karst 0.1.0 → 0.2.0

data/lib/karst/web/populations_panel.rb

@@ -1,32 +1,14 @@
 # frozen_string_literal: true
 
 require "cgi"
-require "securerandom"
-require_relative "../access/population_preview"
 
 module Karst
   module Web
-    # The local approval surface for Karst::Access::PopulationDiscovery:
-    # browse the application-defined groups Karst found, approve the ones
-    # Karst may try, optionally preview one, and see which approvals are no
-    # longer doing anything. Approving is the whole workflow -- generating
-    # Ruby configuration is kept as an advanced export path, not the way a
-    # developer is expected to finish.
-    #
-    # Kept as a pure renderer, exactly like Karst::Web::Panel: every value
-    # this module needs (the discovery result, the approved entries, stale
-    # approvals, an optional storage error, an optional generated snippet, an
-    # optional single preview) is computed by Karst::Web::Middleware and
-    # passed in, so this file never touches Active Record, the filesystem, or
-    # Karst.config directly.
-    # rubocop:disable Metrics/ModuleLength
+    # Advanced, local-only management for approvals already granted from the
+    # contextual /karst workflow. New approvals deliberately cannot be made
+    # here: this surface exists only so persistent state can be inspected and
+    # safely revoked, including after its model or scope becomes stale.
     module PopulationsPanel
-      CANDIDATE_SEPARATOR = "::"
-
-      # Why an approved entry currently does nothing (see
-      # Karst::Access::ApprovedPopulations.stale). Reported rather than
-      # silently ignored -- and never repaired automatically, since the fix
-      # is always a decision about the application, not about Karst.
       STALE_REASONS = {
         not_discovered: "no longer a discovered scope on this model — not used",
         no_principal_source: "not part of a configured user source — not used"
@@ -36,356 +18,84 @@ module Karst
       STYLE = <<~CSS
         :root{color-scheme:light dark}
         *{box-sizing:border-box}
-        body{font:16px/1.5 -apple-system,BlinkMacSystemFont,"Segoe UI",system-ui,sans-serif;max-width:48rem;margin:2rem auto;padding:0 1.25rem;color:#1a1a1a;background:#fff}
-        h1{font-size:1.4rem;margin:0 0 1rem}
-        h2{font-size:1.1rem;margin:1.5rem 0 .5rem}
-        h3{font-size:.85rem;text-transform:uppercase;letter-spacing:.05em;color:#555;margin:1.5rem 0 .6rem;border-bottom:1px solid #e2e2e2;padding-bottom:.35rem}
-        a{color:#2563eb}
-        .lead{margin:.4rem 0 1rem}
-        .hint{color:#8a5b00;font-size:.85rem;margin:.4rem 0}
-        .warning{color:#8a5b00;font-size:.85rem;margin:.4rem 0;border:1px solid #eacb6b;background:#fff7e0;border-radius:.4rem;padding:.6rem .8rem}
-        .saved{color:#0f5132;font-size:.9rem;margin:.4rem 0;border:1px solid #a6d9bb;background:#e6f4ea;border-radius:.4rem;padding:.6rem .8rem}
-        .search-box{margin:1rem 0}
-        .search-box label{display:flex;flex-direction:column;font-size:.78rem;font-weight:600;gap:.25rem;color:#444}
-        .search-box input{font:inherit;padding:.5rem .6rem;border:1px solid #ccc;border-radius:.3rem;max-width:24rem}
-        button{font:inherit;padding:.35rem .65rem;border:1px solid #ccc;border-radius:.35rem;background:#f4f4f4;cursor:pointer}
-        button:hover{background:#eaeaea}
-        button:focus-visible,input:focus-visible,summary:focus-visible,a:focus-visible{outline:2px solid #2563eb;outline-offset:2px}
-        button.primary{background:#202124;border-color:#202124;color:#fff;font-weight:600;padding:.65rem 1.15rem;font-size:.95rem;margin-top:1rem}
-        button.primary:hover{background:#3a3b3e}
-        .approved-summary{border:1px solid #ddd;border-radius:.5rem;padding:.75rem 1rem}
-        .approved-model{margin:.4rem 0}
-        .approved-model strong{display:block}
-        .approved-model ul{margin:.2rem 0 0;padding-left:1.2rem}
-        .approved-model .stale{color:#8a5b00;font-size:.85rem}
-        details.model-group{border:1px solid #e2e2e2;border-radius:.4rem;padding:.5rem .8rem;margin:.5rem 0}
-        details.model-group summary{cursor:pointer;font-weight:600;display:flex;gap:.6rem;align-items:baseline;flex-wrap:wrap}
-        details.model-group summary .count{font-weight:400;color:#666;font-size:.85rem}
-        details.model-group summary .badge{font-weight:400;font-size:.72rem;color:#0f5132;background:#e6f4ea;border-radius:.6rem;padding:.05rem .5rem}
-        .candidate-list{list-style:none;margin:.6rem 0 0;padding:0}
-        .candidate-row{display:flex;align-items:center;gap:.6rem;padding:.3rem 0;flex-wrap:wrap}
-        .candidate-row label{display:flex;align-items:center;gap:.4rem;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:.92rem}
-        .preview{flex-basis:100%;margin:.2rem 0 .3rem 1.6rem;font-size:.85rem;color:#444}
-        .preview.error{color:#8a5b00}
-        .snippet{margin:.6rem 0}
-        .snippet textarea{width:100%;min-height:6rem;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:.85rem;padding:.5rem;border:1px solid #ccc;border-radius:.3rem}
-        details.advanced{border:1px solid #e2e2e2;border-radius:.4rem;padding:.5rem .8rem;margin:1.5rem 0}
-        details.advanced summary{cursor:pointer;font-size:.9rem}
-        code{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:.9em}
-        small{color:#666}
-        @media (prefers-color-scheme:dark){
-          body{background:#16171a;color:#e4e4e6}
-          a{color:#7aa2f7}
-          h3{color:#a7a7ad;border-color:#2c2d31}
-          .search-box input,.snippet textarea{background:#1f2023;border-color:#3a3b3e;color:#e4e4e6}
-          button{background:#26272b;border-color:#3a3b3e;color:#e4e4e6}
-          button:hover{background:#303136}
-          button.primary{background:#e4e4e6;border-color:#e4e4e6;color:#16171a}
-          button.primary:hover{background:#c9c9cc}
-          .approved-summary,details.model-group,details.advanced{border-color:#33343a}
-          .hint,.warning,.approved-model .stale{color:#d8a63d}
-          .warning{background:#3a2f0d;border-color:#6b5423}
-          .saved{background:#123822;border-color:#1f5c37;color:#7fd8a4}
-          details.model-group summary .badge{background:#123822;color:#7fd8a4}
-        }
+        body{font:16px/1.5 -apple-system,BlinkMacSystemFont,"Segoe UI",system-ui,sans-serif;max-width:42rem;margin:2rem auto;padding:0 1.25rem;color:#1a1a1a;background:#fff}
+        h1{font-size:1.4rem;margin:0 0 1rem} h2{font-size:1.1rem;margin:1.5rem 0 .5rem}
+        a{color:#2563eb} .lead,small{color:#666} ul{list-style:none;padding:0}
+        li{display:flex;justify-content:space-between;align-items:center;gap:1rem;border-top:1px solid #ddd;padding:.75rem 0}
+        code{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}
+        .stale{color:#8a5b00;font-size:.85rem;display:block}
+        .warning{color:#8a5b00;font-size:.85rem;border:1px solid #eacb6b;background:#fff7e0;border-radius:.4rem;padding:.6rem .8rem}
+        .saved{color:#0f5132;font-size:.9rem;border:1px solid #a6d9bb;background:#e6f4ea;border-radius:.4rem;padding:.6rem .8rem}
+        button{font:inherit;padding:.35rem .65rem;border:1px solid #b3261e;border-radius:.35rem;background:transparent;color:#b3261e;cursor:pointer}
+        button:focus-visible,a:focus-visible{outline:2px solid #2563eb;outline-offset:2px}
+        @media (prefers-color-scheme:dark){body{background:#16171a;color:#e4e4e6}.lead,small{color:#a7a7ad}li{border-color:#33343a}.stale,.warning{color:#d8a63d}.warning{background:#3a2f0d;border-color:#6b5423}.saved{background:#123822;border-color:#1f5c37;color:#7fd8a4}button{color:#ff817a;border-color:#ff817a}}
       CSS
       private_constant :STYLE
 
-      SEARCH_SCRIPT = <<~JS
-        (function () {
-          var input = document.getElementById("karst-population-search");
-          if (!input) return;
-          var groups = document.querySelectorAll(".model-group");
-          input.addEventListener("input", function () {
-            var query = input.value.trim().toLowerCase();
-            groups.forEach(function (details) {
-              var model = (details.getAttribute("data-model") || "").toLowerCase();
-              var modelMatches = query === "" || model.indexOf(query) !== -1;
-              var rows = details.querySelectorAll(".candidate-row");
-              var anyRowMatches = false;
-              rows.forEach(function (row) {
-                var name = (row.getAttribute("data-name") || "").toLowerCase();
-                var rowMatches = query === "" || modelMatches || name.indexOf(query) !== -1;
-                row.style.display = rowMatches ? "" : "none";
-                if (rowMatches) anyRowMatches = true;
-              });
-              var show = query === "" || modelMatches || anyRowMatches;
-              details.style.display = show ? "" : "none";
-              if (query !== "" && show) details.open = true;
-            });
-          });
-        })();
-      JS
-      private_constant :SEARCH_SCRIPT
-
-      COPY_SCRIPT = <<~JS
-        (function () {
-          var button = document.getElementById("karst-copy-snippet");
-          var field = document.getElementById("karst-snippet-code");
-          if (!button || !field || !navigator.clipboard) return;
-          button.addEventListener("click", function () {
-            navigator.clipboard.writeText(field.value).then(function () {
-              button.textContent = "Copied";
-              setTimeout(function () { button.textContent = "Copy"; }, 1500);
-            }, function () {});
-          });
-        })();
-      JS
-      private_constant :COPY_SCRIPT
-
-      # rubocop:disable Metrics/ClassLength
       class << self
-        # `approved` and each entry of `stale` are anything exposing
-        # #model_name/#method_name -- in practice
-        # Karst::Access::PopulationApprovals::Entry.
-        # rubocop:disable Metrics/ParameterLists
-        def render(discovery:, approved: [], stale: [], snippet: nil, preview: nil, storage_path: nil,
-                   storage_error: nil, saved: false)
-          nonce = SecureRandom.hex(16)
-          state = { approved: approved, stale: stale, snippet: snippet, preview: preview,
-                    storage_path: storage_path, storage_error: storage_error, saved: saved }
-          [200, headers(nonce), [document(discovery, state, nonce)]]
+        def render(approved: [], stale: [], storage_path: nil, storage_error: nil, revoked: false)
+          [200, headers, [document(approved, stale, storage_path, storage_error, revoked)]]
         end
-        # rubocop:enable Metrics/ParameterLists
 
         private
 
-        def headers(nonce)
-          csp = "default-src 'none'; style-src 'unsafe-inline'; script-src 'nonce-#{nonce}'; frame-ancestors 'none'"
+        def headers
           {
             "content-type" => "text/html; charset=utf-8", "cache-control" => "no-store",
-            "x-robots-tag" => "noindex, nofollow", "x-frame-options" => "DENY", "content-security-policy" => csp
+            "x-robots-tag" => "noindex, nofollow", "x-frame-options" => "DENY",
+            "content-security-policy" => "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'"
           }
         end
 
-        # The per-candidate Preview and the advanced snippet export submit
-        # through their own form, referenced by `form=` rather than nested
-        # inside the approval form (HTML forbids nesting): pressing either
-        # therefore cannot smuggle checkbox state into a save, so the only
-        # way to change what Karst may execute is the explicit approve
-        # button.
-        def document(discovery, state, nonce)
+        def document(approved, stale, storage_path, storage_error, revoked)
           <<~HTML
-            <!DOCTYPE html>
-            <html lang="en"><head><meta charset="utf-8"><title>Karst — Candidate groups</title>
-            <style>#{STYLE}</style>
-            </head><body>
-            <h1>Karst</h1>
+            <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Karst — Manage approvals</title>
+            <style>#{STYLE}</style></head><body><h1>Karst</h1>
             <p><a href="/karst">&larr; Back to route evidence</a></p>
-            <h2>Candidate groups</h2>
-            <p class="lead">Approving a group lets Karst try a few existing users from it when the ordinary sample
-            fails. Approving is not a claim that the group grants access — only running an analysis against a route
-            shows what actually happens.</p>
-            #{saved_notice(state[:saved])}
-            #{storage_error(state[:storage_error])}
-            #{load_warning(discovery)}
-            <form id="karst-secondary" method="post" action="/karst/populations"></form>
-            <form method="post" action="/karst/populations">
-            #{search_box}
-            #{approved_section(state[:approved], state[:stale])}
-            #{model_groups_section(discovery, state[:approved], state[:preview])}
-            <button type="submit" name="save_approvals" value="1" class="primary">Approve selected groups</button>
-            </form>
-            #{advanced_section(state[:snippet])}
-            #{storage_note(state[:storage_path])}
-            <script nonce="#{nonce}">#{SEARCH_SCRIPT}#{COPY_SCRIPT}</script>
-            </body></html>
+            <h2>Manage population approvals</h2>
+            <p class="lead">Advanced local-state management. Approve new candidate populations only when a failed route analysis offers them on <code>/karst</code>.</p>
+            #{notice(revoked)}#{storage_error_message(storage_error)}#{approval_list(approved, stale)}
+            #{storage_note(storage_path)}</body></html>
           HTML
         end
 
-        def saved_notice(saved)
-          return "" unless saved
-
-          "<p class=\"saved\" role=\"status\">Approvals saved.</p>"
-        end
-
-        def storage_error(error)
-          return "" unless error
-
-          "<p class=\"warning\" role=\"alert\">#{escape(error)}</p>"
-        end
-
-        def storage_note(path)
-          return "" unless path
-
-          "<p><small>Approvals are stored locally in <code>#{escape(path)}</code> as plain model and " \
-            "scope names — no user data, no Ruby. Delete that file to reset every approval.</small></p>"
-        end
-
-        def load_warning(discovery)
-          return "" unless discovery.load_warning
-
-          "<p class=\"warning\" role=\"alert\">#{escape(discovery.load_warning)}</p>"
-        end
-
-        def search_box
-          <<~HTML
-            <div class="search-box">
-            <label>Search groups or models
-            <input type="search" id="karst-population-search" placeholder="e.g. admin, User, subscription">
-            </label>
-            </div>
-          HTML
-        end
-
-        # -- Approved summary --------------------------------------------------
-
-        def approved_section(approved, stale)
-          body = if approved.empty?
-                   "<p>No groups approved yet.</p>"
-                 else
-                   approved.group_by(&:model_name).sort.map do |model_name, group|
-                     approved_model(model_name, group, stale)
-                   end.join
-                 end
-          "<section class=\"approved-summary\"><h3>Approved (#{approved.size})</h3>#{body}</section>"
-        end
-
-        def approved_model(model_name, entries, stale)
-          items = entries.sort_by { |entry| entry.method_name.to_s }.map do |entry|
-            "<li>#{escape(entry.method_name)}#{stale_note(entry, stale)}</li>"
-          end.join
-          "<div class=\"approved-model\"><strong>#{escape(model_name)}</strong><ul>#{items}</ul></div>"
-        end
-
-        def stale_note(entry, stale)
-          match = stale.find { |item, _reason| same_candidate?(item, entry) }
-          return "" unless match
-
-          " <span class=\"stale\">— #{escape(STALE_REASONS.fetch(match.last, 'not used'))}</span>"
-        end
-
-        def same_candidate?(left, right)
-          left.model_name.to_s == right.model_name.to_s && left.method_name.to_s == right.method_name.to_s
-        end
-
-        # -- Model groups ------------------------------------------------------
+        def approval_list(approved, stale)
+          return "<p>No population approvals are stored.</p>" if approved.empty?
 
-        def model_groups_section(discovery, approved, preview)
-          groups = discovery.model_groups.reject { |group| group.candidate_names.empty? }
-          body = if groups.empty?
-                   "<p>No candidate groups were discovered.</p>"
-                 else
-                   groups.map { |group| model_group(group, approved, preview) }.join
-                 end
-          "<section class=\"model-groups\"><h3>Available models</h3>#{body}</section>"
+          items = approved.map { |entry| approval_item(entry, stale) }.join
+          "<ul>#{items}</ul>"
         end
 
-        def model_group(group, approved, preview)
-          approved_names = approved.select { |entry| entry.model_name == group.model_name }
-                                   .map { |entry| entry.method_name.to_s }
-          open = approved_names.any? ? " open" : ""
-          rows = group.candidate_names.map { |name| candidate_row(group, name, approved_names, preview) }.join
+        def approval_item(entry, stale)
+          match = stale.find { |item, _reason| item.matches?(entry.model_name, entry.method_name) }
+          note = match ? "<span class=\"stale\">#{escape(STALE_REASONS.fetch(match.last, 'not used'))}</span>" : ""
           <<~HTML
-            <details class="model-group" data-model="#{escape(group.model_name)}"#{open}>
-            <summary>#{model_summary(group)}</summary>
-            <ul class="candidate-list">#{rows}</ul>
-            </details>
+            <li><span><code>#{escape(entry.display_label)}</code>#{note}</span>
+            <form method="post" action="/karst/populations"><input type="hidden" name="operation" value="revoke_population">
+            <input type="hidden" name="population" value="#{escape(entry.model_name)}::#{escape(entry.method_name)}">
+            <button type="submit">Revoke</button></form></li>
           HTML
         end
 
-        def model_summary(group)
-          count = group.candidate_names.size
-          "#{escape(group.model_name)} <span class=\"count\">#{count} group#{'s' unless count == 1}</span>" \
-            "#{principal_badge(group)}"
-        end
-
-        def principal_badge(group)
-          return "" unless group.principal_source
-
-          "<span class=\"badge\">user source: #{escape(group.principal_source)}</span>"
-        end
-
-        def candidate_row(group, method_name, approved_names, preview)
-          key = candidate_key(group.model_name, method_name)
-          checked = approved_names.include?(method_name.to_s)
-          box = "<input type=\"checkbox\" name=\"population[]\" value=\"#{escape(key)}\"#{' checked' if checked}>"
-          preview_button = "<button type=\"submit\" form=\"karst-secondary\" name=\"preview\" " \
-                           "value=\"#{escape(key)}\">Preview</button>"
-          label = "<label>#{box} #{escape(method_name)}</label>"
-          "<li class=\"candidate-row\" data-name=\"#{escape(method_name)}\">#{label}" \
-            "#{preview_button}#{preview_result(group, method_name, preview)}</li>"
-        end
-
-        def preview_result(group, method_name, preview)
-          unless preview && preview.model_name == group.model_name && preview.method_name.to_s == method_name.to_s
-            return ""
-          end
-
-          preview.resolved ? preview_success(preview) : preview_failure(preview)
-        end
-
-        def preview_success(preview)
-          return "<p class=\"preview\">Preview: no matching records currently.</p>" if preview.records.empty?
-
-          labels = preview.records.map { |record| record_label(record) }.join(", ")
-          "<p class=\"preview\">Preview (up to #{Access::PopulationPreview::PREVIEW_LIMIT}): #{escape(labels)}</p>"
-        end
-
-        def preview_failure(preview)
-          "<p class=\"preview error\">Preview: #{escape(preview.error)}.</p>"
+        def notice(revoked)
+          revoked ? '<p class="saved" role="status">Approval revoked.</p>' : ""
         end
 
-        # Deliberately generic -- "ModelName #id" only, never an arbitrary
-        # attribute dump, regardless of whether the previewed model happens
-        # to be a configured principal source. A discovered candidate may
-        # belong to any application model, not only ones a developer has
-        # already reviewed for what is safe to display.
-        def record_label(record)
-          primary_key = record.class.respond_to?(:primary_key) ? record.class.primary_key : "id"
-          "#{record.class.name} ##{record.public_send(primary_key)}"
+        def storage_error_message(error)
+          error ? "<p class=\"warning\" role=\"alert\">#{escape(error)}</p>" : ""
         end
 
-        # -- Advanced: Ruby export ---------------------------------------------
-
-        # Approving is the workflow; this stays available for an application
-        # that would rather commit its populations as reviewable Ruby (a
-        # shared or CI environment, where a machine-local approval file is
-        # deliberately not consulted).
-        def advanced_section(snippet)
-          <<~HTML
-            <details class="advanced"#{' open' if snippet}><summary>Advanced: export approvals as Ruby
-            configuration</summary>
-            <p><small>Explicit <code>config.principal_populations</code> keeps working exactly as before and always
-            takes precedence over an approval of the same name. Karst never writes to your application's files.
-            </small></p>
-            <button type="submit" form="karst-secondary" name="generate_snippet" value="1">Generate snippet from
-            approvals</button>
-            #{snippet_section(snippet)}
-            </details>
-          HTML
-        end
-
-        def snippet_section(snippet)
-          return "" unless snippet
-
-          <<~HTML
-            <div class="snippet">
-            <textarea id="karst-snippet-code" readonly>#{escape(snippet.code)}</textarea>
-            <p><button type="button" id="karst-copy-snippet">Copy</button></p>
-            #{unwired_note(snippet)}
-            </div>
-          HTML
-        end
-
-        def unwired_note(snippet)
-          return "" if snippet.unwired.empty?
-
-          names = snippet.unwired.map { |c| "#{c.model_name}.#{c.method_name}" }.join(", ")
-          "<p class=\"hint\">#{snippet.unwired.size} approved group(s) are not part of a configured " \
-            "user source yet and were left out of the snippet above: #{escape(names)}.</p>"
-        end
+        def storage_note(path)
+          return "" unless path
 
-        def candidate_key(model_name, method_name)
-          "#{model_name}#{CANDIDATE_SEPARATOR}#{method_name}"
+          "<p><small>Approvals are stored locally in <code>#{escape(path)}</code> " \
+            "as model and scope names only.</small></p>"
         end
 
         def escape(value)
           CGI.escapeHTML(value.to_s)
         end
       end
-      # rubocop:enable Metrics/ClassLength
     end
-    # rubocop:enable Metrics/ModuleLength
   end
 end

data/lib/karst.rb

@@ -17,13 +17,11 @@ require_relative "karst/access/principal_source"
 require_relative "karst/access/principal_sampler"
 require_relative "karst/access/principal_selection"
 require_relative "karst/access/search"
-require_relative "karst/access/resource_evidence"
 require_relative "karst/access/candidate_population"
 require_relative "karst/access/population_discovery"
 require_relative "karst/access/population_approvals"
+require_relative "karst/access/population_approval"
 require_relative "karst/access/approved_populations"
-require_relative "karst/access/population_preview"
-require_relative "karst/access/population_config_snippet"
 require_relative "karst/access/principal_source_selection"
 require_relative "karst/access/selected_principal_sources"
 

data/lib/rails/commands/karst/mcp/mcp_command.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 require "rails/command"
-require "karst/mcp/server"
 require_relative "../boot"
 
 module Rails
@@ -17,9 +16,23 @@ module Rails
 
         desc "Run Karst's MCP server over stdio, exposing the verify_access tool"
         def perform(*)
+          load_mcp!
           boot_karst_application!
           ::Karst::Mcp::Server.run!
         end
+
+        private
+
+        def load_mcp!
+          begin
+            gem "mcp", "~> 0.9.0"
+          rescue Gem::LoadError
+            abort "Karst MCP requires the optional dependency. " \
+                  'Add gem "mcp", "~> 0.9.0" to your Gemfile and run bundle install.'
+          end
+
+          require "karst/mcp/server"
+        end
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: karst
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Karst contributors
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-08-12 00:00:00.000000000 Z
+date: 2026-08-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -37,7 +37,7 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 0.9.0
-  type: :runtime
+  type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
@@ -59,6 +59,7 @@ files:
 - README.md
 - SECURITY.md
 - docs/advanced-configuration.md
+- docs/rails8-authentication.md
 - lib/generators/karst/install/install_generator.rb
 - lib/generators/karst/install/templates/karst_identity_controller.rb
 - lib/generators/karst/install/templates/karst_initializer.rb
@@ -66,16 +67,15 @@ files:
 - lib/karst/access/approved_populations.rb
 - lib/karst/access/candidate_population.rb
 - lib/karst/access/database_isolation.rb
+- lib/karst/access/population_approval.rb
 - lib/karst/access/population_approvals.rb
-- lib/karst/access/population_config_snippet.rb
 - lib/karst/access/population_discovery.rb
-- lib/karst/access/population_preview.rb
+- lib/karst/access/population_revocation.rb
 - lib/karst/access/principal_sampler.rb
 - lib/karst/access/principal_selection.rb
 - lib/karst/access/principal_source.rb
 - lib/karst/access/principal_source_selection.rb
 - lib/karst/access/probe_application.rb
-- lib/karst/access/resource_evidence.rb
 - lib/karst/access/search.rb
 - lib/karst/access/selected_principal_sources.rb
 - lib/karst/access/sensitive_attribute_names.rb
@@ -89,17 +89,11 @@ files:
 - lib/karst/mcp/server.rb
 - lib/karst/mcp/verify_access_tool.rb
 - lib/karst/railtie.rb
-- lib/karst/spec/catalog.rb
-- lib/karst/spec/example_observation.rb
-- lib/karst/spec/observer.rb
-- lib/karst/spec/principal.rb
-- lib/karst/spec/reporter.rb
-- lib/karst/spec/request_observation.rb
-- lib/karst/spec/scenario.rb
 - lib/karst/value.rb
 - lib/karst/version.rb
 - lib/karst/web/badge.rb
 - lib/karst/web/browser_identity.rb
+- lib/karst/web/csrf.rb
 - lib/karst/web/locality.rb
 - lib/karst/web/middleware.rb
 - lib/karst/web/panel.rb
@@ -108,7 +102,6 @@ files:
 - lib/rails/commands/karst/boot.rb
 - lib/rails/commands/karst/mcp/mcp_command.rb
 - lib/rails/commands/karst/verify/verify_command.rb
-- lib/tasks/karst.rake
 homepage: https://github.com/SilenceDogood1984/karst
 licenses:
 - MIT

data/lib/karst/access/population_config_snippet.rb

@@ -1,67 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "../value"
-
-module Karst
-  module Access
-    # Renders a developer's curated selection of
-    # Karst::Access::PopulationDiscovery::Candidate into a Ruby config
-    # snippet they can copy into their own Karst.configure block. Karst
-    # never writes to the host application's files on its own -- the
-    # developer stays in control of what actually gets committed (see
-    # README "Curation / persistence").
-    module PopulationConfigSnippet
-      # wired is the subset actually rendered into `code` (every selected
-      # candidate whose model matches a configured principal source).
-      # unwired is every selected candidate that is not wired into
-      # anything yet -- present so the UI can say so honestly instead of
-      # silently dropping a selection (see README "Principal vs artifact
-      # populations": this release only wires principal populations).
-      Result = Value.define(:code, :wired, :unwired)
-
-      class << self
-        def generate(candidates)
-          unique = candidates.uniq { |candidate| [candidate.model_name, candidate.method_name] }
-          wired, unwired = unique.partition(&:principal_source)
-          Result.new(code: render(wired), wired: wired, unwired: unwired)
-        end
-
-        private
-
-        def render(wired)
-          return "# Select at least one population above to generate a configuration snippet.\n" if wired.empty?
-
-          by_source = wired.group_by(&:principal_source)
-          by_source.size == 1 && by_source.keys.first == :default ? flat(by_source.fetch(:default)) : nested(by_source)
-        end
-
-        def flat(candidates)
-          "config.principal_populations = {\n#{entries(candidates, indent: 2)}\n}\n"
-        end
-
-        def nested(by_source)
-          sources = by_source.map do |source, group|
-            "  #{source_key(source)}: {\n    populations: {\n#{entries(group, indent: 6)}\n    }\n  }"
-          end.join(",\n")
-          "config.principal_sources = {\n#{sources}\n}\n"
-        end
-
-        # Sorted by model then method so the same selection always renders
-        # byte-identical output, regardless of checkbox submission order.
-        def entries(candidates, indent:)
-          pad = " " * indent
-          sorted = candidates.sort_by { |candidate| [candidate.model_name, candidate.method_name.to_s] }
-          sorted.map { |candidate| entry(candidate, pad) }.join(",\n")
-        end
-
-        def entry(candidate, pad)
-          "#{pad}#{candidate.method_name}: -> { #{candidate.model_name}.#{candidate.method_name} }"
-        end
-
-        def source_key(source)
-          source.to_s =~ /\A[a-zA-Z_][a-zA-Z0-9_]*\z/ ? source : source.inspect
-        end
-      end
-    end
-  end
-end