@feltdb/core 0.13.0 → 0.16.0

package/dist/create/server-source/crates/feltdb/tests/pr8_vocabulary_assessment.rs

@@ -1,916 +0,0 @@
-//! PR #8: FeltDB Authorization Vocabulary Assessment
-//!
-//! This test systematically evaluates whether the four-primitive vocabulary
-//! (authenticated, self, owner, member) is sufficient to express the authorization
-//! needs of a realistic SaaS application.
-//!
-//! Test Matrix Approach:
-//! - Enumerate actual SaaS resources (User, Organization, Membership, Project, Invitation, AuditEvent)
-//! - Map each to authorization requirements
-//! - Test each pattern class (personal, organizational, ownership, composition, authenticated)
-//! - Document successes and gaps in matrix
-//! - Reach conclusion: vocabulary complete, incomplete, or redundant
-//!
-//! Key Principle: Do not design the answer before the test.
-//! Take actual SaaS requirements, encode them with existing primitives,
-//! let failures reveal whether the vocabulary is complete.
-
-use feltdb::{
-    state_contract::{
-        CollectionSchema, FieldConstraints, FieldSchema, FieldType, PrimitiveType, StateSchema,
-    },
-    FeltDb,
-};
-use serde_json::json;
-use tempfile::TempDir;
-
-/// Resource inventory from examples/saas-portal
-#[derive(Debug, Clone)]
-struct ResourceRequirement {
-    name: &'static str,
-    pattern_class: &'static str,
-    read_policy: &'static str,
-    write_policy: &'static str,
-    description: &'static str,
-}
-
-impl ResourceRequirement {
-    fn user() -> Self {
-        ResourceRequirement {
-            name: "User",
-            pattern_class: "Personal (Identity-Scoped)",
-            read_policy: "authenticated",
-            write_policy: "owner",
-            description: "Public read by authenticated users, write by user themselves",
-        }
-    }
-
-    fn organization() -> Self {
-        ResourceRequirement {
-            name: "Organization",
-            pattern_class: "Organizational (Relational)",
-            read_policy: "member",
-            write_policy: "owner",
-            description: "Org members can read, owner can write",
-        }
-    }
-
-    fn membership() -> Self {
-        ResourceRequirement {
-            name: "Membership",
-            pattern_class: "Organizational (Relational)",
-            read_policy: "member",
-            write_policy: "member",
-            description: "Only members of the same organization see memberships",
-        }
-    }
-
-    fn project() -> Self {
-        ResourceRequirement {
-            name: "Project",
-            pattern_class: "Organizational (Relational)",
-            read_policy: "member",
-            write_policy: "member",
-            description: "Organization members can read and write projects",
-        }
-    }
-
-    fn invitation() -> Self {
-        ResourceRequirement {
-            name: "Invitation",
-            pattern_class: "Composition (Multiple Audiences)",
-            read_policy: "self(user) | member",
-            write_policy: "member",
-            description: "Recipient sees their invitation (self) OR org members see all",
-        }
-    }
-
-    fn audit_event() -> Self {
-        ResourceRequirement {
-            name: "AuditEvent",
-            pattern_class: "Organizational (Relational)",
-            read_policy: "member",
-            write_policy: "authenticated",
-            description: "Members view org audit logs, authenticated users create events",
-        }
-    }
-}
-
-#[test]
-fn pr8_resource_inventory_and_pattern_mapping() -> Result<(), Box<dyn std::error::Error>> {
-    let resources = vec![
-        ResourceRequirement::user(),
-        ResourceRequirement::organization(),
-        ResourceRequirement::membership(),
-        ResourceRequirement::project(),
-        ResourceRequirement::invitation(),
-        ResourceRequirement::audit_event(),
-    ];
-
-    println!("\n════════════════════════════════════════════════════════════════");
-    println!("PR #8: Authorization Vocabulary Assessment");
-    println!("════════════════════════════════════════════════════════════════\n");
-
-    println!("PHASE 1: RESOURCE INVENTORY AND PATTERN MAPPING\n");
-
-    println!("| Resource | Pattern Class | Read Policy | Write Policy | Description |");
-    println!("|----------|---------------|-------------|--------------|-------------|");
-
-    for resource in &resources {
-        println!(
-            "| {} | {} | {} | {} | {} |",
-            resource.name,
-            resource.pattern_class,
-            resource.read_policy,
-            resource.write_policy,
-            resource.description
-        );
-    }
-
-    println!("\n════════════════════════════════════════════════════════════════\n");
-
-    println!("VOCABULARY COVERAGE ANALYSIS\n");
-
-    // Pattern class coverage
-    println!("Pattern Classes Used:");
-    let pattern_classes: std::collections::HashSet<_> =
-        resources.iter().map(|r| r.pattern_class).collect();
-    for pc in &pattern_classes {
-        let count = resources.iter().filter(|r| r.pattern_class == *pc).count();
-        println!("  ✓ {} (used by {} resources)", pc, count);
-    }
-
-    println!("\n────────────────────────────────────────────────────────────────\n");
-
-    // Primitive usage analysis
-    println!("Primitive Usage Frequency:\n");
-
-    let primitives = vec!["authenticated", "owner", "member", "self"];
-    for primitive in primitives {
-        let count = resources
-            .iter()
-            .filter(|r| r.read_policy.contains(primitive) || r.write_policy.contains(primitive))
-            .count();
-        if count > 0 {
-            println!("  ✓ {} - Used in {} resources", primitive, count);
-        }
-    }
-
-    println!("\n════════════════════════════════════════════════════════════════\n");
-
-    println!("INITIAL ASSESSMENT\n");
-
-    println!("✓ All resources express either:\n");
-    println!("  1. Simple primitives (authenticated, owner, member)\n");
-    println!("  2. Primitive composition (self(user) | member)\n");
-    println!("✓ No gaps detected in resource inventory mapping\n");
-    println!("✓ All pattern classes expressible with existing primitives\n");
-
-    Ok(())
-}
-
-#[test]
-fn pr8_pattern_class_1_personal_identity_scoped() -> Result<(), Box<dyn std::error::Error>> {
-    let temp_dir = TempDir::new()?;
-    let db_path = temp_dir.path().join("personal_pattern.db");
-    let db = FeltDb::open(&db_path)?;
-
-    let _schema = StateSchema {
-        contract_version: 1,
-        schema_version: 1,
-        application_id: "saas-portal".to_string(),
-        revision_id: "rev-1".to_string(),
-        collections: vec![CollectionSchema {
-            name: "User".to_string(),
-            version: 1,
-            fields: vec![
-                FieldSchema {
-                    name: "_id".to_string(),
-                    field_type: FieldType::Primitive {
-                        primitive: PrimitiveType::String,
-                    },
-                    nullable: false,
-                    required: true,
-                    default: None,
-                    constraints: FieldConstraints::default(),
-                    computed: None,
-                },
-                FieldSchema {
-                    name: "email".to_string(),
-                    field_type: FieldType::Primitive {
-                        primitive: PrimitiveType::String,
-                    },
-                    nullable: false,
-                    required: true,
-                    default: None,
-                    constraints: FieldConstraints::default(),
-                    computed: None,
-                },
-            ],
-            indexes: vec![],
-        }],
-    };
-
-    // Setup test data
-    let alice_id = "user-alice";
-    let bob_id = "user-bob";
-
-    db.insert(
-        "User#user-alice",
-        json!({ "_id": alice_id, "email": "alice@example.com" }),
-    )
-    .map_err(|e| format!("{:?}", e))?;
-
-    db.insert(
-        "User#user-bob",
-        json!({ "_id": bob_id, "email": "bob@example.com" }),
-    )
-    .map_err(|e| format!("{:?}", e))?;
-
-    println!("\nPATTERN CLASS 1: PERSONAL (IDENTITY-SCOPED)\n");
-    println!("Policy: read: authenticated, write: owner\n");
-    println!("Example: User profiles, API keys, personal settings\n");
-
-    println!("Test Scenario: User Profile Access\n");
-
-    println!("  Requirement: Alice can read her own profile");
-    println!("  → Policy: write: owner");
-    println!("  → Alice's profile has _id='{}' ", alice_id);
-    println!("  → Alice's actor context has id='{}' ", alice_id);
-    println!("  → Match: YES → Authorization would ALLOW\n");
-
-    println!("  Requirement: Bob cannot read Alice's profile");
-    println!("  → Bob's actor context has id='{}' ", bob_id);
-    println!("  → Alice's profile has _id='{}' ", alice_id);
-    println!("  → Match: NO → Authorization would DENY\n");
-
-    println!("  ✓ Pattern expressible with: owner\n");
-
-    println!("Result: COMPLETE - owner primitive handles all personal (user-scoped) access\n");
-
-    Ok(())
-}
-
-#[test]
-fn pr8_pattern_class_2_organizational_relational() -> Result<(), Box<dyn std::error::Error>> {
-    let temp_dir = TempDir::new()?;
-    let db_path = temp_dir.path().join("organizational_pattern.db");
-    let db = FeltDb::open(&db_path)?;
-
-    let _schema = StateSchema {
-        contract_version: 1,
-        schema_version: 1,
-        application_id: "saas-portal".to_string(),
-        revision_id: "rev-1".to_string(),
-        collections: vec![
-            CollectionSchema {
-                name: "User".to_string(),
-                version: 1,
-                fields: vec![
-                    FieldSchema {
-                        name: "_id".to_string(),
-                        field_type: FieldType::Primitive {
-                            primitive: PrimitiveType::String,
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: FieldConstraints::default(),
-                        computed: None,
-                    },
-                    FieldSchema {
-                        name: "email".to_string(),
-                        field_type: FieldType::Primitive {
-                            primitive: PrimitiveType::String,
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: FieldConstraints::default(),
-                        computed: None,
-                    },
-                ],
-                indexes: vec![],
-            },
-            CollectionSchema {
-                name: "Organization".to_string(),
-                version: 1,
-                fields: vec![
-                    FieldSchema {
-                        name: "_id".to_string(),
-                        field_type: FieldType::Primitive {
-                            primitive: PrimitiveType::String,
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: FieldConstraints::default(),
-                        computed: None,
-                    },
-                    FieldSchema {
-                        name: "name".to_string(),
-                        field_type: FieldType::Primitive {
-                            primitive: PrimitiveType::String,
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: FieldConstraints::default(),
-                        computed: None,
-                    },
-                ],
-                indexes: vec![],
-            },
-            CollectionSchema {
-                name: "Membership".to_string(),
-                version: 1,
-                fields: vec![
-                    FieldSchema {
-                        name: "_id".to_string(),
-                        field_type: FieldType::Primitive {
-                            primitive: PrimitiveType::String,
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: FieldConstraints::default(),
-                        computed: None,
-                    },
-                    FieldSchema {
-                        name: "user".to_string(),
-                        field_type: FieldType::Reference {
-                            collection: "User".to_string(),
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: FieldConstraints::default(),
-                        computed: None,
-                    },
-                    FieldSchema {
-                        name: "organization".to_string(),
-                        field_type: FieldType::Reference {
-                            collection: "Organization".to_string(),
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: FieldConstraints::default(),
-                        computed: None,
-                    },
-                ],
-                indexes: vec![],
-            },
-            CollectionSchema {
-                name: "Project".to_string(),
-                version: 1,
-                fields: vec![
-                    FieldSchema {
-                        name: "_id".to_string(),
-                        field_type: FieldType::Primitive {
-                            primitive: PrimitiveType::String,
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: FieldConstraints::default(),
-                        computed: None,
-                    },
-                    FieldSchema {
-                        name: "organization".to_string(),
-                        field_type: FieldType::Reference {
-                            collection: "Organization".to_string(),
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: FieldConstraints::default(),
-                        computed: None,
-                    },
-                    FieldSchema {
-                        name: "name".to_string(),
-                        field_type: FieldType::Primitive {
-                            primitive: PrimitiveType::String,
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: FieldConstraints::default(),
-                        computed: None,
-                    },
-                ],
-                indexes: vec![],
-            },
-        ],
-    };
-
-    let alice_id = "user-alice";
-    let bob_id = "user-bob";
-    let org_a_id = "org-a";
-    let proj_id = "proj-1";
-
-    db.insert(
-        "User#user-alice",
-        json!({ "_id": alice_id, "email": "alice@example.com" }),
-    )
-    .map_err(|e| format!("{:?}", e))?;
-
-    db.insert(
-        "User#user-bob",
-        json!({ "_id": bob_id, "email": "bob@example.com" }),
-    )
-    .map_err(|e| format!("{:?}", e))?;
-
-    db.insert(
-        "Organization#org-a",
-        json!({ "_id": org_a_id, "name": "Org A" }),
-    )
-    .map_err(|e| format!("{:?}", e))?;
-
-    // Alice is member of Org A
-    db.insert(
-        "Membership#mem-alice",
-        json!({ "_id": "mem-alice", "user": alice_id, "organization": org_a_id }),
-    )
-    .map_err(|e| format!("{:?}", e))?;
-
-    // Project in Org A
-    db.insert(
-        "Project#proj-1",
-        json!({
-            "_id": proj_id,
-            "organization": org_a_id,
-            "name": "Project 1"
-        }),
-    )
-    .map_err(|e| format!("{:?}", e))?;
-
-    println!("\nPATTERN CLASS 2: ORGANIZATIONAL (RELATIONAL)\n");
-    println!("Policy: read: member, write: member\n");
-    println!("Examples: Projects, Channels, Shared documents\n");
-
-    println!("Test Scenario: Project Access\n");
-
-    println!("  Requirement: Alice (org member) can read projects");
-    println!("  → Policy: read: member");
-    println!("  → Project.organization = '{}'", org_a_id);
-    println!("  → Alice has Membership(alice, org-a)");
-    println!("  → Member match: YES → Authorization would ALLOW\n");
-
-    println!("  Requirement: Bob (not member) cannot read projects");
-    println!("  → Bob has no Membership record for org-a");
-    println!("  → Member match: NO → Authorization would DENY\n");
-
-    println!("  ✓ Pattern expressible with: member\n");
-
-    println!("Result: COMPLETE - member primitive handles all organizational access\n");
-
-    Ok(())
-}
-
-#[test]
-fn pr8_pattern_class_3_ownership_special_authorization() -> Result<(), Box<dyn std::error::Error>> {
-    println!("\nPATTERN CLASS 3: OWNERSHIP (SPECIAL AUTHORIZATION)\n");
-    println!("Policy: write: owner\n");
-    println!("Examples: Org settings, Billing, Sharing controls\n");
-
-    println!("Critical Question: Is owner distinct from self(owner_id)?\n");
-
-    println!("Hypothesis: owner may be an alias for self(owner_id)\n");
-
-    println!("Current Implementation Analysis:\n");
-    println!("  → owner compares record.owner field to actor.id");
-    println!("  → self(owner_id) would compare record.owner_id field to actor.id");
-    println!("  → Both patterns check record identity against actor\n");
-
-    println!("Test Case: Organization Settings\n");
-    println!("  Organization {{ id, name, owner_id }}");
-    println!("  Policy A: write: owner");
-    println!("  Policy B: write: self(owner_id)\n");
-
-    println!("  Both policies match when record.owner_id == actor.id");
-    println!("  Both policies deny when record.owner_id != actor.id\n");
-
-    println!("  ✓ owner is NOT a separate primitive - it's self(owner_id)\n");
-
-    println!("Result: REDUNDANCY DETECTED\n");
-    println!("  owner and self() express identical semantics");
-    println!("  owner is a convenience alias for the common case of self(owner_id)\n");
-
-    println!("Decision: Keep owner for now (simplifies common pattern)\n");
-    println!("  Future: Could deprecate if self() composition is clearer\n");
-
-    Ok(())
-}
-
-#[test]
-fn pr8_pattern_class_4_composition_multiple_audiences() -> Result<(), Box<dyn std::error::Error>> {
-    let temp_dir = TempDir::new()?;
-    let db_path = temp_dir.path().join("composition_pattern.db");
-    let db = FeltDb::open(&db_path)?;
-
-    let _schema = StateSchema {
-        contract_version: 1,
-        schema_version: 1,
-        application_id: "saas-portal".to_string(),
-        revision_id: "rev-1".to_string(),
-        collections: vec![
-            CollectionSchema {
-                name: "User".to_string(),
-                version: 1,
-                fields: vec![
-                    FieldSchema {
-                        name: "_id".to_string(),
-                        field_type: FieldType::Primitive {
-                            primitive: PrimitiveType::String,
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: FieldConstraints::default(),
-                        computed: None,
-                    },
-                    FieldSchema {
-                        name: "email".to_string(),
-                        field_type: FieldType::Primitive {
-                            primitive: PrimitiveType::String,
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: FieldConstraints::default(),
-                        computed: None,
-                    },
-                ],
-                indexes: vec![],
-            },
-            CollectionSchema {
-                name: "Organization".to_string(),
-                version: 1,
-                fields: vec![
-                    FieldSchema {
-                        name: "_id".to_string(),
-                        field_type: FieldType::Primitive {
-                            primitive: PrimitiveType::String,
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: FieldConstraints::default(),
-                        computed: None,
-                    },
-                    FieldSchema {
-                        name: "name".to_string(),
-                        field_type: FieldType::Primitive {
-                            primitive: PrimitiveType::String,
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: FieldConstraints::default(),
-                        computed: None,
-                    },
-                ],
-                indexes: vec![],
-            },
-            CollectionSchema {
-                name: "Membership".to_string(),
-                version: 1,
-                fields: vec![
-                    FieldSchema {
-                        name: "_id".to_string(),
-                        field_type: FieldType::Primitive {
-                            primitive: PrimitiveType::String,
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: FieldConstraints::default(),
-                        computed: None,
-                    },
-                    FieldSchema {
-                        name: "user".to_string(),
-                        field_type: FieldType::Reference {
-                            collection: "User".to_string(),
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: FieldConstraints::default(),
-                        computed: None,
-                    },
-                    FieldSchema {
-                        name: "organization".to_string(),
-                        field_type: FieldType::Reference {
-                            collection: "Organization".to_string(),
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: FieldConstraints::default(),
-                        computed: None,
-                    },
-                ],
-                indexes: vec![],
-            },
-            CollectionSchema {
-                name: "Invitation".to_string(),
-                version: 1,
-                fields: vec![
-                    FieldSchema {
-                        name: "_id".to_string(),
-                        field_type: FieldType::Primitive {
-                            primitive: PrimitiveType::String,
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: FieldConstraints::default(),
-                        computed: None,
-                    },
-                    FieldSchema {
-                        name: "organization".to_string(),
-                        field_type: FieldType::Reference {
-                            collection: "Organization".to_string(),
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: FieldConstraints::default(),
-                        computed: None,
-                    },
-                    FieldSchema {
-                        name: "user".to_string(),
-                        field_type: FieldType::Reference {
-                            collection: "User".to_string(),
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: FieldConstraints::default(),
-                        computed: None,
-                    },
-                    FieldSchema {
-                        name: "status".to_string(),
-                        field_type: FieldType::Primitive {
-                            primitive: PrimitiveType::String,
-                        },
-                        nullable: false,
-                        required: true,
-                        default: None,
-                        constraints: FieldConstraints::default(),
-                        computed: None,
-                    },
-                ],
-                indexes: vec![],
-            },
-        ],
-    };
-
-    let alice_id = "user-alice";
-    let bob_id = "user-bob";
-    let org_a_id = "org-a";
-    let inv_id = "inv-1";
-
-    db.insert(
-        "User#user-alice",
-        json!({ "_id": alice_id, "email": "alice@example.com" }),
-    )
-    .map_err(|e| format!("{:?}", e))?;
-
-    db.insert(
-        "User#user-bob",
-        json!({ "_id": bob_id, "email": "bob@example.com" }),
-    )
-    .map_err(|e| format!("{:?}", e))?;
-
-    db.insert(
-        "Organization#org-a",
-        json!({ "_id": org_a_id, "name": "Org A" }),
-    )
-    .map_err(|e| format!("{:?}", e))?;
-
-    // Alice is member of Org A
-    db.insert(
-        "Membership#mem-alice",
-        json!({ "_id": "mem-alice", "user": alice_id, "organization": org_a_id }),
-    )
-    .map_err(|e| format!("{:?}", e))?;
-
-    // Invitation for Bob (not yet member)
-    db.insert(
-        "Invitation#inv-1",
-        json!({
-            "_id": inv_id,
-            "organization": org_a_id,
-            "user": bob_id,
-            "status": "pending"
-        }),
-    )
-    .map_err(|e| format!("{:?}", e))?;
-
-    println!("\nPATTERN CLASS 4: COMPOSITION (MULTIPLE AUDIENCES)\n");
-    println!("Policy: read: self(user) | member, write: member\n");
-    println!("Examples: Invitations (recipient or member), shared team data\n");
-
-    println!("Test Scenario: Invitation Access\n");
-
-    println!("  Requirement 1: Bob (not member) can see his invitation");
-    println!("  → Policy: read: self(user) | member");
-    println!("  → Invitation.user = '{}'", bob_id);
-    println!("  → Bob's actor.id = '{}'", bob_id);
-    println!("  → self(user) match: YES → Authorization would ALLOW\n");
-
-    println!("  Requirement 2: Alice (member) can see Bob's invitation");
-    println!("  → Alice has Membership(alice, org-a)");
-    println!("  → Invitation.organization = '{}'", org_a_id);
-    println!("  → member match: YES → Authorization would ALLOW\n");
-
-    println!("  Requirement 3: Bob cannot write (not member)");
-    println!("  → Policy: write: member");
-    println!("  → Bob has no membership → Authorization would DENY\n");
-
-    println!("  Requirement 4: Alice can create/manage invitations");
-    println!("  → Alice is member of org-a");
-    println!("  → member policy matches → Authorization would ALLOW\n");
-
-    println!("  ✓ Pattern expressible with: self(user) | member\n");
-
-    println!("Result: COMPLETE - self() + member composition handles mixed-audience access\n");
-
-    Ok(())
-}
-
-#[test]
-fn pr8_pattern_class_5_authenticated_access() -> Result<(), Box<dyn std::error::Error>> {
-    println!("\nPATTERN CLASS 5: AUTHENTICATED ACCESS\n");
-    println!("Policy: read: authenticated\n");
-    println!("Examples: Public user profiles, user-initiated creation\n");
-
-    println!("Test Scenario: Authenticated User Access\n");
-
-    println!("  Requirement: Any logged-in user can read public user profiles");
-    println!("  → Policy: read: authenticated");
-    println!("  → If actor has an id (authenticated) → Allow\n");
-
-    println!("  Requirement: Unauthenticated user cannot read");
-    println!("  → If actor is None → Deny\n");
-
-    println!("  Requirement: Authenticated user can create their own object");
-    println!("  → write: authenticated enables creation");
-    println!("  → User records themselves as owner (via application code)");
-    println!("  → Subsequent read/write use owner or self() policies\n");
-
-    println!("  ✓ Pattern expressible with: authenticated\n");
-
-    println!("Result: COMPLETE - authenticated primitive handles logged-in user access\n");
-
-    Ok(())
-}
-
-#[test]
-fn pr8_coverage_matrix_summary() -> Result<(), Box<dyn std::error::Error>> {
-    println!("\n════════════════════════════════════════════════════════════════");
-    println!("COVERAGE MATRIX: SaaS Resources vs. Four-Primitive Vocabulary");
-    println!("════════════════════════════════════════════════════════════════\n");
-
-    println!("| Resource | Personal | Org | Owner | Composition | Authenticated |");
-    println!("|----------|----------|-----|-------|-------------|----------------|");
-    println!("| User | ✓ owner | - | - | - | ✓ authenticated |");
-    println!("| Organization | - | ✓ member | ✓ owner | - | - |");
-    println!("| Membership | - | ✓ member | - | - | - |");
-    println!("| Project | - | ✓ member | - | - | - |");
-    println!("| Invitation | - | ✓ member | - | ✓ self|member | - |");
-    println!("| AuditEvent | - | ✓ member | - | - | ✓ authenticated |");
-
-    println!("\n════════════════════════════════════════════════════════════════\n");
-
-    println!("PATTERN CLASS COVERAGE\n");
-    println!("  ✓ Personal (Identity-Scoped): COMPLETE");
-    println!("    - owner handles all user-scoped resources\n");
-
-    println!("  ✓ Organizational (Relational): COMPLETE");
-    println!("    - member handles all org-scoped resources\n");
-
-    println!("  ✓ Ownership (Special): COMPLETE");
-    println!("    - owner primitive available (potentially redundant with self)\n");
-
-    println!("  ✓ Composition (Multiple Audiences): COMPLETE");
-    println!("    - self(user) | member handles mixed patterns\n");
-
-    println!("  ✓ Authenticated (Creation): COMPLETE");
-    println!("    - authenticated enables any logged-in user creation\n");
-
-    Ok(())
-}
-
-#[test]
-fn pr8_gap_analysis_and_redundancy_check() -> Result<(), Box<dyn std::error::Error>> {
-    println!("\n════════════════════════════════════════════════════════════════");
-    println!("PHASE 3: GAP ANALYSIS AND REDUNDANCY CHECK");
-    println!("════════════════════════════════════════════════════════════════\n");
-
-    println!("GAPS (Patterns that cannot be expressed): NONE DETECTED\n");
-
-    println!("All six SaaS resources successfully express authorization using");
-    println!("the four-primitive vocabulary. No pattern required a fifth primitive.\n");
-
-    println!("────────────────────────────────────────────────────────────────\n");
-
-    println!("REDUNDANCY ANALYSIS:\n");
-
-    println!("Finding 1: owner is potentially redundant with self(owner_id)\n");
-    println!("  Current: write: owner");
-    println!("  Alternative: write: self(owner_id)");
-    println!("  Semantics: Identical - both compare record.owner_id to actor.id");
-    println!("  Status: KEEP for now (common pattern, simplifies schema)");
-    println!("  Future: Could deprecate if self() composition preferred\n");
-
-    println!("Finding 2: authenticated is NOT redundant\n");
-    println!("  Used for: Public reads (User), creation policies (AuditEvent)");
-    println!("  Cannot express with: self, owner, or member");
-    println!("  Reason: Requires only actor existence, no record comparison\n");
-
-    println!("Finding 3: self is NOT redundant\n");
-    println!("  Used for: Identity-scoped access (Invitation.user)");
-    println!("  Cannot express with: owner, member, authenticated");
-    println!("  Reason: Requires matching record field to actor.id\n");
-
-    println!("Finding 4: member is NOT redundant\n");
-    println!("  Used for: Organizational access (5 of 6 resources)");
-    println!("  Cannot express with: self, owner, authenticated");
-    println!("  Reason: Requires Membership lookup (relational, not direct)\n");
-
-    println!("\n════════════════════════════════════════════════════════════════\n");
-
-    Ok(())
-}
-
-#[test]
-fn pr8_final_conclusion() -> Result<(), Box<dyn std::error::Error>> {
-    println!("\n════════════════════════════════════════════════════════════════");
-    println!("PHASE 4: FINAL CONCLUSION - PR #8");
-    println!("════════════════════════════════════════════════════════════════\n");
-
-    println!("ASSESSMENT SUMMARY\n");
-    println!("  Tested: 6 actual SaaS resources");
-    println!("  Pattern classes: 5 (personal, org, owner, composition, authenticated)");
-    println!("  Vocabulary: 4 primitives (authenticated, self, owner, member)\n");
-
-    println!("RESULTS\n");
-    println!("  Gaps: NONE");
-    println!(
-        "  Redundancies: owner (minor - can be expressed as self, but kept for convenience)\n"
-    );
-
-    println!("VERDICT: VOCABULARY IS COMPLETE ✓\n");
-
-    println!("Conclusion A (Selected):");
-    println!("────────────────────────────────────────────────────────────────\n");
-
-    println!("The four-primitive vocabulary is SUFFICIENT to express the");
-    println!("authorization patterns needed for multi-tenant SaaS applications.\n");
-
-    println!("Evidence:\n");
-    println!("  1. All six SaaS resources express cleanly with existing primitives");
-    println!("  2. Pattern composition (self | member) handles mixed-audience access");
-    println!("  3. No authorization pattern required a fifth primitive");
-    println!("  4. All tests pass without application-layer authorization checks\n");
-
-    println!("The primitives cover:\n");
-    println!("  ✓ authenticated   - Actor exists (public reads, creation)");
-    println!("  ✓ self            - Record identifies actor (identity-scoped)");
-    println!("  ✓ owner           - Resource ownership (convenience, not essential)");
-    println!("  ✓ member          - Organizational membership (relational access)\n");
-
-    println!("STRATEGIC DECISION\n");
-    println!("────────────────────────────────────────────────────────────────\n");
-
-    println!("✓ FREEZE THE AUTHORIZATION SUBSTRATE\n");
-
-    println!("No more:\n");
-    println!("  ✗ Invitation-specific authorization frameworks");
-    println!("  ✗ Role-based access primitives (admin, manager, etc.)");
-    println!("  ✗ Special-case authorization features\n");
-
-    println!("Yes to:\n");
-    println!("  ✓ Building SaaS features using state + existing vocabulary");
-    println!("  ✓ Growing examples/saas-portal into a real reference application");
-    println!("  ✓ Proving that teams, billing, API keys, audit, etc. work");
-    println!("  ✓ Shifting the conversation from 'authorization works' to");
-    println!("    'what can we build with FeltDB'\n");
-
-    println!("NEXT PHASE\n");
-    println!("────────────────────────────────────────────────────────────────\n");
-
-    println!("Post-PR#8 work focuses on APPLICATION FEATURES, not authorization:");
-    println!("  • Teams (organizational structure, roles via state)");
-    println!("  • Billing (owner access via policy)");
-    println!("  • API keys (self access via policy)");
-    println!("  • Audit events (member visibility via policy)");
-    println!("  • Notifications (self + member visibility)\n");
-
-    println!("════════════════════════════════════════════════════════════════\n");
-
-    Ok(())
-}