Authority per namespace: genesis, roles, grants; scopes read inside it; authority shapes per namespace (issue 5)

.ddd/seams/seam-rust-ledger-cli-tests-common-hand-rs.yaml

@@ -1,7 +1,7 @@
 format: 2
 id: seam/rust/ledger-cli-tests-common-hand-rs
 boundary: contract surface of ledger-cli/tests/common/hand.rs
-verdict_knowledge: Test suites learn how to write ledger entities by hand — acceptances, bindings and policies with any at, under or signer — so verify is exercised on files no verb made.
+verdict_knowledge: 'Test-only: the hand-writing half of the ledger-cli suites'' harness, with no consumer outside ledger-cli/tests/ — test suites learn how to write ledger entities by hand (acceptances, bindings, policies with any at, under or signer) and how to found a namespace with its genesis, roles and first policy without the writer, so verify is exercised on files no verb made.'
 contract_location: ledger-cli/tests/common/hand.rs
 obligations: []
 metadata: {}
@@ -186,3 +186,9 @@ bindings:
   after: sha256:6bec31662ee3ba78c736178572b39ca0039fa83f23be4af7317f7422d833824b
   base_revision: 88b3de113c03fa70091d00fef217e55d44ccac3e
   hash: sha256:3fe513692e074586bd1e3d50e6123c7db9f90d76d2619ac108de67879c7bdee7
+- symbol: found
+  file: ledger-cli/tests/common/hand.rs
+  before: sha256:b8a216763ec322bf9470148afbcbea4077dbdbe6730e459bb1d03fa5da2d553a
+  after: sha256:e111d09b6d84e63d8aea9fbbe7cca766bd4bdd1d103674aea3c695e2f81ed99b
+  base_revision: ec43481f591b1022d8840755c8c0381b06a59387
+  hash: sha256:6f5ce54063e728276bd5f3c86b4f7f2f3df238e3e49e4da5b137b9f6690d1369

.ddd/seams/seam-rust-ledger-core-src-author-authority-ops-rs.yaml

@@ -1,7 +1,7 @@
 format: 2
 id: seam/rust/ledger-core-src-author-authority-ops-rs
 boundary: contract surface of ledger-core/src/author/authority_ops.rs
-verdict_knowledge: Callers learn the authority verbs (init_namespace, declare_role, grant, accept_grant, revoke_grant) run the role check, then the same delta-gate as every verb, refusing with AuthorError::Unauthorized or the verify finding.
+verdict_knowledge: 'Callers learn init_namespace opens every namespace with its own genesis grant, root and accept roles and first policy under .decisions/ns/<ns>/ (a mandate is required), and that declare_role runs the role check over that namespace''s authority, then the same delta-gate as every verb, refusing with AuthorError::Unauthorized or the verify finding; the grant verbs live in grant_ops (LP-6.5, ruling 47).'
 contract_location: ledger-core/src/author/authority_ops.rs
 obligations: []
 metadata: {}
@@ -156,3 +156,27 @@ bindings:
   after: sha256:5ee3f00e52414f633ca8b3970070a8ea892e566db63ac49511c311d9f7700c18
   base_revision: 70395dfe317cb9a00665433813766ca763f3c58a
   hash: sha256:bc915b2048b8716dff644b51608397512a153cd62eb87e6091331047bd121a90
+- symbol: namespace
+  file: ledger-core/src/author/authority_ops.rs
+  before: sha256:5ee3f00e52414f633ca8b3970070a8ea892e566db63ac49511c311d9f7700c18
+  after: sha256:48aa783f1903bfcae7c9e5dfc63cc80a6ceb46005ba1fc15af7233711597bce6
+  base_revision: ec43481f591b1022d8840755c8c0381b06a59387
+  hash: sha256:c62fb0ecfe69a0f3867091334f08f2a2597dba2fba2f98ac03ce8f94ab804f87
+- symbol: accept_grant
+  file: ledger-core/src/author/authority_ops.rs
+  before: sha256:5ee3f00e52414f633ca8b3970070a8ea892e566db63ac49511c311d9f7700c18
+  after: sha256:48aa783f1903bfcae7c9e5dfc63cc80a6ceb46005ba1fc15af7233711597bce6
+  base_revision: ec43481f591b1022d8840755c8c0381b06a59387
+  hash: sha256:1df6cb34c71c53f2161b8ed39a8a6fcd2dbf64496f0d0cc79379b549964ea323
+- symbol: grant
+  file: ledger-core/src/author/authority_ops.rs
+  before: sha256:5ee3f00e52414f633ca8b3970070a8ea892e566db63ac49511c311d9f7700c18
+  after: sha256:48aa783f1903bfcae7c9e5dfc63cc80a6ceb46005ba1fc15af7233711597bce6
+  base_revision: ec43481f591b1022d8840755c8c0381b06a59387
+  hash: sha256:4b6a96428d9ce8d4fa86bb99691551a60b71dbee97256ba9db6becf528f592bf
+- symbol: revoke_grant
+  file: ledger-core/src/author/authority_ops.rs
+  before: sha256:5ee3f00e52414f633ca8b3970070a8ea892e566db63ac49511c311d9f7700c18
+  after: sha256:48aa783f1903bfcae7c9e5dfc63cc80a6ceb46005ba1fc15af7233711597bce6
+  base_revision: ec43481f591b1022d8840755c8c0381b06a59387
+  hash: sha256:6fef7024dec55afb1af27752d357b4f871c016ad935d584207a21b581a7a35e2

.ddd/seams/seam-rust-ledger-core-src-author-grant-ops-rs.yaml

@@ -0,0 +1,32 @@
+format: 2
+id: seam/rust/ledger-core-src-author-grant-ops-rs
+boundary: contract surface of ledger-core/src/author/grant_ops.rs
+verdict_knowledge: 'Callers learn the grant verbs (grant, accept_grant, revoke_grant) file into the namespace of the grant they act under or name, with --namespace deciding where a grant is filed when the store holds several, and run the role check over that namespace''s authority before the same delta-gate as every verb (LP-6.5, ruling 47).'
+contract_location: ledger-core/src/author/grant_ops.rs
+obligations: []
+metadata: {}
+bindings:
+- symbol: impl Author
+  file: ledger-core/src/author/grant_ops.rs
+  before: absent
+  after: sha256:077ac022737937424c066dc86eec75677f67b739e5cf648289c9a60cef2463fc
+  base_revision: ec43481f591b1022d8840755c8c0381b06a59387
+  hash: sha256:110ce8a5e6db2dad95318c0fbb111ddabe07943fd2cb50ab1c43765cfed15a8a
+- symbol: accept_grant
+  file: ledger-core/src/author/grant_ops.rs
+  before: absent
+  after: sha256:077ac022737937424c066dc86eec75677f67b739e5cf648289c9a60cef2463fc
+  base_revision: ec43481f591b1022d8840755c8c0381b06a59387
+  hash: sha256:bcbd03d5b6b8cf505c6da4ecff936a11cdeab70a00e17cd70224e0fe8c0f3f26
+- symbol: grant
+  file: ledger-core/src/author/grant_ops.rs
+  before: absent
+  after: sha256:077ac022737937424c066dc86eec75677f67b739e5cf648289c9a60cef2463fc
+  base_revision: ec43481f591b1022d8840755c8c0381b06a59387
+  hash: sha256:4d0914674b3caa5c35dce1f41733cf185ca3fe965e47ee110a547567e239855a
+- symbol: revoke_grant
+  file: ledger-core/src/author/grant_ops.rs
+  before: absent
+  after: sha256:077ac022737937424c066dc86eec75677f67b739e5cf648289c9a60cef2463fc
+  base_revision: ec43481f591b1022d8840755c8c0381b06a59387
+  hash: sha256:5bc507967c9e07b95b5ec42455fae91e8ade6136e4ec301ffa6b11b104742c45

.ddd/seams/seam-rust-ledger-core-src-authority-references-rs.yaml

@@ -1,7 +1,7 @@
 format: 2
 id: seam/rust/ledger-core-src-authority-references-rs
 boundary: contract surface of ledger-core/src/authority/references.rs
-verdict_knowledge: "Consumers learn the cross-record SCHEMA rules: every reference resolves, grant acceptances are the holder's over the grant's hash, nothing is revoked or closed twice, a policy chain has one root and one tip."
+verdict_knowledge: 'Consumers learn the cross-record SCHEMA rules: every reference resolves, grant acceptances are the holder''s over the grant''s hash, nothing is revoked or closed twice, a policy chain has one root and one tip.'
 contract_location: ledger-core/src/authority/references.rs
 obligations: []
 metadata: {}
@@ -12,3 +12,9 @@ bindings:
   after: sha256:f769607fa24749154575a997343858f32c8bdd8e563754597ce3f5c92175a838
   base_revision: e33398d874ec5ddd52404c4f2c16039d5ed7cdbb
   hash: sha256:df70573cb08c341def4b796941772efab92ed37339af9745e1bb357a3812ce0a
+- symbol: faults
+  file: ledger-core/src/authority/references.rs
+  before: sha256:46fc01a0349efbb313c844e871fb502fc48690f75b34e01e6f9abb8fff52701a
+  after: sha256:0f336007b90e01d37230407e17fbf082c098f4b826abb51e7e37f792cea88b55
+  base_revision: ec43481f591b1022d8840755c8c0381b06a59387
+  hash: sha256:40057befcfc460c1f0d9ba8666e45f885b8202b37f8f1889fbbdc0f4dfb6d624

.ddd/seams/seam-rust-ledger-core-src-authority-structure-rs.yaml

@@ -1,7 +1,7 @@
 format: 2
 id: seam/rust/ledger-core-src-authority-structure-rs
 boundary: contract surface of ledger-core/src/authority/structure.rs
-verdict_knowledge: "Consumers learn the single-record SCHEMA rules for roles, grants, intervals, bindings and policies."
+verdict_knowledge: 'Consumers learn the single-record SCHEMA rules for roles, grants, intervals, bindings and policies, judged in the record''s own namespace: a grant''s scope is read inside that namespace (* is the whole namespace) and a scope naming another namespace is a schema fault (LP-6.16, ruling 47).'
 contract_location: ledger-core/src/authority/structure.rs
 obligations: []
 metadata: {}
@@ -18,3 +18,9 @@ bindings:
   after: sha256:e0c3d508f0ef2979262139e05969da693efea418db1ceb75badccdcc7e72d504
   base_revision: e33398d874ec5ddd52404c4f2c16039d5ed7cdbb
   hash: sha256:1163450ba0c074eabde3261db44d8bdff046bf260aa5e2dbd617edd78e9e3b81
+- symbol: entry_faults
+  file: ledger-core/src/authority/structure.rs
+  before: sha256:9e805d601ab60a3ab5ed4ad1fd523a183eb986067e9a7b5d3c8f562901eb3cb9
+  after: sha256:8beb004635ac126329ee2b3f5fc0c4abf393044a879fa56b364b37f625fc21a2
+  base_revision: ec43481f591b1022d8840755c8c0381b06a59387
+  hash: sha256:2ab4c9253aa59d44a1a13b1429b20d4f0bc2de58a58346c054dd526549b7ec0c

.ddd/seams/seam-rust-ledger-core-src-authority-view-rs.yaml

@@ -1,7 +1,7 @@
 format: 2
 id: seam/rust/ledger-core-src-authority-view-rs
 boundary: contract surface of ledger-core/src/authority/view.rs
-verdict_knowledge: Callers learn the Authority view's answers — live, accepted, available, revoked, superseded, the genesis, the policy in force — that every authority check reads.
+verdict_knowledge: 'Callers learn the Authority view is built per namespace, of(store, ns) now and as_of(store, landing, pos, ns) at a past act, and answers live, accepted, available, revoked, superseded, the genesis and the policy in force for that namespace alone (LP-6.5, ruling 47).'
 contract_location: ledger-core/src/authority/view.rs
 obligations: []
 metadata: {}
@@ -156,3 +156,15 @@ bindings:
   after: sha256:a95a2e5a573e61b8bbf03ed29a0e0da62565668d3a6b0db6ec80e7bce38c86a3
   base_revision: 88b3de113c03fa70091d00fef217e55d44ccac3e
   hash: sha256:8695ec2f847bedaa2c2643683652a1f6d5eefc81b4fdead32b0f87675cdbb357
+- symbol: as_of
+  file: ledger-core/src/authority/view.rs
+  before: sha256:a8b7b76054a59ee6efcea9392d21446f3cac91e586502902bbd7fa7afcf90c68
+  after: sha256:c3153380e8201023a1f597f6168ccc9cf946100d28bf39f4598c17a598fd78f7
+  base_revision: ec43481f591b1022d8840755c8c0381b06a59387
+  hash: sha256:d583dbf483594c53d3ce621627b43ed7d5c35a23d747a7b81f4a72f24a208d33
+- symbol: of
+  file: ledger-core/src/authority/view.rs
+  before: sha256:a8b7b76054a59ee6efcea9392d21446f3cac91e586502902bbd7fa7afcf90c68
+  after: sha256:c3153380e8201023a1f597f6168ccc9cf946100d28bf39f4598c17a598fd78f7
+  base_revision: ec43481f591b1022d8840755c8c0381b06a59387
+  hash: sha256:0f7ad170fd1459d5401f376ed2353ee507f8eaba5ef3b2a073f50bb4b7d90ee8

.ddd/seams/seam-rust-ledger-core-src-store-rs.yaml

@@ -1,7 +1,7 @@
 format: 2
 id: seam/rust/ledger-core-src-store-rs
 boundary: contract surface of ledger-core/src/store.rs
-verdict_knowledge: 'Consumers learn the store loads every namespace''s sets, roles and log from .decisions/ns/<ns>/, that a loaded set or change-set carries the namespace of the directory it was read from, that a set is looked up by (namespace, id) with set_in, and that every file must declare the format its fields need (LP-3.34).'
+verdict_knowledge: 'Consumers learn the store loads every namespace''s sets, roles and log from .decisions/ns/<ns>/, that a loaded set, role or change-set carries the namespace of the directory it was read from, that a set or a role is looked up by (namespace, id) with set_in and role_in, and that every file must declare the format its fields need (LP-3.34, ruling 47).'
 contract_location: ledger-core/src/store.rs
 obligations: []
 metadata: {}
@@ -54,3 +54,15 @@ bindings:
   after: sha256:dafa8d9927a1ed6ef80b99b682f949d26a927ece4a8b31ac044602b907884b26
   base_revision: 70395dfe317cb9a00665433813766ca763f3c58a
   hash: sha256:68d5ee772625beaa0a9d2645073dca38bf54888b200ad90e9423cc28343e2128
+- symbol: role_in
+  file: ledger-core/src/store.rs
+  before: sha256:dafa8d9927a1ed6ef80b99b682f949d26a927ece4a8b31ac044602b907884b26
+  after: sha256:f3d39821004043850810504c32f380e2cd29b21cfbf36010bfe0d0841c009826
+  base_revision: ec43481f591b1022d8840755c8c0381b06a59387
+  hash: sha256:39464c8758f1a1ab771855e12826b607b17b9d1d157a937e1fe73b8ea7d09971
+- symbol: role
+  file: ledger-core/src/store.rs
+  before: sha256:dafa8d9927a1ed6ef80b99b682f949d26a927ece4a8b31ac044602b907884b26
+  after: sha256:f3d39821004043850810504c32f380e2cd29b21cfbf36010bfe0d0841c009826
+  base_revision: ec43481f591b1022d8840755c8c0381b06a59387
+  hash: sha256:a3a3c2c3ffbebd3cc37f21aa407f2f12808da096af45cd7f603e72d635dfbedb

.ddd/seams/seam-rust-ledger-core-src-verify-mod-rs.yaml

@@ -144,3 +144,21 @@ bindings:
   after: sha256:005fa2ac0a75a8c4cf4b1d60c90eff616b8e2fa84b879ab7a233d566775c09c6
   base_revision: 74fb8581e549c803a1b4a0ddff3a6ce3ed90cc06
   hash: sha256:50077d369f2ca0de42441e4d36809c172a001080777b7592ca84c080d9f38125
+- symbol: namespace
+  file: ledger-core/src/verify/mod.rs
+  before: sha256:005fa2ac0a75a8c4cf4b1d60c90eff616b8e2fa84b879ab7a233d566775c09c6
+  after: sha256:f3695f3d10145990969ab880418d22b042965be165dd6b9543083d08f2d79071
+  base_revision: ec43481f591b1022d8840755c8c0381b06a59387
+  hash: sha256:0052a3c524aec10f372a29d7887054ddcc65165819d63459a9dab09f02d8923e
+- symbol: genesis_unbound
+  file: ledger-core/src/verify/mod.rs
+  before: sha256:005fa2ac0a75a8c4cf4b1d60c90eff616b8e2fa84b879ab7a233d566775c09c6
+  after: sha256:f3695f3d10145990969ab880418d22b042965be165dd6b9543083d08f2d79071
+  base_revision: ec43481f591b1022d8840755c8c0381b06a59387
+  hash: sha256:290f3a715ebc906dc2b796dc54e9c345d36d1a2ddf03f79b15e0fc29a13afaf8
+- symbol: namespaces
+  file: ledger-core/src/verify/mod.rs
+  before: sha256:005fa2ac0a75a8c4cf4b1d60c90eff616b8e2fa84b879ab7a233d566775c09c6
+  after: sha256:f3695f3d10145990969ab880418d22b042965be165dd6b9543083d08f2d79071
+  base_revision: ec43481f591b1022d8840755c8c0381b06a59387
+  hash: sha256:b6181d32eae2268519f21749b68bbc52b97f0d30aeb7ce7e162221d88ed05a96

CLAUDE.md

@@ -324,13 +324,21 @@ store (`.decisions/`), separate ontology.
 - **Authority (format 6 / spec v1.7, #69)** — roles
   (`.decisions/ns/<ns>/roles/<id>.yml`), grants + grant acceptances, unavailability
   / availability, key bindings, namespace policy, and the `rev:` revocation
-  entity, all in `ledger-core/src/authority/`. `ledger init --namespace
-  <ns> --external-ref <mandate>` bootstraps the genesis; `role declare`,
-  `grant new|accept|revoke`, `unavailable`, `available`, `identity
+  entity, all in `ledger-core/src/authority/`. **Authority is per
+  namespace** (spec v1.9, ruling 47): `ledger init --namespace <ns>
+  --external-ref <mandate>` opens every namespace with its own genesis
+  grant, root and accept roles and first policy, each under
+  `.decisions/ns/<ns>/`; a grant belongs to the directory that holds it and
+  its scope is read inside that namespace (`*` = the whole namespace,
+  `ns:<other>` a schema fault); `grant new --namespace` names where a grant
+  is filed when the store has several. `role declare`, `grant
+  new|accept|revoke`, `unavailable`, `available`, `identity
   add|rotate|revoke|sync`, `policy show|set`. The role check is one
-  function, `authority::authorize`, which `accept`, `revoke` and the grant
-  verbs call; a namespace **without** a policy is pre-v2 and not
-  role-checked. `allowed_signers` is derived (never hand-edited) and held by
+  function, `authority::authorize`, over `Authority::of(store, ns)`, which
+  `accept`, `revoke` and the grant verbs call; a namespace **without** a
+  policy is pre-v2 and not role-checked. The graph stage runs per
+  namespace (`A003`/`A005` count one trust root each). Keys are still
+  bound and trusted store-wide until issue 6 of the namespace PRD. `allowed_signers` is derived (never hand-edited) and held by
   `verify`'s `[SIGNERS]` stage. Graph classes `A003`/`A005`; `A006` deferred.
 - **Signing (format 7 / spec v1.8, #70)** — `ledger-core/src/signing/`.
   A namespace's policy lists the required schemes; a signature is a sidecar

ledger-cli/src/commands/authority.rs

@@ -33,8 +33,9 @@ pub fn role(root: Option<PathBuf>, cmd: RoleCmd) -> Result<i32, String> {
 pub fn grant(root: Option<PathBuf>, cmd: GrantCmd) -> Result<i32, String> {
     match cmd {
         GrantCmd::Accept { grant } => finish(open_author(root)?.accept_grant(&grant.parse()?)),
-        GrantCmd::New { role, to, scope, order, limits, supersedes, as_role } => {
+        GrantCmd::New { role, to, scope, namespace, order, limits, supersedes, as_role } => {
             let args = GrantArgs {
+                namespace,
                 role,
                 holder: to.parse()?,
                 scope: scope.parse()?,

ledger-cli/src/commands/authority_enum.rs

@@ -40,9 +40,14 @@ pub enum GrantCmd {
         /// The holder
         #[arg(long, value_name = "IDENTITY")]
         to: String,
-        /// `*`, `ns:<namespace>`, `set:<set-id>` or `pattern:<id>`
+        /// `*`, `ns:<namespace>`, `set:<set-id>` or `pattern:<id>` — read
+        /// inside the grant's own namespace
         #[arg(long)]
         scope: String,
+        /// The namespace whose directory holds the grant; inferred from a
+        /// `ns:` scope, else when the store has one namespace
+        #[arg(long)]
+        namespace: Option<String>,
         /// `primary` or `fallback-N`
         #[arg(long, default_value = "primary")]
         order: String,

ledger-cli/tests/authority.rs

@@ -299,10 +299,16 @@ fn a_grantor_below_star_is_refused_a_grant_over_another_scope() {
     repo.act_as(ARCHITECT);
     repo.ok(&["grant", "accept", &grant]);
     repo.ok(&["grant", "accept", &delegate]);
-    for scope in ["*", "ns:fixture.other", "set:ledger-design"] {
+    for scope in ["*", "set:ledger-design"] {
         let refused = repo.refused(&["grant", "new", "delegate", "--to", "third@customer.example", "--scope", scope]);
         assert!(refused.contains("does not cover this"), "{scope}: {refused}");
     }
+    // A `ns:` scope names the namespace the grant is filed in (ruling 47):
+    // over another namespace the grant would be made in that namespace's
+    // authority, where the role is not even declared.
+    let elsewhere = repo.ledger(&["grant", "new", "delegate", "--to", "third@customer.example", "--scope", "ns:fixture.other"]);
+    assert_eq!(elsewhere.status.code(), Some(2), "{}", common::both(&elsewhere));
+    assert!(common::both(&elsewhere).contains("not declared in `fixture.other`"), "{}", common::both(&elsewhere));
     repo.ok(&["grant", "new", "delegate", "--to", "third@customer.example", "--scope", &format!("ns:{NS}")]);
     repo.ok(&["verify", "--no-blame"]);
 }