Verify D-006, D-007, AD-146, AD-148 invariants

[George-RD]

Parent

#197 (Spec: Typed Owner Identity)

Blocked by

#201 (Retype ApprovalRecord.approved_by and add AuditEvent.actor)

Deliverables

• Test: D-006 (identity ≠ authority) — OwnerPrincipal has zero authority fields
• Test: D-007 (grant is only authority) — revoking grant revokes all authority
• Test: AD-146 (single owner v1) — exactly one OwnerPrincipal minted, all grants carry same PrincipalId
• Test: AD-148 (MAC-covered fields) — mutating principal_id invalidates grant MAC
• E2E test: Task with typed identity through gate with approval

Phase 4 of typed owner identity implementation. Authority-sensitive verification.

🤖 Generated from spec #197

[coderabbitai]

Coding Plan

Summary

• Add tests only. Do not change runtime authority behavior. Do not add a grant-revoke API, because D-007 forbids mid-flight revocation.
• Group tests by crate seam: schema-level checks (D-006, AD-148) in openspine-schemas, authority-boundary checks (D-007, AD-146) in openspine-authority and openspine-kernel, and one end-to-end approval-flow test in the kernel pipeline.
• Mirror existing test patterns (identity_field_tamper_invalidates_mac, single-owner store tests, compose.rs fixtures, task_board.rs and approval.rs) so the new tests bind to real seams.
• The typed assertions (typed approved_by, AuditEvent.actor, and any distinct MAC-covered principal id field) depend on #201. Each task names the current field it maps to, so the tests remain valid if a type name differs.

Design Choices

Design Choice 1: Availability of typed owner identity primitives from `#201`

Options Considered:

1. Assume #201 has landed. Write tests against the typed fields (OwnerPrincipal, PrincipalId, typed approved_by, AuditEvent.actor).
2. Write tests against the current fields (Principal, user: String, string approved_by) and treat typed assertions as follow-up.

Chosen Option: 1

Rationale: This ticket is explicitly the verification phase gated on #201, so the tests must assert the typed behavior. Each task below names the current field it maps to, so the tests still bind to real seams if a type name differs.

Design Choice 2: Verification method for D-007 without a grant-revoke API

Options Considered:

1. Test that a grant loses authority only through expiry, MAC tamper, and refusal to compose new grants from an inactive source.
2. Add a new revoke API and test it.

Chosen Option: 1

Rationale: Adding a revoke API would contradict D-007 and expand scope. The test must instead prove the absence of any live-authority path after the source is deactivated or the grant expires.

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Phase 1: Schema-level invariant tests (D-006 and AD-148)

This phase adds tests inside openspine-schemas. These tests need no I/O and verify the data types directly. They cover the identity-versus-authority separation (D-006) and MAC coverage of the principal identity (AD-148).

Task 1: Add D-006 test — owner principal carries zero authority fields

Verify that the owner principal type holds only identity fields and no authority fields.

• Add a test near crates/openspine-schemas/src/principal.rs (or extend its #[cfg(test)] module).
• Serialize an owner principal to JSON. Assert the JSON contains only identity keys (id, identity_id, is_owner, schema_version).
• Assert the JSON contains no authority keys. Reuse the existing negative-key pattern from identity_json_has_no_authority_field and deny_unknown_fields_rejects_capability_pack_id.
• Assert that deserializing JSON that contains an authority key such as capability_pack_id fails, because the type uses #[serde(deny_unknown_fields)].
• If #201 renamed Principal to OwnerPrincipal, target that type; otherwise target Principal with is_owner == true.

Task 2: Add AD-148 test — mutating the principal identity invalidates the grant MAC

Verify that a change to the principal identity field after sealing makes verify_mac return false.

• Add a dedicated test in crates/openspine-schemas/src/grant_chain/tests.rs, next to identity_field_tamper_invalidates_mac.
• Seal a root grant. Assert verify_mac returns true.
• Clone the grant. Mutate the principal identity field (the field that stores the principal id; today this is TaskGrant.user, after #201 the typed principal id field). Assert verify_mac returns false.
• If #201 adds a distinct MAC-covered principal id field, add that field to RootAuthority::canonical_bytes coverage confirmation by extending the mutation set, following the thread_id conditional-inclusion pattern.

🤖 Prompt for AI agents

Implement Phase 1: add invariant tests inside the `openspine-schemas` crate that
verify D-006 (identity-authority separation) and AD-148 (MAC coverage of
principal identity). These tests require no I/O and operate directly on the data
types.

For the D-006 test:
- Add or extend a test near `crates/openspine-schemas/src/principal.rs` (in its
`#[cfg(test)]` module).
- Serialize an owner principal to JSON and assert it contains only identity
keys: `id`, `identity_id`, `is_owner`, `schema_version`.
- Assert the JSON contains no authority keys, reusing the negative-key pattern
from `identity_json_has_no_authority_field` and
`deny_unknown_fields_rejects_capability_pack_id`.
- Assert that deserializing JSON containing an authority key such as
`capability_pack_id` fails, since the type uses `#[serde(deny_unknown_fields)]`.
- Target `OwnerPrincipal` if `#201` renamed `Principal`; otherwise target
`Principal` with `is_owner == true`.

For the AD-148 test:
- Add a dedicated test in `crates/openspine-schemas/src/grant_chain/tests.rs`,
next to `identity_field_tamper_invalidates_mac`.
- Seal a root grant and assert `verify_mac` returns `true`.
- Clone the grant, mutate the principal identity field (`TaskGrant.user`
currently, or the typed principal id field after `#201`), and assert `verify_mac`
returns `false`.
- If `#201` adds a distinct MAC-covered principal id field, extend the mutation
set to cover it, following the `thread_id` conditional-inclusion pattern in
`RootAuthority::canonical_bytes`.

Phase 2: Authority-boundary invariant tests (D-007 and AD-146)

This phase adds tests across openspine-authority and openspine-kernel. These tests verify runtime authority behavior: no live-authority path survives source deactivation or expiry (D-007), and every composed grant carries the single owner principal id (AD-146).

Task 1: Add D-007 test — no live-authority path survives revocation

Verify that a grant provides no authority after its source is deactivated or after expiry, and document that no mid-flight revoke exists.

• Add a test file crates/openspine-authority/tests/revocation.rs. Reuse fixtures from tests/common/mod.rs (owner_control_input, test_catalog, and related builders), following tests/compose.rs.
• Compose a valid grant. Assert AuthorityOutcome is allowed.
• Set a backing source (agent, route, workflow, capability pack, or policy) lifecycle_state away from Active. Re-run compose_authority. Assert the outcome is AuthorityOutcome::Denied. This proves no new grant mints from a deactivated source.
• Advance now past expires_at. Assert grant.is_expired(now) is true. Drive the expired grant through gate() and assert DenialReason::GrantExpired.
• Add an explicit comment that D-007 provides no mid-flight revoke; a live grant is bounded only by expiry, MAC tamper, and refusal of new composition.

Task 2: Add AD-146 test — exactly one owner and all grants carry the same principal id

Verify the single-owner rule and the currently untested second half: every composed grant carries the owner principal id.

• For the "exactly one owner" half, confirm coverage exists in crates/openspine-kernel/src/store/identity_tests.rs (bootstrap_owner_principal_creates_exactly_one_owner_and_is_idempotent, database_enforces_at_most_one_owner_principal). Add a test only if a gap remains after #201 renames the type.
• For the "all grants carry same principal id" half, add a test in crates/openspine-kernel/src/pipeline/ (near the composition seam in driver.rs, mirroring pipeline/tests/task_board.rs).
• Bootstrap the owner principal. Read the owner principal id from store.owner_principal().
• Compose a grant through the pipeline. Assert the grant's principal identity field (TaskGrant.user, or the typed principal id field after #201) equals the owner principal id.
• Mint a worker sub-grant with mint_worker_grant. Assert the child grant carries the same principal identity field value as its parent, byte-for-byte.

🤖 Prompt for AI agents

Implement Phase 2: add authority-boundary invariant tests across
`openspine-authority` and `openspine-kernel` that verify D-007 (no live
authority survives revocation) and AD-146 (single owner and consistent principal
id across grants).

For the D-007 test:
- Add a test file `crates/openspine-authority/tests/revocation.rs`, reusing
fixtures from `tests/common/mod.rs` (`owner_control_input`, `test_catalog`,
related builders), following the pattern in `tests/compose.rs`.
- Compose a valid grant and assert `AuthorityOutcome` is allowed.
- Set a backing source (agent, route, workflow, capability pack, or policy)
`lifecycle_state` away from `Active`, re-run `compose_authority`, and assert the
outcome is `AuthorityOutcome::Denied`, proving no new grant mints from a
deactivated source.
- Advance `now` past `expires_at`, assert `grant.is_expired(now)` is `true`,
drive the expired grant through `gate()`, and assert
`DenialReason::GrantExpired`.
- Add a comment stating that D-007 provides no mid-flight revoke; a live grant
is bounded only by expiry, MAC tamper, and refusal of new composition.

For the AD-146 test:
- Confirm the "exactly one owner" half is already covered in
`crates/openspine-kernel/src/store/identity_tests.rs`
(`bootstrap_owner_principal_creates_exactly_one_owner_and_is_idempotent`,
`database_enforces_at_most_one_owner_principal`). Add a new test only if a gap
remains after `#201` renames the type.
- Add a test for the "all grants carry same principal id" half in
`crates/openspine-kernel/src/pipeline/`, near the composition seam in
`driver.rs`, mirroring `pipeline/tests/task_board.rs`.
- Bootstrap the owner principal and read the owner principal id from
`store.owner_principal()`.
- Compose a grant through the pipeline and assert the grant's principal identity
field (`TaskGrant.user`, or the typed principal id field after `#201`) equals the
owner principal id.
- Mint a worker sub-grant with `mint_worker_grant` and assert the child grant
carries the same principal identity field value as its parent, byte-for-byte.

Phase 3: End-to-end typed-identity test through gate with approval

This phase adds one end-to-end test in the kernel pipeline. The test drives a Task with a typed owner principal id through grant composition, gate(), and owner approval. It asserts the typed identity flows unchanged into the approval record and the audit trail.

Add E2E test — Task with typed identity through gate with approval

Verify the full path: typed Task principal → TaskGrant → gate() → owner approval callback → typed ApprovalRecord.approved_by and AuditEvent.actor.

• Add a test in crates/openspine-kernel/src/pipeline/tests/. Combine the task_board.rs Task-to-gate pattern with the approval.rs approval-callback pattern.
• Build a Task with owner_principal_id set to the bootstrapped owner principal id (a Ulid). Fire the task timer. Obtain the TaskGrant.
• Drive the request through mediate_and_dispatch_action (which calls gate()). Continue past the ApprovalRequired decision.
• Call the approval callback (handle_draft_approval_callback or handle_plan_approval_callback).
• Assert ApprovalRecord.approved_by holds the typed principal id from state.owner_principal_id, not the raw owner_user_id Telegram integer. This depends on #201.
• Assert AuditEvent.actor holds the same typed principal id. This depends on #201.
• Assert AuditEvent.task_grant_id matches the grant id, and that the post-approval effect succeeds, mirroring the Gmail-draft assertions in pipeline/tests/approval.rs.

🤖 Prompt for AI agents

Implement Phase 3: add one end-to-end test in the kernel pipeline that drives a
Task with a typed owner principal id through grant composition, `gate()`, and
owner approval, and verifies the typed identity flows unchanged into the
approval record and audit trail.

- Add the test in `crates/openspine-kernel/src/pipeline/tests/`, combining the
`task_board.rs` Task-to-gate pattern with the `approval.rs` approval-callback
pattern.
- Build a `Task` with `owner_principal_id` set to the bootstrapped owner
principal id (a `Ulid`), fire the task timer, and obtain the `TaskGrant`.
- Drive the request through `mediate_and_dispatch_action` (which calls
`gate()`), and continue past the `ApprovalRequired` decision.
- Call the approval callback (`handle_draft_approval_callback` or
`handle_plan_approval_callback`).
- Assert `ApprovalRecord.approved_by` holds the typed principal id from
`state.owner_principal_id`, not the raw `owner_user_id` Telegram integer
(depends on `#201`).
- Assert `AuditEvent.actor` holds the same typed principal id (depends on `#201`).
- Assert `AuditEvent.task_grant_id` matches the grant id, and that the
post-approval effect succeeds, mirroring the Gmail-draft assertions in
`pipeline/tests/approval.rs`.

Research

The authority model lives in three crates. openspine-schemas defines the data types: Principal { id: Ulid, identity_id: Ulid, is_owner: bool } (no authority fields, per D-006), TaskGrant with a chained HMAC field caveat_mac, ApprovalRecord.approved_by: String, and AuditEvent. The MAC math lives in openspine-schemas/src/grant_chain.rs (RootAuthority::canonical_bytes, seal_root, verify_mac). openspine-authority composes grants (compose.rs) and mints worker sub-grants (worker_grant.rs) by calling into grant_chain. openspine-kernel runs the pipeline: store/identity.rs enforces a single owner Principal (DB partial unique index plus bootstrap_owner_principal), and pipeline/approval.rs / pipeline/plan_approval.rs write ApprovalRecord.approved_by from state.owner_user_id. openspine-gate/src/gate.rs enforces expiry and MAC at request time.

Existing test seams to mirror: crates/openspine-schemas/src/grant_chain/tests.rs (identity_field_tamper_invalidates_mac), crates/openspine-kernel/src/store/identity_tests.rs (single-owner tests), crates/openspine-authority/tests/{compose.rs,equivalence.rs} with tests/common/mod.rs, and crates/openspine-kernel/src/pipeline/tests/{task_board.rs,approval.rs}.

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

Implement Phase 1: add invariant tests inside the `openspine-schemas` crate that
verify D-006 (identity-authority separation) and AD-148 (MAC coverage of
principal identity). These tests require no I/O and operate directly on the data
types.

For the D-006 test:
- Add or extend a test near `crates/openspine-schemas/src/principal.rs` (in its
`#[cfg(test)]` module).
- Serialize an owner principal to JSON and assert it contains only identity
keys: `id`, `identity_id`, `is_owner`, `schema_version`.
- Assert the JSON contains no authority keys, reusing the negative-key pattern
from `identity_json_has_no_authority_field` and
`deny_unknown_fields_rejects_capability_pack_id`.
- Assert that deserializing JSON containing an authority key such as
`capability_pack_id` fails, since the type uses `#[serde(deny_unknown_fields)]`.
- Target `OwnerPrincipal` if `#201` renamed `Principal`; otherwise target
`Principal` with `is_owner == true`.

For the AD-148 test:
- Add a dedicated test in `crates/openspine-schemas/src/grant_chain/tests.rs`,
next to `identity_field_tamper_invalidates_mac`.
- Seal a root grant and assert `verify_mac` returns `true`.
- Clone the grant, mutate the principal identity field (`TaskGrant.user`
currently, or the typed principal id field after `#201`), and assert `verify_mac`
returns `false`.
- If `#201` adds a distinct MAC-covered principal id field, extend the mutation
set to cover it, following the `thread_id` conditional-inclusion pattern in
`RootAuthority::canonical_bytes`.
===============================================================================

Task: 2

Implement Phase 2: add authority-boundary invariant tests across
`openspine-authority` and `openspine-kernel` that verify D-007 (no live
authority survives revocation) and AD-146 (single owner and consistent principal
id across grants).

For the D-007 test:
- Add a test file `crates/openspine-authority/tests/revocation.rs`, reusing
fixtures from `tests/common/mod.rs` (`owner_control_input`, `test_catalog`,
related builders), following the pattern in `tests/compose.rs`.
- Compose a valid grant and assert `AuthorityOutcome` is allowed.
- Set a backing source (agent, route, workflow, capability pack, or policy)
`lifecycle_state` away from `Active`, re-run `compose_authority`, and assert the
outcome is `AuthorityOutcome::Denied`, proving no new grant mints from a
deactivated source.
- Advance `now` past `expires_at`, assert `grant.is_expired(now)` is `true`,
drive the expired grant through `gate()`, and assert
`DenialReason::GrantExpired`.
- Add a comment stating that D-007 provides no mid-flight revoke; a live grant
is bounded only by expiry, MAC tamper, and refusal of new composition.

For the AD-146 test:
- Confirm the "exactly one owner" half is already covered in
`crates/openspine-kernel/src/store/identity_tests.rs`
(`bootstrap_owner_principal_creates_exactly_one_owner_and_is_idempotent`,
`database_enforces_at_most_one_owner_principal`). Add a new test only if a gap
remains after `#201` renames the type.
- Add a test for the "all grants carry same principal id" half in
`crates/openspine-kernel/src/pipeline/`, near the composition seam in
`driver.rs`, mirroring `pipeline/tests/task_board.rs`.
- Bootstrap the owner principal and read the owner principal id from
`store.owner_principal()`.
- Compose a grant through the pipeline and assert the grant's principal identity
field (`TaskGrant.user`, or the typed principal id field after `#201`) equals the
owner principal id.
- Mint a worker sub-grant with `mint_worker_grant` and assert the child grant
carries the same principal identity field value as its parent, byte-for-byte.
===============================================================================

Task: 3

Implement Phase 3: add one end-to-end test in the kernel pipeline that drives a
Task with a typed owner principal id through grant composition, `gate()`, and
owner approval, and verifies the typed identity flows unchanged into the
approval record and audit trail.

- Add the test in `crates/openspine-kernel/src/pipeline/tests/`, combining the
`task_board.rs` Task-to-gate pattern with the `approval.rs` approval-callback
pattern.
- Build a `Task` with `owner_principal_id` set to the bootstrapped owner
principal id (a `Ulid`), fire the task timer, and obtain the `TaskGrant`.
- Drive the request through `mediate_and_dispatch_action` (which calls
`gate()`), and continue past the `ApprovalRequired` decision.
- Call the approval callback (`handle_draft_approval_callback` or
`handle_plan_approval_callback`).
- Assert `ApprovalRecord.approved_by` holds the typed principal id from
`state.owner_principal_id`, not the raw `owner_user_id` Telegram integer
(depends on `#201`).
- Assert `AuditEvent.actor` holds the same typed principal id (depends on `#201`).
- Assert `AuditEvent.task_grant_id` matches the grant id, and that the
post-approval effect succeeds, mirroring the Gmail-draft assertions in
`pipeline/tests/approval.rs`.

💡 Iterate on the plan with: `@coderabbitai` <feedback>

Example Feedback
- `@coderabbitai` You can skip phase 3. Add a simple unit test case for phase 2.
- `@coderabbitai` For design choice 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord!