Repository navigation
feat: the grant permission (manage:grant) and subject-mode conditions - #327
Merged
Merged
Conversation
A manage:grant capability authorises its bearer to mint other capability tokens; the mint cites its authoriser through a new authorised-by claim whose obligations include evaluating the authoriser's conditions against the minted child's claims, so an issuer can bar the holder from granting to itself. The chain-root rule is stated for every scope kind, and the registry gains manage:grant.
The authorised-by link is checked in the token walk (bearer, verb, scope and expiry narrowing, one delegations-remaining hop, subject-mode conditions against the child) and at mint time, with canGrantVia as the pure query. Subject mode registers grantee-is and granted-capability-is, and the walk gains a depth bound and cycle guard.
authorised-by, grants-capability and a typed delegations-remaining join TokenClaims so none can fall into the extension tail unchecked, with a round-trip test covering all three at once.
The predicate subset gains strict-Kleene not/and/or (the shape of the no-self-grant bars) and two delegate systems, grantee-is and granted-capability-is, which resolve against the minted child a grant-capability's conditions bind and are indeterminate without one.
The iterative walk tracks which claim links each pair of tokens, upholds the authorisation obligations (bearer, manage:grant verb, grants-capability, scope and expiry narrowing, one delegations-remaining hop, subject-mode conditions against the minted child) and closes the gap that left delegations-remaining unchecked on parent links. Tests mirror the TypeScript matrix.
A manage:grant root with the no-self-grant bar in its conditions, an exec:pty mint authorised by it, and a second-level grant-capability passed onward, pinning the claims' wire shape across implementations.
…r own module generate.ts is at the max-lines cap, so the new grant-permission vectors and the room:member chain they sit beside live in token-vectors.ts, with everything they share with generate.ts handed over explicitly. The regenerated vector files are byte-identical.
Mearman
force-pushed
the
feat/grant-permission
branch
from
October 1, 2026 17:21
18d0963 to
49272b9
Compare
Mearman
marked this pull request as ready for review
October 1, 2026 17:31
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements #323: a manage:grant capability authorises its bearer to mint other capability tokens; the minted token cites its authoriser via a new authorised-by claim, and the authoriser's trilean conditions are evaluated against the minted child's claims at verify time, so an issuer can bar the holder from granting the permission or the underlying capability to itself. The chain-root rule is generalised to every scope kind. Rust parity (typed delegations-remaining, predicate subset with not/and and subject-bearing delegates, the authorised-by walk) and conformance vectors follow on this branch before it leaves draft. Refs #323.