequisites.

Original issue body before this scope amendment

Parent Tracking Epic: #175

Dependencies already merged: #172, #173, #174

Outcome

Make runtime authority decisions derive their stage, actor posture, target rules, inheritance, and delegability from one executable action-class matrix. A caller names the governed action and target; it cannot weaken the decision by supplying a stage or posture.

Primary trust boundary

Runtime authority evaluation: the boundary that turns an authenticated principal, governed action class, target, live grants, and durable scope evidence into an allow or refuse decision.

Authority map

• The accepted OFARM authority model and existing action vocabulary own the allowed semantics.
• The executable matrix owns the mapping from each accepted action class to its required stage, target kinds, human or software-agent posture, inheritance, and delegability.
• The evaluator owns fail-closed application of that mapping and the decision trace.
• Callers may supply facts and request an action; they do not own stage, posture, inheritance, or delegability.
• [M1/Security] Enforce the Authority Action Matrix through a governed control plane #175 follow-on Delivery issues own grant/delegation mutation and production bootstrap. [M1/Security] Enforce complete sharing and output-authorization semantics #177 owns sharing and output permission plans.

Acceptance criteria

• One immutable, reviewable, code-owned table covers every currently accepted action class exactly once.
• Each row defines the required stage, permitted target kinds, human/AI-assisted/autonomous-software posture, inheritance rule, and whether delegation is allowed.
• The evaluator derives those restrictions from the action class. Public and internal callers can no longer supply an authoritative action stage or posture.
• Unknown action classes, incomplete rows, duplicate rows, invalid enum values, and unsupported actor postures fail closed before an allow decision.
• AI-assisted human action remains attributable to the authenticated human. Autonomous software-agent action is distinct and is refused wherever the matrix does not expressly allow it.
• Tenant-wide authority covers a target only when governed data proves that target belongs to the same tenant. Farm or descendant scope requires durable containment or lineage evidence; missing, ambiguous, cross-tenant, or stale evidence refuses.
• The durable decision trace identifies the selected matrix rule and the scope evidence used, without accepting caller-authored authority facts as proof.
• Existing callers are migrated to the derived interface. No compatibility path may continue treating caller-supplied stage or posture as authoritative.
• Hostile tests cover forged stages, forged posture, unknown actions, wrong target kinds, unproven tenant membership, cross-tenant targets, invalid inheritance, autonomous-agent use, and ambiguous descendants.
• Existing accepted SI decisions remain assertion-equivalent unless the old result depended on caller-controlled stage/posture or unproven scope; those cases must become explicit refusals.

Primary risk and containment

The risk is that a caller can choose a weaker authority context or claim scope over a target whose membership was never proved. Containment is one closed action-class matrix, derived restrictions, durable scope proof, and fail-closed handling of every unknown or ambiguous case.

Non-goals

• No creation, narrowing, revocation, rotation, or recovery of grants or delegations.
• No production tenant/root-authority bootstrap or break-glass ceremony.
• No sharing-grant mutation, output redaction plan, or delivery authorization from [M1/Security] Enforce complete sharing and output-authorization semantics #177.
• No new action class, broader authority, OFARM law/contract change, schema migration, profile activation, capability claim, deployment, or production-readiness claim.

Delivery rule

This issue owns one independently reviewable capability in one primary trust boundary and at most one merged implementation PR. The Phase A design and all implementation, migration-free compatibility work, tests, documentation, and mechanical evidence needed to prove this evaluator boundary travel in that PR.

Stop and split if implementation requires grant mutation, bootstrap custody, sharing/output authorization, a new action class, or another durable authority owner.

What is next: open one draft implementation PR containing the risk-shaped Phase A contract and the complete evaluator slice.

What is next: apply the four-point amendment to the issue body and PR status, then resolve the existing canonical prerequisites under OFARM #21 and the concrete production interface before a complete decision card and implementation approval.