@grubbylee/aiba 0.1.1

package/capabilities/audit/README.md

@@ -0,0 +1,7 @@
+# Audit Capability
+
+`audit` defines attributable, append-only security events. Event identity,
+actor, correlation, and time come from trusted context; reusable secrets are
+not valid portable event fields.
+
+The capability does not select an event database, log vendor, or admin UI.

package/capabilities/audit/capability.yaml

@@ -0,0 +1,54 @@
+apiVersion: aiba.dev/v0alpha1
+kind: Capability
+metadata:
+  id: audit
+  version: 0.1.0
+  title: Audit
+  description: >-
+    Attributable, append-only security events with trusted timestamps,
+    correlation, redaction, and explicit delivery outcomes.
+spec:
+  interfaces:
+    - identity.principal
+    - audit.event
+  dependencies: []
+  invariants:
+    - id: actor-is-trusted-and-attributable
+      title: Actor is trusted and attributable
+      description: Event actors come from trusted execution context rather than event payload claims.
+      severity: critical
+      evidence: &sourceAndTest
+        acceptedTypes: [source, test, config, document]
+        requiredTypes: [source, test]
+        minimum: 2
+        requireHash: true
+    - id: event-identity-and-time-are-server-derived
+      title: Event identity and time are server derived
+      description: Unique event identifiers and occurrence timestamps are assigned inside the trusted audit boundary.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: events-are-append-only
+      title: Events are append-only
+      description: The application-facing audit interface cannot update or delete previously accepted events.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: outcomes-are-explicit
+      title: Outcomes are explicit
+      description: Allowed, denied, succeeded, and failed security outcomes are distinguishable.
+      severity: error
+      evidence: *sourceAndTest
+    - id: events-are-correlated
+      title: Events are correlated
+      description: Every event carries a trusted correlation identifier for request or workflow attribution.
+      severity: error
+      evidence: *sourceAndTest
+    - id: reusable-secrets-are-rejected
+      title: Reusable secrets are rejected
+      description: Passwords, credential material, session tokens, reset tokens, and transport secrets are not accepted event fields.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: delivery-failure-is-visible
+      title: Delivery failure is visible
+      description: An event storage failure is returned to the caller and is never silently treated as recorded.
+      severity: critical
+      evidence: *sourceAndTest

package/capabilities/audit/recipes/typescript-reference.yaml

@@ -0,0 +1,64 @@
+apiVersion: aiba.dev/v0alpha1
+kind: CapabilityRecipe
+metadata:
+  id: typescript-reference
+  version: 0.1.0
+  title: TypeScript Audit Boundary
+  description: Semantic guidance for a strict, append-only TypeScript audit recorder.
+spec:
+  capability:
+    id: audit
+    version: 0.1.0
+  compatibility:
+    languages: [TypeScript]
+    frameworks: []
+  writeScope:
+    allowedPatterns:
+      - src/**
+      - server/**
+      - test/**
+      - tests/**
+      - cloudfunctions/**
+  operations:
+    - id: establish-audit-envelope
+      intent: Derive actor, event identity, timestamp, and correlation inside the trusted boundary.
+      requiredInterfaces: [identity.principal, audit.event]
+      invariants: [actor-is-trusted-and-attributable, event-identity-and-time-are-server-derived, events-are-correlated]
+      guidance:
+        - Accept the actor and correlation identifier only from authenticated server context.
+        - Reject payload fields that attempt to replace trusted envelope values.
+    - id: constrain-audit-content
+      intent: Record explicit outcomes and stable reason codes without reusable secret material.
+      requiredInterfaces: [audit.event]
+      invariants: [outcomes-are-explicit, reusable-secrets-are-rejected]
+      guidance:
+        - Use bounded action and reason-code vocabularies rather than arbitrary messages.
+        - Keep passwords, hashes, tokens, cookies, authorization headers, and provider credentials out of events.
+    - id: establish-audit-delivery
+      intent: Append each accepted event durably and expose failed delivery to the caller.
+      requiredInterfaces: [audit.event]
+      invariants: [events-are-append-only, delivery-failure-is-visible]
+      guidance:
+        - Expose append but no update or delete operation through the application recorder.
+        - Propagate or explicitly queue storage failures; never report an unpersisted event as recorded.
+  evidence:
+    - invariant: actor-is-trusted-and-attributable
+      suggestions: &auditEvidence
+        - type: source
+          pathPattern: src/**/*.ts
+          description: Trusted audit recorder implementation.
+        - type: test
+          pathPattern: src/**/*.test.ts
+          description: Audit envelope, redaction, and delivery tests.
+    - invariant: event-identity-and-time-are-server-derived
+      suggestions: *auditEvidence
+    - invariant: events-are-append-only
+      suggestions: *auditEvidence
+    - invariant: outcomes-are-explicit
+      suggestions: *auditEvidence
+    - invariant: events-are-correlated
+      suggestions: *auditEvidence
+    - invariant: reusable-secrets-are-rejected
+      suggestions: *auditEvidence
+    - invariant: delivery-failure-is-visible
+      suggestions: *auditEvidence

package/capabilities/authorization/README.md

@@ -0,0 +1,7 @@
+# Authorization Capability
+
+`authorization` evaluates an explicit principal, action, and resource against
+trusted policy. It defaults to denial, enforces tenant boundaries, emits a
+portable decision, and records every outcome through audit.
+
+It does not prescribe RBAC, ABAC, a policy engine, or an admin UI.

package/capabilities/authorization/capability.yaml

@@ -0,0 +1,66 @@
+apiVersion: aiba.dev/v0alpha1
+kind: Capability
+metadata:
+  id: authorization
+  version: 0.1.0
+  title: Authorization
+  description: >-
+    Fail-closed policy decisions over trusted principals, explicit actions,
+    resources, and tenant boundaries with attributable audit outcomes.
+spec:
+  interfaces:
+    - identity.principal
+    - authorization.decision
+    - audit.event
+  dependencies:
+    - id: identity
+      version: ^0.1.0
+      optional: false
+    - id: audit
+      version: ^0.1.0
+      optional: false
+  invariants:
+    - id: principal-comes-from-trusted-context
+      title: Principal comes from trusted context
+      description: Request payloads cannot choose principal type, subject, tenant, role, or permission.
+      severity: critical
+      evidence: &sourceAndTest
+        acceptedTypes: [source, test, config, document]
+        requiredTypes: [source, test]
+        minimum: 2
+        requireHash: true
+    - id: decisions-default-to-deny
+      title: Decisions default to deny
+      description: Missing grants, malformed requests, and policy evaluation failures never imply access.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: action-and-resource-are-explicit
+      title: Action and resource are explicit
+      description: Each decision binds one bounded action and resource instead of inferring permission from identity.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: deny-takes-precedence
+      title: Deny takes precedence
+      description: An applicable explicit denial cannot be overridden by a simultaneous allow grant.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: tenant-boundaries-are-enforced
+      title: Tenant boundaries are enforced
+      description: A tenant principal cannot access a resource assigned to a different tenant.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: policy-is-server-authoritative
+      title: Policy is server authoritative
+      description: Policy rules and versions come from trusted server state, never request claims.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: decisions-are-attributable
+      title: Decisions are attributable
+      description: Decisions contain server-derived identity, reason, policy version, time, and decision identifier.
+      severity: error
+      evidence: *sourceAndTest
+    - id: decisions-are-audited
+      title: Decisions are audited
+      description: Allowed and denied evaluations are recorded, and audit failure cannot result in allowed access.
+      severity: critical
+      evidence: *sourceAndTest

package/capabilities/authorization/recipes/typescript-reference.yaml

@@ -0,0 +1,73 @@
+apiVersion: aiba.dev/v0alpha1
+kind: CapabilityRecipe
+metadata:
+  id: typescript-reference
+  version: 0.1.0
+  title: TypeScript Authorization Boundary
+  description: Semantic guidance for an explicit, fail-closed TypeScript policy evaluator.
+spec:
+  capability:
+    id: authorization
+    version: 0.1.0
+  compatibility:
+    languages: [TypeScript]
+    frameworks: []
+  writeScope:
+    allowedPatterns:
+      - src/**
+      - server/**
+      - test/**
+      - tests/**
+      - cloudfunctions/**
+  operations:
+    - id: establish-decision-boundary
+      intent: Separate trusted principal context from a bounded action and resource request.
+      requiredInterfaces: [identity.principal, authorization.decision]
+      invariants: [principal-comes-from-trusted-context, action-and-resource-are-explicit, decisions-are-attributable]
+      guidance:
+        - Reject payload fields for principal, tenant context, role, permission, policy, or decision outcome.
+        - Return one explicit decision with a server-derived identifier, reason, policy version, and timestamp.
+    - id: evaluate-policy-fail-closed
+      intent: Evaluate trusted policy with default deny and explicit deny precedence.
+      requiredInterfaces: [authorization.decision]
+      invariants: [decisions-default-to-deny, deny-takes-precedence, policy-is-server-authoritative]
+      guidance:
+        - Treat missing, malformed, unavailable, or ambiguous policy as denial.
+        - Avoid implicit wildcard grants; make broad access explicit and independently reviewable.
+    - id: enforce-tenant-boundary
+      intent: Deny object access across tenant boundaries before evaluating allow grants.
+      requiredInterfaces: [authorization.decision]
+      invariants: [tenant-boundaries-are-enforced]
+      guidance:
+        - Compare trusted principal and resource tenant identifiers before policy grant matching.
+        - Add object-level authorization tests for attacker-selected resource identifiers.
+    - id: audit-policy-decisions
+      intent: Record every allow and deny outcome without permitting audit failure to become access.
+      requiredInterfaces: [audit.event]
+      invariants: [decisions-are-audited]
+      guidance:
+        - Record stable decision and reason identifiers without sensitive resource contents.
+        - Fail closed when required decision auditing cannot be completed.
+  evidence:
+    - invariant: principal-comes-from-trusted-context
+      suggestions: &authorizationEvidence
+        - type: source
+          pathPattern: src/**/*.ts
+          description: Server-side authorization implementation.
+        - type: test
+          pathPattern: src/**/*.test.ts
+          description: Policy, tenant-isolation, and fail-closed tests.
+    - invariant: decisions-default-to-deny
+      suggestions: *authorizationEvidence
+    - invariant: action-and-resource-are-explicit
+      suggestions: *authorizationEvidence
+    - invariant: deny-takes-precedence
+      suggestions: *authorizationEvidence
+    - invariant: tenant-boundaries-are-enforced
+      suggestions: *authorizationEvidence
+    - invariant: policy-is-server-authoritative
+      suggestions: *authorizationEvidence
+    - invariant: decisions-are-attributable
+      suggestions: *authorizationEvidence
+    - invariant: decisions-are-audited
+      suggestions: *authorizationEvidence

package/capabilities/identity/README.md

@@ -0,0 +1,8 @@
+# Identity Capability
+
+`identity` defines a server-authoritative authentication and session boundary.
+It produces a stable principal without embedding roles or permissions, keeps
+credentials one-way, and requires opaque, expiring, revocable sessions.
+
+The pack is implementation guidance and evidence policy. It does not provide a
+hosted identity service, choose a user database, or execute project commands.

package/capabilities/identity/capability.yaml

@@ -0,0 +1,63 @@
+apiVersion: aiba.dev/v0alpha1
+kind: Capability
+metadata:
+  id: identity
+  version: 0.1.0
+  title: Identity
+  description: >-
+    Server-authoritative credential verification and session management that
+    produces stable principals without granting permissions.
+spec:
+  interfaces:
+    - identity.principal
+    - identity.session
+    - audit.event
+  dependencies:
+    - id: audit
+      version: ^0.1.0
+      optional: true
+  invariants:
+    - id: credentials-are-one-way
+      title: Credentials are one-way
+      description: Recoverable passwords and reusable raw credentials are never stored.
+      severity: critical
+      evidence: &sourceAndTest
+        acceptedTypes: [source, test, config, document]
+        requiredTypes: [source, test]
+        minimum: 2
+        requireHash: true
+    - id: principal-is-server-derived
+      title: Principal is server derived
+      description: Principal type, subject, and tenant are derived from trusted identity state, never client claims.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: failures-do-not-enumerate-accounts
+      title: Failures do not enumerate accounts
+      description: Unknown, disabled, and invalid-credential accounts expose the same public authentication failure.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: sessions-are-opaque-and-expiring
+      title: Sessions are opaque and expiring
+      description: Session credentials have strong entropy, are stored one-way, and expire in trusted server state.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: sessions-are-revocable
+      title: Sessions are revocable
+      description: Trusted callers can invalidate a session before its normal expiration.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: attempts-use-trusted-rate-limits
+      title: Attempts use trusted rate limits
+      description: Authentication attempts are limited by trusted transport context even when request fields change.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: authentication-is-audited
+      title: Authentication is audited
+      description: Authentication, session validation, and revocation outcomes emit attributable audit events.
+      severity: error
+      evidence: *sourceAndTest
+    - id: audit-excludes-reusable-secrets
+      title: Audit excludes reusable secrets
+      description: Audit events never contain passwords, credential hashes, session tokens, or reset tokens.
+      severity: critical
+      evidence: *sourceAndTest

package/capabilities/identity/recipes/typescript-reference.yaml

@@ -0,0 +1,75 @@
+apiVersion: aiba.dev/v0alpha1
+kind: CapabilityRecipe
+metadata:
+  id: typescript-reference
+  version: 0.1.0
+  title: TypeScript Identity Boundary
+  description: >-
+    Semantic guidance for adapting credential verification, principals,
+    sessions, abuse controls, and audit emission to a TypeScript server.
+spec:
+  capability:
+    id: identity
+    version: 0.1.0
+  compatibility:
+    languages: [TypeScript]
+    frameworks: []
+  writeScope:
+    allowedPatterns:
+      - src/**
+      - server/**
+      - test/**
+      - tests/**
+      - cloudfunctions/**
+  operations:
+    - id: establish-credential-boundary
+      intent: Verify credentials with a memory-hard one-way function and a non-enumerating public failure.
+      requiredInterfaces: [identity.principal]
+      invariants: [credentials-are-one-way, failures-do-not-enumerate-accounts]
+      guidance:
+        - Use a maintained identity provider or a standard memory-hard primitive such as Argon2id or scrypt.
+        - Perform equivalent credential work for unknown and known accounts before returning one generic failure.
+    - id: derive-principal
+      intent: Produce principal identity only from trusted user and tenant records.
+      requiredInterfaces: [identity.principal]
+      invariants: [principal-is-server-derived]
+      guidance:
+        - Reject extra request fields that try to select subject, tenant, role, or permission.
+        - Keep roles and permissions outside the principal and evaluate them in authorization policy.
+    - id: establish-session-boundary
+      intent: Issue opaque, expiring, revocable sessions whose reusable tokens are never stored in raw form.
+      requiredInterfaces: [identity.session]
+      invariants: [sessions-are-opaque-and-expiring, sessions-are-revocable]
+      guidance:
+        - Generate at least 256 bits of cryptographic randomness and store only a token digest.
+        - Enforce expiry and revocation through shared trusted storage on every session validation.
+    - id: defend-authentication
+      intent: Apply trusted abuse controls and emit redacted security events for every boundary outcome.
+      requiredInterfaces: [audit.event]
+      invariants: [attempts-use-trusted-rate-limits, authentication-is-audited, audit-excludes-reusable-secrets]
+      guidance:
+        - Derive rate-limit keys from trusted transport context rather than request identifiers.
+        - Emit stable reason codes and correlation identifiers without credential or token material.
+  evidence:
+    - invariant: credentials-are-one-way
+      suggestions: &identityEvidence
+        - type: source
+          pathPattern: src/**/*.ts
+          description: Server-side identity implementation.
+        - type: test
+          pathPattern: src/**/*.test.ts
+          description: Identity boundary and attack tests.
+    - invariant: principal-is-server-derived
+      suggestions: *identityEvidence
+    - invariant: failures-do-not-enumerate-accounts
+      suggestions: *identityEvidence
+    - invariant: sessions-are-opaque-and-expiring
+      suggestions: *identityEvidence
+    - invariant: sessions-are-revocable
+      suggestions: *identityEvidence
+    - invariant: attempts-use-trusted-rate-limits
+      suggestions: *identityEvidence
+    - invariant: authentication-is-audited
+      suggestions: *identityEvidence
+    - invariant: audit-excludes-reusable-secrets
+      suggestions: *identityEvidence

package/capabilities/notification/README.md

@@ -0,0 +1,7 @@
+# Notification Capability
+
+`notification` sends authorized, tenant-scoped template commands to trusted
+recipient references. It enforces consent, idempotency, bounded parameters,
+minimized receipts, and redacted delivery audit events.
+
+It does not expose provider credentials, choose a vendor, or prescribe a message UI.

package/capabilities/notification/capability.yaml

@@ -0,0 +1,71 @@
+apiVersion: aiba.dev/v0alpha1
+kind: Capability
+metadata:
+  id: notification
+  version: 0.1.0
+  title: Notification
+  description: >-
+    Authorized, tenant-scoped template delivery with trusted recipient
+    resolution, consent, durable idempotency, minimized receipts, and audit.
+spec:
+  interfaces:
+    - identity.principal
+    - authorization.decision
+    - audit.event
+    - notification.command
+    - notification.receipt
+  dependencies:
+    - id: authorization
+      version: ^0.1.0
+      optional: false
+    - id: audit
+      version: ^0.1.0
+      optional: false
+    - id: users
+      version: ^0.1.0
+      optional: true
+  invariants:
+    - id: send-is-authorized
+      title: Send is authorized
+      description: Every notification command requires an explicit decision over its trusted recipient reference.
+      severity: critical
+      evidence: &sourceAndTest
+        acceptedTypes: [source, test, config, document]
+        requiredTypes: [source, test]
+        minimum: 2
+        requireHash: true
+    - id: tenant-comes-from-trusted-context
+      title: Tenant comes from trusted context
+      description: Requests cannot select the tenant used for templates, recipient resolution, or idempotency.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: content-uses-trusted-templates
+      title: Content uses trusted templates
+      description: Commands select enabled server templates and bounded parameter keys instead of arbitrary message content.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: recipient-destination-is-server-resolved
+      title: Recipient destination is server resolved
+      description: Provider destinations and credentials are resolved in trusted adapters, never command fields.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: consent-is-enforced
+      title: Consent is enforced
+      description: A disabled channel or absent recipient consent suppresses provider delivery.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: delivery-is-idempotent
+      title: Delivery is idempotent
+      description: A tenant-scoped key is durably bound to one command and propagated to an idempotent provider adapter.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: delivery-failure-is-visible
+      title: Delivery failure is visible
+      description: Provider or required audit failure cannot produce a sent receipt.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: receipts-and-audit-are-minimized
+      title: Receipts and audit are minimized
+      description: Results and audit events exclude destinations, parameters, provider secrets, and provider payloads.
+      severity: critical
+      evidence: *sourceAndTest

package/capabilities/notification/recipes/typescript-reference.yaml

@@ -0,0 +1,73 @@
+apiVersion: aiba.dev/v0alpha1
+kind: CapabilityRecipe
+metadata:
+  id: typescript-reference
+  version: 0.1.0
+  title: TypeScript Notification Boundary
+  description: Semantic guidance for authorized, idempotent template delivery in TypeScript.
+spec:
+  capability:
+    id: notification
+    version: 0.1.0
+  compatibility:
+    languages: [TypeScript]
+    frameworks: []
+  writeScope:
+    allowedPatterns:
+      - src/**
+      - server/**
+      - test/**
+      - tests/**
+      - cloudfunctions/**
+  operations:
+    - id: establish-notification-command
+      intent: Accept a bounded template command while deriving tenant and recipient destination from trusted state.
+      requiredInterfaces: [identity.principal, notification.command]
+      invariants: [tenant-comes-from-trusted-context, content-uses-trusted-templates, recipient-destination-is-server-resolved]
+      guidance:
+        - Reject tenant, address, body, provider, credential, and provider-options fields.
+        - Resolve an enabled server template and allow only its declared parameter keys.
+    - id: authorize-and-check-consent
+      intent: Authorize the recipient resource and enforce channel consent before provider invocation.
+      requiredInterfaces: [authorization.decision]
+      invariants: [send-is-authorized, consent-is-enforced]
+      guidance:
+        - Evaluate notification send permission over the trusted tenant and recipient reference.
+        - Suppress delivery without exposing raw destination or preference records.
+    - id: establish-idempotent-delivery
+      intent: Bind one command fingerprint to a durable tenant-scoped key and an idempotent provider call.
+      requiredInterfaces: [notification.receipt]
+      invariants: [delivery-is-idempotent, delivery-failure-is-visible]
+      guidance:
+        - Persist key, command fingerprint, and final receipt through a shared single-flight boundary.
+        - Propagate the same opaque idempotency key to a provider that guarantees duplicate suppression.
+    - id: minimize-notification-provenance
+      intent: Return and audit only delivery metadata that cannot be reused as a destination or secret.
+      requiredInterfaces: [audit.event, notification.receipt]
+      invariants: [receipts-and-audit-are-minimized]
+      guidance:
+        - Exclude destination, parameters, provider request/response, and credentials from receipts and events.
+        - Record sent, suppressed, and failed outcomes with template and recipient references only where policy permits.
+  evidence:
+    - invariant: send-is-authorized
+      suggestions: &notificationEvidence
+        - type: source
+          pathPattern: src/**/*.ts
+          description: Notification command and delivery implementation.
+        - type: test
+          pathPattern: src/**/*.test.ts
+          description: Authorization, consent, idempotency, and redaction tests.
+    - invariant: tenant-comes-from-trusted-context
+      suggestions: *notificationEvidence
+    - invariant: content-uses-trusted-templates
+      suggestions: *notificationEvidence
+    - invariant: recipient-destination-is-server-resolved
+      suggestions: *notificationEvidence
+    - invariant: consent-is-enforced
+      suggestions: *notificationEvidence
+    - invariant: delivery-is-idempotent
+      suggestions: *notificationEvidence
+    - invariant: delivery-failure-is-visible
+      suggestions: *notificationEvidence
+    - invariant: receipts-and-audit-are-minimized
+      suggestions: *notificationEvidence

package/capabilities/review-access/README.md

@@ -0,0 +1,14 @@
+# Review Access
+
+This capability defines generic reviewer access. Platform adapters may bind it
+to a WeChat Mini Program release, an App Store review account, a demo tenant, or
+another external review workflow.
+
+The capability does not prescribe routes, tables, authentication libraries, or
+UI. A valid implementation must satisfy every invariant in `capability.yaml`.
+
+M0 verifies receipt coverage and evidence integrity. The `typescript-reference`
+recipe adds non-executable semantic operations, bounded write paths, and
+evidence suggestions for Agent-assisted installation. The `wechat-native`
+recipe and fixture exercise the same contract through a native Mini Program,
+server-authoritative TypeScript boundary, and black-box HTTP attack tests.

package/capabilities/review-access/capability.yaml

@@ -0,0 +1,65 @@
+apiVersion: aiba.dev/v0alpha1
+kind: Capability
+metadata:
+  id: review-access
+  version: 0.1.0
+  title: Review Access
+  description: >-
+    Time-bound, least-privilege access for application-store and external
+    reviewers who cannot use normal account onboarding.
+spec:
+  interfaces:
+    - identity.principal
+    - authorization.decision
+    - audit.event
+  dependencies: []
+  invariants:
+    - id: reviewer-is-distinct-principal
+      title: Reviewer is a distinct principal
+      description: Reviewer sessions never impersonate an internal user or administrator.
+      severity: critical
+      evidence: &sourceAndTest
+        acceptedTypes: [source, test, document]
+        requiredTypes: [source, test]
+        minimum: 2
+        requireHash: true
+    - id: server-authoritative-enable
+      title: Enablement is server authoritative
+      description: Trusted server-side state decides whether review access is enabled.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: scope-is-least-privilege
+      title: Scope follows least privilege
+      description: Reviewer permissions are explicitly constrained to review-only actions and data.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: access-expires
+      title: Access expires automatically
+      description: Reviewer credentials and sessions have a server-enforced expiration time.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: access-is-revocable
+      title: Access can be revoked
+      description: Authorized operators can invalidate reviewer access before its normal expiration.
+      severity: error
+      evidence: *sourceAndTest
+    - id: production-data-is-isolated
+      title: Production data is isolated
+      description: Reviewer flows expose isolated or explicitly sanitized data, never unrestricted production data.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: attempts-are-rate-limited
+      title: Attempts are rate limited
+      description: Repeated failed reviewer authentication attempts are limited by trusted server state.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: actions-are-audited
+      title: Actions are audited
+      description: Authentication, denial, session creation, revocation, and reviewer actions are attributable.
+      severity: error
+      evidence: *sourceAndTest
+    - id: client-cannot-self-assert-reviewer
+      title: Client cannot self-assert reviewer identity
+      description: Client input cannot select reviewer identity, permissions, data scope, or enablement.
+      severity: critical
+      evidence: *sourceAndTest