@cynodia/axiom 0.14.0-alpha.5 → 0.15.0-alpha.2

package/README.md

@@ -33,7 +33,7 @@ Shorter forms of the same routing: [`AGENTS.md`](AGENTS.md) and [`llms.txt`](llm
 at this package's root.
 
 **Status: experimental / alpha.** The API may change between alpha releases. The
-documentation in `docs/` describes this exact version, `0.14.0-alpha.5`.
+documentation in `docs/` describes this exact version, `0.15.0-alpha.2`.
 
 ## Installation
 
@@ -47,7 +47,7 @@ Every release of this project is a pre-release and npm's `latest` tag points at
 plain command above installs the current version. **There is no `alpha` dist-tag** — the tag
 was removed once it stopped tracking releases, and `npm install @cynodia/axiom@alpha` now
 fails with a 404. Pin the exact version instead when one is needed:
-`npm install @cynodia/axiom@0.14.0-alpha.5`.
+`npm install @cynodia/axiom@0.15.0-alpha.2`.
 
 These are ES modules compiled to ES2022; import them with `import`, not `require`. There is
 no published Axiom CLI. `@cynodia/axiom-server`'s SQLite persistence adapter additionally
@@ -194,6 +194,7 @@ focused document when the reference is not specific enough for the question at h
 | Running N authority processes at once: ownership, leases, fencing, delivery guarantees, version skew | [`docs/DISTRIBUTED_AUTHORITY.md`](docs/DISTRIBUTED_AUTHORITY.md) |
 | Observing a `QueryDef` result over time: live deltas, reconnect, cursor, backpressure, transport | [`docs/LIVE_QUERIES.md`](docs/LIVE_QUERIES.md) |
 | Durable workflows: steps, bindings, event waits, timers, retries, cancellation, crash recovery | [`docs/WORKFLOWS.md`](docs/WORKFLOWS.md) |
+| May this principal perform this operation: `AuthorizationPolicyDef`, closed scope, ALLOW/DENY, fail closed | [`docs/AUTHORIZATION.md`](docs/AUTHORIZATION.md) |
 | Machine queries, mutation impact and graph transformations | [`docs/AGENT_API.md`](docs/AGENT_API.md) |
 
 `docs/AGENT_REFERENCE.md` plus the `.d.ts` declarations are intended to be sufficient on

package/docs/ACTIONS_TRANSACTIONS.md

@@ -1,6 +1,6 @@
 # Actions and transactions
 
-Axiom 0.14.0-alpha.5. An action is behavior expressed as data, executed as a transaction.
+Axiom 0.15.0-alpha.2. An action is behavior expressed as data, executed as a transaction.
 
 ```ts
 {

package/docs/AGENT_API.md

@@ -1,6 +1,6 @@
 # Agent API
 
-Axiom 0.14.0-alpha.5. The machine-facing interface. Agents query semantics and apply
+Axiom 0.15.0-alpha.2. The machine-facing interface. Agents query semantics and apply
 structural transformations; they never edit generated code.
 
 ```ts

package/docs/AGENT_REFERENCE.md

@@ -1,6 +1,6 @@
 # Agent reference
 
-Axiom 0.14.0-alpha.5. Compressed operational contract. Read this plus the `.d.ts`
+Axiom 0.15.0-alpha.2. Compressed operational contract. Read this plus the `.d.ts`
 declarations before authoring or modifying an Axiom application.
 
 Formal guarantees: [`SEMANTIC_CONTRACT.md`](SEMANTIC_CONTRACT.md). Mistakes that compile:
@@ -731,7 +731,8 @@ Portable artifacts, for a runtime written in another language:
 @cynodia/axiom-server/schema/server-ir.v5.schema.json JSON Schema for axiom.server.v5
 @cynodia/axiom-server/schema/server-ir.v6.schema.json JSON Schema for axiom.server.v6
 @cynodia/axiom-server/schema/server-ir.v7.schema.json JSON Schema for axiom.server.v7
-@cynodia/axiom-server/schema/server-ir.v8.schema.json JSON Schema for axiom.server.v8 (latest)
+@cynodia/axiom-server/schema/server-ir.v8.schema.json JSON Schema for axiom.server.v8
+@cynodia/axiom-server/schema/server-ir.v9.schema.json JSON Schema for axiom.server.v9 (latest)
 @cynodia/axiom-server/schema/protocol.v1.schema.json  JSON Schema for the protocol
 @cynodia/axiom-server/conformance/queries/<name>.json one query conformance fixture (axiom.conformance.v4)
 @cynodia/axiom-server/conformance/migrations/<name>.json one migration conformance fixture (axiom.conformance.v5)
@@ -1231,6 +1232,86 @@ Diagnostics (validation): `WORKFLOW_ENTRY_NOT_FOUND` `WORKFLOW_STEP_NOT_FOUND`
 `WORKFLOW_UNREACHABLE_STEP` `WORKFLOW_NO_TERMINAL` `WORKFLOW_EXPRESSION_SCOPE`
 `WORKFLOW_NONDETERMINISTIC`.
 
+## AUTHORIZATION
+
+Full model: [`AUTHORIZATION.md`](AUTHORIZATION.md). **0.15 is phased.** Phase B added the
+vocabulary, `validateGraph` totality, the single semantic projection and `axiom.server.v9`.
+**Phase C (this build) enforces `ActionDef.authorizationPolicy`** — one `authorize()`
+evaluator on every `action.invoke` path (direct call, workflow action step, scheduler- and
+event-triggered action, retry, failover), conjoined with any legacy `ActionDef.authorization`
+expression, re-evaluated on every invocation against current policy. **Phase D enforces
+`QueryDef.authorizationPolicy` (`query.read`)** — the same evaluator gates a one-shot query,
+a `query` operation inside an action and a live-query open, before any provider call;
+`ReadPolicyDef` still filters rows, AND-ed into the effective filter so `filter`/`sort`/
+`limit`/aggregate see only the authorized dataset. **Phase E** — `WorkflowDef.startPolicy`
+decides `workflow.start` (a denied start creates no instance), `instanceAccessPolicy`
+decides `workflow.cancel` / `.inspect` / `.history` when declared; with none, cancel keeps
+the spec14pt6 owner-fingerprint baseline and `getWorkflow` / `inspectWorkflows` /
+`workflowHistory` stay operator-inspection APIs (an explicit trust boundary, not on the
+protocol). Unauthorized inspection ⇒ `undefined` / `[]` (no existence leak); terminal
+cancel stays idempotent for any caller. **Phase F** — a live query re-checks `query.read`
+against the **re-resolved** caller on every re-evaluation, so a revoked principal stops the
+stream (`{ kind: 'error', code: 'AUTHORIZATION_DENIED' }`); the current caller drives row
+filtering, so lost/gained access to a row is a `remove`/`insert` delta; `resumeLiveQuery`
+re-resolves + re-authorizes and refuses a cursor issued for a different principal.
+`subscription.open` (`SubscriptionDef`) is an infrastructure trust boundary — no graph
+policy, the adapter contract is the boundary. Every graph-defined `AuthorizationPolicyDef`
+reference is now enforced; `AUTHORIZATION_ENFORCEMENT_UNAVAILABLE` /
+`usesUnenforcedAuthorizationVocabulary` are the dormant fail-closed extension point
+(spec4 §4).
+
+One authorization language. An `AuthorizationPolicyDef` (graph node kind
+`authorization-policy`) is a single boolean `allow` `Expression`. Exactly `true` ⇒ ALLOW;
+`false`, an absent policy, or **any** evaluation error ⇒ DENY (fail closed). **A missing
+PRINCIPAL / RESOURCE field never satisfies a rule** (spec15pt2): the policy evaluator is
+three-valued (concrete / security-absence / error), so `PRINCIPAL.role != "banned"`,
+`NOT(PRINCIPAL.role == "banned")` and `RESOURCE.ownerId == PRINCIPAL.id` all DENY when the
+named field is absent or the caller is anonymous — `neq` / `not` / `or` cannot turn absence
+into authority. `literal(true)` stays a genuine constant (explicit public still admits
+anonymous). Ordinary `Expression` semantics elsewhere are unchanged. Closed
+expression scope — the three reserved ids exported from core: `ref(PRINCIPAL)`
+(`'axiom_principal'`, the id `ActionDef.authorization` already uses), `ref(RESOURCE)`
+(`'axiom_resource'` — for `action.invoke`, a `{ id, kind }` descriptor), `ref(OPERATION)`
+(`'axiom_operation'` — resolves to the canonical operation string). **Not** a `StateDef`
+(`AUTHORIZATION_INVALID_SCOPE`), **not** a `QueryDef`, **not** `now`/`uuid`/`random`
+(`AUTHORIZATION_NONDETERMINISTIC`). Referenced by id: `ActionDef.authorizationPolicy`
+(`action.invoke`), `QueryDef.authorizationPolicy` (`query.read`, distinct from `readPolicyId`
+row filtering), `WorkflowDef.startPolicy` (`workflow.start`),
+`WorkflowDef.instanceAccessPolicy` (`workflow.inspect`/`.history`/`.cancel`). Legacy
+`ActionDef.authorization` (an `Expression`) and `ReadPolicyDef` coexist; when both a policy
+and a legacy expression are present the effective decision is their conjunction. Canonical
+operation ids: `AUTHORIZATION_OPERATIONS`. The pure ALLOW/DENY combiner is
+`decideAuthorization` (core).
+
+`AuthorizationPolicyDef` is in `EXECUTABLE_KINDS` — editing `allow` from ALLOW to DENY moves
+`semanticFingerprint` and the `AuthorityCompatibilityKey`; a `name`/`description` change
+does not; a graph with **no** authorization vocabulary compiles to the byte-identical v1–v8
+document it always did. Totality: every validate/compile/analyze surface is total over a
+`null` / non-object policy / non-plain `allow` — structured diagnostic, never a native
+`TypeError`.
+
+Static analysis: `AgentAPI.analyzeAuthorization()` → what protects every action / query /
+workflow surface, per-policy dependencies + a secret-free rule `summary`, the `unprotected`
+list (surfaces with no explicit boundary), and per-workflow `privilegeReviewActions`
+(policy-carrying action steps the start principal is not statically proven to satisfy). It
+never claims authorization it cannot prove and exposes no runtime secret. Primitive:
+`authorizationPolicyDependencies(policy)` (core).
+
+Conformance: `axiom.conformance.v9` (`conformance/authorization/`),
+`runAuthorizationConformanceFixture` / `Suite` — a compiled Server IR + principals +
+provider rows + a deterministic driver script, each step carrying the independently-computed
+decision; verified over memory and SQLite.
+
+Diagnostics (validation): `AUTHORIZATION_INVALID_POLICY` `AUTHORIZATION_INVALID_SCOPE`
+`AUTHORIZATION_NONDETERMINISTIC` `AUTHORIZATION_UNKNOWN_POLICY`. Runtime refusal:
+`AUTHORIZATION_DENIED` — `details.operation` (`action.invoke` / `query.read` /
+`workflow.start` / `workflow.cancel`) + `details.reason`
+(`policy-denied`/`policy-error`/`legacy-denied`/`legacy-error`/`owner-mismatch`), terminal,
+not retryable, carries no state value / credential / claim. A denied `query` operation
+inside an action surfaces as `QUERY_OPERATION_FAILED` with `details.code =
+'AUTHORIZATION_DENIED'` and rolls the action back. A denied `workflow.inspect` /
+`workflow.history` returns `undefined` / `[]` (no existence leak).
+
 ## Metadata classes
 
 ```ts

package/docs/ANTI_PATTERNS.md

@@ -1,6 +1,6 @@
 # Anti-patterns
 
-Axiom 0.14.0-alpha.5. Each of these compiles. Each is wrong. Each is followed by the correct
+Axiom 0.15.0-alpha.2. Each of these compiles. Each is wrong. Each is followed by the correct
 alternative.
 
 ## 1. Field names as entity runtime keys

package/docs/AUTHORITY.md

@@ -1,6 +1,6 @@
 # Authority
 
-Axiom 0.14.0-alpha.5. How an application crosses the trust boundary.
+Axiom 0.15.0-alpha.2. How an application crosses the trust boundary.
 
 Until 0.5.x an Axiom application executed locally. 0.6 adds an **authority**: a generic
 runtime that owns state, decides mutations and persists them. The same semantic graph
@@ -467,7 +467,7 @@ does for a local failure.
 | --- | --- |
 | `UNKNOWN_SERVER_ACTION` | The request named an action this authority does not execute. |
 | `ARGUMENT_TYPE_MISMATCH` | An argument did not conform to its declared parameter type, or is not a parameter at all. |
-| `AUTHORIZATION_DENIED` | The caller may not invoke this action, or the rule could not be evaluated. |
+| `AUTHORIZATION_DENIED` | The caller may not invoke this action / read this query / start or cancel this workflow, or the rule could not be evaluated. spec15 Phase C covers `ActionDef.authorizationPolicy`, Phase D `QueryDef.authorizationPolicy` (`query.read` — including a live query whose caller is revoked mid-subscription, Phase F, delivered as a live-query error message carrying this code), Phase E `WorkflowDef.startPolicy` / `instanceAccessPolicy` (`workflow.start` / `.cancel`); `details.operation` names the canonical operation and `details.reason` is a non-secret machine reason (`policy-denied` / `policy-error` / `legacy-denied` / `legacy-error` / `owner-mismatch`). A denied `workflow.inspect` / `workflow.history` returns nothing instead (no existence leak). |
 | `CONCURRENCY_CONFLICT` | Another transaction committed the same state first. Nothing was applied. |
 | `MALFORMED_REQUEST` | The request was not an Axiom semantic request, or spoke an unknown protocol. |
 | `AUTHORITY_UNREACHABLE` | The authority could not be reached, timed out, or answered with a transport error. |
@@ -504,6 +504,7 @@ does for a local failure.
 | `LIVE_QUERY_CURSOR_INVALID` | An `axiom.live-query-cursor.v1` was tampered with, unsigned, or minted for a different query / principal / arguments / read policy. Fail-closed: continuing from it is refused and nothing is disclosed (spec13 §33-§35). |
 | `LIVE_QUERY_CURSOR_INCOMPATIBLE` | A live-query cursor was minted by an authority whose schema fingerprint, semantic fingerprint or server contract differs from this one's — the same fail-closed compatibility check the distributed work store applies. A presentation-only graph change does *not* trigger this (spec13 §79-§82). |
 | `LIVE_QUERY_EVALUATION_FAILED` | Re-evaluating the live query against the `DataProvider` after a committed change failed. Delivered as a `{ kind: 'error' }` message on the live stream; the last delivered result stands and the consumer may reconnect (spec13 §132). |
+| `AUTHORIZATION_ENFORCEMENT_UNAVAILABLE` | The Server IR declares authorization vocabulary this build validates and fingerprints but does not yet enforce. Every `AuthorizationPolicyDef` reference the graph vocabulary defines is enforced through spec15 Phase E (`ActionDef` / `QueryDef` / `WorkflowDef`), so this is **dormant** for every valid IR — kept as the fail-closed extension point (`usesUnenforcedAuthorizationVocabulary`) for any later phase that adds authorization vocabulary ahead of its enforcement (spec4 §4, spec15 §128). |
 | `SCHEMA_MIGRATION_REQUIRED` | Persisted canonical data is at an older semantic schema than the graph requires; a migration must run before the authority will serve traffic (spec11 §12). |
 | `SCHEMA_INCOMPATIBLE` | Persisted data cannot be reconciled with the graph — a stored schema version ahead of the graph's, or no migration path to it. |
 | `MIGRATION_IN_PROGRESS` | A migration is already running: a migration lock is held with a valid lease, by this instance or another (spec11 §66). |
@@ -691,6 +692,7 @@ page plus the conformance fixtures.
 | `axiom.server.v6` | `QueryDef`, `RelationshipDef` and `ReadPolicyDef`, the `query` operation kind, and the `provider-record` location — the semantic data-access & query layer over large authoritative datasets | 0.10.0 |
 | `axiom.server.v7` | `MigrationDef` and the closed migration-operation vocabulary, plus the top-level `schemaVersion` and `schemaFingerprint` fields — semantic schema evolution over persisted canonical data | 0.11.0 |
 | `axiom.server.v8` | `WorkflowDef` and the closed workflow-step vocabulary (`action`, `wait-event`, `timer`, `branch`, `complete`, `fail`) — durable, portable long-running orchestration | 0.14.0 |
+| `axiom.server.v9` | `AuthorizationPolicyDef` (one boolean `allow` expression over the closed scope `PRINCIPAL` / `RESOURCE` / `OPERATION`) and the `authorizationPolicy` / `startPolicy` / `instanceAccessPolicy` references from actions, queries and workflows — the canonical authorization model. See [`AUTHORIZATION.md`](AUTHORIZATION.md) | 0.15.0 |
 
 `SERVER_IR_CONTRACTS` enumerates all eight, and is the single source of truth this table is
 tested against — `packages/demo/test/documentation.test.ts` fails if a contract in

package/docs/AUTHORIZATION.md

@@ -0,0 +1,261 @@
+# Authorization
+
+Axiom 0.15.0-alpha.2. The operational contract for **authorization completeness** — the 0.15
+milestone (spec15). Whether a principal may perform a semantic operation is part of the
+graph's executable meaning — not a runtime concern, not UI visibility, not something that
+varies by transport, provider, process, retry path or authority topology. `axiom.server.v9`
+when a graph carries authorization vocabulary; a graph with none is byte-identical to its
+prior contract.
+
+> **Authentication** answers *who is this?* — credential adapters and transports do that,
+> outside portable application semantics. **Authorization** answers *may this principal
+> perform this semantic operation?* — that is what this document defines.
+
+0.15 landed in nine phases (A–I); `0.15.0-alpha.2` (spec15pt2) is a corrective pass —
+authorization **absent-value safety** (a missing PRINCIPAL / RESOURCE field never grants
+authority), `validateGraph` totality over a malformed `allow` tree, and a fail-closed
+`host.authenticate` exception boundary. This document describes the **model** (stable) and
+marks which phase delivered each surface. External adversarial validation precedes the
+semantic freeze (spec15 §134).
+
+| Phase | Delivers | State |
+| --- | --- | --- |
+| A | Public-API authorization inventory (below) | ✅ landed |
+| B | `AuthorizationPolicyDef` vocabulary, `validateGraph` totality, single semantic projection, `axiom.server.v9` | ✅ landed |
+| **C** | One canonical `authorize()` evaluator; `ActionDef.authorizationPolicy` enforced on every `action.invoke` path (direct / workflow step / scheduler / event / retry / failover), conjoined with legacy `ActionDef.authorization`; state & provider-record mutation authorized through the action boundary | ✅ **enforced** |
+| **D** | `QueryDef.authorizationPolicy` (`query.read`) enforced identically for a one-shot query, a `query` operation inside an action, and a live-query open — before any provider call. Row-level filtering stays `ReadPolicyDef`, AND-ed into the effective filter so `filter` / `sort` / `limit` / aggregation see only the authorized dataset | ✅ **enforced** |
+| **E** | `WorkflowDef.startPolicy` decides `workflow.start` (discovering a workflow ≠ starting it). `instanceAccessPolicy` decides `workflow.cancel` / `.inspect` / `.history` when declared; with none, cancel keeps the 0.14 owner-fingerprint baseline and inspection stays an operator trust boundary. Unauthorized inspection is answered like a missing instance; terminal cancellation stays idempotent for any caller | ✅ **enforced** |
+| **F** | A live query re-checks `query.read` against the **re-resolved** caller on every re-evaluation, so a revoked principal stops the stream (`{ kind: 'error', code: 'AUTHORIZATION_DENIED' }`). The current caller drives row filtering, so a claim / row change that removes access is a `remove` delta and the reverse an `insert`. `resumeLiveQuery` re-resolves + re-authorizes and refuses a cursor issued for a different principal. `subscription.open` (`SubscriptionDef`) is an infrastructure trust boundary — no graph policy, the adapter contract is the boundary | ✅ **enforced** |
+| **G** | `AgentAPI.analyzeAuthorization()` — a graph-level coverage audit: what protects every action / query / workflow surface, what each policy depends on (`PRINCIPAL` / `RESOURCE` fields, `OPERATION`, a secret-free rule summary), which surfaces have **no** explicit boundary, and which workflow action steps run a policy the start principal is not statically proven to hold. `authorizationPolicyDependencies` in core | ✅ **landed** |
+| **H** | `axiom.conformance.v9` — the portable authorization fixture tier (`conformance/authorization/`), `runAuthorizationConformanceFixture` / `Suite`; decisions verified over both memory and SQLite persistence | ✅ **landed** |
+| **I** | The internal adversarial matrix (§74/§88/§136/§137 — every public surface × {owner, different, anonymous, role-equivalent, admin-like, malformed}, forbidden counters at zero), topology-independence over 1/2/8 authorities on shared SQLite, cross-principal race + contention (no unauthorized win, no raw SQLite error), and failover parity | ✅ **landed** |
+
+Every `AuthorizationPolicyDef` reference the graph vocabulary defines is enforced across
+`ActionDef` / `QueryDef` / `WorkflowDef` and every live-query re-evaluation.
+`createAxiomServer` still **fails closed** (`AUTHORIZATION_ENFORCEMENT_UNAVAILABLE`) via
+`usesUnenforcedAuthorizationVocabulary` — kept as the dormant extension point for any later
+phase that introduces authorization vocabulary ahead of its enforcement (spec4 §4,
+spec15 §128).
+
+---
+
+## The model
+
+There is **one** authorization language. An `AuthorizationPolicyDef` is a graph node with a
+single boolean `allow` expression:
+
+```ts
+import { OPERATION, PRINCIPAL, RESOURCE } from '@cynodia/axiom-core';
+
+graph.addNode<AuthorizationPolicyDef>({
+  id: POLICY_DOC_OWNER,
+  kind: 'authorization-policy',
+  // the owner, or anyone in the same tenant
+  allow: binary('or',
+    binary('eq', field(ref(RESOURCE), F_DOC_OWNER), field(ref(PRINCIPAL), F_PRINCIPAL_ID)),
+    binary('eq', field(ref(RESOURCE), F_DOC_TENANT), field(ref(PRINCIPAL), F_PRINCIPAL_TENANT))),
+});
+```
+
+- **Closed scope.** A policy expression's `ref` may resolve **only** the three reserved ids
+  exported from `@cynodia/axiom-core` — `PRINCIPAL` (`'axiom_principal'`, the canonical
+  caller, the *same* id `ActionDef.authorization` uses), `RESOURCE` (`'axiom_resource'`, the
+  semantic object the decision is about — for `action.invoke` a stable `{ id, kind }`
+  descriptor, since there is no per-record target), and `OPERATION` (`'axiom_operation'`;
+  `ref(OPERATION)` resolves to the canonical operation string, e.g. `'action.invoke'`). No
+  `StateDef`, no `QueryDef`, no `now` / `uuid` / `random`, no ambient runtime state, no
+  host-language callback — authorization is portable, deterministic, statically analyzable
+  data (spec15 §7, §34). Write a policy with the ordinary `field` / `ref` / `binary`
+  vocabulary: `binary('eq', field(ref(RESOURCE), F_OWNER), field(ref(PRINCIPAL), F_USER_ID))`.
+- **ALLOW / DENY, fail closed.** `allow` evaluating to exactly `true` is **ALLOW**. `false`,
+  an absent policy field, or *any evaluation error* is **DENY** — the safe direction for a
+  failed access check is always refusal (spec15 §8, §123).
+- **A missing PRINCIPAL / RESOURCE field never satisfies a rule** (spec15pt2 F1). The policy
+  evaluator is three-valued — a concrete value, **security-scope absence** (a field the
+  scope object does not carry), or an evaluation error. A comparison, `not`, `neq` or `or`
+  whose truth would depend on absence is *not satisfied*, so `PRINCIPAL.role != "banned"` /
+  `NOT(PRINCIPAL.role == "banned")` / `RESOURCE.ownerId == PRINCIPAL.id` all **DENY** when
+  the named field is absent or the caller is anonymous. This is authorization-evaluation
+  semantics only; ordinary `Expression` equality/nullish behaviour elsewhere is unchanged
+  (spec15pt2 §4). An `OR` branch that is *concretely* true still allows even if the other
+  branch is absent-dependent. `literal(true)` is a genuine constant — an explicitly public
+  policy still admits an anonymous caller.
+- **Referenced by id.** A protected surface points at a policy:
+  - `ActionDef.authorizationPolicy` — `action.invoke`
+  - `QueryDef.authorizationPolicy` — `query.read` (distinct from `readPolicyId`, which
+    filters *which rows* the result contains)
+  - `WorkflowDef.startPolicy` — `workflow.start`
+  - `WorkflowDef.instanceAccessPolicy` — `workflow.inspect` / `workflow.history` /
+    `workflow.cancel` on a running instance
+- **Same evaluator everywhere.** Actions, queries, workflows and live queries all make the
+  decision through one evaluator with the same `{ principal, operation, resource, policy }`
+  inputs — no per-surface policy engine (spec15 §5, §96).
+
+### Operation identity
+
+Policies reason over canonical semantic operations (`AUTHORIZATION_OPERATIONS`), never over
+transport method names:
+
+```
+action.invoke   query.read      record.read    record.mutate   state.read   state.mutate
+workflow.start  workflow.inspect  workflow.history  workflow.cancel
+live.open       live.resume     subscription.open   event.ingress
+```
+
+### Default when no policy is attached (`AUTHORIZATION_DEFAULT`)
+
+One canonical rule, applied consistently, never left to the runtime (spec15 §9):
+
+- a surface whose **pre-0.15 contract is public** (an unrestricted `ActionDef`, an
+  unrestricted `QueryDef`) stays public;
+- a surface whose contract is **already restricted** — a legacy `ActionDef.authorization`
+  expression, a `QueryDef` with a `ReadPolicyDef`, a workflow instance operation (0.14
+  owner-fingerprint) — keeps that restriction;
+- a **new privileged surface** with no policy fails closed.
+
+A policy may broaden an owner-only default, but only explicitly — a role like `admin` never
+bypasses owner-only semantics unless the policy says so (spec15 §14, §74).
+
+---
+
+## Authorization is semantic identity
+
+`AuthorizationPolicyDef` is in `EXECUTABLE_KINDS` — the *single* projection both
+`semanticFingerprint` and the authority-compatibility key derive from (spec14pt3's
+architecture, preserved). Therefore:
+
+- editing a policy from ALLOW to DENY **moves the semantic fingerprint**;
+- a presentation-only change (`name`, `description`) does **not**;
+- two authorities whose executable authorization meaning differs are **incompatible** — a
+  mixed-build authority with an incompatible policy fails closed before advancing a durable
+  workflow or serving a query, exactly as for any other semantic change (spec15 §45, §46,
+  §47). "Only security" is still semantic; it does not bypass compatibility.
+
+A graph with **no** authorization vocabulary compiles to the byte-identical v1–v8 document
+it always did and its fingerprint is unchanged (spec15 §39, §132).
+
+**Evaluator version.** `0.15.0-alpha.1` and `0.15.0-alpha.2` evaluate the *same* policy
+differently (absent-value safety, spec15pt2 F1), yet the graph — and its
+`semanticFingerprint` — is identical. So the `AuthorityCompatibilityKey` carries an
+`authorizationRuntime` discriminator, present only when the IR uses authorization
+vocabulary: a mixed `alpha.1` / `alpha.2` cluster over an authorization-bearing graph is
+fail-closed **incompatible** (spec15pt2 §35), while a graph with no policy rolls the
+upgrade unaffected.
+
+---
+
+## Public-API authorization inventory (Phase A)
+
+Every public `AxiomServer` semantic operation, classified. "Effective principal" is the
+credential resolved at authority ingress; async work (workflow continuation, scheduler,
+effect retry) reconstructs it from durable identity, never a process-local object
+(spec15 §27).
+
+| Operation | Kind | Resource | Effective principal | Pre-0.15 behaviour | 0.15 target |
+| --- | --- | --- | --- | --- | --- |
+| `handle({kind:'invoke'})` / `ActionDef` | execute | `ActionDef` (`{id,kind}`) | caller credential | `ActionDef.authorization` expr, or public | **C ✅** — `action.invoke` policy ∧ legacy expr, re-evaluated on every invocation against current policy |
+| workflow `action` step | execute | `ActionDef` | **workflow's start principal** | inherits action's `authorization`, re-evaluated per step (0.14) | **C ✅** — same `authorize()` as a direct call; workflow start never amplifies privilege (§101); denial is terminal not retried (§109) |
+| trigger / scheduler / event → action | execute | `ActionDef` | semantic object that scheduled it (no ambient SYSTEM) | `source: 'system'`, `invocation.allowedSources` | **C ✅** — policy under the canonical effective principal; `'system'` source is not privilege (§26, §102) |
+| `handle({kind:'query'})` / `QueryDef` | read | `QueryDef` | caller credential | `ReadPolicyDef` row filter, or public | **D ✅** — `query.read` policy gates the whole query before any provider call; `ReadPolicyDef` still filters rows, AND-ed into the effective filter so `filter`/`sort`/`limit`/aggregate see the authorized dataset (§18, §81, §82) |
+| `query` operation inside an `ActionDef` | read | `QueryDef` | the running action's caller | flows through the action | **D ✅** — `query.read` under `activePrincipal`; a denial fails the operation and rolls the action back (§54) |
+| live query `openLiveQuery` (open) | read | `QueryDef` | caller credential | as one-shot query | **D ✅** — `query.read` decided once at open, identically to a one-shot query (§16) |
+| live query update / `resumeLiveQuery` | read | `QueryDef` + rows | **re-resolved caller** | as one-shot query | **F ✅** — every re-evaluation re-resolves the caller and re-checks `query.read` (a revoked principal ⇒ `{ kind:'error', code:'AUTHORIZATION_DENIED' }`); row filtering tracks current claims so lost/gained access is a `remove`/`insert` delta (§19, §58, §79, §80); resume re-authorizes and rejects another principal's cursor (§20) |
+| `SubscriptionDef` delivery (`subscription.open`) | execute | `SubscriptionDef` | event source identity | adapter-authenticated | **infrastructure trust boundary** — no graph policy; a `SubscriptionDef` is a world→Axiom inbound stream connected by an adapter, not a principal-facing subscribe. The adapter contract is the boundary (§24, §59) |
+| provider-record mutation (via `ActionDef`) | mutate | provider record | caller credential | flows through the action's authorization | **C ✅** — authorized through the causing `ActionDef`; there is no public mutation path that bypasses `invokeCore` (§23) |
+| authoritative `StateDef` write (via `ActionDef`) | mutate | `StateDef` | caller credential | flows through the action's authorization | **C ✅** — same; `hydrateState` stays administrative, not a semantic write (§21) |
+| `startWorkflow` | execute | `WorkflowDef` (`{id,kind}`) | caller credential | any principal | **E ✅** — `WorkflowDef.startPolicy`; a denied start creates no instance; separate from the ActionDef auth a later step is subject to (§100, §101) |
+| `getWorkflow` / `inspectWorkflows` / `workflowHistory` | read | workflow instance | caller credential | `getWorkflow` unauthenticated (0.14) | **E ✅** — gated by `instanceAccessPolicy` when declared (unauthorized ⇒ answered like a missing instance, no existence leak, §39); with none they stay **operator-inspection APIs**, an explicit trust boundary, not reachable through the principal-facing protocol (§15, §112-§113) |
+| `cancelWorkflow` | mutate | workflow instance | caller credential | **owner-fingerprint** (spec14pt6 F4) | **E ✅** — `instanceAccessPolicy` decides when declared (explicit cross-principal, no implicit role bypass); with none the owner-fingerprint baseline is preserved. Unauthorized mutates nothing; terminal cancel stays idempotent for any caller (§14, §110) |
+| `handle({kind:'event'})` ingress | execute | `EventDef` | event source identity | payload-validated, infra-trusted | explicit trust boundary per source; credentials, where accepted, affect authorization (F, §24) |
+| `mutationLog` / `effectLog` / `subscriptionLog` / `revisionInspection` | read | authority internals | — | operator inspection | **operator / infrastructure APIs** — explicit trust boundary, not principal-facing (§112, §113) |
+
+---
+
+## Diagnostics
+
+Validation (`validateGraph`): `AUTHORIZATION_INVALID_POLICY`, `AUTHORIZATION_INVALID_SCOPE`,
+`AUTHORIZATION_NONDETERMINISTIC`, `AUTHORIZATION_UNKNOWN_POLICY` — see
+[`VALIDATION.md`](VALIDATION.md). Every one is structured; a malformed policy never produces
+a native exception (spec15 §37).
+
+Runtime refusal: `AUTHORIZATION_DENIED` — the canonical code a denied `action.invoke`
+(Phase C), `query.read` (Phase D — including a live query whose caller is revoked
+mid-subscription, Phase F), `workflow.start` or `workflow.cancel` (Phase E) returns. On a
+live subscription it arrives as `{ kind: 'error', code: 'AUTHORIZATION_DENIED' }` and the
+stream serves no further data. Its `details` carry the canonical `operation`, a non-secret
+machine `reason` —
+`policy-denied` (the policy is not exactly `true`), `policy-error` (the policy threw — an
+evaluation error is DENY, never ALLOW, spec15 §123), `legacy-denied` / `legacy-error` (the
+legacy `authorization` expression), or (for workflow instance ops with no policy declared)
+`owner-mismatch`, or (spec15pt2 F3, when `host.authenticate` itself threw)
+`authentication-error` with `operation: 'authentication'` — plus `actionId` / `queryId`
+where applicable. A denied `query` operation
+inside an action surfaces as `QUERY_OPERATION_FAILED` with `details.code =
+'AUTHORIZATION_DENIED'` and rolls the action transaction back. A denied `workflow.inspect` /
+`workflow.history` is answered like a missing instance (`undefined` / `[]`), never
+`AUTHORIZATION_DENIED` — no existence leak (§39). No state value, credential, claim or token
+crosses the boundary (spec15 §38, §66, §68). The refusal survives transport faithfully
+(never a `500` / native exception). It is a **terminal** semantic refusal — not a retryable
+infrastructure failure: a workflow action denied at a step routes to `onError` / fails, and
+the attempt count does not grow (spec15 §56, §109).
+
+`AUTHORIZATION_ENFORCEMENT_UNAVAILABLE` — `createAxiomServer` refuses at admission when the
+IR carries authorization vocabulary a phase has **not yet** wired. Every
+`AuthorizationPolicyDef` reference the graph vocabulary defines is now enforced, so the gate
+is dormant; it is kept as the fail-closed extension point for a later phase.
+
+---
+
+## Static analysis (`AgentAPI.analyzeAuthorization`)
+
+`AgentAPI.analyzeAuthorization()` returns an `AuthorizationAnalysis` over the graph — no
+running authority, and it never claims a principal *is* authorized where it cannot prove it
+(spec15 §42, §50). It exposes policy **structure**, never a runtime secret (spec15 §83):
+
+- `policies[]` — per `AuthorizationPolicyDef`: `principalFields` / `resourceFields` (field
+  ids read off each scope), `readsOperation`, `constant` (`always-allow` / `always-deny` /
+  `null`), a secret-free one-line `summary` (`requires RESOURCE.field_doc_owner ==
+  PRINCIPAL.field_user_id`), and any `AUTHORIZATION_*` `problems`.
+- `operations[]` — every `action.invoke` / `query.read` / `workflow.*` surface with its
+  `protection` (`policy` / `legacy-expression` / `policy+legacy` / `read-policy` /
+  `policy+read-policy` / `owner-fingerprint` / `public`) and an `unresolved` flag.
+- `unprotected[]` — every surface with **no** explicit authorization boundary (a `public`
+  action or query; a workflow with no `startPolicy`). A workflow instance op with no
+  `instanceAccessPolicy` is *not* unresolved — owner-fingerprint is a defined default.
+- `workflows[]` — `start` / `instanceAccess` mode, `actionDependencies` (each step's
+  `ActionDef` with its own protection), and `privilegeReviewActions` — action steps whose
+  `ActionDef` carries a policy that static analysis cannot prove the start principal
+  satisfies (the runtime enforces it per step, spec15 §10, §101).
+- `usesAuthorizationVocabulary` — `true` ⇒ the graph requires `axiom.server.v9`.
+
+`authorizationPolicyDependencies(policy)` (core) is the total, secret-free primitive the
+analysis is built on.
+
+---
+
+## Conformance
+
+`axiom.conformance.v9` (`conformance/authorization/`) is the portable authorization tier.
+Each fixture is a compiled `axiom.server.v9` Server IR, the principal records each
+credential resolves to, provider seed rows, and a deterministic driver script — every step
+carrying the **decision the fixture author computed independently** (ALLOW / DENY, and for a
+query the exact set of authorized row ids). `runAuthorizationConformanceFixture` /
+`runAuthorizationConformanceSuite` (from `@cynodia/axiom-server`) run a fixture through a
+real authority and assert the runtime matches and that a denied step changed nothing
+(spec15 §115). The tier is verified over both memory and SQLite persistence (spec15 §114).
+Covered categories (spec15 §71): allow, deny, anonymous, owner, cross-principal, role/claim
+condition, resource-owner condition, tenant isolation, query filtering, action invocation,
+workflow continuation / cancellation / inspection, live-query resume, and the fail-closed
+behaviour of a constant-deny (mixed-build-incompatible) policy. Full semantic-fingerprint
+divergence and real-process crash boundaries are the Phase I suite.
+
+---
+
+## Not in 0.15
+
+Axiom consumes canonical principals from authentication infrastructure and defines
+*application* authorization. Out of scope: OAuth/OIDC, user management, MFA, delegation /
+impersonation (`actAs` / `sudo` / `assumeRole`), an ABAC language with arbitrary functions,
+external policy engines, cryptographic capability tokens, row encryption, an audit-log
+product (spec15 §51, §89). Stronger explainability and AI authoring build on this model in
+0.16.

package/docs/CONSTRAINTS.md

@@ -1,6 +1,6 @@
 # Constraints
 
-Axiom 0.14.0-alpha.5. Two constructs, answering different questions. They are not
+Axiom 0.15.0-alpha.2. Two constructs, answering different questions. They are not
 interchangeable.
 
 | | Question | Sees |

package/docs/DISTRIBUTED_AUTHORITY.md

@@ -1,6 +1,6 @@
 # Distributed authority
 
-*This document describes Axiom `0.14.0-alpha.5`.*
+*This document describes Axiom `0.15.0-alpha.2`.*
 
 The authoritative runtime (`docs/AUTHORITY.md`) may run as **more than one process at the
 same time**, over one shared persistence provider, without any change to the

package/docs/EFFECTS.md

@@ -1,6 +1,6 @@
 # Effects
 
-Axiom 0.14.0-alpha.5. External effects are not rollback-capable state mutations. This file
+Axiom 0.15.0-alpha.2. External effects are not rollback-capable state mutations. This file
 is the delivery model; [`AUTHORITY.md`](AUTHORITY.md#external-effects) is the load-bearing
 statement of why, and [`INTEGRATIONS.md`](INTEGRATIONS.md) is the operation vocabulary this
 builds on.

package/docs/EVENTS.md

@@ -1,6 +1,6 @@
 # Events
 
-Axiom 0.14.0-alpha.5. An event is a typed fact — something that happened — never work
+Axiom 0.15.0-alpha.2. An event is a typed fact — something that happened — never work
 itself. [`AUTHORITY.md`](AUTHORITY.md#external-events) is the load-bearing statement;
 this file is the vocabulary and the webhook delivery mechanism. A **subscription** is the
 other way an external fact becomes an `EventDef` payload — see

package/docs/EXPRESSIONS.md

@@ -1,6 +1,6 @@
 # Expressions
 
-Axiom 0.14.0-alpha.5. An expression describes **what value is computed**. It is a tree of
+Axiom 0.15.0-alpha.2. An expression describes **what value is computed**. It is a tree of
 plain data, never source text and never a callback. Evaluation is pure: an expression MUST
 NOT change state.
 
@@ -103,6 +103,14 @@ object([
 - `not` → `!truthy(operand)`.
 - `negate` → `-Number(operand ?? 0)`.
 
+> **Authorization policies evaluate differently for a missing security field.** An
+> `AuthorizationPolicyDef.allow` expression is run by a dedicated three-valued evaluator: a
+> `field(ref(PRINCIPAL) | ref(RESOURCE), F)` read of a field the scope object does not
+> carry is **security-scope absence**, not an ordinary `undefined`. A comparison, `not`,
+> `neq` or `or` whose truth would depend on absence is *not satisfied*, so the policy
+> DENIES (spec15pt2 F1). This is scoped to `allow` evaluation — the general expression
+> semantics above are unchanged everywhere else, including in `ActionDef.authorization`.
+
 ### `call(fn, ...args)`
 
 Calls a built-in. See [Built-in functions](#built-in-functions).

package/docs/GRAPH_MODEL.md

@@ -1,6 +1,6 @@
 # Graph model
 
-Axiom 0.14.0-alpha.5. The `ApplicationGraph` is the authoritative representation of an
+Axiom 0.15.0-alpha.2. The `ApplicationGraph` is the authoritative representation of an
 application. Everything else — the IR, the page, the DOM — is derived from it and is never
 edited.
 

package/docs/INTEGRATIONS.md

@@ -1,6 +1,6 @@
 # Integrations
 
-Axiom 0.14.0-alpha.5. How an application declares and calls an external system, without
+Axiom 0.15.0-alpha.2. How an application declares and calls an external system, without
 embedding a transport, an SDK or a secret in the graph. The authority boundary this
 depends on is [`AUTHORITY.md`](AUTHORITY.md#external-systems); this file is the vocabulary.
 

package/docs/LIVE_QUERIES.md

@@ -1,6 +1,6 @@
 # Realtime — live canonical queries
 
-Axiom 0.14.0-alpha.5. The operational contract for **observing a `QueryDef` result over
+Axiom 0.15.0-alpha.2. The operational contract for **observing a `QueryDef` result over
 time**: subscribe once, receive an initial coherent result, then receive canonical changes
 as authoritative committed state moves — through any compatible authority, across
 reconnects. `axiom.server.v7` (0.13 adds no IR vocabulary).

package/docs/LOCATIONS.md

@@ -1,6 +1,6 @@
 # Locations
 
-Axiom 0.14.0-alpha.5.
+Axiom 0.15.0-alpha.2.
 
 ```text
 Expression = a value

package/docs/MIGRATIONS.md

@@ -1,6 +1,6 @@
 # Schema evolution & semantic migrations
 
-Axiom 0.14.0-alpha.5. The operational contract for evolving a deployed application's
+Axiom 0.15.0-alpha.2. The operational contract for evolving a deployed application's
 semantic model and its persisted canonical data over time — adding a required field,
 splitting one field into two, removing an obsolete one, migrating millions of
 provider-backed rows — **without** an application-authored SQL migration, an ORM migration,

package/docs/PRESENTATION.md

@@ -1,6 +1,6 @@
 # Presentation
 
-Axiom 0.14.0-alpha.5. Presentation is **semantic UX intent**, expressed as data on a UI
+Axiom 0.15.0-alpha.2. Presentation is **semantic UX intent**, expressed as data on a UI
 node. It names roles, tokens and device classes. It never names a colour, a length, a media
 query or a CSS property.
 

package/docs/QUERIES.md

@@ -1,6 +1,6 @@
 # Semantic data access & the query layer
 
-Axiom 0.14.0-alpha.5. The operational contract for demand-driven reads over authoritative
+Axiom 0.15.0-alpha.2. The operational contract for demand-driven reads over authoritative
 data that is too large to materialize as a `StateDef` — 500,000 orders, 5,000,000 order
 lines, years of audit rows. `axiom.server.v6`.
 

package/docs/RUNTIME.md

@@ -1,6 +1,6 @@
 # Runtime
 
-Axiom 0.14.0-alpha.5. The runtime executes an `ApplicationIR`. It is domain-independent: it
+Axiom 0.15.0-alpha.2. The runtime executes an `ApplicationIR`. It is domain-independent: it
 contains no knowledge of any application.
 
 ## Constructing

package/docs/SEMANTIC_CONTRACT.md

@@ -1,6 +1,6 @@
 # Semantic contract
 
-Axiom 0.14.0-alpha.5. Runtime guarantees, stated formally. This file defines behavior; it
+Axiom 0.15.0-alpha.2. Runtime guarantees, stated formally. This file defines behavior; it
 does not teach. Where this file and any specification in `../specs/` disagree, this file
 describes the implementation and is authoritative.
 

package/docs/STATE.md

@@ -1,6 +1,6 @@
 # State
 
-Axiom 0.14.0-alpha.5. A `StateDef` is a named application value: stored, or computed from
+Axiom 0.15.0-alpha.2. A `StateDef` is a named application value: stored, or computed from
 other state.
 
 ```ts

package/docs/STORAGE.md

@@ -1,6 +1,6 @@
 # Storage and blobs
 
-Axiom 0.14.0-alpha.5. How an application stores, references, serves and deletes binary data —
+Axiom 0.15.0-alpha.2. How an application stores, references, serves and deletes binary data —
 an attachment, a document, a photograph, a diagnostic log — with no filesystem path, no
 upload route and no download route anywhere in it.
 

package/docs/SUBSCRIPTIONS.md

@@ -1,6 +1,6 @@
 # Subscriptions
 
-Axiom 0.14.0-alpha.5. How an application receives a stream of external events — an MQTT
+Axiom 0.15.0-alpha.2. How an application receives a stream of external events — an MQTT
 topic, a WebSocket feed, a queue consumer, a filesystem watcher, a serial port — without a
 client, a socket or a callback anywhere in the graph.
 

package/docs/TRIGGERS.md

@@ -1,6 +1,6 @@
 # Triggers
 
-Axiom 0.14.0-alpha.5. A `TriggerDef` says **when** an action should be invoked, without
+Axiom 0.15.0-alpha.2. A `TriggerDef` says **when** an action should be invoked, without
 embedding callback code. `docs/AUTHORITY.md`
 [§ Triggers](AUTHORITY.md#triggers) is the load-bearing statement of the execution model;
 this file is the vocabulary.

package/docs/UI.md

@@ -1,6 +1,6 @@
 # UI
 
-Axiom 0.14.0-alpha.5. Eleven semantic UI node kinds describe **what exists and what it does**.
+Axiom 0.15.0-alpha.2. Eleven semantic UI node kinds describe **what exists and what it does**.
 How it looks is [presentation](PRESENTATION.md).
 
 All eleven share `UIBase`:

package/docs/VALIDATION.md

@@ -1,6 +1,6 @@
 # Validation
 
-Axiom 0.14.0-alpha.5. Validation is authoring-time structural checking. It is not the same
+Axiom 0.15.0-alpha.2. Validation is authoring-time structural checking. It is not the same
 as runtime constraint evaluation — see [`CONSTRAINTS.md`](CONSTRAINTS.md) for the four
 layers of correctness.
 
@@ -36,7 +36,7 @@ non-numeric collections, and obviously incompatible assignments.
 
 ## Codes
 
-121 codes, exported as `VALIDATION_CODES`. Every one is reachable.
+125 codes, exported as `VALIDATION_CODES`. Every one is reachable.
 
 ### Ids and references
 
@@ -229,6 +229,20 @@ permanently `running` workflow.
 | `WORKFLOW_EXPRESSION_SCOPE` | A workflow expression references an id outside the workflow expression scope: `ref(<input id>)`, `ref(<binding id>)`, `ref('EVENT')` (only inside a `wait-event` `where` / `bind`), `ref('PRINCIPAL')`. Not a `StateDef`, not a `QueryDef`. |
 | `WORKFLOW_NONDETERMINISTIC` | A workflow expression calls `now` / `uuid` / `random`. Workflow decisions must be deterministic and replayable. |
 
+### Authorization (0.15)
+
+Full model: [`AUTHORIZATION.md`](AUTHORIZATION.md). Whether a principal may perform a
+semantic operation is executable meaning; a malformed `AuthorizationPolicyDef` is rejected
+by `validateGraph` before it can be compiled to `axiom.server.v9` or executed, always as a
+structured diagnostic, never a native exception (spec15 §36, §37).
+
+| Code | Raised when |
+| --- | --- |
+| `AUTHORIZATION_INVALID_POLICY` | An `AuthorizationPolicyDef` that is not an object, or has no boolean `allow` expression. |
+| `AUTHORIZATION_INVALID_SCOPE` | An `AuthorizationPolicyDef.allow` expression references an id outside the closed policy scope: `ref('PRINCIPAL')`, `ref('RESOURCE')`, `ref('OPERATION')`. Not a `StateDef`, not a `QueryDef`, no ambient runtime state. |
+| `AUTHORIZATION_NONDETERMINISTIC` | An `AuthorizationPolicyDef.allow` expression calls `now` / `uuid` / `random`. An authorization decision must be deterministic for the same semantic inputs. |
+| `AUTHORIZATION_UNKNOWN_POLICY` | An `authorizationPolicy` (action / query), `startPolicy` or `instanceAccessPolicy` (workflow) id that does not resolve to an `authorization-policy` node. |
+
 ### UI and routing
 
 | Code | Raised when | Severity |

package/docs/WORKFLOWS.md

@@ -1,6 +1,6 @@
 # Durable workflows
 
-Axiom 0.14.0-alpha.5. The operational contract for **long-running semantic computations with
+Axiom 0.15.0-alpha.2. The operational contract for **long-running semantic computations with
 a durable control position** — orchestration that survives process death, authority
 failover, retries, timer delivery, event delivery and ordinary distributed contention
 without application-owned infrastructure. `axiom.server.v8`.
@@ -255,7 +255,7 @@ step's argument expressions / `retry` policy, a `wait-event` step's `where` / `b
   or binding migration, and none is inferred ("closest step" recovery never happens).
 - A graph with **no** `WorkflowDef` compiles to the byte-identical `axiom.server.v1`–`v7`
   document it always did, and its `semanticFingerprint` / `schemaFingerprint` are unchanged.
-- Pre-`0.14.0-alpha.5` instances carry a compatibility key computed before `WorkflowDef`
+- Pre-`0.15.0-alpha.2` instances carry a compatibility key computed before `WorkflowDef`
   participated; a corrected authority treats them as incompatible and fails closed (these
   are pre-freeze alpha releases — silent reinterpretation is the only unacceptable
   outcome).

package/llms.txt

@@ -1,6 +1,6 @@
 # Axiom
 
-> AI-native semantic application framework, version 0.14.0-alpha.5. An Axiom application is a
+> AI-native semantic application framework, version 0.15.0-alpha.2. An Axiom application is a
 > typed semantic graph — state, behavior, constraints, UI structure, presentation and
 > authority as structured data — executed by generic runtimes. The JavaScript, HTML and CSS
 > that reach a browser are compiler output and are never authored or edited. The primary

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cynodia/axiom",
-  "version": "0.14.0-alpha.5",
+  "version": "0.15.0-alpha.2",
   "description": "AI-native semantic web application framework.",
   "license": "MIT",
   "author": "AskTech AS",
@@ -34,10 +34,10 @@
     }
   },
   "dependencies": {
-    "@cynodia/axiom-core": "0.14.0-alpha.5",
-    "@cynodia/axiom-runtime": "0.14.0-alpha.5",
-    "@cynodia/axiom-compiler": "0.14.0-alpha.5",
-    "@cynodia/axiom-agent-api": "0.14.0-alpha.5"
+    "@cynodia/axiom-core": "0.15.0-alpha.2",
+    "@cynodia/axiom-runtime": "0.15.0-alpha.2",
+    "@cynodia/axiom-compiler": "0.15.0-alpha.2",
+    "@cynodia/axiom-agent-api": "0.15.0-alpha.2"
   },
   "scripts": {
     "build": "tsc -b tsconfig.json"