feat(wallet)!: the gate mints an owned SpendApproval; the signer accepts nothing else

Replace the summary-based custody seam with a ruling + owned-approval shape:

- `PolicyAuthorizer::authorize_op(&[CoinSpend], SpendOpClass) -> Result<SpendRuling>`
  derives the summary itself, so no caller-supplied description exists to disagree with.
- `SpendApproval` OWNS the exact coin spends it authorized. Not a digest binding: a
  comparison can compare the wrong bytes, an owned value cannot be mismatched.
- `SpendRuling::RequiresConfirmation` makes "not yet - ask the human" expressible, so a
  Confirm/Vault spend reaches the ceremony instead of collapsing into a refusal.

Removals do the enforcing (the additions are inert without them):
- `MoneySigner::sign_coin_spends` DELETED; `sign_approved` is the only signing entry point.
- `LocalMoneySigner::sign_unsigned` is now `pub(crate)`.
- The `SpendAuthorizer` trait DELETED - a custody gate must not be an interface whose
  simplest implementation approves everything.
- `AccountError::RequireAuth` DELETED: nothing can produce it now that escalation is a ruling.
- The tier-disagreement guard DELETED as vacuous - the gate classifies its own derivation.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: MichaelTaylor3d

src/error.rs

@@ -38,33 +38,34 @@ pub enum AccountError {
     #[error("spend refused: {0}")]
     Spend(String),
 
-    /// The spend policy declined to auto-approve, but a full human authorization ceremony MAY still
-    /// permit it. This is the ESCALATABLE refusal: a vault move, an over-limit hot-wallet spend, a
-    /// spend past the rolling period cap, or a spend whose op class is not auto-send-enabled.
+    /// The spend is FORBIDDEN by a structural custody rule, or the user declined it — no (further)
+    /// confirmation ceremony can permit it.
     ///
-    /// A caller that receives this MUST run the confirm ceremony (and, for a vault move, the
-    /// password-always unlock) before signing — never treat it as a soft pass.
-    #[error("spend requires explicit authorization: {0}")]
-    RequireAuth(String),
-
-    /// The spend is FORBIDDEN by a structural custody rule — no confirmation ceremony can permit it.
+    /// # The escalatable outcome is deliberately NOT an error
+    ///
+    /// "Not auto-approved, but a human could permit it" is
+    /// [`SpendRuling::RequiresConfirmation`](crate::wallet::approval::SpendRuling::RequiresConfirmation)
+    /// — an `Ok` value carrying a
+    /// [`PendingApproval`](crate::wallet::approval::PendingApproval) — never a variant here. When it
+    /// WAS an error variant (`RequireAuth`, removed in 0.2.0), the crate's only consumer collapsed
+    /// every `Err` into one refusal and the confirm ceremony became unreachable for exactly the tiers
+    /// that exist to require it. Every variant in this enum is now terminal for the spend, so
+    /// collapsing them can lose detail but can no longer lose a permission.
     ///
-    /// Distinct from [`RequireAuth`](Self::RequireAuth) precisely so a caller cannot escalate an
-    /// outright-forbidden spend into an approved one by prompting the user. The canonical case is a
-    /// vault outflow to anything other than the profile's own hot wallet (#1504: every vault outflow
-    /// MUST pass through the 24h clawback window, so it may only ever pay the hot wallet).
+    /// The canonical structural case is a vault outflow to anything other than the profile's own hot
+    /// wallet (#1504: every vault outflow MUST pass through the 24h clawback window, so it may only
+    /// ever pay the hot wallet).
     #[error("spend forbidden by custody policy: {0}")]
     PolicyDenied(String),
 
     /// The policy COULD NOT BE EVALUATED for this spend — the answer is unknown, not "no".
     ///
-    /// Kept separate from [`RequireAuth`](Self::RequireAuth) and
-    /// [`PolicyDenied`](Self::PolicyDenied) because collapsing "denied by policy" with "could not
-    /// determine policy" into one refusal loses the only signal that the gate is malfunctioning
-    /// (an unreadable clock, an undecodable recipient address, a spend whose value is denominated in
-    /// units no configured limit can bound, a summary whose declared tier disagrees with the profile's
-    /// custody policy). Every indeterminate outcome refuses the spend, and none of them is
-    /// escalatable — the condition must be fixed, not confirmed away.
+    /// Kept separate from [`PolicyDenied`](Self::PolicyDenied) because collapsing "denied by policy"
+    /// with "could not determine policy" into one refusal loses the only signal that the gate is
+    /// malfunctioning (an unreadable clock, an undecodable recipient address, a spend whose value is
+    /// denominated in units no configured limit can bound, a rolling window zero seconds long). Every
+    /// indeterminate outcome refuses the spend, and none of them is escalatable — the condition must be
+    /// fixed, not confirmed away.
     #[error("spend policy could not be evaluated: {0}")]
     PolicyIndeterminate(String),
 }
@@ -90,24 +91,18 @@ mod tests {
         assert!(e.to_string().contains("disk full"));
     }
 
-    /// The three custody refusals MUST stay distinguishable by variant, not only by message text: a
-    /// caller decides whether to escalate to a ceremony (`RequireAuth`), refuse outright
-    /// (`PolicyDenied`), or surface a malfunctioning gate (`PolicyIndeterminate`) by matching on the
-    /// variant.
+    /// The two custody refusals MUST stay distinguishable by variant, not only by message text: a
+    /// caller decides whether to refuse outright (`PolicyDenied`) or surface a malfunctioning gate
+    /// (`PolicyIndeterminate`) by matching on the variant. The third outcome — "ask the human" — is a
+    /// `SpendRuling`, not an error, and `spend_policy_has_no_escalatable_error_variant` pins that.
     #[test]
-    fn the_three_custody_refusals_are_distinct_variants_with_distinct_wording() {
-        let escalatable = AccountError::RequireAuth("over limit".into());
+    fn the_two_custody_refusals_are_distinct_variants_with_distinct_wording() {
         let forbidden = AccountError::PolicyDenied("vault outflow".into());
         let unknown = AccountError::PolicyIndeterminate("clock unreadable".into());
 
-        assert!(matches!(escalatable, AccountError::RequireAuth(_)));
         assert!(matches!(forbidden, AccountError::PolicyDenied(_)));
         assert!(matches!(unknown, AccountError::PolicyIndeterminate(_)));
 
-        assert_eq!(
-            escalatable.to_string(),
-            "spend requires explicit authorization: over limit"
-        );
         assert_eq!(
             forbidden.to_string(),
             "spend forbidden by custody policy: vault outflow"

src/lib.rs

@@ -1,70 +1,71 @@
-//! # dig-account
-//!
-//! The DIG Network **user Account** — the fat, strictly-logical (zero-UI, headless-testable)
-//! encapsulation of everything an account can do.
-//!
-//! An **Account** is one master seed plus one or more **Profiles** (exactly one default). A
-//! **Profile** is a DID + dig-store + SMT-of-profile-info (dig-social-profile's `IdentityProfile`),
-//! minted and signed with the account seed's key at that profile index.
-//!
-//! This crate owns the object model, the unlock policy + keystore crypto, the in-process
-//! identity+money signer, per-profile key/DEK derivation, the DID+dig-store mint, and all wallet
-//! ops. It NEVER draws UI or drives an OS auth ceremony — the host harness (dig-app) injects a
-//! UI/auth provider that this crate calls back through for unlock and spend-confirm ceremonies.
-//!
-//! ## Custody split (the harness seam)
-//!
-//! dig-account is headless: it owns the account STATE machine + the crypto, but it never collects a
-//! password, renders a spend prompt, or drives an OS auth ceremony. The host harness (dig-app)
-//! implements [`AuthProvider`](auth::provider::AuthProvider) and injects it; dig-account calls back
-//! through that seam for every unlock and every spend confirmation. The private key never leaves the
-//! crate; the UI never sees a seed.
-//!
-//! See `SPEC.md` for the normative contract.
-//!
-//! ## Phase 1 status
-//!
-//! This is the PUBLIC TYPE SURFACE cut: the object model, keystore (`store`), unlock policy
-//! (`auth::policy`), per-profile key/DEK derivation, and the money path (`wallet` — the canonical
-//! `WalletKey` + the concrete [`MoneySigner`](wallet::money_signer::LocalMoneySigner) over
-//! `dig-wallet-backend`'s `LocalSigner`, with the structured [`SpendSummary`](wallet::summary::SpendSummary))
-//! carry real, tested implementations. The identity-signer and mint modules still expose their FINAL
-//! public signatures with `todo!()` bodies, filled in a later phase.
-
-// Phase 1 stubs: several modules expose final signatures with `todo!()`/`unimplemented!()` bodies.
-#![allow(clippy::todo)]
-
-pub mod auth;
-pub mod error;
-pub mod id;
-pub mod keys;
-pub mod model;
-pub mod profile_mint;
-pub mod session;
-pub mod signer;
-pub mod store;
-pub mod unlocked;
-pub mod wallet;
-
-pub use auth::factors::AuthFactors;
-pub use auth::policy::{AllOf, AuthPolicy, PasswordOnlyPolicy, UnlockError, UnlockGate};
-pub use auth::provider::{AuthProvider, SpendConfirmRequest, SpendDecision, UnlockRequest};
-pub use auth::second_factor::SecondFactor;
-pub use error::{AccountError, Result};
-pub use id::{AccountId, ProfileIx};
-pub use keys::dek::profile_dek;
-pub use keys::wallet_key::WalletKey;
-pub use model::{Account, AccountRecord, Profile};
-pub use profile_mint::ProfileMinter;
-pub use session::AccountSession;
-pub use signer::ProfileSigner;
-pub use store::{AccountStore, AccountStoreError};
-pub use unlocked::UnlockedAccount;
-pub use wallet::authorizer::{SpendAuthorizer, WalletOps};
-pub use wallet::autosend::{AutoSendPolicy, OpClassLimits, SpendOpClass, DEFAULT_PERIOD_SECONDS};
-pub use wallet::clock::{Clock, FixedClock, SystemClock};
-pub use wallet::enforcer::PolicyAuthorizer;
-pub use wallet::money_signer::{LocalMoneySigner, MoneySigner};
-pub use wallet::policy::{CustodyPolicy, HotWallet, Vault};
-pub use wallet::summary::{SpendRecipient, SpendSummary, SpendTier};
-pub use wallet::vault_move::VaultMove;
+//! # dig-account
+//!
+//! The DIG Network **user Account** — the fat, strictly-logical (zero-UI, headless-testable)
+//! encapsulation of everything an account can do.
+//!
+//! An **Account** is one master seed plus one or more **Profiles** (exactly one default). A
+//! **Profile** is a DID + dig-store + SMT-of-profile-info (dig-social-profile's `IdentityProfile`),
+//! minted and signed with the account seed's key at that profile index.
+//!
+//! This crate owns the object model, the unlock policy + keystore crypto, the in-process
+//! identity+money signer, per-profile key/DEK derivation, the DID+dig-store mint, and all wallet
+//! ops. It NEVER draws UI or drives an OS auth ceremony — the host harness (dig-app) injects a
+//! UI/auth provider that this crate calls back through for unlock and spend-confirm ceremonies.
+//!
+//! ## Custody split (the harness seam)
+//!
+//! dig-account is headless: it owns the account STATE machine + the crypto, but it never collects a
+//! password, renders a spend prompt, or drives an OS auth ceremony. The host harness (dig-app)
+//! implements [`AuthProvider`](auth::provider::AuthProvider) and injects it; dig-account calls back
+//! through that seam for every unlock and every spend confirmation. The private key never leaves the
+//! crate; the UI never sees a seed.
+//!
+//! See `SPEC.md` for the normative contract.
+//!
+//! ## Phase 1 status
+//!
+//! This is the PUBLIC TYPE SURFACE cut: the object model, keystore (`store`), unlock policy
+//! (`auth::policy`), per-profile key/DEK derivation, and the money path (`wallet` — the canonical
+//! `WalletKey` + the concrete [`MoneySigner`](wallet::money_signer::LocalMoneySigner) over
+//! `dig-wallet-backend`'s `LocalSigner`, with the structured [`SpendSummary`](wallet::summary::SpendSummary))
+//! carry real, tested implementations. The identity-signer and mint modules still expose their FINAL
+//! public signatures with `todo!()` bodies, filled in a later phase.
+
+// Phase 1 stubs: several modules expose final signatures with `todo!()`/`unimplemented!()` bodies.
+#![allow(clippy::todo)]
+
+pub mod auth;
+pub mod error;
+pub mod id;
+pub mod keys;
+pub mod model;
+pub mod profile_mint;
+pub mod session;
+pub mod signer;
+pub mod store;
+pub mod unlocked;
+pub mod wallet;
+
+pub use auth::factors::AuthFactors;
+pub use auth::policy::{AllOf, AuthPolicy, PasswordOnlyPolicy, UnlockError, UnlockGate};
+pub use auth::provider::{AuthProvider, SpendConfirmRequest, SpendDecision, UnlockRequest};
+pub use auth::second_factor::SecondFactor;
+pub use error::{AccountError, Result};
+pub use id::{AccountId, ProfileIx};
+pub use keys::dek::profile_dek;
+pub use keys::wallet_key::WalletKey;
+pub use model::{Account, AccountRecord, Profile};
+pub use profile_mint::ProfileMinter;
+pub use session::AccountSession;
+pub use signer::ProfileSigner;
+pub use store::{AccountStore, AccountStoreError};
+pub use unlocked::UnlockedAccount;
+pub use wallet::approval::{PendingApproval, SpendApproval, SpendRuling};
+pub use wallet::authorizer::WalletOps;
+pub use wallet::autosend::{AutoSendPolicy, OpClassLimits, SpendOpClass, DEFAULT_PERIOD_SECONDS};
+pub use wallet::clock::{Clock, FixedClock, SystemClock};
+pub use wallet::enforcer::PolicyAuthorizer;
+pub use wallet::money_signer::{LocalMoneySigner, MoneySigner};
+pub use wallet::policy::{CustodyPolicy, HotWallet, Vault};
+pub use wallet::summary::{SpendRecipient, SpendSummary, SpendTier};
+pub use wallet::vault_move::VaultMove;