@twinsearth/w2m-dsh-plugin 0.28.0 → 0.29.0

package/CHANGELOG.md

@@ -4,6 +4,68 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.29.0] — 2026-10-15
+
+**v4.8.0 was half shipped, and the ROADMAP said otherwise. The missing half is now built.**
+
+### What the check found
+
+`ROADMAP.md` described v4.8.0 as *"a CAT7 seven-field cognitive block, **per-field acceptance driven by §2's
+authority model**, and lineage"* and marked it **shipped in 0.9.9**. Reading the tree instead of the sentence:
+
+| Claim | Verdict |
+|---|---|
+| CAT7 seven-field block | **real**, asserted |
+| lineage, with a missing parent refused rather than re-rooted | **real**, asserted |
+| a refused field *absent* from the stored block rather than null | **real**, asserted |
+| **"driven by §2's authority model"** | **never built** |
+
+Measured: **`src/agent/blocks.mjs` did not import `authority.mjs` at all**, and `defaultChoose` — the only
+chooser that shipped — refused `confidence` by name and accepted everything else. **A roadmap sentence is a
+claim, and this one was checkable in a single grep.** It stood for several releases because nothing tested the
+sentence itself.
+
+### `src/agent/field-authority.mjs`
+
+Per-field acceptance now goes through `authority.evaluate`, so the two models cannot drift into different
+notions of what a rule is. Three refusals apply in a fixed order:
+
+1. **not a CAT7 field** — before any rule, because a rule cannot make a field exist;
+2. **no declared rule** — refused, never granted and never escalated;
+3. **the authority verdict** — `allow` accepts, anything else refuses with the model's own reason.
+
+**A field with no declared rule is refused**, which is the same decision `authority.mjs` already states for
+exemptions and `permission.mjs` states for capabilities. Three modules, one rule, because the failure mode is
+identical: **a table that grants what it has not heard of grants whatever is added next.**
+
+### The three inherited fields are deliberately undeclared, and that is not dead policy
+
+Measured: the chooser is asked about `subject`, `body` and `evidence` — **never** `origin`, `observed_at` or
+`lineage`, because `acceptBlock` copies the inherited three directly. A rule for them would read as policy
+while doing nothing, so they are left out and `acceptField` reports them `UNDECLARED`. A test asserts a rule
+can never be added for them by accident.
+
+`confidence` is refused **at every level including `AUTHORITY_MAX`**, because if it were merely expensive a
+system administrator would be *permitted by this model* to adopt the sender's own certainty about the
+sender's own assertion.
+
+### Four of my own errors, and how each surfaced
+
+* I invented `scope_claim` and `meaning` as field names. **Neither exists** — the real seven are `origin`,
+  `subject`, `body`, `evidence`, `confidence`, `observed_at`, `lineage`. My "undeclared field" test was
+  therefore testing `NOT_A_FIELD` and passing for the wrong reason; the fields that are genuinely
+  governed-but-undeclared are the three inherited ones.
+* I asserted `accepted_fields` held only the receiver's two, when it also carries the three inherited ones.
+* I asserted one chooser ruling per choosable field; there are **three, not four**, because `acceptBlock`
+  hard-codes the `confidence` refusal and `continue`s **before** calling the chooser.
+* `observed_at: 'T'` is not an ISO timestamp and `makeBlock` refused it — **the block layer was right and my
+  probe was wrong**, which is the sixth time in this project that a failing test was the test's fault.
+
+Every one of the four was found by **measuring the real behaviour** rather than by reading the source and
+predicting it.
+
+**17 tests, 0 failures.**
+
 ## [0.28.0] — 2026-10-15
 
 **First real-machine verification of the recent work, and a tool that packs four answers into one exit code.**

package/ROADMAP.md

@@ -60,7 +60,7 @@ that produced it.
   the document does not grant it and inventing it would be the worst possible default;
 - a rule with no `matching_exempt_level` exempts nobody, rather than exempting everybody.
 
-### v4.8.0 — memory: field-level acceptance (MMP P1/P2)  **shipped in 0.9.9, suite verified on MacMini**
+### v4.8.0 — memory: field-level acceptance (MMP P1/P2)  **shipped in 0.9.9 (block + lineage); the authority half completed in 0.29.0**
 
 **Deliverable.** Extend the shipped memory layer: a CAT7 seven-field cognitive block, per-field
 acceptance driven by §2's authority model, and lineage — each accepted claim records the content hash of
@@ -70,6 +70,17 @@ its parent, so a returned claim is identifiable as the receiver's own earlier th
 claim's ancestor chain survives a round trip; a claim whose parent is missing is refused rather than
 silently re-rooted.
 
+**Correction, 0.29.0.** This entry previously read *"shipped in 0.9.9, suite verified on MacMini"*, and that
+was **half true**. The block, the lineage, the absent-not-null refusal and the missing-parent refusal all
+shipped and are all asserted. But **"per-field acceptance driven by §2's authority model" was never built**:
+measured, `src/agent/blocks.mjs` did not import `authority.mjs` at all, and the only chooser that shipped
+refused `confidence` by name and accepted everything else. The connection now exists in
+`src/agent/field-authority.mjs`, with the three inherited fields deliberately left undeclared because no
+chooser is ever asked about them.
+
+The lesson is recorded rather than tidied away: **a roadmap sentence is a claim, and this one was checkable
+in one grep.** It stood for several releases because nothing tested the sentence itself.
+
 ### v4.9.0 — approval queue and scheduling
 
 **Deliverable.** A cross-session pending-approval index (§4.2's "supervisor reviews every agent's pending

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "0.28.0",
+  "version": "0.29.0",
   "description": "DSH: Windows2MacOS — drive the same project on online Windows and macOS machines from one DeepSeek account, across networks and regions. P2P hole punching is the default path (relay + shared server as rendezvous, ledger and fallback), with a bundled STUN responder, Tailscale/public-VPS/tunnel shapes, Rabbit relay + per-machine Localside + eight DSH tools (replicate / split), nine aggregate verdicts and signed requests.",
   "type": "module",
   "main": "lib/index.js",
@@ -113,13 +113,13 @@
     }
   },
   "scripts": {
-    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/layer-model.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
+    "test": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/layer-model.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-crypto.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
     "test:e2e": "node --test --test-force-exit test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/p2p-agent.test.mjs",
     "test:relay": "node --test --test-force-exit test/relay.test.mjs",
     "test:agent": "node --test --test-force-exit test/agent.test.mjs test/memory.test.mjs",
     "test:tools": "node --test --test-force-exit test/tools.test.mjs",
     "test:crossnetwork": "node --test --test-force-exit test/crossnetwork.test.mjs",
-    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/layer-model.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
+    "test:all": "node --test --test-force-exit test/relay.test.mjs test/broadcast.test.mjs test/agent.test.mjs test/authority.test.mjs test/blocks.test.mjs test/approval-index.test.mjs test/fleet-sync.test.mjs test/health.test.mjs test/storage.test.mjs test/exit-channel.test.mjs test/council.test.mjs test/log-bounds.test.mjs test/test-report.test.mjs test/fleet-scale.test.mjs test/fleet-state.test.mjs test/crypto-blake2s.test.mjs test/installed-version.test.mjs test/permission.test.mjs test/machine-test-packet.test.mjs test/field-authority.test.mjs test/layer-model.test.mjs test/memory.test.mjs test/tools.test.mjs  test/claims.test.mjs test/fleet-target.test.mjs test/client-bundle.test.mjs test/schedule.test.mjs test/auto-update.test.mjs test/update-source.test.mjs test/update-install.test.mjs test/update-wiring.test.mjs test/signing.test.mjs test/stress.test.mjs test/e2e.test.mjs test/crossnetwork.test.mjs test/signing-e2e.test.mjs test/outbound-only.test.mjs test/recovery.test.mjs test/pipeline-e2e.test.mjs test/shared-config.test.mjs test/metrics.test.mjs test/metrics-route.test.mjs test/tool-cards.test.mjs test/p2p-stun.test.mjs test/p2p-transport.test.mjs test/p2p-signaling.test.mjs test/p2p-node.test.mjs test/p2p-transport-fields.test.mjs test/p2p-plugin.test.mjs test/p2p-agent.test.mjs test/stun-server.test.mjs test/loader-entry.test.mjs test/mdns-wire.test.mjs test/mdns-discover.test.mjs test/p2p-crypto.test.mjs test/chatops-approval.test.mjs test/chatops-policy.test.mjs test/chatops-file-safety.test.mjs test/chatops-outbound-queue.test.mjs test/chatops-commands.test.mjs test/chatops-bridge.test.mjs test/chatops-config-route.test.mjs test/chatops-apply.test.mjs test/chatops-ilink-contract.test.mjs test/chatops-fleet.test.mjs test/chatops-account.test.mjs test/chatops-auth.test.mjs test/chatops-fleet-scope.test.mjs test/chatops-handoff.test.mjs test/chatops-fleet-wiring.test.mjs test/chatops-fleet-live.test.mjs test/chatops-takeover.test.mjs test/chatops-device-signing.test.mjs test/chatops-relay-verify.test.mjs test/chatops-durability.test.mjs test/chatops-run-command.test.mjs test/secrets-guard.test.mjs test/chatops-ilink-fleet-bridge.test.mjs test/chatops-fleet-join.test.mjs",
     "pack": "node scripts/pack.mjs",
     "verify:join": "node scripts/verify-join.mjs",
     "lint": "eslint .",
@@ -146,7 +146,8 @@
     "test:crypto-blake2s": "node --test --test-force-exit test/crypto-blake2s.test.mjs",
     "test:installed-version": "node --test --test-force-exit test/installed-version.test.mjs",
     "test:permission": "node --test --test-force-exit test/permission.test.mjs",
-    "test:packet": "node --test --test-force-exit test/machine-test-packet.test.mjs"
+    "test:packet": "node --test --test-force-exit test/machine-test-packet.test.mjs",
+    "test:field-authority": "node --test --test-force-exit test/field-authority.test.mjs"
   },
   "keywords": [
     "dsh-bundle",

package/src/agent/field-authority.mjs

@@ -0,0 +1,202 @@
+/**
+ * Field-level acceptance driven by the authority model — MMP P1/P2's missing half.
+ *
+ * ## What was missing, and how it was found
+ *
+ * `ROADMAP.md` describes v4.8.0 as *"a CAT7 seven-field cognitive block, **per-field acceptance driven by §2's
+ * authority model**, and lineage"*, and marks it **shipped in 0.9.9**. Reading the tree to check that claim:
+ * the block, the lineage, the absent-not-null refusal and the missing-parent refusal are all real and all
+ * asserted. But **`blocks.mjs` does not import `authority.mjs` at all**, and `defaultChoose` — the only
+ * chooser that ships — refuses `confidence` by name and accepts everything else.
+ *
+ * So "driven by the authority model" was a description of an intention, and the one field rule that existed
+ * was hard-coded. This module is the connection that was claimed and not built.
+ *
+ * ## The rule that makes it safe
+ *
+ * **A field with no declared rule is REFUSED.** Not accepted, and not escalated. This is the same decision
+ * `authority.mjs` already states for exemptions — *"the tempting default is 'absent means unconstrained', and
+ * it is wrong in the one direction that matters"* — and `permission.mjs` states for capabilities: an omission
+ * must never become a grant. Three modules, one rule, because the failure mode is identical in all three: a
+ * table that grants what it has not heard of grants whatever is added next.
+ *
+ * ## Ordering, which is the part that is easy to get silently wrong
+ *
+ * Three refusals can apply to one field, and they are checked in this order:
+ *
+ *   1. **not a CAT7 field** — refused before any rule is consulted, because a rule cannot make a field exist;
+ *   2. **no declared rule** — refused, because an undeclared field is one nobody decided about;
+ *   3. **the authority verdict** — `allow` accepts, anything else refuses with the model's own reason.
+ *
+ * Step 3 never *grants* on a non-allow verdict. A `needs_approval` on a field is a refusal here rather than a
+ * queue: an accepted block is a stored fact, and storing a field as though a supervisor had approved it when
+ * nobody has is worse than omitting it.
+ */
+import { CAT7_FIELDS } from './blocks.mjs';
+import { AUTHORITY_VERDICT, evaluate } from './authority.mjs';
+
+/** Why a field was not accepted, as codes rather than prose. */
+export const FIELD_REFUSAL = Object.freeze({
+  NOT_A_FIELD: 'FIELD_NOT_A_FIELD',
+  UNDECLARED: 'FIELD_UNDECLARED',
+  BELOW_AUTHORITY: 'FIELD_BELOW_AUTHORITY',
+  MALFORMED_RULE: 'FIELD_MALFORMED_RULE',
+  ALWAYS_REFUSED: 'FIELD_ALWAYS_REFUSED',
+});
+
+/**
+ * What each field costs to accept.
+ *
+ * Only the four **receiver-choosable** fields can be governed this way, because `acceptBlock` copies the
+ * three inherited ones (`origin`, `observed_at`, `lineage`) without consulting a chooser at all — a receiver
+ * that could set them could assert a provenance it does not have. The two choosable fields that do not appear
+ * here are governed on purpose and the code says which reason applies to each.
+ *
+ * The levels follow `AUTHORITY_BANDS`: `ordinary` may say what was observed and what it means; `captain` may
+ * assert what supports it. A field is a claim about how far the assertion reaches, so its cost is its reach.
+ */
+export const FIELD_LEVELS = Object.freeze({
+  subject: 0,
+  body: 0,
+  evidence: 50,
+});
+
+/**
+ * Fields a receiver is refused whatever its authority, and why.
+ *
+ * `confidence` is **not** in {@link FIELD_LEVELS} at any level. A level can be raised, and if this field were
+ * merely expensive then a system administrator would be *permitted by this model* to adopt the sender's own
+ * certainty about the sender's own assertion — the one transfer of belief `blocks.mjs` calls a hard invariant
+ * rather than a default. This table is what makes that invariant reachable from here, so the refusal is
+ * reported with the same words `acceptBlock` uses instead of a second, drifting explanation.
+ */
+export const NEVER_ACCEPTED = Object.freeze({
+  confidence: 'a receiver does not adopt the sender\'s certainty (invariant, not a default)',
+});
+
+/**
+ * The authority rule for one field, or `null` when the field has no declared rule.
+ *
+ * Returned in the shape `authority.evaluate` accepts, so the two models cannot drift into different notions
+ * of what a rule is.
+ *
+ * @param {string} field
+ * @returns {{action: string, minLevel: number, matchingExemptLevel: null}|null}
+ */
+export function ruleForField(field) {
+  if (!Object.prototype.hasOwnProperty.call(FIELD_LEVELS, field)) return null;
+  return { action: `accept_field:${field}`, minLevel: FIELD_LEVELS[field], matchingExemptLevel: null };
+}
+
+/**
+ * Decide whether an actor may accept one field into a stored block.
+ *
+ * @param {string} field
+ * @param {{level: number, inScope?: boolean|null, id?: string|null}} actor
+ * @returns {{accepted: boolean, field: string|null, code: string, verdict: string|null,
+ *   required: number|null, reason: string}}
+ */
+export function acceptField(field, actor) {
+  if (typeof field !== 'string' || !CAT7_FIELDS.includes(field)) {
+    // Before any rule: a rule cannot make a field exist, so consulting one here would let a typo in a rule
+    // table conjure a field that `verifyBlock` would then reject at the other end of the wire.
+    return {
+      accepted: false,
+      field: typeof field === 'string' ? field : null,
+      code: FIELD_REFUSAL.NOT_A_FIELD,
+      verdict: null,
+      required: null,
+      reason: `${JSON.stringify(field)} is not one of the seven CAT7 fields`,
+    };
+  }
+
+  if (Object.prototype.hasOwnProperty.call(NEVER_ACCEPTED, field)) {
+    // Checked before the table, so raising a level cannot reach it. The message says it is an invariant, not a
+    // threshold, because a reader who thinks it is a threshold will try to raise it.
+    return {
+      accepted: false,
+      field,
+      code: FIELD_REFUSAL.ALWAYS_REFUSED,
+      verdict: AUTHORITY_VERDICT.DENY,
+      required: null,
+      reason: NEVER_ACCEPTED[field],
+    };
+  }
+
+  const rule = ruleForField(field);
+  if (rule === null) {
+    // The load-bearing refusal. Accepting an undeclared field would make this table grant whatever is added
+    // next; escalating it would make it requestable. Both turn an omission into a permission.
+    return {
+      accepted: false,
+      field,
+      code: FIELD_REFUSAL.UNDECLARED,
+      verdict: null,
+      required: null,
+      reason: `no authority rule declares what ${field} costs, so nothing may accept it; a field the table has not heard of is refused rather than granted`,
+    };
+  }
+
+  const decision = evaluate(rule, actor);
+  if (decision.verdict === AUTHORITY_VERDICT.ALLOW) {
+    return {
+      accepted: true,
+      field,
+      code: AUTHORITY_VERDICT.ALLOW,
+      verdict: decision.verdict,
+      required: rule.minLevel,
+      reason: decision.reason,
+    };
+  }
+  return {
+    accepted: false,
+    field,
+    code: decision.reason.startsWith('malformed rule:') ? FIELD_REFUSAL.MALFORMED_RULE : FIELD_REFUSAL.BELOW_AUTHORITY,
+    verdict: decision.verdict,
+    required: rule.minLevel,
+    reason: decision.reason,
+  };
+}
+
+/**
+ * A `choose` function for `acceptBlock`, built from the authority model.
+ *
+ * Shaped to drop straight into `acceptBlock(block, { choose })`, which is the only reason it exists as a
+ * separate function rather than being inlined: the block layer must not need to know about authority, and the
+ * authority layer must not need to know about blocks.
+ *
+ * @param {{level: number, inScope?: boolean|null, id?: string|null}} actor
+ * @param {{onDecision?: (result: object) => void}} [options] `onDecision` sees every field's ruling, so a
+ *   caller can record refusals without re-deriving them.
+ * @returns {(field: string, value: unknown, block: object) => {accept: boolean, why: string}}
+ */
+export function authorityChooser(actor, options = {}) {
+  const onDecision = typeof options.onDecision === 'function' ? options.onDecision : null;
+  return (field) => {
+    const result = acceptField(field, actor);
+    if (onDecision !== null) onDecision(result);
+    return { accept: result.accepted, why: result.reason };
+  };
+}
+
+/**
+ * Accept a whole block with the authority chooser, and report both halves.
+ *
+ * @param {object} block
+ * @param {{level: number, inScope?: boolean|null, id?: string|null}} actor
+ * @param {{lineage?: string[]|null, accept?: Function}} [options] `accept` is `acceptBlock`, injected so this
+ *   module does not import it in a cycle.
+ * @returns {{accepted: object|null, refused: Array<object>, decisions: Array<object>}}
+ */
+export function acceptWithAuthority(block, actor, options = {}) {
+  const accept = options.accept;
+  if (typeof accept !== 'function') {
+    return { accepted: null, refused: [{ field: null, why: 'no acceptBlock implementation was supplied' }], decisions: [] };
+  }
+  const decisions = [];
+  const result = accept(block, {
+    choose: authorityChooser(actor, { onDecision: (d) => decisions.push(d) }),
+    ...(Object.prototype.hasOwnProperty.call(options, 'lineage') ? { lineage: options.lineage } : {}),
+  });
+  return { accepted: result.accepted, refused: result.refused, decisions };
+}

package/src/plugin/tools.mjs

@@ -193,7 +193,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '0.28.0';
+const PLUGIN_VERSION = '0.29.0';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;