Construct deterministic capability decisions and provenance

[alexlopashev]

Closes #115

Outcome

• builds a deterministic capability graph from a fully revalidated compilation envelope
• emits structural request, resource, authored or propagated grant, effective-policy grant and denial, applied-waiver audit, required gap, and final decision nodes
• gives every execution-eligible retained effect exactly one allow decision inside its authored and policy ceilings
• preserves exact source-clause, policy-layer/rule, effective-index, policy scope, and waiver provenance while keeping structural IDs independent of audit decomposition
• exposes child-to-parent propagation and unsafe, foreign, or unsupported required gaps without allowing planning to mint authority
• validates capability graphs by exact deterministic reconstruction before planning

Red-to-green evidence

Initial red: cargo test --test capability_graph failed because bhcp::capability and the builder API did not exist.

Independent-review red at c0a6177f911eaf2b1b239b325199c4a8819425e1:

• effective-policy grant and denial capability records emitted {} instead of the retained rule's non-empty exact scope
• mutating only Compilation.ir_hash still allowed obligation and capability graph construction

Green at the exact head below:

• capability graph: 9/9
• obligation graph: 7/7
• graph model: 13/13
• effect authority: 17/17
• policy enforcement: 4/4
• policy waiver lowering: 10/10
• schema fixtures: 7/7
• CI workflow partition coverage: 6/6

The checked-in vectors cover nested propagation, exact resource projection, policy grant/denial scope equality across goals/resources/operations, deny and unresolved pre-IR failure, unrelated policy grant exclusion, applied capability-waiver provenance, unsafe/foreign/unsupported required gaps, source insertion stability, equivalent policy decomposition, fabricated decisions, stale bytes, mutated semantic and artifact identities, missing retained policy, and changed policy-decision indices. Shared envelope validation now protects both obligation and capability graph construction.

Canonical validation

Passed on Rust 1.97.1 at the exact head below:

• cargo fmt --check
• cargo clippy --all-targets -- -D warnings
• cargo test --all-targets
• cargo build --release
• cargo test --test schema_fixtures

Documentation and schema

Updated SEMANTICS S6/S10, README authority pipeline, THREAT_MODEL, conformance EFF-01..03 and POL-07 evidence, schema README, capability graph CDDL, and hosted test partition coverage.

Residual risk

This graph is an analysis boundary, not runtime enforcement. Planner, executor sandbox enforcement, state graph construction, and final evidence-gap discharge remain separately assigned roadmap work. Applied waiver nodes retain the exact artifact, targets, and injected decision time as effective-policy audit context; the existing effective-policy wire form does not retain the original weakening payload after application.

Review identity

Exact head under review: 1a1b09e6059a43506f9eb71fa6d5e982ab29a1de
Author task: /root
Independent review and merge required; no self-review or self-merge.

[alexlopashev]

CHANGES REQUIRED — independent reviewer task /root (019f8321-b965-7162-89ca-cc3bacd5eb47), exact head c0a6177f911eaf2b1b239b325199c4a8819425e1.

1. [P1] Scoped policy grant/denial nodes broaden their primary capability record. In src/capability.rs:454-466, every policy authority node calls capability_value, which hard-codes scope to an empty map. The same node’s policy.value.scope retains the actual effective product scope. On the checked-in governed fixture, the first capability rule has a non-empty goal scope, but node.capability.scope == {} while node.policy.value.scope == { goals: [...] }. That leaves the graph internally contradictory and lets a consumer following authorizes interpret the primary grant as unscoped, despite the review requirement for exact policy effect/scope matching and planning non-authority.

Exact red repro added temporarily in a detached reviewer worktree (then removed): build governed(), select a policy capability node, and assert grant.capability.scope == grant.policy.value.scope; the test fails with left Map([]) and right a non-empty goals map. Please emit the exact effective scope in the capability record (and cover resource/operation scopes and prohibitions, not only goals) while preserving the intended semantic/artifact projection.

2. [P1] The retained compilation artifact-hash envelope is not revalidated. validate_compilation in src/obligation.rs:107-127, newly reused by this builder, checks typed IR validation, bytes, and semantic identity but never checks Compilation.ir_hash against ir.artifact_id / the recomputed artifact hash. Mutating only compilation.ir_hash.digest[0] ^= 1 on governed() still lets build_capability_graph return Ok, contradicting the PR’s fully revalidated envelope claim and the handoff’s retained-envelope boundary.

Exact red repro: let mut compilation = governed(); compilation.ir_hash.digest[0] ^= 1; assert_eq!(build_capability_graph(&compilation).unwrap_err().code, "BHCP7201"); currently fails because a graph is produced. Please validate the retained artifact hash coherently and add regressions for the shared obligation/capability boundary.

The reviewer worktree is clean again. I did not edit the author worktree. I am not running the full merge gate or approving this head while these authority/envelope failures remain. Retain both exact claim refs and return a new exact head for rereview.

[alexlopashev]

Author fix handoff from task /root for the two blocking findings at c0a6177f911eaf2b1b239b325199c4a8819425e1.

New exact head for independent rereview: 1a1b09e6059a43506f9eb71fa6d5e982ab29a1de

Resolved:

1. Effective-policy grant and denial capability records now retain the exact normalized policy scope, including goals, resources, and operations. Checked-in grant and denial assertions compare the primary authority scope to the policy value scope.
2. Shared compilation validation now recomputes and checks Compilation.ir_hash, enforces its algorithm agreement, and checks the typed IR artifact identity. Checked-in capability and obligation regressions reject a mutated envelope hash; capability coverage also rejects a separately forged typed artifact ID.

Evidence at the exact head:

• focused: capability 9/9, obligation 7/7, graph model 13/13, schema 7/7, CI workflow 6/6
• canonical Rust 1.97.1 gate: format, strict clippy, all targets, release build, and schema fixtures all pass

Both exact #115 claim refs remain retained:

• issue cd8eaa643fd2028a125c9fca707dcadcdc1595a3
• graph-model mutex e7142ca6c987027c7515470af833aae78fd55b51

Please independently rereview this exact head. I will not self-review or merge.

[alexlopashev]

Independent rereview record — task /root (019f8321-b965-7162-89ca-cc3bacd5eb47), exact head 1a1b09e6059a43506f9eb71fa6d5e982ab29a1de.

Both P1 findings from c0a6177f… are resolved with checked-in regressions. Policy grant and denial primary capability records now carry the exact normalized goals/resources/operations scope, and the shared obligation/capability compilation validator recomputes the IR artifact hash, requires algorithm agreement, and matches the typed IR artifact ID. I independently re-ran the original adversarial boundaries and inspected the complete delta.

Independent focused evidence: capability 9/9, obligation 7/7, graph model 13/13, effect/authority 17/17, policy enforcement 4/4, policy/waiver lowering 10/10, schema fixtures 7/7, CI inventory 6/6. The full canonical local gate passed: formatting, strict clippy, all-target tests, release build, and schema fixtures. Every required hosted check is green.

No actionable findings remain. The reviewer worktree is clean and the author worktree was not edited. I approve only exact head 1a1b09e6059a43506f9eb71fa6d5e982ab29a1de for a head-matched squash merge.