[antoinetoussaint-byte]

What we are trying to do

This is step 2b of the solution-principal work (spec #11, #14). The core's decisions landed in #18. This PR adds the core's state layer: the transactional Store that both hosts implement, an in-memory store, the seal, epoch and revision sources that core's verifier reads, and the role and lifecycle operations that move them. Issuance builds on it in the next PR, which I open from main once this one merges, as split per r137 (m5). saas is untouched.

The change

libraries/authority-core/go:

• authority/store.go: the Store (Read, Write) and Tx contract.
  • Write is all or nothing.
  • An adapter that gives up on a serialization conflict reports ErrConflict.
• memstore: the in-memory store. Write undoes a failing transaction's writes.
• authority/service.go: New(store, Config). The host injects the signer, the keys, the clock, the id sources and the replay store. Replay is required: nothing defaults to memory.
  • The seal sources live here.
  • A seal's revision is the installation's revision, plus the owner's grant epoch on it, plus the solution's owner-aware revision. Each term only grows and is keyed stably, so the sum never repeats. This invariant is documented and tested.
  • An installation principal's epoch is the installation's revision. It grows on every install and uninstall.
• authority/roles.go:
  • GrantRole moves nothing.
  • RevokeRole moves the subject's grant epoch on that installation.
  • ListRoleGrants.
  • PersonChanged moves the person's epoch.
  • The installation is resolved by (organization, id), and a foreign or absent installation gets the same answer.
• authority/lifecycle.go:
  • ApplyModule: a narrowing or an owner-aware withdrawal invalidates earlier capabilities. A module keeps its principal for life, and a principal never names a person or an installed solution's principal.
  • WithdrawModule.
  • Install: pending until its step converges. The host's own setup resumes a pending attempt.
  • Uninstall(caller, organization, id): an administrator's act. It moves its organization's authorization revision and clears the installation's grants. A foreign installation is answered as an absent one.
  • Installations.

Also in this PR:

• CI: .github/workflows/clients.yml runs the Python and TypeScript readers.
• hop: requires the client at main's merge commit f688c549.
• Local service module: tidied for that bump.

r132 and r137

• r132 m1, m2, m4, m5: fixed (x61).
• r137 here: B2, B3, M1, M2, m2, m3, m6 and m7, recorded against r137.
• r137 in the issuance PR: B1 (the issue/revoke race), m1 (IssueForInstallation's foreign answer) and m4 (Check verifying before it reads). That PR also carries token-level tests for B2 and M1.

Size

1,136 hand-written non-test lines (370 of them the in-memory store) and 581 test lines, under the ~2,000 budget.

Reuse and classification

• Every decision is decide's, from feat: the authority core's decisions, and readers that honour resource owners #18.
• The seal, epoch, binding and revision sources implement the existing core interfaces.
• This is a fix at the owner.

Tests

• go vet and go test -race -count=1 ./... with GOWORK=off pass in libraries/authority-core/go, libraries/hop/go, libraries/conformance/go and modules/authority/services/local/code.
• Source-level tests (sources_test.go):
  • a reinstall never repeats the principal's epoch;
  • an uninstall moves its organization's revision and no other;
  • an uninstall is an administrator's act, and a foreign installation is answered as an absent one;
  • the seal revision never repeats across revoke, narrowing, owner-aware withdrawal, uninstall and reinstall;
  • a module's principal is its own for life;
  • the replay store is required;
  • a failed write leaves nothing;
  • a revoke moves only its subject's seal on that installation;
  • a team revoke moves its members' seals, and a leave moves the person's epoch;
  • a revoked grant stays gone across a reinstall and a role declared again.
• I re-ran each r137 test with its fix reverted, and each failed.

🤖 Generated with Claude Code