@arjunkhera/atlas 0.4.37 → 0.4.39

package/work/lib/delivery.mjs

@@ -266,7 +266,7 @@ export function correctionsOf(marks = []) {
 }
 
 export function createDeliveryVerbs(core) {
-  const { client, label, now, typeNamed, kindOf, registry, requireProduct, requireItem, ownerPresent, patch, create, edge, landed, alreadyPatched, readGitHub, readLive } = core;
+  const { client, label, now, typeNamed, kindOf, registry, requireProduct, requireItem, patch, create, edge, landed, alreadyPatched, readGitHub, readLive } = core;
 
   const github = async (path) => {
     if (typeof readGitHub !== 'function') refuse('this verb needs a GitHub reader; the server supplies one');
@@ -324,9 +324,7 @@ export function createDeliveryVerbs(core) {
     }
     return null;
   }
-  // The reopen door (R9). The owner-present flag, or the lead in this session.
-  const requireOwnerOrLead = (verb) => { if (!ownerPresent && label.agent !== 'lead') refuse(`${verb} is for the owner or the lead in session; this session is agent "${label.agent}"`); };
-
+  // The reopen door (R9) is a row of the role table (roles.mjs, R20): the lead.
   const markOf = async (id, itemId) => {
     const type = await typeNamed('mark');
     let entity;
@@ -432,9 +430,11 @@ export function createDeliveryVerbs(core) {
   //
   // A decision record is an Engram entity, and any Engram writer can make one
   // that looks right. So the acceptance is not taken from the record alone:
-  // passing accepted_red needs the owner-present flag, the same flag that
-  // decision_record needs. A forged record then gives a caller nothing it
-  // could not write itself (security review of this change, finding 1).
+  // passing accepted_red needs the lead role, the same role that
+  // decision_record needs (the role table, roles.mjs, R20). A forged record
+  // then gives a caller nothing it could not write itself (security review
+  // of this change, finding 1). The lead role is not the owner's own act; the
+  // signed waiver below is.
   // R17 line 6: a decision record alone does not waive a red check. The owner
   // signs a waiver act with his security key (R72, design
   // docs/design-docs/signed-act/) and posts the block on the pull request.
@@ -530,10 +530,9 @@ export function createDeliveryVerbs(core) {
 
   const verbs = {
     // The delivering agent marks its own change done, after the verb runs the
-    // three live checks itself. No owner flag: the agent that shipped it calls
-    // this, and the lead catches up a delivery made outside a session (R2).
+    // three live checks itself. The role table gives it to the lead, and
+    // accepted_red, the owner's words, to the lead too (roles.mjs, R20).
     async item_done(args, requestId, meta) {
-      if (args.accepted_red !== undefined && !ownerPresent) refuse('accepted_red needs the owner-present flag on the server host (ATLAS_WORK_OWNER_PRESENT=1): only the owner waives a red check');
       const item = await requireItem(args.item_id);
       const fields = item.fields ?? {};
       const replay = alreadyPatched(item, requestId, meta);
@@ -750,11 +749,10 @@ export function createDeliveryVerbs(core) {
       };
     },
 
-    // Reopen: the owner or the lead in session, with a reason and the failed
+    // Reopen: the lead in session, with a reason and the failed
     // check as a URL. It appends a mark that corrects the delivery. The
     // delivery mark is never touched (R9).
     async item_reopen(args, requestId, meta) {
-      requireOwnerOrLead('item reopen');
       const item = await requireItem(args.item_id);
       const fields = item.fields ?? {};
       const reason = text(args.reason, 'reason', { max: 4000 });

package/work/lib/questions.mjs

@@ -119,7 +119,7 @@ export function itemLine(item, product, lifecycle = 'active') {
 }
 
 export function createQuestionVerbs(core) {
-  const { client, label, now, typeNamed, kindOf, registry, requireProduct, requireItem, requireOwner, patch, create, edge, landed, alreadyPatched, findCreated } = core;
+  const { client, label, now, typeNamed, kindOf, registry, requireProduct, requireItem, patch, create, edge, landed, alreadyPatched, findCreated } = core;
 
   async function recordOfKind(id, kind, name) {
     text(id, name, { max: 200 });
@@ -193,7 +193,6 @@ export function createQuestionVerbs(core) {
 
     // The owner answers. One call writes the decision, the receipt, and closes the question.
     async question_answer(args, requestId, meta) {
-      requireOwner('question answer');
       const question = await recordOfKind(args.question_id, 'question', 'question_id');
       const answer = text(args.text, 'text', { max: MAX_RENDERED });
       const date = isoDate(args.date, 'date');
@@ -229,7 +228,6 @@ export function createQuestionVerbs(core) {
 
     // The owner speaks outside a question. D2: refuses with no verbatim text, no date.
     async decision_record(args, requestId, meta) {
-      requireOwner('decision record');
       const decisionText = text(args.text, 'text', { max: MAX_RENDERED });
       const date = isoDate(args.date, 'date');
       const source = text(args.source, 'source', { optional: true, max: 500 }) ?? '';

package/work/lib/roles.mjs

@@ -0,0 +1,135 @@
+// Roadmap R20: the roles of the tools server, and the one table that says
+// who may call each verb. Every guard reads only this table.
+//
+// The probe of 26 October 2026 found no harness marker that tells a lead, a
+// sub-agent and a scheduled run apart: a sub-agent shares the lead's server
+// process, and a scheduled run carries the same variables as a project
+// thread. So the role comes from two things only:
+//   1. the key type, which gives the widest role: a user key gives lead, an
+//      agent key gives routine. Today the server starts with a user key
+//      only, so routine comes from the marker until R22 opens the agent key;
+//   2. the launcher's marker ATLAS_WORK_ROLE, which can only narrow it.
+// No role is the owner. The lead writes down the owner's words; the owner's
+// own act is a signed act (R72), which the owner door reads (R27).
+import { refuse } from './verb-fields.mjs';
+
+// Widest first. A role may call what a later role may call, and more.
+export const ROLES = Object.freeze(['lead', 'routine', 'crew']);
+const ALL = ROLES;
+const LEAD = Object.freeze(['lead']);
+const LEAD_AND_ROUTINE = Object.freeze(['lead', 'routine']);
+const rank = (role) => ROLES.indexOf(role);
+
+export const READ_ROLES = ALL;
+
+// Each write verb, and atlas_upgrade, with the roles that may call it.
+// owner_words marks a verb whose record is the owner's words, written down
+// by the lead. The stamp still says lead: it is never the owner's own act.
+export const VERB_ROLES = Object.freeze({
+  setup: { roles: LEAD },
+  product_add: { roles: LEAD },
+  product_edit: { roles: LEAD },
+  repo_add: { roles: LEAD },
+  repo_edit: { roles: LEAD },
+  item_propose: { roles: LEAD_AND_ROUTINE },
+  item_lock: { roles: LEAD, owner_words: true },
+  item_split: { roles: LEAD },
+  item_park: { roles: LEAD, owner_words: true },
+  item_resume: { roles: LEAD, owner_words: true },
+  item_drop: { roles: LEAD, owner_words: true },
+  item_edit: { roles: LEAD },
+  item_block: { roles: LEAD },
+  item_unblock: { roles: LEAD },
+  item_stage: { roles: LEAD },
+  item_link: { roles: LEAD },
+  item_comment: { roles: LEAD_AND_ROUTINE },
+  step_in_name: { roles: LEAD },
+  lesson_record: { roles: LEAD },
+  question_ask: { roles: LEAD },
+  question_answer: { roles: LEAD, owner_words: true },
+  decision_record: { roles: LEAD, owner_words: true },
+  item_done: { roles: LEAD },
+  item_reopen: { roles: LEAD },
+  atlas_upgrade: { roles: LEAD },
+});
+
+// The owner-only arguments: a verb that one role may call, with an argument
+// that only a narrower set of roles may pass. when says if a call holds it.
+export const ARGUMENT_ROLES = Object.freeze({
+  'item_edit.title': { verb: 'item_edit', roles: LEAD, owner_words: true, when: (args) => args.title !== undefined },
+  'item_edit.plan': { verb: 'item_edit', roles: LEAD, owner_words: true, when: (args) => args.plan !== undefined },
+  'item_comment.voice': { verb: 'item_comment', roles: LEAD, owner_words: true, name: '`voice: owner`', when: (args) => args.voice === 'owner' },
+  'item_done.accepted_red': { verb: 'item_done', roles: LEAD, owner_words: true, when: (args) => args.accepted_red !== undefined },
+  'atlas_upgrade.check': { verb: 'atlas_upgrade', roles: ALL, widens: true, name: '`check: true`', when: (args) => args.check === true },
+});
+
+// A widening row replaces the roles of its verb, so it would undo a
+// narrowing row on the same verb. The table refuses to load with both.
+for (const [key, argument] of Object.entries(ARGUMENT_ROLES)) {
+  if (!argument.widens) continue;
+  const other = Object.keys(ARGUMENT_ROLES).find((name) => name !== key && ARGUMENT_ROLES[name].verb === argument.verb);
+  if (other) throw new Error(`role table: ${key} widens ${argument.verb}, so ${other} may not narrow it`);
+}
+
+const KEY_ROLES = Object.freeze({ user: 'lead', agent: 'routine' });
+
+// The role of a server. keyType is the principal_type of the Engram key;
+// marker is ATLAS_WORK_ROLE. A marker the table does not know narrows to the
+// least role, so a typo never widens. The answer says why, for the
+// instructions and the health file.
+export function roleOf({ keyType, marker } = {}) {
+  const fromKey = KEY_ROLES[keyType] ?? 'crew';
+  const key = keyType === 'agent' ? 'an agent key' : keyType === 'user' ? 'a user key' : 'no known key';
+  const said = typeof marker === 'string' ? marker.trim() : '';
+  if (!said) return { role: fromKey, from: key };
+  const fromMarker = ROLES.includes(said) ? said : 'crew';
+  const role = rank(fromMarker) > rank(fromKey) ? fromMarker : fromKey;
+  const why = ROLES.includes(said) ? `ATLAS_WORK_ROLE=${said}` : `ATLAS_WORK_ROLE=${said}, which is not a role`;
+  return { role, from: `${key} with ${why}` };
+}
+
+// The roles that may make this call. A read verb is open to every role.
+export function rolesFor(verb, args = {}, { readVerbs = [] } = {}) {
+  if (readVerbs.includes(verb)) return READ_ROLES;
+  const row = VERB_ROLES[verb];
+  if (!row) return null;
+  let roles = row.roles;
+  for (const argument of Object.values(ARGUMENT_ROLES)) {
+    if (argument.verb !== verb || !argument.when(args)) continue;
+    roles = argument.widens ? argument.roles : roles.filter((role) => argument.roles.includes(role));
+  }
+  return roles;
+}
+
+// The name of an argument row, as the docs and the refusals print it.
+const nameOf = (argument) => argument.name ?? `\`${Object.keys(ARGUMENT_ROLES).find((key) => ARGUMENT_ROLES[key] === argument).split('.')[1]}\``;
+
+// The one guard. It refuses a call that the table does not give this role.
+export function allow(role, verb, args = {}, { readVerbs = [], from } = {}) {
+  const roles = rolesFor(verb, args, { readVerbs });
+  if (!roles) refuse(`${verb} has no row in the role table (packages/atlas/work/lib/roles.mjs); it is refused for every role`);
+  if (roles.includes(role)) return;
+  const named = Object.values(ARGUMENT_ROLES).find((argument) => argument.verb === verb && argument.when(args) && !argument.widens && !argument.roles.includes(role));
+  const what = named ? `${verb} with ${nameOf(named).replaceAll('`', '')}` : verb;
+  const who = (named?.roles ?? roles).join(' or ');
+  refuse(`${what} is for the ${who}. This server runs as ${role}${from ? `, from ${from}` : ''}`);
+}
+
+// The Who cell of work/VERBS.md for one verb, generated from the table
+// (R20 line 7). node work/who.mjs --write puts it in the file.
+export function whoCell(verb, { readVerbs = [] } = {}) {
+  if (readVerbs.includes(verb) && !VERB_ROLES[verb]) return 'every role';
+  const row = VERB_ROLES[verb];
+  if (!row) return null;
+  const parts = [row.roles.join(', ')];
+  const words = [];
+  for (const argument of Object.values(ARGUMENT_ROLES)) {
+    if (argument.verb !== verb) continue;
+    const same = argument.roles.length === row.roles.length && argument.roles.every((role) => row.roles.includes(role));
+    if (!same) parts.push(`${argument.roles.length === ROLES.length ? 'every role' : argument.roles.join(', ')} for ${nameOf(argument)}`);
+    if (argument.owner_words) words.push(nameOf(argument));
+  }
+  if (row.owner_words) parts.push("the owner's words");
+  if (words.length) parts.push(`${words.join(' and ')} ${words.length === 1 ? 'is' : 'are'} the owner's words`);
+  return parts.join('; ');
+}

package/work/lib/verbs.mjs

@@ -22,6 +22,7 @@ import { createCapabilityVerbs, CAPABILITY_READ_VERBS, hubOf } from './capabilit
 import { createRoundupVerbs, ROUNDUP_READ_VERBS } from './roundup.mjs';
 import { createActivityVerbs, diffOf, LOG_VERBS, ENTRY_VERBS, ACTIVITY_WRITE_VERBS, ACTIVITY_READ_VERBS } from './activity.mjs';
 import { createStepInVerbs, STEP_IN_WRITE_VERBS, STEP_IN_READ_VERBS } from './step-ins.mjs';
+import { ROLES, allow } from './roles.mjs';
 import { createLessonVerbs, LESSON_WRITE_VERBS, LESSON_READ_VERBS } from './lessons.mjs';
 
 export { VerbError, canonicalJson, sha256, COSTS, LIVE_LIFECYCLES, REPO_KINDS, LIVE_KINDS, repoKinds };
@@ -106,12 +107,18 @@ const renderHandle = (value, handle) => JSON.parse(JSON.stringify(value).replace
 // Sortable form of a three-part version, for "is the tenant ahead of us?".
 const semver = (value) => String(value).split('.').map((part) => String(Number(part) || 0).padStart(6, '0')).join('.');
 
-export function createVerbs({ client, store, writer, session, agent = 'lead', boundClient = null, ownerPresent = false, readGitHub, readLive, now = () => new Date().toISOString() } = {}) {
+// The verbs that write nothing. The role table opens them to every role (R20).
+export const READ_VERBS = Object.freeze(['registry_list', ...QUESTION_READ_VERBS, ...DELIVERY_READ_VERBS, ...CAPABILITY_READ_VERBS, ...ROUNDUP_READ_VERBS, ...ACTIVITY_READ_VERBS, ...STEP_IN_READ_VERBS, ...LESSON_READ_VERBS]);
+
+export function createVerbs({ client, store, writer, session, agent, role, roleFrom, boundClient = null, readGitHub, readLive, now = () => new Date().toISOString() } = {}) {
   if (!client) throw new TypeError('client is required');
   if (!store) throw new TypeError('store (the request journal) is required');
   if (typeof writer?.token_id !== 'string' || !writer.token_id) throw new TypeError('writer.token_id is required');
   if (typeof session !== 'string' || !session.trim()) throw new TypeError('session is required; the server supplies it');
-  const label = Object.freeze({ token_id: writer.token_id, session, agent, ...(boundClient ? { client: String(boundClient) } : {}) });
+  // Roadmap R20: the role decides what this server may call, and the
+  // writer stamp names it. The agent label is a name only; it gives no right.
+  if (!ROLES.includes(role)) throw new TypeError(`role must be one of ${ROLES.join(', ')}`);
+  const label = Object.freeze({ token_id: writer.token_id, session, agent: agent ?? role, role, ...(boundClient ? { client: String(boundClient) } : {}) });
   let handleCache = null, typesCache = null;
 
   async function handle() {
@@ -191,7 +198,6 @@ export function createVerbs({ client, store, writer, session, agent = 'lead', bo
     if (entity.state && entity.state !== 'active') refuse(`item ${id} is ${entity.state}, not active in the graph`);
     return entity;
   }
-  const requireOwner = (verb) => { if (!ownerPresent) refuse(`${verb} needs the owner-present flag on the server host (ATLAS_WORK_OWNER_PRESENT=1)`); };
 
   // fields may be a function of the record as read, so a retry after a 409
   // recomputes it from the newer record. guard, when given, is checked again on
@@ -264,7 +270,6 @@ export function createVerbs({ client, store, writer, session, agent = 'lead', bo
 
   const verbs = {
     async setup(args) {
-      requireOwner('setup');
       const publisherHandle = await handle();
       const rendered = renderHandle(manifestCurrent, publisherHandle);
       if (rendered.name !== 'atlas-work' || rendered.version !== MANIFEST_VERSION) throw new Error(`local manifest must be atlas-work ${MANIFEST_VERSION}`);
@@ -321,7 +326,6 @@ export function createVerbs({ client, store, writer, session, agent = 'lead', bo
     },
 
     async product_add(args, requestId, meta) {
-      requireOwner('product add');
       const registryId = text(args.registry_id, 'registry_id', { max: 64 });
       if (!PRODUCT_ID.test(registryId)) refuse('registry_id must be a lowercase slug: letters, digits and hyphens, for example "engram"');
       const name = text(args.name, 'name', { max: 200 });
@@ -347,7 +351,6 @@ export function createVerbs({ client, store, writer, session, agent = 'lead', bo
     },
 
     async product_edit(args, requestId, meta) {
-      requireOwner('product edit');
       const registryId = text(args.registry_id, 'registry_id', { max: 64 });
       const reg = await registry();
       const record = await requireProduct(registryId, reg);
@@ -376,7 +379,6 @@ export function createVerbs({ client, store, writer, session, agent = 'lead', bo
     },
 
     async repo_add(args, requestId, meta) {
-      requireOwner('repo add');
       if (typeof readGitHub !== 'function') refuse('repo add needs a GitHub reader for the push-rights check');
       const registryId = text(args.registry_id, 'registry_id', { max: 200 });
       if (!REPO_ID.test(registryId)) refuse('registry_id must be a GitHub "owner/repo" name');
@@ -401,7 +403,6 @@ export function createVerbs({ client, store, writer, session, agent = 'lead', bo
     },
 
     async repo_edit(args, requestId, meta) {
-      requireOwner('repo edit');
       const registryId = text(args.registry_id, 'registry_id', { max: 200 });
       const reg = await registry();
       const record = reg.repos.get(registryId);
@@ -425,7 +426,6 @@ export function createVerbs({ client, store, writer, session, agent = 'lead', bo
     },
 
     async item_propose(args, requestId, meta) {
-      requireOwner('item propose');
       const title = text(args.title, 'title', { max: 300 });
       const reg = await registry();
       const product = await requireProduct(args.product, reg);
@@ -443,7 +443,6 @@ export function createVerbs({ client, store, writer, session, agent = 'lead', bo
     },
 
     async item_lock(args, requestId, meta) {
-      requireOwner('item lock');
       const item = await requireItem(args.item_id);
       const fields = item.fields ?? {};
       if (alreadyPatched(item, requestId, meta)) return { verb: 'item_lock', item_id: item.id, version: item.version, lifecycle: fields.lifecycle, stage: fields.stage, product: fields.product, repos: fields.repos, scope_hash: fields.scope_hash, locked_at: fields.locked_at, replayed_from_graph: true };
@@ -473,7 +472,6 @@ export function createVerbs({ client, store, writer, session, agent = 'lead', bo
     },
 
     async item_split(args, requestId, meta) {
-      requireOwner('item split');
       const parent = await requireItem(args.item_id);
       const reason = text(args.reason, 'reason', { max: 2000 });
       // split_order is a piece's place in the parent's split_children. That
@@ -534,7 +532,6 @@ export function createVerbs({ client, store, writer, session, agent = 'lead', bo
     },
 
     async item_park(args, requestId, meta) {
-      requireOwner('item park');
       const item = await requireItem(args.item_id);
       const reason = text(args.reason, 'reason', { max: 2000 });
       if (alreadyPatched(item, requestId, meta)) return { verb: 'item_park', item_id: item.id, version: item.version, lifecycle: item.fields.lifecycle, reason, replayed_from_graph: true };
@@ -544,7 +541,6 @@ export function createVerbs({ client, store, writer, session, agent = 'lead', bo
     },
 
     async item_resume(args, requestId, meta) {
-      requireOwner('item resume');
       const item = await requireItem(args.item_id);
       const reason = text(args.reason, 'reason', { max: 2000 });
       if (alreadyPatched(item, requestId, meta)) return { verb: 'item_resume', item_id: item.id, version: item.version, lifecycle: item.fields.lifecycle, reason, replayed_from_graph: true };
@@ -565,7 +561,6 @@ export function createVerbs({ client, store, writer, session, agent = 'lead', bo
     // dropped item stays in the graph; no live view lists it. A delivered item
     // is not dropped: item_reopen is its path.
     async item_drop(args, requestId, meta) {
-      requireOwner('item drop');
       const item = await requireItem(args.item_id);
       const words = origin(args.origin);
       if (alreadyPatched(item, requestId, meta)) return { verb: 'item_drop', item_id: item.id, version: item.version, lifecycle: item.fields.lifecycle, dropped_from: item.fields.dropped_from ?? null, replayed_from_graph: true };
@@ -578,8 +573,8 @@ export function createVerbs({ client, store, writer, session, agent = 'lead', bo
 
     // Release 0.2.3: edit an item's next step, what it waits on, and its title.
     // The next step and the wait are the lead's to keep true, so any
-    // in-session caller may change them. The title is the owner's words, so a
-    // new title needs the owner present. Each edit keeps the old values.
+    // in-session caller may change them. The title is the owner's words, so only
+    // the lead role sets a new title. Each edit keeps the old values.
     // Work item additions, slice 1: tags_add and tags_remove change the free
     // tags, and plan holds the owner's planned start, end and deadline.
     async item_edit(args, requestId, meta) {
@@ -591,7 +586,6 @@ export function createVerbs({ client, store, writer, session, agent = 'lead', bo
       const change = {}, previous = {};
       let title;
       if (args.title !== undefined) {
-        requireOwner('item edit of a title');
         title = text(args.title, 'title', { max: 300 });
         if (title !== item.title) previous.title = item.title ?? '';
       }
@@ -618,7 +612,6 @@ export function createVerbs({ client, store, writer, session, agent = 'lead', bo
       let tagEdit = tagsAdd.length || tagsRemove.length;
       let planGiven = null;
       if (args.plan !== undefined) {
-        requireOwner('item edit of planned dates');
         if (!args.plan || typeof args.plan !== 'object' || Array.isArray(args.plan)) refuse(`plan must be { ${PLAN_DATES.join(', ')} }, each a date YYYY-MM-DD or null to clear it`);
         const unknown = Object.keys(args.plan).filter((key) => !PLAN_DATES.includes(key));
         if (unknown.length) refuse(`plan holds only ${PLAN_DATES.join(', ')}; not ${unknown.join(', ')}`);
@@ -653,8 +646,8 @@ export function createVerbs({ client, store, writer, session, agent = 'lead', bo
 
     // Work item additions, slice 2: an item names the items that block it.
     // The list on the item is the one home of the fact; a view works out
-    // "blocks" from the items it loaded. The lead keeps the links true, so no
-    // owner flag is needed. A link that would close a loop is refused.
+    // "blocks" from the items it loaded. The lead keeps the links true (the role
+    // table gives it to the lead). A link that would close a loop is refused.
     async item_block(args, requestId, meta) {
       const item = await requireItem(args.item_id);
       text(args.blocked_by, 'blocked_by', { max: 200 });
@@ -744,9 +737,9 @@ export function createVerbs({ client, store, writer, session, agent = 'lead', bo
   // registry and this writer stamp. The delivery verbs also get the two
   // read-only readers: GitHub through the gh CLI, and one GET against the
   // deployed app. Slice L4 adds three read verbs, which write nothing.
-  const core = { client, label, now, typeNamed, kindOf, registry, requireProduct, requireItem, requireOwner, patch, create, edge, landed, alreadyPatched, findCreated };
+  const core = { client, label, now, typeNamed, kindOf, registry, requireProduct, requireItem, patch, create, edge, landed, alreadyPatched, findCreated };
   Object.assign(verbs, createQuestionVerbs(core));
-  Object.assign(verbs, createDeliveryVerbs({ ...core, ownerPresent, readGitHub, readLive }));
+  Object.assign(verbs, createDeliveryVerbs({ ...core, readGitHub, readLive }));
   Object.assign(verbs, createCapabilityVerbs({ ...core, readGitHub }));
   Object.assign(verbs, createRoundupVerbs({ ...core, readGitHub, inFlight: (args) => verbs.in_flight(args), needsMe: (args) => verbs.needs_me(args) }));
   const activity = createActivityVerbs(core);
@@ -759,12 +752,12 @@ export function createVerbs({ client, store, writer, session, agent = 'lead', bo
   Object.assign(verbs, createLessonVerbs(core));
 
   const WRITE_VERBS = Object.freeze(['setup', 'product_add', 'product_edit', 'repo_add', 'repo_edit', 'item_propose', 'item_lock', 'item_split', 'item_park', 'item_resume', 'item_drop', 'item_edit', 'item_block', 'item_unblock', 'item_stage', 'item_link', ...QUESTION_WRITE_VERBS, ...DELIVERY_WRITE_VERBS, ...ACTIVITY_WRITE_VERBS, ...STEP_IN_WRITE_VERBS, ...LESSON_WRITE_VERBS]);
-  const READ_VERBS = Object.freeze(['registry_list', ...QUESTION_READ_VERBS, ...DELIVERY_READ_VERBS, ...CAPABILITY_READ_VERBS, ...ROUNDUP_READ_VERBS, ...ACTIVITY_READ_VERBS, ...STEP_IN_READ_VERBS, ...LESSON_READ_VERBS]);
 
   async function run(verb, args = {}) {
     if (!verbs[verb]) refuse(`unknown verb: ${verb}`);
     if (!args || typeof args !== 'object' || Array.isArray(args)) refuse('arguments must be an object');
     for (const key of AUTHORITY_FIELDS) if (key in args) refuse(`the request cannot supply ${key}; the server stamps the writer and session`);
+    allow(role, verb, args, { readVerbs: READ_VERBS, from: roleFrom });
     if (READ_VERBS.includes(verb)) return verbs[verb](args);
     const requestId = text(args.request_id, 'request_id', { max: 200 });
     if (!/^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(requestId)) refuse('request_id may hold letters, digits, dots, colons, underscores and hyphens');