@reventlessdev/reventless-core 3.0.0-alpha.283 → 3.0.0-alpha.285

package/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.285 (2026-10-01)
+
+### Features
+
+* **spec, aws, core, local:** an app declares its environments, and every deployment records its commit ([c7cc925](https://github.com/ReventlessDev/reventless-core/commit/c7cc92573e97742b681a9000cea0bdfd6e9a33fc))
+* **spec, core, gwt, ppx:** a command acts only on what its caller owns ([2636f0e](https://github.com/ReventlessDev/reventless-core/commit/2636f0ee44797ee2c0b0c40a7107cf306113173f))
+
+
+# 3.0.0-alpha.284 (2026-09-29)
+
+**Note:** Version bump only for package @reventlessdev/reventless-core
+
+
+
+
+
 # 3.0.0-alpha.283 (2026-09-28)
 
 **Note:** Version bump only for package @reventlessdev/reventless-core

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-core",
-  "version": "3.0.0-alpha.283",
+  "version": "3.0.0-alpha.285",
   "description": "Core package for Reventless framework",
   "license": "Apache-2.0",
   "jest": {
@@ -28,17 +28,17 @@
   "dependencies": {
     "sury": "11.0.0",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.34",
+    "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.20",
     "@reventlessdev/rescript-hash-object": "1.2.0-alpha.15",
-    "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.19",
+    "@reventlessdev/rescript-effect": "0.1.0-alpha.34",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.20",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.11",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.19",
-    "@reventlessdev/rescript-ssh2": "2.0.0-alpha.20",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.22",
+    "@reventlessdev/rescript-ssh2": "2.0.0-alpha.21",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.181",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.155",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.38",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.153"
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.183"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/src/Message.res.mjs

@@ -381,6 +381,8 @@ function combineMessage(typ, data) {
 
 let serviceSchema = Message$Reventless.serviceSchema;
 
+let CallerClaim = Message$Reventless.CallerClaim;
+
 let metaSchema = Message$Reventless.metaSchema;
 
 let contextSchema = Message$Reventless.contextSchema;
@@ -402,6 +404,7 @@ let InvalidEvent = Message$Reventless.InvalidEvent;
 export {
   logger,
   serviceSchema,
+  CallerClaim,
   metaSchema,
   contextSchema,
   statusChangeSchema,

package/src/components/Aggregate/Aggregate_Callback.res

@@ -57,10 +57,29 @@ module Make = (
   let updateMeta = (command': Message.command'<'id, 'command>) =>
     Message.deriveMeta(~parent=command'.meta)
 
+  // The events whose `@owner` field names who owns this aggregate. Empty for an
+  // aggregate that marks none, and then nothing is enforced.
+  let ownerFieldsByEventType = Reventless.Owner.fieldNamesByVariant(
+    Spec.eventSchema->S.castToUnknown,
+  )
+  let actsOnOwned = ownerFieldsByEventType->Dict.keysToArray->Array.length > 0
+
+  let recordEventOwners = (owners, event: Spec.event) =>
+    if actsOnOwned {
+      let (eventType, data) = event->Message.encode(Spec.eventSchema)->Message.splitMessage
+      switch ownerFieldsByEventType->Dict.get(eventType) {
+      | Some(fields) => owners->Reventless.OwnerScope.recordOwners(~fields, data)
+      | None => owners
+      }
+    } else {
+      owners
+    }
+
   // Per-command outcome carried through the fold, paired with the originating reference and meta.
   type cmdOutcome =
     | CmdOk(array<Spec.event>)
     | CmdRejected({errorCode: string, errorDetail: string})
+    | CmdRefused(CommandTopic_Helpers.ownershipRefusal)
 
   // Folds a single command into the running accumulator: (currentState, perCommandOutcomes).
   // A domain rejection from Behavior.decide is recorded as `CmdRejected` (no state change,
@@ -69,9 +88,16 @@ module Make = (
   //
   // `~seq` is the replayed sequence number the batch decides from, carried in so
   // the line below can name the state rather than serialise it.
+  //
+  // `owners` are the distinct owners the stream records so far, including any a
+  // command earlier in the same batch just recorded.
   let processCommand = (~seq: int) =>
     (
-      (state, outcomes): (Behavior.state, array<(string, cmdOutcome, Message.meta)>),
+      (state, owners, outcomes): (
+        Behavior.state,
+        array<string>,
+        array<(string, cmdOutcome, Message.meta)>,
+      ),
       topicItem: CommandTopic.topicItem<Message.command'<Spec.Id.t, Spec.command>>,
     ) => {
       let {reference, command: command'} = topicItem
@@ -81,33 +107,57 @@ module Make = (
       // history, so serialising it here makes the line's size a function of how
       // long the system has been in use. The state at decision time is a
       // debugger's subject, not a log's.
-      let cmdName =
-        command'.command
-        ->Message.encode(Spec.commandSchema)
-        ->Message.variantNameOfJson
-        ->LogFormat.bold
+      let cmdVariant =
+        command'.command->Message.encode(Spec.commandSchema)->Message.variantNameOfJson
+      let cmdName = cmdVariant->LogFormat.bold
       EffectLogger.logDebug(
         ~comp,
         `deciding: id=${id} seq=${seq->Int.toString} cmd=${cmdName}`,
       )->Effect.runSync
-      switch Behavior.decide(state, command'.command) {
-      | Ok(generatedEvents) =>
-        let newState = generatedEvents->Array.reduce(state, Behavior.evolve)
-        (newState, Array.concat(outcomes, [(reference, CmdOk(generatedEvents), meta)]))
-      | Error(error) =>
-        let errorJson = error->Message.encode(Spec.errorSchema)
-        let errorCode = errorJson->Message.variantNameOfJson
-        // Strip the TAG so detail carries only the rejection payload (empty for unit errors).
-        let (_, payloadDict) = errorJson->Message.splitMessage
-        let errorDetail =
-          payloadDict->Dict.toArray->Array.length == 0
-            ? ""
-            : payloadDict->JSON.Encode.object->JSON.stringify
-        EffectLogger.logError(
-          ~comp,
-          `decide rejected: ${errorCode} ${errorDetail} id=${id}`,
+      // Before `decide`: an owner-marked aggregate refuses a caller who does not
+      // own the stream.
+      let refusal = actsOnOwned
+        ? Reventless.OwnerScope.decideActing(
+            ~claim=command'.meta.callerClaim,
+            ~recordedOwners=Some(owners),
+          )->CommandTopic_Helpers.ownershipRefusal(~component=Spec.name, ~command=cmdVariant)
+        : None
+      switch refusal {
+      | Some(refused) =>
+        let line = `refused: ${refused.rejected.errorDetail} id=${id}`
+
+        (
+          refused.isDefect ? EffectLogger.logError(~comp, line) : EffectLogger.logWarn(~comp, line)
         )->Effect.runSync
-        (state, Array.concat(outcomes, [(reference, CmdRejected({errorCode, errorDetail}), meta)]))
+        (state, owners, Array.concat(outcomes, [(reference, CmdRefused(refused), meta)]))
+      | None =>
+        switch Behavior.decide(state, command'.command) {
+        | Ok(generatedEvents) =>
+          let newState = generatedEvents->Array.reduce(state, Behavior.evolve)
+          (
+            newState,
+            generatedEvents->Array.reduce(owners, recordEventOwners),
+            Array.concat(outcomes, [(reference, CmdOk(generatedEvents), meta)]),
+          )
+        | Error(error) =>
+          let errorJson = error->Message.encode(Spec.errorSchema)
+          let errorCode = errorJson->Message.variantNameOfJson
+          // Strip the TAG so detail carries only the rejection payload (empty for unit errors).
+          let (_, payloadDict) = errorJson->Message.splitMessage
+          let errorDetail =
+            payloadDict->Dict.toArray->Array.length == 0
+              ? ""
+              : payloadDict->JSON.Encode.object->JSON.stringify
+          EffectLogger.logError(
+            ~comp,
+            `decide rejected: ${errorCode} ${errorDetail} id=${id}`,
+          )->Effect.runSync
+          (
+            state,
+            owners,
+            Array.concat(outcomes, [(reference, CmdRejected({errorCode, errorDetail}), meta)]),
+          )
+        }
       }
     }
 
@@ -115,8 +165,8 @@ module Make = (
 
   // In-process replay cache (per warm Lambda instance, per aggregate — the
   // functor instance owns the cache, so the event log is implicit and the key
-  // is just the aggregate id). Holds the `(state, sequenceNr)` the previous
-  // command batch for that id left behind.
+  // is just the aggregate id). Holds the `(state, sequenceNr, owners)` the
+  // previous command batch for that id left behind.
   //
   // On a hit, `replayProcessAppend` skips the event-log replay entirely and
   // decides on the cached state; after a successful append it stores the
@@ -129,7 +179,9 @@ module Make = (
   // the fixed capacity (a per-aggregate knob is a future refinement — see
   // docs/plans/done/aggregate-snapshotting.md).
   let replayCacheCapacity = 100
-  let replayCache: Lru.t<string, (Behavior.state, int)> = Lru.make(~capacity=replayCacheCapacity)
+  let replayCache: Lru.t<string, (Behavior.state, int, array<string>)> = Lru.make(
+    ~capacity=replayCacheCapacity,
+  )
 
   let resetCache = () => replayCache->Lru.clear
 
@@ -139,7 +191,17 @@ module Make = (
   // one every `interval` events. Snapshots are a read optimization only — the
   // OCC append remains the sole consistency primitive, so a missing, drifted,
   // or corrupt snapshot degrades silently to full replay.
-  let snapshotConfig = Behavior.snapshot
+  //
+  // Off for an owner-marked aggregate: a snapshot holds the state alone, so a
+  // replay seeded from one would never see the event that recorded the owner,
+  // and the ownership check would pass every caller.
+  let snapshotConfig = actsOnOwned ? None : Behavior.snapshot
+  if actsOnOwned && Behavior.snapshot->Option.isSome {
+    EffectLogger.logWarn(
+      ~comp,
+      "snapshots disabled: this aggregate records an @owner, which a snapshot does not carry",
+    )->Effect.runSync
+  }
 
   // Structural hash of the state schema, computed once. Stored on every written
   // snapshot and compared on read: a snapshot whose hash differs from the
@@ -183,8 +245,8 @@ module Make = (
 
   // Cold read (in-process cache miss): when snapshots are enabled, seed from the
   // latest persisted snapshot (hash-gated) and replay only the events after it;
-  // otherwise replay full history from seq 0. Returns `(state, sequenceNr)` where
-  // sequenceNr is the total event count (the OCC condition for the next append).
+  // otherwise replay full history from seq 0. Returns `(state, sequenceNr, owners)`
+  // where sequenceNr is the total event count (the OCC condition for the next append).
   let coldReadState = id => {
     let idStr = id->Spec.Id.toString
     let seedEffect = switch snapshotConfig {
@@ -220,8 +282,12 @@ module Make = (
     }
     seedEffect->Effect.flatMap(((seedState, seedSeq)) =>
       Ops.eventLog.replayStream(id, ~fromSeq=seedSeq)
-      ->Stream.runFold((seedState, seedSeq), ((st, n), ev) => (Behavior.evolve(st, ev), n + 1))
-      ->Effect.tap(((_, n)) => {
+      ->Stream.runFold((seedState, seedSeq, []), ((st, n, owners), ev) => (
+        Behavior.evolve(st, ev),
+        n + 1,
+        owners->recordEventOwners(ev),
+      ))
+      ->Effect.tap(((_, n, _)) => {
         let detail =
           seedSeq > 0
             ? `(snapshot@${seedSeq->Int.toString}, ${(n - seedSeq)->Int.toString} delta event(s))`
@@ -305,6 +371,14 @@ module Make = (
           {errorCode, errorDetail},
         )
         Ok(reference)
+      | CmdRefused({rejected}) =>
+        CommandTopic_Helpers.reportRejected(
+          ~component=Spec.name,
+          ~cause=AccessRefusal,
+          reference,
+          rejected,
+        )
+        Ok(reference)
       | CmdOk(_) if appendSucceeded =>
         CommandTopic_Helpers.reportAccepted(
           ~component=Spec.name,
@@ -339,24 +413,27 @@ module Make = (
     // path (`coldReadState`): seed from the persisted snapshot when enabled, else
     // full replay.
     let readState = switch replayCache->Lru.get(idStr) {
-    | Some((state, seqNr)) =>
+    | Some((state, seqNr, owners)) =>
       EffectLogger.logInfo(
         ~comp,
         `replay skipped (cached): id=${idStr}, seq=${seqNr->Int.toString}`,
-      )->Effect.map(_ => (state, seqNr))
+      )->Effect.map(_ => (state, seqNr, owners))
     | None => coldReadState(id)
     }
 
-    readState->Effect.flatMap(((initialState, sequenceNr)) => {
-      let (finalState, outcomes) =
-        topicItemsForId->Array.reduce((initialState, []), processCommand(~seq=sequenceNr))
+    readState->Effect.flatMap(((initialState, sequenceNr, initialOwners)) => {
+      let (finalState, finalOwners, outcomes) =
+        topicItemsForId->Array.reduce(
+          (initialState, initialOwners, []),
+          processCommand(~seq=sequenceNr),
+        )
 
       let eventsToAppend =
         outcomes
         ->Array.map(((_reference, outcome, meta)) =>
           switch outcome {
           | CmdOk(events) => events->Array.map(event => {Message.id, meta, event})
-          | CmdRejected(_) => []
+          | CmdRejected(_) | CmdRefused(_) => []
           }
         )
         ->Array.flat
@@ -365,7 +442,7 @@ module Make = (
       | [] =>
         // Nothing appended, but the read snapshot is valid — keep it warm for
         // the next command (also refreshes recency on a cache hit).
-        replayCache->Lru.put(idStr, (initialState, sequenceNr))
+        replayCache->Lru.put(idStr, (initialState, sequenceNr, initialOwners))
         let perRef = reportFinalOutcomes(
           outcomes,
           ~entityId=idStr,
@@ -392,7 +469,7 @@ module Make = (
             // The post-decide fold state IS the post-append replay result;
             // cache it so the next command for this id skips the replay.
             let newSeq = sequenceNr + generatedEvents'->Array.length
-            replayCache->Lru.put(idStr, (finalState, newSeq))
+            replayCache->Lru.put(idStr, (finalState, newSeq, finalOwners))
             // Persist a snapshot if this append crossed an interval boundary
             // (fire-and-forget — never blocks or fails the command).
             maybeWriteSnapshot(id, idStr, ~oldSeq=sequenceNr, ~newSeq, finalState)

package/src/components/Aggregate/Aggregate_Callback.res.mjs

@@ -8,9 +8,11 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Effect from "effect/Effect";
 import * as Stream from "effect/Stream";
 import * as Stdlib_Promise from "@rescript/runtime/lib/es6/Stdlib_Promise.js";
+import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Lru$ReventlessCore from "../../util/Lru.res.mjs";
 import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Sury.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Message$ReventlessCore from "../../Message.res.mjs";
 import * as LogFormat$ReventlessCore from "../../util/LogFormat.res.mjs";
 import * as EffectLogger$ReventlessCore from "../../util/EffectLogger.res.mjs";
@@ -29,21 +31,55 @@ function Make(Spec) {
       Spec.Id.makeFromString(param[0]),
       param[1]
     ]));
+    let ownerFieldsByEventType = Owner$Reventless.fieldNamesByVariant(Spec.eventSchema);
+    let actsOnOwned = Object.keys(ownerFieldsByEventType).length !== 0;
+    let recordEventOwners = (owners, event) => {
+      if (!actsOnOwned) {
+        return owners;
+      }
+      let match = Message$ReventlessCore.splitMessage(Message$ReventlessCore.encode(event, Spec.eventSchema));
+      let fields = ownerFieldsByEventType[match[0]];
+      if (fields !== undefined) {
+        return OwnerScope$Reventless.recordOwners(owners, fields, match[1]);
+      } else {
+        return owners;
+      }
+    };
     let processCommand = seq => ((param, topicItem) => {
       let reference = topicItem.reference;
       let command$p = topicItem.command;
-      let outcomes = param[1];
+      let outcomes = param[2];
+      let owners = param[1];
       let state = param[0];
       let meta = Message$ReventlessCore.deriveMeta(command$p.meta, undefined);
       let id = Spec.Id.toString(command$p.id);
-      let cmdName = LogFormat$ReventlessCore.bold(Message$ReventlessCore.variantNameOfJson(Message$ReventlessCore.encode(command$p.command, Spec.commandSchema)));
+      let cmdVariant = Message$ReventlessCore.variantNameOfJson(Message$ReventlessCore.encode(command$p.command, Spec.commandSchema));
+      let cmdName = LogFormat$ReventlessCore.bold(cmdVariant);
       Effect.runSync(EffectLogger$ReventlessCore.logDebug(comp, undefined, `deciding: id=` + id + ` seq=` + seq.toString() + ` cmd=` + cmdName));
+      let refusal = actsOnOwned ? CommandTopic_Helpers$ReventlessCore.ownershipRefusal(OwnerScope$Reventless.decideActing(command$p.meta.callerClaim, owners), Spec.name, cmdVariant) : undefined;
+      if (refusal !== undefined) {
+        let line = `refused: ` + refusal.rejected.errorDetail + ` id=` + id;
+        Effect.runSync(refusal.isDefect ? EffectLogger$ReventlessCore.logError(comp, undefined, line) : EffectLogger$ReventlessCore.logWarn(comp, undefined, line));
+        return [
+          state,
+          owners,
+          outcomes.concat([[
+              reference,
+              {
+                TAG: "CmdRefused",
+                _0: refusal
+              },
+              meta
+            ]])
+        ];
+      }
       let generatedEvents = Behavior.decide(state, command$p.command);
       if (generatedEvents.TAG === "Ok") {
         let generatedEvents$1 = generatedEvents._0;
         let newState = Stdlib_Array.reduce(generatedEvents$1, state, Behavior.evolve);
         return [
           newState,
+          Stdlib_Array.reduce(generatedEvents$1, owners, recordEventOwners),
           outcomes.concat([[
               reference,
               {
@@ -62,6 +98,7 @@ function Make(Spec) {
       Effect.runSync(EffectLogger$ReventlessCore.logError(comp, undefined, `decide rejected: ` + errorCode + ` ` + errorDetail + ` id=` + id));
       return [
         state,
+        owners,
         outcomes.concat([[
             reference,
             {
@@ -75,7 +112,10 @@ function Make(Spec) {
     });
     let replayCache = Lru$ReventlessCore.make(100);
     let resetCache = () => Lru$ReventlessCore.clear(replayCache);
-    let snapshotConfig = Behavior.snapshot;
+    let snapshotConfig = actsOnOwned ? undefined : Behavior.snapshot;
+    if (actsOnOwned && Stdlib_Option.isSome(Behavior.snapshot)) {
+      Effect.runSync(EffectLogger$ReventlessCore.logWarn(comp, undefined, "snapshots disabled: this aggregate records an @owner, which a snapshot does not carry"));
+    }
     let stateSchemaHash = snapshotConfig !== undefined ? HashObject(Object.fromEntries([[
           "state",
           SchemaWalker$ReventlessCore.describeSchema(snapshotConfig.stateSchema)
@@ -151,10 +191,12 @@ function Make(Spec) {
         let seedSeq = param[1];
         return Effect.tap(Stream.runFold(Ops.eventLog.replayStream(id, seedSeq), [
           param[0],
-          seedSeq
+          seedSeq,
+          []
         ], (param, ev) => [
           Behavior.evolve(param[0], ev),
-          param[1] + 1 | 0
+          param[1] + 1 | 0,
+          recordEventOwners(param[2], ev)
         ]), param => {
           let n = param[1];
           let detail = seedSeq > 0 ? `(snapshot@` + seedSeq.toString() + `, ` + (n - seedSeq | 0).toString() + ` delta event(s))` : n.toString() + ` event(s)`;
@@ -199,35 +241,43 @@ function Make(Spec) {
       return outcomes.map(param => {
         let outcome = param[1];
         let reference = param[0];
-        if (outcome.TAG === "CmdOk") {
-          if (appendSucceeded) {
-            CommandTopic_Helpers$ReventlessCore.reportAccepted(Spec.name, reference, {
-              entityId: entityId,
-              eventCount: appendedEventCount
+        switch (outcome.TAG) {
+          case "CmdOk" :
+            if (appendSucceeded) {
+              CommandTopic_Helpers$ReventlessCore.reportAccepted(Spec.name, reference, {
+                entityId: entityId,
+                eventCount: appendedEventCount
+              });
+              return {
+                TAG: "Ok",
+                _0: reference
+              };
+            } else {
+              CommandTopic_Helpers$ReventlessCore.reportRejected(Spec.name, "InfrastructureFailure", reference, {
+                errorCode: "AppendFailed",
+                errorDetail: appendErrorDetail
+              });
+              return {
+                TAG: "Error",
+                _0: reference
+              };
+            }
+          case "CmdRejected" :
+            CommandTopic_Helpers$ReventlessCore.reportRejected(Spec.name, "DomainRejection", reference, {
+              errorCode: outcome.errorCode,
+              errorDetail: outcome.errorDetail
             });
             return {
               TAG: "Ok",
               _0: reference
             };
-          } else {
-            CommandTopic_Helpers$ReventlessCore.reportRejected(Spec.name, "InfrastructureFailure", reference, {
-              errorCode: "AppendFailed",
-              errorDetail: appendErrorDetail
-            });
+          case "CmdRefused" :
+            CommandTopic_Helpers$ReventlessCore.reportRejected(Spec.name, "AccessRefusal", reference, outcome._0.rejected);
             return {
-              TAG: "Error",
+              TAG: "Ok",
               _0: reference
             };
-          }
         }
-        CommandTopic_Helpers$ReventlessCore.reportRejected(Spec.name, "DomainRejection", reference, {
-          errorCode: outcome.errorCode,
-          errorDetail: outcome.errorDetail
-        });
-        return {
-          TAG: "Ok",
-          _0: reference
-        };
       });
     };
     let replayProcessAppend = (id, topicItemsForId) => {
@@ -235,35 +285,42 @@ function Make(Spec) {
       let match = Lru$ReventlessCore.get(replayCache, idStr);
       let readState;
       if (match !== undefined) {
+        let owners = match[2];
         let seqNr = match[1];
         let state = match[0];
         readState = Effect.map(EffectLogger$ReventlessCore.logInfo(comp, undefined, `replay skipped (cached): id=` + idStr + `, seq=` + seqNr.toString()), () => [
           state,
-          seqNr
+          seqNr,
+          owners
         ]);
       } else {
         readState = coldReadState(id);
       }
       return Effect.flatMap(readState, param => {
+        let initialOwners = param[2];
         let sequenceNr = param[1];
         let initialState = param[0];
         let match = Stdlib_Array.reduce(topicItemsForId, [
           initialState,
+          initialOwners,
           []
         ], processCommand(sequenceNr));
-        let outcomes = match[1];
+        let outcomes = match[2];
+        let finalOwners = match[1];
         let finalState = match[0];
         let eventsToAppend = outcomes.map(param => {
           let meta = param[2];
           let outcome = param[1];
-          if (outcome.TAG === "CmdOk") {
-            return outcome._0.map(event => ({
-              id: id,
-              meta: meta,
-              event: event
-            }));
-          } else {
-            return [];
+          switch (outcome.TAG) {
+            case "CmdOk" :
+              return outcome._0.map(event => ({
+                id: id,
+                meta: meta,
+                event: event
+              }));
+            case "CmdRejected" :
+            case "CmdRefused" :
+              return [];
           }
         }).flat();
         if (eventsToAppend.length !== 0) {
@@ -280,7 +337,8 @@ function Make(Spec) {
               let newSeq = sequenceNr + eventsToAppend.length | 0;
               Lru$ReventlessCore.put(replayCache, idStr, [
                 finalState,
-                newSeq
+                newSeq,
+                finalOwners
               ]);
               maybeWriteSnapshot(id, idStr, sequenceNr, newSeq, finalState);
               let perRef = reportFinalOutcomes(outcomes, idStr, true, eventsToAppend.length, undefined);
@@ -308,7 +366,8 @@ function Make(Spec) {
         }
         Lru$ReventlessCore.put(replayCache, idStr, [
           initialState,
-          sequenceNr
+          sequenceNr,
+          initialOwners
         ]);
         let perRef = reportFinalOutcomes(outcomes, idStr, true, 0, undefined);
         return Effect.map(EffectLogger$ReventlessCore.logInfo(comp, undefined, `no events produced: id=` + idStr), () => ({

package/src/components/CommandGenerator/CommandGenerator_Callback.res

@@ -55,13 +55,13 @@ let stampOwnerFields = (
   obj: dict<JSON.t>,
   ~commandSchema: S.t<unknown>,
   ~command: string,
-  ~identity: Reventless.Identity.t,
+  ~scope: Reventless.OwnerScope.t,
   ~serviceName: string,
 ) =>
   switch Reventless.Owner.variantFieldNames(commandSchema, ~variant=command) {
   | [] => ()
   | ownerFields =>
-    switch identity->Reventless.OwnerScope.resolve {
+    switch scope {
     | System | Elevated(_) => ()
     | Owned({userId}) =>
       ownerFields->Array.forEach(field => obj->Dict.set(field, JSON.Encode.string(userId)))
@@ -118,6 +118,11 @@ let makeGenerateCommand = (
   (payload: CommandGenerator.payload) =>
     Effect.sync(() => {
       let msgId = Message.uuid()
+      // One classification for the stamp below and for the claim the handler
+      // checks ownership against, so the two cannot disagree about the caller.
+      // The claim is built here and nowhere from the payload, which is all a
+      // client controls.
+      let scope = payload.identity->Reventless.OwnerScope.resolve
       let meta = {
         {
           Message.service: serviceName,
@@ -126,6 +131,7 @@ let makeGenerateCommand = (
           time: Message.nowAsISOString(),
           msgId,
           correlationId: msgId,
+          callerClaim: scope->Reventless.OwnerScope.toClaim,
         }
       }
       let params = switch payload.arguments
@@ -136,12 +142,7 @@ let makeGenerateCommand = (
             obj->Dict.delete("id")
           }
           obj->dropNullArguments
-          obj->stampOwnerFields(
-            ~commandSchema,
-            ~command=payload.command,
-            ~identity=payload.identity,
-            ~serviceName,
-          )
+          obj->stampOwnerFields(~commandSchema, ~command=payload.command, ~scope, ~serviceName)
           obj->Dict.toArray
         }
       | None =>