feat(kernel): fail closed on empty or misconfigured dark-window Allow allowlist (#135)

[George-RD]

What

Hardens the dark-window Allow eligibility predicate so token minting fails
closed when the allowlist is empty or misconfigured (#135 AC).

Previously dark_window_allow_eligible was bare allowlist membership
(allowlist.contains(action)). The allowlist is deliberately empty, so the
empty case already failed closed — but a misconfigured entry naming a
communication or connector-write effect (e.g. email.send) would have been
permitted at activation, violating D-146. The "permitted" branch was also
untested.

Change

• action_catalog_contracts.rs: two-axis, fail-closed decision. An action is
  eligible only if it is on the (empty) allowlist AND the catalog certifies
  it is_approval_narrowing — the existing, reviewed classification for actions
  that "reach no connector, write nothing, communicate with nobody".
• Positive safety boundary, not effect inference: secret.rotate,
  policy.modify_direct, coolify.deploy, filesystem.host_write all declare
  no egress class / output channel, so an inference would miss them; requiring
  approval-narrowing certification fails every un-cleared id closed.
• Whole-list validation: a misconfigured allowlist (any uncertified entry) fails
  closed for every action, not just the bad entry, via the new pure, total
  dark_window_allow_eligibility(action, allowlist, certified_safe) -> Eligible | NotAllowlisted | Misconfigured.
• Tests: pure empty / filled / misconfigured decision test, plus a
  safety-boundary completeness test.

Why enforcement stays where it is

Enforcement remains at the activation guard (dark_window_allow_rejection) and
the startup sweep (sweep_ineligible_dark_window_allow_rules) — both already
consult this predicate, so hardening it hardens both. No mint-boundary
(claim/consume/recovery) re-check was added: it breaks the settled
legacy-install machinery tests, would need a #[cfg(test)] seam that collides
with the cardinality-pinned catalog tests, touches dev-172's fired-token
erasure surface, and duplicates the activation+sweep design. Production
behavior is unchanged (allowlist empty); no existing test changes.

Verification

• ./scripts/check.sh passes (fmt, clippy -D warnings, workspace tests,
  OpenSpec strict-validate) on the rebased HEAD.
• New tests pass; full openspine-kernel standing-rule + catalog suites green.
• Rebased on latest origin/main.

Implementation notes (five-line summary)

• Bound dark-window exceptions so silence cannot amplify standing-rule authority #135's bulk already landed via merged PR feat(kernel): bound dark-window exceptions so silence cannot amplify authority (#135) #164; issue left open, re-scoped to
  the narrow Allow-allowlist fail-closed AC.
• Real gap was the misconfigured allowlist branch (bare .contains) and the
  untested "permitted" path — both now closed.
• Fix is a two-axis predicate (allowlist AND approval-narrowing), whole-list
  fail-closed, enforced at the existing activation guard + startup sweep.
• Mint-boundary re-checks were deliberately not added (test-seam churn,
  dev-172 overlap, redundant over activation+sweep).
• Open question for review: pre-Bound dark-window exceptions so silence cannot amplify standing-rule authority #135 DBs with already-allowed undispatched
  rows for now-ineligible actions are an upgrade-path edge left out of scope.

Closes #135

---

Summary by cubic

Fail closed when the dark-window Allow allowlist is empty or misconfigured to prevent effectful actions from minting. Previously, eligibility was bare allowlist membership; now, actions must be on the allowlist and be catalog-certified approval-narrowing, and any uncertified allowlist entry misconfigures the list and blocks all minting.

• Introduces a pure, total predicate dark_window_allow_eligibility(action, allowlist, certified_safe) -> Eligible | NotAllowlisted | Misconfigured, and updates dark_window_allow_eligible to use it.
• Uses a memoized canonical catalog via LazyLock to derive the certified-safe subset; the allowlist remains empty.
• Enforcement stays at the activation guard and startup sweep; no mint-boundary re-check was added.
• Adds tests for empty/filled/misconfigured lists and for safety-boundary completeness (e.g., email.send, secret.rotate, filesystem.host_write stay uncertified).
• Production behavior is unchanged; no migration required. Note: pre-Bound dark-window exceptions so silence cannot amplify standing-rule authority #135 databases with already-allowed, undispatched rows are out of scope for this PR.

^{Written for commit 148703e. Summary will update on new commits.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e509c3e2-b13e-4d30-b3d5-37c6f8cfbc56

📥 Commits

Reviewing files that changed from the base of the PR and between 733dc5d and 148703e.

📒 Files selected for processing (2)

• crates/openspine-kernel/src/action_catalog_contracts.rs
• crates/openspine-kernel/src/action_catalog_tests.rs

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes

  • Improved dark-window Allow eligibility using explicit allowlists and catalog-certified safe actions.
  • Misconfigured allowlists now fail closed, preventing unlisted or uncertified actions from being allowed.
  • Added clearer eligibility outcomes for allowed, unlisted, and misconfigured actions.

• Tests

  • Added coverage for valid, empty, and misconfigured allowlists, including actions with external effects.

Walkthrough

Dark-window Allow eligibility now combines explicit allowlist membership with canonical catalog safety certification. Misconfigured allowlists fail closed for all actions. Tests cover eligibility outcomes and safety boundaries.

Changes

Dark-window Allow hardening

Layer / File(s)	Summary
Eligibility contract and catalog certification crates/openspine-kernel/src/action_catalog_contracts.rs	Adds explicit eligibility outcomes and a pure decision helper. dark_window_allow_eligible now requires allowlist membership and catalog certification. Canonical catalog access is memoized.
Eligibility and safety-boundary tests crates/openspine-kernel/src/action_catalog_tests.rs	Tests empty, valid, and misconfigured allowlists. Tests confirm that external-effect actions are not certified safe, while openspine.status.read and connector.enable are certified candidates.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Poem

I’m a rabbit guarding the gate,
Allowlisted hops must certify their fate.
Misconfigured paths stay closed,
Safe catalog marks are disclosed.
No effectful leap slips through—
Thump, test, and approval too!

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch George-RD/dev-135

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}