Phase 2: authority judged at causal past or canonical prefix

Groups track and voiding track disagree on the reference point for authority checks. Design says each operation is judged at its own causal past. Confirm and make both paths use it.

id train triage (2026-10-24): needs-decision — project owner: authority reference point (causal past vs canonical prefix); groups track and voiding track disagree.

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), Lane A shift
Session / ID: queue task 2012
Found via: queue claim · repo-health-code-pilot
Task: Triage Phase 2: authority judged at causal past or canonical prefix #162 — verify whether the groups track and the voiding track still disagree on the authority reference point (causal past vs canonical prefix) at current main; route a scoped fix or close with evidence.
Expectation: effort s — done = triage verdict posted, follow-up enqueued or issue closed with evidence, task 2012 completed.
Links: issue Phase 2: authority judged at causal past or canonical prefix #162

🤖 Agent note · escalated (triage verdict: disagreement CONFIRMED at HEAD; reference-point choice is the project owner's decision)

Agent: queue worker (repo-worker-code), Lane A shift
Session / ID: queue task 2012 (triage)
Found via: queue claim · repo-health-code-pilot
Task: Triage complete. The factual claim is confirmed; the fix direction is not worker-pinnable, so this escalates with the full read (this confirms the 2026-10-24 id-train triage flag: "needs-decision — project owner").
What the thing is: In pkgs/id, two judging paths use different reference points for authority. (a) The groups fold (pkgs/id/src/groups/fold.rs): the file header states the fold applies events in canonical order and "the Admin check, the member cap, and dissolve are all decided against that prefix"; effective_author (fold.rs:1050-1063) judges a direct author against the Engine's current state — that prefix state, which includes concurrent events the author never saw — and only the device-key fallback (authorized_device_account, fold.rs:1065) is judged at the event's own after. member() (fold.rs:873ff) and policy() (fold.rs:841ff) both gate on effective_author. (b) Delegation and voiding judge at the causal past: delegation.rs:145,285-329 (causal_past(by_id, after)), void() (delegation.rs:380-393) and the fold's own voiding helpers (fold.rs:1007-1092) all test concurrency/causality against causal_past, never the prefix.
Why "the design already says causal past" does not settle it: design §4.4 (pkgs/id/docs/2026-10-11T03-44-33Z_design_groups_events_delegation) says an event's validity "is a function of its causal past and of the events concurrent with it" — not of its causal past alone. And §5.1's member-cap rule as implemented deliberately uses canonical order ("two concurrent events are ordered by ID, so the lower ID wins a contested place", fold.rs header) — a pure causal-past judge cannot decide a cap contest between two concurrent adds, because neither author had seen the other.
The options: (1) Causal past for authority, canonical prefix only for set-state rules — authors are judged (Admin/Manager/active) at their own after; cap/dissolve stay prefix-judged. Effect: a concurrent demotion/removal the author had not seen no longer retroactively invalidates their operation (it is then handled, if at all, by the voiding track); delegation and fold authority finally agree. Risk: an operation by a just-removed admin stands unless a removal mode voids it. (2) Canonical prefix everywhere — make delegation/voiding also prefix-judged. Effect: simplest single rule, fully deterministic on the set; but it contradicts design §6/§7.3's causal wording and the strong-remove concurrency tests (e.g. groups/tests.rs:1270 "a grant concurrent with its grantor's removal is void" is a causal-past test), so this reopens settled delegation semantics. (3) Keep the split, document it as intended — close this issue as designed: authority over membership state is prefix-judged, authority over delegations is causal-past-judged, and §4.4's "causal past and concurrent events" is the umbrella statement. Cost: the two-path subtlety stays a trap for future readers.
Recommendation: option (1). It matches the issue's instinct and §6/§7.3's causal language where authority over a person is concerned, while keeping the one rule that genuinely needs a canonical order (the cap contest) on the prefix. It is also the smallest change: effective_author's direct path would be judged against the state at event.after (the machinery already exists — the device path and dissolved_before already reconstruct at a causal past), with tests for a concurrent demotion/removal.
Expectation: Drew picks 1 / 2 / 3 (or another reference point); on the pick, a scoped small_fix packet gets enqueued the same pass. Until then the task is blocked as escalated-to-user — no code change is safe to queue, because each option changes consensus-visible semantics differently.
Links: issue Phase 2: authority judged at causal past or canonical prefix #162 · fold.rs:1050 · delegation.rs:285 · design §4.4/§5.1/§6/§7.3

DREW DECISION (2026-10-29, main chat): Option 1 (judge authority at the causal past) is the rule — the default 99% of the time. Canonical order remains only for set-state rules like the member cap.

Option 2 (judge everything against finalized canonical history) does not work as a general rule.
Keep ONE exception possible, admin-only and NOT a priority to build: a server admin may declare a rollback for a specific group or situation — e.g. everything from an account is invalid, or everything after a time is invalid — as an anti-vandalism/attack instrument. The original events still exist; the system keeps moving forward; whether everything can actually be rolled back is a separate question.
The standard remedy is roll-FORWARD, not history surgery: cancel the offending user's access, revoke anything they permitted, and reapply the correct version of anything they edited.
Do not discount an option-2-style tool entirely for specific purposes/conveniences — but it is not a major player and must not displace option 1 anywhere by default.

Agent note — task 7640 resumed (lane L shift)

Queue task 7640 (small_fix, issue Phase 2: authority judged at causal past or canonical prefix #162) re-claimed by lane code-l at 2026-11-03T14:21Z (attempt 2); execution lane: direct.
Resuming from the verified checkpoint (instruction §10.4): PR groups: judge authority at the causal past in strong-remove mode too (#162) #4933 is OPEN at 12e795e9c on branch queue/7640-162-strong-remove-causal-authority (laptop worktree ~/git/fleet/7640); cargo test --lib groups:: already passed on the laptop (110 passed, 0 failed, incl. 3 new strong-remove causal-past tests).
This shift: fresh PR/CI verification, full cargo test -p id sweep on the laptop worktree, Codex findings disposition, then merge under the standing criteria or park with the blocker.

Merge pull request #4933 from developing-today/queue/7640-162-strong-…

Agent note — task 7640 done (lane L shift): PR #4933 merged

PR groups: judge authority at the causal past in strong-remove mode too (#162) #4933 "groups: judge authority at the causal past in strong-remove mode too (Phase 2: authority judged at causal past or canonical prefix #162)" MERGED at 2026-11-03T14:28Z, merge commit 659a72ed9a6b759fd30f18df96f94bad9bef718b; this issue auto-closed.
Verification this shift: PR diff is exactly pkgs/id/src/groups/fold.rs + pkgs/id/src/groups/tests.rs; cargo test --lib groups on the branch worktree: 121 passed, 0 failed (incl. the new strong-remove causal-past regression tests). PR checks: line-limit success, CodeRabbit neutral; mergeable_state clean.
Codex gate: Codex's review failed to run (usage limits) and produced no findings; disposition posted on PR groups: judge authority at the causal past in strong-remove mode too (#162) #4933 (comment 6606434285).
Pre-existing failure noted, unrelated to this PR: full cargo test in pkgs/id fails to compile chain_properties / bridge_poc / voiding_properties (missing checkpoint field in ChainExt initializers) — reproduced identically on clean main b96333243. That breakage needs its own fix; it is not caused or worsened by this change.

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), lane G shift (code-g)
Session / ID: task 7640 (small_fix)
Found via: queue claim · repo-health-code-pilot
Task: Fix issue Phase 2: authority judged at causal past or canonical prefix #162 per triage task 7571: judge groups authority at the causal past in strong-remove (default) mode too — edit effective_author helper selection in pkgs/id/src/groups/fold.rs, update the stale module header, add regression tests (concurrent demotion / Admin loss under strong-remove keeps author's standing at their position). Member cap and dissolve keep canonical/prefix judging per Drew's 2026-10-29 Option 1 decision.
Expectation: branch + PR from a laptop worktree; cargo test -p id groups, then full -p id on the laptop/CI.

Navigation Menu

Repository navigation

Phase 2: authority judged at causal past or canonical prefix #162

28 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Phase 2: authority judged at causal past or canonical prefix #162

Description

Activity

dezren39 commented on Oct 24, 2026

dezren39 commented on Oct 29, 2026

dezren39 commented on Oct 29, 2026

dezren39 commented on Oct 29, 2026

28 remaining items

dezren39 commented on Nov 3, 2026

dezren39 commented on Nov 3, 2026

dezren39 commented on Nov 3, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions