fix(solid): route every ODRL bridge grant through sparq-policy's decision

[jeswr]

Summary

Stacked on #6734 (review that first; this PR's diff is the bridge and the decision's grant token).

Before: sparq-solid wrote grants the evaluator had not settled.

• The conditional ACP materialiser persisted recipient, assignee and dateTime constraints as auth:ConditionalGrant heads re-checked per session. A head re-checks identity and clock but not the rest of the decision, so it admitted sessions decide denies: a prohibition on another party or at a later time, an assignee and a recipient that must both hold, two recipient constraints read as alternatives, and a duty with its own constraint counted as discharged by action alone.
• Its one-shot fallback, and the one-shot path itself, stored a triple that outlived the decision: a permission valid until a date, or a prohibition that opens later, still granted after that time.
• A grant could name a wildcard principal (auth:Public as the request party), or a party other than the recipient the decision checked.
• The N3 materialiser granted when a prohibition lacked evidence (a dateTime lteq prohibition with no clock).

After: the bridge stores only grants that depend on nothing that can change. This is fail-closed and drops opt-in odrl-bridge behaviour, which no published artifact contains: any constrained grant (recipient, assignee context, time window, purpose, place, count), any grant from a policy that has a prohibition, and any grant decided with membership evidence is no longer stored. Counted access stays available per request through evaluate_and_exercise. The server's ODRL query lane and the wac-oracle window corpus deny those cases now, as intended. Restoring them soundly needs per-request evaluation through decide in the enforcement path, tracked in #6743.

• Every allow comes from the Permit decide issued for that exact request, and the triple carries exactly its party, mapped action and target. One-shot, policy, counted, refresh and N3 allows all go through one emitter.
• The emitter refuses a party that is not a single agent (auth:Public, auth:Authenticated, a reserved encoding), a permit whose checked recipient is not the party, and a permit that is not lasting(). lasting() holds for exactly one shape: a permission with no constraints, logical constraints or duties, assigned to exactly the requesting party (a named IRI, not a declared party collection), targeting exactly the requested asset or every asset, decided without party or asset membership evidence, in a policy with no prohibitions.
• Policy::validate refuses two rules sharing an id, so the count guard and a permit always name one rule.
• base_decision (count feature) is the count-free decision evaluate_and_exercise grants on; a grant from a count-limited permission is not lasting there, so the counted bridge refuses it before spending budget.
• The counted path checks the base permit for storability before the atomic exercise, so a grant the bridge refuses spends no usage unit.
• decide denies a request whose party was changed after Request::by, so a permit never names a party other than the one whose recipient evidence was checked.
• materialize_permission_conditional now stores the same one-shot grant. The conditional allow code, decide_conditional and ConditionalPermit are removed. Conditional denies are unchanged.
• contains returns Unknown when either policy's conflict strategy is one decide refuses.
• The N3 path keeps a derived grant only when it is exactly the permit's.
• The unset odrl:conflict default stays deny-overrides, as decided in odrl-bridge: unset odrl:conflict defaults to prohibit, not the ODRL spec default of invalid (follow-up to sq-ihqbl) #1375; the skill now states that this lets an uncontested permission in an otherwise conflicting policy grant, where ODRL's invalid would void it.

Base gate (always required)

• cargo build --workspace succeeds.
• cargo clippy -p sparq-policy -p sparq-solid -p sparq-lws-core -p sparq-server --all-features --all-targets -- -D warnings is clean.
• The touched lines are formatted.
• cargo test passes for sparq-policy (all features), sparq-solid (default, odrl-bridge, all features), sparq-lws-core, sparq-trust, sparq-wac-oracle and sparq-server.
• odrl_n3_failopen_regression::defect1_two_operand… (failing on main since fix(policy,reason): fail closed on ambiguous ODRL constraints and hostile RIF/XML input #6657 made the parser refuse the node) now asserts that refusal. Known failure, identical on main: sparq-lws-core redis_replay::mark_fails_closed_when_redis_errors (needs a Redis service).
• tests/odrl_decision_entry_points.rs runs 9 undecidable shapes × permission/prohibition × atomic/and/or/xone through every grant entry point (evaluate, the one-shot, policy and conditional materialisers, N3, and a ledger replay of a grant live before the policy changed), plus the constrained-duty and no-clock-prohibition counterexamples and a decidable control.
• Policy tests: only_an_unconstrained_grant_to_the_named_party_is_lasting enumerates every ODRL left operand (atomic, inside or, and on a prohibition), every prohibition shape, every assignee shape (none, membership, declared collection, membership evidence, asset membership) and a discharged duty, and only the one shape is lasting; duplicate_rule_ids_are_refused; the permit binds the checked recipient; containment under a refused conflict strategy. Bridge tests: constrained, purpose-scoped, windowed and prohibition-carrying policies store nothing for anyone; bridge/decide parity per agent with an unconstrained control; a wildcard party is never granted. Count tests: a count-limited grant is never stored and spends nothing, while evaluate_and_exercise still grants N times. N3 differential grant floors are the exact counts (N3 3, Rust 4). Server odrl_authz lane equals a lasting decide grant and is never wider than evaluate; wac-oracle window corpus expects carol denied at every instant.
• Tests for the removed conditional-allow heads are deleted; the deny tests that layered on a public allow now get it from a static WAC rule.

Targeted re-evaluation (check the rows that apply to your change)

• Policy evaluation: decide adds the party/recipient consistency check and the lasting flag; no other rule changes.

Ratchets and conventions

• I did not lower any ratchet. The N3 differential sweep's N3-grant non-vacuity floor moves from 20 to 10 because three clock-bounded shape families (nine cases) no longer store a grant; the Rust-grant, deny, refusal and total floors are unchanged.
• No hard-coded performance numbers added to markdown.

Security

• Closes the grant-widening paths in the ODRL bridge listed above. All changes are toward deny.

🤖 Generated with Claude Code

https://claude.ai/code/session_01C1gMf8RJim1LzuKapZNpZR

---

Generated by Claude Code

[jeswr]

🔎 Codex reviewer — gpt-6.1-sol

Automated review by the Codex reviewer (OpenAI gpt-6.1-sol via Codex CLI) of head 574e6c2268af. Scope: correctness, security, soundness and design; style nits omitted. A new head gets a fresh review.

Findings

1. [high] ConditionalPermit does not settle prohibitions across sessions — crates/sparq-policy/src/eval.rs:630
   The new API checks prohibitions against the materialization request, then issues a permit whose identity and time remain open. For example, a policy permitting everyone to read a target but prohibiting Bob passes decide_conditional for Alice. The bridge emits a public conditional allow, and Bob subsequently reads the target: the session check contains no prohibition, although decide for Bob denies. Similarly, a future dateTime prohibition can become applicable after materialization without invalidating the allow.

   The bridge had analogous behavior on the base; the new design problem is certifying this request-specific result as a ConditionalPermit with prohibitions settled. Require prohibition non-applicability across every admitted identity/time, or retain and re-evaluate the relevant prohibitions per session; otherwise use a one-shot permit.

Requested checks

1. Construction: Neither permit has public mutable fields, Default, deserialization, conversion constructors, or exposed test constructors. Cloning preserves their contents. ValidatedPolicy::default() is publicly available but produces an empty, denying policy; editing requires extracting the model and validating again. These guarantees concern safe Rust—privacy cannot prevent arbitrary unsafe memory manipulation.

2. Grant routing: One-shot, policy, counted and counted-refresh allows use Permit; N3 grants must equal its triple. Conditional allows require ConditionalPermit, subject to finding 1. The inspected server, built-in LWS gate and wasm policy evaluator route through the bridge or evaluate/decide. Independent WAC/ACP authorization and the injectable LWS gate remain separate authorization mechanisms.

3. Session re-check: Persisted permission windows reject missing or unparseable clocks, and the cache key includes identity and now. Clock accuracy remains caller-supplied. These checks do not re-evaluate prohibitions whose applicability changes with identity or time.

4. Conflict strategy: Both decision functions check strategy admissibility before prohibitions. This implements the documented subset: perm is refused, prohibit uses deny-overrides, and explicit invalid refuses detected conflicts. The unset default remains deny-overrides, differing from ODRL 2.2’s invalid default. ODRL conflict semantics.

5. Earlier highs: The constrained-duty conditional bypass and N3 missing-prohibition-evidence bypass are closed for the evaluated request. The base’s typed-set guards and mandatory validation for direct construction and ledger replay remain intact.

6. Logic and coverage: xone returns False for at least two True operands, True for exactly one True without Unknown, and Unknown when unresolved; zero True without Unknown returns False. The incomparable contains() implication has a comparability guard, but general containment soundness is not established: unchanged code claims inner lteq 5 implies outer lt 5. The new test matrix covers the requested materializers and three replay kinds for admitted policies, but checks only the original Alice session and omits counted paths.

Tests were inspected, not executed in this read-only checkout.

Verdict: Resolve the new conditional-permit soundness guarantee before merging as is.

[jeswr]

🔎 Codex reviewer — gpt-6.1-sol

Automated review by the Codex reviewer (OpenAI gpt-6.1-sol via Codex CLI) of head 128f3fe0ebdb. Scope: correctness, security, soundness and design; style nits omitted. A new head gets a fresh review.

Findings

1. [high] The fallback grant survives into a prohibited time — crates/sparq-solid/src/odrl_bridge.rs:1151
   With permission to read and a prohibition beginning 2027-01-01, materializing for Alice in June 2026 falls back to a persistent Alice auth:read target triple. Alice’s session in 2027 still reads: ordinary triples ignore Session::now. refresh_odrl_grants() also replays the stored 2026 request, preserving the grant. The new future-prohibition test never checks Alice after the boundary.
   Make fallback authorization request-scoped, or retain and re-evaluate its temporal restrictions during enforcement.

2. [high] Conditional grants still discard identity conjunctions — crates/sparq-solid/src/odrl_bridge.rs:1376
   A permission with odrl:assignee Alice and recipient eq Bob receives a ConditionalPermit, but condition_agents uses Bob’s recipient head and ignores Alice’s assignee restriction. Bob therefore reads although decide() denies his request. Similarly, separate atomic recipient constraints are accumulated as alternative heads although the evaluator requires their conjunction. These inherited mapper defects remain reachable through the new permit boundary.
   Intersect all identity restrictions, including the assignee property; reject mappings that cannot preserve the evaluator’s conjunction.

3. [medium] A supposedly concrete fallback party can become a wildcard principal — crates/sparq-solid/src/odrl_bridge.rs:405
emit_allow checks only that the party exists. For an unrestricted permission and a prohibition assigned to Bob, a request with .by("https://sparq.dev/ns/auth#Public") passes decide() and the conditional fallback writes a public allow. Bob and anonymous sessions then match that triple. Using auth:Authenticated similarly grants every authenticated agent. The Permit preserves the string but does not make it an exact WebID principal.
   Reject authorization wildcard and encoded principal values when emitting grants intended for one concrete party.

4. [medium] The unset conflict strategy can grant from a policy ODRL considers void — crates/sparq-policy/src/compare.rs:189
   This inherited divergence remains in the combined head. A policy with conflicting read permission/prohibition on asset A and an uncontested read permission on asset B grants B when conflict is unset. ODRL 2.2 §2.10 defaults to invalid, which voids the entire conflicting policy. Deny-overrides therefore is not universally conservative relative to that default.
   Apply invalid when unset, or require explicit prohibit for this behavior and qualify the fail-closed claims accordingly.

Requested checks

Reviewed both the PR-only diff and the combined head against origin/main. This was a static review; tests were not run in the read-only checkout.

1. Earlier highs: N3 unknown-prohibition grants and constrained-duty discharge are closed. Simple recipient exclusions now deny anonymous sessions. The conditional prohibition check considers other identities and times, but its fallback retains the temporal bypass in finding 1.
2. Fallback binding and replay: Normal WebIDs remain scoped to their agent and target, with action mapped to a Solid mode. Client, issuer and time are not retained. Ledger and counted refresh replay stored requests rather than the accessing session; wildcard party strings also widen access as described above.
3. Authenticated exclusion heads: A simple recipient neq Bob correctly excludes Bob, and .by(WebID) supplies default recipient evidence. This does not establish faithful enforcement of all identity restrictions: assignee mismatches and atomic conjunctions remain vulnerable.
4. Default conflict strategy: The specified default is invalid; the documented divergence can fail open on uncontested rules in an otherwise void policy.
5. Public Decision fields and construction: Callers can alter Decision.allow, but bridge grant paths evaluate internally and require a Permit or ConditionalPermit. Safe external code cannot forge either permit or bypass policy validation. ValidatedPolicy::default() does publicly construct the valid empty policy; Policy::validate() constructs other admitted policies.

Verdict: Request changes; the stack still permits authorization widening.

[jeswr]

On the medium about the unset odrl:conflict strategy (finding 4 at 128f3fe): this stays deny-overrides by the maintainer's decision in #1375 ("keep prohibit as the default; document the divergence"). A prohibition still always wins wherever it applies; the gap is only that an uncontested permission in an otherwise conflicting policy grants, where ODRL 2.2's invalid would void the whole policy. skills/usage-control-policy/SKILL.md now says exactly that, and that declaring odrl:conflict odrl:invalid gets the void-the-policy behaviour. The other findings are addressed at 06fcbd3 (see the PR body).

---

Generated by Claude Code

[jeswr]

🔎 Codex reviewer — gpt-6.1-sol

Automated review by the Codex reviewer (OpenAI gpt-6.1-sol via Codex CLI) of head 06fcbd33e93c. Scope: correctness, security, soundness and design; style nits omitted. A new head gets a fresh review.

Findings

1. [high] lasting() certifies advancing non-dateTime constraints as permanent — crates/sparq-policy/src/eval.rs:618

   Every operand other than odrl:dateTime is treated as stable. An admitted permission with elapsedTime lt 10, evaluated with Value::Num(1.0) as elapsed-time evidence, receives lasting() == true and becomes an unconditional stored grant. At elapsed time 11, decide denies, but accessible/query_as still grant access. Similarly, withdrawn_later treats a currently false elapsedTime gteq 10 prohibition as withdrawn forever.

   Certify only dimensions whose stability is established. Reject durable materialization of other temporal or mutable constraints until enforcement re-evaluates them per request.

2. [medium] Newly rejected counted grants still consume usage budget — crates/sparq-solid/src/odrl_bridge.rs:1926

   evaluate_and_exercise consumes budget before emit_allow checks the new persistence and identity restrictions. For a permission combining count lteq 1 with a currently satisfied dateTime deadline, the bridge returns granted == false because the permit is not lasting, but consumes the sole unit. Subsequent count-aware exercises deny despite no access having been granted. Recipient mismatch and wildcard-party rejection can also burn budget.

   Check bridge eligibility using a non-consuming decision before the atomic consume operation, while retaining permit-only grant emission.

Requested checks

Reviewed both the PR-only diff and the combined stack against origin/main. This was source review; builds and tests were not run in the read-only environment.

1. Allow paths: No stored ODRL allow bypass found. One-shot, policy, conditional, counted, refresh and N3 grants converge on emit_allow(Permit). Server and GUI callers use those paths. LWS also has a direct per-request evaluator gate; it does not persist grants. No additional wasm bridge writer found.

2. Persistence soundness: Future dateTime starts and permission lt/lteq deadlines are rejected correctly. Constrained duties, including deadlines, cannot discharge. Elapsed-time constraints remain unsafe as described above. Counted permits inherit lasting from the count-stripped policy, and stored access still relies on explicit refresh rather than per-query counting. Policy revocation likewise requires updating the ledger policy and refreshing; lasting() does not guarantee validity after revocation.

3. Identity binding: Party/recipient matching is exact by string. Changed .by() parties, auth-namespace wildcard parties and reserved encodings are rejected. No normalization-based wildcard widening found. Blank-node-like strings are not IRI-validated, but remain exact-match heads rather than wildcard principals.

4. Non-vacuity floor: Static enumeration gives N3 grants 21 → 12: three removed clock-containing shape families each contributed three cases. The 10 floor still detects losing an entire surviving three-case family. Rust grants become 40 → 20, so lowering its floor to 10 is unnecessary and weakens coverage.

5. Earlier highs: The specific dateTime fallback, assignee/recipient restriction, identity conjunction, wildcard party, N3 unknown-evidence and constrained-duty counterexamples are closed. The broader persistence guarantee remains incomplete for advancing non-dateTime evidence and count-sensitive grants.

Verdict: Request changes before merging; persistence certification and rejected-grant budget consumption remain incorrect.

[jeswr]

🔎 Codex reviewer — gpt-6.1-sol

Automated review by the Codex reviewer (OpenAI gpt-6.1-sol via Codex CLI) of head de53c7a671c8. Scope: correctness, security, soundness and design; style nits omitted. A new head gets a fresh review.

Findings

1. [high] Purpose and location constraints become unrestricted stored grants — crates/sparq-policy/src/eval.rs:619

   STABLE_LEFT_OPERANDS treats purpose and spatial evidence as fixed, but the emitted grant contains only party, mode and target. For example, Alice materializes a research-only permission with purpose research; subsequent accessible/query_as calls admit Alice for marketing or without purpose evidence. Session carries neither purpose nor location, so enforcement cannot re-check either. Similarly, a prohibition on marketing is certified permanently withdrawn during a research request, letting later marketing requests bypass it.

   Remove purpose and spatial from the lasting allow-list for both permissions and prohibition withdrawal. Restore them only with enforcement that scopes or re-evaluates each actual request.

2. [high] Count stripping certifies an exhaustible grant as lasting — crates/sparq-policy/src/count.rs:391

   evaluate_and_exercise evaluates a policy with permission count constraints removed, then forwards that decision’s Permit, including lasting=true. The counted bridge consequently passes allow_binding and stores an unrestricted allow. With count lteq 1, the first materialization exhausts the budget, yet subsequent query_as calls still succeed; another counted materialization denies but leaves the existing grant intact. Retraction requires an explicit refresh, and ordinary accesses never consume units.

   Preserve the original count restriction when determining permit storability and refuse persistent counted grants, or enforce atomic consumption on every actual access.

Requested checks

1. Allow paths: All ODRL auth-view allow writers reviewed route through emit_allow(Permit), including policy, counted, refresh, N3, server and GUI paths. The native LWS gate evaluates each request directly; the wasm policy probe returns decisions rather than storing grants. Conditional deny heads remain.

2. lasting() soundness: Purpose and spatial must come off the list: later requests inherit the stored grant without those constraints being checked. Future dateTime gteq prohibitions, permission lt/lteq deadlines, elapsed time and arbitrary operands are otherwise conservatively rejected. Constrained duties, including deadlines, cannot be discharged by action alone. Counted grants remain unsound as described above. Policy revocation requires refresh_odrl_grant with the updated policy; lasting() does not establish validity across policy changes.

3. Party/recipient binding: Party changes after .by() deny, explicit recipient mismatches refuse materialization, and auth-namespace/reserved principals are rejected. Matching is byte-for-byte; wildcard aliases are not normalized into public grants. Blank-node-style party strings are not rejected as invalid IRIs because emission uses NamedNode::new_unchecked, but they do not expand into wildcard principals.

4. N3 floor: Static enumeration supports the reduction: three permission shape families lose three N3 grants each, reducing 21 grant cases to 12. The removed families are the future upper bound, the clock-bearing or, and the clock-bearing and. A floor of 10 still detects losing any complete remaining three-case family. The Rust floor remains 20.

5. Earlier findings: Cross-party conditional heads, dropped assignee restrictions, identity conjunctions, wildcard fallback parties, unknown-evidence N3 grants and constrained-duty discharge are addressed. The elapsed-time/arbitrary-operand defect and rejected-counted-grant budget consumption are closed. The broader stored-grant soundness requirement remains unresolved by Findings 1–2.

Reviewed the PR diff and combined ODRL state against origin/main. No files were modified; tests were not rerun.

Verdict: Unsafe to merge as is because stored grants still widen authorization beyond the evaluated request.

[jeswr]

🔎 Codex reviewer — gpt-6.1-sol

Automated review by the Codex reviewer (OpenAI gpt-6.1-sol via Codex CLI) of head 797aee653fbe. Scope: correctness, security, soundness and design; style nits omitted. A new head gets a fresh review.

Findings

1. [high] Assignee context is incorrectly certified as immutable — crates/sparq-policy/src/eval.rs:626
   An odrl:assignee constraint reads Request.context, unlike the rule’s assignee property. A permission constrained by assignee eq urn:alice grants and becomes lasting() when Alice supplies that context value. The bridge then stores an unconditional grant for Alice; later requests without that context, or with a different value, receive access although decide denies them. The same mistake can certify a context-dependent prohibition as permanently withdrawn.

   Remove assignee constraints from the stable allow-list unless their evaluated value is enforced as the stored party’s identity. Apply that restriction to prohibition withdrawal too.

2. [high] Collection membership can invalidate a supposedly lasting grant — crates/sparq-policy/src/eval.rs:643
withdrawn_later treats an assignee/target mismatch as permanent, but party_matches and asset_matches depend on request-supplied collection membership. For example, an unrestricted permission plus a prohibition assigned to a declared group produces a lasting grant for Alice before she joins that group. After membership evidence places Alice in the group, decide denies her while the stored grant still permits access. Permissions and recipient constraints satisfied through membership likewise survive removal of that membership because holds_later never checks this dependency.

   Only certify membership-independent decisions as lasting, or bind stored grants to membership-state invalidation and re-evaluate before access.

3. [high] Duplicate rule IDs bypass the count-limited storage guard — crates/sparq-policy/src/count.rs:439
Policy::validate accepts duplicate permission IDs, but base_decision identifies the granting rule using the first matching ID. A hand-built policy with an uncounted Bob-only rule followed by an Alice-only count lteq 0 rule, both sharing an ID, grants Alice after count stripping. This lookup finds Bob’s uncounted rule and leaves Alice’s permit lasting. evaluate_and_exercise repeats the same lookup, skips consumption, and the counted bridge stores unlimited access despite a zero allowance.

   Reject duplicate permission IDs during validation, or carry an unambiguous rule identity through evaluation and use it for both count enforcement and lasting certification.

4. [medium] Removing conditional allows breaks the feature-enabled oracle corpus — crates/sparq-solid/src/odrl_bridge.rs:971
sparq-wac-oracle::build_window_store still calls this entry point with Alice to create Carol’s conditional time-window grant. Delegating to the one-shot evaluator now returns no grant, so the builder returns Err. Three window-corpus tests consequently fail in the registered sparq-wac-oracle (odrl-bridge) feature-matrix leg.

   Update the corpus alongside the feature removal. Preserve coverage of the remaining AuthIndex window behavior using an appropriate trusted fixture, or explicitly retire the obsolete bridge-dependent corpus.

Requested checks

• Reviewed the PR’s base-to-head diff and the combined policy/bridge stack against origin/main.
• All ODRL stored allow paths traced—including one-shot, policy, conditional, counted, refresh/replay and N3—reach emit_allow(Permit). Server and GUI use these bridges; LWS evaluates per request, and the wasm policy probe stores no grants.
• Purpose/spatial, elapsed-time, clock upper bounds and future-start prohibitions are rejected for storage as intended. Constrained duties also fail closed. However, lasting() remains unsound through findings 1–2. Policy revocation still requires an explicit ledger update and refresh.
• Party mutation after .by(), different checked recipients, auth:Public/Authenticated and reserved principal encodings are blocked. Matching uses exact strings without alias normalization. Ordinary Rust bridge paths still use unchecked IRI construction, so blank-node-like strings are not explicitly rejected.
• Counts anywhere in nested and/or/xone prevent lasting certification because every atom is checked. Unsupported rule-head refinements are refused. An unidentified rule produces a transient permit that the emitter rejects; duplicate IDs remain the bypass in finding 3.
• The N3 floor reduction is justified by the removed behavior: three generated shape families × three admitted conflict settings remove nine grants, reducing the source-enumerated N3 grant cases from 21 to 12.
• The named fallback, conjunction, wildcard, unknown-evidence, constrained-duty and purpose/spatial counterexamples are closed. Rejected counted grants no longer spend budget. Ordinary count stripping is fixed, but duplicate IDs defeat that fix.
• Tests were not executed in the read-only checkout.

Verdict: Unsafe to merge as is because lasting certification and count-rule identification still permit authorization widening.

[jeswr]

🔎 Codex reviewer — gpt-6.1-sol

Automated review by the Codex reviewer (OpenAI gpt-6.1-sol via Codex CLI) of head 667a9c2808d8. Scope: correctness, security, soundness and design; style nits omitted. A new head gets a fresh review.

Findings

No correctness, security, soundness or design problems found.

Requested checks

Reviewed both ecb05657..HEAD and the combined stack against origin/main.

1. Nonstatic grant paths: No bypass found. One-shot, conditional, policy, counted, refresh, ledger replay and N3 grants reach the emitter’s lasting check. Write-through rematerialization replays those same paths. Count-limited permits are refused before consumption.

2. Recipient versus assignee: An explicit recipient context can differ from the assigned party even on a lasting permit. The emitter rejects that mismatch, so it cannot produce a stored grant.

3. Three previous highs: All closed. Constraints on assignee context prevent lasting classification; declared party collections and any membership evidence prevent it; duplicate rule IDs across permissions and prohibitions fail validation before count-rule lookup.

4. Oracle/differential fallout: The changed expectations follow the intended removal of constrained, clock-dependent, collection-dependent, unassigned/public and prohibition-carrying stored grants. The window corpus denies Carol at every instant while preserving Alice’s static ACP access. Count tests retain per-request exercises, deny tests retain static WAC controls, and the two-operand regression now expects the existing parser refusal. No additional regression was identified.

Tests were not rerun in the read-only workspace.

Verdict: Safe to merge as is based on this static review.