Retype grant identity fields to PrincipalId (#200)

crates/openspine-authority/src/compose.rs

@@ -293,7 +293,7 @@ pub fn compose_authority(
         id: Ulid::new(),
         schema_version: 1,
         lifecycle_state: Lifecycle::Active,
-        user: input.principal_id.to_string(),
+        user: input.principal_id.into(),
         purpose: input.purpose.to_string(),
         issued_by: "kernel".to_string(),
         issued_at,

crates/openspine-authority/src/worker_grant.rs

@@ -228,7 +228,7 @@ mod worker_grant_tests {
             id: Ulid::new(),
             schema_version: 1,
             lifecycle_state: Lifecycle::Active,
-            user: "owner".to_string(),
+            user: Ulid::new().into(),
             purpose: "master-task".to_string(),
             issued_by: "kernel".to_string(),
             issued_at: now,

crates/openspine-gate/src/gate/tests.rs

@@ -26,7 +26,7 @@ pub(crate) fn grant_with(
         id: Ulid::new(),
         schema_version: 1,
         lifecycle_state: Lifecycle::Active,
-        user: "owner".to_string(),
+        user: Ulid::new().into(),
         purpose: "test".to_string(),
         issued_by: "kernel".to_string(),
         issued_at,

crates/openspine-gate/src/gate/token_tests.rs

@@ -46,9 +46,9 @@ fn make_token(id: Ulid, expires_at: Timestamp) -> SelectionToken {
         id,
         schema_version: 1,
         token_type: SelectionTokenType::email_thread_selection(),
-        user: "owner".to_string(),
+        user: Ulid::new().into(),
         target_id: "thread_abc123".to_string(),
-        selected_by: "owner".to_string(),
+        selected_by: Ulid::new().into(),
         selected_at: expires_at - std::time::Duration::from_secs(600),
         issued_by: "kernel".to_string(),
         expires_at,

crates/openspine-kernel/src/api/artifact_propose_miner_grouping_tests.rs

@@ -231,7 +231,7 @@ async fn scheduled_reflection_miner_duplicate_decision_event_is_not_repeated() {
         .state
         .store
         .load_owner_miner_audit_slice(
-            &harness.state.owner_principal_id.to_string(),
+            harness.state.owner_principal_id.into(),
             &crate::grant_hmac_key().unwrap(),
             &format!("reflection:{}", miner_grant.id),
             openspine_schemas::event::DataClassification::Private,

crates/openspine-kernel/src/api/artifact_propose_miner_tests.rs

@@ -95,7 +95,7 @@ async fn artifact_propose_accepts_miner_reflection_correction_route() {
         id: miner_id,
         schema_version: 1,
         lifecycle_state: Lifecycle::Active,
-        user: "owner".into(),
+        user: state.owner_principal_id.into(),
         purpose: "scheduled reflection miner".into(),
         issued_by: "kernel".into(),
         issued_at: now,
@@ -247,7 +247,7 @@ async fn reflection_miner_runtime_wires_ad135_route_through_lifecycle() {
         id: Ulid::new(),
         schema_version: 1,
         lifecycle_state: Lifecycle::Active,
-        user: state.owner_principal_id.to_string(),
+        user: state.owner_principal_id.into(),
         purpose: "scheduled reflection miner".into(),
         issued_by: "kernel".into(),
         issued_at: now,

crates/openspine-kernel/src/api/briefcase_tests.rs

@@ -27,7 +27,7 @@ fn mint_topup_grant(state: &AppState, allow_topup: bool) -> TaskGrant {
         id: Ulid::new(),
         schema_version: 1,
         lifecycle_state: Lifecycle::Active,
-        user: state.owner_user_id.to_string(),
+        user: state.owner_principal_id.into(),
         purpose: "briefcase_topup_test".to_string(),
         issued_by: "kernel".to_string(),
         issued_at: now,
@@ -285,7 +285,7 @@ fn minimal_grant() -> TaskGrant {
         "id": Ulid::new().to_string(),
         "schema_version": 1,
         "lifecycle_state": "active",
-        "user": "owner",
+        "user": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
         "purpose": "test",
         "issued_by": "kernel",
         "issued_at": "2026-01-01T00:00:00Z",

crates/openspine-kernel/src/api/dispatch_tests.rs

@@ -90,14 +90,14 @@ pub(crate) fn mint_grant_with_selection_token(
     token_expires_at: Timestamp,
 ) -> (TaskGrant, SelectionToken) {
     let now = Timestamp::now();
-    let user = state.owner_user_id.to_string();
+    let user: openspine_schemas::ids::PrincipalId = state.owner_principal_id.into();
     let token = SelectionToken {
         id: Ulid::new(),
         schema_version: 1,
         token_type: SelectionTokenType::email_thread_selection(),
-        user: user.clone(),
+        user,
         target_id: "thread-1".to_string(),
-        selected_by: user.clone(),
+        selected_by: user,
         selected_at: now,
         issued_by: "kernel".to_string(),
         expires_at: token_expires_at,

crates/openspine-kernel/src/api/generate_tests.rs

@@ -95,7 +95,7 @@ fn email_reply_drafter_grant(task_token: &str) -> TaskGrant {
         id: Ulid::new(),
         schema_version: 1,
         lifecycle_state: Lifecycle::Active,
-        user: "owner".to_string(),
+        user: Ulid::new().into(),
         purpose: "draft_email_reply".to_string(),
         issued_by: "kernel".to_string(),
         issued_at,

crates/openspine-kernel/src/api/overlay_export_restore.rs

@@ -42,7 +42,7 @@ fn require_root_owner_grant(
     grant: &TaskGrant,
     action: &ActionId,
 ) -> Result<(), DispatchError> {
-    if grant.user != state.owner_principal_id.to_string() {
+    if grant.user != openspine_schemas::ids::PrincipalId::from(state.owner_principal_id) {
         return Err(DispatchError::BadRequest(
             "overlay export/restore requires the configured owner principal".to_string(),
         ));
@@ -151,7 +151,7 @@ mod tests {
 
     fn mint_grant(
         state: &AppState,
-        user: String,
+        user: openspine_schemas::ids::PrincipalId,
         action: &str,
         parent: Option<Ulid>,
         chain_nonempty: bool,
@@ -239,7 +239,7 @@ mod tests {
         let action = ActionId::new(EXPORT_ACTION);
         let grant = mint_grant(
             &state,
-            state.owner_principal_id.to_string(),
+            state.owner_principal_id.into(),
             EXPORT_ACTION,
             None,
             false,
@@ -265,14 +265,14 @@ mod tests {
         let action = ActionId::new(RESTORE_ACTION);
         let grant = mint_grant(
             &state,
-            state.owner_principal_id.to_string(),
+            state.owner_principal_id.into(),
             RESTORE_ACTION,
             None,
             false,
         );
         let export_grant = mint_grant(
             &state,
-            state.owner_principal_id.to_string(),
+            state.owner_principal_id.into(),
             EXPORT_ACTION,
             None,
             false,
@@ -319,7 +319,7 @@ mod tests {
     async fn foreign_principal_is_rejected() {
         let state = test_state();
         let action = ActionId::new(EXPORT_ACTION);
-        let grant = mint_grant(&state, Ulid::new().to_string(), EXPORT_ACTION, None, false);
+        let grant = mint_grant(&state, Ulid::new().into(), EXPORT_ACTION, None, false);
         let payload = json!({"bundle_name": "backup-1"});
         let err = handle_overlay_export(
             &state,
@@ -340,7 +340,7 @@ mod tests {
         let parent = Ulid::new();
         let grant = mint_grant(
             &state,
-            state.owner_principal_id.to_string(),
+            state.owner_principal_id.into(),
             EXPORT_ACTION,
             Some(parent),
             true,
@@ -364,7 +364,7 @@ mod tests {
         let action = ActionId::new(EXPORT_ACTION);
         let grant = mint_grant(
             &state,
-            state.owner_principal_id.to_string(),
+            state.owner_principal_id.into(),
             EXPORT_ACTION,
             Some(Ulid::new()),
             true,
@@ -390,7 +390,7 @@ mod tests {
         let action = ActionId::new(RESTORE_ACTION);
         let grant = mint_grant(
             &state,
-            state.owner_principal_id.to_string(),
+            state.owner_principal_id.into(),
             RESTORE_ACTION,
             None,
             false,
@@ -443,7 +443,7 @@ mod tests {
         let action = ActionId::new(EXPORT_ACTION);
         let grant = mint_grant(
             &state,
-            state.owner_principal_id.to_string(),
+            state.owner_principal_id.into(),
             EXPORT_ACTION,
             None,
             false,

crates/openspine-kernel/src/api/scoped_admission_support.rs

@@ -150,14 +150,14 @@ pub(super) async fn drafts_written(server: &MockServer) -> usize {
 /// shape binds an identity-resolved counterparty.
 pub(crate) fn mint_draft_grant(state: &AppState, thread_id: &str) -> TaskGrant {
     let now = Timestamp::now();
-    let user = state.owner_user_id.to_string();
+    let user: openspine_schemas::ids::PrincipalId = state.owner_principal_id.into();
     let token = SelectionToken {
         id: Ulid::new(),
         schema_version: 1,
         token_type: SelectionTokenType::email_thread_selection(),
-        user: user.clone(),
+        user,
         target_id: thread_id.to_string(),
-        selected_by: user.clone(),
+        selected_by: user,
         selected_at: now,
         issued_by: "kernel".to_string(),
         expires_at: now + Duration::from_secs(300),

crates/openspine-kernel/src/api/task.rs

@@ -123,7 +123,7 @@ mod tests {
             id: Ulid::new(),
             schema_version: 1,
             lifecycle_state: Lifecycle::Active,
-            user: "owner".to_string(),
+            user: Ulid::new().into(),
             purpose: "w".to_string(),
             issued_by: "kernel".to_string(),
             issued_at: now,

crates/openspine-kernel/src/api/worker.rs

@@ -396,7 +396,7 @@ pub(crate) fn handle_worker_commission<'a>(
         // AD-102: address this worker by identity tuple, never by process
         // handle. Derived from trusted grant context.
         let identity = WorkerIdentity {
-            owner: grant.user.clone(),
+            owner: grant.user.to_string(),
             conversation: grant
                 .thread_id
                 .clone()

crates/openspine-kernel/src/briefcase/tests.rs

@@ -2,7 +2,7 @@ use super::*;
 use openspine_schemas::briefcase::{RelationshipTier, TopUpOutcome};
 use openspine_schemas::identity::RelationshipKind;
 fn grant_with(id: &str, event_id: &str, token: &str) -> TaskGrant {
-    serde_json::from_value(serde_json::json!({"id":id,"schema_version":1,"lifecycle_state":"active","user":"owner","purpose":"test","issued_by":"kernel","issued_at":"2026-01-01T00:00:00Z","expires_at":"2030-01-01T00:00:00Z","event_id":event_id,"route_id":"route","agent_id":"agent","workflow_id":"workflow","capability_pack_id":"pack","allowed_actions":[],"approval_required_actions":[],"denied_actions":[],"output_channels":[],"limits":{"max_model_calls":1,"max_artifacts":1,"max_runtime_seconds":1},"task_token":token,"root_grant_id":id,"parent_grant_id":null,"mode":"live","chain":[],"caveat_mac":""})).unwrap()
+    serde_json::from_value(serde_json::json!({"id":id,"schema_version":1,"lifecycle_state":"active","user":"01ARZ3NDEKTSV4RRFFQ69G5FAV","purpose":"test","issued_by":"kernel","issued_at":"2026-01-01T00:00:00Z","expires_at":"2030-01-01T00:00:00Z","event_id":event_id,"route_id":"route","agent_id":"agent","workflow_id":"workflow","capability_pack_id":"pack","allowed_actions":[],"approval_required_actions":[],"denied_actions":[],"output_channels":[],"limits":{"max_model_calls":1,"max_artifacts":1,"max_runtime_seconds":1},"task_token":token,"root_grant_id":id,"parent_grant_id":null,"mode":"live","chain":[],"caveat_mac":""})).unwrap()
 }
 fn grant() -> TaskGrant {
     grant_with(

crates/openspine-kernel/src/connectors_tests.rs

@@ -110,7 +110,7 @@ mod tests {
             id: Ulid::new(),
             schema_version: 1,
             lifecycle_state: Lifecycle::Active,
-            user: "owner".to_string(),
+            user: Ulid::new().into(),
             purpose: "test".to_string(),
             issued_by: "kernel".to_string(),
             issued_at,
@@ -251,7 +251,7 @@ mod tests {
             id: Ulid::new(),
             schema_version: 1,
             lifecycle_state: Lifecycle::Active,
-            user: "owner".to_string(),
+            user: Ulid::new().into(),
             purpose: "test".to_string(),
             issued_by: "kernel".to_string(),
             issued_at,

crates/openspine-kernel/src/escalation.rs

@@ -115,7 +115,7 @@ mod tests {
             id,
             schema_version: 1,
             lifecycle_state: Lifecycle::Active,
-            user: "owner".into(),
+            user: ulid::Ulid::new().into(),
             purpose: "test".into(),
             issued_by: "kernel".into(),
             issued_at: now,

crates/openspine-kernel/src/overlay_export_restore/control.rs

@@ -157,7 +157,7 @@ impl OverlayControl {
             BundleName::parse(bundle_name)?,
             OperationAuthorization {
                 action_id: action.to_string(),
-                owner_principal_id: grant.user.clone(),
+                owner_principal_id: grant.user.to_string(),
                 grant_id: grant.id.to_string(),
                 request_id: Ulid::new().to_string(),
                 requested_at: now.to_string(),

crates/openspine-kernel/src/overlay_export_restore/control_tests.rs

@@ -23,7 +23,7 @@ fn grant(user: &str) -> TaskGrant {
         id,
         schema_version: 1,
         lifecycle_state: openspine_schemas::artifact::Lifecycle::Active,
-        user: user.to_owned(),
+        user: crate::test_support::principal(user),
         purpose: "overlay-control-test".into(),
         issued_by: "kernel".into(),
         issued_at: now,

crates/openspine-kernel/src/overlay_export_restore/control_tests/portability.rs

@@ -64,7 +64,7 @@ fn portable_restore_accepts_fresh_destination_owner_id_and_preserves_request() {
     let source_req = crate::overlay_export_restore::bundle::BundleRequestMetadata {
         request_id: export_op.request_id().to_owned(),
         action_id: EXPORT_ACTION.into(),
-        owner_principal_id: "alice_owner".into(),
+        owner_principal_id: alice_grant.user.to_string(),
         grant_id: alice_grant.id.to_string(),
         requested_at: export_op.requested_at().to_owned(),
     };
@@ -117,13 +117,13 @@ fn portable_restore_accepts_fresh_destination_owner_id_and_preserves_request() {
         )
         .unwrap();
 
-    assert_eq!(restore_op.owner_principal_id(), "bob_destination_owner");
+    assert_eq!(restore_op.owner_principal_id(), bob_grant.user.to_string());
     let saved_source_req = restore_op.source_bundle_request().unwrap();
     assert_eq!(
         saved_source_req,
         &OperationAuthorization {
             action_id: EXPORT_ACTION.into(),
-            owner_principal_id: "alice_owner".into(),
+            owner_principal_id: alice_grant.user.to_string(),
             grant_id: alice_grant.id.to_string(),
             request_id: export_op.request_id().to_owned(),
             requested_at: export_op.requested_at().to_owned(),

crates/openspine-kernel/src/overlay_export_restore/operation_tests/mod.rs

@@ -41,7 +41,7 @@ pub(super) fn grant(user: &str, action: &str) -> TaskGrant {
         id,
         schema_version: 1,
         lifecycle_state: openspine_schemas::artifact::Lifecycle::Active,
-        user: user.to_owned(),
+        user: crate::test_support::principal(user),
         purpose: "overlay-operation-test".into(),
         issued_by: "kernel".into(),
         issued_at: now,

crates/openspine-kernel/src/overlay_export_restore/operation_tests/regressions.rs

@@ -91,20 +91,21 @@ fn regression_stale_valid_bundle_metadata_mismatch_rejected() {
     }
 
     let ops4 = acquire(&data3, KEY).unwrap();
+    let restore_grant = grant("other_user", RESTORE_ACTION);
     let staged = ops4
         .stage_export_or_restore(
-            &grant("other_user", RESTORE_ACTION),
+            &restore_grant,
             &ActionId::new(RESTORE_ACTION),
             "bundle-owner-test",
             Timestamp::now(),
         )
         .unwrap();
-    assert_eq!(staged.owner_principal_id(), "other_user");
+    assert_eq!(staged.owner_principal_id(), restore_grant.user.to_string());
     let pending4 = ops4
         .process_pre_open(false, Timestamp::now())
         .expect("authenticated source request must verify")
         .expect("restore pending");
-    assert_eq!(pending4.owner_principal_id, "other_user");
+    assert_eq!(pending4.owner_principal_id, restore_grant.user.to_string());
     finalize_ok(&ops4, pending4);
 }
 

crates/openspine-kernel/src/overlay_startup_tests.rs

@@ -56,7 +56,7 @@ fn grant(user: &str) -> TaskGrant {
         id,
         schema_version: 1,
         lifecycle_state: openspine_schemas::artifact::Lifecycle::Active,
-        user: user.to_owned(),
+        user: crate::test_support::principal(user),
         purpose: "overlay-startup-test".into(),
         issued_by: "kernel".into(),
         issued_at: now,

crates/openspine-kernel/src/pipeline/approval.rs

@@ -98,7 +98,9 @@ pub(super) async fn handle_draft_approval_callback(
             .as_ref()
             .is_none_or(|(grant, _, _)| grant.is_expired(Timestamp::now()));
         if refresh {
-            if let Some(grant) = super::mint_reconfirm_grant(request.task_grant_id) {
+            if let Some(grant) =
+                super::mint_reconfirm_grant(request.task_grant_id, state.owner_principal_id)
+            {
                 if existing.is_some() {
                     state.store.refresh_task_grant(&grant)?;
                 } else {

crates/openspine-kernel/src/pipeline/message_notify.rs

@@ -43,7 +43,7 @@ pub(crate) async fn notify_owner_with_digest(
         return NotifyOutcome::SurfaceUnsupported;
     }
     let now = Timestamp::now();
-    let Some(notify_grant) = kernel_notify_grant() else {
+    let Some(notify_grant) = kernel_notify_grant(state.owner_principal_id) else {
         record_notify_skipped(state, "notify grant unavailable (HMAC key unset)");
         tracing::warn!("OPENSPINE_GRANT_HMAC_KEY unset; refusing owner.notify (fail-closed)");
         return NotifyOutcome::GateUnavailable;
@@ -326,14 +326,14 @@ pub(crate) async fn notify_owner_best_effort(
 /// `ActionOrigin::Kernel` auto-allows only the trusted-origin set. Returns
 /// `None` when the HMAC key is unavailable — callers must skip the effect
 /// (fail-closed), not present an unsealed grant to `gate()`.
-fn kernel_notify_grant() -> Option<TaskGrant> {
+fn kernel_notify_grant(owner_principal_id: Ulid) -> Option<TaskGrant> {
     let key = crate::grant_hmac_key()?;
     let now = Timestamp::now();
     let mut grant = TaskGrant {
         id: Ulid::new(),
         schema_version: 1,
         lifecycle_state: Lifecycle::Active,
-        user: "kernel".to_string(),
+        user: owner_principal_id.into(),
         purpose: "owner-notify".to_string(),
         issued_by: "kernel".to_string(),
         issued_at: now,