Validate change through full CI and gate

[George-RD]

Parent

#197 (Spec: Typed Owner Identity)

Blocked by

#202 (Verify D-006, D-007, AD-146, AD-148 invariants)

Deliverables

• Run scripts/check.sh with change
• All cargo test --workspace passes
• No clippy warnings
• Shell E2E test spawns successfully
• Gate validates strictly

Phase 5 of typed owner identity implementation. Gate integration and CI.

🤖 Generated from spec #197

[coderabbitai]

Coding Plan

Summary

Treat this ticket as validation of the assembled Typed Owner Identity change. First confirm the Phase 1-4 code is present.

Run scripts/check.sh to reproduce CI exactly. Then fix failures where the typed field ripples through test fixtures and call sites.

Bring clippy, formatting, and the file-size cap to a clean state. Update docs/threat-claims.md for any new invariant tests.

Confirm the Shell E2E test spawns the real binary. Confirm the gate authorizes fail-closed. Confirm the final openspec validate --all --strict passes.

Design Choices

Design Choice 1: Are the Phase 1-4 code changes present on the working branch?

Options Considered:

1. Assume the Phase 1-4 change is merged or rebased onto the working branch before this ticket starts. This ticket then only validates the assembled change.
2. Treat this ticket as also implementing any remaining typed identity code needed to make the gate pass.

Chosen Option: 1

Rationale: The ticket text names this "Phase 5" and lists only validation deliverables. The plan assumes the implementation phases are present and focuses on validation and failure resolution.

The codebase exploration found that no typed owner identity code has landed yet. TaskGrant.user and ApprovalRecord.approved_by are still plain String. AppState still holds three owner scalars. The audit schema still has no identity dimension. This ticket is the validation phase and depends on the implementation phases.

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Phase 1: Assemble the change and run the full gate

This phase confirms that the typed owner identity change is present, then runs the complete gate once to collect all failures. The goal is a single reproducible gate run that matches CI exactly.

Task 1: Confirm the typed owner identity change is present

Verify that the Phase 1-4 code is on the working branch before validation.

• Confirm that TaskGrant.user in crates/openspine-schemas/src/grant.rs and ApprovalRecord.approved_by in crates/openspine-schemas/src/approval.rs carry the typed principal reference from the prior phases.
• Confirm that AppState in crates/openspine-kernel/src/pipeline/mod.rs uses the consolidated typed owner identity, not the three separate scalars.
• Confirm that the audit identity dimension exists in crates/openspine-schemas/src/audit.rs.
• If any of these are absent, stop and report that the implementation phases are not yet merged. The validation cannot proceed against an unchanged codebase.

Task 2: Run the local gate and capture failures

Run the same gate that CI runs and record every failure category.

• Run scripts/check.sh from the repository root.
• Record failures per stage: cargo fmt --check, clippy, the shell binary build, cargo test --workspace, the file-size cap, the threat-claims check, the OMP ceremony check, and openspec validate --all --strict.
• Note that scripts/check.sh builds openspine-shell before cargo test --workspace. The E2E test spawns the real binary. Keep this ordering when reproducing failures.
• For faster iteration on a single crate, use cargo test -p <crate> as the inner loop. Always confirm the final result through scripts/check.sh.

🤖 Prompt for AI agents

Implement Phase 1: confirm the typed owner identity change is present on the
working branch, then run the full local gate once to collect all failures.

First, verify the prior-phase code exists:
- Check that `TaskGrant.user` in `crates/openspine-schemas/src/grant.rs` and
`ApprovalRecord.approved_by` in `crates/openspine-schemas/src/approval.rs` use
the typed principal reference, not plain strings.
- Check that `AppState` in `crates/openspine-kernel/src/pipeline/mod.rs` uses
the consolidated typed owner identity instead of the three separate owner
scalars.
- Check that the audit identity dimension exists in
`crates/openspine-schemas/src/audit.rs`.
- If any of these checks fail, stop the process and report that the
implementation phases are not merged yet.

Then run the gate:
- Run `scripts/check.sh` from the repository root.
- Record failures per stage: `cargo fmt --check`, clippy, the `openspine-shell`
binary build, `cargo test --workspace`, the file-size cap check, the
threat-claims check, the OMP ceremony check, and `openspec validate --all
--strict`.
- Preserve the stage ordering used by `scripts/check.sh` (the shell binary
builds before `cargo test --workspace`, since the E2E test spawns the real
binary).
- Use `cargo test -p <crate>` for faster iteration on individual crates, but
always confirm final results via the full `scripts/check.sh` run.

Phase 2: Resolve gate failures introduced by the typed change

This phase fixes the compile, test, and lint failures that the type change causes. The typed field ripples through fixtures and call sites that previously used plain strings.

Task 1: Update gate crate test fixtures

Update the gate crate tests that construct owner fields as plain strings.

• Update crates/openspine-gate/src/gate/tests.rs where grant_with() and approval_for() set user and approved_by to "owner".
• Update crates/openspine-gate/src/gate/token_tests.rs where make_token() sets user and selected_by to "owner".
• Change these fixtures to build the typed principal reference from the schemas crate, matching the new field types.
• Keep the gate authorization logic unchanged. The gate does not read TaskGrant.user in its decision path, so only fixture construction needs adjustment.

Task 2: Update grant-chain and kernel test fixtures

Update the remaining tests that mutate or read the owner fields as strings.

• Update crates/openspine-schemas/src/grant_chain/tests.rs where tests mutate user as a plain string (for example g.user = "attacker".into()), so the mutation uses the typed reference.
• Update crates/openspine-kernel/src/pipeline/tests/driver.rs, which currently asserts grant.user against stringified owner scalars. Rework these assertions to check the typed principal reference, and remove the assertions that documented the old confusion.
• Update the worker and approval test fixtures that read parent.user or grant.user as strings (for example under crates/openspine-kernel/src/store/ and crates/openspine-authority/tests/).
• Update crates/openspine-kernel/src/test_support.rs and build_state_with_store if the consolidated owner identity changes the fixture wiring.

Task 3: Resolve clippy warnings and formatting

Bring clippy and formatting to a clean state.

• Run cargo clippy --workspace --all-targets -- -D warnings and fix every warning. -D warnings promotes each lint to a hard error.
• Address common lints from the type change, such as needless .to_string() conversions and redundant clones on the new typed reference.
• Run cargo fmt to satisfy cargo fmt --check.
• If any modified file in crates/**/*.rs exceeds 500 lines, split the file or add the // openspine:allow-large-module reason: <reason> header per the repository convention.

🤖 Prompt for AI agents

Implement Phase 2: fix the compile, test, and lint failures caused by the typed
owner identity change. The typed field ripples through fixtures and call sites
that previously used plain strings.

Update gate crate test fixtures:
- In `crates/openspine-gate/src/gate/tests.rs`, update `grant_with()` and
`approval_for()`, which set `user` and `approved_by` to `"owner"`.
- In `crates/openspine-gate/src/gate/token_tests.rs`, update `make_token()`,
which sets `user` and `selected_by` to `"owner"`.
- Change these fixtures to build the typed principal reference from the schemas
crate, matching the new field types.
- Keep the gate authorization logic itself unchanged, since the gate does not
read `TaskGrant.user` in its decision path; only fixture construction needs
adjustment.

Update grant-chain and kernel test fixtures:
- In `crates/openspine-schemas/src/grant_chain/tests.rs`, update tests that
mutate `user` as a plain string (for example `g.user = "attacker".into()`) to
use the typed reference instead.
- In `crates/openspine-kernel/src/pipeline/tests/driver.rs`, rework assertions
that check `grant.user` against stringified owner scalars so they check the
typed principal reference instead. Remove assertions that documented the old
confusion.
- Update worker and approval test fixtures that read `parent.user` or
`grant.user` as strings, including those under
`crates/openspine-kernel/src/store/` and `crates/openspine-authority/tests/`.
- Update `crates/openspine-kernel/src/test_support.rs` and
`build_state_with_store` if the consolidated owner identity changes the fixture
wiring.

Resolve clippy warnings and formatting:
- Run `cargo clippy --workspace --all-targets -- -D warnings` and fix every
warning, since `-D warnings` turns each lint into a hard error.
- Address common lints introduced by the type change, such as needless
`.to_string()` conversions and redundant clones on the new typed reference.
- Run `cargo fmt` to satisfy `cargo fmt --check`.
- If any modified file under `crates/**/*.rs` exceeds 500 lines, split the file,
or add the `// openspine:allow-large-module reason: <reason>` header, per
repository convention.

Phase 3: Validate strict gate behavior, E2E spawn, and claims

This phase confirms the runtime gate authorizes strictly, the Shell E2E test spawns, and the claims register stays valid. These are the acceptance conditions in the ticket.

Task 1: Validate the Shell E2E spawn

Confirm the real shell binary spawns and completes its task loop.

• Build the shell binary with cargo build -p openspine-shell --bin openspine-shell before running the test.
• Run terminal_owner_status_reaches_device_through_real_shell in crates/openspine-kernel/src/pipeline/tests/terminal_e2e.rs.
• Confirm the test emits exactly one task.shell_completed audit event and zero task.shell_failed events.
• Confirm the redacted TaskView wire shape is unchanged, because the shell consumes only TaskView and must stay insulated from the owner identity types.

Task 2: Validate strict gate authorization

Confirm the gate still authorizes fail-closed after the type change.

• Run the gate crate tests under crates/openspine-gate/, including gate/tests.rs, gate/plan_tests.rs, and gate/token_tests.rs.
• Confirm the deny-by-default precedence still holds: explicit deny over approval-required over allow over unspecified deny.
• Confirm approval digest binding, selection-token requirements, and caveat MAC checks still deny on mismatch.
• Confirm the identity invariant tests still pass: the D-006 no-authority-field checks in crates/openspine-schemas/src/identity.rs and principal.rs, and the single-owner and binding tests in crates/openspine-kernel/src/store/identity_tests.rs.

Task 3: Update the threat-claims register and confirm strict validation

Keep docs/threat-claims.md consistent and confirm the final strict validation passes.

• If the typed change added or renamed invariant tests (for example the audit identity dimension or the typed approver-of-record), update the test: rows in docs/threat-claims.md so each names a real test that appears in cargo test --workspace -- --list.
• Run scripts/check-claims.sh to confirm every claim maps to a real test.
• Run openspec validate --all --strict and confirm it passes, because this is the final strict validation stage of the gate.
• Do not create a new openspec/changes/ entry. The repository uses the GitHub-issue-native workflow, and OpenSpec is retired for new work.

Task 4: Run the full gate once more to confirm green

Confirm the complete gate passes end to end.

• Run scripts/check.sh again from a clean state.
• Confirm all stages pass: Node capability-map tests, cargo fmt --check, clippy with no warnings, the shell binary build, cargo test --workspace, the file-size cap, the claims check, the OMP ceremony check, and openspec validate --all --strict.
• Record the passing gate result as the ticket's completion evidence.

🤖 Prompt for AI agents

Implement Phase 3: confirm the runtime gate authorizes strictly, the Shell E2E
test spawns, and the claims register stays valid. These are the acceptance
conditions for the ticket.

Validate the Shell E2E spawn:
- Build the shell binary with `cargo build -p openspine-shell --bin
openspine-shell` before running the test.
- Run `terminal_owner_status_reaches_device_through_real_shell` in
`crates/openspine-kernel/src/pipeline/tests/terminal_e2e.rs`.
- Confirm the test emits exactly one `task.shell_completed` audit event and zero
`task.shell_failed` events.
- Confirm the redacted `TaskView` wire shape stays unchanged, since the shell
consumes only `TaskView` and must stay insulated from the owner identity types.

Validate strict gate authorization:
- Run the gate crate tests under `crates/openspine-gate/`, including
`gate/tests.rs`, `gate/plan_tests.rs`, and `gate/token_tests.rs`.
- Confirm the deny-by-default precedence still holds, in this order: explicit
deny, then approval-required, then allow, then unspecified deny.
- Confirm approval digest binding, selection-token requirements, and caveat MAC
checks still deny on mismatch.
- Confirm the identity invariant tests still pass: the D-006 no-authority-field
checks in `crates/openspine-schemas/src/identity.rs` and `principal.rs`, and the
single-owner and binding tests in
`crates/openspine-kernel/src/store/identity_tests.rs`.

Update the threat-claims register and confirm strict validation:
- If the typed change added or renamed invariant tests (for example, the audit
identity dimension or the typed approver-of-record), update the `test:` rows in
`docs/threat-claims.md` so each row names a real test that appears in `cargo
test --workspace -- --list`.
- Run `scripts/check-claims.sh` to confirm every claim maps to a real test.
- Run `openspec validate --all --strict` and confirm it passes, since this is
the final strict validation stage of the gate.
- Do not create a new `openspec/changes/` entry, since the repository uses the
GitHub-issue-native workflow and OpenSpec is retired for new work.

Run the full gate once more to confirm green:
- Run `scripts/check.sh` again from a clean state.
- Confirm all stages pass: Node capability-map tests, `cargo fmt --check`,
clippy with no warnings, the shell binary build, `cargo test --workspace`, the
file-size cap, the claims check, the OMP ceremony check, and `openspec validate
--all --strict`.
- Record the passing gate result as the completion evidence for the ticket.

Research

openspine is a Rust workspace. It has crates for schemas, kernel, authority, gate, and shell.

The single local gate is scripts/check.sh. The .github/workflows/ci.yml file mirrors this script 1:1.

The script runs these stages in order:

• Node capability-map tests
• cargo fmt --check
• cargo clippy --workspace --all-targets -- -D warnings
• An explicit cargo build -p openspine-shell --bin openspine-shell
• cargo test --workspace
• A 500-line file-size cap check
• A threat-claims check
• An OMP ceremony check
• openspec validate --all --strict

The Typed Owner Identity change comes from prior phases of ticket #197. This change replaces the stringly-typed owner fields with a typed principal reference. It touches these locations:

• TaskGrant.user in crates/openspine-schemas/src/grant.rs
• ApprovalRecord.approved_by in crates/openspine-schemas/src/approval.rs
• The three parallel owner scalars on AppState in crates/openspine-kernel/src/pipeline/mod.rs:145-147
• The audit identity dimension in crates/openspine-schemas/src/audit.rs
• Roughly 35 read/write sites across the kernel

The Shell E2E test terminal_owner_status_reaches_device_through_real_shell in crates/openspine-kernel/src/pipeline/tests/terminal_e2e.rs exercises the real shell binary over HTTP.

The openspine-gate crate authorizes fail-closed. It never inspects TaskGrant.user directly. Only its test fixtures hardcode "owner" strings.

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

Implement Phase 1: confirm the typed owner identity change is present on the
working branch, then run the full local gate once to collect all failures.

First, verify the prior-phase code exists:
- Check that `TaskGrant.user` in `crates/openspine-schemas/src/grant.rs` and
`ApprovalRecord.approved_by` in `crates/openspine-schemas/src/approval.rs` use
the typed principal reference, not plain strings.
- Check that `AppState` in `crates/openspine-kernel/src/pipeline/mod.rs` uses
the consolidated typed owner identity instead of the three separate owner
scalars.
- Check that the audit identity dimension exists in
`crates/openspine-schemas/src/audit.rs`.
- If any of these checks fail, stop the process and report that the
implementation phases are not merged yet.

Then run the gate:
- Run `scripts/check.sh` from the repository root.
- Record failures per stage: `cargo fmt --check`, clippy, the `openspine-shell`
binary build, `cargo test --workspace`, the file-size cap check, the
threat-claims check, the OMP ceremony check, and `openspec validate --all
--strict`.
- Preserve the stage ordering used by `scripts/check.sh` (the shell binary
builds before `cargo test --workspace`, since the E2E test spawns the real
binary).
- Use `cargo test -p <crate>` for faster iteration on individual crates, but
always confirm final results via the full `scripts/check.sh` run.
===============================================================================

Task: 2

Implement Phase 2: fix the compile, test, and lint failures caused by the typed
owner identity change. The typed field ripples through fixtures and call sites
that previously used plain strings.

Update gate crate test fixtures:
- In `crates/openspine-gate/src/gate/tests.rs`, update `grant_with()` and
`approval_for()`, which set `user` and `approved_by` to `"owner"`.
- In `crates/openspine-gate/src/gate/token_tests.rs`, update `make_token()`,
which sets `user` and `selected_by` to `"owner"`.
- Change these fixtures to build the typed principal reference from the schemas
crate, matching the new field types.
- Keep the gate authorization logic itself unchanged, since the gate does not
read `TaskGrant.user` in its decision path; only fixture construction needs
adjustment.

Update grant-chain and kernel test fixtures:
- In `crates/openspine-schemas/src/grant_chain/tests.rs`, update tests that
mutate `user` as a plain string (for example `g.user = "attacker".into()`) to
use the typed reference instead.
- In `crates/openspine-kernel/src/pipeline/tests/driver.rs`, rework assertions
that check `grant.user` against stringified owner scalars so they check the
typed principal reference instead. Remove assertions that documented the old
confusion.
- Update worker and approval test fixtures that read `parent.user` or
`grant.user` as strings, including those under
`crates/openspine-kernel/src/store/` and `crates/openspine-authority/tests/`.
- Update `crates/openspine-kernel/src/test_support.rs` and
`build_state_with_store` if the consolidated owner identity changes the fixture
wiring.

Resolve clippy warnings and formatting:
- Run `cargo clippy --workspace --all-targets -- -D warnings` and fix every
warning, since `-D warnings` turns each lint into a hard error.
- Address common lints introduced by the type change, such as needless
`.to_string()` conversions and redundant clones on the new typed reference.
- Run `cargo fmt` to satisfy `cargo fmt --check`.
- If any modified file under `crates/**/*.rs` exceeds 500 lines, split the file,
or add the `// openspine:allow-large-module reason: <reason>` header, per
repository convention.
===============================================================================

Task: 3

Implement Phase 3: confirm the runtime gate authorizes strictly, the Shell E2E
test spawns, and the claims register stays valid. These are the acceptance
conditions for the ticket.

Validate the Shell E2E spawn:
- Build the shell binary with `cargo build -p openspine-shell --bin
openspine-shell` before running the test.
- Run `terminal_owner_status_reaches_device_through_real_shell` in
`crates/openspine-kernel/src/pipeline/tests/terminal_e2e.rs`.
- Confirm the test emits exactly one `task.shell_completed` audit event and zero
`task.shell_failed` events.
- Confirm the redacted `TaskView` wire shape stays unchanged, since the shell
consumes only `TaskView` and must stay insulated from the owner identity types.

Validate strict gate authorization:
- Run the gate crate tests under `crates/openspine-gate/`, including
`gate/tests.rs`, `gate/plan_tests.rs`, and `gate/token_tests.rs`.
- Confirm the deny-by-default precedence still holds, in this order: explicit
deny, then approval-required, then allow, then unspecified deny.
- Confirm approval digest binding, selection-token requirements, and caveat MAC
checks still deny on mismatch.
- Confirm the identity invariant tests still pass: the D-006 no-authority-field
checks in `crates/openspine-schemas/src/identity.rs` and `principal.rs`, and the
single-owner and binding tests in
`crates/openspine-kernel/src/store/identity_tests.rs`.

Update the threat-claims register and confirm strict validation:
- If the typed change added or renamed invariant tests (for example, the audit
identity dimension or the typed approver-of-record), update the `test:` rows in
`docs/threat-claims.md` so each row names a real test that appears in `cargo
test --workspace -- --list`.
- Run `scripts/check-claims.sh` to confirm every claim maps to a real test.
- Run `openspec validate --all --strict` and confirm it passes, since this is
the final strict validation stage of the gate.
- Do not create a new `openspec/changes/` entry, since the repository uses the
GitHub-issue-native workflow and OpenSpec is retired for new work.

Run the full gate once more to confirm green:
- Run `scripts/check.sh` again from a clean state.
- Confirm all stages pass: Node capability-map tests, `cargo fmt --check`,
clippy with no warnings, the shell binary build, `cargo test --workspace`, the
file-size cap, the claims check, the OMP ceremony check, and `openspec validate
--all --strict`.
- Record the passing gate result as the completion evidence for the ticket.

💡 Iterate on the plan with: `@coderabbitai` <feedback>

Example Feedback
- `@coderabbitai` You can skip phase 3. Add a simple unit test case for phase 2.
- `@coderabbitai` For design choice 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord!

[George-RD]

Validated by the coordinator on integrated main at 4e2a316 (contains the full typed-owner-identity chain: #199 PR #235, #200 PR #245, #201 PR #250, #202 PR #254). ./scripts/check.sh exit 0 — fmt, clippy -D warnings (no warnings), cargo test --workspace green incl. the kernel E2E spawning the real openspine-shell binary, strict spec validation 45/45 passed. GitHub Actions CI remains the known-broken billing check and is non-blocking per repo convention. All five deliverables met; closing.