@fuzdev/fuz_app 0.103.0 → 0.104.0

package/dist/db/cell_queries.js

@@ -51,14 +51,17 @@ const grant_count_projection = (cell_alias) => `(SELECT COUNT(*)::int FROM cell_
 export const query_cell_create = async (deps, input) => {
     const refs = derive_refs(input.data);
     const row = await deps.db.query_one(`INSERT INTO cell
-		   (data, kind, visibility, path, refs, created_by)
-		 VALUES ($1::jsonb, $2, COALESCE($3::cell_visibility, 'private'::cell_visibility), $4, $5::text[], $6)
+		   (data, kind, visibility, path, refs, parent_id, root_id, moderation, created_by)
+		 VALUES ($1::jsonb, $2, COALESCE($3::cell_visibility, 'private'::cell_visibility), $4, $5::text[], $6, $7, $8, $9)
 		 RETURNING *, ${grant_count_projection('cell')}`, [
         JSON.stringify(input.data),
         input.kind ?? null,
         input.visibility ?? null,
         input.path ?? null,
         refs,
+        input.parent_id ?? null,
+        input.root_id ?? null,
+        input.moderation ?? null,
         input.created_by ?? null,
     ]);
     return assert_row(row, 'INSERT INTO cell');
@@ -171,6 +174,34 @@ export const query_cell_delete = async (deps, id, options) => {
 		 RETURNING id`, [id, options?.deleted_by ?? null]);
     return row !== undefined;
 };
+/**
+ * Transition a contribution's `moderation` marker (the `cell_moderate` verb's
+ * write). On `set_visibility_public` (an approval) it also flips `visibility`
+ * to `'public'` so the approved contribution goes live; a rejection leaves
+ * visibility untouched (stays private). `updated_at` / `updated_by` are stamped.
+ *
+ * `moderation` is deliberately **not** writable through `query_cell_update`
+ * (it's absent from `CellUpdatePatch`) — gating the transition on a dedicated
+ * query (with the manage-tier authority check in the handler) is what stops an
+ * author self-approving their own pending cell.
+ *
+ * @param deps - query deps
+ * @param id - cell id
+ * @param moderation - the terminal marker to write (`'approved'` | `'rejected'`)
+ * @param options - `set_visibility_public` flips visibility on approval; `updated_by` records the moderator
+ * @returns the updated row, or `null` when no active row matched (raced delete)
+ * @mutates `cell` - sets `moderation` (+ maybe `visibility`) on one row
+ */
+export const query_cell_set_moderation = async (deps, id, moderation, options) => {
+    const row = await deps.db.query_one(`UPDATE cell SET
+		   moderation = $2,
+		   visibility = CASE WHEN $3::bool THEN 'public'::cell_visibility ELSE visibility END,
+		   updated_by = $4,
+		   updated_at = NOW()
+		 WHERE id = $1 AND deleted_at IS NULL
+		 RETURNING *, ${grant_count_projection('cell')}`, [id, moderation, options.set_visibility_public, options.updated_by ?? null]);
+    return row ?? null;
+};
 /**
  * List active cells with the given `kind`, newest first. Uses the
  * `idx_cell_kind` index (`cell.kind = ?`).
@@ -272,7 +303,7 @@ export const query_cell_list = async (deps, params) => {
     // supplied wildcards (`%`, `_`, `\`) match literally — Postgres 11+ has
     // the function and pglite/PG 16 supports it.
     //
-    // Two SQL shapes share the same 14-param positional layout:
+    // Two SQL shapes share the same 16-param positional layout:
     //
     // - `shared_with_caller_only: false` — cell-driven scan with the
     //   visibility predicate (admin / public / owner / grant-admits).
@@ -298,6 +329,8 @@ export const query_cell_list = async (deps, params) => {
         role_grant_roles,
         role_grant_scope_ids,
         params.visibility ?? null,
+        params.root_id ?? null,
+        params.moderation ?? null,
     ]);
 };
 /**
@@ -340,6 +373,8 @@ const build_general_sql = (order_column, order_direction) => `${CALLER_ROLE_GRAN
 	   AND ($4::uuid IS NULL OR c.created_by = $4)
 	   AND ($5::text IS NULL OR starts_with(c.path, $5))
 	   AND ($10::uuid[] IS NULL OR c.id = ANY($10))
+	   AND ($15::uuid IS NULL OR c.root_id = $15)
+	   AND ($16::text IS NULL OR c.moderation = $16::text)
 	   AND (
 	     $6::bool
 	     OR c.visibility = 'public'
@@ -376,6 +411,8 @@ const build_shared_with_sql = (order_column, order_direction) => `${CALLER_ROLE_
 	   AND ($4::uuid IS NULL OR c.created_by = $4)
 	   AND ($5::text IS NULL OR starts_with(c.path, $5))
 	   AND ($10::uuid[] IS NULL OR c.id = ANY($10))
+	   AND ($15::uuid IS NULL OR c.root_id = $15)
+	   AND ($16::text IS NULL OR c.moderation = $16::text)
 	   AND $7::uuid IS NOT NULL
 	   AND c.created_by IS DISTINCT FROM $7
 	   AND c.id IN (

package/dist/testing/CLAUDE.md

@@ -915,13 +915,15 @@ source of truth for wire-shape conformance.
   parity suite — both `true` on every backend that live-mounts the full cell
   surface (TS spine binary, in-process app, Rust stub). A backend mounting only
   plain CRUD would declare `cell_crud: true, cell_relations: false`.
-  `cell_gated_create` gates `describe_cell_gated_create_cross_tests` (the
-  cell-creation-authorizer parity proof); unlike `cell_crud`/`cell_relations`
+  `cell_gated_create` gates `describe_cell_gated_create_cross_tests` +
+  `describe_cell_moderate_cross_tests` (the parent-aware-creation-authorizer +
+  `cell_moderate` parity proofs); unlike `cell_crud`/`cell_relations`
   it is **cross-only** (`false` in-process) — `true` only on the reference
   spine binaries that live-mount the `test_cell_gated_create_authorize` policy
   (the TS spine `full_spine_mount` + the Rust `testing_spine_stub`), since the
-  authorizer adds no method/column/wire shape and so the schema + manifest
-  parity gates are blind to an authorizer divergence.
+  authorizer _behavior_ adds no method/wire shape and so the schema + manifest
+  parity gates are blind to an authorizer divergence (the `cell_moderate`
+  _verb_ it pairs with is on the manifest, separately gated).
   `account_lifecycle` gates `describe_account_lifecycle_cross_tests` (the
   `account_delete` / `account_undelete` / `account_purge` parity suite); unlike
   cells those verbs **are** on the declared surface (in `create_admin_actions`,
@@ -1197,22 +1199,29 @@ backdoor, cell).
   holder who can `cell_get` still gets the IDOR 404). Only **actor-shaped**
   grants are exercised — role-shaped principals need a closed role registry the
   Rust spine deliberately lacks.
-- **`describe_cell_gated_create_cross_tests`** (gates on
-  `capabilities.cell_gated_create`, **cross-only**) — the cell-creation
-  authorizer (`CellCreateAuthorize`) parity proof. Both spines mount the same
-  `test_cell_gated_create_authorize` policy (gate `kind: 'gated'` behind the
-  `participant` role or admin): a non-participant is denied with the
-  `cell_not_found` 404 IDOR mask, an ungated kind is open, a `participant` is
-  admitted, and admin bypasses. The authorizer adds no method/column/wire
-  shape, so schema + manifest parity are **blind** to a divergence — this is the
-  only gate that catches one. In-process hook coverage is the standalone
-  `auth/cell_create_authorize.db.test.ts` (this cross suite skips in-process,
-  where the default app mounts no authorizer).
+- **`describe_cell_gated_create_cross_tests`** + **`describe_cell_moderate_cross_tests`**
+  (gate on `capabilities.cell_gated_create`, **cross-only**) — the parent-aware
+  cell-creation authorizer (`CellCreateAuthorize`, **directory model**) +
+  the `cell_moderate` verb parity proofs. Both spines mount the same
+  `test_cell_gated_create_authorize` policy: a `kind: 'space'` **root** is
+  admin-only (a non-admin → **403** `cell_create_forbidden`); a **contribution**
+  under a space is gated by the root's `data.policy[kind] = {min_role,
+moderation_required}`, with `moderation` set per the verdict (`pending`+private
+  vs `approved`+author-visibility); a **hidden** parent **404**-masks vs a
+  **visible** one **403**s; plain parentless creates stay open. The moderate
+  suite then proves the `pending → approved | rejected` transition: an admin
+  (root manager) approves → public, the **author** self-approve → 403
+  (anti-self-approval), a non-viewer → 404, reject → stays private. The
+  authorizer _behavior_ adds no method/wire shape, so schema + manifest parity
+  are **blind** to a divergence — these are the only gates that catch one (the
+  `cell_moderate` verb itself is manifest-covered). In-process hook coverage is
+  the standalone `auth/cell_create_authorize.db.test.ts` (these cross suites skip
+  in-process, where the default app mounts no authorizer).
 
 `cell_crud` / `cell_relations` gate `true` on TS + Rust (cells run on both, no
 `.skip`); `cell_gated_create` is cross-only (the policy is a spine-binary
 fixture). Cross-process wiring is `src/test/cross_backend/cell.cross.test.ts`
-(all three suites); the in-process legs (plain `gro test`) for crud/relations
+(all the cell suites); the in-process legs (plain `gro test`) for crud/relations
 are `src/test/auth/cell_crud_parity.db.test.ts`
 
 - `cell_relations_parity.db.test.ts`, sharing the full-surface

package/dist/testing/cross_backend/cell_gated_create.d.ts

@@ -1,4 +1,28 @@
 import '../assert_dev_env.js';
 import type { RpcPathCrossSuiteOptions } from './setup.js';
 export declare const describe_cell_gated_create_cross_tests: (options: RpcPathCrossSuiteOptions) => void;
+/**
+ * Cross-backend parity for the **`cell_moderate` verb** (the `pending →
+ * approved | rejected` transition) — root-authority-gated.
+ *
+ * Builds a moderated public space (admin) + a `participant`'s `post` (born
+ * `pending` + private under the `moderation_required: true` policy), then
+ * proves both spines agree:
+ *
+ * - **a root manager (admin) approves** → `moderation: 'approved'` +
+ *   `visibility: 'public'` (the contribution goes live).
+ * - **the author cannot self-approve** → `403 cell_moderate_forbidden` (the
+ *   author can *view* their own pending cell, so they reach the gate, and are
+ *   denied — moderation authority is over the governing root, not the
+ *   contribution).
+ * - **a non-viewer is 404-masked** → a stranger who can't see the pending
+ *   contribution gets `cell_not_found`, never learns it exists.
+ * - **reject** → `moderation: 'rejected'`, visibility stays private.
+ *
+ * Gated on `capabilities.cell_gated_create` — a `pending` contribution only
+ * exists when the directory authorizer is mounted (reference spine binaries).
+ *
+ * `$lib`-free by contract (relative specifiers only).
+ */
+export declare const describe_cell_moderate_cross_tests: (options: RpcPathCrossSuiteOptions) => void;
 //# sourceMappingURL=cell_gated_create.d.ts.map

package/dist/testing/cross_backend/cell_gated_create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_gated_create.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_gated_create.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuC9B,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,YAAY,CAAC;AAIzD,eAAO,MAAM,sCAAsC,GAAI,SAAS,wBAAwB,KAAG,IAqF1F,CAAC"}
+{"version":3,"file":"cell_gated_create.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_gated_create.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiD9B,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,YAAY,CAAC;AAkBzD,eAAO,MAAM,sCAAsC,GAAI,SAAS,wBAAwB,KAAG,IAwP1F,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,kCAAkC,GAAI,SAAS,wBAAwB,KAAG,IAwHtF,CAAC"}

package/dist/testing/cross_backend/cell_gated_create.js

@@ -1,25 +1,35 @@
 import '../assert_dev_env.js';
 /**
- * Cross-backend parity suite for the **cell-creation authorizer**
- * (`CellCreateAuthorize`).
+ * Cross-backend parity suite for the **parent-aware cell-creation authorizer**
+ * (`CellCreateAuthorize`) — the directory model.
  *
  * The authorizer adds no method, column, or wire shape, so the schema-snapshot
  * and action-manifest parity gates are **blind** to a TS↔Rust authorizer
- * divergence (the authorizer in the wrong phase, a different deny shape,
- * create-vs-update). This behavioral cross case is the only gate that catches
- * one — proven *here in fuz_app*, against both reference spines.
+ * divergence (the authorizer in the wrong phase, a different deny shape, the
+ * 404/403 split, the moderation outcome). This behavioral cross case is the
+ * only gate that catches one — proven *here in fuz_app*, against both reference
+ * spines.
  *
- * Both spines mount the same `test_cell_gated_create_authorize` policy (the
- * TS spine binary via `full_spine_mount`, the Rust `testing_spine_stub` via
- * `TestCellGatedCreateAuthorize`): creating a `kind: 'gated'` cell requires the
- * `participant` app-role or admin; every other kind (and a typeless cell) is
- * open. The suite asserts all three spines agree:
+ * Both spines mount the same directory-model policy (the TS spine binary via
+ * `create_test_cell_gated_create_authorize`, the Rust `testing_spine_stub` via
+ * `TestCellGatedCreateAuthorize`): admin bypasses; a non-admin creating a
+ * `kind: 'space'` **root** is denied (admin-only); a **contribution** under a
+ * space is gated by the space's `data.policy[kind] = {min_role, moderation_required}`,
+ * with the moderation outcome folded into the verdict; plain parentless creates
+ * stay open. The suite asserts all spines agree on:
  *
- * - **non-participant → gated kind is denied** with the `cell_not_found` 404
- *   IDOR mask (a gated kind is wire-indistinguishable from a missing resource).
- * - **non-participant → ungated kind succeeds** (the policy gates only `gated`).
- * - **participant → gated kind succeeds** (the role unlocks it).
- * - **admin → gated kind succeeds** (the admin bypass).
+ * - **root-create admin-only** — a non-admin `space` root → **403**
+ *   `cell_create_forbidden`; admin → succeeds.
+ * - **contribution gated by the root's policy** — under a public space, an
+ *   unauthorized stranger → **403**; a `participant` → succeeds.
+ * - **moderation per `moderation_required`** — a `participant`'s `post`
+ *   (`moderation_required: true`) is born `moderation: 'pending'` + private; a
+ *   `react` (`moderation_required: false`) is born `moderation: 'approved'` at
+ *   the author's visibility.
+ * - **404 on a hidden parent vs 403 on a visible one** — a contribution under a
+ *   **private** space the caller can't view → **404** `cell_not_found` (the
+ *   parent is masked); under a **public** space → **403** (you see it, you
+ *   can't contribute).
  *
  * Gated on `capabilities.cell_gated_create` — `true` only on the reference
  * spine binaries that mount the policy, so it skips for generic consumers and
@@ -31,41 +41,173 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, assert } from 'vitest';
-import { CellCreateOutput } from '../../auth/cell_action_specs.js';
+import { CellCreateOutput, CellModerateOutput } from '../../auth/cell_action_specs.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
-import { GATED_CELL_KIND, GATED_CELL_ROLE } from './test_cell_gated_create_authorize.js';
+import { SPACE_CELL_KIND, PARTICIPATION_ROLE } from './test_cell_gated_create_authorize.js';
+/**
+ * A space `data.policy` mirroring the test ladder: gated `post` (moderated) +
+ * `react` (live) + `comment` (live). `comment` exists so the deep-case test can
+ * create a comment under a post (`root_id !== parent_id`) and prove the policy
+ * resolves from the governing root (the space), not the immediate parent.
+ */
+const SPACE_POLICY = {
+    policy: {
+        post: { min_role: PARTICIPATION_ROLE, moderation_required: true },
+        react: { min_role: PARTICIPATION_ROLE, moderation_required: false },
+        comment: { min_role: PARTICIPATION_ROLE, moderation_required: false },
+    },
+};
 export const describe_cell_gated_create_cross_tests = (options) => {
     const { setup_test, capabilities } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
-    describe('cell_gated_create authorizer parity', () => {
-        test_if(capabilities.cell_gated_create, 'a non-participant is denied the gated kind (cell_not_found 404 IDOR mask)', async () => {
+    describe('cell_gated_create authorizer parity (directory model)', () => {
+        test_if(capabilities.cell_gated_create, 'a non-admin is denied a `space` root (admin-only), admin succeeds', async () => {
             const fixture = await setup_test();
-            const stranger = await fixture.create_account({ username: 'gated_stranger' });
-            const denied = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: GATED_CELL_KIND, data: {} }, stranger.create_session_headers());
-            assert.ok(!denied.ok, 'a non-participant must not create the gated kind');
-            assert.strictEqual(error_reason(denied), 'cell_not_found');
+            const stranger = await fixture.create_account({ username: 'space_stranger' });
+            const denied = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {} }, stranger.create_session_headers());
+            assert.ok(!denied.ok, 'a non-admin must not create a space root');
+            assert.strictEqual(error_reason(denied), 'cell_create_forbidden');
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+            assert.strictEqual(space.cell.kind, SPACE_CELL_KIND, 'admin creates the space root');
+            assert.strictEqual(space.cell.parent_id, null, 'a root is parentless');
+            assert.strictEqual(space.cell.root_id, null, 'a root has no governing root');
+            assert.strictEqual(space.cell.moderation, null, 'a root carries no moderation marker even under a mounted authorizer (moderation is a contribution concept)');
         });
-        test_if(capabilities.cell_gated_create, 'a non-participant may create an ungated kind (the policy gates only `gated`)', async () => {
+        test_if(capabilities.cell_gated_create, 'a contribution under a public space: unauthorized → 403, participant → allowed', async () => {
             const fixture = await setup_test();
-            const stranger = await fixture.create_account({ username: 'ungated_stranger' });
-            const created = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'note', data: {} }, stranger.create_session_headers()), CellCreateOutput);
-            assert.strictEqual(created.cell.kind, 'note', 'the ungated cell keeps its kind');
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+            // A non-participant sees the public space but can't contribute → 403.
+            const stranger = await fixture.create_account({ username: 'post_stranger' });
+            const forbidden = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id }, stranger.create_session_headers());
+            assert.ok(!forbidden.ok, 'a non-participant must not post in the space');
+            assert.strictEqual(error_reason(forbidden), 'cell_create_forbidden');
+            // A participant may post; the contribution carries the directory edges.
+            const participant = await fixture.create_account({
+                username: 'post_participant',
+                roles: [PARTICIPATION_ROLE],
+            });
+            const post = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id }, participant.create_session_headers()), CellCreateOutput);
+            assert.strictEqual(post.cell.parent_id, space.cell.id, 'parent edge set');
+            assert.strictEqual(post.cell.root_id, space.cell.id, 'root resolved to the space');
         });
-        test_if(capabilities.cell_gated_create, 'a participant may create the gated kind', async () => {
+        test_if(capabilities.cell_gated_create, 'moderation is set per `moderation_required` (post → pending+private, react → approved)', async () => {
             const fixture = await setup_test();
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
             const participant = await fixture.create_account({
-                username: 'gated_participant',
-                roles: [GATED_CELL_ROLE],
+                username: 'mod_participant',
+                roles: [PARTICIPATION_ROLE],
             });
-            const created = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: GATED_CELL_KIND, data: {} }, participant.create_session_headers()), CellCreateOutput);
-            assert.strictEqual(created.cell.kind, GATED_CELL_KIND, 'the participant created the gated kind');
+            // `post` requires moderation → born pending + forced private.
+            const post = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id, visibility: 'public' }, participant.create_session_headers()), CellCreateOutput);
+            assert.strictEqual(post.cell.moderation, 'pending', 'gated post is born pending');
+            assert.strictEqual(post.cell.visibility, 'private', 'a pending contribution is forced private until approved');
+            // `react` does not require moderation → born approved at the author's visibility.
+            const react = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'react', data: {}, parent_id: space.cell.id, visibility: 'public' }, participant.create_session_headers()), CellCreateOutput);
+            assert.strictEqual(react.cell.moderation, 'approved', 'unmoderated kind is born approved');
+            assert.strictEqual(react.cell.visibility, 'public', "the author's visibility is honored");
+        });
+        test_if(capabilities.cell_gated_create, 'a contribution under a hidden (private) space is 404-masked (not 403)', async () => {
+            const fixture = await setup_test();
+            // A private space — only admin/owner can view it.
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'private' }, fixture.create_session_headers()), CellCreateOutput);
+            const stranger = await fixture.create_account({ username: 'hidden_stranger' });
+            const masked = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id }, stranger.create_session_headers());
+            assert.ok(!masked.ok, 'a stranger must not contribute under a hidden space');
+            assert.strictEqual(error_reason(masked), 'cell_not_found', 'a hidden parent 404-masks the attempt (never reveals it exists)');
         });
-        test_if(capabilities.cell_gated_create, 'an admin (keeper) may create the gated kind (admin bypass)', async () => {
+        test_if(capabilities.cell_gated_create, 'a deep contribution (comment under a post) resolves policy from the governing root, not the parent', async () => {
             const fixture = await setup_test();
-            const created = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: GATED_CELL_KIND, data: {} }, fixture.create_session_headers()), CellCreateOutput);
-            assert.strictEqual(created.cell.kind, GATED_CELL_KIND, 'admin bypasses the gate');
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+            const participant = await fixture.create_account({
+                username: 'deep_participant',
+                roles: [PARTICIPATION_ROLE],
+            });
+            // A post lives directly under the space — the shallow case
+            // (`root_id === parent_id`), so the handler reuses the parent row as
+            // `root_data`. The post is gated `moderation_required: true`, so it's
+            // born pending + private; the author can still view their own pending
+            // cell, so it's a valid parent for the comment below.
+            const post = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id }, participant.create_session_headers()), CellCreateOutput);
+            assert.strictEqual(post.cell.root_id, space.cell.id, 'a post roots at the space');
+            // A comment lives under the post — the DEEP case. Here
+            // `root_id !== parent_id`, so the handler must read the governing
+            // root (the space) *through* the post (the separate in-tx root read),
+            // and the authorizer must resolve `policy.comment` from the SPACE's
+            // data, not the post's. This is the only case that exercises the
+            // deep-read branch on both spines.
+            const comment = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'comment', data: {}, parent_id: post.cell.id }, participant.create_session_headers()), CellCreateOutput);
+            assert.strictEqual(comment.cell.parent_id, post.cell.id, 'the immediate parent is the post');
+            assert.strictEqual(comment.cell.root_id, space.cell.id, 'the governing root resolves to the space (deep read through the post), not the post');
+            assert.strictEqual(comment.cell.moderation, 'approved', 'the comment policy (moderation_required: false) resolved from the space, not the post');
+        });
+    });
+};
+/**
+ * Cross-backend parity for the **`cell_moderate` verb** (the `pending →
+ * approved | rejected` transition) — root-authority-gated.
+ *
+ * Builds a moderated public space (admin) + a `participant`'s `post` (born
+ * `pending` + private under the `moderation_required: true` policy), then
+ * proves both spines agree:
+ *
+ * - **a root manager (admin) approves** → `moderation: 'approved'` +
+ *   `visibility: 'public'` (the contribution goes live).
+ * - **the author cannot self-approve** → `403 cell_moderate_forbidden` (the
+ *   author can *view* their own pending cell, so they reach the gate, and are
+ *   denied — moderation authority is over the governing root, not the
+ *   contribution).
+ * - **a non-viewer is 404-masked** → a stranger who can't see the pending
+ *   contribution gets `cell_not_found`, never learns it exists.
+ * - **reject** → `moderation: 'rejected'`, visibility stays private.
+ *
+ * Gated on `capabilities.cell_gated_create` — a `pending` contribution only
+ * exists when the directory authorizer is mounted (reference spine binaries).
+ *
+ * `$lib`-free by contract (relative specifiers only).
+ */
+export const describe_cell_moderate_cross_tests = (options) => {
+    const { setup_test, capabilities } = options;
+    const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    // Build an admin-owned public space (moderated `post` policy) + a
+    // participant's pending post under it.
+    const setup_pending_post = async () => {
+        const fixture = await setup_test();
+        const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+        const author = await fixture.create_account({
+            username: 'moderate_author',
+            roles: [PARTICIPATION_ROLE],
+        });
+        const post = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id }, author.create_session_headers()), CellCreateOutput);
+        return { fixture, author, post };
+    };
+    describe('cell_moderate verb parity (root-authority-gated)', () => {
+        test_if(capabilities.cell_gated_create, 'a root manager (admin) approves a pending post → approved + public', async () => {
+            const { fixture, post } = await setup_pending_post();
+            assert.strictEqual(post.cell.moderation, 'pending', 'the post is born pending');
+            const moderated = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_moderate', { cell_id: post.cell.id, moderation: 'approved' }, fixture.create_session_headers()), CellModerateOutput);
+            assert.strictEqual(moderated.cell.moderation, 'approved', 'approval sets the marker');
+            assert.strictEqual(moderated.cell.visibility, 'public', 'approval publishes the post');
+        });
+        test_if(capabilities.cell_gated_create, 'the author (non-manager) cannot moderate their own pending post → 403', async () => {
+            const { fixture, author, post } = await setup_pending_post();
+            const denied = await cross_rpc_call(fixture.transport, rpc_path, 'cell_moderate', { cell_id: post.cell.id, moderation: 'approved' }, author.create_session_headers());
+            assert.ok(!denied.ok, 'the author must not self-approve');
+            assert.strictEqual(error_reason(denied), 'cell_moderate_forbidden');
+        });
+        test_if(capabilities.cell_gated_create, 'a non-viewer is 404-masked from moderating a pending post', async () => {
+            const { fixture, post } = await setup_pending_post();
+            const stranger = await fixture.create_account({ username: 'moderate_stranger' });
+            const masked = await cross_rpc_call(fixture.transport, rpc_path, 'cell_moderate', { cell_id: post.cell.id, moderation: 'approved' }, stranger.create_session_headers());
+            assert.ok(!masked.ok, 'a non-viewer must not moderate');
+            assert.strictEqual(error_reason(masked), 'cell_not_found', 'a non-viewer never learns the pending post exists');
+        });
+        test_if(capabilities.cell_gated_create, 'a root manager rejects a pending post → rejected, stays private', async () => {
+            const { fixture, post } = await setup_pending_post();
+            const moderated = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_moderate', { cell_id: post.cell.id, moderation: 'rejected' }, fixture.create_session_headers()), CellModerateOutput);
+            assert.strictEqual(moderated.cell.moderation, 'rejected', 'rejection sets the marker');
+            assert.strictEqual(moderated.cell.visibility, 'private', 'rejection leaves the post private');
         });
     });
 };

package/dist/testing/cross_backend/expected_schema.json

@@ -55,8 +55,11 @@
 		"deleted_at",
 		"id",
 		"kind",
+		"moderation",
+		"parent_id",
 		"path",
 		"refs",
+		"root_id",
 		"updated_at",
 		"updated_by",
 		"visibility"

package/dist/testing/cross_backend/full_spine_mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"full_spine_mount.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/full_spine_mount.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,6BAA6B,CAAC;AAE3D,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,8CAA8C,CAAC;AAKrF,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oCAAoC,CAAC;AASzE,2FAA2F;AAC3F,MAAM,WAAW,qBAAqB;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CAiCjB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACpC,KAAK,gBAAgB,EACrB,SAAS,qBAAqB,KAC5B,KAAK,CAAC,eAAe,CAEvB,CAAC"}
+{"version":3,"file":"full_spine_mount.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/full_spine_mount.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,6BAA6B,CAAC;AAE3D,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,8CAA8C,CAAC;AAKrF,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oCAAoC,CAAC;AASzE,2FAA2F;AAC3F,MAAM,WAAW,qBAAqB;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CAoCjB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACpC,KAAK,gBAAgB,EACrB,SAAS,qBAAqB,KAC5B,KAAK,CAAC,eAAe,CAEvB,CAAC"}

package/dist/testing/cross_backend/full_spine_mount.js

@@ -29,10 +29,13 @@ export const build_full_spine_rpc_actions = (deps, options) => {
             session_options: spine_session_options,
             daemon_token_state: options.daemon_token_state,
         }),
-        // Mount the `cell_gated_create` test policy (twin of the Rust stub's
-        // `TestCellGatedCreateAuthorize`) so the cross-backend authorizer-parity
-        // suite has a known gate. It only gates `kind: 'gated'`; every other kind
-        // stays open, so the other cell suites are unaffected.
+        // Mount the directory-model `cell_gated_create` test policy (twin of the
+        // Rust stub's `TestCellGatedCreateAuthorize`) so the cross-backend
+        // authorizer-parity suite has a known gate: `kind: 'space'` roots are
+        // admin-only, contributions are gated by the root's `data.policy`, and
+        // plain parentless creates stay open (the other cell suites are
+        // unaffected). The handler hands the governing root's `data` to the
+        // (pure) authorizer.
         ...create_all_cell_actions({ ...deps, authorize_create: test_cell_gated_create_authorize }, { roles: spine_roles }),
         ...create_actor_lookup_actions(deps),
         ...create_actor_search_actions(deps),

package/dist/testing/cross_backend/test_cell_gated_create_authorize.d.ts

@@ -1,17 +1,22 @@
 import '../assert_dev_env.js';
 import type { CellCreateAuthorize } from '../../auth/cell_actions.js';
-/** The single kind the test policy gates (shared with the driving suite). */
-export declare const GATED_CELL_KIND = "gated";
+/** The admin-only root kind the test policy gates (talk's `space` analog). */
+export declare const SPACE_CELL_KIND = "space";
 /**
- * The app-role that unlocks creating the gated kind (besides admin) — the
+ * The app-role a space policy references as `min_role` (besides admin) — the
  * `participant` role both reference spines register. Mirrors the Rust policy's
  * `"participant"` literal.
  */
-export declare const GATED_CELL_ROLE = "participant";
+export declare const PARTICIPATION_ROLE = "participant";
+/** A space's per-kind contribution rule (the shape stamped into `space.data.policy`). */
+export interface ContributionRule {
+    min_role?: string;
+    moderation_required?: boolean;
+}
 /**
- * Allow unless the cell's `kind` is `'gated'`, in which case the actor must
- * hold the `participant` role or be a (scope-agnostic) admin. Mirrors the Rust
- * `TestCellGatedCreateAuthorize` exactly.
+ * The directory-model test authorizer — a **pure** function of the input (it
+ * reads the governing root's policy off `input.root_data`, supplied by the
+ * handler). Byte-equivalent with the Rust `TestCellGatedCreateAuthorize`.
  */
 export declare const test_cell_gated_create_authorize: CellCreateAuthorize;
 //# sourceMappingURL=test_cell_gated_create_authorize.d.ts.map

package/dist/testing/cross_backend/test_cell_gated_create_authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test_cell_gated_create_authorize.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/test_cell_gated_create_authorize.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuB9B,OAAO,KAAK,EAAC,mBAAmB,EAA2B,MAAM,4BAA4B,CAAC;AAG9F,6EAA6E;AAC7E,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,eAAe,gBAAyB,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAE,mBAIiD,CAAC"}
+{"version":3,"file":"test_cell_gated_create_authorize.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/test_cell_gated_create_authorize.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA+B9B,OAAO,KAAK,EACX,mBAAmB,EAGnB,MAAM,4BAA4B,CAAC;AAGpC,8EAA8E;AAC9E,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,gBAAyB,CAAC;AAEzD,yFAAyF;AACzF,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAYD;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAE,mBAoB9C,CAAC"}

package/dist/testing/cross_backend/test_cell_gated_create_authorize.js

@@ -3,14 +3,22 @@ import '../assert_dev_env.js';
  * Test `CellCreateAuthorize` policy mounted on **both** reference spines — the
  * TS spine binary's full mount (`full_spine_mount.ts`) and the Rust
  * `testing_spine_stub` — so the cross-backend `cell_gated_create` suite proves
- * the cell-creation authorizer agrees TS↔Rust. The twin of the Rust
- * `TestCellGatedCreateAuthorize`.
+ * the parent-aware cell-creation authorizer agrees TS↔Rust. The twin of the
+ * Rust `TestCellGatedCreateAuthorize`, **directory model**.
  *
- * The policy gates exactly one kind: creating a `kind: 'gated'` cell requires
- * the `participant` app-role (registered on both spines, `grant_paths:
- * ['admin']`) or admin. Every other kind — and a typeless cell — is open, so
- * the existing cell suites (which use `note` / `collection` kinds) are
- * unaffected, exactly as on the Rust stub.
+ * Admin bypasses everything (`{allow: true, moderation_required: false}`). For
+ * a non-admin:
+ *
+ * - **Root creation** (`root_id` null): `kind: 'space'` is admin-only (denied);
+ *   every other parentless kind stays open, so the plain-create `cell_crud` /
+ *   `cell_relations` suites are unaffected.
+ * - **Contribution** (`root_id` set): the governing root's
+ *   `data.policy[kind] = {min_role?, moderation_required?}` decides — a missing
+ *   entry denies, a present `min_role` the actor lacks denies, and otherwise it
+ *   admits with the entry's `moderation_required` folded into the verdict. The
+ *   root's `data` arrives in `input.root_data` (the handler read it in-tx), so
+ *   the predicate is **pure** — no DB read of its own (which also dodges the
+ *   single-connection PGlite deadlock a separate handle would hit).
  *
  * **`$lib`-free by contract** — reached by the spawned TS spine binary under
  * Gro's loader (no `$lib` alias). Keep every import relative.
@@ -20,17 +28,48 @@ import '../assert_dev_env.js';
 import { has_role } from '../../auth/request_context.js';
 import { ROLE_ADMIN } from '../../auth/role_schema.js';
 import { SPINE_PARTICIPANT_ROLE } from './spine_surface_constants.js';
-/** The single kind the test policy gates (shared with the driving suite). */
-export const GATED_CELL_KIND = 'gated';
+/** The admin-only root kind the test policy gates (talk's `space` analog). */
+export const SPACE_CELL_KIND = 'space';
 /**
- * The app-role that unlocks creating the gated kind (besides admin) — the
+ * The app-role a space policy references as `min_role` (besides admin) — the
  * `participant` role both reference spines register. Mirrors the Rust policy's
  * `"participant"` literal.
  */
-export const GATED_CELL_ROLE = SPINE_PARTICIPANT_ROLE;
+export const PARTICIPATION_ROLE = SPINE_PARTICIPANT_ROLE;
+/** Pull the governing root's `data.policy[kind]` rule, defensively (loose `data`). */
+const get_contribution_rule = (data, kind) => {
+    if (data === null || typeof data !== 'object')
+        return undefined;
+    const policy = data.policy;
+    if (policy === null || typeof policy !== 'object')
+        return undefined;
+    const rule = policy[kind];
+    if (rule === null || typeof rule !== 'object')
+        return undefined;
+    return rule;
+};
 /**
- * Allow unless the cell's `kind` is `'gated'`, in which case the actor must
- * hold the `participant` role or be a (scope-agnostic) admin. Mirrors the Rust
- * `TestCellGatedCreateAuthorize` exactly.
+ * The directory-model test authorizer — a **pure** function of the input (it
+ * reads the governing root's policy off `input.root_data`, supplied by the
+ * handler). Byte-equivalent with the Rust `TestCellGatedCreateAuthorize`.
  */
-export const test_cell_gated_create_authorize = (auth, input) => input.kind !== GATED_CELL_KIND || has_role(auth, GATED_CELL_ROLE) || has_role(auth, ROLE_ADMIN);
+export const test_cell_gated_create_authorize = (auth, input) => {
+    // Admin bypass — admins create roots + any kind, live immediately.
+    if (has_role(auth, ROLE_ADMIN))
+        return { allow: true, moderation_required: false };
+    // Root creation (no governing root): `space` is admin-only; other parentless
+    // kinds stay open (the plain-create suites).
+    if (input.root_id === null) {
+        return input.kind === SPACE_CELL_KIND
+            ? { allow: false }
+            : { allow: true, moderation_required: false };
+    }
+    // Contribution: resolve the governing root's per-kind policy.
+    const rule = get_contribution_rule(input.root_data, input.kind ?? '');
+    if (!rule)
+        return { allow: false };
+    const admitted = rule.min_role === undefined || has_role(auth, rule.min_role);
+    return admitted
+        ? { allow: true, moderation_required: rule.moderation_required ?? false }
+        : { allow: false };
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.103.0",
+  "version": "0.104.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",