@xemahq/contracts 0.60.0 → 0.61.0

package/dist/.source-stamp.json

@@ -1,5 +1,5 @@
 {
   "algorithm": "sha256/len-framed-v1",
-  "hash": "b56c26a60c38e5104d2a6ac074005d040784b47a21b30760853680b264ee753d",
+  "hash": "86876ed052a59bcb643685a3c0afc5a762b2abe9bc2f1fa786d28958a9f4f791",
   "fileCount": 589
 }

package/dist/authorization-module/platform/xema_core.fga

@@ -91,12 +91,16 @@ type project
 # descendants inside the delegation's scope. An org-owned session writes
 # `owner` (organization) and `anchor`, and no `parent` and no `participant`.
 #
-# `can_act` is ACTING INSIDE the session (posting a turn, interrupting it,
-# changing its threads), which is narrower than `xema_write` (managing it):
-# a turn runs with the session's authority, so only its owner and the editors
-# the owner invited may act. It derives NOTHING from `parent`: a project
-# editor or an org admin holds `xema_write` on a colleague's session and still
-# may not act in it. An `editor` is also a reader.
+# `can_act` is the human turn/interrupt permission (editor/owner). Human
+# session relations never confer workload execution authority; that requires
+# the session's verified launch delegation. It derives NOTHING from `parent`.
+#
+# Managing the session (`xema_write` / `xema_admin`) is the OWNER ONLY and
+# derives NOTHING from `parent`: a parent reader, a parent writer or an org
+# admin only READS the session (`xema_read from parent`); they neither act in
+# it nor manage it. A future admin "close a member's session" door needs an
+# explicit governance capability; inherited manage does not exist.
+# An `editor` is also a reader.
 type xema_session
   relations
     define parent: [org, project, ${XEMA_PARENT_TYPES}]
@@ -104,8 +108,8 @@ type xema_session
     define owner: [user, agent, organization]
     define participant: [user, agent]
     define editor: [user, agent]
-    define xema_admin: owner or xema_admin from parent
-    define xema_write: owner or xema_write from parent
+    define xema_admin: owner
+    define xema_write: owner
     define xema_read: owner or participant or editor or xema_read from parent
     define can_read: xema_read
     define can_write: xema_write

package/dist/authorization-module/platform/xema_core.fga.yaml

@@ -158,7 +158,7 @@ tests:
           can_read: false
   # A user-owned session in project p1: olga owns it, ed is an invited editor,
   # erin an invited (read-only) participant.
-  - name: only a session's owner and its invited editors may act in it; parent write never confers acting
+  - name: only a session's owner and its invited editors may act in it; parent read is read-only, parent write and org admin never act or manage
     tuples:
       - user: project:org1|p1
         relation: parent
@@ -178,12 +178,17 @@ tests:
         assertions:
           can_act: true
           can_read: true
+          can_write: true
+          xema_write: true
+          xema_admin: true
       - user: user:ed
         object: xema_session:org1|s5
         assertions:
           can_act: true
           can_read: true
           can_write: false
+          xema_write: false
+          xema_admin: false
       - user: user:erin
         object: xema_session:org1|s5
         assertions:
@@ -195,18 +200,27 @@ tests:
         assertions:
           can_act: false
           can_read: true
-      # project editor: manages through the parent, may not act
+          can_write: false
+          xema_write: false
+          xema_admin: false
+      # project editor: reads through the parent, neither acts nor manages
       - user: user:pat
         object: xema_session:org1|s5
         assertions:
+          can_read: true
           can_act: false
-          can_write: true
-      # org admin: manages through the parent, may not act
+          can_write: false
+          xema_write: false
+          xema_admin: false
+      # org admin: reads through the parent, neither acts nor manages
       - user: user:root
         object: xema_session:org1|s5
         assertions:
+          can_read: true
           can_act: false
-          can_write: true
+          can_write: false
+          xema_write: false
+          xema_admin: false
       - user: user:dave
         object: xema_session:org1|s5
         assertions:
@@ -215,6 +229,45 @@ tests:
         object: xema_session:org1|s2
         assertions:
           can_act: false
+  # A session with `reference` and no parent tuple: the parent chain grants
+  # nothing, so a project reader, a project editor and the org admin get
+  # nothing at all.
+  - name: a session without a parent tuple grants parent readers, parent writers and org admins nothing
+    tuples:
+      - user: user:olga
+        relation: owner
+        object: xema_session:org1|s6
+    check:
+      - user: user:bob
+        object: xema_session:org1|s6
+        assertions:
+          can_read: false
+          can_act: false
+          can_write: false
+          xema_write: false
+          xema_admin: false
+      - user: user:pat
+        object: xema_session:org1|s6
+        assertions:
+          can_read: false
+          can_act: false
+          can_write: false
+          xema_write: false
+          xema_admin: false
+      - user: user:root
+        object: xema_session:org1|s6
+        assertions:
+          can_read: false
+          can_act: false
+          can_write: false
+          xema_write: false
+          xema_admin: false
+      - user: user:olga
+        object: xema_session:org1|s6
+        assertions:
+          can_read: true
+          can_act: true
+          can_write: true
   # ── Durable delegation: may_delegate_for defaults ──────────────────────
   # `user#is_self` is NEVER stored: the PDP supplies it per decision as a
   # CONTEXTUAL tuple for the asking principal (`buildSelfContextualTuples`).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/contracts",
-  "version": "0.60.0",
+  "version": "0.61.0",
   "description": "Consolidated Xema OS kernel wire contracts — pure types + zod schemas for the kernel protocol surfaces. One package, one npm scope, wildcard per-surface subpath exports. No framework deps; the one runtime dependency beside zod is the OpenFGA syntax transformer the authorization-module composer runs.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",