Schema authorization: split write into create/update with fallback (0304) - #488
Merged
Conversation
added 8 commits
July 12, 2026 22:42
…schema authorization Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: xNet Test <test@xnet.dev>
Signed-off-by: xNet Test <test@xnet.dev>
…, grants and hub projection Signed-off-by: xNet Test <test@xnet.dev>
…, Comment) Signed-off-by: xNet Test <test@xnet.dev>
…e suite Signed-off-by: xNet Test <test@xnet.dev>
…date; gate chat composer Signed-off-by: xNet Test <test@xnet.dev>
…; check off exploration Signed-off-by: xNet Test <test@xnet.dev>
…mplementation Signed-off-by: xNet Test <test@xnet.dev>
Contributor
|
Preview removed for PR #488. |
Contributor
🖼️ UI changes in this PRScreens✏️ Data _(SSIM 0.987)_
InteractionsAuto-captured by CI · run. Informational — not a blocking check. |
crs48
added a commit
that referenced
this pull request
Jul 13, 2026
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @xnetjs/core@1.0.0 ### Major Changes - [#482](#482) [`e6b4c6f`](e6b4c6f) Thanks [@crs48](https://github.com/crs48)! - Grinding-resistant Last-Write-Wins tiebreak (protocol v4, exploration 0305) The final LWW conflict tiebreak was the raw author DID ("higher DID wins"). Because a `did:key` is a free, attacker-chosen function of a keypair, an attacker could grind a vanity DID that sorts highest and win **every** concurrent-write tie against every honest peer, permanently. Protocol v4 replaces that final rung with a per-conflict key, `blake3(authorDID ‖ property ‖ value)` (`computeLwwTiebreakKey` in `@xnetjs/core`), so the winner of a tie is a random-oracle function of _what is written_ — a ground identity wins no durable, universal advantage. The key is gated on both changes being v4 (legacy changes fall back to the author DID), is derived at resolution time (never part of the change hash or wire format), and is threaded through `PropertyTimestamp`, the SQLite `node_properties` guard (new nullable `tiebreak_key` column, schema v8), and every conformance kernel. BREAKING: `CURRENT_PROTOCOL_VERSION` is now `4` and new changes are stamped v4. The LWW golden vectors gain `0005-tie-grinding-resistant-key`; `LwwStamp` / `PropertyTimestamp` gain an optional `tiebreakKey`. Mixed fleets converge on exact `{lamport, wallTime}` ties only once both peers are on v4 — a transient rollout window affecting rare exact ties. ### Minor Changes - [#488](#488) [`1de6587`](1de6587) Thanks [@crs48](https://github.com/crs48)! - Schema authorization gains `create` and `update` actions — optional refinements of `write` (exploration 0304). A schema may now split its mutation policy into who may **add** nodes vs. who may **modify** existing ones; when a refinement is absent it falls back to the schema's `write` expression, so existing schemas behave identically. - `@xnetjs/core`: `AUTH_ACTIONS` includes `create`/`update`; new `actionExpressionOrder()` and `grantActionSatisfies()` helpers (a `write` grant covers both refinements; granular grants cover only themselves). - `@xnetjs/data`: the policy evaluator resolves actions with the fallback and evaluates `create` against the draft node built from the payload (container relations resolve membership, so creation into a shared Space is genuinely gated); `NodeStore` checks the precise verbs, and remote creates are inferred and checked as `create` instead of failing closed on a not-yet-existing node. New `spaceContributorAuthorization()` cascade — adopted by `ChatMessage` and `Comment` — expresses "members may post, only the author (or space admins) may edit". `StoreAuthAPI.can` accepts an optional draft `node`. - `@xnetjs/react`: new `useCanCreate(schemaId, properties)` hook; `useCan`/`useCanEdit` check the precise `update` verb. - `@xnetjs/runtime`: conformance corpus gains the `authz-actions` suite pinning the fallback table. ### Patch Changes - [#483](#483) [`38fd26f`](38fd26f) Thanks [@crs48](https://github.com/crs48)! - docs(exploration): renumber Effect adoption doc 0300 -> 0303 (collision) Exploration numbers collided across parallel worktrees again (0301 gotcha): 0300 was already taken by RUNNING_AN_XNET_HUB_ON_A_RASPBERRY_PI ([#477](#477)) and 0301/0302 are claimed. Renames the doc and updates the exploration-number references in code comments and CLAUDE.md; no code change (empty changeset). Signed-off-by: xNet Test <test@xnet.dev> ## @xnetjs/data@1.0.0 ### Major Changes - [#482](#482) [`e6b4c6f`](e6b4c6f) Thanks [@crs48](https://github.com/crs48)! - Grinding-resistant Last-Write-Wins tiebreak (protocol v4, exploration 0305) The final LWW conflict tiebreak was the raw author DID ("higher DID wins"). Because a `did:key` is a free, attacker-chosen function of a keypair, an attacker could grind a vanity DID that sorts highest and win **every** concurrent-write tie against every honest peer, permanently. Protocol v4 replaces that final rung with a per-conflict key, `blake3(authorDID ‖ property ‖ value)` (`computeLwwTiebreakKey` in `@xnetjs/core`), so the winner of a tie is a random-oracle function of _what is written_ — a ground identity wins no durable, universal advantage. The key is gated on both changes being v4 (legacy changes fall back to the author DID), is derived at resolution time (never part of the change hash or wire format), and is threaded through `PropertyTimestamp`, the SQLite `node_properties` guard (new nullable `tiebreak_key` column, schema v8), and every conformance kernel. BREAKING: `CURRENT_PROTOCOL_VERSION` is now `4` and new changes are stamped v4. The LWW golden vectors gain `0005-tie-grinding-resistant-key`; `LwwStamp` / `PropertyTimestamp` gain an optional `tiebreakKey`. Mixed fleets converge on exact `{lamport, wallTime}` ties only once both peers are on v4 — a transient rollout window affecting rare exact ties. ### Minor Changes - [#488](#488) [`1de6587`](1de6587) Thanks [@crs48](https://github.com/crs48)! - Schema authorization gains `create` and `update` actions — optional refinements of `write` (exploration 0304). A schema may now split its mutation policy into who may **add** nodes vs. who may **modify** existing ones; when a refinement is absent it falls back to the schema's `write` expression, so existing schemas behave identically. - `@xnetjs/core`: `AUTH_ACTIONS` includes `create`/`update`; new `actionExpressionOrder()` and `grantActionSatisfies()` helpers (a `write` grant covers both refinements; granular grants cover only themselves). - `@xnetjs/data`: the policy evaluator resolves actions with the fallback and evaluates `create` against the draft node built from the payload (container relations resolve membership, so creation into a shared Space is genuinely gated); `NodeStore` checks the precise verbs, and remote creates are inferred and checked as `create` instead of failing closed on a not-yet-existing node. New `spaceContributorAuthorization()` cascade — adopted by `ChatMessage` and `Comment` — expresses "members may post, only the author (or space admins) may edit". `StoreAuthAPI.can` accepts an optional draft `node`. - `@xnetjs/react`: new `useCanCreate(schemaId, properties)` hook; `useCan`/`useCanEdit` check the precise `update` verb. - `@xnetjs/runtime`: conformance corpus gains the `authz-actions` suite pinning the fallback table. ### Patch Changes - Updated dependencies [[`e6b4c6f`](e6b4c6f), [`3bc1b5f`](3bc1b5f), [`38fd26f`](38fd26f), [`1de6587`](1de6587)]: - @xnetjs/core@1.0.0 - @xnetjs/sync@1.0.0 - @xnetjs/sqlite@1.0.0 - @xnetjs/crypto@1.0.0 - @xnetjs/identity@1.0.0 - @xnetjs/storage@1.0.0 ## @xnetjs/sqlite@1.0.0 ### Major Changes - [#482](#482) [`e6b4c6f`](e6b4c6f) Thanks [@crs48](https://github.com/crs48)! - Grinding-resistant Last-Write-Wins tiebreak (protocol v4, exploration 0305) The final LWW conflict tiebreak was the raw author DID ("higher DID wins"). Because a `did:key` is a free, attacker-chosen function of a keypair, an attacker could grind a vanity DID that sorts highest and win **every** concurrent-write tie against every honest peer, permanently. Protocol v4 replaces that final rung with a per-conflict key, `blake3(authorDID ‖ property ‖ value)` (`computeLwwTiebreakKey` in `@xnetjs/core`), so the winner of a tie is a random-oracle function of _what is written_ — a ground identity wins no durable, universal advantage. The key is gated on both changes being v4 (legacy changes fall back to the author DID), is derived at resolution time (never part of the change hash or wire format), and is threaded through `PropertyTimestamp`, the SQLite `node_properties` guard (new nullable `tiebreak_key` column, schema v8), and every conformance kernel. BREAKING: `CURRENT_PROTOCOL_VERSION` is now `4` and new changes are stamped v4. The LWW golden vectors gain `0005-tie-grinding-resistant-key`; `LwwStamp` / `PropertyTimestamp` gain an optional `tiebreakKey`. Mixed fleets converge on exact `{lamport, wallTime}` ties only once both peers are on v4 — a transient rollout window affecting rare exact ties. ## @xnetjs/sync@1.0.0 ### Major Changes - [#482](#482) [`e6b4c6f`](e6b4c6f) Thanks [@crs48](https://github.com/crs48)! - Grinding-resistant Last-Write-Wins tiebreak (protocol v4, exploration 0305) The final LWW conflict tiebreak was the raw author DID ("higher DID wins"). Because a `did:key` is a free, attacker-chosen function of a keypair, an attacker could grind a vanity DID that sorts highest and win **every** concurrent-write tie against every honest peer, permanently. Protocol v4 replaces that final rung with a per-conflict key, `blake3(authorDID ‖ property ‖ value)` (`computeLwwTiebreakKey` in `@xnetjs/core`), so the winner of a tie is a random-oracle function of _what is written_ — a ground identity wins no durable, universal advantage. The key is gated on both changes being v4 (legacy changes fall back to the author DID), is derived at resolution time (never part of the change hash or wire format), and is threaded through `PropertyTimestamp`, the SQLite `node_properties` guard (new nullable `tiebreak_key` column, schema v8), and every conformance kernel. BREAKING: `CURRENT_PROTOCOL_VERSION` is now `4` and new changes are stamped v4. The LWW golden vectors gain `0005-tie-grinding-resistant-key`; `LwwStamp` / `PropertyTimestamp` gain an optional `tiebreakKey`. Mixed fleets converge on exact `{lamport, wallTime}` ties only once both peers are on v4 — a transient rollout window affecting rare exact ties. ### Minor Changes - [#487](#487) [`3bc1b5f`](3bc1b5f) Thanks [@crs48](https://github.com/crs48)! - Harden the sync-integrity primitives so look-alike helpers no longer give false assurance (exploration 0307): - `verifyIntegrity` now performs **real Ed25519 signature verification** against the key recovered from each change's author DID (previously it only checked that the signature field was non-empty). It accepts an optional `resolveKey` override; the default is self-certifying `did:key` resolution. - `attemptRepair`'s `recompute-hash` action — which overwrites a change's stored hash and can launder tampered payloads — is now gated behind an explicit `{ trustHashRecompute: true }` opt-in and refused by default. - `AuthorizedYjsSyncProvider.handleRemoteUpdate` now enforces the Yjs update size cap before applying, and `validateChain` / the handler registry / `quickIntegrityCheck` document that they are structural-only and do not authenticate authorship. ### Patch Changes - Updated dependencies [[`e6b4c6f`](e6b4c6f), [`38fd26f`](38fd26f), [`1de6587`](1de6587)]: - @xnetjs/core@1.0.0 - @xnetjs/crypto@1.0.0 - @xnetjs/identity@1.0.0 ## @xnetjs/react@1.0.0 ### Minor Changes - [#494](#494) [`6acf14b`](6acf14b) Thanks [@crs48](https://github.com/crs48)! - New `usePresence<T>(awareness, initialState)` hook: typed, throttled (~30fps) ephemeral peer state over Yjs Awareness. Pairs with `useNode().awareness` for live cursors, positions, and "who's here" UI without writing the persisted change log. Peers are evicted on disconnect; unmount retracts only the fields the hook owns. - [#488](#488) [`1de6587`](1de6587) Thanks [@crs48](https://github.com/crs48)! - Schema authorization gains `create` and `update` actions — optional refinements of `write` (exploration 0304). A schema may now split its mutation policy into who may **add** nodes vs. who may **modify** existing ones; when a refinement is absent it falls back to the schema's `write` expression, so existing schemas behave identically. - `@xnetjs/core`: `AUTH_ACTIONS` includes `create`/`update`; new `actionExpressionOrder()` and `grantActionSatisfies()` helpers (a `write` grant covers both refinements; granular grants cover only themselves). - `@xnetjs/data`: the policy evaluator resolves actions with the fallback and evaluates `create` against the draft node built from the payload (container relations resolve membership, so creation into a shared Space is genuinely gated); `NodeStore` checks the precise verbs, and remote creates are inferred and checked as `create` instead of failing closed on a not-yet-existing node. New `spaceContributorAuthorization()` cascade — adopted by `ChatMessage` and `Comment` — expresses "members may post, only the author (or space admins) may edit". `StoreAuthAPI.can` accepts an optional draft `node`. - `@xnetjs/react`: new `useCanCreate(schemaId, properties)` hook; `useCan`/`useCanEdit` check the precise `update` verb. - `@xnetjs/runtime`: conformance corpus gains the `authz-actions` suite pinning the fallback table. ### Patch Changes - Updated dependencies [[`e6b4c6f`](e6b4c6f), [`3bc1b5f`](3bc1b5f), [`38fd26f`](38fd26f), [`1de6587`](1de6587)]: - @xnetjs/core@1.0.0 - @xnetjs/sync@1.0.0 - @xnetjs/data@1.0.0 - @xnetjs/plugins@1.0.0 - @xnetjs/runtime@0.4.0 - @xnetjs/crypto@1.0.0 - @xnetjs/data-bridge@1.0.0 - @xnetjs/history@1.0.0 - @xnetjs/identity@1.0.0 ## @xnetjs/runtime@0.4.0 ### Minor Changes - [#488](#488) [`1de6587`](1de6587) Thanks [@crs48](https://github.com/crs48)! - Schema authorization gains `create` and `update` actions — optional refinements of `write` (exploration 0304). A schema may now split its mutation policy into who may **add** nodes vs. who may **modify** existing ones; when a refinement is absent it falls back to the schema's `write` expression, so existing schemas behave identically. - `@xnetjs/core`: `AUTH_ACTIONS` includes `create`/`update`; new `actionExpressionOrder()` and `grantActionSatisfies()` helpers (a `write` grant covers both refinements; granular grants cover only themselves). - `@xnetjs/data`: the policy evaluator resolves actions with the fallback and evaluates `create` against the draft node built from the payload (container relations resolve membership, so creation into a shared Space is genuinely gated); `NodeStore` checks the precise verbs, and remote creates are inferred and checked as `create` instead of failing closed on a not-yet-existing node. New `spaceContributorAuthorization()` cascade — adopted by `ChatMessage` and `Comment` — expresses "members may post, only the author (or space admins) may edit". `StoreAuthAPI.can` accepts an optional draft `node`. - `@xnetjs/react`: new `useCanCreate(schemaId, properties)` hook; `useCan`/`useCanEdit` check the precise `update` verb. - `@xnetjs/runtime`: conformance corpus gains the `authz-actions` suite pinning the fallback table. ### Patch Changes - [#483](#483) [`38fd26f`](38fd26f) Thanks [@crs48](https://github.com/crs48)! - docs(exploration): renumber Effect adoption doc 0300 -> 0303 (collision) Exploration numbers collided across parallel worktrees again (0301 gotcha): 0300 was already taken by RUNNING_AN_XNET_HUB_ON_A_RASPBERRY_PI ([#477](#477)) and 0301/0302 are claimed. Renames the doc and updates the exploration-number references in code comments and CLAUDE.md; no code change (empty changeset). Signed-off-by: xNet Test <test@xnet.dev> - Updated dependencies [[`e6b4c6f`](e6b4c6f), [`3bc1b5f`](3bc1b5f), [`38fd26f`](38fd26f), [`1de6587`](1de6587)]: - @xnetjs/core@1.0.0 - @xnetjs/sync@1.0.0 - @xnetjs/data@1.0.0 - @xnetjs/plugins@1.0.0 - @xnetjs/crypto@1.0.0 - @xnetjs/data-bridge@1.0.0 - @xnetjs/history@1.0.0 - @xnetjs/identity@1.0.0 - @xnetjs/storage@1.0.0 ## @xnetjs/abuse@1.0.0 ### Patch Changes - Updated dependencies []: - @xnetjs/crypto@1.0.0 - @xnetjs/identity@1.0.0 ## @xnetjs/cli@0.1.6 ### Patch Changes - Updated dependencies [[`e6b4c6f`](e6b4c6f), [`3bc1b5f`](3bc1b5f), [`38fd26f`](38fd26f), [`1de6587`](1de6587)]: - @xnetjs/core@1.0.0 - @xnetjs/sync@1.0.0 - @xnetjs/data@1.0.0 - @xnetjs/sqlite@1.0.0 - @xnetjs/plugins@1.0.0 - @xnetjs/runtime@0.4.0 - @xnetjs/crypto@1.0.0 - @xnetjs/identity@1.0.0 ## @xnetjs/crypto@1.0.0 ### Patch Changes - Updated dependencies [[`e6b4c6f`](e6b4c6f), [`38fd26f`](38fd26f), [`1de6587`](1de6587)]: - @xnetjs/core@1.0.0 ## @xnetjs/data-bridge@1.0.0 ### Patch Changes - Updated dependencies [[`e6b4c6f`](e6b4c6f), [`3bc1b5f`](3bc1b5f), [`38fd26f`](38fd26f), [`1de6587`](1de6587)]: - @xnetjs/core@1.0.0 - @xnetjs/sync@1.0.0 - @xnetjs/data@1.0.0 - @xnetjs/sqlite@1.0.0 ## @xnetjs/history@1.0.0 ### Patch Changes - Updated dependencies [[`e6b4c6f`](e6b4c6f), [`3bc1b5f`](3bc1b5f), [`38fd26f`](38fd26f), [`1de6587`](1de6587)]: - @xnetjs/core@1.0.0 - @xnetjs/sync@1.0.0 - @xnetjs/data@1.0.0 ## @xnetjs/identity@1.0.0 ### Patch Changes - Updated dependencies [[`e6b4c6f`](e6b4c6f), [`38fd26f`](38fd26f), [`1de6587`](1de6587)]: - @xnetjs/core@1.0.0 - @xnetjs/crypto@1.0.0 ## @xnetjs/plugins@1.0.0 ### Patch Changes - [#483](#483) [`38fd26f`](38fd26f) Thanks [@crs48](https://github.com/crs48)! - docs(exploration): renumber Effect adoption doc 0300 -> 0303 (collision) Exploration numbers collided across parallel worktrees again (0301 gotcha): 0300 was already taken by RUNNING_AN_XNET_HUB_ON_A_RASPBERRY_PI ([#477](#477)) and 0301/0302 are claimed. Renames the doc and updates the exploration-number references in code comments and CLAUDE.md; no code change (empty changeset). Signed-off-by: xNet Test <test@xnet.dev> - Updated dependencies [[`e6b4c6f`](e6b4c6f), [`38fd26f`](38fd26f), [`1de6587`](1de6587)]: - @xnetjs/core@1.0.0 - @xnetjs/data@1.0.0 - @xnetjs/abuse@1.0.0 ## @xnetjs/storage@1.0.0 ### Patch Changes - Updated dependencies [[`e6b4c6f`](e6b4c6f), [`38fd26f`](38fd26f), [`1de6587`](1de6587)]: - @xnetjs/core@1.0.0 - @xnetjs/sqlite@1.0.0 - @xnetjs/crypto@1.0.0 ## xnet-cloud@0.0.17 ### Patch Changes - Updated dependencies []: - @xnetjs/cloud@0.0.1 - @xnetjs/crypto@1.0.0 ## xnet-demos@0.1.1 ### Patch Changes - Updated dependencies [[`e6b4c6f`](e6b4c6f), [`6acf14b`](6acf14b), [`1de6587`](1de6587)]: - @xnetjs/data@1.0.0 - @xnetjs/react@1.0.0 - @xnetjs/identity@1.0.0 ## @xnetjs/brain@0.0.18 ### Patch Changes - Updated dependencies [[`e6b4c6f`](e6b4c6f), [`1de6587`](1de6587)]: - @xnetjs/data@1.0.0 - @xnetjs/vectors@0.0.1 ## @xnetjs/comms@0.0.18 ### Patch Changes - Updated dependencies [[`e6b4c6f`](e6b4c6f), [`1de6587`](1de6587)]: - @xnetjs/data@1.0.0 - @xnetjs/crypto@1.0.0 ## @xnetjs/dashboard@0.0.18 ### Patch Changes - Updated dependencies [[`e6b4c6f`](e6b4c6f), [`6acf14b`](6acf14b), [`38fd26f`](38fd26f), [`1de6587`](1de6587)]: - @xnetjs/data@1.0.0 - @xnetjs/react@1.0.0 - @xnetjs/plugins@1.0.0 - @xnetjs/social@0.0.18 ## @xnetjs/labs@0.0.18 ### Patch Changes - Updated dependencies [[`e6b4c6f`](e6b4c6f), [`38fd26f`](38fd26f), [`1de6587`](1de6587)]: - @xnetjs/data@1.0.0 - @xnetjs/plugins@1.0.0 ## @xnetjs/licenses@0.0.18 ### Patch Changes - Updated dependencies []: - @xnetjs/crypto@1.0.0 ## @xnetjs/maps@0.0.18 ### Patch Changes - Updated dependencies [[`e6b4c6f`](e6b4c6f), [`1de6587`](1de6587)]: - @xnetjs/data@1.0.0 ## @xnetjs/meetings@0.0.11 ### Patch Changes - Updated dependencies [[`e6b4c6f`](e6b4c6f), [`38fd26f`](38fd26f), [`1de6587`](1de6587)]: - @xnetjs/data@1.0.0 - @xnetjs/plugins@1.0.0 ## @xnetjs/server@0.0.17 ### Patch Changes - Updated dependencies [[`e6b4c6f`](e6b4c6f), [`1de6587`](1de6587)]: - @xnetjs/data@1.0.0 - @xnetjs/crypto@1.0.0 - @xnetjs/data-bridge@1.0.0 - @xnetjs/identity@1.0.0 ## @xnetjs/social@0.0.18 ### Patch Changes - Updated dependencies [[`e6b4c6f`](e6b4c6f), [`1de6587`](1de6587)]: - @xnetjs/data@1.0.0 - @xnetjs/crypto@1.0.0 ## @xnetjs/unreal@0.0.18 ### Patch Changes - Updated dependencies [[`e6b4c6f`](e6b4c6f), [`1de6587`](1de6587)]: - @xnetjs/data@1.0.0 ## xnet-desktop@1.0.0 Desktop shell release riding the @xnetjs/core 1.0.0 train. Desktop-specific changes are not tracked here; see the core packages' changelogs for what shipped.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements exploration 0304 (and writes the doc + docs-site updates for the new style).
What
Schema authorization gains
createandupdateactions — optional refinements of the coarsewriteaction:create→actions.create ?? actions.write;updateand legacywritechecks →actions.update ?? actions.write. Schemas declaring onlywritebehave byte-identically to before (pinned by a fast-check property test).space,channel) resolve membership roles — creation into a shared Space is genuinely gated. The creator role is excluded fromcreatein the new cascade because it always matches on a draft.applyRemoteChangepreviously mapped creates towriteon a not-yet-existing node — the evaluator denies missing nodes, so collaborator creates would be silently dropped the day the evaluator is wired into sync. Creates are now inferred (payload.schemaId+ no stored node) and checked ascreateagainst the payload draft. Regression-tested end-to-end.spaceContributorAuthorization()— "members may post, only the author (or space admins) may edit" — adopted byChatMessageandComment(Comment additionally lets the commenter rung and the target node's owner create).writegrant satisfies both refinements; granular grants stay narrow (fail closed for old callers). Old clients drop unknown action strings — also fail closed.create/update→ hubwrite(parity-tested); the hub grant vocabulary stays coarse for now.authz-actionsgolden-vector suite pins the fallback table; TS reference + Rust kernel both implement and pass it.useCanCreate(schemaId, properties)hook;useCan/useCanEditcheck the preciseupdateverb; the chat composer gates its Send button on a definitive create deny (fail-open whilestore.authis unwired).Validation
AUTH_SCHEMA_INCOMPLETE_MUTATION_ACTIONS, PUBLIC-on-create/update).cargo test(Rust kernel) green incl.l3_authz_actions.@xnetjs/core,@xnetjs/data,@xnetjs/react,@xnetjs/runtime.🤖 Generated with Claude Code