@twinsearth/w2m-dsh-plugin 0.33.0 → 0.34.0

package/CHANGELOG.md

@@ -4,6 +4,54 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.34.0] — 2026-10-15
+
+**`requireAuthorityLevel`: the policy that makes 分权限 real, and why it is a flag rather than a default.**
+
+`docs/1.0.0-ACCEPTANCE.md` §3.11 recorded the gap plainly — the gate is **off unless configured**, so a
+default install dispatches exactly as it did before the permission model existed, and **"off unless
+configured" cannot be part of a 1.0.0 that claims 分权限.**
+
+`requireAuthorityLevel: true` (or `W2M_REQUIRE_AUTHORITY_LEVEL`) closes it for a machine that asks. Measured,
+the whole truth table:
+
+| `requireAuthorityLevel` | level | result |
+|---|---|---|
+| off | unset | **starts**, gate unenforced |
+| off | chosen | starts, gate enforced |
+| **on** | **unset** | **refuses to start** — `AUTHORITY_CHOICE_NOT_CHOSEN` |
+| **on** | **unusable** | **refuses to start** — `AUTHORITY_CHOICE_UNKNOWN` |
+| on | chosen | starts, gate enforced |
+
+A refusal names the four choices, so it is fixable from the message alone, and a machine that opted in says
+so in `w2m_status` — a reader can tell "asked and answered" from "never asked".
+
+### Why opt-in, which is a deliberate limit rather than a hedge
+
+Refusing unconditionally would be the honest reading of *"a permission system that is off is untested in
+production"* — and it would also **stop every machine running an earlier version the moment it upgraded**,
+because none of them has a level. That trade is one silent failure for a loud outage, and **an outage is not
+a security property.**
+
+**So the gap is narrowed, not closed, and the document says so** rather than letting the flag's existence
+imply otherwise. A fleet that never sets it is exactly as unenforced as before.
+
+### `W2M_REQUIRE_AUTHORITY_LEVEL=0` means off
+
+Asserted, because a truthiness test would read the string `"0"` as set-and-therefore-on and **refuse to start
+a machine whose operator explicitly wrote zero.**
+
+### My own errors, both of them syntax rather than logic
+
+* I wrote `await` inside a **non-async arrow** passed to `assert.rejects`, which does not parse. `node --check`
+  caught it immediately; the fix is to compute the state directory first, because making the arrow async would
+  change what it does.
+* I asserted refusal codes against the **message text**; the codes live on `error.reason_code`, which is the
+  field a consumer branches on. **The code was correct and the assertion was looking in the wrong place** —
+  now it pins the field.
+
+**6 new tests, 0 failures.**
+
 ## [0.33.0] — 2026-10-15
 
 **The authority level is chosen by name. Nobody types a number.**

package/docs/1.0.0-ACCEPTANCE.md

@@ -57,24 +57,35 @@ limiter down to `util`, **not** to add the edge.
 | 3.8 | An escalated dispatch reaches a queue an approver can answer | `w2m_approvals`, asserted end to end | **yes** |
 | 3.9 | The queue's front door meters **raising only** | `approval-gate.mjs`, wired in 0.31.0 | **yes** |
 | 3.10 | Field-level memory acceptance is driven by the same model | `field-authority.mjs` | **mechanism yes, caller NO — see §4** |
-| 3.11 | **The gate is ON by default** | *nothing — it is off* | **NO — see below** |
+| 3.11 | **The gate is ON by default** | `requireAuthorityLevel`, asserted | **NARROWED — see below** |
+| 3.12 | A level is chosen by name, never typed | `authority-choice.mjs`, asserted | **yes** |
+| 3.13 | A misconfigured level is reported, not silently ignored | `w2m_status.actor_authority` | **yes** |
 
-### `3.11` is the load-bearing gap, and it is a decision rather than an oversight
+### `3.11` — narrowed rather than closed, and the distinction is stated
 
 `actorAuthorityLevel` is **unset by default**, and an unset level means the gate reports `enforced: false` and
-changes nothing. So today, **a default install dispatches exactly as it did before the permission model
-existed.** The reasoning is in `permission.mjs` and it is sound as far as it goes: treating an unset level as
-`0` would refuse every writing dispatch on every machine that never opted in, breaking a working fleet to
-enforce a policy nobody asked for.
-
-**But "off unless configured" cannot be part of a 1.0.0 that claims 分权限**, because a permission system that
-is off is a permission system that is untested in production. The question this file puts to a reader is
-therefore concrete:
-
-> **Should 1.0.0 require `actorAuthorityLevel` to be set, refusing to start without one — or should it ship
-> with the gate off and say so in the README?**
-
-Both are defensible. Silence is not, and neither is claiming 分权限 while it is off.
+changes nothing. So a default install dispatches exactly as it did before the permission model existed.
+
+**0.34.0 adds `requireAuthorityLevel`** (or `W2M_REQUIRE_AUTHORITY_LEVEL`), which closes it for a machine that
+asks for it to be closed. Measured, the whole table:
+
+| `requireAuthorityLevel` | level | result |
+|---|---|---|
+| off | unset | **starts**, gate unenforced |
+| off | chosen | starts, gate enforced |
+| **on** | **unset** | **refuses to start** — `AUTHORITY_CHOICE_NOT_CHOSEN` |
+| **on** | **unusable** | **refuses to start** — `AUTHORITY_CHOICE_UNKNOWN` |
+| on | chosen | starts, gate enforced |
+
+**Why it is opt-in, which is a deliberate limit rather than a hedge.** Refusing unconditionally would be the
+honest reading of *"a permission system that is off is untested in production"* — and it would also **stop
+every machine running an earlier version the moment it upgraded**, because none of them has a level. That
+trades one silent failure for a loud outage, and **an outage is not a security property.**
+
+**So the gap is narrowed, not closed.** A fleet that does not set this flag is exactly as unenforced as
+before, and this document says so rather than letting the flag's existence imply otherwise. **The remaining
+question for 1.0.0 is whether shipping a flag is enough, or whether the default must flip** — and that is a
+decision about who this release is for, not a defect to fix.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "description": "DSH: Windows2MacOS — drive the same project on online Windows and macOS machines from one DeepSeek account, across networks and regions. P2P hole punching is the default path (relay + shared server as rendezvous, ledger and fallback), with a bundled STUN responder, Tailscale/public-VPS/tunnel shapes, Rabbit relay + per-machine Localside + eight DSH tools (replicate / split), nine aggregate verdicts and signed requests.",
   "type": "module",
   "main": "lib/index.js",

package/src/plugin/tools.mjs

@@ -198,7 +198,7 @@ const MAX_STAGES = 16;
  * `package.json` during `scripts/pack.mjs` rather than hand-maintained, and `W2M_PLUGIN_VERSION`
  * overrides it at runtime for tests and packagers.
  */
-const PLUGIN_VERSION = '0.33.0';
+const PLUGIN_VERSION = '0.34.0';
 
 /** How long any single HTTP call may take before it is aborted, in milliseconds. */
 const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
@@ -720,6 +720,40 @@ function readConfig(config = {}) {
         ? process.env.W2M_ACTOR_AUTHORITY.trim()
         : undefined;
       const resolved = resolveConfiguredLevel(fromEnv !== undefined ? fromEnv : config.actorAuthorityLevel);
+
+      /**
+       * v0.34.0: the policy that makes 分权限 real, and why it is a policy rather than a default.
+       *
+       * `docs/1.0.0-ACCEPTANCE.md` §3.11 records the gap plainly: the gate is **off unless configured**, so a
+       * default install dispatches exactly as it did before the permission model existed, and **"off unless
+       * configured" cannot be part of a 1.0.0 that claims 分权限.**
+       *
+       * `requireAuthorityLevel: true` closes it: with the policy on, a machine that has not chosen a level
+       * **refuses to start** rather than dispatching unenforced. `W2M_REQUIRE_AUTHORITY_LEVEL` supplies the
+       * same policy from the environment, so a fleet can require it without editing every profile.
+       *
+       * ## Why it is opt-in, which is a deliberate limit
+       *
+       * Refusing unconditionally would be the honest reading of "a permission system that is off is
+       * untested" — and it would also **stop every machine running an earlier version the moment it
+       * upgraded**, since none of them has a level. That trades one silent failure for a loud outage, and an
+       * outage is not a security property.
+       *
+       * So the policy is per-machine and explicit. **The gap is narrowed, not closed**: a fleet that does not
+       * turn this on is exactly as unenforced as before, and this comment says so rather than letting the
+       * existence of the flag imply otherwise.
+       */
+      const required = config.requireAuthorityLevel === true
+        || (typeof process.env.W2M_REQUIRE_AUTHORITY_LEVEL === 'string' && process.env.W2M_REQUIRE_AUTHORITY_LEVEL.trim() !== '' && process.env.W2M_REQUIRE_AUTHORITY_LEVEL.trim() !== '0');
+      if (required && !resolved.ok) {
+        throw configError(
+          'actorAuthorityLevel',
+          `is required on this machine (requireAuthorityLevel is set) and ${resolved.ok ? '' : resolved.detail}`,
+          `choose one of ${AUTHORITY_CHOICES.map((c) => c.value).join(', ')} as \`actorAuthorityLevel\`, or as \`W2M_ACTOR_AUTHORITY\`; to dispatch without a level, unset requireAuthorityLevel`,
+          resolved.code ?? 'W2M_AUTHORITY_LEVEL_REQUIRED',
+        );
+      }
+
       return {
         actorAuthorityLevel: resolved.ok ? resolved.level : null,
         actorAuthorityChoice: {
@@ -728,6 +762,7 @@ function readConfig(config = {}) {
           source: resolved.source,
           reason_code: resolved.code,
           detail: resolved.detail,
+          required,
         },
       };
     })(),