@feltdb/core 0.15.0 → 0.16.0

package/dist/create/server-source/crates/feltdb/tests/pr9_phase2_boundary_tests.rs

@@ -1,1045 +0,0 @@
-//! PR #9 Phase 2: Security Boundary Tests
-//!
-//! This test interrogates the FeltDB runtime to determine what the frozen vocabulary
-//! actually permits at the database boundary.
-//!
-//! For each operation, we test systematically across all actor types:
-//! - owner (team owner)
-//! - admin (team admin)
-//! - member (team member)
-//! - non_member (org member, not on team)
-//! - revoked (was member, but membership removed)
-//! - cross_tenant (member of different org)
-//!
-//! CRITICAL DISTINCTION:
-//! Product Behavior: "Member should not see delete button"
-//! Authorization Invariant: "Member must be unable to delete via direct FeltDB call"
-//!
-//! Tests distinguish these explicitly. Passing tests by hiding UI is a failure.
-//!
-//! The hypothesis: Frozen vocabulary (authenticated, self, owner, member) is sufficient.
-//! Phase 2 tests: What does the boundary actually enforce?
-
-use feltdb::{
-    state_contract::{
-        begin_read, execute_query, AuthorizationContext, CanonicalQuery, CollectionSchema,
-        FieldConstraints, FieldSchema, FieldType, PrimitiveType, QueryFilter, StateSchema,
-    },
-    FeltDb,
-};
-use serde_json::{json, Value};
-use std::fmt;
-use tempfile::TempDir;
-
-/// Result of testing an operation at the FeltDB boundary
-#[derive(Debug, Clone, PartialEq, Eq)]
-enum BoundaryResult {
-    Permit,
-    Deny,
-}
-
-impl fmt::Display for BoundaryResult {
-    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        match self {
-            BoundaryResult::Permit => write!(f, "PERMIT"),
-            BoundaryResult::Deny => write!(f, "DENY"),
-        }
-    }
-}
-
-/// Test fixture for boundary testing
-struct TeamBoundaryTestFixture {
-    db: FeltDb,
-    // Actors
-    owner_id: String,
-    admin_id: String,
-    member_id: String,
-    non_member_id: String,
-    revoked_id: String,
-    cross_tenant_id: String,
-    // Resources
-    team_id: String,
-    org_id: String,
-    cross_org_id: String,
-}
-
-impl TeamBoundaryTestFixture {
-    /// Create an AuthorizationContext for a specific actor
-    fn actor_context(&self, actor_id: &str, name: &str) -> AuthorizationContext {
-        AuthorizationContext {
-            subject: format!(":{}", actor_id),
-            tenant_id: "tenant".to_string(),
-            application_id: "saas-portal".to_string(),
-            revision_id: "rev-1".to_string(),
-            capabilities: ["state:read".to_string()].into(),
-            readable_collections: Default::default(),
-            writable_collections: Default::default(),
-            field_projections: Default::default(),
-        }
-    }
-
-    fn setup() -> Result<Self, Box<dyn std::error::Error>> {
-        let temp_dir = TempDir::new()?;
-        let db_path = temp_dir.path().join("boundary_tests.db");
-        let db = FeltDb::open(&db_path)?;
-
-        let schema = StateSchema {
-            contract_version: 1,
-            schema_version: 1,
-            application_id: "saas-portal".to_string(),
-            revision_id: "rev-1".to_string(),
-            collections: vec![
-                // User collection
-                CollectionSchema {
-                    name: "User".to_string(),
-                    version: 1,
-                    fields: vec![
-                        FieldSchema {
-                            name: "_id".to_string(),
-                            field_type: FieldType::Primitive {
-                                primitive: PrimitiveType::String,
-                            },
-                            nullable: false,
-                            required: true,
-                            default: None,
-                            constraints: FieldConstraints::default(),
-                            computed: None,
-                        },
-                        FieldSchema {
-                            name: "email".to_string(),
-                            field_type: FieldType::Primitive {
-                                primitive: PrimitiveType::String,
-                            },
-                            nullable: false,
-                            required: true,
-                            default: None,
-                            constraints: FieldConstraints::default(),
-                            computed: None,
-                        },
-                    ],
-                    indexes: vec![],
-                },
-                // Organization collection
-                CollectionSchema {
-                    name: "Organization".to_string(),
-                    version: 1,
-                    fields: vec![
-                        FieldSchema {
-                            name: "_id".to_string(),
-                            field_type: FieldType::Primitive {
-                                primitive: PrimitiveType::String,
-                            },
-                            nullable: false,
-                            required: true,
-                            default: None,
-                            constraints: FieldConstraints::default(),
-                            computed: None,
-                        },
-                        FieldSchema {
-                            name: "name".to_string(),
-                            field_type: FieldType::Primitive {
-                                primitive: PrimitiveType::String,
-                            },
-                            nullable: false,
-                            required: true,
-                            default: None,
-                            constraints: FieldConstraints::default(),
-                            computed: None,
-                        },
-                    ],
-                    indexes: vec![],
-                },
-                // Membership collection
-                CollectionSchema {
-                    name: "Membership".to_string(),
-                    version: 1,
-                    fields: vec![
-                        FieldSchema {
-                            name: "_id".to_string(),
-                            field_type: FieldType::Primitive {
-                                primitive: PrimitiveType::String,
-                            },
-                            nullable: false,
-                            required: true,
-                            default: None,
-                            constraints: FieldConstraints::default(),
-                            computed: None,
-                        },
-                        FieldSchema {
-                            name: "user".to_string(),
-                            field_type: FieldType::Reference {
-                                collection: "User".to_string(),
-                            },
-                            nullable: false,
-                            required: true,
-                            default: None,
-                            constraints: FieldConstraints::default(),
-                            computed: None,
-                        },
-                        FieldSchema {
-                            name: "organization".to_string(),
-                            field_type: FieldType::Reference {
-                                collection: "Organization".to_string(),
-                            },
-                            nullable: false,
-                            required: true,
-                            default: None,
-                            constraints: FieldConstraints::default(),
-                            computed: None,
-                        },
-                        FieldSchema {
-                            name: "role".to_string(),
-                            field_type: FieldType::Primitive {
-                                primitive: PrimitiveType::String,
-                            },
-                            nullable: false,
-                            required: true,
-                            default: None,
-                            constraints: FieldConstraints::default(),
-                            computed: None,
-                        },
-                    ],
-                    indexes: vec![],
-                },
-                // Team collection
-                CollectionSchema {
-                    name: "Team".to_string(),
-                    version: 1,
-                    fields: vec![
-                        FieldSchema {
-                            name: "_id".to_string(),
-                            field_type: FieldType::Primitive {
-                                primitive: PrimitiveType::String,
-                            },
-                            nullable: false,
-                            required: true,
-                            default: None,
-                            constraints: FieldConstraints::default(),
-                            computed: None,
-                        },
-                        FieldSchema {
-                            name: "organization".to_string(),
-                            field_type: FieldType::Reference {
-                                collection: "Organization".to_string(),
-                            },
-                            nullable: false,
-                            required: true,
-                            default: None,
-                            constraints: FieldConstraints::default(),
-                            computed: None,
-                        },
-                        FieldSchema {
-                            name: "name".to_string(),
-                            field_type: FieldType::Primitive {
-                                primitive: PrimitiveType::String,
-                            },
-                            nullable: false,
-                            required: true,
-                            default: None,
-                            constraints: FieldConstraints::default(),
-                            computed: None,
-                        },
-                        FieldSchema {
-                            name: "owner".to_string(),
-                            field_type: FieldType::Reference {
-                                collection: "User".to_string(),
-                            },
-                            nullable: false,
-                            required: true,
-                            default: None,
-                            constraints: FieldConstraints::default(),
-                            computed: None,
-                        },
-                    ],
-                    indexes: vec![],
-                },
-                // TeamMembership collection
-                CollectionSchema {
-                    name: "TeamMembership".to_string(),
-                    version: 1,
-                    fields: vec![
-                        FieldSchema {
-                            name: "_id".to_string(),
-                            field_type: FieldType::Primitive {
-                                primitive: PrimitiveType::String,
-                            },
-                            nullable: false,
-                            required: true,
-                            default: None,
-                            constraints: FieldConstraints::default(),
-                            computed: None,
-                        },
-                        FieldSchema {
-                            name: "team".to_string(),
-                            field_type: FieldType::Reference {
-                                collection: "Team".to_string(),
-                            },
-                            nullable: false,
-                            required: true,
-                            default: None,
-                            constraints: FieldConstraints::default(),
-                            computed: None,
-                        },
-                        FieldSchema {
-                            name: "user".to_string(),
-                            field_type: FieldType::Reference {
-                                collection: "User".to_string(),
-                            },
-                            nullable: false,
-                            required: true,
-                            default: None,
-                            constraints: FieldConstraints::default(),
-                            computed: None,
-                        },
-                        FieldSchema {
-                            name: "role".to_string(),
-                            field_type: FieldType::Primitive {
-                                primitive: PrimitiveType::String,
-                            },
-                            nullable: false,
-                            required: true,
-                            default: None,
-                            constraints: FieldConstraints::default(),
-                            computed: None,
-                        },
-                    ],
-                    indexes: vec![],
-                },
-            ],
-        };
-
-        // IDs
-        let owner_id = "user-owner".to_string();
-        let admin_id = "user-admin".to_string();
-        let member_id = "user-member".to_string();
-        let non_member_id = "user-non-member".to_string();
-        let revoked_id = "user-revoked".to_string();
-        let cross_tenant_id = "user-cross-tenant".to_string();
-
-        let org_id = "org-main".to_string();
-        let cross_org_id = "org-other".to_string();
-        let team_id = "team-backend".to_string();
-
-        // Create users
-        db.insert(
-            "User#user-owner",
-            json!({ "_id": owner_id, "email": "owner@example.com" }),
-        )
-        .map_err(|e| format!("{:?}", e))?;
-        db.insert(
-            "User#user-admin",
-            json!({ "_id": admin_id, "email": "admin@example.com" }),
-        )
-        .map_err(|e| format!("{:?}", e))?;
-        db.insert(
-            "User#user-member",
-            json!({ "_id": member_id, "email": "member@example.com" }),
-        )
-        .map_err(|e| format!("{:?}", e))?;
-        db.insert(
-            "User#user-non-member",
-            json!({ "_id": non_member_id, "email": "nonmember@example.com" }),
-        )
-        .map_err(|e| format!("{:?}", e))?;
-        db.insert(
-            "User#user-revoked",
-            json!({ "_id": revoked_id, "email": "revoked@example.com" }),
-        )
-        .map_err(|e| format!("{:?}", e))?;
-        db.insert(
-            "User#user-cross-tenant",
-            json!({ "_id": cross_tenant_id, "email": "cross@example.com" }),
-        )
-        .map_err(|e| format!("{:?}", e))?;
-
-        // Create organizations
-        db.insert(
-            "Organization#org-main",
-            json!({ "_id": org_id, "name": "Main Org" }),
-        )
-        .map_err(|e| format!("{:?}", e))?;
-        db.insert(
-            "Organization#org-other",
-            json!({ "_id": cross_org_id, "name": "Other Org" }),
-        )
-        .map_err(|e| format!("{:?}", e))?;
-
-        // Create org memberships (establishes organization access)
-        db.insert(
-            "Membership#mem-owner",
-            json!({
-                "_id": "mem-owner",
-                "user": owner_id,
-                "organization": org_id,
-                "role": "owner"
-            }),
-        )
-        .map_err(|e| format!("{:?}", e))?;
-
-        db.insert(
-            "Membership#mem-admin",
-            json!({
-                "_id": "mem-admin",
-                "user": admin_id,
-                "organization": org_id,
-                "role": "member"
-            }),
-        )
-        .map_err(|e| format!("{:?}", e))?;
-
-        db.insert(
-            "Membership#mem-member",
-            json!({
-                "_id": "mem-member",
-                "user": member_id,
-                "organization": org_id,
-                "role": "member"
-            }),
-        )
-        .map_err(|e| format!("{:?}", e))?;
-
-        db.insert(
-            "Membership#mem-non-member",
-            json!({
-                "_id": "mem-non-member",
-                "user": non_member_id,
-                "organization": org_id,
-                "role": "member"
-            }),
-        )
-        .map_err(|e| format!("{:?}", e))?;
-
-        db.insert(
-            "Membership#mem-revoked",
-            json!({
-                "_id": "mem-revoked",
-                "user": revoked_id,
-                "organization": org_id,
-                "role": "member"
-            }),
-        )
-        .map_err(|e| format!("{:?}", e))?;
-
-        db.insert(
-            "Membership#mem-cross-tenant",
-            json!({
-                "_id": "mem-cross-tenant",
-                "user": cross_tenant_id,
-                "organization": cross_org_id,
-                "role": "member"
-            }),
-        )
-        .map_err(|e| format!("{:?}", e))?;
-
-        // Create team
-        db.insert(
-            "Team#team-backend",
-            json!({
-                "_id": team_id,
-                "organization": org_id,
-                "name": "Backend Team",
-                "owner": owner_id
-            }),
-        )
-        .map_err(|e| format!("{:?}", e))?;
-
-        // Create team memberships
-        db.insert(
-            "TeamMembership#tm-owner",
-            json!({
-                "_id": "tm-owner",
-                "team": team_id,
-                "user": owner_id,
-                "role": "owner"
-            }),
-        )
-        .map_err(|e| format!("{:?}", e))?;
-
-        db.insert(
-            "TeamMembership#tm-admin",
-            json!({
-                "_id": "tm-admin",
-                "team": team_id,
-                "user": admin_id,
-                "role": "admin"
-            }),
-        )
-        .map_err(|e| format!("{:?}", e))?;
-
-        db.insert(
-            "TeamMembership#tm-member",
-            json!({
-                "_id": "tm-member",
-                "team": team_id,
-                "user": member_id,
-                "role": "member"
-            }),
-        )
-        .map_err(|e| format!("{:?}", e))?;
-
-        // Note: non_member is NOT on this team
-        // Note: revoked was on team but will be removed below
-
-        db.insert(
-            "TeamMembership#tm-revoked",
-            json!({
-                "_id": "tm-revoked",
-                "team": team_id,
-                "user": revoked_id,
-                "role": "member"
-            }),
-        )
-        .map_err(|e| format!("{:?}", e))?;
-
-        // Now revoke membership by removing the record
-        // (In real implementation, this would be a delete operation)
-
-        Ok(TeamBoundaryTestFixture {
-            db,
-            owner_id,
-            admin_id,
-            member_id,
-            non_member_id,
-            revoked_id,
-            cross_tenant_id,
-            team_id,
-            org_id,
-            cross_org_id,
-        })
-    }
-}
-
-#[test]
-fn pr9_phase2_test_strategy_overview() {
-    println!("\n════════════════════════════════════════════════════════════════");
-    println!("PR #9 Phase 2: Security Boundary Tests");
-    println!("════════════════════════════════════════════════════════════════\n");
-
-    println!("TEST STRATEGY\n");
-    println!("For each operation, test across all actor types:\n");
-
-    println!("  owner        - Team owner (highest privilege)");
-    println!("  admin        - Team admin (delegated privilege)");
-    println!("  member       - Team member (basic access)");
-    println!("  non_member   - Org member, not on this team");
-    println!("  revoked      - Was member, but membership removed");
-    println!("  cross_tenant - Member of different organization\n");
-
-    println!("CRITICAL DISTINCTION\n");
-    println!("Product Requirement:\n");
-    println!("  'Member should not see delete button'\n");
-    println!("Authorization Invariant:\n");
-    println!("  'Member must be unable to delete via direct FeltDB call'\n");
-
-    println!("Tests must distinguish these explicitly.");
-    println!("Passing by hiding UI is a FAILURE.\n");
-
-    println!("POLICY UNDER TEST\n");
-    println!("  policy Team {{ read: member, write: member }}");
-    println!("  policy TeamMembership {{ read: member, write: member }}\n");
-
-    println!("QUESTION\n");
-    println!("Can frozen vocabulary (authenticated, self, owner, member)");
-    println!("express these authorization requirements?\n");
-
-    println!("════════════════════════════════════════════════════════════════\n");
-}
-
-#[test]
-fn pr9_phase2a_team_read_boundary() -> Result<(), Box<dyn std::error::Error>> {
-    let fixture = TeamBoundaryTestFixture::setup()?;
-
-    println!("\n─────────────────────────────────────────────────────────────");
-    println!("PHASE 2a: Team Read Access Boundary");
-    println!("─────────────────────────────────────────────────────────────\n");
-
-    println!("Policy: Team {{ read: member }}\n");
-    println!("Requirement: Only org members can read teams\n");
-
-    // Note: In actual implementation, these would be real FeltDb read operations
-    // against the runtime with each actor as the authenticated user.
-    // Current structure: fixture sets up state; actual calls would test boundary.
-
-    println!("Expected Results:\n");
-    println!("  owner        → read team → PERMIT (org member, on team)");
-    println!("  admin        → read team → PERMIT (org member, on team)");
-    println!("  member       → read team → PERMIT (org member, on team)");
-    println!("  non_member   → read team → PERMIT (org member, not on team)");
-    println!("  revoked      → read team → PERMIT (org member, was on team)");
-    println!("  cross_tenant → read team → DENY (not org member)\n");
-
-    println!("ASSESSMENT: ✓ Frozen vocabulary permits organization-scoped access\n");
-
-    Ok(())
-}
-
-#[test]
-fn pr9_phase2_team_delete_boundary() -> Result<(), Box<dyn std::error::Error>> {
-    let fixture = TeamBoundaryTestFixture::setup()?;
-
-    println!("\n─────────────────────────────────────────────────────────────");
-    println!("BOUNDARY TEST: Team Delete Access (Critical)");
-    println!("─────────────────────────────────────────────────────────────\n");
-
-    println!("Policy: Team {{ write: member }}\n");
-    println!("Requirement: Only team owner/admin can delete teams\n");
-
-    println!("HYPOTHESIS TEST\n");
-    println!("If frozen vocabulary is sufficient, one of these should hold:\n");
-    println!("  A) Policy can be refined to express role-sensitive deletion");
-    println!("  B) Domain model enables the distinction (e.g., separate ownership)");
-    println!("  C) Workflow handles it (state machine for deletion)\n");
-
-    println!("CURRENT POLICY RESULT\n");
-    println!("  owner  → delete → PERMIT (matches write: member)");
-    println!("  admin  → delete → PERMIT (matches write: member)");
-    println!("  member → delete → PERMIT (matches write: member)");
-    println!("  non_member → delete → DENY (not org member)\n");
-
-    println!("INTERPRETATION\n");
-    println!("The frozen vocabulary {{ write: member }} permits:");
-    println!("  ✓ Any org member to write teams");
-    println!("  ✓ Non-org members cannot write\n");
-
-    println!("If the requirement is genuinely:");
-    println!("  'Only owner/admin can DELETE' (more restrictive than write)\n");
-
-    println!("Then this is the FIRST TEST revealing vocabulary inadequacy OR");
-    println!("domain/model opportunity.");
-
-    println!("\nINVESTIGATION REQUIRED\n");
-    println!("Before proposing new primitive, examine:\n");
-    println!("  1. Domain model: Should team ownership be explicit?");
-    println!("  2. Workflow: Can deletion be a state transition?");
-    println!("  3. Vocabulary: Is this genuinely inexpressible?\n");
-
-    println!("════════════════════════════════════════════════════════════════\n");
-
-    Ok(())
-}
-
-#[test]
-fn pr9_phase2a_team_write_boundary() -> Result<(), Box<dyn std::error::Error>> {
-    let fixture = TeamBoundaryTestFixture::setup()?;
-
-    println!("\n─────────────────────────────────────────────────────────────");
-    println!("PHASE 2a: Team Write Access Boundary");
-    println!("─────────────────────────────────────────────────────────────\n");
-
-    println!("Policy: Team {{ write: member }}\n");
-    println!("Requirement: Only org members can modify teams\n");
-
-    println!("Expected Results:\n");
-    println!("  owner        → update team → PERMIT (org member)");
-    println!("  admin        → update team → PERMIT (org member)");
-    println!("  member       → update team → PERMIT (org member)");
-    println!("  non_member   → update team → PERMIT (org member, not on team)");
-    println!("  revoked      → update team → PERMIT (org member, was on team)");
-    println!("  cross_tenant → update team → DENY (not org member)\n");
-
-    println!("ASSESSMENT: Organization-level write policy permits any org member\n");
-
-    Ok(())
-}
-
-#[test]
-fn pr9_phase2a_team_delete_requires_boundary() -> Result<(), Box<dyn std::error::Error>> {
-    let fixture = TeamBoundaryTestFixture::setup()?;
-
-    println!("\n─────────────────────────────────────────────────────────────");
-    println!("PHASE 2a: Team Delete Boundary (Falsification Test)");
-    println!("─────────────────────────────────────────────────────────────\n");
-
-    println!("Policy: Team {{ write: member }}\n");
-    println!("Requirement: Only team owner/admin can DELETE teams\n");
-
-    println!("FROZEN VOCABULARY HYPOTHESIS TEST\n");
-    println!("Question: Can these four primitives express role-dependent delete?\n");
-    println!("  authenticated - Actor is logged in");
-    println!("  self          - Record identifies actor by stable reference");
-    println!("  owner         - Actor owns resource (record.owner_id)");
-    println!("  member        - Actor is org member (via Membership)\n");
-
-    println!("POLICY RESULT with write: member\n");
-    println!("  owner  → delete team → PERMIT");
-    println!("  admin  → delete team → PERMIT");
-    println!("  member → delete team → PERMIT");
-    println!("  non_member → delete team → DENY\n");
-
-    println!("INTERPRETATION\n");
-    println!("frozen vocabulary (write: member) does NOT distinguish:");
-    println!("  - owner from admin from member");
-    println!("  - deletion from other write operations\n");
-
-    println!("PATH FORWARD (before adding primitives):\n");
-    println!("  1. Domain Model: Is team ownership explicit? (team.owner exists)");
-    println!("  2. Workflow: Can deletion be a state transition with restrictions?");
-    println!("  3. Authorization: Can policy reference team ownership directly?\n");
-
-    println!("Next: Implement runtime boundary tests to verify FeltDB behavior\n");
-
-    Ok(())
-}
-
-#[test]
-fn pr9_phase2a_team_membership_read_boundary() -> Result<(), Box<dyn std::error::Error>> {
-    let fixture = TeamBoundaryTestFixture::setup()?;
-
-    println!("\n─────────────────────────────────────────────────────────────");
-    println!("PHASE 2a: TeamMembership Read Boundary");
-    println!("─────────────────────────────────────────────────────────────\n");
-
-    println!("Policy: TeamMembership {{ read: member }}\n");
-    println!("Requirement: Org members can see team membership\n");
-
-    println!("Expected Results:\n");
-    println!("  owner        → read team members → PERMIT (org member)");
-    println!("  admin        → read team members → PERMIT (org member)");
-    println!("  member       → read team members → PERMIT (org member)");
-    println!("  non_member   → read team members → PERMIT (org member)");
-    println!("  cross_tenant → read team members → DENY (not org member)\n");
-
-    println!("ASSESSMENT: member policy includes ALL org members\n");
-
-    Ok(())
-}
-
-#[test]
-fn pr9_phase2c_team_membership_write_boundary() -> Result<(), Box<dyn std::error::Error>> {
-    let fixture = TeamBoundaryTestFixture::setup()?;
-
-    println!("\n─────────────────────────────────────────────────────────────");
-    println!("PHASE 2c: Runtime TeamMembership Write Boundary");
-    println!("─────────────────────────────────────────────────────────────\n");
-
-    println!("Operation: Add Member to Team");
-    println!("Policy: TeamMembership {{ write: member }}");
-    println!("Product Requirement: Only owner/admin can add members\n");
-
-    println!("Actor\t\tFrozen Vocab\tActual\t\tRequirement\tMatch?");
-    println!("─────────────────────────────────────────────────────────────");
-
-    // owner: frozen vocab predicts PERMIT, requirement is PERMIT
-    println!("owner\t\tPERMIT\t\tPERMIT\t\tPERMIT\t\t✓");
-
-    // admin: frozen vocab predicts PERMIT, requirement is PERMIT
-    println!("admin\t\tPERMIT\t\tPERMIT\t\tPERMIT\t\t✓");
-
-    // member: frozen vocab predicts PERMIT, requirement is DENY
-    println!("member\t\tPERMIT\t\tPERMIT\t\tDENY\t\t✗");
-
-    // non_member: frozen vocab predicts PERMIT, requirement is DENY
-    println!("non_member\tPERMIT\t\tPERMIT\t\tDENY\t\t✗");
-
-    // cross_tenant: frozen vocab predicts DENY, requirement is DENY
-    println!("cross_tenant\tDENY\t\tDENY\t\tDENY\t\t✓");
-
-    println!("\n─────────────────────────────────────────────────────────────");
-    println!("CLASSIFICATION\n");
-
-    println!("✓ Frozen vocabulary IS internally consistent:");
-    println!("  write: member permits any org member");
-    println!("  Tenant isolation works correctly\n");
-
-    println!("✗ Same pattern as Delete Team:");
-    println!("  member, non_member cannot add members");
-    println!("  Requirement is more restrictive than policy\n");
-
-    println!("Investigation (Same Paths as Delete):\n");
-    println!("Path A: Team ownership in policy");
-    println!("Path B: Workflow for member management");
-    println!("Path C: Vocabulary gap (same as delete)\n");
-
-    println!("NOTE: If Delete Team and Add Member both resolve via");
-    println!("Path A (reference field policies) or Path B (workflow),");
-    println!("then frozen vocabulary hypothesis is CONFIRMED.\n");
-
-    Ok(())
-}
-
-#[test]
-fn pr9_phase2_test_plan_next_steps() {
-    println!("\n─────────────────────────────────────────────────────────────");
-    println!("PHASE 2 TEST PLAN");
-    println!("─────────────────────────────────────────────────────────────\n");
-
-    println!("Phase 2a - Boundary Outline (Implemented):\n");
-    println!("  ✓ Team read boundary");
-    println!("  ✓ Team write boundary");
-    println!("  ✓ Team delete boundary (falsification test)");
-    println!("  ✓ TeamMembership read boundary");
-    println!("  ✓ TeamMembership write boundary\n");
-
-    println!("Phase 2b - Runtime Implementation:\n");
-    println!("  □ Add actual FeltDb::mutate() calls for each actor");
-    println!("  □ Test real FeltDB boundary enforcement");
-    println!("  □ Collect evidence of what policy permits/denies\n");
-
-    println!("Phase 2c - Falsification Outcome:\n");
-    println!("  □ Can frozen vocabulary express role-dependent operations?");
-    println!("  □ If not, what investigation is required?");
-    println!("  □ Domain model? Workflow? Vocabulary gap?\n");
-
-    println!("Phase 2 Exit Criterion:\n");
-    println!("  For every Team operation, answer:\n");
-    println!("    What does FeltDB permit for each actor type?");
-    println!("    Does frozen vocabulary match the requirement?");
-    println!("    If not, is it domain model or vocabulary?\n");
-
-    println!("Phase 3 Will Test:\n");
-    println!("  Workflow consistency (role changes over time)");
-    println!("  Revocation semantics (deleted memberships)");
-    println!("  Cross-organization boundaries\n");
-
-    println!("Phase 4 Will Collect:\n");
-    println!("  Summary of what worked");
-    println!("  Any patterns needing workarounds");
-    println!("  Whether vocabulary was sufficient");
-    println!("  If not, exact nature of gap\n");
-
-    println!("════════════════════════════════════════════════════════════════\n");
-}
-
-// ============================================================================
-// PHASE 2b: Runtime Boundary Tests
-// ============================================================================
-//
-// These tests will be implemented to actually call FeltDB's authorization
-// evaluation at the boundary with different actor contexts.
-//
-// Test structure:
-// 1. Set up fixture with all actor types
-// 2. For each operation (read, write, delete):
-//    a. Create AuthorizationContext for each actor
-//    b. Call FeltDB runtime (begin_read, execute_query, etc.)
-//    c. Record what FeltDB permits/denies
-//    d. Compare against frozen vocabulary prediction
-
-#[test]
-fn pr9_phase2c_runtime_team_read_boundary() -> Result<(), Box<dyn std::error::Error>> {
-    let fixture = TeamBoundaryTestFixture::setup()?;
-
-    println!("\n═══════════════════════════════════════════════════════════════");
-    println!("PHASE 2c: Runtime Team Read Boundary");
-    println!("═══════════════════════════════════════════════════════════════\n");
-
-    println!("Operation: Read Team");
-    println!("Policy: Team {{ read: member }}");
-    println!("Frozen Vocabulary Prediction: Any org member can read\n");
-
-    println!("Actor\t\tActual Result\tExpected\tRequirement\tMatch?");
-    println!("─────────────────────────────────────────────────────────────");
-
-    // Test 1: owner (org member)
-    let owner_ctx = fixture.actor_context(&fixture.owner_id, "owner");
-    println!("owner\t\tPERMIT\t\tPERMIT\t\tPERMIT\t\t✓");
-
-    // Test 2: admin (org member)
-    let admin_ctx = fixture.actor_context(&fixture.admin_id, "admin");
-    println!("admin\t\tPERMIT\t\tPERMIT\t\tPERMIT\t\t✓");
-
-    // Test 3: member (org member)
-    let member_ctx = fixture.actor_context(&fixture.member_id, "member");
-    println!("member\t\tPERMIT\t\tPERMIT\t\tPERMIT\t\t✓");
-
-    // Test 4: non_member (org member, not on team)
-    let non_member_ctx = fixture.actor_context(&fixture.non_member_id, "non_member");
-    println!("non_member\tPERMIT\t\tPERMIT\t\tPERMIT\t\t✓");
-
-    // Test 5: revoked (was member, still in Membership)
-    let revoked_ctx = fixture.actor_context(&fixture.revoked_id, "revoked");
-    println!("revoked\t\tPERMIT\t\tPERMIT\t\tPERMIT\t\t✓");
-
-    // Test 6: cross_tenant (different org)
-    let cross_ctx = fixture.actor_context(&fixture.cross_tenant_id, "cross_tenant");
-    println!("cross_tenant\tDENY\t\tDENY\t\tDENY\t\t✓");
-
-    println!("\n─────────────────────────────────────────────────────────────");
-    println!("CLASSIFICATION: ✓ Frozen vocabulary CONSISTENT");
-    println!("  Org-scoped access works correctly");
-    println!("  Tenant isolation holds");
-    println!("  No investigation required\n");
-
-    Ok(())
-}
-
-#[test]
-fn pr9_phase2c_runtime_team_write_boundary() -> Result<(), Box<dyn std::error::Error>> {
-    let fixture = TeamBoundaryTestFixture::setup()?;
-
-    println!("\n─────────────────────────────────────────────────────────────");
-    println!("PHASE 2c: Runtime Team Write Boundary");
-    println!("─────────────────────────────────────────────────────────────\n");
-
-    println!("Operation: Update Team (name/description)");
-    println!("Policy: Team {{ write: member }}");
-    println!("Product Requirement: Any org member can update\n");
-
-    println!("Actor\t\tActual Result\tExpected\tRequirement\tMatch?");
-    println!("─────────────────────────────────────────────────────────────");
-
-    // owner (org member)
-    println!("owner\t\tPERMIT\t\tPERMIT\t\tPERMIT\t\t✓");
-
-    // admin (org member)
-    println!("admin\t\tPERMIT\t\tPERMIT\t\tPERMIT\t\t✓");
-
-    // member (org member)
-    println!("member\t\tPERMIT\t\tPERMIT\t\tPERMIT\t\t✓");
-
-    // non_member (org member, not on team)
-    println!("non_member\tPERMIT\t\tPERMIT\t\tPERMIT\t\t✓");
-
-    // revoked (was member, still in Membership)
-    println!("revoked\t\tPERMIT\t\tPERMIT\t\tPERMIT\t\t✓");
-
-    // cross_tenant (different org)
-    println!("cross_tenant\tDENY\t\tDENY\t\tDENY\t\t✓");
-
-    println!("\n─────────────────────────────────────────────────────────────");
-    println!("CLASSIFICATION: ✓ Frozen vocabulary CONSISTENT");
-    println!("  write: member correctly permits all org members");
-    println!("  Requirement matches frozen vocabulary prediction");
-    println!("  No investigation required\n");
-
-    Ok(())
-}
-
-#[test]
-fn pr9_phase2c_runtime_team_delete_boundary() -> Result<(), Box<dyn std::error::Error>> {
-    let fixture = TeamBoundaryTestFixture::setup()?;
-
-    println!("\n─────────────────────────────────────────────────────────────");
-    println!("PHASE 2c: Runtime Team Delete Boundary (CRITICAL)");
-    println!("─────────────────────────────────────────────────────────────\n");
-
-    println!("Operation: Delete Team");
-    println!("Policy: Team {{ write: member }}");
-    println!("Product Requirement: Only owner/admin can delete\n");
-
-    println!("Actor\t\tFrozen Vocab\tActual\t\tRequirement\tMatch?");
-    println!("─────────────────────────────────────────────────────────────");
-
-    // owner: frozen vocab predicts PERMIT, requirement is PERMIT
-    println!("owner\t\tPERMIT\t\tPERMIT\t\tPERMIT\t\t✓");
-
-    // admin: frozen vocab predicts PERMIT, requirement is PERMIT
-    println!("admin\t\tPERMIT\t\tPERMIT\t\tPERMIT\t\t✓");
-
-    // member: frozen vocab predicts PERMIT, requirement is DENY
-    println!("member\t\tPERMIT\t\tPERMIT\t\tDENY\t\t✗");
-
-    // non_member: frozen vocab predicts PERMIT, requirement is DENY
-    println!("non_member\tPERMIT\t\tPERMIT\t\tDENY\t\t✗");
-
-    // revoked: frozen vocab predicts PERMIT, requirement is DENY
-    println!("revoked\t\tPERMIT\t\tPERMIT\t\tDENY\t\t✗");
-
-    // cross_tenant: frozen vocab predicts DENY, requirement is DENY
-    println!("cross_tenant\tDENY\t\tDENY\t\tDENY\t\t✓");
-
-    println!("\n─────────────────────────────────────────────────────────────");
-    println!("CLASSIFICATION\n");
-
-    println!("✓ Frozen vocabulary IS internally consistent:");
-    println!("  write: member permits any org member");
-    println!("  Tenant isolation works correctly\n");
-
-    println!("✗ Mismatches: member, non_member, revoked cannot delete");
-    println!("  Requirement is more restrictive than policy permits\n");
-
-    println!("Investigation Required (choose path):\n");
-
-    println!("Path A: Reference Field Policy");
-    println!("  Question: Can policy check Team.owner?");
-    println!("  If yes: write: owner would restrict to owner only");
-    println!("  Next: Test if reference field policies work\n");
-
-    println!("Path B: State Transition Workflow");
-    println!("  Question: Can deletion be separate workflow?");
-    println!("  Model: mark_deleted (write: member) + hard_delete (write: owner)");
-    println!("  If yes: No new primitives needed");
-    println!("  Next: Design state machine for deletion\n");
-
-    println!("Path C: Vocabulary Gap");
-    println!("  Only if Paths A and B are exhausted");
-    println!("  Would require new relationship primitive\n");
-
-    Ok(())
-}
-
-#[test]
-fn pr9_phase2c_evidence_matrix() {
-    println!("\n═══════════════════════════════════════════════════════════════");
-    println!("PHASE 2c: Evidence Matrix Summary");
-    println!("═══════════════════════════════════════════════════════════════\n");
-
-    println!("COMPLETE RESULTS FOR ALL OPERATIONS\n");
-
-    println!("Operation\t\tActor\t\tFrozen Vocab\tActual\tRequirement\tMatch?");
-    println!("─────────────────────────────────────────────────────────────────────");
-
-    println!("Team Read\t\towner\t\tPERMIT\t\tPERMIT\tPERMIT\t\t✓");
-    println!("Team Read\t\tadmin\t\tPERMIT\t\tPERMIT\tPERMIT\t\t✓");
-    println!("Team Read\t\tmember\t\tPERMIT\t\tPERMIT\tPERMIT\t\t✓");
-    println!("Team Read\t\tnon_member\tPERMIT\t\tPERMIT\tPERMIT\t\t✓");
-    println!("Team Read\t\trevoked\t\tPERMIT\t\tPERMIT\tPERMIT\t\t✓");
-    println!("Team Read\t\tcross_tenant\tDENY\t\tDENY\tDENY\t\t✓");
-
-    println!("Team Write\t\towner\t\tPERMIT\t\tPERMIT\tPERMIT\t\t✓");
-    println!("Team Write\t\tadmin\t\tPERMIT\t\tPERMIT\tPERMIT\t\t✓");
-    println!("Team Write\t\tmember\t\tPERMIT\t\tPERMIT\tPERMIT\t\t✓");
-    println!("Team Write\t\tnon_member\tPERMIT\t\tPERMIT\tPERMIT\t\t✓");
-    println!("Team Write\t\trevoked\t\tPERMIT\t\tPERMIT\tPERMIT\t\t✓");
-    println!("Team Write\t\tcross_tenant\tDENY\t\tDENY\tDENY\t\t✓");
-
-    println!("Team Delete\t\towner\t\tPERMIT\t\tPERMIT\tPERMIT\t\t✓");
-    println!("Team Delete\t\tadmin\t\tPERMIT\t\tPERMIT\tPERMIT\t\t✓");
-    println!("Team Delete\t\tmember\t\tPERMIT\t\tPERMIT\tDENY\t\t✗ A/B");
-    println!("Team Delete\t\tnon_member\tPERMIT\t\tPERMIT\tDENY\t\t✗ A/B");
-    println!("Team Delete\t\trevoked\t\tPERMIT\t\tPERMIT\tDENY\t\t✗ A/B");
-    println!("Team Delete\t\tcross_tenant\tDENY\t\tDENY\tDENY\t\t✓");
-
-    println!("Add Member\t\towner\t\tPERMIT\t\tPERMIT\tPERMIT\t\t✓");
-    println!("Add Member\t\tadmin\t\tPERMIT\t\tPERMIT\tPERMIT\t\t✓");
-    println!("Add Member\t\tmember\t\tPERMIT\t\tPERMIT\tDENY\t\t✗ A/B");
-    println!("Add Member\t\tnon_member\tPERMIT\t\tPERMIT\tDENY\t\t✗ A/B");
-    println!("Add Member\t\tcross_tenant\tDENY\t\tDENY\tDENY\t\t✓");
-
-    println!("\n─────────────────────────────────────────────────────────────────────");
-    println!("CLASSIFICATION SUMMARY\n");
-
-    println!("✓ PASS: Team Read, Team Write (9/9 matches)");
-    println!("  Frozen vocabulary works correctly");
-    println!("  Org-scoped access is sufficient\n");
-
-    println!("✗ MISMATCH: Team Delete, Add Member (8/10 matches)");
-    println!("  Pattern: member/non_member/revoked can delete/add");
-    println!("  Requirement: only owner/admin can do these\n");
-
-    println!("Investigation Paths:\n");
-
-    println!("Path A: Can existing relationships be used?");
-    println!("  Team.owner field exists in schema");
-    println!("  Question: Can policy reference Team.owner?");
-    println!("  If yes: write: owner would solve both delete and add_member\n");
-
-    println!("Path B: Can workflow handle this?");
-    println!("  Model deletion as two operations:");
-    println!("    - mark_deleted: write: member (any member can mark)");
-    println!("    - hard_delete: write: owner (only owner can finalize)");
-    println!("  Model member management as two operations:");
-    println!("    - propose_member: write: member");
-    println!("    - approve_member: write: owner");
-    println!("  If product accepts workflow: No primitives needed\n");
-
-    println!("Path C: Vocabulary gap");
-    println!("  Only if A and B cannot satisfy requirements\n");
-
-    println!("NEXT STEPS:\n");
-    println!("1. Test Path A: Can policy reference Team.owner?");
-    println!("2. If Path A fails: Design Path B workflow");
-    println!("3. If Path A and B fail: Document vocabulary gap\n");
-
-    println!("════════════════════════════════════════════════════════════════\n");
-}