[antoinetoussaint-byte]

What we are trying to do

Close review r148 on #20 before the local authority wires Uninstall into a host. The wrapper PR, which comes next, is what exposes it.

The change (libraries/authority-core/go)

• M1. A module is withdrawn, never uninstalled.
  • Uninstall refuses a module's installation by name, as Install already refuses a module.
  • ApplyModule reactivates revoked module installations only on the tombstone path, that is, after a WithdrawModule.
  • An administrator's uninstall of a solution stays uninstalled across deliveries.
• m1. A tombstone holds its principal.
  • The Store contract gains TombstoneByPrincipal.
  • No other module can claim a withdrawn module's principal, and Install refuses one.
  • A tombstone is never cleared: a module that must change principal is delivered under a new name. This is documented on domain.Tombstone and on the Store contract.
• m2. Only an administrator learns what is installed.
  • Uninstall gives the foreign answer to anyone who is not a current administrator of the named organization, before any installation is read.
  • In every role call, a caller the store no longer knows belongs to no organization, so they get the foreign answer whatever their session says.
• m3. Issuance reports a store failure under the fence as the store failure, not as a refusal.

Size

52 hand-written non-test lines and 124 test lines.

Classification

This is a fix at the owner. It reuses decide.ForeignInstallation and the existing tombstone record; nothing new is added beside them.

Tests

• r148_test.go:
  • a module installation is never uninstalled, and a routine delivery reactivates nothing an administrator cut;
  • a tombstoned principal is never claimed, by a module or by an installation;
  • no one but an administrator tells a present installation from an absent one: a member uninstalling, and a deleted ex-member uninstalling or listing;
  • an issue reports a store outage as the outage.
• Each test was run against main's core and failed.
• sources_test.go: a member who administers nothing now gets the foreign answer.
• go vet and go test -race -count=1 with GOWORK=off pass in authority-core, hop, conformance and local/code.

🤖 Generated with Claude Code