@fuzdev/fuz_app 0.101.1 → 0.103.0

package/dist/auth/role_grant_offer_actions.js

@@ -1,8 +1,9 @@
 /**
  * Role grant offer RPC action handlers — the consentful-role-grants action surface.
  *
- * Seven actions: six offer-lifecycle methods (create / accept / decline /
- * retract / list / history) plus `role_grant_revoke` (admin-only). All mount
+ * Eight actions: six offer-lifecycle methods (create / accept / decline /
+ * retract / list / history) plus `role_grant_revoke` and `role_grant_assign`
+ * (both admin-only). All mount
  * on a consumer's JSON-RPC endpoint via `create_rpc_endpoint`. The action
  * specs themselves live in `auth/role_grant_offer_action_specs.ts`. Mutations
  * declare `side_effects: true` so the RPC dispatcher wraps the handler in
@@ -23,6 +24,10 @@
  *   dispatcher rejects non-admin callers before the handler runs.
  *   The admin-grant-path gate prevents revoking keeper / daemon-scoped
  *   roles via this surface. Keys on `actor_id` to survive multi-actor accounts.
+ * - `role_grant_assign` — spec-level `auth: {role: 'admin'}`; the immediate
+ *   consent-free conferral path. The admin-grant-path gate prevents assigning
+ *   keeper / daemon-scoped roles via this surface. No holder-propagation — only
+ *   admins confer (see participation-gates.md Decision 7).
  *
  * Audit events are emitted in-transaction by the query layer (atomic with
  * the role_grant write on accept/revoke) or by the handler via the bound
@@ -44,12 +49,12 @@ import { builtin_role_specs_by_name, ROLE_ADMIN, role_has_grant_path, } from './
 import { GRANT_PATH_ADMIN } from './grant_path_schema.js';
 import { ROLE_GRANT_OFFER_DEFAULT_TTL_MS, to_role_grant_offer_json, } from './role_grant_offer_schema.js';
 import { query_role_grant_offer_create, query_role_grant_offer_decline, query_role_grant_offer_retract, query_role_grant_offer_list, query_role_grant_offer_history_for_account, query_accept_offer, RoleGrantOfferActorAccountMismatchError, RoleGrantOfferActorMismatchError, RoleGrantOfferAlreadyTerminalError, RoleGrantOfferExpiredError, RoleGrantOfferNotFoundError, RoleGrantOfferSelfTargetError, } from './role_grant_offer_queries.js';
-import { query_role_grant_find_active_role_for_actor, query_revoke_role_grant, } from './role_grant_queries.js';
-import { query_actor_by_id } from './account_queries.js';
+import { query_create_role_grant, query_role_grant_find_active_role_for_actor, query_revoke_role_grant, } from './role_grant_queries.js';
+import { query_actor_by_id, query_active_actors_by_account } from './account_queries.js';
 import { has_scoped_role } from './request_context.js';
 import { build_role_grant_offer_accepted_notification, build_role_grant_offer_declined_notification, build_role_grant_offer_received_notification, build_role_grant_offer_retracted_notification, build_role_grant_offer_supersede_notification, build_role_grant_revoke_notification, } from './role_grant_offer_notifications.js';
 import { ERROR_ROLE_GRANT_NOT_FOUND, ERROR_ROLE_NOT_WEB_GRANTABLE } from '../http/error_schemas.js';
-import { ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH, ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH, ERROR_ROLE_GRANT_OFFER_EXPIRED, ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED, ERROR_ROLE_GRANT_OFFER_NOT_FOUND, ERROR_ROLE_GRANT_OFFER_ROLE_NOT_GRANTABLE, ERROR_ROLE_GRANT_OFFER_SELF_TARGET, ERROR_ROLE_GRANT_OFFER_TERMINAL, role_grant_offer_create_action_spec, role_grant_offer_accept_action_spec, role_grant_offer_decline_action_spec, role_grant_offer_retract_action_spec, role_grant_offer_list_action_spec, role_grant_offer_history_action_spec, role_grant_revoke_action_spec, } from './role_grant_offer_action_specs.js';
+import { ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH, ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH, ERROR_ROLE_GRANT_OFFER_EXPIRED, ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED, ERROR_ROLE_GRANT_OFFER_NOT_FOUND, ERROR_ROLE_GRANT_OFFER_ROLE_NOT_GRANTABLE, ERROR_ROLE_GRANT_OFFER_SELF_TARGET, ERROR_ROLE_GRANT_OFFER_TERMINAL, role_grant_offer_create_action_spec, role_grant_offer_accept_action_spec, role_grant_offer_decline_action_spec, role_grant_offer_retract_action_spec, role_grant_offer_list_action_spec, role_grant_offer_history_action_spec, role_grant_revoke_action_spec, role_grant_assign_action_spec, } from './role_grant_offer_action_specs.js';
 // -- Helpers ----------------------------------------------------------------
 /**
  * Fan out a batch of pre-written audit rows to the bound emitter's
@@ -67,40 +72,18 @@ const fan_out_audit_events = (events, audit) => {
     }
 };
 // eslint-disable-next-line @typescript-eslint/require-await
-const default_authorize = async (auth, input, _deps, _ctx) => {
-    // Caller must hold an active role_grant for the offered role. Global (no scope)
-    // check — the scope-aware "only in this classroom" policy is consumer-level.
-    // Reads from the in-memory `auth.role_grants` snapshot loaded once per request
-    // by `create_request_context_middleware`; no DB roundtrip needed.
-    return has_scoped_role(auth, input.role, null);
-};
-/**
- * Authorization callback that admits any admin and otherwise falls back to
- * the symmetric default (caller must hold the offered role globally).
- *
- * The admin-grant-path filter in `create_handler` runs **before** the
- * `authorize` callback, so this never sees roles whose `grant_paths`
- * omits `'admin'`. Drop into
- * `create_role_grant_offer_actions({authorize: authorize_admin_or_holder})`
- * (or any factory that forwards `authorize`, e.g. `create_standard_rpc_actions`)
- * for the common "admins offer anything; users offer what they hold"
- * pattern. Scope-aware policies (e.g. classroom_teacher offering
- * classroom_student in their own scope) wrap this and short-circuit `true`
- * before delegating.
- */
-export const authorize_admin_or_holder = async (auth, input, _deps, _ctx) => {
-    // Admin bypass keys on **global** admin role_grants only — `has_scoped_role(_, _, null)`
-    // rejects scoped admin role_grants. Without this, a `{role: 'admin', scope_id: scope_X}`
-    // role_grant would let the holder offer any admin-grant-path role without holding it
-    // themselves, escalating scoped admin to global authority over the offer surface.
-    if (has_scoped_role(auth, ROLE_ADMIN, null))
-        return true;
-    return has_scoped_role(auth, input.role, null);
+const default_authorize = async (auth, _input, _deps, _ctx) => {
+    // Admin-only conferral: the caller must hold a *global* `admin` grant. Holding
+    // the offered role itself confers no power to offer it (no holder-propagation —
+    // see participation-gates.md Decision 6). The global check (scope_id null) stops
+    // a scoped `admin` escalating into global authority over the offer surface.
+    // Reads the in-memory `auth.role_grants` snapshot; no DB roundtrip.
+    return has_scoped_role(auth, ROLE_ADMIN, null);
 };
 // -- Action factory ---------------------------------------------------------
 /**
- * Create the seven role-grant-offer RPC actions (six offer-lifecycle methods
- * plus `role_grant_revoke`).
+ * Create the eight role-grant-offer RPC actions (six offer-lifecycle methods
+ * plus `role_grant_revoke` and the immediate `role_grant_assign`).
  *
  * @param deps - `RouteFactoryDeps` (`log`, `audit`, …) plus optional `notification_sender` for WS fan-out — when absent, WS fan-out is silently skipped (DB-only side effects still happen). Consumers wiring `BackendWebsocketTransport` assign its instance directly (the transport's `send_to_account` signature accepts the broader `JsonrpcMessageFromServerToClient`, which is contravariantly compatible)
  * @param options - role schema, default TTL, authorization override
@@ -464,6 +447,77 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
         }
         return { ok: true, revoked: true };
     };
+    // The immediate admin-only conferral path — the consent-free sibling of
+    // `role_grant_offer_create`. Admin-gated at the dispatcher (`roles:
+    // ['admin']`), it re-checks admin-grantability (so keeper / CLI-only roles
+    // can't be web-assigned), resolves the target actor, writes the idempotent
+    // grant, and emits a `role_grant_create` audit row — the same event the
+    // offer-accept and self-service paths emit. No WS notification in v1 (the
+    // grantee picks the capability up on its next authenticated request).
+    const assign_handler = async (input, ctx) => {
+        const auth = ctx.auth;
+        // Admin-grant-path gate — the same registry check the offer/revoke gates
+        // use; keeper / daemon-scoped roles stay CLI-only. Denial is
+        // forensic-audited (`role_grant_id` omitted — no grant was created).
+        if (!role_has_grant_path(role_specs, input.role, GRANT_PATH_ADMIN)) {
+            audit.emit_role_grant_target(ctx, auth, {
+                event_type: 'role_grant_create',
+                outcome: 'failure',
+                target_account_id: input.to_account_id,
+                target_actor_id: input.to_actor_id ?? null,
+                metadata: { role: input.role, scope_id: input.scope_id ?? null },
+            });
+            throw jsonrpc_errors.forbidden('role not web-grantable', {
+                reason: ERROR_ROLE_NOT_WEB_GRANTABLE,
+            });
+        }
+        // Resolve the grant's target actor. A supplied `to_actor_id` must be an
+        // active actor of `to_account_id`; otherwise the account's sole active
+        // actor is used (a multi-actor account must name one). A missing /
+        // actorless account 404-masks. Inlined (not a helper) so the
+        // actor-account-mismatch throw stays in the handler body the
+        // error_reasons drift scan reads.
+        const actors = await query_active_actors_by_account(ctx, input.to_account_id);
+        let target_actor_id;
+        if (input.to_actor_id != null) {
+            if (!actors.some((a) => a.id === input.to_actor_id)) {
+                throw jsonrpc_errors.invalid_params('to_actor_id does not belong to to_account_id', {
+                    reason: ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH,
+                });
+            }
+            target_actor_id = input.to_actor_id;
+        }
+        else if (actors.length === 1) {
+            target_actor_id = actors[0].id;
+        }
+        else if (actors.length === 0) {
+            throw jsonrpc_errors.not_found('account');
+        }
+        else {
+            throw jsonrpc_errors.invalid_params('to_actor_id is required for a multi-actor account');
+        }
+        // Idempotent write — re-assigning an already-held grant returns the
+        // existing row. `scope_kind` stays null: `scope_id` alone is the v1
+        // discriminator. `granted_by` is the assigning admin.
+        const grant = await query_create_role_grant(ctx, {
+            actor_id: target_actor_id,
+            role: input.role,
+            scope_kind: null,
+            scope_id: input.scope_id ?? null,
+            granted_by: auth.actor.id,
+        });
+        audit.emit_role_grant_target(ctx, auth, {
+            event_type: 'role_grant_create',
+            target_account_id: input.to_account_id,
+            target_actor_id,
+            metadata: {
+                role: grant.role,
+                role_grant_id: grant.id,
+                scope_id: grant.scope_id,
+            },
+        });
+        return { ok: true, role_grant_id: grant.id };
+    };
     return [
         rpc_action(role_grant_offer_create_action_spec, create_handler),
         rpc_action(role_grant_offer_accept_action_spec, accept_handler),
@@ -472,5 +526,6 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
         rpc_action(role_grant_offer_list_action_spec, list_handler),
         rpc_action(role_grant_offer_history_action_spec, history_handler),
         rpc_action(role_grant_revoke_action_spec, revoke_handler),
+        rpc_action(role_grant_assign_action_spec, assign_handler),
     ];
 };

package/dist/db/CLAUDE.md

@@ -51,16 +51,19 @@ The wire schemas + RPC handlers + authz predicates for this layer live in
   tables; single-migration `CELL_MIGRATION_NS` (namespace `fuz_cell`).
   `cell.visibility cell_visibility NOT NULL DEFAULT 'private'` (PG ENUM
   `('private', 'public')`) — a top-level access-control column, peer to
-  `cell_grant`, not a `data` field. Nullable `created_by` / `updated_by`
-  FKs to `actor` (NULL = system origin). GIN on `data` / `refs`; global
-  partial-unique on `path`.
+  `cell_grant`, not a `data` field. `cell.kind text` (nullable) is the
+  write-once capability/identity axis — likewise a top-level column, not a
+  `data` field (`idx_cell_kind` partial-active). Nullable `created_by` /
+  `updated_by` FKs to `actor` (NULL = system origin). GIN on `data` / `refs`;
+  global partial-unique on `path`.
 - **`cell_history_ddl.ts`** — dormant `cell_history` table
   (`CELL_HISTORY_MIGRATION_NS`, namespace `fuz_cell_history`), FK → `cell.id`.
   Ships present-but-unwritten; no snapshot lifecycle yet.
 - **`cell_queries.ts`** — `query_cell_create / get / get_by_path / update /
-delete`, `_list_by_data_kind / _list_by_creator`, the
+delete`, `_list_by_kind / _list_by_creator`, the
   generic `query_cell_list` (filter + SQL-side visibility predicate mirroring
-  `can_view_cell`; the `ref` filter narrows by `cell.refs`), and
+  `can_view_cell`; the `kind` filter narrows by the `cell.kind` column, the
+  `ref` filter by `cell.refs`), and
   `query_cell_load_many` (bulk id load, no visibility filter — feeds the
   strict relation-read filter). `cell.refs` derived from
   `data` via `extract_refs` on create/update. `CellRow.grant_count` is a

package/dist/db/cell_ddl.d.ts

@@ -62,8 +62,15 @@ export declare const CELL_VISIBILITY_TYPE = "\nDO $$ BEGIN\n\tCREATE TYPE cell_v
  *
  * `path` is the global namespace axis (no tenant/hub scoping) — globally
  * unique on active rows via `idx_cell_path_unique`.
+ *
+ * `kind` is the capability / identity axis — a nullable top-level column
+ * (peer to `visibility` / `path`), **not** a field inside `data`. It is the
+ * discriminator a creation authorizer gates on (see `auth/cell_actions.ts`
+ * `CellCreateAuthorize`) and is **write-once**: set at INSERT and carried on
+ * no update path, so a cell's kind is fixed at birth. Content stays
+ * duck-typed in `data`; `kind` is a capability tag, not a content-type.
  */
-export declare const CELL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS cell (\n\tid UUID PRIMARY KEY DEFAULT gen_random_uuid(),\n\tdata JSONB NOT NULL,\n\tvisibility cell_visibility NOT NULL DEFAULT 'private',\n\tpath TEXT,\n\trefs TEXT[],\n\tcreated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n\tupdated_at TIMESTAMPTZ,\n\tdeleted_at TIMESTAMPTZ,\n\tcreated_by UUID REFERENCES actor(id) ON DELETE SET NULL,\n\tupdated_by UUID REFERENCES actor(id) ON DELETE SET NULL\n)";
+export declare const CELL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS cell (\n\tid UUID PRIMARY KEY DEFAULT gen_random_uuid(),\n\tdata JSONB NOT NULL,\n\tkind TEXT,\n\tvisibility cell_visibility NOT NULL DEFAULT 'private',\n\tpath TEXT,\n\trefs TEXT[],\n\tcreated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n\tupdated_at TIMESTAMPTZ,\n\tdeleted_at TIMESTAMPTZ,\n\tcreated_by UUID REFERENCES actor(id) ON DELETE SET NULL,\n\tupdated_by UUID REFERENCES actor(id) ON DELETE SET NULL\n)";
 /**
  * Cell indexes — all active-only, partial on `deleted_at IS NULL`.
  *
@@ -71,7 +78,9 @@ export declare const CELL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS cell (\n\tid UU
  * - `idx_cell_path_unique`: global `path` uniqueness + read-side path
  *   lookup. Partial on path + active so reused paths after soft delete are
  *   allowed.
- * - `idx_cell_data`: shape-driven queries (`data ? 'kind'`, `data @> ...`).
+ * - `idx_cell_kind`: the `cell_list` kind filter (`cell.kind = ?`) and
+ *   kind-scoped scans. Active-only.
+ * - `idx_cell_data`: shape-driven queries (`data @> ...`).
  * - `idx_cell_refs`: cells-by-fact discovery (cross-cell reference graph).
  * - `idx_cell_created_by`: "cells this actor created" queries.
  *

package/dist/db/cell_ddl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_ddl.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_ddl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,KAAK,EAAC,SAAS,EAAE,kBAAkB,EAAC,MAAM,cAAc,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,oIAI1B,CAAC;AAER;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,WAAW,4aAYtB,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,MAAM,CAYtC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,0iBAc5B,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAW5C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,+RAO5B,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAE5C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,qSAO3B,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAG3C,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,4DAA6D,CAAC;AAE3F,uBAAuB;AACvB,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CAuB5C,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}
+{"version":3,"file":"cell_ddl.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_ddl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,KAAK,EAAC,SAAS,EAAE,kBAAkB,EAAC,MAAM,cAAc,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,oIAI1B,CAAC;AAER;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,WAAW,0bAatB,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,MAAM,CActC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,0iBAc5B,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAW5C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,+RAO5B,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAE5C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,qSAO3B,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAG3C,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,4DAA6D,CAAC;AAE3F,uBAAuB;AACvB,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CAuB5C,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}

package/dist/db/cell_ddl.js

@@ -65,11 +65,19 @@ END $$`;
  *
  * `path` is the global namespace axis (no tenant/hub scoping) — globally
  * unique on active rows via `idx_cell_path_unique`.
+ *
+ * `kind` is the capability / identity axis — a nullable top-level column
+ * (peer to `visibility` / `path`), **not** a field inside `data`. It is the
+ * discriminator a creation authorizer gates on (see `auth/cell_actions.ts`
+ * `CellCreateAuthorize`) and is **write-once**: set at INSERT and carried on
+ * no update path, so a cell's kind is fixed at birth. Content stays
+ * duck-typed in `data`; `kind` is a capability tag, not a content-type.
  */
 export const CELL_SCHEMA = `
 CREATE TABLE IF NOT EXISTS cell (
 	id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
 	data JSONB NOT NULL,
+	kind TEXT,
 	visibility cell_visibility NOT NULL DEFAULT 'private',
 	path TEXT,
 	refs TEXT[],
@@ -86,7 +94,9 @@ CREATE TABLE IF NOT EXISTS cell (
  * - `idx_cell_path_unique`: global `path` uniqueness + read-side path
  *   lookup. Partial on path + active so reused paths after soft delete are
  *   allowed.
- * - `idx_cell_data`: shape-driven queries (`data ? 'kind'`, `data @> ...`).
+ * - `idx_cell_kind`: the `cell_list` kind filter (`cell.kind = ?`) and
+ *   kind-scoped scans. Active-only.
+ * - `idx_cell_data`: shape-driven queries (`data @> ...`).
  * - `idx_cell_refs`: cells-by-fact discovery (cross-cell reference graph).
  * - `idx_cell_created_by`: "cells this actor created" queries.
  *
@@ -99,6 +109,8 @@ export const CELL_INDEXES = [
     `CREATE UNIQUE INDEX IF NOT EXISTS idx_cell_path_unique
 		ON cell(path)
 		WHERE path IS NOT NULL AND deleted_at IS NULL`,
+    `CREATE INDEX IF NOT EXISTS idx_cell_kind ON cell(kind)
+		WHERE deleted_at IS NULL`,
     `CREATE INDEX IF NOT EXISTS idx_cell_data ON cell USING gin(data)
 		WHERE deleted_at IS NULL`,
     `CREATE INDEX IF NOT EXISTS idx_cell_refs ON cell USING gin(refs)

package/dist/db/cell_queries.d.ts

@@ -42,6 +42,7 @@ import type { CellVisibility } from '../auth/cell_action_specs.js';
 export interface CellRow {
     id: Uuid;
     data: CellData;
+    kind: string | null;
     visibility: CellVisibility;
     path: string | null;
     refs: Array<FactHash> | null;
@@ -52,9 +53,14 @@ export interface CellRow {
     updated_by: Uuid | null;
     grant_count: number;
 }
-/** Input for `query_cell_create`. `refs` is derived from `data`. */
+/**
+ * Input for `query_cell_create`. `refs` is derived from `data`. `kind` is
+ * the write-once capability axis (`cell.kind` column) — set here at INSERT
+ * and absent from `CellUpdatePatch`, so it can never change post-create.
+ */
 export interface CellCreateQueryInput {
     data: Json;
+    kind?: string | null;
     visibility?: CellVisibility;
     path?: string | null;
     created_by?: Uuid | null;
@@ -153,15 +159,15 @@ export declare const query_cell_delete: (deps: QueryDeps, id: Uuid, options?: {
     deleted_by?: Uuid | null;
 }) => Promise<boolean>;
 /**
- * List cells whose `data.kind` matches the given value, newest first.
- * Uses the `idx_cell_data` GIN index (`data @> ...`).
+ * List active cells with the given `kind`, newest first. Uses the
+ * `idx_cell_kind` index (`cell.kind = ?`).
  *
  * @param deps - query deps
- * @param kind - `data.kind` value to match (e.g. `'collection'`, `'entry'`)
+ * @param kind - `cell.kind` value to match (e.g. `'collection'`, `'entry'`)
  * @param options - pagination
  * @returns matching active rows
  */
-export declare const query_cell_list_by_data_kind: (deps: QueryDeps, kind: string, options?: Pick<CellListOptions, "limit" | "offset">) => Promise<Array<CellRow>>;
+export declare const query_cell_list_by_kind: (deps: QueryDeps, kind: string, options?: Pick<CellListOptions, "limit" | "offset">) => Promise<Array<CellRow>>;
 /**
  * List active cells created by an actor, newest first. Backed by the
  * `idx_cell_created_by` partial index.
@@ -221,8 +227,8 @@ export declare const query_cell_list_by_creator: (deps: QueryDeps, actor_id: Uui
 export declare const query_cell_list: (deps: QueryDeps, params: CellListParams) => Promise<Array<CellRow>>;
 /** Parameters for `query_cell_list`. All filter dimensions are optional. */
 export interface CellListParams {
-    /** Match `data.kind = ?` via `data @> {"kind": ?}` (uses `idx_cell_data`). */
-    data_kind?: string;
+    /** Match `cell.kind = ?` (uses `idx_cell_kind`). */
+    kind?: string;
     /**
      * Match `cell.visibility = ?` directly on the top-level column.
      * Additional narrowing on top of the SQL-side auth visibility
@@ -286,7 +292,7 @@ export interface CellListParams {
     /**
      * When `true`, narrow to cells admitting the caller via a
      * `cell_grant` row AND that the caller does not own. Authenticated
-     * only (`viewer_actor_id` must be set). Combine with `data_kind` /
+     * only (`viewer_actor_id` must be set). Combine with `kind` /
      * `path_prefix` etc. to scope further.
      */
     shared_with_caller_only?: boolean;

package/dist/db/cell_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,0BAA0B,CAAC;AACnD,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAyB,KAAK,QAAQ,EAAC,MAAM,+BAA+B,CAAC;AAGpF,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,6BAA6B,CAAC;AAC1D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAEjE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,QAAQ,CAAC;IACf,UAAU,EAAE,cAAc,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACpB;AAgBD,oEAAoE;AACpE,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,OAAO,oBAAoB,KACzB,OAAO,CAAC,OAAO,CAgBjB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAC,KACnC,OAAO,CAAC,OAAO,GAAG,IAAI,CAUxB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,MAAM,MAAM,KACV,OAAO,CAAC,OAAO,GAAG,IAAI,CAQxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,KAAK,aAAa,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQxB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,OAAO,eAAe,KACpB,OAAO,CAAC,OAAO,GAAG,IAAI,CA4BxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAC,KAClC,OAAO,CAAC,OAAO,CAWjB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,SAAS,EACf,MAAM,MAAM,EACZ,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CASvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,SAAS,EACf,UAAU,IAAI,EACd,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQvB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,eAAe,GAC3B,MAAM,SAAS,EACf,QAAQ,cAAc,KACpB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CA0DxB,CAAC;AAiGF,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC9B,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,4EAA4E;IAC5E,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,0EAA0E;IAC1E,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB;;;;OAIG;IACH,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,aAAa,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACzD;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,yCAAyC;IACzC,QAAQ,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;IACvC,sCAAsC;IACtC,eAAe,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,iBAAiB;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B"}
+{"version":3,"file":"cell_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,0BAA0B,CAAC;AACnD,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAyB,KAAK,QAAQ,EAAC,MAAM,+BAA+B,CAAC;AAGpF,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,6BAA6B,CAAC;AAC1D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAEjE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,cAAc,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACpB;AAgBD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,OAAO,oBAAoB,KACzB,OAAO,CAAC,OAAO,CAiBjB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAC,KACnC,OAAO,CAAC,OAAO,GAAG,IAAI,CAUxB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,MAAM,MAAM,KACV,OAAO,CAAC,OAAO,GAAG,IAAI,CAQxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,KAAK,aAAa,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQxB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,OAAO,eAAe,KACpB,OAAO,CAAC,OAAO,GAAG,IAAI,CA4BxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAC,KAClC,OAAO,CAAC,OAAO,CAWjB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,MAAM,MAAM,EACZ,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CASvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,SAAS,EACf,UAAU,IAAI,EACd,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQvB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,eAAe,GAC3B,MAAM,SAAS,EACf,QAAQ,cAAc,KACpB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CA0DxB,CAAC;AAiGF,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC9B,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,4EAA4E;IAC5E,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,0EAA0E;IAC1E,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB;;;;OAIG;IACH,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,aAAa,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACzD;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,yCAAyC;IACzC,QAAQ,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;IACvC,sCAAsC;IACtC,eAAe,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,iBAAiB;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B"}

package/dist/db/cell_queries.js

@@ -51,10 +51,11 @@ const grant_count_projection = (cell_alias) => `(SELECT COUNT(*)::int FROM cell_
 export const query_cell_create = async (deps, input) => {
     const refs = derive_refs(input.data);
     const row = await deps.db.query_one(`INSERT INTO cell
-		   (data, visibility, path, refs, created_by)
-		 VALUES ($1::jsonb, COALESCE($2::cell_visibility, 'private'::cell_visibility), $3, $4::text[], $5)
+		   (data, kind, visibility, path, refs, created_by)
+		 VALUES ($1::jsonb, $2, COALESCE($3::cell_visibility, 'private'::cell_visibility), $4, $5::text[], $6)
 		 RETURNING *, ${grant_count_projection('cell')}`, [
         JSON.stringify(input.data),
+        input.kind ?? null,
         input.visibility ?? null,
         input.path ?? null,
         refs,
@@ -171,20 +172,20 @@ export const query_cell_delete = async (deps, id, options) => {
     return row !== undefined;
 };
 /**
- * List cells whose `data.kind` matches the given value, newest first.
- * Uses the `idx_cell_data` GIN index (`data @> ...`).
+ * List active cells with the given `kind`, newest first. Uses the
+ * `idx_cell_kind` index (`cell.kind = ?`).
  *
  * @param deps - query deps
- * @param kind - `data.kind` value to match (e.g. `'collection'`, `'entry'`)
+ * @param kind - `cell.kind` value to match (e.g. `'collection'`, `'entry'`)
  * @param options - pagination
  * @returns matching active rows
  */
-export const query_cell_list_by_data_kind = async (deps, kind, options) => deps.db.query(`SELECT *, ${grant_count_projection('cell')}
+export const query_cell_list_by_kind = async (deps, kind, options) => deps.db.query(`SELECT *, ${grant_count_projection('cell')}
 		 FROM cell
-		 WHERE data @> $1::jsonb
+		 WHERE kind = $1
 		   AND deleted_at IS NULL
 		 ORDER BY created_at DESC
-		 LIMIT $2 OFFSET $3`, [JSON.stringify({ kind }), options?.limit ?? null, options?.offset ?? 0]);
+		 LIMIT $2 OFFSET $3`, [kind, options?.limit ?? null, options?.offset ?? 0]);
 /**
  * List active cells created by an actor, newest first. Backed by the
  * `idx_cell_created_by` partial index.
@@ -284,7 +285,7 @@ export const query_cell_list = async (deps, params) => {
         : build_general_sql(order_column, order_direction);
     return deps.db.query(sql, [
         params.include_deleted === true,
-        params.data_kind ?? null,
+        params.kind ?? null,
         params.ref ?? null,
         params.created_by ?? null,
         params.path_prefix ?? null,
@@ -333,7 +334,7 @@ const CALLER_ROLE_GRANTS_CTE = `WITH caller_role_grants AS (
 const build_general_sql = (order_column, order_direction) => `${CALLER_ROLE_GRANTS_CTE}
 	 SELECT c.*, ${grant_count_projection('c')} FROM cell c
 	 WHERE ($1::bool OR c.deleted_at IS NULL)
-	   AND ($2::text IS NULL OR c.data @> jsonb_build_object('kind', $2::text))
+	   AND ($2::text IS NULL OR c.kind = $2::text)
 	   AND ($14::cell_visibility IS NULL OR c.visibility = $14::cell_visibility)
 	   AND ($3::text IS NULL OR c.refs @> ARRAY[$3]::text[])
 	   AND ($4::uuid IS NULL OR c.created_by = $4)
@@ -369,7 +370,7 @@ const build_general_sql = (order_column, order_direction) => `${CALLER_ROLE_GRAN
 const build_shared_with_sql = (order_column, order_direction) => `${CALLER_ROLE_GRANTS_CTE}
 	 SELECT c.*, ${grant_count_projection('c')} FROM cell c
 	 WHERE ($1::bool OR c.deleted_at IS NULL)
-	   AND ($2::text IS NULL OR c.data @> jsonb_build_object('kind', $2::text))
+	   AND ($2::text IS NULL OR c.kind = $2::text)
 	   AND ($14::cell_visibility IS NULL OR c.visibility = $14::cell_visibility)
 	   AND ($3::text IS NULL OR c.refs @> ARRAY[$3]::text[])
 	   AND ($4::uuid IS NULL OR c.created_by = $4)

package/dist/testing/CLAUDE.md

@@ -897,8 +897,9 @@ source of truth for wire-shape conformance.
 
 - `testing/cross_backend/capabilities.ts` — `BackendCapabilities` vocabulary
   (the **gating** flags `ws` / `sse` / `cell_crud` / `cell_relations` /
-  `account_lifecycle` / `fact_serving` / `ready` / `account_status` /
-  `oversized_reject_closes_connection` / `peer_request` — each has a `test_if`
+  `cell_gated_create` / `account_lifecycle` / `fact_serving` / `ready` /
+  `account_status` / `oversized_reject_closes_connection` / `peer_request` —
+  each has a `test_if`
   reader; `peer_request` (server-initiated requests — the ActionPeer
   `peer/ping` round-trip) is `true` for both the Rust spine and the TS spine
   (`BackendWebsocketTransport.request_connection`); `ts_default_capabilities`
@@ -914,6 +915,13 @@ source of truth for wire-shape conformance.
   parity suite — both `true` on every backend that live-mounts the full cell
   surface (TS spine binary, in-process app, Rust stub). A backend mounting only
   plain CRUD would declare `cell_crud: true, cell_relations: false`.
+  `cell_gated_create` gates `describe_cell_gated_create_cross_tests` (the
+  cell-creation-authorizer parity proof); unlike `cell_crud`/`cell_relations`
+  it is **cross-only** (`false` in-process) — `true` only on the reference
+  spine binaries that live-mount the `test_cell_gated_create_authorize` policy
+  (the TS spine `full_spine_mount` + the Rust `testing_spine_stub`), since the
+  authorizer adds no method/column/wire shape and so the schema + manifest
+  parity gates are blind to an authorizer divergence.
   `account_lifecycle` gates `describe_account_lifecycle_cross_tests` (the
   `account_delete` / `account_undelete` / `account_purge` parity suite); unlike
   cells those verbs **are** on the declared surface (in `create_admin_actions`,
@@ -1154,7 +1162,7 @@ the stream \_can't* open on a spine without SSE — a self-cleaning tripwire for
 the spine that should grow it, distinct from the consumer-legit capability
 skip the shared suite emits.
 
-### `cross_backend/cell_crud.ts` + `cell_relations.ts` — cell parity suites
+### `cross_backend/cell_crud.ts` + `cell_relations.ts` + `cell_gated_create.ts` — cell parity suites
 
 The cell-layer parity coverage is split across two sibling suites. Cells
 can't ride the generic `describe_rpc_round_trip_tests` (stateful verbs need a
@@ -1189,10 +1197,23 @@ backdoor, cell).
   holder who can `cell_get` still gets the IDOR 404). Only **actor-shaped**
   grants are exercised — role-shaped principals need a closed role registry the
   Rust spine deliberately lacks.
-
-Both gate `true` on TS + Rust (cells run on both, no `.skip`). Cross-process
-wiring is `src/test/cross_backend/cell.cross.test.ts` (both suites); the
-in-process legs (plain `gro test`) are `src/test/auth/cell_crud_parity.db.test.ts`
+- **`describe_cell_gated_create_cross_tests`** (gates on
+  `capabilities.cell_gated_create`, **cross-only**) — the cell-creation
+  authorizer (`CellCreateAuthorize`) parity proof. Both spines mount the same
+  `test_cell_gated_create_authorize` policy (gate `kind: 'gated'` behind the
+  `participant` role or admin): a non-participant is denied with the
+  `cell_not_found` 404 IDOR mask, an ungated kind is open, a `participant` is
+  admitted, and admin bypasses. The authorizer adds no method/column/wire
+  shape, so schema + manifest parity are **blind** to a divergence — this is the
+  only gate that catches one. In-process hook coverage is the standalone
+  `auth/cell_create_authorize.db.test.ts` (this cross suite skips in-process,
+  where the default app mounts no authorizer).
+
+`cell_crud` / `cell_relations` gate `true` on TS + Rust (cells run on both, no
+`.skip`); `cell_gated_create` is cross-only (the policy is a spine-binary
+fixture). Cross-process wiring is `src/test/cross_backend/cell.cross.test.ts`
+(all three suites); the in-process legs (plain `gro test`) for crud/relations
+are `src/test/auth/cell_crud_parity.db.test.ts`
 
 - `cell_relations_parity.db.test.ts`, sharing the full-surface
   `create_cell_parity_setup` (`cell_parity_helpers.ts`) which mounts every cell
@@ -1452,6 +1473,44 @@ The in-process counterparts already exist (`describe_rate_limiting_tests` plus t
 proxy middleware tests), so there's no in-process leg. `npm run test:cross:security`.
 Cited property: `docs/security.md` §"Rate Limiting" + §"Trusted Proxy / Client IP".
 
+### Role-gated participation parity — `cross_backend/role_grant_participation.ts`
+
+The role-gated-participation capstone — TS↔Rust agreement that an **app-defined
+role is conferred identically** on both spines. A `participant`
+(`grant_paths: ['admin']`) app-role is registered on both spines (`spine_roles`
+in `default_spine_surface.ts` + the Rust `testing_spine_stub`'s `RoleRegistry`
+and `known_roles`); the cross legs prove the three conferral properties agree.
+
+**Declarative-max, imperative-as-escape-hatch.** The single-request matrix is
+declarative (`conformance_participation_cases.ts`, run via
+`describe_conformance_table_tests`): **(a) grantability** —
+`role_grant_assign` of `participant` passes the admin-grant-path gate and dies
+_past_ it (404, nonexistent account) while a non-grantable role (`keeper`,
+unregistered) is refused _at_ it (403 `role_not_web_grantable`), and the
+`role_grant_offer_create` grant-path gate matches (403
+`role_grant_offer_role_not_grantable`); **(b) admin-only conferral** — a
+non-admin _holder_ of `participant` (and a fresh non-admin) can't offer it (403
+`role_grant_offer_not_authorized` — no holder-propagation); **(c)
+`role_grant_assign` is admin-only** — non-admin holder / fresh → 403
+`insufficient_permissions` (dispatcher gate), anon → 401; plus the
+`to_actor_id`-must-belong-to-`to_account_id` resolution arm (400
+`role_grant_offer_actor_account_mismatch`).
+
+`describe_role_grant_participation_cross_tests` (this module) is the **imperative
+escape hatch** for the multi-step success paths a static row can't express (they
+need a real recipient): admin **assigns** `participant` to a fresh account
+(`{ok, role_grant_id}` + idempotent re-assign), and admin **offers**
+`participant` → recipient **accepts** → a role_grant lands. The `role_holder`
+principal is seeded via `extra_accounts: [{username, roles: ['participant']}]`
+(bootstrap-cradle direct grant) and named through `principals.role_holder`.
+
+Both legs run in-process (`conformance_participation.db.test.ts`, plain
+`gro test`) and cross-process (`conformance_participation.cross.test.ts`, TS
+node/deno/bun + Rust stub). Landing the TS `role_grant_assign` action also turned
+the `cross_backend_parity` action-manifest gate green (it was Rust-only before).
+Cited property: `docs/identity.md` + the role-gated-participation design
+(admin-only conferral, immediate assign).
+
 ### Building a TS test-server binary — `testing_server_core.ts` + adapters
 
 The reusable shape for standing up a **spawnable TS** cross-process test

package/dist/testing/cross_backend/capabilities.d.ts

@@ -159,6 +159,20 @@ export interface BackendCapabilities {
      * coverage.
      */
     readonly peer_request: boolean;
+    /**
+     * A test `CellCreateAuthorize` policy is live-mounted on the backend's cell
+     * layer — creating a `kind: 'gated'` cell requires the `participant` role
+     * or admin; every other kind (and a typeless cell) is open. Gates
+     * `describe_cell_gated_create_cross_tests`, the TS↔Rust cell-creation-
+     * authorizer parity proof. The authorizer adds no method / column / wire
+     * shape, so schema-snapshot + action-manifest parity are **blind** to an
+     * authorizer divergence — this behavioral cross case is the only gate that
+     * catches one. `true` only on the reference spine binaries that mount the
+     * test policy (the TS spine `full_spine_mount` + the Rust
+     * `testing_spine_stub`); consumers and the in-process default app don't
+     * mount it.
+     */
+    readonly cell_gated_create: boolean;
 }
 /**
  * Capability declarations for the in-process Hono transport. Nearly every

package/dist/testing/cross_backend/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwC9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;IACrD;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAWpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwC9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;IACrD;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAcpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}

package/dist/testing/cross_backend/capabilities.js

@@ -56,6 +56,9 @@ export const in_process_capabilities = Object.freeze({
     account_status: true,
     oversized_reject_closes_connection: true,
     peer_request: false,
+    // Cross-process-only: the test `CellCreateAuthorize` policy is mounted on the
+    // spine binaries' full mount + the Rust stub, not the in-process default app.
+    cell_gated_create: false,
 });
 /**
  * Shape notes for the in-process Hono transport — every wiring fact present

package/dist/testing/cross_backend/cell_crud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsD9B,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,YAAY,CAAC;AAGzD,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IA6VlF,CAAC"}
+{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2D9B,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,YAAY,CAAC;AAGzD,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IAublF,CAAC"}