[AdaWorldAPI]

Implements the 2026-10-21 operator ruling (ISS-PRESET-VERBS-PROVISIONAL, ISS-PERMISSION-SETS-NOT-ROLES) and the first D-IAM-3 output path.

A role name grants nothing

• roles::bind() binds RBAC_PLUG through RoleNames, which defines the six names but has no grants, so every decision the binding makes on its own refuses.
• The old verb table is now PresetFixture, reachable only through bind_preset_fixture(). It is for simulation and tests only.

Tenant data (hubspo_iam::tenant)

• TenantPolicy has a declared version plus a generation that bumps on every change.
• PermissionSets have stable ids and are assigned to a role or a principal.
• A set lists its class grants, scopes, outer field masks, inner ordinals and named ActionGrants. Nothing is implied.
• Seat is the ceiling on concepts and actions.

Per-request access (hubspo_iam::access::RequestAccess)

• Rows come from the broadest scope among the sets that read the concept.
• Properties are checked by outer mask and inner ordinal.
• Plain verbs are READ, WRITE and CREATE.
• Named actions (ACT, DELETE, EXPORT) each need the verb and the gate in the same set, plus the seat.
• The result is stamped with concept, schema, policy version and generation, seat and role versions (Stamp gains seat and roles). Any difference refuses with Stale.
• Super Admin has no special path.

First output path (hubspo_compat::contacts)

• lookup returns NotFound for:
  • a missing record;
  • another tenant's record;
  • an owner outside the request's scope;
  • a request with no read grant.
• It projects by ordinal before naming fields, so the packed run never leaves whole.
• check_search refuses filters and sorts on hidden or unknown properties.

Tests

• hubspo-iam: 40 lib, 4 directory and 8 scope tests. hubspo-compat: 6.
• All six negative tests from the ruling are present.
• Also covered: seat-change and role-change invalidation, super admin with no set, and another tenant's policy.
• Workspace fmt, clippy (-D warnings) and tests pass.

Disable runs: all ten measured red.

• seat concept check;
• seat action check;
• named gate;
• plain-verb guard;
• scope taken from non-reading sets;
• role version dropped from the stamp;
• tenant check;
• row-scope check;
• search gate;
• RoleNames returning preset grants.

The board is updated in the same commit: LATEST_STATE, STATUS_BOARD rows D-IAM-1 and D-IAM-3, ISSUES.

Open:

• the store read that supplies (ordinal, value) pairs (D-API-1);
• TenantPolicy persistence;
• default sets for simulation;
• the other output paths.

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-21T02:20:02.264974Z	acfa5cb	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.