dir-rmap-probe: IAM nested groups as a DR256 register, versioned populations and method folds (arm Q) by AdaWorldAPI · Pull Request #1666 · AdaWorldAPI/lance-graph

AdaWorldAPI · 2026-10-21T17:09:48Z

Lab only. This models IAM nested groups as a DR256 register and turns the resolved relationships into reusable, version-bound populations that later queries fold with bit algebra.

What changed

Register (src/qr.rs): every security group is bound to one of 256 slots, once per snapshot. Nesting is a 256 × 256 bit tile closed by Warshall. More than 256 security groups is refused, never truncated. Bind resolves no user.
Pages on demand: Qr::page resolves 256 users (membership rows plus roles as a column fold). Pages resolves a page when a question names one of its users.
Masked counts over several tiles: count_masked takes a tile mask and per-tile row masks and runs branch-free. Runs holds per-slot tile pointer tables, so a query reads only the selected tiles' runs.
Populations (src/pop.rs): one bit per user, by tile and row. Each carries the witness of its version; combining versions is refused. Filters chain as AND / AND-NOT; answers are counts.
Team focus: a group identity plus the tile mask of its members. Populations can be built only in the focus's tiles.
Method folds: a ClassView declares three methods (compute_dag). The DR table binds each to a lance-graph-relalg query over populations lent as Rel::Plane, lowered by relalg's existing mask-risc path. No evaluator of the probe's own.
Repair after edits: slot sets are diffed against the rebound register. Members of slots that lost a property, and users whose direct memberships changed, are re-derived from their direct groups, never cleared. Edit::RemoveNested was added.
OU decision (operator): extension proxy chains stay inside one Dn128 OU prefix; memberOf and nesting may cross OUs. Recorded in the board entry. The proxy chain itself is not built.

Verification

19 new tests across qr_register, qr_masked, qr_license and qr_focus. Answers are checked against dir-sim, the crepe oracle and B+.
Every new guard has a disable run that turns the tests red, including the multi-support falsifier. Clearing the members of a removed slot instead of re-deriving them breaks it: a group keeps a role through a second parent, and a user keeps it through its own second path.
cargo +1.99.0 fmt, clippy --release --all-targets -D warnings and all crate tests are green.

Measured (65,000 users; full tables in the board entry)


register bind	≈ 40–53 µs
one 256-user page	≈ 14 µs
16 license counts through a role AND-NOT location chain, end to end	124 µs (chain + counts 3 µs)
team focus, three methods, warm, native folds	6.6 µs
same, through relalg (18 queries)	75 µs (≈ 3 µs fixed per query)
B+ per focus user (77 members)	12.3 µs
repair 18 populations after an edit / rebuild	5.7 µs / 152 µs
prepare (dir-sim → CSR) and B+ compile	FAILED GATE (ms)

Open

relalg's fixed cost per query, which dominates the warm path.
Incremental register update (rebind is ≈ 52 µs after an edit).
Positions ordered by Dn128, without which the team focus covers most tiles.
Proxy chains, and chains with more than 256 security groups.
Reading source lanes directly (ADMISSION B) and the codebook witness.
ACT-R and Thought-Git consuming the same focus and populations.

Board: .claude/board/entries/2026-10-21-dr256-iam-nested-groups.md.

🤖 Generated with Claude Code

https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

The security chain is bound to 256 local slots once (global-to-local register). Nesting is a 256x256 bit tile closed inside the tile by Warshall; users are rows of a users x groups bit matrix in pages of 256. Roles and effective security groups match dir-sim, the crepe oracle and B+ for every user, before and after a nesting add and a membership removal. A chain with more than 256 security groups is refused, never truncated; a stale snapshot and a group outside the chain are refused. Wired as a DR route from the ClassView compute_dag, as in classview_dr.rs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

…xample Roles per 256-user page are the OR of the membership matrix's columns of the slots carrying each role. examples/qr_cost.rs times prepare, B+ and the register bind per phase and the per-user routes, every route checked equal to dir-sim first. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

coderabbitai · 2026-10-21T17:09:57Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 7801ad1f-35ea-4d8a-8df3-a8db4ae46507

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

bind builds only the register (slots, nesting tile, Warshall closure, slot roles). A page of 256 users is resolved when a question names it (Qr::page, Pages); nothing resolves the whole population. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

…w mask) + amortization sweep Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

…ount Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

…e masking Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

…tered over all memberships) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

…s, repair Pop carries the witness of its version and refuses mixed versions; TeamFocus binds a group identity to its tiles; population_in fills only the focus's tiles via the pointer runs; three ClassView methods fold the same bound populations through lance-graph-relalg (Rel::Plane) and mask-risc; Pop::repair diffs slot sets and re-derives affected users. Edit::RemoveNested added. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

…ion + revision 5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

chatgpt-codex-connector · 2026-10-21T17:58:42Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T18:00:08.955834Z	`5d68c03`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

coderabbitai · 2026-10-21T17:59:06Z

Add Carrot credits or activate Agent usage billing to use Autofix

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5d68c03f5d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…air to their version and mask Pages carries its register witness and refuses another register or source rows before returning a cached page or resolving one. Pop records the tile mask it was built for (kept); repair refuses any other mask. Both reproduce the Codex review findings on #1666 as tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

claude added 3 commits October 21, 2026 17:09

board: DR256 register for IAM nested groups (arm Q) entry

25d05dd

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

claude added 9 commits October 21, 2026 17:16

board: arm Q lazy pages — operator correction and on-demand numbers

99233b0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

dir-rmap-probe: arm Q masked count over several tiles (tile mask x ro…

d046f96

…w mask) + amortization sweep Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

dir-rmap-probe: arm Q per-slot tile pointer runs; branchless masked c…

8021573

…ount Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

board: arm Q masked multi-tile count — amortization and selective til…

f283b2b

…e masking Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

dir-rmap-probe: arm Q populations + chained masks (license groups fil…

92fc829

…tered over all memberships) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

board: arm Q chained population masking over license groups

4187120

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

dir-rmap-probe: focus cold/warm/repair vs B+ example; board: OU decis…

5d68c03

…ion + revision 5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

AdaWorldAPI changed the title ~~dir-rmap-probe: IAM nested groups as a DR256 register (arm Q)~~ dir-rmap-probe: IAM nested groups as a DR256 register, versioned populations and method folds (arm Q) Oct 21, 2026

AdaWorldAPI marked this pull request as ready for review October 21, 2026 17:58

chatgpt-codex-connector Bot reviewed Oct 21, 2026

View reviewed changes

Comment thread crates/dir-rmap-probe/src/qr.rs

Comment thread crates/dir-rmap-probe/src/pop.rs

AdaWorldAPI merged commit 365725d into main Oct 21, 2026
12 checks passed

AdaWorldAPI mentioned this pull request Oct 21, 2026

docs(D-QSP/D-RFT/D-LFA): Quack SQL parity, relalg/thought-git, flow plans #1667

Merged

Navigation Menu

Repository navigation

dir-rmap-probe: IAM nested groups as a DR256 register, versioned populations and method folds (arm Q) - #1666

dir-rmap-probe: IAM nested groups as a DR256 register, versioned populations and method folds (arm Q)#1666
AdaWorldAPI merged 13 commits into
mainfrom
ccr-0455e606-wmtsor

AdaWorldAPI commented Oct 21, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 21, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

AdaWorldAPI commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changed

Verification

Measured (65,000 users; full tables in the board entry)

Open

Uh oh!

coderabbitai Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

coderabbitai Bot commented Oct 21, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

AdaWorldAPI commented Oct 21, 2026 •

edited

Loading

coderabbitai Bot commented Oct 21, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 21, 2026 •

edited

Loading