Phase 2: production ingest enforces only p2panda-auth membership

Admin rules, member cap, friendship consent, delegation, veto, crossings and the create rule live in the groups fold and provisioning, not in the store's ingest. Wiring them into ingest is the next Phase 2 integration step.

id train triage (2026-10-24): blocked-on-groups-fold-and-provisioning — production ingest wiring; admin/member-cap/friendship/delegation rules live in the fold and provisioning, not in the store's ingest.

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), lane D shift
Session / ID: queue task 2015 (repo-health-code-pilot)
Found via: queue claim
Task: Triage issue Phase 2: production ingest enforces only p2panda-auth membership #168 — verify on current main whether production ingest enforces only p2panda-auth membership, then route as a scoped follow-up packet or close with evidence.
Expectation: effort s — done = triage verdict posted with code evidence at HEAD, follow-up packet enqueued if confirmed, labels synced.
Links: queue task 2015

🤖 Agent note · done

Agent: queue worker (repo-worker-code), lane D shift
Session / ID: queue task 2015 (repo-health-code-pilot, triage)
Found via: queue claim
Task: Triage verdict for Phase 2: production ingest enforces only p2panda-auth membership #168 — CONFIRMED on current main (26221fcc77952cc672f8960bfd997a795b1167ca, 2026-10-29T01:13:30Z). Routed as a scoped follow-up fix packet; this issue stays open as the tracking issue.
Expectation: done = verdict + evidence below, follow-up packet enqueued, labels synced.

Evidence (all at HEAD above):

pkgs/id/src/event_store/resolve.rs (287 lines) derives the applied state the store uses on ingest. Its header lists exactly three rules: fork exclusion; group operations via the membership layer (Membership::is_effective, manage access at position — the p2panda-auth wrapper in crate::membership); content voided only when its author is not a member of its group at its position. The file contains no reference to crate::groups or the fold.
pkgs/id/src/event_store/ingest.rs, ingest_with_body doc (~line 227): "This is the production path. The membership action comes from the body, by the body codec in crate::membership::body" — membership is the only group check on the production path, and refresh() in the same file calls only resolve::resolve/resolve::load.
pkgs/id/src/groups/fold.rs (lines 1–20, Refusal enum ~lines 38–105) is where the other rules live: NotAdmin, NotManager, OverCap (member cap), NotInvited/AlreadyPresent/WrongFriendshipId (friendship consent), Attenuated/NoChain (delegation), UnknownGrant (veto), NotCrossable (crossings), BadTemplate/BadPolicy (create rule) — exactly the list in this issue's body.
The fold's only callers at HEAD are not on the ingest path: pkgs/id/src/groups/log.rs (fold(&self.events) — the local author's GroupLog file) and pkgs/id/src/server_config/provision.rs:111,177 (server provisioning). No caller under event_store/.

Route: follow-up packet enqueued to repo-health-code-pilot — kind small_fix, dedupe key repo-health:v1:fix:developing-today/code:issue:168, priority 40: wire crate::groups::fold into event_store/resolve.rs/ingest.rs so fold-refused group events are voided on production ingest, with tests for a fold-refused op (e.g. over-cap add) and a fold-accepted op arriving via ingest_with_body. Related but distinct: #165 (create of an existing group is first-arrival-wins) — not a duplicate, stays separate.

id(event-store): reconcile fold refusals with the membership layer (#168

Merge pull request #3725 from developing-today/queue/2952-168-groups-…

🤖 Agent note · done

Agent: queue worker (repo-worker-code), Lane F
Session / ID: queue task 5665 (pr_shepherd)
Found via: queue claim
Task: Shepherd PR id(event-store): apply the groups fold on production ingest (#168) #3725 (Phase 2: production ingest enforces only p2panda-auth membership #168 groups fold on production ingest) to merge — DONE, merged as 60c325f39
Codex gate: both findings fixed in-PR (commit 5d8977296) and dispositioned on-thread (replies 4436078597, 4436078752):
- P1 (fold-refused ops still mutated membership authority): the fold is now judged before the membership layer is built and voided operations are fed to the layer as no-ops. Regression test test_a_fold_refused_removal_does_not_strip_the_admins_authority.
- P2 (projection roster disagreed with applied decisions): bridge() no longer bridges a create listing its author below Manage (incompatible creator-access mapping, rejected before folding per the finding's own option), so the roster follows the membership verdict. Regression test test_a_create_listing_its_author_below_manage_keeps_the_membership_roster.
Verification (laptop): 4 fold tests pass (2 new + 2 pre-existing); full event_store lib suite: 106 passed, 0 failed, 2 ignored. PR was MERGEABLE; merged 2026-11-01T14:42:28Z.
Links: PR id(event-store): apply the groups fold on production ingest (#168) #3725 · merge 60c325f39 · fix commit 5d8977296

Navigation Menu

Repository navigation

Phase 2: production ingest enforces only p2panda-auth membership #168

20 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Phase 2: production ingest enforces only p2panda-auth membership #168

Description

Activity

dezren39 commented on Oct 24, 2026

dezren39 commented on Oct 29, 2026

dezren39 commented on Oct 29, 2026

20 remaining items

dezren39 commented on Nov 1, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions