Design the typed owner identity

[George-RD]

Part of #182

Question

One typed owner-identity module: replaces the three parallel AppState owner scalars and the stringly TaskGrant.user (four value shapes across ~35 sites); the grant carries a typed, kernel-owned principal reference (the MAC-covered thread_id precedent); the approver of record derives from the verified surface (today ApprovalRecord.approved_by persists a raw Telegram user id); identity becomes an audit dimension.

Decided (DIRECTION.md): this design precedes the tenancy assessment. Users: Auditor, Bell, Lyra. Promise: Permissions. Evidence: review, candidate 4.

Resolve per the handoff shape: grill + domain-model, then to-spec; link the spec issue here.

[coderabbitai]

Coding Plan

Summary

• Treat this as a design ticket. The deliverable is an OpenSpec change, not the code refactor. The refactor becomes follow-up implementation tickets from the spec.
• Follow the repo handoff shape: recover the missing DIRECTION.md and candidate-4 evidence, grill the open forks into a decision list, capture the domain model, then formalize to-spec.
• Center the design on a PrincipalId(Ulid) newtype and an OwnerPrincipal aggregate that unify the three AppState scalars and the four TaskGrant.user shapes. Follow the OwnerSurfaceRef and MAC-covered thread_id precedents while preserving grant MAC bytes and the D-006/D-007/AD-146/AD-148 invariants.
• Extend identity as an approver-of-record source (ApprovalRecord.approved_by from the verified surface) and as an audit dimension (an optional typed actor on AuditEvent).

Design Choices

Design Choice 1: Missing evidence documents and named users

Options Considered:

1. Block the design until the evidence and DIRECTION.md are recovered.
2. Proceed using the concrete code evidence found in exploration, and treat the missing documents as inputs to confirm during the grill.

Chosen Option: 2

Rationale: The code-level problems (three scalars, four user shapes, raw approved_by, no audit actor) are directly verifiable, so the design can proceed. Recovery of DIRECTION.md and the candidate-4 review is a required grill input, not a blocker.

Design Choice 2: Representation of the typed owner reference on TaskGrant

Options Considered:

1. Introduce a PrincipalId(Ulid) newtype and retype user in place; the newtype serializes to the same string as today's stringified Ulid, so MAC bytes stay identical for grants that already held a Ulid.
2. Add a new additive Option field following the thread_id playbook and deprecate user over a transition window.
3. Reuse OwnerSurfaceRef directly on the grant.

Chosen Option: 1

Rationale: A PrincipalId(Ulid) newtype preserves MAC bytes for the dominant production shape, removes the non-Ulid literals ("owner", "kernel") by construction, and keeps the raw SQL json_extract('$.user') query valid. Confirm during the grill whether legacy grants carrying literals exist in any persisted store and need a reseal path.

Design Choice 3: Shape of the owner-identity aggregate that replaces the three AppState scalars

Options Considered:

1. One OwnerPrincipal aggregate bundling principal_id, identity_id, and the Telegram binding behind typed accessors.
2. Bundle only the two Ulid values and keep the Telegram i64 as a separate channel field.

Chosen Option: 1

Rationale: A single OwnerPrincipal aggregate returned from bootstrap_owner_principal gives one source of truth. The Telegram id is exposed only through a typed channel-binding accessor so generic code cannot read a naked i64.

Design Choice 4: Shape of the new audit actor dimension

Options Considered:

1. Add an optional typed PrincipalId actor field to AuditEvent.
2. Add an optional full OwnerSurfaceRef to AuditEvent.

Chosen Option: 1

Rationale: A channel-neutral PrincipalId actor field is the minimal audit dimension. Channel-specific surface detail stays in the grant and review rows and is reachable through task_grant_id.

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Phase 1: Recover inputs and run the grill

This phase gathers the external decision inputs and converts the fuzzy candidate into a settled decision list. It follows the repo grill step (.omp/skills/interview-me/SKILL.md). No spec is written yet.

Task 1: Recover the external design inputs

Obtain the decision inputs the ticket names but the repo lacks.

• Retrieve the candidate-4 content from .raw/openspine-architecture-review-2026-08-20.md and DIRECTION.md from the issue #182 context or the owner.
• Confirm the meaning of the users "Auditor", "Bell", "Lyra" and the "Permissions" promise, because none appear in the repository.
• Confirm the land/fold/reject verdict for candidate 4 under DIRECTION.md, and that this design precedes the tenancy assessment.
• If any input stays unavailable, record the assumption explicitly in the grill decision list and proceed with the code-level evidence.

Task 2: Run the grill and produce the decision list

Interrogate the open design forks and end with a decision list ready for the domain model.

• Resolve the four forks in the Assumptions section: grant reference representation, owner aggregate shape, audit dimension shape, and legacy-grant reseal handling.
• Confirm the invariants that must not break: D-006 (identity carries no authority), D-007 (the task grant is the only live authority object), AD-146 (single owner principal, principal_id: Some only for the owner), and AD-148 (kernel-owned MAC-covered fields).
• Decide the migration posture for ApprovalRecord.approved_by: derive it from OwnerSurfaceRef::principal_id() and retype it, and decide whether stored historical rows need backfill.
• Produce a numbered decision list as the single grill output.

🤖 Prompt for AI agents

Implement Phase 1 of the design: recover missing external inputs and run the
grill to produce a settled decision list. No code or spec files are produced in
this phase; the output is a decision list document.

Recover inputs:
- Retrieve the candidate-4 content from
`.raw/openspine-architecture-review-2026-08-20.md` and `DIRECTION.md` from the
issue `#182` context or the owner.
- Confirm the meaning of the users "Auditor", "Bell", "Lyra", and the
"Permissions" promise, since none appear in the repository.
- Confirm the land/fold/reject verdict for candidate 4 under `DIRECTION.md`, and
confirm that this design precedes the tenancy assessment.
- If any input remains unavailable, record that explicitly as an assumption in
the grill decision list, and proceed using code-level evidence.

Run the grill following `.omp/skills/interview-me/SKILL.md`:
- Resolve four forks: grant reference representation, owner aggregate shape,
audit dimension shape, and legacy-grant reseal handling.
- Confirm invariants that must not break: D-006 (identity carries no authority),
D-007 (the task grant is the only live authority object), AD-146 (single owner
principal, `principal_id: Some` only for the owner), and AD-148 (kernel-owned
MAC-covered fields).
- Decide the migration posture for `ApprovalRecord.approved_by`: derive it from
`OwnerSurfaceRef::principal_id()`, retype it, and decide whether stored
historical rows need backfill.
- Produce a single numbered decision list as the output of this phase.

Phase 2: Capture the domain model

This phase turns the decision list into a durable domain model. It defines the typed owner-identity module, the grant reference, the approver-of-record source, and the audit dimension, and it records the back-compat strategy. This maps to the domain-model step and is captured in the change design.md.

Task 1: Define the typed owner-identity module

Describe the module shape and its invariants.

• Define a PrincipalId(Ulid) newtype in crates/openspine-schemas. Give it a Display/serde form identical to Ulid.to_string() so it preserves MAC bytes and JSON query compatibility.
• Define an OwnerPrincipal aggregate that bundles principal_id: PrincipalId, identity_id: Ulid, and the verified Telegram binding. Follow the owner_surface.rs pattern: private fields, a smart constructor produced by bootstrap_owner_principal, narrow accessors, and #[serde(deny_unknown_fields)].
• State that generic kernel code must read the owner only through typed accessors, and that the raw Telegram i64 is reachable only through a channel-binding accessor.
• State that OwnerPrincipal carries no authority field, to preserve D-006.

Task 2: Define the typed, kernel-owned grant reference and its back-compat rule

Describe how TaskGrant.user becomes typed while grant MACs stay valid.

• Retype TaskGrant.user (and the mirrored RootAuthority.user and SelectionToken actor field) from String to PrincipalId.
• State that RootAuthority::canonical_bytes in grant_chain.rs keeps "user" as a mandatory string value with the same bytes, so existing sealed grants that held a stringified Ulid still verify.
• State that the four current value shapes collapse to one: every construction site sets the owner PrincipalId; the literals "owner" and "kernel" are removed. Identify compose.rs as the single mint-from-data site and mint_worker_grant as the clone-inheritance site that stays type-agnostic.
• Record the reseal path for any persisted legacy grant that held a non-Ulid literal, per the Phase 1 decision.
• Note the downstream typed cutover: WorkerIdentity.owner, OperationAuthorization.owner_principal_id, and the raw SQL json_extract(g.grant_json, '$.user') consumer must move from String comparisons to PrincipalId comparisons.

Task 3: Define the approver of record and the audit dimension

Describe how the verified surface becomes the approver of record and how identity becomes an audit dimension.

• Retype ApprovalRecord.approved_by to PrincipalId and require the pipeline to set it from OwnerSurfaceRef::principal_id(), not from state.owner_user_id. Identify pipeline/approval.rs and pipeline/plan_approval.rs as the two callback sites.
• Add an optional actor: Option<PrincipalId> field to AuditEvent. Thread it through the append path (store/audit_append.rs) and the hash pre-image, and update the deny_unknown_fields test.
• State that the actor field is populated from the verified surface principal on owner-authored audit events, and stays None where no principal applies.

🤖 Prompt for AI agents

Implement Phase 2 of the design: capture the domain model derived from the Phase
1 decision list, defining the typed owner-identity module, the grant reference,
the approver-of-record source, and the audit dimension. Record this domain model
in the change `design.md`.

Define the typed owner-identity module:
- Define a `PrincipalId(Ulid)` newtype in `crates/openspine-schemas`, with a
`Display`/serde form identical to `Ulid.to_string()` to preserve MAC bytes and
JSON query compatibility.
- Define an `OwnerPrincipal` aggregate bundling `principal_id: PrincipalId`,
`identity_id: Ulid`, and the verified Telegram binding, following the
`owner_surface.rs` pattern: private fields, a smart constructor produced by
`bootstrap_owner_principal`, narrow accessors, and
`#[serde(deny_unknown_fields)]`.
- Require generic kernel code to read the owner only through typed accessors;
expose the raw Telegram `i64` only through a channel-binding accessor.
- Ensure `OwnerPrincipal` carries no authority field, to preserve invariant
D-006.

Define the typed, kernel-owned grant reference and back-compat rule:
- Retype `TaskGrant.user` (and the mirrored `RootAuthority.user` and
`SelectionToken` actor field) from `String` to `PrincipalId`.
- Keep `RootAuthority::canonical_bytes` in `grant_chain.rs` producing the
`"user"` key as a mandatory string value with identical bytes, so existing
sealed grants holding a stringified `Ulid` still verify.
- Collapse the four current value shapes into one: every construction site sets
the owner `PrincipalId`; remove the literals `"owner"` and `"kernel"`. Identify
`compose.rs` as the single mint-from-data site, and `mint_worker_grant` as the
clone-inheritance site that stays type-agnostic.
- Record the reseal path for any persisted legacy grant holding a non-`Ulid`
literal, per the Phase 1 decision.
- Note the downstream typed cutover: `WorkerIdentity.owner`,
`OperationAuthorization.owner_principal_id`, and the raw SQL
`json_extract(g.grant_json, '$.user')` consumer must move from `String`
comparisons to `PrincipalId` comparisons.

Define the approver of record and the audit dimension:
- Retype `ApprovalRecord.approved_by` to `PrincipalId`; require the pipeline to
set it from `OwnerSurfaceRef::principal_id()`, not from `state.owner_user_id`.
Identify `pipeline/approval.rs` and `pipeline/plan_approval.rs` as the two
callback sites.
- Add an optional `actor: Option<PrincipalId>` field to `AuditEvent`, thread it
through the append path (`store/audit_append.rs`) and the hash pre-image, and
update the `deny_unknown_fields` test.
- Populate the actor field from the verified surface principal on owner-authored
audit events; leave it `None` where no principal applies.

Phase 3: Produce the OpenSpec change and link the spec issue

This phase converts the domain model into a formal OpenSpec change (the to-spec step) that follows the repo ceremony, and links the resulting spec issue back to #182. This phase produces spec artifacts only; the code refactor is deferred to follow-up implementation tickets spawned from the spec.

Task 1: Create the change folder and author proposal, design, and tasks

Create the OpenSpec change per openspec/conventions.md.

• Create a dated change folder, for example openspec/changes/<date>-design-typed-owner-identity/.
• Author proposal.md with the required sections: summary, what changes, why, affected layer, authority sensitivity, goals, non-goals, and a decision-log check. State that this change binds and types the existing single owner principal and does not add tenancy, OAuth, or a new principal model.
• Author design.md from the Phase 2 domain model, including the four resolved forks and the MAC byte-identity rationale.
• Author tasks.md with implementation slices for the schema, kernel, authority, and store layers, plus explicit verification tasks, because identity is authority-sensitive.

Task 2: Author the spec deltas

Write the normative spec deltas against the existing capabilities.

• Write ## MODIFIED Requirements deltas against openspec/specs/identity-store/spec.md for the typed OwnerPrincipal aggregate and the single-owner invariant, not ## ADDED, because these requirements already exist.
• Write ## MODIFIED Requirements deltas against openspec/specs/core-runtime-schemas/spec.md for the typed, MAC-covered grant principal reference, including a scenario that mutating the reference invalidates the grant MAC.
• Write ## MODIFIED Requirements deltas against openspec/specs/responsibility-contract/spec.md for the approver-of-record derivation from the verified surface principal.
• Add the audit-actor requirement to the spec that owns AuditEvent, with a scenario for the optional typed actor dimension.
• Give every requirement at least one #### Scenario: block.

Task 3: Update canon, sequence, and link the issue

Record the decision and wire the change into the dependency order.

• Add a new D-0XX entry in .raw/openspine-decision-log.md for the typed owner identity and any narrowed identity-store requirement.
• Add a sequence entry in openspec/openspine-change-sequence.md with Requires: implement-identity-store-and-principal, and HARD edges to or from define-responsibility-contract and add-channel-neutral-responsibility-review if the principal typing they consume changes.
• Run openspec validate --changes <change-id> --strict and the repo gate scripts/check.sh <change-id>.
• Open the to-spec issue for this change and link it in ticket "Design the typed owner identity" and in issue #182.

🤖 Prompt for AI agents

Implement Phase 3 of the design: convert the domain model into a formal OpenSpec
change following the repo ceremony, and link the resulting spec issue back to
`#182`. This phase produces spec artifacts only; defer the code refactor to
follow-up implementation tickets spawned from the spec.

Create the change folder and author proposal, design, and tasks, per
`openspec/conventions.md`:
- Create a dated change folder, for example
`openspec/changes/<date>-design-typed-owner-identity/`.
- Author `proposal.md` with sections: summary, what changes, why, affected
layer, authority sensitivity, goals, non-goals, and a decision-log check. State
that this change binds and types the existing single owner principal, and does
not add tenancy, OAuth, or a new principal model.
- Author `design.md` from the Phase 2 domain model, including the four resolved
forks and the MAC byte-identity rationale.
- Author `tasks.md` with implementation slices for the schema, kernel,
authority, and store layers, plus explicit verification tasks, since identity is
authority-sensitive.

Author the spec deltas:
- Write `## MODIFIED Requirements` deltas against
`openspec/specs/identity-store/spec.md` for the typed `OwnerPrincipal` aggregate
and the single-owner invariant (use MODIFIED, not ADDED, since these
requirements already exist).
- Write `## MODIFIED Requirements` deltas against
`openspec/specs/core-runtime-schemas/spec.md` for the typed, MAC-covered grant
principal reference, including a scenario showing that mutating the reference
invalidates the grant MAC.
- Write `## MODIFIED Requirements` deltas against
`openspec/specs/responsibility-contract/spec.md` for the approver-of-record
derivation from the verified surface principal.
- Add the audit-actor requirement to the spec that owns `AuditEvent`, with a
scenario for the optional typed actor dimension.
- Give every requirement at least one `#### Scenario:` block.

Update canon, sequence, and link the issue:
- Add a new `D-0XX` entry in `.raw/openspine-decision-log.md` for the typed
owner identity and any narrowed identity-store requirement.
- Add a sequence entry in `openspec/openspine-change-sequence.md` with
`Requires: implement-identity-store-and-principal`, and add HARD edges to or
from `define-responsibility-contract` and
`add-channel-neutral-responsibility-review` if the principal typing they consume
changes.
- Run `openspec validate --changes <change-id> --strict` and the repo gate
`scripts/check.sh <change-id>`.
- Open the to-spec issue for this change, and link it in ticket "Design the
typed owner identity" and in issue `#182`.

Research

OpenSpine is a Rust workspace. Schemas live in crates/openspine-schemas. The runtime kernel lives in crates/openspine-kernel. Authority composition lives in crates/openspine-authority. Formal specs live under openspec/specs, and changes follow a strict OpenSpec ceremony (proposal.md, design.md, tasks.md, specs/<capability>/spec.md deltas) with a dependency-ordered openspec/openspine-change-sequence.md and a canon decision log in .raw/openspine-decision-log.md.

The current owner identity is fragmented across four shapes:

• AppState in crates/openspine-kernel/src/pipeline/mod.rs holds three scalars: owner_user_id: i64, owner_principal_id: Ulid, owner_identity_id: Ulid. Two of these (principal_id, identity_id) come from one bootstrap_owner_principal call. owner_user_id is a raw config passthrough.
• TaskGrant.user: String in crates/openspine-schemas/src/grant.rs holds four value shapes across roughly 35 construction sites: a stringified owner_principal_id, a stringified owner_user_id, the literal "owner", and the literal "kernel". It is MAC-covered unconditionally through RootAuthority::canonical_bytes in grant_chain.rs.
• ApprovalRecord.approved_by: String in crates/openspine-schemas/src/approval.rs persists the statically configured owner Telegram id, not the verified per-callback surface.
• AuditEvent in crates/openspine-schemas/src/audit.rs has no actor/principal field. The only link to "who" is task_grant_id.

Two strong precedents exist. OwnerSurfaceRef in crates/openspine-schemas/src/owner_surface.rs is a typed, principal-bound, kind-tagged reference with private fields and smart constructors. The MAC-covered dormant thread_id field (AD-148) on TaskGrant and EventEnvelope shows how to add a kernel-owned, integrity-bound field additively.

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

Implement Phase 1 of the design: recover missing external inputs and run the
grill to produce a settled decision list. No code or spec files are produced in
this phase; the output is a decision list document.

Recover inputs:
- Retrieve the candidate-4 content from
`.raw/openspine-architecture-review-2026-08-20.md` and `DIRECTION.md` from the
issue `#182` context or the owner.
- Confirm the meaning of the users "Auditor", "Bell", "Lyra", and the
"Permissions" promise, since none appear in the repository.
- Confirm the land/fold/reject verdict for candidate 4 under `DIRECTION.md`, and
confirm that this design precedes the tenancy assessment.
- If any input remains unavailable, record that explicitly as an assumption in
the grill decision list, and proceed using code-level evidence.

Run the grill following `.omp/skills/interview-me/SKILL.md`:
- Resolve four forks: grant reference representation, owner aggregate shape,
audit dimension shape, and legacy-grant reseal handling.
- Confirm invariants that must not break: D-006 (identity carries no authority),
D-007 (the task grant is the only live authority object), AD-146 (single owner
principal, `principal_id: Some` only for the owner), and AD-148 (kernel-owned
MAC-covered fields).
- Decide the migration posture for `ApprovalRecord.approved_by`: derive it from
`OwnerSurfaceRef::principal_id()`, retype it, and decide whether stored
historical rows need backfill.
- Produce a single numbered decision list as the output of this phase.
===============================================================================

Task: 2

Implement Phase 2 of the design: capture the domain model derived from the Phase
1 decision list, defining the typed owner-identity module, the grant reference,
the approver-of-record source, and the audit dimension. Record this domain model
in the change `design.md`.

Define the typed owner-identity module:
- Define a `PrincipalId(Ulid)` newtype in `crates/openspine-schemas`, with a
`Display`/serde form identical to `Ulid.to_string()` to preserve MAC bytes and
JSON query compatibility.
- Define an `OwnerPrincipal` aggregate bundling `principal_id: PrincipalId`,
`identity_id: Ulid`, and the verified Telegram binding, following the
`owner_surface.rs` pattern: private fields, a smart constructor produced by
`bootstrap_owner_principal`, narrow accessors, and
`#[serde(deny_unknown_fields)]`.
- Require generic kernel code to read the owner only through typed accessors;
expose the raw Telegram `i64` only through a channel-binding accessor.
- Ensure `OwnerPrincipal` carries no authority field, to preserve invariant
D-006.

Define the typed, kernel-owned grant reference and back-compat rule:
- Retype `TaskGrant.user` (and the mirrored `RootAuthority.user` and
`SelectionToken` actor field) from `String` to `PrincipalId`.
- Keep `RootAuthority::canonical_bytes` in `grant_chain.rs` producing the
`"user"` key as a mandatory string value with identical bytes, so existing
sealed grants holding a stringified `Ulid` still verify.
- Collapse the four current value shapes into one: every construction site sets
the owner `PrincipalId`; remove the literals `"owner"` and `"kernel"`. Identify
`compose.rs` as the single mint-from-data site, and `mint_worker_grant` as the
clone-inheritance site that stays type-agnostic.
- Record the reseal path for any persisted legacy grant holding a non-`Ulid`
literal, per the Phase 1 decision.
- Note the downstream typed cutover: `WorkerIdentity.owner`,
`OperationAuthorization.owner_principal_id`, and the raw SQL
`json_extract(g.grant_json, '$.user')` consumer must move from `String`
comparisons to `PrincipalId` comparisons.

Define the approver of record and the audit dimension:
- Retype `ApprovalRecord.approved_by` to `PrincipalId`; require the pipeline to
set it from `OwnerSurfaceRef::principal_id()`, not from `state.owner_user_id`.
Identify `pipeline/approval.rs` and `pipeline/plan_approval.rs` as the two
callback sites.
- Add an optional `actor: Option<PrincipalId>` field to `AuditEvent`, thread it
through the append path (`store/audit_append.rs`) and the hash pre-image, and
update the `deny_unknown_fields` test.
- Populate the actor field from the verified surface principal on owner-authored
audit events; leave it `None` where no principal applies.
===============================================================================

Task: 3

Implement Phase 3 of the design: convert the domain model into a formal OpenSpec
change following the repo ceremony, and link the resulting spec issue back to
`#182`. This phase produces spec artifacts only; defer the code refactor to
follow-up implementation tickets spawned from the spec.

Create the change folder and author proposal, design, and tasks, per
`openspec/conventions.md`:
- Create a dated change folder, for example
`openspec/changes/<date>-design-typed-owner-identity/`.
- Author `proposal.md` with sections: summary, what changes, why, affected
layer, authority sensitivity, goals, non-goals, and a decision-log check. State
that this change binds and types the existing single owner principal, and does
not add tenancy, OAuth, or a new principal model.
- Author `design.md` from the Phase 2 domain model, including the four resolved
forks and the MAC byte-identity rationale.
- Author `tasks.md` with implementation slices for the schema, kernel,
authority, and store layers, plus explicit verification tasks, since identity is
authority-sensitive.

Author the spec deltas:
- Write `## MODIFIED Requirements` deltas against
`openspec/specs/identity-store/spec.md` for the typed `OwnerPrincipal` aggregate
and the single-owner invariant (use MODIFIED, not ADDED, since these
requirements already exist).
- Write `## MODIFIED Requirements` deltas against
`openspec/specs/core-runtime-schemas/spec.md` for the typed, MAC-covered grant
principal reference, including a scenario showing that mutating the reference
invalidates the grant MAC.
- Write `## MODIFIED Requirements` deltas against
`openspec/specs/responsibility-contract/spec.md` for the approver-of-record
derivation from the verified surface principal.
- Add the audit-actor requirement to the spec that owns `AuditEvent`, with a
scenario for the optional typed actor dimension.
- Give every requirement at least one `#### Scenario:` block.

Update canon, sequence, and link the issue:
- Add a new `D-0XX` entry in `.raw/openspine-decision-log.md` for the typed
owner identity and any narrowed identity-store requirement.
- Add a sequence entry in `openspec/openspine-change-sequence.md` with
`Requires: implement-identity-store-and-principal`, and add HARD edges to or
from `define-responsibility-contract` and
`add-channel-neutral-responsibility-review` if the principal typing they consume
changes.
- Run `openspec validate --changes <change-id> --strict` and the repo gate
`scripts/check.sh <change-id>`.
- Open the to-spec issue for this change, and link it in ticket "Design the
typed owner identity" and in issue `#182`.

💡 Iterate on the plan with: `@coderabbitai` <feedback>

Example Feedback
- `@coderabbitai` You can skip phase 3. Add a simple unit test case for phase 2.
- `@coderabbitai` For design choice 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord!

[George-RD]

Resolution.

Designed and published the spec for typed owner identity.

Deliverable:

• Spec issue: Spec: Typed Owner Identity #197 (Spec: Typed Owner Identity) — ready-for-agent
• OpenSpec change: openspec/changes/2026-08-20-design-typed-owner-identity/
  • proposal.md: Problem/context, solution, goals, dependencies
  • design.md: Domain model, four resolved design forks, invariants preserved
  • tasks.md: Phased implementation with authority-sensitive verification tasks
  • specs.md: Requirement deltas for identity-store, core-runtime-schemas, responsibility-contract, audit-and-logging
• Decision log: D-174 recorded in .raw/openspine-decision-log.md

Design Decisions (all four forks resolved):

1. ✅ TaskGrant.user representation: PrincipalId(Ulid) newtype, MAC-preserving
2. ✅ Owner aggregate: Single OwnerPrincipal (principal_id, identity_id, telegram_binding via accessor)
3. ✅ Audit actor dimension: Optional typed PrincipalId (not full OwnerSurfaceRef)
4. ✅ ApprovalRecord.approved_by migration: Retype to PrincipalId, source from verified surface, no backfill

Invariants Preserved:

• ✅ D-006: Identity carries no authority
• ✅ D-007: Task grant is the only live authority object
• ✅ AD-146: Single owner principal (v1, additive for future tenancy)
• ✅ AD-148: Kernel-owned MAC-covered fields

Path Forward: Implementation from the spec (#197), starting with Phase 1 (schema + identity layer). Depends on implement-identity-store-and-principal landing first.

---

🤖 Closed by worker task (2026-08-20)

Linked: #182 (wayfinder map), #197 (spec issue), .raw/openspine-decision-log.md (D-174)