{ "format": "ess-docs/1", "system": "mandate", "version": "v1", "pages": [ { "id": "index", "title": [ { "inline": "text", "text": "mandate v1" } ], "provenance": { "provenance": { "system": "mandate", "specification_version": "v1", "source_digest": "2f11d2daffc2d75bb4ca8c0485aedc56fb2a712cdaed6347fc48b8ba2b1f7ca6", "contract_digest": "c10ff6000b18ab217e70b48ced7e45b185d42665b843db0c0d17aae4c5394ee5" }, "slice": { "of": "whole-model" } }, "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "Standalone identity, authorization and constrained credential contracts. Runtime enforcement and UNMAPPED semantics are explicit obligations." } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "The system as a graph" } ], "anchor": "the-system-as-a-graph", "blocks": [ { "block": "diagram", "kind": "system", "source": "flowchart TB\n subgraph unit0[\"mandate-authorization\"]\n cmd2[\"mandate.authorization.Check\"]\n cmd38[\"mandate.graph.DeregisterResource\"]\n cmd39[\"mandate.graph.RegisterResource\"]\n cmd40[\"mandate.graph.RemoveRelation\"]\n cmd41[\"mandate.graph.RevokeGrant\"]\n cmd42[\"mandate.graph.WriteRelationship\"]\n cmd48[\"mandate.policy.SupersedeAuthorizationModel\"]\n cmd49[\"mandate.policy.SupersedePolicy\"]\n evt7[\"mandate.authorization.DecisionRecorded\"]\n evt48[\"mandate.graph.GrantRevoked\"]\n evt49[\"mandate.graph.RelationRemoved\"]\n evt50[\"mandate.graph.RelationshipWritten\"]\n evt51[\"mandate.graph.ResourceDeregistered\"]\n evt52[\"mandate.graph.ResourceRegistered\"]\n evt61[\"mandate.policy.AuthorizationModelSuperseded\"]\n evt62[\"mandate.policy.PolicySuperseded\"]\n end\n subgraph unit1[\"mandate-control-plane\"]\n cmd15[\"mandate.delegation.CompleteExecution\"]\n cmd16[\"mandate.delegation.ConsumeApproval\"]\n cmd17[\"mandate.delegation.CreateDelegation\"]\n cmd18[\"mandate.delegation.RetireAgent\"]\n cmd19[\"mandate.delegation.RevokeDelegation\"]\n cmd20[\"mandate.delegation.SupersedeAgentCapabilityCeiling\"]\n cmd21[\"mandate.directory.CompleteSyncJob\"]\n cmd22[\"mandate.directory.CreateDirectoryGroupTeamMapping\"]\n cmd23[\"mandate.directory.FailSyncJob\"]\n cmd24[\"mandate.directory.RemoveDirectoryGroupMembership\"]\n cmd25[\"mandate.directory.RemoveDirectoryGroupTeamMapping\"]\n cmd26[\"mandate.directory.RemoveMembershipContribution\"]\n cmd27[\"mandate.directory.RetireDirectoryGroup\"]\n cmd28[\"mandate.directory.SyncDirectoryMembership\"]\n cmd29[\"mandate.federation.AuthenticateFederation\"]\n cmd30[\"mandate.federation.AuthorizePublicClient\"]\n cmd31[\"mandate.federation.DisableFederationConnection\"]\n cmd32[\"mandate.federation.DisableOAuthClient\"]\n cmd33[\"mandate.federation.LinkExternalPrincipal\"]\n cmd34[\"mandate.federation.ProvisionExternalPrincipal\"]\n cmd35[\"mandate.federation.RegisterFederationConnection\"]\n cmd36[\"mandate.federation.RegisterOAuthClient\"]\n cmd37[\"mandate.federation.UnlinkExternalPrincipal\"]\n cmd43[\"mandate.identity.DisablePrincipal\"]\n cmd44[\"mandate.identity.IncrementSecurityEpoch\"]\n cmd45[\"mandate.identity.RefreshSession\"]\n cmd46[\"mandate.identity.RevokeRefreshCredential\"]\n cmd47[\"mandate.identity.RevokeSession\"]\n cmd50[\"mandate.tenancy.AddOrganizationMembership\"]\n cmd51[\"mandate.tenancy.AddTeamMembership\"]\n cmd52[\"mandate.tenancy.CloseOrganization\"]\n cmd53[\"mandate.tenancy.CreateOrganization\"]\n cmd54[\"mandate.tenancy.CreateSpace\"]\n cmd55[\"mandate.tenancy.CreateTeam\"]\n cmd56[\"mandate.tenancy.RemoveOrganizationMembership\"]\n cmd57[\"mandate.tenancy.RemoveTeamMembership\"]\n cmd58[\"mandate.tenancy.RetireSpace\"]\n cmd59[\"mandate.tenancy.RetireTeam\"]\n cmd60[\"mandate.workload.RevokeWorkloadIdentity\"]\n evt21[\"mandate.delegation.AgentCapabilityCeilingSuperseded\"]\n evt22[\"mandate.delegation.AgentRetired\"]\n evt23[\"mandate.delegation.ApprovalConsumed\"]\n evt24[\"mandate.delegation.DelegationCreated\"]\n evt25[\"mandate.delegation.DelegationRevoked\"]\n evt26[\"mandate.delegation.ExecutionCompleted\"]\n evt27[\"mandate.directory.DirectoryGroupMembershipChanged\"]\n evt28[\"mandate.directory.DirectoryGroupMembershipRecorded\"]\n evt29[\"mandate.directory.DirectoryGroupMembershipRemoved\"]\n evt30[\"mandate.directory.DirectoryGroupRecorded\"]\n evt31[\"mandate.directory.DirectoryGroupRetired\"]\n evt32[\"mandate.directory.DirectoryGroupTeamMappingCreated\"]\n evt33[\"mandate.directory.DirectoryGroupTeamMappingRemoved\"]\n evt34[\"mandate.directory.MembershipContributionRecorded\"]\n evt35[\"mandate.directory.MembershipContributionRemoved\"]\n evt36[\"mandate.directory.SyncJobCompleted\"]\n evt37[\"mandate.directory.SyncJobFailed\"]\n evt38[\"mandate.directory.SyncJobRecorded\"]\n evt39[\"mandate.federation.AuthorizationCodeIssued\"]\n evt40[\"mandate.federation.ExternalPrincipalLinked\"]\n evt41[\"mandate.federation.ExternalPrincipalProvisioned\"]\n evt42[\"mandate.federation.ExternalPrincipalUnlinked\"]\n evt43[\"mandate.federation.FederationAuthenticated\"]\n evt44[\"mandate.federation.FederationConnectionCreated\"]\n evt45[\"mandate.federation.FederationConnectionDisabled\"]\n evt46[\"mandate.federation.OAuthClientDisabled\"]\n evt47[\"mandate.federation.OAuthClientRegistered\"]\n evt53[\"mandate.identity.EpochSnapshotRecorded\"]\n evt54[\"mandate.identity.PrincipalDisabled\"]\n evt55[\"mandate.identity.RefreshCredentialRevoked\"]\n evt56[\"mandate.identity.SecurityEpochIncremented\"]\n evt57[\"mandate.identity.SecurityEpochRecorded\"]\n evt58[\"mandate.identity.SessionOpened\"]\n evt59[\"mandate.identity.SessionRefreshed\"]\n evt60[\"mandate.identity.SessionRevoked\"]\n evt63[\"mandate.tenancy.OrganizationClosed\"]\n evt64[\"mandate.tenancy.OrganizationCreated\"]\n evt65[\"mandate.tenancy.OrganizationMembershipAdded\"]\n evt66[\"mandate.tenancy.OrganizationMembershipRemoved\"]\n evt67[\"mandate.tenancy.SpaceCreated\"]\n evt68[\"mandate.tenancy.SpaceRetired\"]\n evt69[\"mandate.tenancy.TeamCreated\"]\n evt70[\"mandate.tenancy.TeamMembershipAdded\"]\n evt71[\"mandate.tenancy.TeamMembershipRemoved\"]\n evt72[\"mandate.tenancy.TeamRetired\"]\n evt73[\"mandate.workload.WorkloadIdentityRevoked\"]\n end\n subgraph unit2[\"mandate-sts\"]\n cmd3[\"mandate.credential.DisableResourceServer\"]\n cmd4[\"mandate.credential.ExchangeCredential\"]\n cmd5[\"mandate.credential.IntrospectCredential\"]\n cmd6[\"mandate.credential.IssueAuthorizationCode\"]\n cmd7[\"mandate.credential.IssueReferenceCredential\"]\n cmd8[\"mandate.credential.IssueSelfContainedCredential\"]\n cmd9[\"mandate.credential.RedeemAuthorizationCode\"]\n cmd10[\"mandate.credential.RegisterResourceServer\"]\n cmd11[\"mandate.credential.RegisterSigningKey\"]\n cmd12[\"mandate.credential.RetireSigningKey\"]\n cmd13[\"mandate.credential.RevokeAccessCredential\"]\n cmd14[\"mandate.credential.RevokeSigningKey\"]\n evt8[\"mandate.credential.AccessCredentialRevoked\"]\n evt9[\"mandate.credential.AuthorizationCodeIssued\"]\n evt10[\"mandate.credential.AuthorizationCodeRedeemed\"]\n evt11[\"mandate.credential.CredentialIntrospected\"]\n evt12[\"mandate.credential.CredentialReferenceIssued\"]\n evt13[\"mandate.credential.CredentialSelfContainedIssued\"]\n evt14[\"mandate.credential.ResourceServerDisabled\"]\n evt15[\"mandate.credential.ResourceServerRegistered\"]\n evt16[\"mandate.credential.SigningKeyRegistered\"]\n evt17[\"mandate.credential.SigningKeyRetired\"]\n evt18[\"mandate.credential.SigningKeyRevoked\"]\n evt19[\"mandate.credential.TokenExchangeAllowed\"]\n evt20[\"mandate.credential.TokenExchangeDenied\"]\n end\n subgraph unit3[\"mandate-worker\"]\n cmd0[\"mandate.audit.RecordAuditEvent\"]\n cmd1[\"mandate.audit.RedactAuditEvent\"]\n evt0[\"mandate.audit.AuditEventRecorded\"]\n evt1[\"mandate.audit.AuditEventRedacted\"]\n evt2[\"mandate.audit.CredentialRevoked\"]\n evt3[\"mandate.audit.DirectoryGroupCreated\"]\n evt4[\"mandate.audit.ExternalPrincipalUnlinked\"]\n evt5[\"mandate.audit.FederationConnectionChanged\"]\n evt6[\"mandate.audit.TokenExchangeDenied\"]\n end\n cmd0 -->|\"recorded\"| evt0\n cmd1 -->|\"accepted\"| evt1\n cmd2 -->|\"accepted\"| evt7\n cmd3 -->|\"accepted\"| evt14\n cmd4 -->|\"accepted\"| evt19\n cmd5 -->|\"accepted\"| evt11\n cmd6 -->|\"accepted\"| evt9\n cmd7 -->|\"accepted\"| evt12\n cmd8 -->|\"accepted\"| evt13\n cmd9 -->|\"accepted\"| evt10\n cmd10 -->|\"accepted\"| evt15\n cmd11 -->|\"accepted\"| evt16\n cmd12 -->|\"accepted\"| evt17\n cmd13 -->|\"accepted\"| evt8\n cmd14 -->|\"accepted\"| evt18\n cmd15 -->|\"accepted\"| evt26\n cmd16 -->|\"accepted\"| evt23\n cmd17 -->|\"accepted\"| evt24\n cmd18 -->|\"accepted\"| evt22\n cmd19 -->|\"accepted\"| evt25\n cmd20 -->|\"accepted\"| evt21\n cmd21 -->|\"accepted\"| evt36\n cmd22 -->|\"accepted\"| evt32\n cmd23 -->|\"accepted\"| evt37\n cmd24 -->|\"accepted\"| evt29\n cmd25 -->|\"accepted\"| evt33\n cmd26 -->|\"accepted\"| evt35\n cmd27 -->|\"accepted\"| evt31\n cmd28 -->|\"accepted\"| evt27\n cmd29 -->|\"accepted\"| evt43\n cmd30 -->|\"accepted\"| evt39\n cmd31 -->|\"accepted\"| evt45\n cmd32 -->|\"accepted\"| evt46\n cmd33 -->|\"accepted\"| evt40\n cmd34 -->|\"accepted\"| evt41\n cmd35 -->|\"accepted\"| evt44\n cmd36 -->|\"accepted\"| evt47\n cmd37 -->|\"accepted\"| evt42\n cmd38 -->|\"accepted\"| evt51\n cmd39 -->|\"accepted\"| evt52\n cmd40 -->|\"accepted\"| evt49\n cmd41 -->|\"accepted\"| evt48\n cmd42 -->|\"accepted\"| evt50\n cmd43 -->|\"accepted\"| evt54\n cmd44 -->|\"accepted\"| evt56\n cmd45 -->|\"accepted\"| evt59\n cmd46 -->|\"accepted\"| evt55\n cmd47 -->|\"accepted\"| evt60\n cmd48 -->|\"accepted\"| evt61\n cmd49 -->|\"accepted\"| evt62\n cmd50 -->|\"accepted\"| evt65\n cmd51 -->|\"accepted\"| evt70\n cmd52 -->|\"accepted\"| evt63\n cmd53 -->|\"accepted\"| evt64\n cmd54 -->|\"accepted\"| evt67\n cmd55 -->|\"accepted\"| evt69\n cmd56 -->|\"accepted\"| evt66\n cmd57 -->|\"accepted\"| evt71\n cmd58 -->|\"accepted\"| evt68\n cmd59 -->|\"accepted\"| evt72\n cmd60 -->|\"accepted\"| evt73" }, { "block": "prose", "text": [ { "inline": "text", "text": "A command is accepted by the component that owns its context, emits the events one of its outcomes declares, and a dashed edge is a binding carrying an event into the next command. Design §9 begins one step earlier, at the actor who invokes the first command, and so does this graph: a solid edge out of an actor is a grant, and an actor drawn with no edge at all may invoke nothing — which is something the model says, not an arrow somebody forgot." } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Bounded contexts" } ], "anchor": "bounded-contexts", "blocks": [ { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-audit" }, "text": [ { "inline": "text", "text": "audit" } ] } ] }, { "inline": "text", "text": " (" }, { "inline": "code", "text": "mandate.audit" }, { "inline": "text", "text": ")" }, { "inline": "text", "text": " — Canonical redacted audit records and the trusted worker append port. UNMAPPED-AUDIT-ROUTING: per-domain event mapping, durable outbox transport, the concrete retention floor and failure policy remain required; retention itself is redaction, never deletion. Named AuditAction and AuditOutcome do not admit arbitrary values." }, { "inline": "text", "text": " No types, one entity, no views, two commands, seven events, one error and no actors." } ] } ], [ { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-authorization" }, "text": [ { "inline": "text", "text": "authorization" } ] } ] }, { "inline": "text", "text": " (" }, { "inline": "code", "text": "mandate.authorization" }, { "inline": "text", "text": ")" }, { "inline": "text", "text": " No types, no entities, no views, one command, one event, one error and no actors." } ] } ], [ { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-core" }, "text": [ { "inline": "text", "text": "core" } ] } ] }, { "inline": "text", "text": " (" }, { "inline": "code", "text": "mandate.core" }, { "inline": "text", "text": ")" }, { "inline": "text", "text": " 74 types, no entities, no views, no commands, no events, no errors and no actors." } ] } ], [ { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-credential" }, "text": [ { "inline": "text", "text": "credential" } ] } ] }, { "inline": "text", "text": " (" }, { "inline": "code", "text": "mandate.credential" }, { "inline": "text", "text": ")" }, { "inline": "text", "text": " No types, four entities, no views, 12 commands, 13 events, one error and no actors." } ] } ], [ { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-delegation" }, "text": [ { "inline": "text", "text": "delegation" } ] } ] }, { "inline": "text", "text": " (" }, { "inline": "code", "text": "mandate.delegation" }, { "inline": "text", "text": ")" }, { "inline": "text", "text": " No types, five entities, no views, six commands, six events, one error and no actors." } ] } ], [ { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-directory" }, "text": [ { "inline": "text", "text": "directory" } ] } ] }, { "inline": "text", "text": " (" }, { "inline": "code", "text": "mandate.directory" }, { "inline": "text", "text": ")" }, { "inline": "text", "text": " No types, five entities, no views, eight commands, 12 events, one error and no actors." } ] } ], [ { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-federation" }, "text": [ { "inline": "text", "text": "federation" } ] } ] }, { "inline": "text", "text": " (" }, { "inline": "code", "text": "mandate.federation" }, { "inline": "text", "text": ")" }, { "inline": "text", "text": " No types, three entities, no views, nine commands, nine events, one error and no actors." } ] } ], [ { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-graph" }, "text": [ { "inline": "text", "text": "graph" } ] } ] }, { "inline": "text", "text": " (" }, { "inline": "code", "text": "mandate.graph" }, { "inline": "text", "text": ")" }, { "inline": "text", "text": " — Resource topology, tagged principal-or-team relationship subjects and grants. UNMAPPED-SUBJECT-RELATIONS: ESS cannot select a union branch as a relation carrier. Each chosen principal/team branch references exactly one existing target; conditional foreign-key and tenant membership validation remain required before graph runtime admission." }, { "inline": "text", "text": " No types, three entities, no views, five commands, five events, one error and no actors." } ] } ], [ { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-identity" }, "text": [ { "inline": "text", "text": "identity" } ] } ] }, { "inline": "text", "text": " (" }, { "inline": "code", "text": "mandate.identity" }, { "inline": "text", "text": ")" }, { "inline": "text", "text": " — Principal, session and independent principal/organization/federation generation ownership. UNMAPPED-EPOCH: each generation record declares one non-negative Integer generation, the recorded stand-in for the addendum's u64; monotonic increment, denial at the maximum and per-dimension snapshot values are absent until supported. EpochSnapshotRef is an immutable record handle, not a generation number. Refresh and exchange cannot be implemented without closing this blocker." }, { "inline": "text", "text": " No types, seven entities, no views, five commands, eight events, one error and no actors." } ] } ], [ { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-policy" }, "text": [ { "inline": "text", "text": "policy" } ] } ] }, { "inline": "text", "text": " (" }, { "inline": "code", "text": "mandate.policy" }, { "inline": "text", "text": ")" }, { "inline": "text", "text": " No types, two entities, no views, two commands, two events, one error and no actors." } ] } ], [ { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-tenancy" }, "text": [ { "inline": "text", "text": "tenancy" } ] } ] }, { "inline": "text", "text": " (" }, { "inline": "code", "text": "mandate.tenancy" }, { "inline": "text", "text": ")" }, { "inline": "text", "text": " No types, five entities, no views, 10 commands, 10 events, one error and no actors." } ] } ], [ { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-workload" }, "text": [ { "inline": "text", "text": "workload" } ] } ] }, { "inline": "text", "text": " (" }, { "inline": "code", "text": "mandate.workload" }, { "inline": "text", "text": ")" }, { "inline": "text", "text": " No types, one entity, no views, one command, one event, one error and no actors." } ] } ] ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Components" } ], "anchor": "components", "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "A component is a unit of ownership, not a deployment. How many of each runs, and what each needs, is " }, { "inline": "link", "to": { "target": "page", "page": "topology" }, "text": [ { "inline": "text", "text": "the topology" } ] }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "mandate-authorization" } ] }, { "inline": "text", "text": " — Planned deployment boundary; exact domain-to-library responsibilities and required adapter/worker gaps are recorded in docs/architecture/ownership.md." }, { "inline": "text", "text": " It owns " }, { "inline": "link", "to": { "target": "page", "page": "domains/mandate-authorization" }, "text": [ { "inline": "code", "text": "mandate.authorization" } ] }, { "inline": "text", "text": ", " }, { "inline": "link", "to": { "target": "page", "page": "domains/mandate-graph" }, "text": [ { "inline": "code", "text": "mandate.graph" } ] }, { "inline": "text", "text": " and " }, { "inline": "link", "to": { "target": "page", "page": "domains/mandate-policy" }, "text": [ { "inline": "code", "text": "mandate.policy" } ] }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It accepts " }, { "inline": "code", "text": "mandate.authorization.Check" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.graph.DeregisterResource" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.graph.RegisterResource" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.graph.RemoveRelation" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.graph.RevokeGrant" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.graph.WriteRelationship" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.policy.SupersedeAuthorizationModel" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "mandate.policy.SupersedePolicy" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It publishes " }, { "inline": "code", "text": "mandate.authorization.DecisionRecorded" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.graph.GrantRevoked" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.graph.RelationRemoved" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.graph.RelationshipWritten" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.graph.ResourceDeregistered" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.graph.ResourceRegistered" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.policy.AuthorizationModelSuperseded" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "mandate.policy.PolicySuperseded" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "mandate-control-plane" } ] }, { "inline": "text", "text": " — Administrative deployment and documentation publisher for the shared mandate.core vocabulary. All four deployments compile those shared library types; core is not a remote control-plane runtime dependency. See docs/architecture/ownership.md." }, { "inline": "text", "text": " It owns " }, { "inline": "link", "to": { "target": "page", "page": "domains/mandate-core" }, "text": [ { "inline": "code", "text": "mandate.core" } ] }, { "inline": "text", "text": ", " }, { "inline": "link", "to": { "target": "page", "page": "domains/mandate-delegation" }, "text": [ { "inline": "code", "text": "mandate.delegation" } ] }, { "inline": "text", "text": ", " }, { "inline": "link", "to": { "target": "page", "page": "domains/mandate-directory" }, "text": [ { "inline": "code", "text": "mandate.directory" } ] }, { "inline": "text", "text": ", " }, { "inline": "link", "to": { "target": "page", "page": "domains/mandate-federation" }, "text": [ { "inline": "code", "text": "mandate.federation" } ] }, { "inline": "text", "text": ", " }, { "inline": "link", "to": { "target": "page", "page": "domains/mandate-identity" }, "text": [ { "inline": "code", "text": "mandate.identity" } ] }, { "inline": "text", "text": ", " }, { "inline": "link", "to": { "target": "page", "page": "domains/mandate-tenancy" }, "text": [ { "inline": "code", "text": "mandate.tenancy" } ] }, { "inline": "text", "text": " and " }, { "inline": "link", "to": { "target": "page", "page": "domains/mandate-workload" }, "text": [ { "inline": "code", "text": "mandate.workload" } ] }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It accepts " }, { "inline": "code", "text": "mandate.delegation.CompleteExecution" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.delegation.ConsumeApproval" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.delegation.CreateDelegation" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.delegation.RetireAgent" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.delegation.RevokeDelegation" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.delegation.SupersedeAgentCapabilityCeiling" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.directory.CompleteSyncJob" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.directory.CreateDirectoryGroupTeamMapping" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.directory.FailSyncJob" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.directory.RemoveDirectoryGroupMembership" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.directory.RemoveDirectoryGroupTeamMapping" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.directory.RemoveMembershipContribution" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.directory.RetireDirectoryGroup" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.directory.SyncDirectoryMembership" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.federation.AuthenticateFederation" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.federation.AuthorizePublicClient" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.federation.DisableFederationConnection" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.federation.DisableOAuthClient" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.federation.LinkExternalPrincipal" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.federation.ProvisionExternalPrincipal" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.federation.RegisterFederationConnection" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.federation.RegisterOAuthClient" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.federation.UnlinkExternalPrincipal" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.identity.DisablePrincipal" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.identity.IncrementSecurityEpoch" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.identity.RefreshSession" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.identity.RevokeRefreshCredential" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.identity.RevokeSession" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.tenancy.AddOrganizationMembership" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.tenancy.AddTeamMembership" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.tenancy.CloseOrganization" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.tenancy.CreateOrganization" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.tenancy.CreateSpace" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.tenancy.CreateTeam" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.tenancy.RemoveOrganizationMembership" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.tenancy.RemoveTeamMembership" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.tenancy.RetireSpace" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.tenancy.RetireTeam" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "mandate.workload.RevokeWorkloadIdentity" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It publishes " }, { "inline": "code", "text": "mandate.delegation.AgentCapabilityCeilingSuperseded" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.delegation.AgentRetired" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.delegation.ApprovalConsumed" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.delegation.DelegationCreated" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.delegation.DelegationRevoked" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.delegation.ExecutionCompleted" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.directory.DirectoryGroupMembershipChanged" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.directory.DirectoryGroupMembershipRecorded" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.directory.DirectoryGroupMembershipRemoved" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.directory.DirectoryGroupRecorded" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.directory.DirectoryGroupRetired" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.directory.DirectoryGroupTeamMappingCreated" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.directory.DirectoryGroupTeamMappingRemoved" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.directory.MembershipContributionRecorded" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.directory.MembershipContributionRemoved" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.directory.SyncJobCompleted" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.directory.SyncJobFailed" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.directory.SyncJobRecorded" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.federation.AuthorizationCodeIssued" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.federation.ExternalPrincipalLinked" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.federation.ExternalPrincipalProvisioned" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.federation.ExternalPrincipalUnlinked" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.federation.FederationAuthenticated" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.federation.FederationConnectionCreated" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.federation.FederationConnectionDisabled" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.federation.OAuthClientDisabled" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.federation.OAuthClientRegistered" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.identity.EpochSnapshotRecorded" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.identity.PrincipalDisabled" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.identity.RefreshCredentialRevoked" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.identity.SecurityEpochIncremented" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.identity.SecurityEpochRecorded" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.identity.SessionOpened" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.identity.SessionRefreshed" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.identity.SessionRevoked" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.tenancy.OrganizationClosed" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.tenancy.OrganizationCreated" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.tenancy.OrganizationMembershipAdded" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.tenancy.OrganizationMembershipRemoved" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.tenancy.SpaceCreated" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.tenancy.SpaceRetired" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.tenancy.TeamCreated" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.tenancy.TeamMembershipAdded" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.tenancy.TeamMembershipRemoved" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.tenancy.TeamRetired" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "mandate.workload.WorkloadIdentityRevoked" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "mandate-sts" } ] }, { "inline": "text", "text": " — Planned deployment boundary; exact domain-to-library responsibilities and required adapter/worker gaps are recorded in docs/architecture/ownership.md." }, { "inline": "text", "text": " It owns " }, { "inline": "link", "to": { "target": "page", "page": "domains/mandate-credential" }, "text": [ { "inline": "code", "text": "mandate.credential" } ] }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It accepts " }, { "inline": "code", "text": "mandate.credential.DisableResourceServer" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.credential.ExchangeCredential" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.credential.IntrospectCredential" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.credential.IssueAuthorizationCode" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.credential.IssueReferenceCredential" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.credential.IssueSelfContainedCredential" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.credential.RedeemAuthorizationCode" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.credential.RegisterResourceServer" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.credential.RegisterSigningKey" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.credential.RetireSigningKey" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.credential.RevokeAccessCredential" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "mandate.credential.RevokeSigningKey" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It publishes " }, { "inline": "code", "text": "mandate.credential.AccessCredentialRevoked" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.credential.AuthorizationCodeIssued" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.credential.AuthorizationCodeRedeemed" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.credential.CredentialIntrospected" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.credential.CredentialReferenceIssued" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.credential.CredentialSelfContainedIssued" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.credential.ResourceServerDisabled" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.credential.ResourceServerRegistered" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.credential.SigningKeyRegistered" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.credential.SigningKeyRetired" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.credential.SigningKeyRevoked" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.credential.TokenExchangeAllowed" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "mandate.credential.TokenExchangeDenied" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "mandate-worker" } ] }, { "inline": "text", "text": " — Planned deployment boundary; exact domain-to-library responsibilities and required adapter/worker gaps are recorded in docs/architecture/ownership.md." }, { "inline": "text", "text": " It owns " }, { "inline": "link", "to": { "target": "page", "page": "domains/mandate-audit" }, "text": [ { "inline": "code", "text": "mandate.audit" } ] }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It accepts " }, { "inline": "code", "text": "mandate.audit.RecordAuditEvent" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "mandate.audit.RedactAuditEvent" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It publishes " }, { "inline": "code", "text": "mandate.audit.AuditEventRecorded" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.audit.AuditEventRedacted" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.audit.CredentialRevoked" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.audit.DirectoryGroupCreated" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.audit.ExternalPrincipalUnlinked" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.audit.FederationConnectionChanged" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "mandate.audit.TokenExchangeDenied" }, { "inline": "text", "text": "." } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "The other pages" } ], "anchor": "the-other-pages", "blocks": [ { "block": "table", "columns": [ [ { "inline": "text", "text": "page" } ], [ { "inline": "text", "text": "what is on it" } ] ], "rows": [ [ [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-audit" }, "text": [ { "inline": "text", "text": "audit" } ] } ], [ { "inline": "text", "text": "the " }, { "inline": "code", "text": "mandate.audit" }, { "inline": "text", "text": " vocabulary: its types, entities, views, commands, events, errors and actors" } ] ], [ [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-authorization" }, "text": [ { "inline": "text", "text": "authorization" } ] } ], [ { "inline": "text", "text": "the " }, { "inline": "code", "text": "mandate.authorization" }, { "inline": "text", "text": " vocabulary: its types, entities, views, commands, events, errors and actors" } ] ], [ [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-core" }, "text": [ { "inline": "text", "text": "core" } ] } ], [ { "inline": "text", "text": "the " }, { "inline": "code", "text": "mandate.core" }, { "inline": "text", "text": " vocabulary: its types, entities, views, commands, events, errors and actors" } ] ], [ [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-credential" }, "text": [ { "inline": "text", "text": "credential" } ] } ], [ { "inline": "text", "text": "the " }, { "inline": "code", "text": "mandate.credential" }, { "inline": "text", "text": " vocabulary: its types, entities, views, commands, events, errors and actors" } ] ], [ [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-delegation" }, "text": [ { "inline": "text", "text": "delegation" } ] } ], [ { "inline": "text", "text": "the " }, { "inline": "code", "text": "mandate.delegation" }, { "inline": "text", "text": " vocabulary: its types, entities, views, commands, events, errors and actors" } ] ], [ [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-directory" }, "text": [ { "inline": "text", "text": "directory" } ] } ], [ { "inline": "text", "text": "the " }, { "inline": "code", "text": "mandate.directory" }, { "inline": "text", "text": " vocabulary: its types, entities, views, commands, events, errors and actors" } ] ], [ [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-federation" }, "text": [ { "inline": "text", "text": "federation" } ] } ], [ { "inline": "text", "text": "the " }, { "inline": "code", "text": "mandate.federation" }, { "inline": "text", "text": " vocabulary: its types, entities, views, commands, events, errors and actors" } ] ], [ [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-graph" }, "text": [ { "inline": "text", "text": "graph" } ] } ], [ { "inline": "text", "text": "the " }, { "inline": "code", "text": "mandate.graph" }, { "inline": "text", "text": " vocabulary: its types, entities, views, commands, events, errors and actors" } ] ], [ [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-identity" }, "text": [ { "inline": "text", "text": "identity" } ] } ], [ { "inline": "text", "text": "the " }, { "inline": "code", "text": "mandate.identity" }, { "inline": "text", "text": " vocabulary: its types, entities, views, commands, events, errors and actors" } ] ], [ [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-policy" }, "text": [ { "inline": "text", "text": "policy" } ] } ], [ { "inline": "text", "text": "the " }, { "inline": "code", "text": "mandate.policy" }, { "inline": "text", "text": " vocabulary: its types, entities, views, commands, events, errors and actors" } ] ], [ [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-tenancy" }, "text": [ { "inline": "text", "text": "tenancy" } ] } ], [ { "inline": "text", "text": "the " }, { "inline": "code", "text": "mandate.tenancy" }, { "inline": "text", "text": " vocabulary: its types, entities, views, commands, events, errors and actors" } ] ], [ [ { "inline": "link", "to": { "target": "page", "page": "domains/mandate-workload" }, "text": [ { "inline": "text", "text": "workload" } ] } ], [ { "inline": "text", "text": "the " }, { "inline": "code", "text": "mandate.workload" }, { "inline": "text", "text": " vocabulary: its types, entities, views, commands, events, errors and actors" } ] ], [ [ { "inline": "link", "to": { "target": "page", "page": "interactions" }, "text": [ { "inline": "text", "text": "Interactions" } ] } ], [ { "inline": "text", "text": "every binding, with what it guarantees and what happens when it fails" } ] ], [ [ { "inline": "link", "to": { "target": "page", "page": "crossings" }, "text": [ { "inline": "text", "text": "Type crossings" } ] } ], [ { "inline": "text", "text": "every conversion this system permits, and the reason someone gave for it" } ] ], [ [ { "inline": "link", "to": { "target": "page", "page": "topology" }, "text": [ { "inline": "text", "text": "Topology" } ] } ], [ { "inline": "text", "text": "what each component needs in order to run" } ] ] ] } ] }, { "block": "list", "ordered": false, "items": [] } ] }, { "id": "domains/mandate-audit", "title": [ { "inline": "text", "text": "audit" } ], "about": { "kind": "domain", "name": "mandate.audit" }, "provenance": { "provenance": { "system": "mandate", "specification_version": "v1", "source_digest": "2f11d2daffc2d75bb4ca8c0485aedc56fb2a712cdaed6347fc48b8ba2b1f7ca6", "contract_digest": "slice-sha256/2:6bf4b0d22c19d7ef08826bd3fbe010083c8c3ee4cb3003c0894f6f34a6a6144f" }, "slice": { "of": "constructs", "seeds": [ { "kind": "domain", "name": "mandate.audit" }, { "kind": "type", "name": "mandate.audit.AuditEvent.State" }, { "kind": "entity", "name": "mandate.audit.AuditEvent" }, { "kind": "command", "name": "mandate.audit.RecordAuditEvent" }, { "kind": "command", "name": "mandate.audit.RedactAuditEvent" }, { "kind": "event", "name": "mandate.audit.AuditEventRecorded" }, { "kind": "event", "name": "mandate.audit.AuditEventRedacted" }, { "kind": "event", "name": "mandate.audit.CredentialRevoked" }, { "kind": "event", "name": "mandate.audit.DirectoryGroupCreated" }, { "kind": "event", "name": "mandate.audit.ExternalPrincipalUnlinked" }, { "kind": "event", "name": "mandate.audit.FederationConnectionChanged" }, { "kind": "event", "name": "mandate.audit.TokenExchangeDenied" }, { "kind": "error", "name": "mandate.audit.Denied" }, { "kind": "component", "name": "mandate-authorization" }, { "kind": "component", "name": "mandate-control-plane" }, { "kind": "component", "name": "mandate-sts" }, { "kind": "component", "name": "mandate-worker" } ] } }, "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "Canonical redacted audit records and the trusted worker append port. UNMAPPED-AUDIT-ROUTING: per-domain event mapping, durable outbox transport, the concrete retention floor and failure policy remain required; retention itself is redaction, never deletion. Named AuditAction and AuditOutcome do not admit arbitrary values." } ] }, { "block": "prose", "text": [ { "inline": "code", "text": "mandate.audit" }, { "inline": "text", "text": " is one of mandate's bounded contexts. " }, { "inline": "link", "to": { "target": "page", "page": "index" }, "text": [ { "inline": "text", "text": "Back to the index" } ] }, { "inline": "text", "text": "." } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Entities" } ], "anchor": "entities", "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "An entity is what this context is about: something with an identity that outlives any one request, a shape, and a lifecycle. The lifecycle is exhaustive — a move that is not drawn below is a move this specification does not permit, and that is the only way it says so. Every move is labelled with the command that takes it, because a move nothing can trigger is refused rather than drawn." } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AuditEvent" } ], "anchor": "auditevent", "about": { "kind": "entity", "name": "mandate.audit.AuditEvent" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.audit.AuditEvent" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.AuditEventId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "subject" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "actor" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "event_type" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuditAction" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "correlation" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CorrelationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "decision_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "requested_audience" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "issued_audience" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "requested_scope" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "credential_kind" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "delegation_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "execution_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "result" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuditOutcome" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "occurred_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "policy_version" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "model_version" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "authz_revision" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "source_credential_kind" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "source_credential_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "issued_credential_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "issued_scope" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "principal" }, "text": [ { "inline": "code", "text": "mandate.identity.Principal" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "subject_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "AuditEvent.subject" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "principal" }, "text": [ { "inline": "code", "text": "mandate.identity.Principal" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "actor_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "AuditEvent.actor" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "AuditEvent.organization_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-delegation", "anchor": "delegation" }, "text": [ { "inline": "code", "text": "mandate.delegation.Delegation" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "delegation_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "AuditEvent.delegation_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-delegation", "anchor": "execution" }, "text": [ { "inline": "code", "text": "mandate.delegation.Execution" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "execution_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "AuditEvent.execution_id" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.audit.AuditEvent.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Redacted" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Redacted" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Recorded\n Recorded --> Redacted: redact (RedactAuditEvent)\n Redacted --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "redact" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.audit.RedactAuditEvent" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is brought into existence by " }, { "inline": "code", "text": "mandate.audit.RecordAuditEvent" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "recorded" }, { "inline": "text", "text": " outcome" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Redacted" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Recorded" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Commands" } ], "anchor": "commands", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RecordAuditEvent" } ], "anchor": "recordauditevent", "about": { "kind": "command", "name": "mandate.audit.RecordAuditEvent" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.audit.RecordAuditEvent" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "emitter_context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "record" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuditRecord" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "recorded" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The trusted append adapter must persist one validated, redacted record before acknowledging its identifier; durable storage/outbox semantics are required under UNMAPPED-AUDIT-ROUTING. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It creates a " }, { "inline": "code", "text": "mandate.audit.AuditEvent" }, { "inline": "text", "text": ", which starts in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The new instance's identity is published as " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": " on " }, { "inline": "code", "text": "mandate.audit.AuditEventRecorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.audit.AuditEventRecorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Emitter is not an authorized trusted event producer, subject/actor/correlation was changed, action/result is unadmitted, payload contains secret material, or durable append/outbox validation fails.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.audit.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RedactAuditEvent" } ], "anchor": "redactauditevent", "about": { "kind": "command", "name": "mandate.audit.RedactAuditEvent" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.audit.RedactAuditEvent" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuditEventId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The only answer to a retention or erasure obligation. The record keeps its identity, its correlation and the fact that it was redacted; the redacted content does not reappear in this event. Deletion of an audit event is admitted by no command. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.audit.AuditEvent" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Redacted" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "redact" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.audit.AuditEventRedacted" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.audit.AuditEvent" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Redacted" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.audit.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks audit-redaction authority for the verified organization, the event is unresolved, the applicable retention floor has not passed, the request would remove the record rather than redact it, or redaction cannot rewrite the projection while retaining that the record existed and was redacted.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.audit.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Events" } ], "anchor": "events", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AuditEventRecorded" } ], "anchor": "auditeventrecorded", "about": { "kind": "event", "name": "mandate.audit.AuditEventRecorded" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.audit.AuditEventRecorded" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuditEventId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "record" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuditRecord" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.audit.RecordAuditEvent" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "recorded" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AuditEventRedacted" } ], "anchor": "auditeventredacted", "about": { "kind": "event", "name": "mandate.audit.AuditEventRedacted" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.audit.AuditEventRedacted" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuditEventId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.audit.RedactAuditEvent" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "CredentialRevoked" } ], "anchor": "credentialrevoked", "about": { "kind": "event", "name": "mandate.audit.CredentialRevoked" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.audit.CredentialRevoked" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "record" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuditRecord" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command in this system emits it, so something outside the specification does." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DirectoryGroupCreated" } ], "anchor": "directorygroupcreated", "about": { "kind": "event", "name": "mandate.audit.DirectoryGroupCreated" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.audit.DirectoryGroupCreated" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "record" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuditRecord" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command in this system emits it, so something outside the specification does." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ExternalPrincipalUnlinked" } ], "anchor": "externalprincipalunlinked", "about": { "kind": "event", "name": "mandate.audit.ExternalPrincipalUnlinked" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.audit.ExternalPrincipalUnlinked" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "record" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuditRecord" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command in this system emits it, so something outside the specification does." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "FederationConnectionChanged" } ], "anchor": "federationconnectionchanged", "about": { "kind": "event", "name": "mandate.audit.FederationConnectionChanged" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.audit.FederationConnectionChanged" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "record" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuditRecord" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command in this system emits it, so something outside the specification does." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "TokenExchangeDenied" } ], "anchor": "tokenexchangedenied", "about": { "kind": "event", "name": "mandate.audit.TokenExchangeDenied" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.audit.TokenExchangeDenied" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "record" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuditRecord" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command in this system emits it, so something outside the specification does." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Errors" } ], "anchor": "errors", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Denied" } ], "anchor": "denied", "about": { "kind": "error", "name": "mandate.audit.Denied" }, "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "No audit record or credential mutation is admitted on refusal; required audit failure behavior remains an explicit runtime obligation." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "reason" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DenialReason" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.audit.RecordAuditEvent" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.audit.RedactAuditEvent" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] } ] } ] }, { "block": "list", "ordered": false, "items": [] } ] }, { "id": "domains/mandate-authorization", "title": [ { "inline": "text", "text": "authorization" } ], "about": { "kind": "domain", "name": "mandate.authorization" }, "provenance": { "provenance": { "system": "mandate", "specification_version": "v1", "source_digest": "2f11d2daffc2d75bb4ca8c0485aedc56fb2a712cdaed6347fc48b8ba2b1f7ca6", "contract_digest": "slice-sha256/2:6bf4b0d22c19d7ef08826bd3fbe010083c8c3ee4cb3003c0894f6f34a6a6144f" }, "slice": { "of": "constructs", "seeds": [ { "kind": "domain", "name": "mandate.authorization" }, { "kind": "command", "name": "mandate.authorization.Check" }, { "kind": "event", "name": "mandate.authorization.DecisionRecorded" }, { "kind": "error", "name": "mandate.authorization.Denied" }, { "kind": "component", "name": "mandate-authorization" }, { "kind": "component", "name": "mandate-control-plane" }, { "kind": "component", "name": "mandate-sts" }, { "kind": "component", "name": "mandate-worker" } ] } }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.authorization" }, { "inline": "text", "text": " is one of mandate's bounded contexts. " }, { "inline": "link", "to": { "target": "page", "page": "index" }, "text": [ { "inline": "text", "text": "Back to the index" } ] }, { "inline": "text", "text": "." } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Commands" } ], "anchor": "commands", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Check" } ], "anchor": "check", "about": { "kind": "command", "name": "mandate.authorization.Check" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.authorization.Check" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "action" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.Action" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "resource" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceRef" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.authorization.DecisionRecorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Credential-derived context is invalid/revoked/expired/stale, tenant/audience/resource/space binding mismatches, relationships/policy/ceilings deny, approval is required, or the required PDP/graph/credential authority is unavailable.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.authorization.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Events" } ], "anchor": "events", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DecisionRecorded" } ], "anchor": "decisionrecorded", "about": { "kind": "event", "name": "mandate.authorization.DecisionRecorded" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.authorization.DecisionRecorded" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "decision" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.Decision" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.authorization.Check" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Errors" } ], "anchor": "errors", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Denied" } ], "anchor": "denied", "about": { "kind": "error", "name": "mandate.authorization.Denied" }, "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "Fail closed; no credential, authority or lifecycle mutation on refusal." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "reason" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DenialReason" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.authorization.Check" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] } ] } ] }, { "block": "list", "ordered": false, "items": [] } ] }, { "id": "domains/mandate-core", "title": [ { "inline": "text", "text": "core" } ], "about": { "kind": "domain", "name": "mandate.core" }, "provenance": { "provenance": { "system": "mandate", "specification_version": "v1", "source_digest": "2f11d2daffc2d75bb4ca8c0485aedc56fb2a712cdaed6347fc48b8ba2b1f7ca6", "contract_digest": "slice-sha256/2:dc56b634ab160d154b191173e0045d01e39f6bfb507cb38a5abcc158e0a3a095" }, "slice": { "of": "constructs", "seeds": [ { "kind": "domain", "name": "mandate.core" }, { "kind": "type", "name": "mandate.core.AccessCredentialId" }, { "kind": "type", "name": "mandate.core.Action" }, { "kind": "type", "name": "mandate.core.ActionPattern" }, { "kind": "type", "name": "mandate.core.AgentCapabilityCeilingId" }, { "kind": "type", "name": "mandate.core.ApprovalId" }, { "kind": "type", "name": "mandate.core.Audience" }, { "kind": "type", "name": "mandate.core.AuditAction" }, { "kind": "type", "name": "mandate.core.AuditEventId" }, { "kind": "type", "name": "mandate.core.AuditOutcome" }, { "kind": "type", "name": "mandate.core.AuditRecord" }, { "kind": "type", "name": "mandate.core.AuthorityScope" }, { "kind": "type", "name": "mandate.core.AuthoritySubject" }, { "kind": "type", "name": "mandate.core.AuthorizationCodeId" }, { "kind": "type", "name": "mandate.core.AuthorizationModelId" }, { "kind": "type", "name": "mandate.core.AuthorizationModelVersion" }, { "kind": "type", "name": "mandate.core.AuthzRevision" }, { "kind": "type", "name": "mandate.core.ClientId" }, { "kind": "type", "name": "mandate.core.CorrelationId" }, { "kind": "type", "name": "mandate.core.CredentialDescriptor" }, { "kind": "type", "name": "mandate.core.CredentialId" }, { "kind": "type", "name": "mandate.core.CredentialKind" }, { "kind": "type", "name": "mandate.core.CredentialProfile" }, { "kind": "type", "name": "mandate.core.CredentialProof" }, { "kind": "type", "name": "mandate.core.CredentialSecret" }, { "kind": "type", "name": "mandate.core.CredentialVerifier" }, { "kind": "type", "name": "mandate.core.Decision" }, { "kind": "type", "name": "mandate.core.DecisionChallenge" }, { "kind": "type", "name": "mandate.core.DecisionId" }, { "kind": "type", "name": "mandate.core.DecisionReason" }, { "kind": "type", "name": "mandate.core.DelegationId" }, { "kind": "type", "name": "mandate.core.DenialReason" }, { "kind": "type", "name": "mandate.core.DirectoryGroupId" }, { "kind": "type", "name": "mandate.core.DirectoryGroupMembershipId" }, { "kind": "type", "name": "mandate.core.DirectoryGroupTeamMappingId" }, { "kind": "type", "name": "mandate.core.EpochSnapshotRef" }, { "kind": "type", "name": "mandate.core.ExecutionId" }, { "kind": "type", "name": "mandate.core.ExternalLinkMethod" }, { "kind": "type", "name": "mandate.core.ExternalPrincipalId" }, { "kind": "type", "name": "mandate.core.ExternalSubject" }, { "kind": "type", "name": "mandate.core.FederationConnectionId" }, { "kind": "type", "name": "mandate.core.GrantId" }, { "kind": "type", "name": "mandate.core.Issuer" }, { "kind": "type", "name": "mandate.core.KeyReference" }, { "kind": "type", "name": "mandate.core.MembershipContributionId" }, { "kind": "type", "name": "mandate.core.MembershipSource" }, { "kind": "type", "name": "mandate.core.OAuthClientId" }, { "kind": "type", "name": "mandate.core.OrganizationId" }, { "kind": "type", "name": "mandate.core.OrganizationMembershipId" }, { "kind": "type", "name": "mandate.core.PkceChallenge" }, { "kind": "type", "name": "mandate.core.PkceMethod" }, { "kind": "type", "name": "mandate.core.PolicyId" }, { "kind": "type", "name": "mandate.core.PolicyVersion" }, { "kind": "type", "name": "mandate.core.PrincipalId" }, { "kind": "type", "name": "mandate.core.PrincipalKind" }, { "kind": "type", "name": "mandate.core.RedirectUri" }, { "kind": "type", "name": "mandate.core.RefreshCredentialId" }, { "kind": "type", "name": "mandate.core.RelationId" }, { "kind": "type", "name": "mandate.core.ResourceId" }, { "kind": "type", "name": "mandate.core.ResourceRef" }, { "kind": "type", "name": "mandate.core.ResourceServerId" }, { "kind": "type", "name": "mandate.core.ResourceType" }, { "kind": "type", "name": "mandate.core.RevocationGuarantee" }, { "kind": "type", "name": "mandate.core.SecurityEpochTarget" }, { "kind": "type", "name": "mandate.core.SessionId" }, { "kind": "type", "name": "mandate.core.SigningAlgorithm" }, { "kind": "type", "name": "mandate.core.SigningKeyId" }, { "kind": "type", "name": "mandate.core.SpaceId" }, { "kind": "type", "name": "mandate.core.SyncJobId" }, { "kind": "type", "name": "mandate.core.TeamId" }, { "kind": "type", "name": "mandate.core.TeamMembershipId" }, { "kind": "type", "name": "mandate.core.TenantResolutionRule" }, { "kind": "type", "name": "mandate.core.TrustDomain" }, { "kind": "type", "name": "mandate.core.VerifiedContext" }, { "kind": "type", "name": "mandate.core.WorkloadIdentityId" }, { "kind": "component", "name": "mandate-authorization" }, { "kind": "component", "name": "mandate-control-plane" }, { "kind": "component", "name": "mandate-sts" }, { "kind": "component", "name": "mandate-worker" } ] } }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core" }, { "inline": "text", "text": " is one of mandate's bounded contexts. " }, { "inline": "link", "to": { "target": "page", "page": "index" }, "text": [ { "inline": "text", "text": "Back to the index" } ] }, { "inline": "text", "text": "." } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Types" } ], "anchor": "types", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AccessCredentialId" } ], "anchor": "accesscredentialid", "about": { "kind": "type", "name": "mandate.core.AccessCredentialId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.AccessCredentialId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Action" } ], "anchor": "action", "about": { "kind": "type", "name": "mandate.core.Action" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.Action" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "String" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ActionPattern" } ], "anchor": "actionpattern", "about": { "kind": "type", "name": "mandate.core.ActionPattern" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.ActionPattern" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "String" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AgentCapabilityCeilingId" } ], "anchor": "agentcapabilityceilingid", "about": { "kind": "type", "name": "mandate.core.AgentCapabilityCeilingId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.AgentCapabilityCeilingId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ApprovalId" } ], "anchor": "approvalid", "about": { "kind": "type", "name": "mandate.core.ApprovalId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.ApprovalId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Audience" } ], "anchor": "audience", "about": { "kind": "type", "name": "mandate.core.Audience" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.Audience" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "String" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AuditAction" } ], "anchor": "auditaction", "about": { "kind": "type", "name": "mandate.core.AuditAction" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.AuditAction" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "String" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AuditEventId" } ], "anchor": "auditeventid", "about": { "kind": "type", "name": "mandate.core.AuditEventId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.AuditEventId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AuditOutcome" } ], "anchor": "auditoutcome", "about": { "kind": "type", "name": "mandate.core.AuditOutcome" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.AuditOutcome" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "String" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AuditRecord" } ], "anchor": "auditrecord", "about": { "kind": "type", "name": "mandate.core.AuditRecord" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.AuditRecord" }, { "inline": "text", "text": " is a record of 21 fields:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "subject" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "actor" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "event_type" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuditAction" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "correlation" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CorrelationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "decision_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "requested_audience" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "issued_audience" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "requested_scope" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "credential_kind" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "delegation_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "execution_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "result" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuditOutcome" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "occurred_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "policy_version" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "model_version" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "authz_revision" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "source_credential_kind" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "source_credential_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "issued_credential_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "issued_scope" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ] ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AuthorityScope" } ], "anchor": "authorityscope", "about": { "kind": "type", "name": "mandate.core.AuthorityScope" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.AuthorityScope" }, { "inline": "text", "text": " is a record of three fields:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "actions" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "List" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "resources" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "List" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "space" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ] ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AuthoritySubject" } ], "anchor": "authoritysubject", "about": { "kind": "type", "name": "mandate.core.AuthoritySubject" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.AuthoritySubject" }, { "inline": "text", "text": " is one of two shapes, told apart by a " }, { "inline": "code", "text": "kind" }, { "inline": "text", "text": " field — tagged, so a decoder never has to guess which branch it is reading:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "principal" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "team" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.TeamId" } ] } ] ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AuthorizationCodeId" } ], "anchor": "authorizationcodeid", "about": { "kind": "type", "name": "mandate.core.AuthorizationCodeId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.AuthorizationCodeId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AuthorizationModelId" } ], "anchor": "authorizationmodelid", "about": { "kind": "type", "name": "mandate.core.AuthorizationModelId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.AuthorizationModelId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AuthorizationModelVersion" } ], "anchor": "authorizationmodelversion", "about": { "kind": "type", "name": "mandate.core.AuthorizationModelVersion" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.AuthorizationModelVersion" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "String" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AuthzRevision" } ], "anchor": "authzrevision", "about": { "kind": "type", "name": "mandate.core.AuthzRevision" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.AuthzRevision" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "String" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ClientId" } ], "anchor": "clientid", "about": { "kind": "type", "name": "mandate.core.ClientId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.ClientId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "String" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "CorrelationId" } ], "anchor": "correlationid", "about": { "kind": "type", "name": "mandate.core.CorrelationId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.CorrelationId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "String" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "CredentialDescriptor" } ], "anchor": "credentialdescriptor", "about": { "kind": "type", "name": "mandate.core.CredentialDescriptor" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.CredentialDescriptor" }, { "inline": "text", "text": " is a record of nine fields:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "kind" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialKind" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "subject" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "actor" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "organization" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "audience" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.Audience" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "scope" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorityScope" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "delegation" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "execution" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "expires_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ] ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "CredentialId" } ], "anchor": "credentialid", "about": { "kind": "type", "name": "mandate.core.CredentialId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.CredentialId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "CredentialKind" } ], "anchor": "credentialkind", "about": { "kind": "type", "name": "mandate.core.CredentialKind" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.CredentialKind" }, { "inline": "text", "text": " is one of " }, { "inline": "code", "text": "SelfContained" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Reference" }, { "inline": "text", "text": "." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "CredentialProfile" } ], "anchor": "credentialprofile", "about": { "kind": "type", "name": "mandate.core.CredentialProfile" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.CredentialProfile" }, { "inline": "text", "text": " is a record of six fields:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "name" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "kind" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialKind" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "revocation" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.RevocationGuarantee" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "max_ttl" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Duration" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "positive_cache_ttl" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Duration" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "requires_online_authorization" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Boolean" } ] } ] ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "CredentialProof" } ], "anchor": "credentialproof", "about": { "kind": "type", "name": "mandate.core.CredentialProof" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.CredentialProof" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Bytes" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "CredentialSecret" } ], "anchor": "credentialsecret", "about": { "kind": "type", "name": "mandate.core.CredentialSecret" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.CredentialSecret" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Bytes" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "CredentialVerifier" } ], "anchor": "credentialverifier", "about": { "kind": "type", "name": "mandate.core.CredentialVerifier" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.CredentialVerifier" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "String" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Decision" } ], "anchor": "decision", "about": { "kind": "type", "name": "mandate.core.Decision" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.Decision" }, { "inline": "text", "text": " is a record of seven fields:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "allowed" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Boolean" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "reason" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DecisionReason" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "decision_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DecisionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "revision" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "challenge" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "policy_version" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "model_version" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ] ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DecisionChallenge" } ], "anchor": "decisionchallenge", "about": { "kind": "type", "name": "mandate.core.DecisionChallenge" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.DecisionChallenge" }, { "inline": "text", "text": " is a record of four fields:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "action" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.Action" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "resource" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceRef" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "approver_policy" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PolicyId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "expires_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ] ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DecisionId" } ], "anchor": "decisionid", "about": { "kind": "type", "name": "mandate.core.DecisionId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.DecisionId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DecisionReason" } ], "anchor": "decisionreason", "about": { "kind": "type", "name": "mandate.core.DecisionReason" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.DecisionReason" }, { "inline": "text", "text": " is one of " }, { "inline": "code", "text": "Allowed" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "Denied" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "ApprovalRequired" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "InvalidCredential" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "TenantMismatch" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "AudienceMismatch" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "Unavailable" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "StaleEpoch" }, { "inline": "text", "text": "." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DelegationId" } ], "anchor": "delegationid", "about": { "kind": "type", "name": "mandate.core.DelegationId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.DelegationId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DenialReason" } ], "anchor": "denialreason", "about": { "kind": "type", "name": "mandate.core.DenialReason" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.DenialReason" }, { "inline": "text", "text": " is one of " }, { "inline": "code", "text": "Denied" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "ApprovalRequired" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "InvalidCredential" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "TenantMismatch" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "AudienceMismatch" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "Unavailable" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "StaleEpoch" }, { "inline": "text", "text": "." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DirectoryGroupId" } ], "anchor": "directorygroupid", "about": { "kind": "type", "name": "mandate.core.DirectoryGroupId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.DirectoryGroupId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DirectoryGroupMembershipId" } ], "anchor": "directorygroupmembershipid", "about": { "kind": "type", "name": "mandate.core.DirectoryGroupMembershipId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.DirectoryGroupMembershipId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DirectoryGroupTeamMappingId" } ], "anchor": "directorygroupteammappingid", "about": { "kind": "type", "name": "mandate.core.DirectoryGroupTeamMappingId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.DirectoryGroupTeamMappingId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "EpochSnapshotRef" } ], "anchor": "epochsnapshotref", "about": { "kind": "type", "name": "mandate.core.EpochSnapshotRef" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.EpochSnapshotRef" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ExecutionId" } ], "anchor": "executionid", "about": { "kind": "type", "name": "mandate.core.ExecutionId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.ExecutionId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ExternalLinkMethod" } ], "anchor": "externallinkmethod", "about": { "kind": "type", "name": "mandate.core.ExternalLinkMethod" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.ExternalLinkMethod" }, { "inline": "text", "text": " is one of " }, { "inline": "code", "text": "Administrator" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "AuthenticatedConfirmation" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "VerifiedMigration" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "ConfiguredFederation" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "SecuritySupport" }, { "inline": "text", "text": "." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ExternalPrincipalId" } ], "anchor": "externalprincipalid", "about": { "kind": "type", "name": "mandate.core.ExternalPrincipalId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.ExternalPrincipalId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ExternalSubject" } ], "anchor": "externalsubject", "about": { "kind": "type", "name": "mandate.core.ExternalSubject" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.ExternalSubject" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "String" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "FederationConnectionId" } ], "anchor": "federationconnectionid", "about": { "kind": "type", "name": "mandate.core.FederationConnectionId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.FederationConnectionId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "GrantId" } ], "anchor": "grantid", "about": { "kind": "type", "name": "mandate.core.GrantId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.GrantId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Issuer" } ], "anchor": "issuer", "about": { "kind": "type", "name": "mandate.core.Issuer" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.Issuer" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "String" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "KeyReference" } ], "anchor": "keyreference", "about": { "kind": "type", "name": "mandate.core.KeyReference" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.KeyReference" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "String" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "MembershipContributionId" } ], "anchor": "membershipcontributionid", "about": { "kind": "type", "name": "mandate.core.MembershipContributionId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.MembershipContributionId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "MembershipSource" } ], "anchor": "membershipsource", "about": { "kind": "type", "name": "mandate.core.MembershipSource" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.MembershipSource" }, { "inline": "text", "text": " is one of " }, { "inline": "code", "text": "Manual" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "DirectoryMapping" }, { "inline": "text", "text": "." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "OAuthClientId" } ], "anchor": "oauthclientid", "about": { "kind": "type", "name": "mandate.core.OAuthClientId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.OAuthClientId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "OrganizationId" } ], "anchor": "organizationid", "about": { "kind": "type", "name": "mandate.core.OrganizationId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.OrganizationId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "OrganizationMembershipId" } ], "anchor": "organizationmembershipid", "about": { "kind": "type", "name": "mandate.core.OrganizationMembershipId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.OrganizationMembershipId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "PkceChallenge" } ], "anchor": "pkcechallenge", "about": { "kind": "type", "name": "mandate.core.PkceChallenge" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.PkceChallenge" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "String" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "PkceMethod" } ], "anchor": "pkcemethod", "about": { "kind": "type", "name": "mandate.core.PkceMethod" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.PkceMethod" }, { "inline": "text", "text": " is one of " }, { "inline": "code", "text": "S256" }, { "inline": "text", "text": "." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "PolicyId" } ], "anchor": "policyid", "about": { "kind": "type", "name": "mandate.core.PolicyId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.PolicyId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "PolicyVersion" } ], "anchor": "policyversion", "about": { "kind": "type", "name": "mandate.core.PolicyVersion" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.PolicyVersion" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "String" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "PrincipalId" } ], "anchor": "principalid", "about": { "kind": "type", "name": "mandate.core.PrincipalId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.PrincipalId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "PrincipalKind" } ], "anchor": "principalkind", "about": { "kind": "type", "name": "mandate.core.PrincipalKind" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.PrincipalKind" }, { "inline": "text", "text": " is one of " }, { "inline": "code", "text": "User" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "Service" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "Agent" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "ServiceAccount" }, { "inline": "text", "text": "." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RedirectUri" } ], "anchor": "redirecturi", "about": { "kind": "type", "name": "mandate.core.RedirectUri" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.RedirectUri" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "String" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RefreshCredentialId" } ], "anchor": "refreshcredentialid", "about": { "kind": "type", "name": "mandate.core.RefreshCredentialId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.RefreshCredentialId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RelationId" } ], "anchor": "relationid", "about": { "kind": "type", "name": "mandate.core.RelationId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.RelationId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ResourceId" } ], "anchor": "resourceid", "about": { "kind": "type", "name": "mandate.core.ResourceId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.ResourceId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ResourceRef" } ], "anchor": "resourceref", "about": { "kind": "type", "name": "mandate.core.ResourceRef" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.ResourceRef" }, { "inline": "text", "text": " is a record of two fields:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "resource_type" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceType" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "resource_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceId" } ] } ] ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ResourceServerId" } ], "anchor": "resourceserverid", "about": { "kind": "type", "name": "mandate.core.ResourceServerId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.ResourceServerId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ResourceType" } ], "anchor": "resourcetype", "about": { "kind": "type", "name": "mandate.core.ResourceType" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.ResourceType" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "String" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RevocationGuarantee" } ], "anchor": "revocationguarantee", "about": { "kind": "type", "name": "mandate.core.RevocationGuarantee" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.RevocationGuarantee" }, { "inline": "text", "text": " is one of " }, { "inline": "code", "text": "ImmediateOnline" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "BoundedOffline" }, { "inline": "text", "text": "." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SecurityEpochTarget" } ], "anchor": "securityepochtarget", "about": { "kind": "type", "name": "mandate.core.SecurityEpochTarget" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.SecurityEpochTarget" }, { "inline": "text", "text": " is one of three shapes, told apart by a " }, { "inline": "code", "text": "kind" }, { "inline": "text", "text": " field — tagged, so a decoder never has to guess which branch it is reading:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "federation" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.FederationConnectionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "organization" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "principal" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ] ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SessionId" } ], "anchor": "sessionid", "about": { "kind": "type", "name": "mandate.core.SessionId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.SessionId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SigningAlgorithm" } ], "anchor": "signingalgorithm", "about": { "kind": "type", "name": "mandate.core.SigningAlgorithm" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.SigningAlgorithm" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "String" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SigningKeyId" } ], "anchor": "signingkeyid", "about": { "kind": "type", "name": "mandate.core.SigningKeyId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.SigningKeyId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SpaceId" } ], "anchor": "spaceid", "about": { "kind": "type", "name": "mandate.core.SpaceId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.SpaceId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SyncJobId" } ], "anchor": "syncjobid", "about": { "kind": "type", "name": "mandate.core.SyncJobId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.SyncJobId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "TeamId" } ], "anchor": "teamid", "about": { "kind": "type", "name": "mandate.core.TeamId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.TeamId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "TeamMembershipId" } ], "anchor": "teammembershipid", "about": { "kind": "type", "name": "mandate.core.TeamMembershipId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.TeamMembershipId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "TenantResolutionRule" } ], "anchor": "tenantresolutionrule", "about": { "kind": "type", "name": "mandate.core.TenantResolutionRule" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.TenantResolutionRule" }, { "inline": "text", "text": " is a record of three fields:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "configured_organization" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "verified_claim_name" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "verified_claim_value" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ] ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "TrustDomain" } ], "anchor": "trustdomain", "about": { "kind": "type", "name": "mandate.core.TrustDomain" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.TrustDomain" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "String" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "VerifiedContext" } ], "anchor": "verifiedcontext", "about": { "kind": "type", "name": "mandate.core.VerifiedContext" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.VerifiedContext" }, { "inline": "text", "text": " is a record of eight fields:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "subject" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "actor" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "organization" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "audience" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.Audience" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "credential" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "delegation" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "execution" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "correlation" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CorrelationId" } ] } ] ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "WorkloadIdentityId" } ], "anchor": "workloadidentityid", "about": { "kind": "type", "name": "mandate.core.WorkloadIdentityId" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.core.WorkloadIdentityId" }, { "inline": "text", "text": " wraps " }, { "inline": "code", "text": "Uuid" }, { "inline": "text", "text": " and is not interchangeable with one: the whole value of naming it separately is the crossings the model then refuses." } ] } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Two of the types above are reached by nothing else in this system: " }, { "inline": "code", "text": "mandate.core.AccessCredentialId" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "mandate.core.CredentialSecret" }, { "inline": "text", "text": ". No entity, view, command, event, error or crossing names them, so it is either vocabulary something outside this specification uses or a leftover — and only a person can tell which." } ] } ] }, { "block": "list", "ordered": false, "items": [] } ] }, { "id": "domains/mandate-credential", "title": [ { "inline": "text", "text": "credential" } ], "about": { "kind": "domain", "name": "mandate.credential" }, "provenance": { "provenance": { "system": "mandate", "specification_version": "v1", "source_digest": "2f11d2daffc2d75bb4ca8c0485aedc56fb2a712cdaed6347fc48b8ba2b1f7ca6", "contract_digest": "slice-sha256/2:6bf4b0d22c19d7ef08826bd3fbe010083c8c3ee4cb3003c0894f6f34a6a6144f" }, "slice": { "of": "constructs", "seeds": [ { "kind": "domain", "name": "mandate.credential" }, { "kind": "type", "name": "mandate.credential.AccessCredential.State" }, { "kind": "type", "name": "mandate.credential.AuthorizationCode.State" }, { "kind": "type", "name": "mandate.credential.ResourceServer.State" }, { "kind": "type", "name": "mandate.credential.SigningKey.State" }, { "kind": "entity", "name": "mandate.credential.AccessCredential" }, { "kind": "entity", "name": "mandate.credential.AuthorizationCode" }, { "kind": "entity", "name": "mandate.credential.ResourceServer" }, { "kind": "entity", "name": "mandate.credential.SigningKey" }, { "kind": "command", "name": "mandate.credential.DisableResourceServer" }, { "kind": "command", "name": "mandate.credential.ExchangeCredential" }, { "kind": "command", "name": "mandate.credential.IntrospectCredential" }, { "kind": "command", "name": "mandate.credential.IssueAuthorizationCode" }, { "kind": "command", "name": "mandate.credential.IssueReferenceCredential" }, { "kind": "command", "name": "mandate.credential.IssueSelfContainedCredential" }, { "kind": "command", "name": "mandate.credential.RedeemAuthorizationCode" }, { "kind": "command", "name": "mandate.credential.RegisterResourceServer" }, { "kind": "command", "name": "mandate.credential.RegisterSigningKey" }, { "kind": "command", "name": "mandate.credential.RetireSigningKey" }, { "kind": "command", "name": "mandate.credential.RevokeAccessCredential" }, { "kind": "command", "name": "mandate.credential.RevokeSigningKey" }, { "kind": "event", "name": "mandate.credential.AccessCredentialRevoked" }, { "kind": "event", "name": "mandate.credential.AuthorizationCodeIssued" }, { "kind": "event", "name": "mandate.credential.AuthorizationCodeRedeemed" }, { "kind": "event", "name": "mandate.credential.CredentialIntrospected" }, { "kind": "event", "name": "mandate.credential.CredentialReferenceIssued" }, { "kind": "event", "name": "mandate.credential.CredentialSelfContainedIssued" }, { "kind": "event", "name": "mandate.credential.ResourceServerDisabled" }, { "kind": "event", "name": "mandate.credential.ResourceServerRegistered" }, { "kind": "event", "name": "mandate.credential.SigningKeyRegistered" }, { "kind": "event", "name": "mandate.credential.SigningKeyRetired" }, { "kind": "event", "name": "mandate.credential.SigningKeyRevoked" }, { "kind": "event", "name": "mandate.credential.TokenExchangeAllowed" }, { "kind": "event", "name": "mandate.credential.TokenExchangeDenied" }, { "kind": "error", "name": "mandate.credential.Denied" }, { "kind": "component", "name": "mandate-authorization" }, { "kind": "component", "name": "mandate-control-plane" }, { "kind": "component", "name": "mandate-sts" }, { "kind": "component", "name": "mandate-worker" } ] } }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential" }, { "inline": "text", "text": " is one of mandate's bounded contexts. " }, { "inline": "link", "to": { "target": "page", "page": "index" }, "text": [ { "inline": "text", "text": "Back to the index" } ] }, { "inline": "text", "text": "." } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Entities" } ], "anchor": "entities", "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "An entity is what this context is about: something with an identity that outlives any one request, a shape, and a lifecycle. The lifecycle is exhaustive — a move that is not drawn below is a move this specification does not permit, and that is the only way it says so. Every move is labelled with the command that takes it, because a move nothing can trigger is refused rather than drawn." } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AccessCredential" } ], "anchor": "accesscredential", "about": { "kind": "entity", "name": "mandate.credential.AccessCredential" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.AccessCredential" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.CredentialId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "descriptor" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialDescriptor" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "reference_verifier" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "epochs" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "issued_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "securityepochsnapshot" }, "text": [ { "inline": "code", "text": "mandate.identity.SecurityEpochSnapshot" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "epoch_snapshot_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "AccessCredential.epochs" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.credential.AccessCredential.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Active\n Active --> Revoked: revoke (RevokeAccessCredential)\n Revoked --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "revoke" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.credential.RevokeAccessCredential" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is brought into existence by " }, { "inline": "code", "text": "mandate.credential.ExchangeCredential" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "mandate.credential.IssueReferenceCredential" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "mandate.credential.IssueSelfContainedCredential" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Active" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AuthorizationCode" } ], "anchor": "authorizationcode", "about": { "kind": "entity", "name": "mandate.credential.AuthorizationCode" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.AuthorizationCode" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.AuthorizationCodeId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "client_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OAuthClientId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "session_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SessionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "verifier" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialVerifier" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "challenge" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PkceChallenge" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "method" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PkceMethod" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "redirect_uri" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.RedirectUri" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "expires_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "target" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceServerId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "scope" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorityScope" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-federation", "anchor": "oauthclient" }, "text": [ { "inline": "code", "text": "mandate.federation.OAuthClient" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "client_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "AuthorizationCode.client_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "session" }, "text": [ { "inline": "code", "text": "mandate.identity.Session" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "session_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "AuthorizationCode.session_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-credential", "anchor": "resourceserver" }, "text": [ { "inline": "code", "text": "ResourceServer" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "target_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "AuthorizationCode.target" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.credential.AuthorizationCode.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Consumed" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Issued" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Issued" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Consumed" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Issued\n Issued --> Consumed: consume (RedeemAuthorizationCode)\n Consumed --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "consume" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.credential.RedeemAuthorizationCode" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is brought into existence by " }, { "inline": "code", "text": "mandate.credential.IssueAuthorizationCode" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Consumed" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Issued" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ResourceServer" } ], "anchor": "resourceserver", "about": { "kind": "entity", "name": "mandate.credential.ResourceServer" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.ResourceServer" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.ResourceServerId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "audience" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.Audience" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "credential_profile" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialProfile" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "allowed_exchange_sources" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "List" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "ResourceServer.organization_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references any number of " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-credential", "anchor": "resourceserver" }, "text": [ { "inline": "code", "text": "ResourceServer" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "allowed_exchange_source_records" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "ResourceServer.allowed_exchange_sources" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.credential.ResourceServer.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Disabled" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Enabled" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Enabled" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Disabled" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Enabled\n Enabled --> Disabled: disable (DisableResourceServer)\n Disabled --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "disable" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.credential.DisableResourceServer" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is brought into existence by " }, { "inline": "code", "text": "mandate.credential.RegisterResourceServer" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Disabled" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Enabled" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SigningKey" } ], "anchor": "signingkey", "about": { "kind": "entity", "name": "mandate.credential.SigningKey" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.SigningKey" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.SigningKeyId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "key_reference" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.KeyReference" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "thumbprint" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "algorithm" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SigningAlgorithm" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "not_before" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "expires_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It declares no relation to another entity, and no other entity names it." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Every instance satisfies " }, { "inline": "code", "text": "not_before < expires_at" }, { "inline": "text", "text": " — a predicate over this entity's own fields, checked against them rather than stored as a sentence, so an invariant reading something the entity does not have is refused instead of documented." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.credential.SigningKey.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "Retired" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Retired" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": " are terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Recorded\n Recorded --> Retired: retire (RetireSigningKey)\n Recorded --> Revoked: revoke (RevokeSigningKey)\n Retired --> Revoked: revoke (RevokeSigningKey)\n Retired --> [*]\n Revoked --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "retire" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.credential.RetireSigningKey" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "revoke" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.credential.RevokeSigningKey" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is brought into existence by " }, { "inline": "code", "text": "mandate.credential.RegisterSigningKey" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Retired" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Recorded" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Recorded" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Retired" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Commands" } ], "anchor": "commands", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DisableResourceServer" } ], "anchor": "disableresourceserver", "about": { "kind": "command", "name": "mandate.credential.DisableResourceServer" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.DisableResourceServer" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceServerId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.credential.ResourceServer" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Enabled" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Disabled" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "disable" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.credential.ResourceServerDisabled" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.credential.ResourceServer" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Disabled" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.credential.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks resource-server administration authority, server is outside the verified organization, or durable disablement cannot prevent subsequent issuance.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.credential.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ExchangeCredential" } ], "anchor": "exchangecredential", "about": { "kind": "command", "name": "mandate.credential.ExchangeCredential" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.ExchangeCredential" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "subject_proof" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialProof" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "actor_proof" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "target" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceServerId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "requested_scope" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorityScope" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "delegation_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It creates a " }, { "inline": "code", "text": "mandate.credential.AccessCredential" }, { "inline": "text", "text": ", which starts in " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The new instance's identity is published as " }, { "inline": "code", "text": "credential_id" }, { "inline": "text", "text": " on " }, { "inline": "code", "text": "mandate.credential.TokenExchangeAllowed" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.credential.TokenExchangeAllowed" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Either independently validated proof is invalid/revoked/expired/stale; actor, tenant, registered target/source, scope, space, delegation or ceiling binding fails; transitive delegation is requested; approval is required; or authority/expiry narrowing and durable audit fail.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.credential.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "IntrospectCredential" } ], "anchor": "introspectcredential", "about": { "kind": "command", "name": "mandate.credential.IntrospectCredential" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.IntrospectCredential" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "caller_proof" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialProof" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "credential_proof" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialProof" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "An active answer carries the descriptor and the credential_id of the record this log holds. An inactive answer carries neither — that is the answer for a credential this deployment revoked, one whose expiry has passed, and a well-formed proof that resolves to no record at all, which are one answer here and not three. The three are distinguished by nothing this event carries, deliberately, because a caller holding a well-formed proof learns only whether it is usable. This outcome creates, moves and updates nothing, and CredentialIntrospected folds into no record — its credential_id names an instance only when one exists in this log, and a fold reading it must not take the name for the existence of a record some other event created. The presented credential may have been issued by a deployment this log never saw, which is why the field is optional rather than the event's subject. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.credential.CredentialIntrospected" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller proof lacks introspection authority for the registered server/tenant or is itself invalid, revoked or expired, the presented credential proof is malformed, principal/connection/epoch validation fails, audience mismatches, or authoritative online resolution is unavailable.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.credential.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "IssueAuthorizationCode" } ], "anchor": "issueauthorizationcode", "about": { "kind": "command", "name": "mandate.credential.IssueAuthorizationCode" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.IssueAuthorizationCode" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "client_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OAuthClientId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "session_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SessionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "target" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceServerId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "requested_scope" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorityScope" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "challenge" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PkceChallenge" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "method" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PkceMethod" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "redirect_uri" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.RedirectUri" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "expires_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "STS stores only a non-reversible verifier bound to the validated client, session, exact redirect, S256 challenge, registered target, narrowed scope and bounded expiry. Only the transient code is returned to the public-client adapter. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It creates a " }, { "inline": "code", "text": "mandate.credential.AuthorizationCode" }, { "inline": "text", "text": ", which starts in " }, { "inline": "code", "text": "Issued" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The new instance's identity is published as " }, { "inline": "code", "text": "code_id" }, { "inline": "text", "text": " on " }, { "inline": "code", "text": "mandate.credential.AuthorizationCodeIssued" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.credential.AuthorizationCodeIssued" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Trusted control-plane caller/session context, registered public client, exact redirect URI, S256 policy, tenant/target agreement, authority narrowing or bounded expiry validation fails, or the client the code would be bound to is disabled.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.credential.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "IssueReferenceCredential" } ], "anchor": "issuereferencecredential", "about": { "kind": "command", "name": "mandate.credential.IssueReferenceCredential" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.IssueReferenceCredential" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "target" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceServerId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "requested_scope" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorityScope" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It creates a " }, { "inline": "code", "text": "mandate.credential.AccessCredential" }, { "inline": "text", "text": ", which starts in " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The new instance's identity is published as " }, { "inline": "code", "text": "credential_id" }, { "inline": "text", "text": " on " }, { "inline": "code", "text": "mandate.credential.CredentialReferenceIssued" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.credential.CredentialReferenceIssued" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Validated context is expired/revoked/stale, subject/actor authority or ceilings do not cover requested scope, target/profile is unregistered/disabled/outside tenant, expiry cannot be bounded, or verifier-only persistence and required audit cannot commit.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.credential.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "IssueSelfContainedCredential" } ], "anchor": "issueselfcontainedcredential", "about": { "kind": "command", "name": "mandate.credential.IssueSelfContainedCredential" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.IssueSelfContainedCredential" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "target" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceServerId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "requested_scope" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorityScope" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It creates a " }, { "inline": "code", "text": "mandate.credential.AccessCredential" }, { "inline": "text", "text": ", which starts in " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The new instance's identity is published as " }, { "inline": "code", "text": "credential_id" }, { "inline": "text", "text": " on " }, { "inline": "code", "text": "mandate.credential.CredentialSelfContainedIssued" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.credential.CredentialSelfContainedIssued" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Validated context is expired/revoked/stale, subject/actor authority or ceilings do not cover requested scope, target/profile/signing algorithm or key is unadmitted, expiry cannot be bounded, or the promised revocation/audit guarantee cannot be met.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.credential.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RedeemAuthorizationCode" } ], "anchor": "redeemauthorizationcode", "about": { "kind": "command", "name": "mandate.credential.RedeemAuthorizationCode" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.RedeemAuthorizationCode" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "code_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorizationCodeId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "client_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OAuthClientId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "code" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialProof" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "pkce_verifier" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialProof" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "redirect_uri" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.RedirectUri" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "STS atomically consumes the code and persists the narrowed credential and audit outbox. The returned credential remains bound to the code target, scope, session and expiry; a failed or replayed transaction produces no credential. The command takes no context input and admits no caller-supplied selector — the generated context on the emitted event takes its subject, organization and audience from the code record and the session it names through the STS's session port, its credential as the credential_id this outcome issues, its correlation as the one the outcome mints for this request, and its actor, delegation and execution as absent unless the code record names them. The audience is the one published by the registration the code record's target names. The epoch whose staleness the denial names is the session's own, resolved through that same port, because a redemption presents no source credential of its own. The credential this outcome issues is recorded by mandate.credential.AuthorizationCodeRedeemed, which carries the whole mandate.credential.AccessCredential record, and the epoch snapshot it binds is the one this command answers in its response; the outcome's one subject stays the code it consumes, so the seeding is declared in this domain's header. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.credential.AuthorizationCode" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Issued" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Consumed" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "consume" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "code_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.credential.AuthorizationCodeRedeemed" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.credential.AuthorizationCode" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Consumed" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.credential.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Code proof does not match the server-resolved code_id; code is expired; client, redirect URI or S256 verifier mismatches; the bound client is disabled; source/session epoch is stale; registered target is disabled or outside the verified tenant; or narrowing/atomic issuance validation fails.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.credential.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RegisterResourceServer" } ], "anchor": "registerresourceserver", "about": { "kind": "command", "name": "mandate.credential.RegisterResourceServer" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.RegisterResourceServer" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "audience" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.Audience" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "profile" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialProfile" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "allowed_exchange_sources" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "List" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It creates a " }, { "inline": "code", "text": "mandate.credential.ResourceServer" }, { "inline": "text", "text": ", which starts in " }, { "inline": "code", "text": "Enabled" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The new instance's identity is published as " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": " on " }, { "inline": "code", "text": "mandate.credential.ResourceServerRegistered" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.credential.ResourceServerRegistered" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks resource-server administration authority, audience registration is ambiguous, profile semantics are unadmitted, or an allowed source server is unresolved/disabled/outside the verified organization.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.credential.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RegisterSigningKey" } ], "anchor": "registersigningkey", "about": { "kind": "command", "name": "mandate.credential.RegisterSigningKey" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.RegisterSigningKey" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "key_reference" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.KeyReference" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "algorithm" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SigningAlgorithm" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "not_before" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "expires_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The key enters the contract Recorded, which is what rotation requires — RetireSigningKey denies a retirement with no overlapping replacement published for continued verification, and no replacement can exist until a key can be registered. SigningKeyRegistered carries the whole mandate.credential.SigningKey record — the key identity, the reference the deployment resolves to the material, the thumbprint of the public key, the algorithm name and the validity window — so the credential fold materializes the key from this event alone and reads no command input or response. The mandate.core.SigningKeyId is the kid the signer publishes and a credential names; the thumbprint is the RFC 7638 JWK thumbprint of the public key this outcome resolved from key_reference, so a revocation record naming a kid and a thumbprint is rebuilt from this log without resolving the material of a key that was revoked as compromised. Both are decided by this outcome and read from its response. No key material enters the contract — KeyReference is a handle to material the deployment holds, and no event here carries a secret. The algorithm is a name and not an admitted algorithm (UNMAPPED-ALGORITHM-POLICY); the deployment's verifier-side allowlist admits it or the registration is denied. A key reference, or the key material it resolves to, already held by a recorded key is refused in every state that key can be in, including Retired and Revoked, so material the deployment revoked never returns under a second identity. The window ordering is the entity's invariant, checked by the deciding handler; the synthesized accepted scenario builds an equal window and is expected to fail until ESS's synthesizer consults entity invariants (routed to the ESS wave). No command replaces a key in place; rotation registers the successor and retires the predecessor. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It creates a " }, { "inline": "code", "text": "mandate.credential.SigningKey" }, { "inline": "text", "text": ", which starts in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The new instance's identity is published as " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": " on " }, { "inline": "code", "text": "mandate.credential.SigningKeyRegistered" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.credential.SigningKeyRegistered" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks platform signing-key administration authority, the algorithm is outside the deployment's admitted set, the key reference is unresolvable, or the key reference or the key material is already recorded.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.credential.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RetireSigningKey" } ], "anchor": "retiresigningkey", "about": { "kind": "command", "name": "mandate.credential.RetireSigningKey" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.RetireSigningKey" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SigningKeyId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Rotation, not revocation. A retired key signs nothing further; it remains admitted for verifying credentials already issued under it until they expire, which is the overlapping rotation period the key requirements demand. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.credential.SigningKey" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Retired" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "retire" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.credential.SigningKeyRetired" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.credential.SigningKey" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Retired" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.credential.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks platform signing-key administration authority, the key is unresolved, no overlapping replacement key is published for continued verification, or retirement cannot durably stop further issuance under the key.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.credential.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RevokeAccessCredential" } ], "anchor": "revokeaccesscredential", "about": { "kind": "command", "name": "mandate.credential.RevokeAccessCredential" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.RevokeAccessCredential" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.credential.AccessCredential" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "revoke" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.credential.AccessCredentialRevoked" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.credential.AccessCredential" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.credential.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks credential-revocation authority, resolved credential is outside the verified organization, or the named profile revocation guarantee cannot be met.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.credential.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RevokeSigningKey" } ], "anchor": "revokesigningkey", "about": { "kind": "command", "name": "mandate.credential.RevokeSigningKey" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.RevokeSigningKey" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SigningKeyId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The emergency procedure. A revoked key is admitted for neither issuance nor verification, and the self-contained credentials it signed are refused from that point; the key record itself is kept. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.credential.SigningKey" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Retired" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "revoke" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.credential.SigningKeyRevoked" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.credential.SigningKey" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.credential.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks platform signing-key administration authority, the key is unresolved, or emergency revocation cannot durably stop both issuance and verification under the key and refuse the credentials it signed.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.credential.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Events" } ], "anchor": "events", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AccessCredentialRevoked" } ], "anchor": "accesscredentialrevoked", "about": { "kind": "event", "name": "mandate.credential.AccessCredentialRevoked" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.AccessCredentialRevoked" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.credential.RevokeAccessCredential" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AuthorizationCodeIssued" } ], "anchor": "authorizationcodeissued", "about": { "kind": "event", "name": "mandate.credential.AuthorizationCodeIssued" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.AuthorizationCodeIssued" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "code_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorizationCodeId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "client_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OAuthClientId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "session_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SessionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "verifier" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialVerifier" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "challenge" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PkceChallenge" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "method" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PkceMethod" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "redirect_uri" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.RedirectUri" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "expires_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "target" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceServerId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "scope" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorityScope" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.credential.IssueAuthorizationCode" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AuthorizationCodeRedeemed" } ], "anchor": "authorizationcoderedeemed", "about": { "kind": "event", "name": "mandate.credential.AuthorizationCodeRedeemed" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.AuthorizationCodeRedeemed" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "code_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorizationCodeId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "credential_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "reference_verifier" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "epochs" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "issued_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "descriptor" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialDescriptor" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "target" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceServerId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.credential.RedeemAuthorizationCode" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "CredentialIntrospected" } ], "anchor": "credentialintrospected", "about": { "kind": "event", "name": "mandate.credential.CredentialIntrospected" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.CredentialIntrospected" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "descriptor" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "active" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Boolean" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "credential_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.credential.IntrospectCredential" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "CredentialReferenceIssued" } ], "anchor": "credentialreferenceissued", "about": { "kind": "event", "name": "mandate.credential.CredentialReferenceIssued" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.CredentialReferenceIssued" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "credential_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "reference_verifier" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "epochs" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "issued_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "descriptor" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialDescriptor" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "target" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceServerId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "requested_scope" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorityScope" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.credential.IssueReferenceCredential" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "CredentialSelfContainedIssued" } ], "anchor": "credentialselfcontainedissued", "about": { "kind": "event", "name": "mandate.credential.CredentialSelfContainedIssued" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.CredentialSelfContainedIssued" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "credential_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "reference_verifier" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "epochs" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "issued_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "descriptor" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialDescriptor" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "target" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceServerId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "requested_scope" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorityScope" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.credential.IssueSelfContainedCredential" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ResourceServerDisabled" } ], "anchor": "resourceserverdisabled", "about": { "kind": "event", "name": "mandate.credential.ResourceServerDisabled" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.ResourceServerDisabled" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceServerId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.credential.DisableResourceServer" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ResourceServerRegistered" } ], "anchor": "resourceserverregistered", "about": { "kind": "event", "name": "mandate.credential.ResourceServerRegistered" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.ResourceServerRegistered" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceServerId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "audience" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.Audience" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "credential_profile" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialProfile" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "allowed_exchange_sources" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "List" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.credential.RegisterResourceServer" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SigningKeyRegistered" } ], "anchor": "signingkeyregistered", "about": { "kind": "event", "name": "mandate.credential.SigningKeyRegistered" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.SigningKeyRegistered" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SigningKeyId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "key_reference" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.KeyReference" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "thumbprint" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "algorithm" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SigningAlgorithm" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "not_before" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "expires_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.credential.RegisterSigningKey" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SigningKeyRetired" } ], "anchor": "signingkeyretired", "about": { "kind": "event", "name": "mandate.credential.SigningKeyRetired" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.SigningKeyRetired" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SigningKeyId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.credential.RetireSigningKey" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SigningKeyRevoked" } ], "anchor": "signingkeyrevoked", "about": { "kind": "event", "name": "mandate.credential.SigningKeyRevoked" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.SigningKeyRevoked" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SigningKeyId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.credential.RevokeSigningKey" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "TokenExchangeAllowed" } ], "anchor": "tokenexchangeallowed", "about": { "kind": "event", "name": "mandate.credential.TokenExchangeAllowed" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.TokenExchangeAllowed" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "credential_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "reference_verifier" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "epochs" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "issued_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "descriptor" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialDescriptor" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "target" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceServerId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "requested_scope" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorityScope" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.credential.ExchangeCredential" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "TokenExchangeDenied" } ], "anchor": "tokenexchangedenied", "about": { "kind": "event", "name": "mandate.credential.TokenExchangeDenied" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.TokenExchangeDenied" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "requested_target" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceServerId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "requested_scope" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorityScope" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command in this system emits it, so something outside the specification does." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Errors" } ], "anchor": "errors", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Denied" } ], "anchor": "denied", "about": { "kind": "error", "name": "mandate.credential.Denied" }, "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "Fail closed; no credential, authority or lifecycle mutation on refusal." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "reason" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DenialReason" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.credential.DisableResourceServer" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.credential.ExchangeCredential" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.credential.IntrospectCredential" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.credential.IssueAuthorizationCode" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.credential.IssueReferenceCredential" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.credential.IssueSelfContainedCredential" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.credential.RedeemAuthorizationCode" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.credential.RegisterResourceServer" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.credential.RegisterSigningKey" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.credential.RetireSigningKey" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.credential.RevokeAccessCredential" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.credential.RevokeSigningKey" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] } ] } ] }, { "block": "list", "ordered": false, "items": [] } ] }, { "id": "domains/mandate-delegation", "title": [ { "inline": "text", "text": "delegation" } ], "about": { "kind": "domain", "name": "mandate.delegation" }, "provenance": { "provenance": { "system": "mandate", "specification_version": "v1", "source_digest": "2f11d2daffc2d75bb4ca8c0485aedc56fb2a712cdaed6347fc48b8ba2b1f7ca6", "contract_digest": "slice-sha256/2:6bf4b0d22c19d7ef08826bd3fbe010083c8c3ee4cb3003c0894f6f34a6a6144f" }, "slice": { "of": "constructs", "seeds": [ { "kind": "domain", "name": "mandate.delegation" }, { "kind": "type", "name": "mandate.delegation.Agent.State" }, { "kind": "type", "name": "mandate.delegation.AgentCapabilityCeiling.State" }, { "kind": "type", "name": "mandate.delegation.Approval.State" }, { "kind": "type", "name": "mandate.delegation.Delegation.State" }, { "kind": "type", "name": "mandate.delegation.Execution.State" }, { "kind": "entity", "name": "mandate.delegation.Agent" }, { "kind": "entity", "name": "mandate.delegation.AgentCapabilityCeiling" }, { "kind": "entity", "name": "mandate.delegation.Approval" }, { "kind": "entity", "name": "mandate.delegation.Delegation" }, { "kind": "entity", "name": "mandate.delegation.Execution" }, { "kind": "command", "name": "mandate.delegation.CompleteExecution" }, { "kind": "command", "name": "mandate.delegation.ConsumeApproval" }, { "kind": "command", "name": "mandate.delegation.CreateDelegation" }, { "kind": "command", "name": "mandate.delegation.RetireAgent" }, { "kind": "command", "name": "mandate.delegation.RevokeDelegation" }, { "kind": "command", "name": "mandate.delegation.SupersedeAgentCapabilityCeiling" }, { "kind": "event", "name": "mandate.delegation.AgentCapabilityCeilingSuperseded" }, { "kind": "event", "name": "mandate.delegation.AgentRetired" }, { "kind": "event", "name": "mandate.delegation.ApprovalConsumed" }, { "kind": "event", "name": "mandate.delegation.DelegationCreated" }, { "kind": "event", "name": "mandate.delegation.DelegationRevoked" }, { "kind": "event", "name": "mandate.delegation.ExecutionCompleted" }, { "kind": "error", "name": "mandate.delegation.Denied" }, { "kind": "component", "name": "mandate-authorization" }, { "kind": "component", "name": "mandate-control-plane" }, { "kind": "component", "name": "mandate-sts" }, { "kind": "component", "name": "mandate-worker" } ] } }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation" }, { "inline": "text", "text": " is one of mandate's bounded contexts. " }, { "inline": "link", "to": { "target": "page", "page": "index" }, "text": [ { "inline": "text", "text": "Back to the index" } ] }, { "inline": "text", "text": "." } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Entities" } ], "anchor": "entities", "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "An entity is what this context is about: something with an identity that outlives any one request, a shape, and a lifecycle. The lifecycle is exhaustive — a move that is not drawn below is a move this specification does not permit, and that is the only way it says so. Every move is labelled with the command that takes it, because a move nothing can trigger is refused rather than drawn." } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Agent" } ], "anchor": "agent", "about": { "kind": "entity", "name": "mandate.delegation.Agent" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.Agent" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.PrincipalId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "agent_type" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Agent.organization_id" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.delegation.Agent.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Retired" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Retired" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Recorded\n Recorded --> Retired: retire (RetireAgent)\n Retired --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "retire" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.delegation.RetireAgent" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command here creates one, so an instance arrives from outside this specification." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Retired" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Recorded" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AgentCapabilityCeiling" } ], "anchor": "agentcapabilityceiling", "about": { "kind": "entity", "name": "mandate.delegation.AgentCapabilityCeiling" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.AgentCapabilityCeiling" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.AgentCapabilityCeilingId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "agent_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "allowed_actions" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "List" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "denied_actions" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "List" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "scope" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorityScope" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "max_delegation_ttl" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Duration" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "AgentCapabilityCeiling.organization_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "principal" }, "text": [ { "inline": "code", "text": "mandate.identity.Principal" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "agent_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "AgentCapabilityCeiling.agent_id" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.delegation.AgentCapabilityCeiling.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Superseded" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Superseded" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Recorded\n Recorded --> Superseded: supersede (SupersedeAgentCapabilityCeiling)\n Superseded --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "supersede" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.delegation.SupersedeAgentCapabilityCeiling" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command here creates one, so an instance arrives from outside this specification." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Superseded" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Recorded" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Approval" } ], "anchor": "approval", "about": { "kind": "entity", "name": "mandate.delegation.Approval" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.Approval" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.ApprovalId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "subject" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "actor" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "action" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.Action" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "resource" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceRef" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "expires_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "approver" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Approval.organization_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "principal" }, "text": [ { "inline": "code", "text": "mandate.identity.Principal" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "subject_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Approval.subject" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "principal" }, "text": [ { "inline": "code", "text": "mandate.identity.Principal" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "actor_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Approval.actor" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "principal" }, "text": [ { "inline": "code", "text": "mandate.identity.Principal" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "approver_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Approval.approver" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.delegation.Approval.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Consumed" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Consumed" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Recorded\n Recorded --> Consumed: consume (ConsumeApproval)\n Consumed --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "consume" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.delegation.ConsumeApproval" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command here creates one, so an instance arrives from outside this specification." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Consumed" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Recorded" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Delegation" } ], "anchor": "delegation", "about": { "kind": "entity", "name": "mandate.delegation.Delegation" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.Delegation" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.DelegationId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "delegator" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "delegate" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "scope" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorityScope" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "audience" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.Audience" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "not_before" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "expires_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "execution_binding" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "transitive" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Boolean" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "created_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Delegation.organization_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "principal" }, "text": [ { "inline": "code", "text": "mandate.identity.Principal" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "delegator_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Delegation.delegator" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "principal" }, "text": [ { "inline": "code", "text": "mandate.identity.Principal" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "delegate_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Delegation.delegate" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-delegation", "anchor": "execution" }, "text": [ { "inline": "code", "text": "Execution" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "execution_binding_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Delegation.execution_binding" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Every instance satisfies " }, { "inline": "code", "text": "transitive == false" }, { "inline": "text", "text": " — a predicate over this entity's own fields, checked against them rather than stored as a sentence, so an invariant reading something the entity does not have is refused instead of documented." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.delegation.Delegation.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Active\n Active --> Revoked: revoke (RevokeDelegation)\n Revoked --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "revoke" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.delegation.RevokeDelegation" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is brought into existence by " }, { "inline": "code", "text": "mandate.delegation.CreateDelegation" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Active" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Execution" } ], "anchor": "execution", "about": { "kind": "entity", "name": "mandate.delegation.Execution" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.Execution" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.ExecutionId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "agent_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "subject" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "delegation_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "initiating_session" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "created_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "expires_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "policy_version" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PolicyVersion" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Execution.organization_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "principal" }, "text": [ { "inline": "code", "text": "mandate.identity.Principal" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "agent_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Execution.agent_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "principal" }, "text": [ { "inline": "code", "text": "mandate.identity.Principal" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "subject_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Execution.subject" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-delegation", "anchor": "delegation" }, "text": [ { "inline": "code", "text": "Delegation" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "delegation_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Execution.delegation_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "session" }, "text": [ { "inline": "code", "text": "mandate.identity.Session" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "initiating_session_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Execution.initiating_session" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.delegation.Execution.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Completed" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Completed" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Recorded\n Recorded --> Completed: complete (CompleteExecution)\n Completed --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "complete" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.delegation.CompleteExecution" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command here creates one, so an instance arrives from outside this specification." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Completed" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Recorded" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Commands" } ], "anchor": "commands", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "CompleteExecution" } ], "anchor": "completeexecution", "about": { "kind": "command", "name": "mandate.delegation.CompleteExecution" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.CompleteExecution" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ExecutionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The recorded end of one agent invocation. No further tool call is admitted under the execution; the record, its delegation binding and its policy version are preserved. An execution past expires_at is ineligible without any recorded move. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.delegation.Execution" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Completed" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "complete" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.delegation.ExecutionCompleted" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.delegation.Execution" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Completed" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.delegation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller is not the agent runtime that holds this execution, the execution is outside the verified organization, or completion cannot durably stop further tool calls bound to it.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.delegation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ConsumeApproval" } ], "anchor": "consumeapproval", "about": { "kind": "command", "name": "mandate.delegation.ConsumeApproval" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.ConsumeApproval" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ApprovalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "One approval satisfies exactly one decision. Consumption commits with the decision that used it; a consumed approval never satisfies a second check and is never reinstated. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.delegation.Approval" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Consumed" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "consume" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.delegation.ApprovalConsumed" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.delegation.Approval" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Consumed" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.delegation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller does not hold the decision context the approval answers, the approval is outside the verified organization, its subject/actor/action/resource or expiry does not match the check being satisfied, or one-use consumption cannot commit atomically with that decision.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.delegation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "CreateDelegation" } ], "anchor": "createdelegation", "about": { "kind": "command", "name": "mandate.delegation.CreateDelegation" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.CreateDelegation" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "delegate" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "scope" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorityScope" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "audience" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.Audience" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "expires_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "not_before" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "execution_binding" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It creates a " }, { "inline": "code", "text": "mandate.delegation.Delegation" }, { "inline": "text", "text": ", which starts in " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The new instance's identity is published as " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": " on " }, { "inline": "code", "text": "mandate.delegation.DelegationCreated" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.delegation.DelegationCreated" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks delegation authority, subject/delegate/tenant/space/registered audience or execution binding fails, requested scope/expiry exceeds source/delegation/policy limits or agent ceilings, or a transitive/approval-required grant would be created.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.delegation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RetireAgent" } ], "anchor": "retireagent", "about": { "kind": "command", "name": "mandate.delegation.RetireAgent" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.RetireAgent" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The installation is withdrawn, not deleted. A retired agent starts no execution and is admitted by no exchange; its executions, delegations and audit history are preserved, and disabling the agent's principal remains a separate identity command. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.delegation.Agent" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Retired" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "retire" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.delegation.AgentRetired" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.delegation.Agent" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Retired" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.delegation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks agent-administration authority, the agent is outside the verified organization, or retirement cannot stop new executions and exchanges under its ceiling.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.delegation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RevokeDelegation" } ], "anchor": "revokedelegation", "about": { "kind": "command", "name": "mandate.delegation.RevokeDelegation" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.RevokeDelegation" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DelegationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.delegation.Delegation" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "revoke" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.delegation.DelegationRevoked" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.delegation.Delegation" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.delegation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks delegation-revocation authority, delegation is outside the verified organization, or durable revocation and affected exchange invalidation fail.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.delegation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SupersedeAgentCapabilityCeiling" } ], "anchor": "supersedeagentcapabilityceiling", "about": { "kind": "command", "name": "mandate.delegation.SupersedeAgentCapabilityCeiling" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.SupersedeAgentCapabilityCeiling" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AgentCapabilityCeilingId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "A ceiling is never edited. The replacement is a new ceiling record and this one stops being current, which is what keeps exactly one current ceiling per (agent, organization-or-platform); every applicable platform and tenant ceiling still intersects. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.delegation.AgentCapabilityCeiling" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Superseded" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "supersede" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.delegation.AgentCapabilityCeilingSuperseded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.delegation.AgentCapabilityCeiling" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Superseded" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.delegation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks ceiling-administration authority, the ceiling is outside the verified organization or platform scope, no later ceiling covers the same agent and scope, or supersession cannot take effect before the next exchange is evaluated.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.delegation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Events" } ], "anchor": "events", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AgentCapabilityCeilingSuperseded" } ], "anchor": "agentcapabilityceilingsuperseded", "about": { "kind": "event", "name": "mandate.delegation.AgentCapabilityCeilingSuperseded" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.AgentCapabilityCeilingSuperseded" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AgentCapabilityCeilingId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.delegation.SupersedeAgentCapabilityCeiling" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AgentRetired" } ], "anchor": "agentretired", "about": { "kind": "event", "name": "mandate.delegation.AgentRetired" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.AgentRetired" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.delegation.RetireAgent" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ApprovalConsumed" } ], "anchor": "approvalconsumed", "about": { "kind": "event", "name": "mandate.delegation.ApprovalConsumed" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.ApprovalConsumed" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ApprovalId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.delegation.ConsumeApproval" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DelegationCreated" } ], "anchor": "delegationcreated", "about": { "kind": "event", "name": "mandate.delegation.DelegationCreated" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.DelegationCreated" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DelegationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "delegator" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "delegate" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "scope" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorityScope" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "audience" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.Audience" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "not_before" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "expires_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "execution_binding" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "created_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.delegation.CreateDelegation" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DelegationRevoked" } ], "anchor": "delegationrevoked", "about": { "kind": "event", "name": "mandate.delegation.DelegationRevoked" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.DelegationRevoked" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DelegationId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.delegation.RevokeDelegation" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ExecutionCompleted" } ], "anchor": "executioncompleted", "about": { "kind": "event", "name": "mandate.delegation.ExecutionCompleted" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.ExecutionCompleted" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ExecutionId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.delegation.CompleteExecution" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Errors" } ], "anchor": "errors", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Denied" } ], "anchor": "denied", "about": { "kind": "error", "name": "mandate.delegation.Denied" }, "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "Fail closed; no credential, authority or lifecycle mutation on refusal." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "reason" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DenialReason" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.delegation.CompleteExecution" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.delegation.ConsumeApproval" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.delegation.CreateDelegation" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.delegation.RetireAgent" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.delegation.RevokeDelegation" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.delegation.SupersedeAgentCapabilityCeiling" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] } ] } ] }, { "block": "list", "ordered": false, "items": [] } ] }, { "id": "domains/mandate-directory", "title": [ { "inline": "text", "text": "directory" } ], "about": { "kind": "domain", "name": "mandate.directory" }, "provenance": { "provenance": { "system": "mandate", "specification_version": "v1", "source_digest": "2f11d2daffc2d75bb4ca8c0485aedc56fb2a712cdaed6347fc48b8ba2b1f7ca6", "contract_digest": "slice-sha256/2:6bf4b0d22c19d7ef08826bd3fbe010083c8c3ee4cb3003c0894f6f34a6a6144f" }, "slice": { "of": "constructs", "seeds": [ { "kind": "domain", "name": "mandate.directory" }, { "kind": "type", "name": "mandate.directory.DirectoryGroup.State" }, { "kind": "type", "name": "mandate.directory.DirectoryGroupMembership.State" }, { "kind": "type", "name": "mandate.directory.DirectoryGroupTeamMapping.State" }, { "kind": "type", "name": "mandate.directory.MembershipContribution.State" }, { "kind": "type", "name": "mandate.directory.SyncJob.State" }, { "kind": "entity", "name": "mandate.directory.DirectoryGroup" }, { "kind": "entity", "name": "mandate.directory.DirectoryGroupMembership" }, { "kind": "entity", "name": "mandate.directory.DirectoryGroupTeamMapping" }, { "kind": "entity", "name": "mandate.directory.MembershipContribution" }, { "kind": "entity", "name": "mandate.directory.SyncJob" }, { "kind": "command", "name": "mandate.directory.CompleteSyncJob" }, { "kind": "command", "name": "mandate.directory.CreateDirectoryGroupTeamMapping" }, { "kind": "command", "name": "mandate.directory.FailSyncJob" }, { "kind": "command", "name": "mandate.directory.RemoveDirectoryGroupMembership" }, { "kind": "command", "name": "mandate.directory.RemoveDirectoryGroupTeamMapping" }, { "kind": "command", "name": "mandate.directory.RemoveMembershipContribution" }, { "kind": "command", "name": "mandate.directory.RetireDirectoryGroup" }, { "kind": "command", "name": "mandate.directory.SyncDirectoryMembership" }, { "kind": "event", "name": "mandate.directory.DirectoryGroupMembershipChanged" }, { "kind": "event", "name": "mandate.directory.DirectoryGroupMembershipRecorded" }, { "kind": "event", "name": "mandate.directory.DirectoryGroupMembershipRemoved" }, { "kind": "event", "name": "mandate.directory.DirectoryGroupRecorded" }, { "kind": "event", "name": "mandate.directory.DirectoryGroupRetired" }, { "kind": "event", "name": "mandate.directory.DirectoryGroupTeamMappingCreated" }, { "kind": "event", "name": "mandate.directory.DirectoryGroupTeamMappingRemoved" }, { "kind": "event", "name": "mandate.directory.MembershipContributionRecorded" }, { "kind": "event", "name": "mandate.directory.MembershipContributionRemoved" }, { "kind": "event", "name": "mandate.directory.SyncJobCompleted" }, { "kind": "event", "name": "mandate.directory.SyncJobFailed" }, { "kind": "event", "name": "mandate.directory.SyncJobRecorded" }, { "kind": "error", "name": "mandate.directory.Denied" }, { "kind": "component", "name": "mandate-authorization" }, { "kind": "component", "name": "mandate-control-plane" }, { "kind": "component", "name": "mandate-sts" }, { "kind": "component", "name": "mandate-worker" } ] } }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory" }, { "inline": "text", "text": " is one of mandate's bounded contexts. " }, { "inline": "link", "to": { "target": "page", "page": "index" }, "text": [ { "inline": "text", "text": "Back to the index" } ] }, { "inline": "text", "text": "." } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Entities" } ], "anchor": "entities", "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "An entity is what this context is about: something with an identity that outlives any one request, a shape, and a lifecycle. The lifecycle is exhaustive — a move that is not drawn below is a move this specification does not permit, and that is the only way it says so. Every move is labelled with the command that takes it, because a move nothing can trigger is refused rather than drawn." } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DirectoryGroup" } ], "anchor": "directorygroup", "about": { "kind": "entity", "name": "mandate.directory.DirectoryGroup" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.DirectoryGroup" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.DirectoryGroupId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "display_name" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "source" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "DirectoryGroup.organization_id" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.directory.DirectoryGroup.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Retired" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Retired" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Recorded\n Recorded --> Retired: retire (RetireDirectoryGroup)\n Retired --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "retire" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.directory.RetireDirectoryGroup" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command here creates one, so an instance arrives from outside this specification." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Retired" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Recorded" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DirectoryGroupMembership" } ], "anchor": "directorygroupmembership", "about": { "kind": "entity", "name": "mandate.directory.DirectoryGroupMembership" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.DirectoryGroupMembership" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.DirectoryGroupMembershipId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "group_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DirectoryGroupId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "principal_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "DirectoryGroupMembership.organization_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-directory", "anchor": "directorygroup" }, "text": [ { "inline": "code", "text": "DirectoryGroup" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "group_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "DirectoryGroupMembership.group_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "principal" }, "text": [ { "inline": "code", "text": "mandate.identity.Principal" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "principal_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "DirectoryGroupMembership.principal_id" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.directory.DirectoryGroupMembership.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Active\n Active --> Removed: remove (RemoveDirectoryGroupMembership)\n Removed --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "remove" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.directory.RemoveDirectoryGroupMembership" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command here creates one, so an instance arrives from outside this specification." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Removed" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Active" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DirectoryGroupTeamMapping" } ], "anchor": "directorygroupteammapping", "about": { "kind": "entity", "name": "mandate.directory.DirectoryGroupTeamMapping" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.DirectoryGroupTeamMapping" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.DirectoryGroupTeamMappingId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "group_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DirectoryGroupId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "team_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.TeamId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "created_by" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "created_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "DirectoryGroupTeamMapping.organization_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-directory", "anchor": "directorygroup" }, "text": [ { "inline": "code", "text": "DirectoryGroup" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "group_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "DirectoryGroupTeamMapping.group_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "team" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Team" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "team_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "DirectoryGroupTeamMapping.team_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "principal" }, "text": [ { "inline": "code", "text": "mandate.identity.Principal" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "created_by_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "DirectoryGroupTeamMapping.created_by" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.directory.DirectoryGroupTeamMapping.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Active\n Active --> Removed: remove (RemoveDirectoryGroupTeamMapping)\n Removed --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "remove" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.directory.RemoveDirectoryGroupTeamMapping" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is brought into existence by " }, { "inline": "code", "text": "mandate.directory.CreateDirectoryGroupTeamMapping" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Removed" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Active" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "MembershipContribution" } ], "anchor": "membershipcontribution", "about": { "kind": "entity", "name": "mandate.directory.MembershipContribution" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.MembershipContribution" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.MembershipContributionId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "team_membership_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.TeamMembershipId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "source" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.MembershipSource" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mapping_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "created_by" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "MembershipContribution.organization_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "teammembership" }, "text": [ { "inline": "code", "text": "mandate.tenancy.TeamMembership" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "team_membership_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "MembershipContribution.team_membership_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-directory", "anchor": "directorygroupteammapping" }, "text": [ { "inline": "code", "text": "DirectoryGroupTeamMapping" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "mapping_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "MembershipContribution.mapping_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "principal" }, "text": [ { "inline": "code", "text": "mandate.identity.Principal" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "created_by_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "MembershipContribution.created_by" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.directory.MembershipContribution.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Active\n Active --> Removed: remove (RemoveMembershipContribution)\n Removed --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "remove" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.directory.RemoveMembershipContribution" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command here creates one, so an instance arrives from outside this specification." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Removed" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Active" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SyncJob" } ], "anchor": "syncjob", "about": { "kind": "entity", "name": "mandate.directory.SyncJob" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.SyncJob" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.SyncJobId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "connection_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.FederationConnectionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "correlation" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CorrelationId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "SyncJob.organization_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-federation", "anchor": "federationconnection" }, "text": [ { "inline": "code", "text": "mandate.federation.FederationConnection" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "connection_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "SyncJob.connection_id" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.directory.SyncJob.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Completed" }, { "inline": "text", "text": ", " }, { "inline": "code", "text": "Failed" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Completed" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Failed" }, { "inline": "text", "text": " are terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Recorded\n Recorded --> Completed: complete (CompleteSyncJob)\n Recorded --> Failed: fail (FailSyncJob)\n Completed --> [*]\n Failed --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "complete" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.directory.CompleteSyncJob" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "fail" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.directory.FailSyncJob" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command here creates one, so an instance arrives from outside this specification." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Completed" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Failed" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "Completed" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Recorded" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "Failed" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Completed" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "Failed" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Recorded" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Commands" } ], "anchor": "commands", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "CompleteSyncJob" } ], "anchor": "completesyncjob", "about": { "kind": "command", "name": "mandate.directory.CompleteSyncJob" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.CompleteSyncJob" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SyncJobId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "One synchronization run is recorded as having applied every membership change it resolved. The queue that delivered the job stays behind its port; this records the outcome, not the transport. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.directory.SyncJob" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Completed" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "complete" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.directory.SyncJobCompleted" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.directory.SyncJob" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Completed" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Failed" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.directory.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller is not the trusted synchronization worker, the job is outside the verified organization, or the membership changes the run applied cannot be recorded durably with its completion.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.directory.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "CreateDirectoryGroupTeamMapping" } ], "anchor": "createdirectorygroupteammapping", "about": { "kind": "command", "name": "mandate.directory.CreateDirectoryGroupTeamMapping" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.CreateDirectoryGroupTeamMapping" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "group_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DirectoryGroupId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "team_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.TeamId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "One mapping row, and the mapping-derived contribution rows the reconciliation wrote named by identity alone. Each contribution's own fields are on its MembershipContributionRecorded; nothing here is read positionally. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It creates a " }, { "inline": "code", "text": "mandate.directory.DirectoryGroupTeamMapping" }, { "inline": "text", "text": ", which starts in " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The new instance's identity is published as " }, { "inline": "code", "text": "mapping_id" }, { "inline": "text", "text": " on " }, { "inline": "code", "text": "mandate.directory.DirectoryGroupTeamMappingCreated" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.directory.DirectoryGroupTeamMappingCreated" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks mapping authority, group/team is unknown, the group is retired, the team is retired, either target is outside the verified organization, or provenance-preserving contribution reconciliation fails.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.directory.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "FailSyncJob" } ], "anchor": "failsyncjob", "about": { "kind": "command", "name": "mandate.directory.FailSyncJob" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.FailSyncJob" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SyncJobId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "A run that did not apply its full result is recorded as failed, so stale directory state is visible rather than silent. Redelivery is a new job record; a failed job is never retried in place. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.directory.SyncJob" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Failed" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "fail" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.directory.SyncJobFailed" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.directory.SyncJob" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Completed" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Failed" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.directory.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller is not the trusted synchronization worker, the job is outside the verified organization, or the partial run cannot be recorded without implying a completed synchronization.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.directory.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RemoveDirectoryGroupMembership" } ], "anchor": "removedirectorygroupmembership", "about": { "kind": "command", "name": "mandate.directory.RemoveDirectoryGroupMembership" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.RemoveDirectoryGroupMembership" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DirectoryGroupMembershipId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.directory.DirectoryGroupMembership" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "remove" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.directory.DirectoryGroupMembershipRemoved" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.directory.DirectoryGroupMembership" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.directory.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks trusted provisioning authority, group/member organization mismatches, or derived contribution removal cannot preserve unrelated memberships.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.directory.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RemoveDirectoryGroupTeamMapping" } ], "anchor": "removedirectorygroupteammapping", "about": { "kind": "command", "name": "mandate.directory.RemoveDirectoryGroupTeamMapping" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.RemoveDirectoryGroupTeamMapping" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DirectoryGroupTeamMappingId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.directory.DirectoryGroupTeamMapping" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "remove" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.directory.DirectoryGroupTeamMappingRemoved" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.directory.DirectoryGroupTeamMapping" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.directory.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks mapping authority, mapping is outside the verified organization, or retraction would remove the team, manual membership or another mapping contribution.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.directory.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RemoveMembershipContribution" } ], "anchor": "removemembershipcontribution", "about": { "kind": "command", "name": "mandate.directory.RemoveMembershipContribution" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.RemoveMembershipContribution" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.MembershipContributionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.directory.MembershipContribution" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "remove" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.directory.MembershipContributionRemoved" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.directory.MembershipContribution" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.directory.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks mapping authority, contribution is outside the verified organization, or removal cannot preserve every other valid manual/mapping contribution.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.directory.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RetireDirectoryGroup" } ], "anchor": "retiredirectorygroup", "about": { "kind": "command", "name": "mandate.directory.RetireDirectoryGroup" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.RetireDirectoryGroup" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DirectoryGroupId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The group the customer directory no longer publishes stops contributing authority and is kept as a record. Its memberships and team mappings are retracted by their own commands, which is what preserves every other manual or mapping contribution. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.directory.DirectoryGroup" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Retired" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "retire" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.directory.DirectoryGroupRetired" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.directory.DirectoryGroup" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Retired" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.directory.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller is not an admitted provisioning source, the group is outside the verified organization, or retirement cannot preserve the team, manual memberships and the contributions another mapping still supports.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.directory.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SyncDirectoryMembership" } ], "anchor": "syncdirectorymembership", "about": { "kind": "command", "name": "mandate.directory.SyncDirectoryMembership" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.SyncDirectoryMembership" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "group_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DirectoryGroupId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "members" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "List" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The membership rows this run wrote, named by identity alone and nothing else. They are the additions the run resolved, never the group's full membership, and each row's own fields are on its own DirectoryGroupMembershipRecorded. A membership this run no longer resolves is removed only by RemoveDirectoryGroupMembership, whose DirectoryGroupMembershipRemoved names the row; absence from this list removes nothing. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.directory.DirectoryGroupMembershipChanged" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller is not an admitted provisioning source, the group is retired, group/member organization mismatches, or synchronization would grant authority without an explicit valid team mapping.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.directory.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Events" } ], "anchor": "events", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DirectoryGroupMembershipChanged" } ], "anchor": "directorygroupmembershipchanged", "about": { "kind": "event", "name": "mandate.directory.DirectoryGroupMembershipChanged" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.DirectoryGroupMembershipChanged" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "group_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DirectoryGroupId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "membership_ids" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "List" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "contributions" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "List" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.directory.SyncDirectoryMembership" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DirectoryGroupMembershipRecorded" } ], "anchor": "directorygroupmembershiprecorded", "about": { "kind": "event", "name": "mandate.directory.DirectoryGroupMembershipRecorded" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.DirectoryGroupMembershipRecorded" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DirectoryGroupMembershipId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "group_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DirectoryGroupId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "principal_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command in this system emits it, so something outside the specification does." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DirectoryGroupMembershipRemoved" } ], "anchor": "directorygroupmembershipremoved", "about": { "kind": "event", "name": "mandate.directory.DirectoryGroupMembershipRemoved" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.DirectoryGroupMembershipRemoved" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DirectoryGroupMembershipId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.directory.RemoveDirectoryGroupMembership" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DirectoryGroupRecorded" } ], "anchor": "directorygrouprecorded", "about": { "kind": "event", "name": "mandate.directory.DirectoryGroupRecorded" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.DirectoryGroupRecorded" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DirectoryGroupId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "display_name" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "source" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command in this system emits it, so something outside the specification does." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DirectoryGroupRetired" } ], "anchor": "directorygroupretired", "about": { "kind": "event", "name": "mandate.directory.DirectoryGroupRetired" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.DirectoryGroupRetired" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DirectoryGroupId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.directory.RetireDirectoryGroup" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DirectoryGroupTeamMappingCreated" } ], "anchor": "directorygroupteammappingcreated", "about": { "kind": "event", "name": "mandate.directory.DirectoryGroupTeamMappingCreated" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.DirectoryGroupTeamMappingCreated" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mapping_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DirectoryGroupTeamMappingId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "group_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DirectoryGroupId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "team_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.TeamId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "created_by" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "created_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "contributions" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "List" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.directory.CreateDirectoryGroupTeamMapping" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DirectoryGroupTeamMappingRemoved" } ], "anchor": "directorygroupteammappingremoved", "about": { "kind": "event", "name": "mandate.directory.DirectoryGroupTeamMappingRemoved" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.DirectoryGroupTeamMappingRemoved" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DirectoryGroupTeamMappingId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.directory.RemoveDirectoryGroupTeamMapping" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "MembershipContributionRecorded" } ], "anchor": "membershipcontributionrecorded", "about": { "kind": "event", "name": "mandate.directory.MembershipContributionRecorded" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.MembershipContributionRecorded" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.MembershipContributionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "team_membership_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.TeamMembershipId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "source" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.MembershipSource" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mapping_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "created_by" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command in this system emits it, so something outside the specification does." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "MembershipContributionRemoved" } ], "anchor": "membershipcontributionremoved", "about": { "kind": "event", "name": "mandate.directory.MembershipContributionRemoved" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.MembershipContributionRemoved" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.MembershipContributionId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.directory.RemoveMembershipContribution" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SyncJobCompleted" } ], "anchor": "syncjobcompleted", "about": { "kind": "event", "name": "mandate.directory.SyncJobCompleted" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.SyncJobCompleted" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SyncJobId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.directory.CompleteSyncJob" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SyncJobFailed" } ], "anchor": "syncjobfailed", "about": { "kind": "event", "name": "mandate.directory.SyncJobFailed" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.SyncJobFailed" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SyncJobId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.directory.FailSyncJob" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SyncJobRecorded" } ], "anchor": "syncjobrecorded", "about": { "kind": "event", "name": "mandate.directory.SyncJobRecorded" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.SyncJobRecorded" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SyncJobId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "connection_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.FederationConnectionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "correlation" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CorrelationId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command in this system emits it, so something outside the specification does." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Errors" } ], "anchor": "errors", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Denied" } ], "anchor": "denied", "about": { "kind": "error", "name": "mandate.directory.Denied" }, "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "Fail closed; no credential, authority or lifecycle mutation on refusal." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "reason" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DenialReason" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.directory.CompleteSyncJob" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.directory.CreateDirectoryGroupTeamMapping" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.directory.FailSyncJob" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.directory.RemoveDirectoryGroupMembership" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.directory.RemoveDirectoryGroupTeamMapping" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.directory.RemoveMembershipContribution" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.directory.RetireDirectoryGroup" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.directory.SyncDirectoryMembership" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] } ] } ] }, { "block": "list", "ordered": false, "items": [] } ] }, { "id": "domains/mandate-federation", "title": [ { "inline": "text", "text": "federation" } ], "about": { "kind": "domain", "name": "mandate.federation" }, "provenance": { "provenance": { "system": "mandate", "specification_version": "v1", "source_digest": "2f11d2daffc2d75bb4ca8c0485aedc56fb2a712cdaed6347fc48b8ba2b1f7ca6", "contract_digest": "slice-sha256/2:6bf4b0d22c19d7ef08826bd3fbe010083c8c3ee4cb3003c0894f6f34a6a6144f" }, "slice": { "of": "constructs", "seeds": [ { "kind": "domain", "name": "mandate.federation" }, { "kind": "type", "name": "mandate.federation.ExternalPrincipal.State" }, { "kind": "type", "name": "mandate.federation.FederationConnection.State" }, { "kind": "type", "name": "mandate.federation.OAuthClient.State" }, { "kind": "entity", "name": "mandate.federation.ExternalPrincipal" }, { "kind": "entity", "name": "mandate.federation.FederationConnection" }, { "kind": "entity", "name": "mandate.federation.OAuthClient" }, { "kind": "command", "name": "mandate.federation.AuthenticateFederation" }, { "kind": "command", "name": "mandate.federation.AuthorizePublicClient" }, { "kind": "command", "name": "mandate.federation.DisableFederationConnection" }, { "kind": "command", "name": "mandate.federation.DisableOAuthClient" }, { "kind": "command", "name": "mandate.federation.LinkExternalPrincipal" }, { "kind": "command", "name": "mandate.federation.ProvisionExternalPrincipal" }, { "kind": "command", "name": "mandate.federation.RegisterFederationConnection" }, { "kind": "command", "name": "mandate.federation.RegisterOAuthClient" }, { "kind": "command", "name": "mandate.federation.UnlinkExternalPrincipal" }, { "kind": "event", "name": "mandate.federation.AuthorizationCodeIssued" }, { "kind": "event", "name": "mandate.federation.ExternalPrincipalLinked" }, { "kind": "event", "name": "mandate.federation.ExternalPrincipalProvisioned" }, { "kind": "event", "name": "mandate.federation.ExternalPrincipalUnlinked" }, { "kind": "event", "name": "mandate.federation.FederationAuthenticated" }, { "kind": "event", "name": "mandate.federation.FederationConnectionCreated" }, { "kind": "event", "name": "mandate.federation.FederationConnectionDisabled" }, { "kind": "event", "name": "mandate.federation.OAuthClientDisabled" }, { "kind": "event", "name": "mandate.federation.OAuthClientRegistered" }, { "kind": "error", "name": "mandate.federation.Denied" }, { "kind": "component", "name": "mandate-authorization" }, { "kind": "component", "name": "mandate-control-plane" }, { "kind": "component", "name": "mandate-sts" }, { "kind": "component", "name": "mandate-worker" } ] } }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation" }, { "inline": "text", "text": " is one of mandate's bounded contexts. " }, { "inline": "link", "to": { "target": "page", "page": "index" }, "text": [ { "inline": "text", "text": "Back to the index" } ] }, { "inline": "text", "text": "." } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Entities" } ], "anchor": "entities", "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "An entity is what this context is about: something with an identity that outlives any one request, a shape, and a lifecycle. The lifecycle is exhaustive — a move that is not drawn below is a move this specification does not permit, and that is the only way it says so. Every move is labelled with the command that takes it, because a move nothing can trigger is refused rather than drawn." } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ExternalPrincipal" } ], "anchor": "externalprincipal", "about": { "kind": "entity", "name": "mandate.federation.ExternalPrincipal" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.ExternalPrincipal" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.ExternalPrincipalId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "subject" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ExternalSubject" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "principal_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "connection_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.FederationConnectionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "link_method" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ExternalLinkMethod" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "linked_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "ExternalPrincipal.organization_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "principal" }, "text": [ { "inline": "code", "text": "mandate.identity.Principal" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "principal_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "ExternalPrincipal.principal_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-federation", "anchor": "federationconnection" }, "text": [ { "inline": "code", "text": "FederationConnection" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "connection_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "ExternalPrincipal.connection_id" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.federation.ExternalPrincipal.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Linked" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Unlinked" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Linked" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Unlinked" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Linked\n Linked --> Unlinked: unlink (UnlinkExternalPrincipal)\n Unlinked --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "unlink" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.federation.UnlinkExternalPrincipal" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is brought into existence by " }, { "inline": "code", "text": "mandate.federation.LinkExternalPrincipal" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "mandate.federation.ProvisionExternalPrincipal" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Unlinked" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Linked" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "FederationConnection" } ], "anchor": "federationconnection", "about": { "kind": "entity", "name": "mandate.federation.FederationConnection" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.FederationConnection" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.FederationConnectionId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "issuer" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.Issuer" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "client_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ClientId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "tenant_resolution" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.TenantResolutionRule" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "jit_provisioning" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Boolean" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "FederationConnection.organization_id" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.federation.FederationConnection.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Disabled" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Enabled" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Enabled" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Disabled" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Enabled\n Enabled --> Disabled: disable (DisableFederationConnection)\n Disabled --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "disable" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.federation.DisableFederationConnection" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is brought into existence by " }, { "inline": "code", "text": "mandate.federation.RegisterFederationConnection" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Disabled" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Enabled" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "OAuthClient" } ], "anchor": "oauthclient", "about": { "kind": "entity", "name": "mandate.federation.OAuthClient" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.OAuthClient" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.OAuthClientId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "public" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Boolean" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "redirect_uris" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "List" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "pkce_method" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PkceMethod" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "OAuthClient.organization_id" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.federation.OAuthClient.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Disabled" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Disabled" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Recorded\n Recorded --> Disabled: disable (DisableOAuthClient)\n Disabled --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "disable" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.federation.DisableOAuthClient" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is brought into existence by " }, { "inline": "code", "text": "mandate.federation.RegisterOAuthClient" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Disabled" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Recorded" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Commands" } ], "anchor": "commands", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AuthenticateFederation" } ], "anchor": "authenticatefederation", "about": { "kind": "command", "name": "mandate.federation.AuthenticateFederation" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.AuthenticateFederation" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "connection_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.FederationConnectionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "proof" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialProof" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "A validated federated login mints the session, which is step 9 of the resolution order in docs/architecture/federated-login.md. FederationAuthenticated carries the whole mandate.identity.Session record — the new session identity, the principal, the resolved organization, the connection, the epoch snapshot the session is bound to and its expiry — so the identity fold materializes the session from this event alone and reads no command input or response. The audience and the correlation are carried beside the record. The principal, the organization, the epoch snapshot handle and the expiry are the ones this command resolved and returned, so the fold reads each from the response rather than from a value the implementation invented; the snapshot's own contents are recorded by the adapter through EpochSnapshotRecorded. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It creates a " }, { "inline": "code", "text": "mandate.identity.Session" }, { "inline": "text", "text": ", which starts in " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The new instance's identity is published as " }, { "inline": "code", "text": "session_id" }, { "inline": "text", "text": " on " }, { "inline": "code", "text": "mandate.federation.FederationAuthenticated" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.federation.FederationAuthenticated" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Connection is disabled/untrusted, proof signature/issuer/audience/expiry is invalid, tenant resolution has zero or multiple matches, principal linking is absent/conflicting, or any email-domain/unverified-input fallback would be required.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.federation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AuthorizePublicClient" } ], "anchor": "authorizepublicclient", "about": { "kind": "command", "name": "mandate.federation.AuthorizePublicClient" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.AuthorizePublicClient" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "client_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OAuthClientId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "redirect_uri" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.RedirectUri" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "challenge" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PkceChallenge" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "method" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PkceMethod" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "state" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "nonce" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "session_proof" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialProof" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "target" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceServerId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "requested_scope" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorityScope" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The control plane orchestrates the verified session and client checks and calls the STS IssueAuthorizationCode port; the STS creates the mandate.credential.AuthorizationCode record and returns its identity, which this event names. This outcome creates nothing — code_id is the code STS minted, not one minted here — and the transient code is returned to the public-client adapter and to nothing else. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.federation.AuthorizationCodeIssued" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Session proof is invalid/stale, client is not a registered public client, the client is disabled, exact redirect URI or state/applicable nonce binding fails, S256 challenge is absent/invalid, target is unregistered/outside tenant, or STS code issuance/narrowing is refused.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.federation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DisableFederationConnection" } ], "anchor": "disablefederationconnection", "about": { "kind": "command", "name": "mandate.federation.DisableFederationConnection" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.DisableFederationConnection" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.FederationConnectionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.federation.FederationConnection" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Enabled" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Disabled" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "disable" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.federation.FederationConnectionDisabled" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.federation.FederationConnection" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Disabled" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.federation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks federation-administration authority, connection is outside the verified organization, or emergency trust shutdown and affected generation invalidation cannot commit.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.federation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DisableOAuthClient" } ], "anchor": "disableoauthclient", "about": { "kind": "command", "name": "mandate.federation.DisableOAuthClient" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.DisableOAuthClient" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OAuthClientId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "A registered public client whose redirect surface is no longer trusted stops being admitted. The registration record is kept. No new authorization code is issued to it, and an outstanding code is refused at redemption, where RedeemAuthorizationCode re-reads the client the code is bound to; no declared move invalidates an outstanding code. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.federation.OAuthClient" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Disabled" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "disable" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.federation.OAuthClientDisabled" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.federation.OAuthClient" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Disabled" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.federation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks client-administration authority, the client is outside the verified organization, or disablement cannot stop the issuance of new authorization codes to it.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.federation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "LinkExternalPrincipal" } ], "anchor": "linkexternalprincipal", "about": { "kind": "command", "name": "mandate.federation.LinkExternalPrincipal" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.LinkExternalPrincipal" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "connection_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.FederationConnectionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "external_subject" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ExternalSubject" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "principal_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "method" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ExternalLinkMethod" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It creates a " }, { "inline": "code", "text": "mandate.federation.ExternalPrincipal" }, { "inline": "text", "text": ", which starts in " }, { "inline": "code", "text": "Linked" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The new instance's identity is published as " }, { "inline": "code", "text": "external_principal_id" }, { "inline": "text", "text": " on " }, { "inline": "code", "text": "mandate.federation.ExternalPrincipalLinked" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.federation.ExternalPrincipalLinked" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller/method lacks linking authority, proof/connection trust is invalid, organization or target principal mismatches, composite (organization, configured issuer, subject) key conflicts, or durable audited linking fails. Email equality never authorizes linking.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.federation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ProvisionExternalPrincipal" } ], "anchor": "provisionexternalprincipal", "about": { "kind": "command", "name": "mandate.federation.ProvisionExternalPrincipal" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.ProvisionExternalPrincipal" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "connection_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.FederationConnectionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "proof" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialProof" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Just-in-time provisioning on first login. The outcome creates exactly one record, the mandate.federation.ExternalPrincipal linking the principal with ExternalLinkMethod::ConfiguredFederation. The event also names the mandate.identity.Principal of kind User the provisioning produced, and no outcome in this contract declares that Principal's creation. Both identities, the external subject and the display name are bound from the response rather than left to the implementation; the display name is the validated subject until a connection admits a display-name claim, which no connection declares yet (story:federation-linking). The composite key is (organization, connection issuer, external subject), with the issuer read from the validated connection and the subject from the validated proof, never from the caller. No session is minted here; the adapter calls AuthenticateFederation again. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It creates a " }, { "inline": "code", "text": "mandate.federation.ExternalPrincipal" }, { "inline": "text", "text": ", which starts in " }, { "inline": "code", "text": "Linked" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The new instance's identity is published as " }, { "inline": "code", "text": "external_principal_id" }, { "inline": "text", "text": " on " }, { "inline": "code", "text": "mandate.federation.ExternalPrincipalProvisioned" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.federation.ExternalPrincipalProvisioned" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Connection is disabled/untrusted, proof signature/issuer/audience/expiry is invalid, tenant resolution has zero or multiple matches, principal linking is conflicting, connection does not admit provisioning, the composite (organization, configured issuer, subject) key already exists, or any email-domain/unverified-input fallback would be required.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.federation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RegisterFederationConnection" } ], "anchor": "registerfederationconnection", "about": { "kind": "command", "name": "mandate.federation.RegisterFederationConnection" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.RegisterFederationConnection" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "issuer" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.Issuer" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "client_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ClientId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "tenant_resolution" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.TenantResolutionRule" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "jit_provisioning" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Boolean" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The connection is created with its provisioning setting decided here and never changed afterwards. A connection whose issuer or provisioning admission must change is disabled and registered again; there is no update command. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It creates a " }, { "inline": "code", "text": "mandate.federation.FederationConnection" }, { "inline": "text", "text": ", which starts in " }, { "inline": "code", "text": "Enabled" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The new instance's identity is published as " }, { "inline": "code", "text": "connection_id" }, { "inline": "text", "text": " on " }, { "inline": "code", "text": "mandate.federation.FederationConnectionCreated" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.federation.FederationConnectionCreated" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks federation-administration authority, issuer/client/trust, tenant-resolution or just-in-time provisioning configuration is unadmitted, or organization binding is invalid.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.federation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RegisterOAuthClient" } ], "anchor": "registeroauthclient", "about": { "kind": "command", "name": "mandate.federation.RegisterOAuthClient" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.RegisterOAuthClient" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "public" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Boolean" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "redirect_uris" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "List" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "pkce_method" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PkceMethod" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The client is bound to the organization the verified context carries; the command takes no organization input, so no caller selects the tenant a client is registered into. OAuthClientRegistered carries the whole mandate.federation.OAuthClient record — the client identity, its organization, whether it is a public client, its exact redirect set and its PKCE method — so the federation fold materializes the client from this event alone and reads no command input or response. The identity and the organization are the ones this outcome decided and returned, read from the response rather than from a value the implementation invented. An empty redirect set is admitted and is not a denial — the client it registers is inert, because AuthorizePublicClient matches the presented redirect against the registered set exactly and an empty set matches nothing, so every authorization request to that client is refused. mandate.core.PkceMethod admits S256 and nothing else, so no registration can name another method and none is refused for naming one. A registration whose redirect surface or PKCE method must change is disabled and registered again; there is no update command. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It creates a " }, { "inline": "code", "text": "mandate.federation.OAuthClient" }, { "inline": "text", "text": ", which starts in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The new instance's identity is published as " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": " on " }, { "inline": "code", "text": "mandate.federation.OAuthClientRegistered" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.federation.OAuthClientRegistered" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks client-administration authority, a redirect URI is unadmitted, or organization binding is invalid.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.federation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "UnlinkExternalPrincipal" } ], "anchor": "unlinkexternalprincipal", "about": { "kind": "command", "name": "mandate.federation.UnlinkExternalPrincipal" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.UnlinkExternalPrincipal" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ExternalPrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.federation.ExternalPrincipal" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Linked" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Unlinked" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "unlink" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.federation.ExternalPrincipalUnlinked" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.federation.ExternalPrincipal" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Unlinked" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.federation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks explicit link-administration authority, link is outside the verified organization, or unlinking and its required invalidation/audit cannot commit.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.federation.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Events" } ], "anchor": "events", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AuthorizationCodeIssued" } ], "anchor": "authorizationcodeissued", "about": { "kind": "event", "name": "mandate.federation.AuthorizationCodeIssued" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.AuthorizationCodeIssued" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "correlation" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CorrelationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "code_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorizationCodeId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "client_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OAuthClientId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "session_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SessionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "redirect_uri" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.RedirectUri" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "challenge" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PkceChallenge" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "method" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PkceMethod" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "target" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceServerId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "requested_scope" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorityScope" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.federation.AuthorizePublicClient" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ExternalPrincipalLinked" } ], "anchor": "externalprincipallinked", "about": { "kind": "event", "name": "mandate.federation.ExternalPrincipalLinked" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.ExternalPrincipalLinked" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "connection_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.FederationConnectionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "principal_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "external_principal_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ExternalPrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "subject" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ExternalSubject" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "link_method" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ExternalLinkMethod" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "linked_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.federation.LinkExternalPrincipal" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ExternalPrincipalProvisioned" } ], "anchor": "externalprincipalprovisioned", "about": { "kind": "event", "name": "mandate.federation.ExternalPrincipalProvisioned" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.ExternalPrincipalProvisioned" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "correlation" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CorrelationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "connection_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.FederationConnectionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "principal_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "kind" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalKind" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "display_name" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "external_principal_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ExternalPrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "subject" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ExternalSubject" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "link_method" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ExternalLinkMethod" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "linked_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.federation.ProvisionExternalPrincipal" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ExternalPrincipalUnlinked" } ], "anchor": "externalprincipalunlinked", "about": { "kind": "event", "name": "mandate.federation.ExternalPrincipalUnlinked" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.ExternalPrincipalUnlinked" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ExternalPrincipalId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.federation.UnlinkExternalPrincipal" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "FederationAuthenticated" } ], "anchor": "federationauthenticated", "about": { "kind": "event", "name": "mandate.federation.FederationAuthenticated" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.FederationAuthenticated" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "session_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SessionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "principal_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "audience" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.Audience" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "correlation" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CorrelationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "connection_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.FederationConnectionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "epochs" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.EpochSnapshotRef" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "expires_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.federation.AuthenticateFederation" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "FederationConnectionCreated" } ], "anchor": "federationconnectioncreated", "about": { "kind": "event", "name": "mandate.federation.FederationConnectionCreated" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.FederationConnectionCreated" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "connection_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.FederationConnectionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "issuer" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.Issuer" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "client_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ClientId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "tenant_resolution" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.TenantResolutionRule" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "jit_provisioning" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Boolean" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.federation.RegisterFederationConnection" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "FederationConnectionDisabled" } ], "anchor": "federationconnectiondisabled", "about": { "kind": "event", "name": "mandate.federation.FederationConnectionDisabled" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.FederationConnectionDisabled" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.FederationConnectionId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.federation.DisableFederationConnection" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "OAuthClientDisabled" } ], "anchor": "oauthclientdisabled", "about": { "kind": "event", "name": "mandate.federation.OAuthClientDisabled" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.OAuthClientDisabled" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OAuthClientId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.federation.DisableOAuthClient" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "OAuthClientRegistered" } ], "anchor": "oauthclientregistered", "about": { "kind": "event", "name": "mandate.federation.OAuthClientRegistered" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.OAuthClientRegistered" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OAuthClientId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "public" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Boolean" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "redirect_uris" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "List" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "pkce_method" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PkceMethod" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.federation.RegisterOAuthClient" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Errors" } ], "anchor": "errors", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Denied" } ], "anchor": "denied", "about": { "kind": "error", "name": "mandate.federation.Denied" }, "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "Fail closed; no credential, authority or lifecycle mutation on refusal." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "reason" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DenialReason" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.federation.AuthenticateFederation" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.federation.AuthorizePublicClient" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.federation.DisableFederationConnection" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.federation.DisableOAuthClient" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.federation.LinkExternalPrincipal" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.federation.ProvisionExternalPrincipal" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.federation.RegisterFederationConnection" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.federation.RegisterOAuthClient" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.federation.UnlinkExternalPrincipal" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] } ] } ] }, { "block": "list", "ordered": false, "items": [] } ] }, { "id": "domains/mandate-graph", "title": [ { "inline": "text", "text": "graph" } ], "about": { "kind": "domain", "name": "mandate.graph" }, "provenance": { "provenance": { "system": "mandate", "specification_version": "v1", "source_digest": "2f11d2daffc2d75bb4ca8c0485aedc56fb2a712cdaed6347fc48b8ba2b1f7ca6", "contract_digest": "slice-sha256/2:6bf4b0d22c19d7ef08826bd3fbe010083c8c3ee4cb3003c0894f6f34a6a6144f" }, "slice": { "of": "constructs", "seeds": [ { "kind": "domain", "name": "mandate.graph" }, { "kind": "type", "name": "mandate.graph.Grant.State" }, { "kind": "type", "name": "mandate.graph.Relation.State" }, { "kind": "type", "name": "mandate.graph.Resource.State" }, { "kind": "entity", "name": "mandate.graph.Grant" }, { "kind": "entity", "name": "mandate.graph.Relation" }, { "kind": "entity", "name": "mandate.graph.Resource" }, { "kind": "command", "name": "mandate.graph.DeregisterResource" }, { "kind": "command", "name": "mandate.graph.RegisterResource" }, { "kind": "command", "name": "mandate.graph.RemoveRelation" }, { "kind": "command", "name": "mandate.graph.RevokeGrant" }, { "kind": "command", "name": "mandate.graph.WriteRelationship" }, { "kind": "event", "name": "mandate.graph.GrantRevoked" }, { "kind": "event", "name": "mandate.graph.RelationRemoved" }, { "kind": "event", "name": "mandate.graph.RelationshipWritten" }, { "kind": "event", "name": "mandate.graph.ResourceDeregistered" }, { "kind": "event", "name": "mandate.graph.ResourceRegistered" }, { "kind": "error", "name": "mandate.graph.Denied" }, { "kind": "component", "name": "mandate-authorization" }, { "kind": "component", "name": "mandate-control-plane" }, { "kind": "component", "name": "mandate-sts" }, { "kind": "component", "name": "mandate-worker" } ] } }, "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "Resource topology, tagged principal-or-team relationship subjects and grants. UNMAPPED-SUBJECT-RELATIONS: ESS cannot select a union branch as a relation carrier. Each chosen principal/team branch references exactly one existing target; conditional foreign-key and tenant membership validation remain required before graph runtime admission." } ] }, { "block": "prose", "text": [ { "inline": "code", "text": "mandate.graph" }, { "inline": "text", "text": " is one of mandate's bounded contexts. " }, { "inline": "link", "to": { "target": "page", "page": "index" }, "text": [ { "inline": "text", "text": "Back to the index" } ] }, { "inline": "text", "text": "." } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Entities" } ], "anchor": "entities", "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "An entity is what this context is about: something with an identity that outlives any one request, a shape, and a lifecycle. The lifecycle is exhaustive — a move that is not drawn below is a move this specification does not permit, and that is the only way it says so. Every move is labelled with the command that takes it, because a move nothing can trigger is refused rather than drawn." } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Grant" } ], "anchor": "grant", "about": { "kind": "entity", "name": "mandate.graph.Grant" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.graph.Grant" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.GrantId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "subject" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthoritySubject" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "scope" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorityScope" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "role" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Grant.organization_id" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.graph.Grant.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Active\n Active --> Revoked: revoke (RevokeGrant)\n Revoked --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "revoke" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.graph.RevokeGrant" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command here creates one, so an instance arrives from outside this specification." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Active" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Relation" } ], "anchor": "relation", "about": { "kind": "entity", "name": "mandate.graph.Relation" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.graph.Relation" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.RelationId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "subject" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthoritySubject" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "relation" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "resource_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Relation.organization_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-graph", "anchor": "resource" }, "text": [ { "inline": "code", "text": "Resource" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "resource_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Relation.resource_id" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.graph.Relation.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Active\n Active --> Removed: remove (RemoveRelation)\n Removed --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "remove" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.graph.RemoveRelation" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is brought into existence by " }, { "inline": "code", "text": "mandate.graph.WriteRelationship" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Removed" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Active" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Resource" } ], "anchor": "resource", "about": { "kind": "entity", "name": "mandate.graph.Resource" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.graph.Resource" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.ResourceId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "resource_type" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceType" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "parent" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "space_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Resource.organization_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-graph", "anchor": "resource" }, "text": [ { "inline": "code", "text": "Resource" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "parent_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Resource.parent" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "space" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Space" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "space_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Resource.space_id" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.graph.Resource.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Deregistered" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Deregistered" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Recorded\n Recorded --> Deregistered: deregister (DeregisterResource)\n Deregistered --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "deregister" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.graph.DeregisterResource" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is brought into existence by " }, { "inline": "code", "text": "mandate.graph.RegisterResource" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Deregistered" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Recorded" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Commands" } ], "anchor": "commands", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DeregisterResource" } ], "anchor": "deregisterresource", "about": { "kind": "command", "name": "mandate.graph.DeregisterResource" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.graph.DeregisterResource" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The security record of a deleted resource is kept and stops resolving. Relationship cleanup is the durable outbox job's, and each removal is its own recorded move; no child resource, relation or grant is destroyed as a side effect of this one. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.graph.Resource" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Deregistered" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "deregister" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.graph.ResourceDeregistered" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.graph.Resource" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Deregistered" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.graph.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks resource registration/ownership authority, the resource is outside the verified organization, a child resource still resolves through it, or the durable relationship cleanup this deregistration requires cannot be enqueued.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.graph.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RegisterResource" } ], "anchor": "registerresource", "about": { "kind": "command", "name": "mandate.graph.RegisterResource" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.graph.RegisterResource" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "resource" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceRef" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "parent" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It creates a " }, { "inline": "code", "text": "mandate.graph.Resource" }, { "inline": "text", "text": ", which starts in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The new instance's identity is published as " }, { "inline": "code", "text": "resource_id" }, { "inline": "text", "text": " on " }, { "inline": "code", "text": "mandate.graph.ResourceRegistered" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.graph.ResourceRegistered" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks resource registration/ownership authority, parent is unresolved or belongs to another organization, or hierarchy admission fails.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.graph.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RemoveRelation" } ], "anchor": "removerelation", "about": { "kind": "command", "name": "mandate.graph.RemoveRelation" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.graph.RemoveRelation" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.RelationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.graph.Relation" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "remove" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.graph.RelationRemoved" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.graph.Relation" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.graph.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks relationship-write authority, relation/resource is outside the verified organization, or required graph revocation visibility cannot be satisfied.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.graph.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RevokeGrant" } ], "anchor": "revokegrant", "about": { "kind": "command", "name": "mandate.graph.RevokeGrant" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.graph.RevokeGrant" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.GrantId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.graph.Grant" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "revoke" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.graph.GrantRevoked" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.graph.Grant" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.graph.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks grant-revocation authority, grant is outside the verified organization, or required graph revocation visibility cannot be satisfied.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.graph.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "WriteRelationship" } ], "anchor": "writerelationship", "about": { "kind": "command", "name": "mandate.graph.WriteRelationship" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.graph.WriteRelationship" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "subject" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthoritySubject" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "resource" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceRef" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "relation" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It creates a " }, { "inline": "code", "text": "mandate.graph.Relation" }, { "inline": "text", "text": ", which starts in " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The new instance's identity is published as " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": " on " }, { "inline": "code", "text": "mandate.graph.RelationshipWritten" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.graph.RelationshipWritten" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks relationship-write authority, the chosen principal/team subject is unresolved or outside tenant membership, resource tenancy mismatches, or the relationship is not admitted by the authorization model.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.graph.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Events" } ], "anchor": "events", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "GrantRevoked" } ], "anchor": "grantrevoked", "about": { "kind": "event", "name": "mandate.graph.GrantRevoked" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.graph.GrantRevoked" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.GrantId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.graph.RevokeGrant" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RelationRemoved" } ], "anchor": "relationremoved", "about": { "kind": "event", "name": "mandate.graph.RelationRemoved" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.graph.RelationRemoved" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.RelationId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.graph.RemoveRelation" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RelationshipWritten" } ], "anchor": "relationshipwritten", "about": { "kind": "event", "name": "mandate.graph.RelationshipWritten" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.graph.RelationshipWritten" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.RelationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "subject" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthoritySubject" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "relation" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "resource" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceRef" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.graph.WriteRelationship" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ResourceDeregistered" } ], "anchor": "resourcederegistered", "about": { "kind": "event", "name": "mandate.graph.ResourceDeregistered" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.graph.ResourceDeregistered" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.graph.DeregisterResource" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "ResourceRegistered" } ], "anchor": "resourceregistered", "about": { "kind": "event", "name": "mandate.graph.ResourceRegistered" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.graph.ResourceRegistered" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "resource_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "resource" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ResourceRef" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "parent" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.graph.RegisterResource" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Errors" } ], "anchor": "errors", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Denied" } ], "anchor": "denied", "about": { "kind": "error", "name": "mandate.graph.Denied" }, "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "Fail closed; no credential, authority or lifecycle mutation on refusal." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "reason" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DenialReason" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.graph.DeregisterResource" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.graph.RegisterResource" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.graph.RemoveRelation" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.graph.RevokeGrant" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.graph.WriteRelationship" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] } ] } ] }, { "block": "list", "ordered": false, "items": [] } ] }, { "id": "domains/mandate-identity", "title": [ { "inline": "text", "text": "identity" } ], "about": { "kind": "domain", "name": "mandate.identity" }, "provenance": { "provenance": { "system": "mandate", "specification_version": "v1", "source_digest": "2f11d2daffc2d75bb4ca8c0485aedc56fb2a712cdaed6347fc48b8ba2b1f7ca6", "contract_digest": "slice-sha256/2:89845c0e0963fd70f09ee7fec78a7a43ced0650a5b71f849901b42ff676f8d43" }, "slice": { "of": "constructs", "seeds": [ { "kind": "domain", "name": "mandate.identity" }, { "kind": "type", "name": "mandate.identity.FederationSecurityEpoch.State" }, { "kind": "type", "name": "mandate.identity.OrganizationSecurityEpoch.State" }, { "kind": "type", "name": "mandate.identity.Principal.State" }, { "kind": "type", "name": "mandate.identity.PrincipalSecurityEpoch.State" }, { "kind": "type", "name": "mandate.identity.RefreshCredential.State" }, { "kind": "type", "name": "mandate.identity.SecurityEpochSnapshot.State" }, { "kind": "type", "name": "mandate.identity.Session.State" }, { "kind": "entity", "name": "mandate.identity.FederationSecurityEpoch" }, { "kind": "entity", "name": "mandate.identity.OrganizationSecurityEpoch" }, { "kind": "entity", "name": "mandate.identity.Principal" }, { "kind": "entity", "name": "mandate.identity.PrincipalSecurityEpoch" }, { "kind": "entity", "name": "mandate.identity.RefreshCredential" }, { "kind": "entity", "name": "mandate.identity.SecurityEpochSnapshot" }, { "kind": "entity", "name": "mandate.identity.Session" }, { "kind": "command", "name": "mandate.identity.DisablePrincipal" }, { "kind": "command", "name": "mandate.identity.IncrementSecurityEpoch" }, { "kind": "command", "name": "mandate.identity.RefreshSession" }, { "kind": "command", "name": "mandate.identity.RevokeRefreshCredential" }, { "kind": "command", "name": "mandate.identity.RevokeSession" }, { "kind": "event", "name": "mandate.identity.EpochSnapshotRecorded" }, { "kind": "event", "name": "mandate.identity.PrincipalDisabled" }, { "kind": "event", "name": "mandate.identity.RefreshCredentialRevoked" }, { "kind": "event", "name": "mandate.identity.SecurityEpochIncremented" }, { "kind": "event", "name": "mandate.identity.SecurityEpochRecorded" }, { "kind": "event", "name": "mandate.identity.SessionOpened" }, { "kind": "event", "name": "mandate.identity.SessionRefreshed" }, { "kind": "event", "name": "mandate.identity.SessionRevoked" }, { "kind": "error", "name": "mandate.identity.Denied" }, { "kind": "component", "name": "mandate-authorization" }, { "kind": "component", "name": "mandate-control-plane" }, { "kind": "component", "name": "mandate-sts" }, { "kind": "component", "name": "mandate-worker" } ] } }, "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "Principal, session and independent principal/organization/federation generation ownership. UNMAPPED-EPOCH: each generation record declares one non-negative Integer generation, the recorded stand-in for the addendum's u64; monotonic increment, denial at the maximum and per-dimension snapshot values are absent until supported. EpochSnapshotRef is an immutable record handle, not a generation number. Refresh and exchange cannot be implemented without closing this blocker." } ] }, { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity" }, { "inline": "text", "text": " is one of mandate's bounded contexts. " }, { "inline": "link", "to": { "target": "page", "page": "index" }, "text": [ { "inline": "text", "text": "Back to the index" } ] }, { "inline": "text", "text": "." } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Entities" } ], "anchor": "entities", "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "An entity is what this context is about: something with an identity that outlives any one request, a shape, and a lifecycle. The lifecycle is exhaustive — a move that is not drawn below is a move this specification does not permit, and that is the only way it says so. Every move is labelled with the command that takes it, because a move nothing can trigger is refused rather than drawn." } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "FederationSecurityEpoch" } ], "anchor": "federationsecurityepoch", "about": { "kind": "entity", "name": "mandate.identity.FederationSecurityEpoch" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.FederationSecurityEpoch" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.FederationConnectionId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "generation" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Integer" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It declares no relation to another entity, and no other entity names it." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Every instance satisfies " }, { "inline": "code", "text": "generation >= 0" }, { "inline": "text", "text": " — a predicate over this entity's own fields, checked against them rather than stored as a sentence, so an invariant reading something the entity does not have is refused instead of documented." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.identity.FederationSecurityEpoch.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Recorded\n Recorded --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "It declares no moves, so nothing changes its state once it exists." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has one state, so there is no move to permit or to forbid." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "OrganizationSecurityEpoch" } ], "anchor": "organizationsecurityepoch", "about": { "kind": "entity", "name": "mandate.identity.OrganizationSecurityEpoch" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.OrganizationSecurityEpoch" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.OrganizationId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "generation" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Integer" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It declares no relation to another entity, and no other entity names it." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Every instance satisfies " }, { "inline": "code", "text": "generation >= 0" }, { "inline": "text", "text": " — a predicate over this entity's own fields, checked against them rather than stored as a sentence, so an invariant reading something the entity does not have is refused instead of documented." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.identity.OrganizationSecurityEpoch.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Recorded\n Recorded --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "It declares no moves, so nothing changes its state once it exists." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has one state, so there is no move to permit or to forbid." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Principal" } ], "anchor": "principal", "about": { "kind": "entity", "name": "mandate.identity.Principal" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.Principal" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.PrincipalId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "kind" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalKind" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "display_name" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It declares no relation to another entity, and no other entity names it." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.identity.Principal.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Disabled" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Disabled" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Active\n Active --> Disabled: disable (DisablePrincipal)\n Disabled --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "disable" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.identity.DisablePrincipal" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command here creates one, so an instance arrives from outside this specification." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Disabled" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Active" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "PrincipalSecurityEpoch" } ], "anchor": "principalsecurityepoch", "about": { "kind": "entity", "name": "mandate.identity.PrincipalSecurityEpoch" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.PrincipalSecurityEpoch" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.PrincipalId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "generation" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Integer" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It declares no relation to another entity, and no other entity names it." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Every instance satisfies " }, { "inline": "code", "text": "generation >= 0" }, { "inline": "text", "text": " — a predicate over this entity's own fields, checked against them rather than stored as a sentence, so an invariant reading something the entity does not have is refused instead of documented." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.identity.PrincipalSecurityEpoch.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Recorded\n Recorded --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "It declares no moves, so nothing changes its state once it exists." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has one state, so there is no move to permit or to forbid." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RefreshCredential" } ], "anchor": "refreshcredential", "about": { "kind": "entity", "name": "mandate.identity.RefreshCredential" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.RefreshCredential" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.RefreshCredentialId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "principal_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "session_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SessionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "verifier" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialVerifier" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "epochs" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.EpochSnapshotRef" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "expires_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "principal" }, "text": [ { "inline": "code", "text": "Principal" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "principal_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "RefreshCredential.principal_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "RefreshCredential.organization_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "session" }, "text": [ { "inline": "code", "text": "Session" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "session_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "RefreshCredential.session_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "securityepochsnapshot" }, "text": [ { "inline": "code", "text": "SecurityEpochSnapshot" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "epoch_snapshot_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "RefreshCredential.epochs" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.identity.RefreshCredential.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Active\n Active --> Revoked: revoke (RevokeRefreshCredential)\n Revoked --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "revoke" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.identity.RevokeRefreshCredential" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command here creates one, so an instance arrives from outside this specification." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Active" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SecurityEpochSnapshot" } ], "anchor": "securityepochsnapshot", "about": { "kind": "entity", "name": "mandate.identity.SecurityEpochSnapshot" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.SecurityEpochSnapshot" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.EpochSnapshotRef" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "principal_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "connection_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "principal" }, "text": [ { "inline": "code", "text": "Principal" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "principal_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "SecurityEpochSnapshot.principal_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "SecurityEpochSnapshot.organization_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-federation", "anchor": "federationconnection" }, "text": [ { "inline": "code", "text": "mandate.federation.FederationConnection" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "connection_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "SecurityEpochSnapshot.connection_id" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.identity.SecurityEpochSnapshot.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Recorded\n Recorded --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "It declares no moves, so nothing changes its state once it exists." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has one state, so there is no move to permit or to forbid." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Session" } ], "anchor": "session", "about": { "kind": "entity", "name": "mandate.identity.Session" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.Session" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.SessionId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "principal_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "connection_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "epochs" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.EpochSnapshotRef" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "expires_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "principal" }, "text": [ { "inline": "code", "text": "Principal" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "principal_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Session.principal_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Session.organization_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-federation", "anchor": "federationconnection" }, "text": [ { "inline": "code", "text": "mandate.federation.FederationConnection" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "connection_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Session.connection_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "securityepochsnapshot" }, "text": [ { "inline": "code", "text": "SecurityEpochSnapshot" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "epoch_snapshot_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Session.epochs" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.identity.Session.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Active\n Active --> Revoked: revoke (RevokeSession)\n Revoked --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "revoke" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.identity.RevokeSession" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is brought into existence by " }, { "inline": "code", "text": "mandate.federation.AuthenticateFederation" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Active" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Commands" } ], "anchor": "commands", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "DisablePrincipal" } ], "anchor": "disableprincipal", "about": { "kind": "command", "name": "mandate.identity.DisablePrincipal" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.DisablePrincipal" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.identity.Principal" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Disabled" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "disable" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.identity.PrincipalDisabled" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.identity.Principal" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Disabled" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.identity.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks principal-administration authority, principal does not exist, or disablement cannot atomically trigger the required session/credential invalidation.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.identity.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "IncrementSecurityEpoch" } ], "anchor": "incrementsecurityepoch", "about": { "kind": "command", "name": "mandate.identity.IncrementSecurityEpoch" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.IncrementSecurityEpoch" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "target" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SecurityEpochTarget" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "UNMAPPED-EPOCH: this event declares the required increment outcome; no numeric mutation is executed or approximated. The adapter must atomically increment the one selected generation, deny unsigned overflow and preserve isolation of unrelated organizations/connections. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.identity.SecurityEpochIncremented" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks authority for the explicitly selected principal/organization/federation target, tenant containment fails, the exact unsigned generation is at its maximum, or atomic increment cannot commit.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.identity.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RefreshSession" } ], "anchor": "refreshsession", "about": { "kind": "command", "name": "mandate.identity.RefreshSession" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.RefreshSession" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "refresh_proof" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.CredentialProof" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.identity.SessionRefreshed" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Refresh verifier is absent/incorrect, record is expired/revoked, principal/session is disabled, any applicable principal/organization/federation epoch mismatches, or session binding fails.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.identity.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RevokeRefreshCredential" } ], "anchor": "revokerefreshcredential", "about": { "kind": "command", "name": "mandate.identity.RevokeRefreshCredential" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.RevokeRefreshCredential" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.RefreshCredentialId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.identity.RefreshCredential" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "revoke" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.identity.RefreshCredentialRevoked" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.identity.RefreshCredential" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.identity.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks authority over the resolved refresh credential, tenant/session binding mismatches, or durable revocation fails.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.identity.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RevokeSession" } ], "anchor": "revokesession", "about": { "kind": "command", "name": "mandate.identity.RevokeSession" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.RevokeSession" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SessionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.identity.Session" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "revoke" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.identity.SessionRevoked" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.identity.Session" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.identity.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks authority over this session, session is outside the verified organization, or revocation cannot be durably observed under the applicable profile.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.identity.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Events" } ], "anchor": "events", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "EpochSnapshotRecorded" } ], "anchor": "epochsnapshotrecorded", "about": { "kind": "event", "name": "mandate.identity.EpochSnapshotRecorded" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.EpochSnapshotRecorded" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.EpochSnapshotRef" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "principal_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "connection_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command in this system emits it, so something outside the specification does." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "PrincipalDisabled" } ], "anchor": "principaldisabled", "about": { "kind": "event", "name": "mandate.identity.PrincipalDisabled" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.PrincipalDisabled" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.identity.DisablePrincipal" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RefreshCredentialRevoked" } ], "anchor": "refreshcredentialrevoked", "about": { "kind": "event", "name": "mandate.identity.RefreshCredentialRevoked" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.RefreshCredentialRevoked" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.RefreshCredentialId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.identity.RevokeRefreshCredential" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SecurityEpochIncremented" } ], "anchor": "securityepochincremented", "about": { "kind": "event", "name": "mandate.identity.SecurityEpochIncremented" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.SecurityEpochIncremented" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "target" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SecurityEpochTarget" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.identity.IncrementSecurityEpoch" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SecurityEpochRecorded" } ], "anchor": "securityepochrecorded", "about": { "kind": "event", "name": "mandate.identity.SecurityEpochRecorded" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.SecurityEpochRecorded" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "target" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SecurityEpochTarget" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "generation" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Integer" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command in this system emits it, so something outside the specification does." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SessionOpened" } ], "anchor": "sessionopened", "about": { "kind": "event", "name": "mandate.identity.SessionOpened" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.SessionOpened" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SessionId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "principal_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "connection_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Optional" }, { "inline": "text", "text": ", which may be absent" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "epochs" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.EpochSnapshotRef" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "expires_at" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "Timestamp" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command in this system emits it, so something outside the specification does." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SessionRefreshed" } ], "anchor": "sessionrefreshed", "about": { "kind": "event", "name": "mandate.identity.SessionRefreshed" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.SessionRefreshed" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "session_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SessionId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.identity.RefreshSession" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SessionRevoked" } ], "anchor": "sessionrevoked", "about": { "kind": "event", "name": "mandate.identity.SessionRevoked" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.SessionRevoked" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SessionId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.identity.RevokeSession" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Errors" } ], "anchor": "errors", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Denied" } ], "anchor": "denied", "about": { "kind": "error", "name": "mandate.identity.Denied" }, "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "Fail closed; no credential, authority or lifecycle mutation on refusal." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "reason" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DenialReason" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.identity.DisablePrincipal" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.identity.IncrementSecurityEpoch" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.identity.RefreshSession" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.identity.RevokeRefreshCredential" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.identity.RevokeSession" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] } ] } ] }, { "block": "list", "ordered": false, "items": [] } ] }, { "id": "domains/mandate-policy", "title": [ { "inline": "text", "text": "policy" } ], "about": { "kind": "domain", "name": "mandate.policy" }, "provenance": { "provenance": { "system": "mandate", "specification_version": "v1", "source_digest": "2f11d2daffc2d75bb4ca8c0485aedc56fb2a712cdaed6347fc48b8ba2b1f7ca6", "contract_digest": "slice-sha256/2:6bf4b0d22c19d7ef08826bd3fbe010083c8c3ee4cb3003c0894f6f34a6a6144f" }, "slice": { "of": "constructs", "seeds": [ { "kind": "domain", "name": "mandate.policy" }, { "kind": "type", "name": "mandate.policy.AuthorizationModel.State" }, { "kind": "type", "name": "mandate.policy.Policy.State" }, { "kind": "entity", "name": "mandate.policy.AuthorizationModel" }, { "kind": "entity", "name": "mandate.policy.Policy" }, { "kind": "command", "name": "mandate.policy.SupersedeAuthorizationModel" }, { "kind": "command", "name": "mandate.policy.SupersedePolicy" }, { "kind": "event", "name": "mandate.policy.AuthorizationModelSuperseded" }, { "kind": "event", "name": "mandate.policy.PolicySuperseded" }, { "kind": "error", "name": "mandate.policy.Denied" }, { "kind": "component", "name": "mandate-authorization" }, { "kind": "component", "name": "mandate-control-plane" }, { "kind": "component", "name": "mandate-sts" }, { "kind": "component", "name": "mandate-worker" } ] } }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.policy" }, { "inline": "text", "text": " is one of mandate's bounded contexts. " }, { "inline": "link", "to": { "target": "page", "page": "index" }, "text": [ { "inline": "text", "text": "Back to the index" } ] }, { "inline": "text", "text": "." } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Entities" } ], "anchor": "entities", "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "An entity is what this context is about: something with an identity that outlives any one request, a shape, and a lifecycle. The lifecycle is exhaustive — a move that is not drawn below is a move this specification does not permit, and that is the only way it says so. Every move is labelled with the command that takes it, because a move nothing can trigger is refused rather than drawn." } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AuthorizationModel" } ], "anchor": "authorizationmodel", "about": { "kind": "entity", "name": "mandate.policy.AuthorizationModel" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.policy.AuthorizationModel" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.AuthorizationModelId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "version" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PolicyVersion" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "schema" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "AuthorizationModel.organization_id" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.policy.AuthorizationModel.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Superseded" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Superseded" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Recorded\n Recorded --> Superseded: supersede (SupersedeAuthorizationModel)\n Superseded --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "supersede" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.policy.SupersedeAuthorizationModel" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command here creates one, so an instance arrives from outside this specification." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Superseded" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Recorded" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Policy" } ], "anchor": "policy", "about": { "kind": "entity", "name": "mandate.policy.Policy" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.policy.Policy" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.PolicyId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "version" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PolicyVersion" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "source" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Policy.organization_id" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.policy.Policy.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Superseded" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Superseded" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Recorded\n Recorded --> Superseded: supersede (SupersedePolicy)\n Superseded --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "supersede" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.policy.SupersedePolicy" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command here creates one, so an instance arrives from outside this specification." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Superseded" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Recorded" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Commands" } ], "anchor": "commands", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SupersedeAuthorizationModel" } ], "anchor": "supersedeauthorizationmodel", "about": { "kind": "command", "name": "mandate.policy.SupersedeAuthorizationModel" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.policy.SupersedeAuthorizationModel" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorizationModelId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The recorded schema version stops being the current one and is kept for attribution. A breaking change is a new model version with its own migration; no superseded model is reactivated and none is deleted. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.policy.AuthorizationModel" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Superseded" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "supersede" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.policy.AuthorizationModelSuperseded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.policy.AuthorizationModel" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Superseded" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.policy.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks authorization-model administration authority, the model is outside the verified organization, no later model version is recorded for that organization, or the relationship revision the later version requires is not yet observable.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.policy.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SupersedePolicy" } ], "anchor": "supersedepolicy", "about": { "kind": "command", "name": "mandate.policy.SupersedePolicy" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.policy.SupersedePolicy" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PolicyId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The recorded version stops being the current one. Its source is kept, because every decision already made under it stays attributable to it; a rollback is a new version record carrying the earlier source, never a revival of this one. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.policy.Policy" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Superseded" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "supersede" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.policy.PolicySuperseded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.policy.Policy" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Superseded" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.policy.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks policy-administration authority, the policy is outside the verified organization, no later policy version is recorded for that organization, or decisions in flight cannot remain attributable to the version that made them.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.policy.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Events" } ], "anchor": "events", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AuthorizationModelSuperseded" } ], "anchor": "authorizationmodelsuperseded", "about": { "kind": "event", "name": "mandate.policy.AuthorizationModelSuperseded" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.policy.AuthorizationModelSuperseded" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.AuthorizationModelId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.policy.SupersedeAuthorizationModel" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "PolicySuperseded" } ], "anchor": "policysuperseded", "about": { "kind": "event", "name": "mandate.policy.PolicySuperseded" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.policy.PolicySuperseded" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PolicyId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.policy.SupersedePolicy" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Errors" } ], "anchor": "errors", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Denied" } ], "anchor": "denied", "about": { "kind": "error", "name": "mandate.policy.Denied" }, "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "Fail closed; no credential, authority or lifecycle mutation on refusal." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "reason" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DenialReason" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.policy.SupersedeAuthorizationModel" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.policy.SupersedePolicy" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] } ] } ] }, { "block": "list", "ordered": false, "items": [] } ] }, { "id": "domains/mandate-tenancy", "title": [ { "inline": "text", "text": "tenancy" } ], "about": { "kind": "domain", "name": "mandate.tenancy" }, "provenance": { "provenance": { "system": "mandate", "specification_version": "v1", "source_digest": "2f11d2daffc2d75bb4ca8c0485aedc56fb2a712cdaed6347fc48b8ba2b1f7ca6", "contract_digest": "slice-sha256/2:6bf4b0d22c19d7ef08826bd3fbe010083c8c3ee4cb3003c0894f6f34a6a6144f" }, "slice": { "of": "constructs", "seeds": [ { "kind": "domain", "name": "mandate.tenancy" }, { "kind": "type", "name": "mandate.tenancy.Organization.State" }, { "kind": "type", "name": "mandate.tenancy.OrganizationMembership.State" }, { "kind": "type", "name": "mandate.tenancy.Space.State" }, { "kind": "type", "name": "mandate.tenancy.Team.State" }, { "kind": "type", "name": "mandate.tenancy.TeamMembership.State" }, { "kind": "entity", "name": "mandate.tenancy.Organization" }, { "kind": "entity", "name": "mandate.tenancy.OrganizationMembership" }, { "kind": "entity", "name": "mandate.tenancy.Space" }, { "kind": "entity", "name": "mandate.tenancy.Team" }, { "kind": "entity", "name": "mandate.tenancy.TeamMembership" }, { "kind": "command", "name": "mandate.tenancy.AddOrganizationMembership" }, { "kind": "command", "name": "mandate.tenancy.AddTeamMembership" }, { "kind": "command", "name": "mandate.tenancy.CloseOrganization" }, { "kind": "command", "name": "mandate.tenancy.CreateOrganization" }, { "kind": "command", "name": "mandate.tenancy.CreateSpace" }, { "kind": "command", "name": "mandate.tenancy.CreateTeam" }, { "kind": "command", "name": "mandate.tenancy.RemoveOrganizationMembership" }, { "kind": "command", "name": "mandate.tenancy.RemoveTeamMembership" }, { "kind": "command", "name": "mandate.tenancy.RetireSpace" }, { "kind": "command", "name": "mandate.tenancy.RetireTeam" }, { "kind": "event", "name": "mandate.tenancy.OrganizationClosed" }, { "kind": "event", "name": "mandate.tenancy.OrganizationCreated" }, { "kind": "event", "name": "mandate.tenancy.OrganizationMembershipAdded" }, { "kind": "event", "name": "mandate.tenancy.OrganizationMembershipRemoved" }, { "kind": "event", "name": "mandate.tenancy.SpaceCreated" }, { "kind": "event", "name": "mandate.tenancy.SpaceRetired" }, { "kind": "event", "name": "mandate.tenancy.TeamCreated" }, { "kind": "event", "name": "mandate.tenancy.TeamMembershipAdded" }, { "kind": "event", "name": "mandate.tenancy.TeamMembershipRemoved" }, { "kind": "event", "name": "mandate.tenancy.TeamRetired" }, { "kind": "error", "name": "mandate.tenancy.Denied" }, { "kind": "component", "name": "mandate-authorization" }, { "kind": "component", "name": "mandate-control-plane" }, { "kind": "component", "name": "mandate-sts" }, { "kind": "component", "name": "mandate-worker" } ] } }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy" }, { "inline": "text", "text": " is one of mandate's bounded contexts. " }, { "inline": "link", "to": { "target": "page", "page": "index" }, "text": [ { "inline": "text", "text": "Back to the index" } ] }, { "inline": "text", "text": "." } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Entities" } ], "anchor": "entities", "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "An entity is what this context is about: something with an identity that outlives any one request, a shape, and a lifecycle. The lifecycle is exhaustive — a move that is not drawn below is a move this specification does not permit, and that is the only way it says so. Every move is labelled with the command that takes it, because a move nothing can trigger is refused rather than drawn." } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Organization" } ], "anchor": "organization", "about": { "kind": "entity", "name": "mandate.tenancy.Organization" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.OrganizationId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "display_name" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It declares no relation to another entity, and no other entity names it." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.tenancy.Organization.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Closed" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Closed" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Recorded\n Recorded --> Closed: close (CloseOrganization)\n Closed --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "close" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.tenancy.CloseOrganization" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is brought into existence by " }, { "inline": "code", "text": "mandate.tenancy.CreateOrganization" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Closed" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Recorded" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "OrganizationMembership" } ], "anchor": "organizationmembership", "about": { "kind": "entity", "name": "mandate.tenancy.OrganizationMembership" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.OrganizationMembership" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.OrganizationMembershipId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "principal_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "OrganizationMembership.organization_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "principal" }, "text": [ { "inline": "code", "text": "mandate.identity.Principal" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "principal_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "OrganizationMembership.principal_id" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.tenancy.OrganizationMembership.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Active\n Active --> Removed: remove (RemoveOrganizationMembership)\n Removed --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "remove" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.tenancy.RemoveOrganizationMembership" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is brought into existence by " }, { "inline": "code", "text": "mandate.tenancy.AddOrganizationMembership" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Removed" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Active" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Space" } ], "anchor": "space", "about": { "kind": "entity", "name": "mandate.tenancy.Space" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.Space" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.SpaceId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "display_name" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Space.organization_id" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.tenancy.Space.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Retired" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Retired" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Recorded\n Recorded --> Retired: retire (RetireSpace)\n Retired --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "retire" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.tenancy.RetireSpace" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is brought into existence by " }, { "inline": "code", "text": "mandate.tenancy.CreateSpace" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Retired" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Recorded" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Team" } ], "anchor": "team", "about": { "kind": "entity", "name": "mandate.tenancy.Team" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.Team" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.TeamId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "display_name" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "Team.organization_id" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.tenancy.Team.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Retired" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Retired" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Recorded\n Recorded --> Retired: retire (RetireTeam)\n Retired --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "retire" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.tenancy.RetireTeam" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is brought into existence by " }, { "inline": "code", "text": "mandate.tenancy.CreateTeam" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Retired" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Recorded" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "TeamMembership" } ], "anchor": "teammembership", "about": { "kind": "entity", "name": "mandate.tenancy.TeamMembership" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.TeamMembership" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.TeamMembershipId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "team_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.TeamId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "principal_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "TeamMembership.organization_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "team" }, "text": [ { "inline": "code", "text": "Team" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "team_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "TeamMembership.team_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "principal" }, "text": [ { "inline": "code", "text": "mandate.identity.Principal" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "principal_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "TeamMembership.principal_id" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.tenancy.TeamMembership.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Recorded\n Recorded --> Removed: remove (RemoveTeamMembership)\n Removed --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "remove" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.tenancy.RemoveTeamMembership" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is brought into existence by " }, { "inline": "code", "text": "mandate.tenancy.AddTeamMembership" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Removed" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Recorded" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Commands" } ], "anchor": "commands", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AddOrganizationMembership" } ], "anchor": "addorganizationmembership", "about": { "kind": "command", "name": "mandate.tenancy.AddOrganizationMembership" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.AddOrganizationMembership" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "principal_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The one membership path, and the only command that names an organization other than the caller's. organization_id must equal the organization in the caller's verified context; it may differ only for a caller holding platform organization-administration authority, which is how the organization CreateOrganization returns is first populated and how it acquires the administrator whose own context every later write inside it resolves from. A directory provisioning source calls this command as an admitted caller; membership carries no authority by itself, which stays with grants and relationships. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It creates a " }, { "inline": "code", "text": "mandate.tenancy.OrganizationMembership" }, { "inline": "text", "text": ", which starts in " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The new instance's identity is published as " }, { "inline": "code", "text": "membership_id" }, { "inline": "text", "text": " on " }, { "inline": "code", "text": "mandate.tenancy.OrganizationMembershipAdded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.tenancy.OrganizationMembershipAdded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks membership-administration authority, organization_id differs from the verified organization and the caller lacks platform organization-administration authority, the named organization is closed, the principal is unresolved or disabled, the principal is already a member of that organization, or membership and its dependent authorization cannot commit consistently.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.tenancy.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "AddTeamMembership" } ], "anchor": "addteammembership", "about": { "kind": "command", "name": "mandate.tenancy.AddTeamMembership" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.AddTeamMembership" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "team_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.TeamId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "principal_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The manual path, and the only command that records a team membership. It records one membership and the one manual MembershipContribution that says where the membership came from, and returns both identities. A mapping-derived contribution against the same membership is mandate.directory's own record, written by that domain's commands when a group mapping is created or synchronized, so a retracted mapping never removes a membership a manual decision still holds up. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It creates a " }, { "inline": "code", "text": "mandate.tenancy.TeamMembership" }, { "inline": "text", "text": ", which starts in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The new instance's identity is published as " }, { "inline": "code", "text": "team_membership_id" }, { "inline": "text", "text": " on " }, { "inline": "code", "text": "mandate.tenancy.TeamMembershipAdded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.tenancy.TeamMembershipAdded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks team-administration authority, team or principal is unresolved or outside the verified organization, the team is retired, the principal is disabled, the principal is not a member of that organization, the principal is already a member of that team, or the membership and the manual contribution recording its provenance cannot be recorded together.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.tenancy.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "CloseOrganization" } ], "anchor": "closeorganization", "about": { "kind": "command", "name": "mandate.tenancy.CloseOrganization" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.CloseOrganization" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The tenant stops admitting authority and nothing it owns is destroyed. Memberships, grants, delegations and audit history are preserved; sessions and credentials inside it stop being eligible through the organization generation, which IncrementSecurityEpoch advances. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.tenancy.Organization" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Closed" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "close" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.tenancy.OrganizationClosed" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.tenancy.Organization" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Closed" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.tenancy.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks platform organization-administration authority, the organization is unresolved, the sessions, credentials and delegations inside it cannot be invalidated with the closure, or closure would require destroying membership or audit history.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.tenancy.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "CreateOrganization" } ], "anchor": "createorganization", "about": { "kind": "command", "name": "mandate.tenancy.CreateOrganization" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.CreateOrganization" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "display_name" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The isolation root every other tenant-owned record resolves to. It is created empty, and no membership, team, space or grant exists inside it until that record's own command writes one. AddOrganizationMembership is the one command that can name this organization rather than the caller's own, so the first membership inside it is written by a caller holding platform organization-administration authority; every later write resolves the organization from that member's verified context. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It creates a " }, { "inline": "code", "text": "mandate.tenancy.Organization" }, { "inline": "text", "text": ", which starts in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The new instance's identity is published as " }, { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " on " }, { "inline": "code", "text": "mandate.tenancy.OrganizationCreated" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.tenancy.OrganizationCreated" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks platform organization-administration authority, the requested display name is not admitted, or the isolation root cannot be created without implying membership, grants or authority inside it.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.tenancy.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "CreateSpace" } ], "anchor": "createspace", "about": { "kind": "command", "name": "mandate.tenancy.CreateSpace" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.CreateSpace" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "display_name" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "A security boundary below the organization, with no environment semantics implied by its name. Creating it grants nothing inside it. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It creates a " }, { "inline": "code", "text": "mandate.tenancy.Space" }, { "inline": "text", "text": ", which starts in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The new instance's identity is published as " }, { "inline": "code", "text": "space_id" }, { "inline": "text", "text": " on " }, { "inline": "code", "text": "mandate.tenancy.SpaceCreated" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.tenancy.SpaceCreated" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks space-administration authority, the display name is not admitted in the verified organization, or the space cannot be created without implying a grant or a resource inside it.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.tenancy.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "CreateTeam" } ], "anchor": "createteam", "about": { "kind": "command", "name": "mandate.tenancy.CreateTeam" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.CreateTeam" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "display_name" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has two outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "A team is created by an organization administrator and never by directory synchronization. A customer directory group populates directory state, and whether that group maps to this team is a separate explicit decision. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It creates a " }, { "inline": "code", "text": "mandate.tenancy.Team" }, { "inline": "text", "text": ", which starts in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The new instance's identity is published as " }, { "inline": "code", "text": "team_id" }, { "inline": "text", "text": " on " }, { "inline": "code", "text": "mandate.tenancy.TeamCreated" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.tenancy.TeamCreated" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks team-administration authority, the display name is not admitted in the verified organization, or the team cannot be created without implying a grant or a directory mapping.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.tenancy.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RemoveOrganizationMembership" } ], "anchor": "removeorganizationmembership", "about": { "kind": "command", "name": "mandate.tenancy.RemoveOrganizationMembership" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.RemoveOrganizationMembership" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationMembershipId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.tenancy.OrganizationMembership" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Active" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "remove" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.tenancy.OrganizationMembershipRemoved" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.tenancy.OrganizationMembership" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.tenancy.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks membership-administration authority, membership is outside the verified organization, or membership and dependent authorization invalidation cannot commit consistently.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.tenancy.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RemoveTeamMembership" } ], "anchor": "removeteammembership", "about": { "kind": "command", "name": "mandate.tenancy.RemoveTeamMembership" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.RemoveTeamMembership" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.TeamMembershipId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken only once no contribution supports the membership any longer — neither the manual one recorded with it nor any mandate.directory mapping contribution — which is what stops a retracted mapping from removing a membership a manual decision still holds up. The record and its history are kept. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.tenancy.TeamMembership" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "remove" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.tenancy.TeamMembershipRemoved" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.tenancy.TeamMembership" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Removed" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.tenancy.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks team-administration authority, the membership is outside the verified organization, a mandate.directory mapping contribution still supports it, or dependent authorization invalidation cannot commit consistently.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.tenancy.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RetireSpace" } ], "anchor": "retirespace", "about": { "kind": "command", "name": "mandate.tenancy.RetireSpace" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.RetireSpace" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SpaceId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The boundary stops admitting new authority and keeps every resource bound to it. Resources inside are deregistered by their own command; nothing is destroyed by retiring the space around them. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.tenancy.Space" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Retired" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "retire" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.tenancy.SpaceRetired" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.tenancy.Space" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Retired" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.tenancy.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks space-administration authority, the space is outside the verified organization, or retirement cannot refuse new authority inside it while preserving the resources and grants already bound to it.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.tenancy.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RetireTeam" } ], "anchor": "retireteam", "about": { "kind": "command", "name": "mandate.tenancy.RetireTeam" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.RetireTeam" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.TeamId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The explicit request a mapping retraction never makes on its own. The team stops resolving as an authorization subject; its memberships and their provenance are preserved, and the grants that target it are revoked by their own command. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.tenancy.Team" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Retired" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "retire" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.tenancy.TeamRetired" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.tenancy.Team" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Retired" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.tenancy.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks team-administration authority, the team is outside the verified organization, a directory mapping still contributes to it, or retirement cannot revoke the grants that target it while preserving membership provenance.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.tenancy.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Events" } ], "anchor": "events", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "OrganizationClosed" } ], "anchor": "organizationclosed", "about": { "kind": "event", "name": "mandate.tenancy.OrganizationClosed" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.OrganizationClosed" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.tenancy.CloseOrganization" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "OrganizationCreated" } ], "anchor": "organizationcreated", "about": { "kind": "event", "name": "mandate.tenancy.OrganizationCreated" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.OrganizationCreated" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "display_name" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.tenancy.CreateOrganization" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "OrganizationMembershipAdded" } ], "anchor": "organizationmembershipadded", "about": { "kind": "event", "name": "mandate.tenancy.OrganizationMembershipAdded" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.OrganizationMembershipAdded" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "principal_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "membership_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationMembershipId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.tenancy.AddOrganizationMembership" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "OrganizationMembershipRemoved" } ], "anchor": "organizationmembershipremoved", "about": { "kind": "event", "name": "mandate.tenancy.OrganizationMembershipRemoved" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.OrganizationMembershipRemoved" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationMembershipId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.tenancy.RemoveOrganizationMembership" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SpaceCreated" } ], "anchor": "spacecreated", "about": { "kind": "event", "name": "mandate.tenancy.SpaceCreated" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.SpaceCreated" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "space_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SpaceId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "display_name" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.tenancy.CreateSpace" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "SpaceRetired" } ], "anchor": "spaceretired", "about": { "kind": "event", "name": "mandate.tenancy.SpaceRetired" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.SpaceRetired" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.SpaceId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.tenancy.RetireSpace" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "TeamCreated" } ], "anchor": "teamcreated", "about": { "kind": "event", "name": "mandate.tenancy.TeamCreated" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.TeamCreated" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "team_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.TeamId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "display_name" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "String" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.tenancy.CreateTeam" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "TeamMembershipAdded" } ], "anchor": "teammembershipadded", "about": { "kind": "event", "name": "mandate.tenancy.TeamMembershipAdded" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.TeamMembershipAdded" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "team_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.TeamId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "principal_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "team_membership_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.TeamMembershipId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "contribution_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.MembershipContributionId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.tenancy.AddTeamMembership" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "TeamMembershipRemoved" } ], "anchor": "teammembershipremoved", "about": { "kind": "event", "name": "mandate.tenancy.TeamMembershipRemoved" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.TeamMembershipRemoved" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.TeamMembershipId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.tenancy.RemoveTeamMembership" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "TeamRetired" } ], "anchor": "teamretired", "about": { "kind": "event", "name": "mandate.tenancy.TeamRetired" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.TeamRetired" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.TeamId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.tenancy.RetireTeam" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Errors" } ], "anchor": "errors", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Denied" } ], "anchor": "denied", "about": { "kind": "error", "name": "mandate.tenancy.Denied" }, "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "Fail closed; no credential, authority or lifecycle mutation on refusal." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "reason" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DenialReason" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.tenancy.AddOrganizationMembership" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.tenancy.AddTeamMembership" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.tenancy.CloseOrganization" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.tenancy.CreateOrganization" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.tenancy.CreateSpace" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.tenancy.CreateTeam" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.tenancy.RemoveOrganizationMembership" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.tenancy.RemoveTeamMembership" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.tenancy.RetireSpace" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.tenancy.RetireTeam" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] } ] } ] }, { "block": "list", "ordered": false, "items": [] } ] }, { "id": "domains/mandate-workload", "title": [ { "inline": "text", "text": "workload" } ], "about": { "kind": "domain", "name": "mandate.workload" }, "provenance": { "provenance": { "system": "mandate", "specification_version": "v1", "source_digest": "2f11d2daffc2d75bb4ca8c0485aedc56fb2a712cdaed6347fc48b8ba2b1f7ca6", "contract_digest": "slice-sha256/2:6bf4b0d22c19d7ef08826bd3fbe010083c8c3ee4cb3003c0894f6f34a6a6144f" }, "slice": { "of": "constructs", "seeds": [ { "kind": "domain", "name": "mandate.workload" }, { "kind": "type", "name": "mandate.workload.WorkloadIdentity.State" }, { "kind": "entity", "name": "mandate.workload.WorkloadIdentity" }, { "kind": "command", "name": "mandate.workload.RevokeWorkloadIdentity" }, { "kind": "event", "name": "mandate.workload.WorkloadIdentityRevoked" }, { "kind": "error", "name": "mandate.workload.Denied" }, { "kind": "component", "name": "mandate-authorization" }, { "kind": "component", "name": "mandate-control-plane" }, { "kind": "component", "name": "mandate-sts" }, { "kind": "component", "name": "mandate-worker" } ] } }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.workload" }, { "inline": "text", "text": " is one of mandate's bounded contexts. " }, { "inline": "link", "to": { "target": "page", "page": "index" }, "text": [ { "inline": "text", "text": "Back to the index" } ] }, { "inline": "text", "text": "." } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Entities" } ], "anchor": "entities", "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "An entity is what this context is about: something with an identity that outlives any one request, a shape, and a lifecycle. The lifecycle is exhaustive — a move that is not drawn below is a move this specification does not permit, and that is the only way it says so. Every move is labelled with the command that takes it, because a move nothing can trigger is refused rather than drawn." } ] }, { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "WorkloadIdentity" } ], "anchor": "workloadidentity", "about": { "kind": "entity", "name": "mandate.workload.WorkloadIdentity" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.workload.WorkloadIdentity" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is identified by " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": ", a " }, { "inline": "code", "text": "mandate.core.WorkloadIdentityId" }, { "inline": "text", "text": ". The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It holds:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "organization_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.OrganizationId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "principal_id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.PrincipalId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "trust_domain" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.TrustDomain" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "external_subject" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.ExternalSubject" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-tenancy", "anchor": "organization" }, "text": [ { "inline": "code", "text": "mandate.tenancy.Organization" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "organization_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "WorkloadIdentity.organization_id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It references at most one " }, { "inline": "link", "to": { "target": "anchor", "page": "domains/mandate-identity", "anchor": "principal" }, "text": [ { "inline": "code", "text": "mandate.identity.Principal" } ] }, { "inline": "text", "text": ", as " }, { "inline": "code", "text": "principal_id_record" }, { "inline": "text", "text": ", carried by " }, { "inline": "code", "text": "WorkloadIdentity.principal_id" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No invariant is declared, so nothing here constrains an instance at rest." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Its state is a " }, { "inline": "code", "text": "mandate.workload.WorkloadIdentity.State" }, { "inline": "text", "text": ", one of " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": ". That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "An instance is created in " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": " is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which." } ] }, { "block": "diagram", "kind": "lifecycle", "source": "stateDiagram-v2\n [*] --> Recorded\n Recorded --> Revoked: revoke (RevokeWorkloadIdentity)\n Revoked --> [*]" }, { "block": "prose", "text": [ { "inline": "text", "text": "Each move is taken by a declared command outcome, and a move nothing takes is refused as " }, { "inline": "code", "text": "missing_causation" }, { "inline": "text", "text": " rather than left as a state change nobody can trigger:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "revoke" }, { "inline": "text", "text": " — taken by " }, { "inline": "code", "text": "mandate.workload.RevokeWorkloadIdentity" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No command here creates one, so an instance arrives from outside this specification." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": " may not become " }, { "inline": "code", "text": "Recorded" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "No view projects it, so nothing outside this context is promised a way to observe one." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Commands" } ], "anchor": "commands", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "RevokeWorkloadIdentity" } ], "anchor": "revokeworkloadidentity", "about": { "kind": "command", "name": "mandate.workload.RevokeWorkloadIdentity" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.workload.RevokeWorkloadIdentity" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It takes:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.WorkloadIdentityId" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It has three outcomes." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "accepted" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "The binding stops being admitted. A workload credential presented under this trust domain and subject is refused from that point, and the record is kept so past exchanges stay attributable. " }, { "inline": "text", "text": "The default branch, taken when no other outcome's condition matched." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "It moves a " }, { "inline": "code", "text": "mandate.workload.WorkloadIdentity" }, { "inline": "text", "text": " from " }, { "inline": "code", "text": "Recorded" }, { "inline": "text", "text": " to " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": ", along the declared move " }, { "inline": "code", "text": "revoke" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "The instance is the one named by the input field " }, { "inline": "code", "text": "id" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits " }, { "inline": "code", "text": "mandate.workload.WorkloadIdentityRevoked" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " A test reaches it by constructing an input that satisfies no other outcome's condition." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "wrong-state" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Taken when the subject is resting in a state none of this command's moves start from" }, { "inline": "text", "text": " — a " }, { "inline": "code", "text": "mandate.workload.WorkloadIdentity" }, { "inline": "text", "text": " in " }, { "inline": "code", "text": "Revoked" }, { "inline": "text", "text": ", which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.workload.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch." } ] }, { "block": "prose", "text": [ { "inline": "strong", "text": [ { "inline": "code", "text": "denied" } ] }, { "inline": "text", "text": " — " }, { "inline": "text", "text": "Decided outside the input: Caller lacks workload-identity administration authority, the identity is outside the verified organization, or revocation cannot durably stop the exchange of workload credentials presented under the binding.. No predicate over the input reaches this branch, and saying " }, { "inline": "code", "text": "when: false" }, { "inline": "text", "text": " instead would have claimed it is unreachable, which is a different and false statement." }, { "inline": "text", "text": " " }, { "inline": "text", "text": "No entity in this specification changes." }, { "inline": "text", "text": " It reports " }, { "inline": "code", "text": "mandate.workload.Denied" }, { "inline": "text", "text": ", carrying " }, { "inline": "code", "text": "reason" }, { "inline": "text", "text": "." }, { "inline": "text", "text": " It emits nothing." }, { "inline": "text", "text": " A test reaches it by injecting the declared fault, because no input can." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Events" } ], "anchor": "events", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "WorkloadIdentityRevoked" } ], "anchor": "workloadidentityrevoked", "about": { "kind": "event", "name": "mandate.workload.WorkloadIdentityRevoked" }, "blocks": [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.workload.WorkloadIdentityRevoked" }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "context" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.VerifiedContext" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "id" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.WorkloadIdentityId" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Emitted by " }, { "inline": "code", "text": "mandate.workload.RevokeWorkloadIdentity" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "accepted" }, { "inline": "text", "text": " outcome." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Nothing in this system reacts to it." } ] } ] } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Errors" } ], "anchor": "errors", "blocks": [ { "block": "section", "level": 3, "title": [ { "inline": "code", "text": "Denied" } ], "anchor": "denied", "about": { "kind": "error", "name": "mandate.workload.Denied" }, "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "Fail closed; no credential, authority or lifecycle mutation on refusal." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "It carries:" } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "reason" }, { "inline": "text", "text": " — " }, { "inline": "code", "text": "mandate.core.DenialReason" } ] } ] ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Reported by " }, { "inline": "code", "text": "mandate.workload.RevokeWorkloadIdentity" }, { "inline": "text", "text": " on its " }, { "inline": "code", "text": "wrong-state" }, { "inline": "text", "text": " and " }, { "inline": "code", "text": "denied" }, { "inline": "text", "text": " outcomes." } ] } ] } ] }, { "block": "list", "ordered": false, "items": [] } ] }, { "id": "interactions", "title": [ { "inline": "text", "text": "Interactions" } ], "provenance": { "provenance": { "system": "mandate", "specification_version": "v1", "source_digest": "2f11d2daffc2d75bb4ca8c0485aedc56fb2a712cdaed6347fc48b8ba2b1f7ca6", "contract_digest": "c10ff6000b18ab217e70b48ced7e45b185d42665b843db0c0d17aae4c5394ee5" }, "slice": { "of": "whole-model" } }, "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "A binding is the only way an event in one context causes a command in another. Each one states how many times the command may run and what happens when it does not, because a binding that can fail quietly is the difference between specifying a system and specifying a demo." } ] }, { "block": "prose", "text": [ { "inline": "link", "to": { "target": "page", "page": "index" }, "text": [ { "inline": "text", "text": "Back to the index" } ] }, { "inline": "text", "text": "." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "This system declares no bindings: nothing here reacts to anything." } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Events nothing reacts to" } ], "anchor": "events-nothing-reacts-to", "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "Legal, and worth seeing. An event with no reader inside the system is either a deliberate boundary — something outside consumes it — or a binding somebody forgot, and only a person can tell which." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.audit.AuditEventRecorded" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.audit.AuditEventRedacted" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.audit.CredentialRevoked" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.audit.DirectoryGroupCreated" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.audit.ExternalPrincipalUnlinked" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.audit.FederationConnectionChanged" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.audit.TokenExchangeDenied" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.authorization.DecisionRecorded" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.AccessCredentialRevoked" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.AuthorizationCodeIssued" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.AuthorizationCodeRedeemed" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.CredentialIntrospected" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.CredentialReferenceIssued" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.CredentialSelfContainedIssued" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.ResourceServerDisabled" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.ResourceServerRegistered" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.SigningKeyRegistered" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.SigningKeyRetired" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.SigningKeyRevoked" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.TokenExchangeAllowed" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.credential.TokenExchangeDenied" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.AgentCapabilityCeilingSuperseded" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.AgentRetired" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.ApprovalConsumed" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.DelegationCreated" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.DelegationRevoked" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.delegation.ExecutionCompleted" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.DirectoryGroupMembershipChanged" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.DirectoryGroupMembershipRecorded" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.DirectoryGroupMembershipRemoved" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.DirectoryGroupRecorded" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.DirectoryGroupRetired" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.DirectoryGroupTeamMappingCreated" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.DirectoryGroupTeamMappingRemoved" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.MembershipContributionRecorded" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.MembershipContributionRemoved" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.SyncJobCompleted" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.SyncJobFailed" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.directory.SyncJobRecorded" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.AuthorizationCodeIssued" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.ExternalPrincipalLinked" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.ExternalPrincipalProvisioned" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.ExternalPrincipalUnlinked" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.FederationAuthenticated" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.FederationConnectionCreated" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.FederationConnectionDisabled" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.OAuthClientDisabled" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.federation.OAuthClientRegistered" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.graph.GrantRevoked" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.graph.RelationRemoved" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.graph.RelationshipWritten" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.graph.ResourceDeregistered" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.graph.ResourceRegistered" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.EpochSnapshotRecorded" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.PrincipalDisabled" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.RefreshCredentialRevoked" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.SecurityEpochIncremented" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.SecurityEpochRecorded" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.SessionOpened" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.SessionRefreshed" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.identity.SessionRevoked" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.policy.AuthorizationModelSuperseded" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.policy.PolicySuperseded" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.OrganizationClosed" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.OrganizationCreated" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.OrganizationMembershipAdded" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.OrganizationMembershipRemoved" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.SpaceCreated" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.SpaceRetired" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.TeamCreated" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.TeamMembershipAdded" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.TeamMembershipRemoved" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.tenancy.TeamRetired" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate.workload.WorkloadIdentityRevoked" } ] } ] ] } ] }, { "block": "list", "ordered": false, "items": [] } ] }, { "id": "crossings", "title": [ { "inline": "text", "text": "Type crossings" } ], "provenance": { "provenance": { "system": "mandate", "specification_version": "v1", "source_digest": "2f11d2daffc2d75bb4ca8c0485aedc56fb2a712cdaed6347fc48b8ba2b1f7ca6", "contract_digest": "c10ff6000b18ab217e70b48ced7e45b185d42665b843db0c0d17aae4c5394ee5" }, "slice": { "of": "whole-model" } }, "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "A conversion is this system's permission for a value of one type to be used as another. Every one of them carries a reason, and the reason is required rather than optional precisely so that this page can exist: someone asking why an invoice's email address is allowed to become a mailbox address gets an answer written by the person who allowed it, not a shrug." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "Declaring a crossing is also the only way to make one. Two newtypes over " }, { "inline": "code", "text": "String" }, { "inline": "text", "text": " do not convert because they are both strings; they convert because a line in the specification says they may." } ] }, { "block": "prose", "text": [ { "inline": "text", "text": "This system declares no crossings. Every type is used only as itself." } ] }, { "block": "prose", "text": [ { "inline": "link", "to": { "target": "page", "page": "index" }, "text": [ { "inline": "text", "text": "Back to the index" } ] }, { "inline": "text", "text": "." } ] } ] }, { "id": "topology", "title": [ { "inline": "text", "text": "Topology" } ], "provenance": { "provenance": { "system": "mandate", "specification_version": "v1", "source_digest": "2f11d2daffc2d75bb4ca8c0485aedc56fb2a712cdaed6347fc48b8ba2b1f7ca6", "contract_digest": "c10ff6000b18ab217e70b48ced7e45b185d42665b843db0c0d17aae4c5394ee5" }, "slice": { "of": "whole-model" } }, "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "Runtime requirements, stated semantically. None of this is a deployment and nothing generates a manifest from it: a replica floor of two is a claim that the system is not correct with one instance, which is a fact about the design and survives every change of hosting." } ] }, { "block": "section", "level": 2, "title": [ { "inline": "text", "text": "Components that run nowhere" } ], "anchor": "components-that-run-nowhere", "blocks": [ { "block": "prose", "text": [ { "inline": "text", "text": "Declared as a unit of ownership, with nothing in the topology running it. That is legal — a context can be owned by a library — but it is the kind of legal worth reading twice." } ] }, { "block": "list", "ordered": false, "items": [ [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate-authorization" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate-control-plane" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate-sts" } ] } ], [ { "block": "prose", "text": [ { "inline": "code", "text": "mandate-worker" } ] } ] ] } ] }, { "block": "prose", "text": [ { "inline": "link", "to": { "target": "page", "page": "index" }, "text": [ { "inline": "text", "text": "Back to the index" } ] }, { "inline": "text", "text": "." } ] } ] } ] }