borgmcp-shared 0.6.2 → 0.6.3

package/docs/enrollment.md

@@ -18,11 +18,11 @@ incident is bound to tag object `045268aa8873da330819860012ecaddb4bc2883c`, prot
 `90a1cf686a0ce32a7aef836b0b82a930191b9030` peels to protected-main commit
 `fd69b08586481a60c88099dede8e4e066f73f2f2`; attempt-1 workflow run
 `30054936226` failed in tests before build, packaging, authentication, or registry
-mutation and must never be rerun or moved. `borgmcp-shared@0.6.1` is published
-and immutable. This source now identifies the unpublished `0.6.2` Coordinator
-activation-cadence release. The version bump grants no tag or publication
-authority: creating `v0.6.2` and publishing the reviewed artifact remain separate,
-independently gated steps.
+mutation and must never be rerun or moved. `borgmcp-shared@0.6.1` and
+`borgmcp-shared@0.6.2` are published and immutable. This source now identifies
+the reviewed, unpublished `0.6.3` protocol-v4 cube-creation contract release.
+The version bump grants no tag or publication authority: creating `v0.6.3` and
+publishing the reviewed artifact remain separate, independently gated steps.
 There is no compatibility path that returns a bearer from the server.
 
 A client verifies the credential-free `GET /api/protocol` tag preflight before
@@ -128,43 +128,67 @@ enrollment and attach routes never create or widen grants.
 
 ## Cube Creation
 
-`POST /api/cubes` requires an active parent-client credential with the persisted
-`create_cube` server capability. Ordinary clients, revoked clients, and drone
-sessions cannot use it. Its strict payload is:
+Under protocol v4, `POST /api/cubes` requires an active parent-client credential
+with the persisted `create_cube` server capability. Ordinary clients, revoked
+clients, and drone sessions cannot use it. Its strict payload is:
 
 ```json
 {
   "retry_key": "00000000-0000-4000-8000-000000000201",
-  "name": "repository presentation name",
-  "template": "default"
+  "name": "My Repository Cube",
+  "working_repo_name": "repository-display-name",
+  "repository": {
+    "kind": "origin",
+    "value": "https://github.com/owner/repository"
+  },
+  "template": "software-dev"
 }
 ```
 
 The client persists the pending retry tuple before network I/O and reuses it
-after ambiguous transport failure. `name` is bounded presentation data and
-`template` selects allowlisted, server-owned inert data. The request cannot
-supply cube or role IDs, an owner, access, grant target, capability, arbitrary
-template data, paths, URLs, modules, commands, or repository credentials.
-
-The server binds `(authenticated client, retry_key)` to the exact canonical name
-and template. A successful transaction atomically creates one cube, exactly one
-human-seat role, exactly one default worker role, and exactly one creator
-`manage` grant. It returns:
+after ambiguous transport failure. `name` is the bounded user-selected cube
+name. `working_repo_name` is derived repository display metadata and does not
+identify or authorize the repository. `repository` is either an exact canonical
+public origin or a client-generated opaque local UUID. `template` accepts
+`software-dev`, `starter`, or the compatible legacy `default` seed. The request
+cannot supply cube or role IDs, an owner, access, grant target, capability,
+arbitrary template data, local paths, raw origins, modules, commands, or
+repository credentials.
+
+The server binds `(authenticated client, retry_key)` to the exact cube name,
+repository identity, and template. A successful transaction atomically creates
+one cube, the selected template directive, roles and flags, message taxonomy,
+and exactly one creator `manage` grant. The legacy `default` input retains its
+empty directive, platform Coordinator, default Builder, and no taxonomy. The
+authoritative response is:
 
 ```json
 {
+  "result": "created",
   "cube_id": "<canonical UUID>",
+  "name": "My Repository Cube",
+  "working_repo_name": "repository-display-name",
+  "repository": {
+    "kind": "origin",
+    "value": "https://github.com/owner/repository"
+  },
+  "template": "software-dev",
   "human_seat_role_id": "<canonical UUID>",
   "default_worker_role_id": "<canonical UUID>",
   "access": "manage"
 }
 ```
 
-An exact retry returns that stable response without mutation. Reusing the same
-retry key with a different name or template returns non-enumerating HTTP `409`
-`INVALID_INPUT` and creates nothing. A fresh retry key may create another cube,
-subject to implementation quotas. `owner_id` and role labels remain metadata;
-cube access derives only from the explicit cube-scoped grant.
+An exact retry returns `result: "resolved"` with the stored authoritative fields
+and no mutation. A fresh retry key for the same creator-scoped repository
+association also resolves that stored cube, name, repository display, and
+template without mutation. Changed `working_repo_name` input does not overwrite
+stored display metadata. Reusing a bound retry key with a different cube name,
+repository identity, or template returns non-enumerating HTTP `409`
+`INVALID_INPUT` and creates nothing. A fresh retry for a different, unassociated
+repository may create another cube, subject to implementation quotas. `owner_id`
+and role labels remain metadata; cube access derives only from the explicit
+cube-scoped grant.
 
 ## Conformance
 
@@ -178,3 +202,9 @@ every retry vector, observes client/capability/cube/role/grant counts, verifies
 secret-free errors, and proves authorized idempotent cube creation. Hostile
 reference adapters demonstrate that each retry, authority, and idempotency
 violation fails conformance.
+
+`CREATE_CUBE_RETRY_CONFORMANCE` independently pins exact resolution, stored
+display readback, and mismatch rejection for cube name, repository kind/value,
+and template. `CREATE_CUBE_ASSOCIATION_CONFORMANCE` distinguishes no-mutation
+resolution of an existing repository association from creation for a different,
+unassociated repository.

package/docs/releasing.md

@@ -20,16 +20,16 @@ The release lane has one build, test, package, and publication authority:
 4. rejects an existing immutable version or a package not owned solely by the
    configured npm owner before any registry mutation;
 5. publishes that exact local tarball through npm Trusted Publishing with
-   provenance; and
-6. uses bounded registry-propagation retries to compare the published
-   `dist.integrity` with the tarball, then installs the exact registry version
-   with scripts disabled and runs `npm audit signatures`.
+   provenance. Successful completion of `npm publish` is the workflow's terminal
+   release boundary; no post-publication registry readback can fail the immutable
+   release after npm has accepted it.
 
-npm and GitHub verify the registry signature and publish attestation. The
-repository does not reconstruct DSSE or SLSA statements, transfer approval
-tuples between runs, rebuild in a second job, or place checksum, SBOM, and report
-bundles on the critical publication path. SBOM portability remains covered by
-CI and the repository's dedicated deterministic SBOM tests.
+npm and GitHub produce the registry signature and publish attestation as part of
+Trusted Publishing. The repository does not reconstruct or immediately read back
+those records, reconstruct DSSE or SLSA statements, transfer approval tuples
+between runs, rebuild in a second job, or place checksum, SBOM, and report bundles
+on the critical publication path. SBOM portability remains covered by CI and the
+repository's dedicated deterministic SBOM tests.
 
 ## Permanent Configuration
 
@@ -77,8 +77,9 @@ repository, workflow output, artifact, issue, or shell history.
    tag gets one first attempt.
 5. Obtain the separately required environment approval, then approve that exact
    pending job. Approval does not permit a local rebuild or alternate artifact.
-6. Require every job step to pass, including exact registry integrity and
-   `npm audit signatures`, before announcing the version or updating consumers.
+6. Require the protected publish job to complete successfully before announcing
+   the version or updating consumers. Registry propagation and later consumer
+   availability are operational observations, not release-workflow gates.
 
 The workflow publishes only `./release/<tarball>`. It never publishes from the
 repository directory, a package name, a URL, a prior workflow artifact, or a
@@ -96,11 +97,9 @@ and run as immutable evidence. Fix the source and begin a separately reviewed an
 authorized version/tag plan. Never move, reuse, rerun, or force-update the failed
 tag.
 
-If npm accepts the version but a bounded integrity or signature check fails, do
-not rerun or republish. Preserve the run, inspect the live registry integrity and
-`npm audit signatures` result, and require an explicit recovery decision before
-consumer adoption. npm versions are immutable; never overwrite, unpublish, or
-silently substitute a replacement.
+Once npm accepts the version, the immutable release has occurred. Never rerun,
+republish, overwrite, unpublish, or silently substitute a replacement because a
+later registry read is delayed or unavailable.
 
 ## Immutable Historical Evidence
 
@@ -133,10 +132,12 @@ that tag. `borgmcp-shared@0.6.0` was never published. Its annotated tag object
 `90a1cf686a0ce32a7aef836b0b82a930191b9030` peels to protected-main commit
 `fd69b08586481a60c88099dede8e4e066f73f2f2`; attempt-1 workflow run
 `30054936226` failed in tests before build, packaging, authentication, or registry
-mutation. Never rerun or move that tag. `borgmcp-shared@0.6.1` is published and
-immutable. This source identifies the unpublished `0.6.2` Coordinator
-activation-cadence release. Its release requires reviewed source and explicit publication authorization
-through one protected publish run, followed by postpublish registry integrity,
-signature, and attestation verification. Consumers
+mutation. Never rerun or move that tag. `borgmcp-shared@0.6.1` and
+`borgmcp-shared@0.6.2` are published and immutable. This source identifies the
+reviewed, unpublished `0.6.3` protocol-v4 cube-creation contract release. Its
+release requires reviewed source and explicit publication authorization through
+one protected publish run whose terminal boundary is successful `npm publish`.
+The workflow performs no post-publication registry readback. Consumers
 must update the reviewed shared artifact before adopting the matching server and
-client releases; protocol v2 and v3 peers fail closed at credential-free preflight.
+client releases; incompatible protocol v2, v3, and v4 peers fail closed at
+credential-free preflight.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "borgmcp-shared",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "description": "Shared protocol, domain, templates, and conformance contracts for Borg MCP implementations.",
   "type": "module",
   "main": "./dist/index.js",

package/src/conformance/adapter.ts

@@ -22,11 +22,17 @@ import {
   PROTOCOL_VERSION,
   utf8ByteLength,
   type CreateCubeResponse,
+  type CreateCubeRepository,
+  type CubeTemplate,
   type LogCursor,
   type StreamEvent,
   type DroneRuntimeMetadata,
 } from '../protocol/index.js';
-import { ENROLLMENT_RETRY_CONFORMANCE } from './index.js';
+import {
+  CREATE_CUBE_ASSOCIATION_CONFORMANCE,
+  CREATE_CUBE_RETRY_CONFORMANCE,
+  ENROLLMENT_RETRY_CONFORMANCE,
+} from './index.js';
 
 export interface ConformanceHttpResponse {
   status: number;
@@ -102,13 +108,21 @@ export interface ConformanceAuthorityState {
   grants: number;
   server_capabilities: number;
   cube_create_bindings: number;
+  repository_associations: number;
 }
 
 export interface ConformanceCreatedCubeState {
   cube_exists: boolean;
   creator_has_grant: boolean;
+  creator_access: 'manage' | null;
   grant_count: number;
   role_count: number;
+  name: string;
+  working_repo_name: string;
+  repository: CreateCubeRepository;
+  template: CubeTemplate;
+  human_seat_role_id: string;
+  default_worker_role_id: string;
   human_seat_role_matches: boolean;
   default_worker_role_matches: boolean;
 }
@@ -686,7 +700,12 @@ export async function runAdapterConformance(
 
     const cubeRequest = {
       retry_key: '00000000-0000-4000-8000-000000000213',
-      name: 'repository-one',
+      name: 'Repository One',
+      working_repo_name: 'repository-one',
+      repository: {
+        kind: 'origin' as const,
+        value: 'https://github.com/Byte-Ventures/repository-one',
+      },
       template: 'default',
     };
     const droneCredential = await environment.admin.issueDroneSession(ownerPrincipal);
@@ -724,13 +743,25 @@ export async function runAdapterConformance(
     const createdResponse = await environment.operations.createCube(ownerCredential, createProtocolEnvelope('cube-create', cubeRequest));
     expectStatus(createdResponse, 201, 'Owner cube create');
     const created = decodeCreateCubeResponseEnvelope(createdResponse.body).payload;
-    assertStateDelta(beforeCreate, await environment.admin.observeAuthorityState(), { cubes: 1, roles: 2, grants: 1, cube_create_bindings: 1 }, 'Owner cube create');
+    assertStateDelta(
+      beforeCreate,
+      await environment.admin.observeAuthorityState(),
+      { cubes: 1, roles: 2, grants: 1, cube_create_bindings: 1, repository_associations: 1 },
+      'Owner cube create',
+    );
     invariant(
       same(await environment.admin.inspectCreatedCube(ownerPrincipal, created), {
         cube_exists: true,
         creator_has_grant: true,
+        creator_access: 'manage',
         grant_count: 1,
         role_count: 2,
+        name: cubeRequest.name,
+        working_repo_name: cubeRequest.working_repo_name,
+        repository: cubeRequest.repository,
+        template: cubeRequest.template,
+        human_seat_role_id: created.human_seat_role_id,
+        default_worker_role_id: created.default_worker_role_id,
         human_seat_role_matches: true,
         default_worker_role_matches: true,
       }),
@@ -739,19 +770,92 @@ export async function runAdapterConformance(
     const beforeCreateRetry = await environment.admin.observeAuthorityState();
     const retriedCreateResponse = await environment.operations.createCube(ownerCredential, createProtocolEnvelope('cube-retry', cubeRequest));
     expectStatus(retriedCreateResponse, 201, 'Exact cube-create retry');
-    invariant(same(decodeCreateCubeResponseEnvelope(retriedCreateResponse.body).payload, created), 'Exact cube-create retry returned different identities.');
+    const retriedCreate = decodeCreateCubeResponseEnvelope(retriedCreateResponse.body).payload;
+    invariant(retriedCreate.result === 'resolved', 'Exact cube-create retry did not report resolved readback.');
+    invariant(
+      same({ ...retriedCreate, result: 'created' }, created),
+      'Exact cube-create retry returned different authoritative fields.',
+    );
     assertStateDelta(beforeCreateRetry, await environment.admin.observeAuthorityState(), {}, 'Exact cube-create retry');
-    const beforeCreateMismatch = await environment.admin.observeAuthorityState();
-    expectSecretFreeError(
-      await environment.operations.createCube(ownerCredential, createProtocolEnvelope('cube-mismatch', { ...cubeRequest, name: 'repository-two' })),
-      409,
-      ErrorCode.INVALID_INPUT,
-      'Cube-create retry mismatch',
-      [cubeRequest.retry_key],
+    const displayRetryVector = CREATE_CUBE_RETRY_CONFORMANCE.find(
+      (vector) => vector.expected.outcome === 'resolved_response' &&
+        vector.retry.working_repo_name !== vector.initial.working_repo_name,
+    );
+    invariant(displayRetryVector !== undefined, 'Missing repository display readback vector.');
+    const beforeDisplayRetry = await environment.admin.observeAuthorityState();
+    const displayRetryResponse = await environment.operations.createCube(
+      ownerCredential,
+      createProtocolEnvelope('cube-display-retry', {
+        ...displayRetryVector.retry,
+        retry_key: cubeRequest.retry_key,
+      }),
+    );
+    expectStatus(displayRetryResponse, 201, 'Changed repository display retry');
+    invariant(
+      same(decodeCreateCubeResponseEnvelope(displayRetryResponse.body).payload, retriedCreate),
+      'Changed repository display retry did not return stored authoritative display.',
+    );
+    assertStateDelta(
+      beforeDisplayRetry,
+      await environment.admin.observeAuthorityState(),
+      {},
+      'Changed repository display retry',
+    );
+    for (const [index, vector] of CREATE_CUBE_RETRY_CONFORMANCE.entries()) {
+      if (vector.expected.outcome !== 'retry_tuple_mismatch') continue;
+      const mismatch = { ...vector.retry, retry_key: cubeRequest.retry_key };
+      const beforeCreateMismatch = await environment.admin.observeAuthorityState();
+      expectSecretFreeError(
+        await environment.operations.createCube(
+          ownerCredential,
+          createProtocolEnvelope(`cube-mismatch-${index}`, mismatch),
+        ),
+        409,
+        ErrorCode.INVALID_INPUT,
+        `Cube-create ${vector.name}`,
+        [cubeRequest.retry_key],
+      );
+      assertStateDelta(
+        beforeCreateMismatch,
+        await environment.admin.observeAuthorityState(),
+        {},
+        `Cube-create ${vector.name}`,
+      );
+    }
+    const sameAssociationVector = CREATE_CUBE_ASSOCIATION_CONFORMANCE.find(
+      (vector) => vector.expected.outcome === 'resolved',
+    );
+    invariant(sameAssociationVector !== undefined, 'Missing same-repository association vector.');
+    const beforeAssociationResolve = await environment.admin.observeAuthorityState();
+    const associationResolveResponse = await environment.operations.createCube(
+      ownerCredential,
+      createProtocolEnvelope('cube-association-resolve', {
+        ...sameAssociationVector.request,
+        repository: cubeRequest.repository,
+      }),
+    );
+    expectStatus(associationResolveResponse, 201, 'Fresh retry for associated repository');
+    const associationResolved = decodeCreateCubeResponseEnvelope(associationResolveResponse.body).payload;
+    invariant(associationResolved.result === 'resolved', 'Associated repository did not resolve.');
+    invariant(
+      same({ ...associationResolved, result: 'created' }, created),
+      'Associated repository did not return stored authoritative fields.',
+    );
+    assertStateDelta(
+      beforeAssociationResolve,
+      await environment.admin.observeAuthorityState(),
+      sameAssociationVector.expected.authority_state_delta,
+      'Fresh retry for associated repository',
     );
-    assertStateDelta(beforeCreateMismatch, await environment.admin.observeAuthorityState(), {}, 'Cube-create retry mismatch');
     await environment.admin.grantCreateCubeCapability(ordinaryPrincipal);
-    const crossClientRequest = { ...cubeRequest, name: 'ordinary-repository' };
+    const crossClientRequest = {
+      ...cubeRequest,
+      working_repo_name: 'ordinary-repository',
+      repository: {
+        kind: 'local' as const,
+        value: '00000000-0000-4000-8000-000000000216',
+      },
+    };
     const beforeCrossClientCreate = await environment.admin.observeAuthorityState();
     const crossClientResponse = await environment.operations.createCube(
       ordinaryCredential,
@@ -763,7 +867,7 @@ export async function runAdapterConformance(
     assertStateDelta(
       beforeCrossClientCreate,
       await environment.admin.observeAuthorityState(),
-      { cubes: 1, roles: 2, grants: 1, cube_create_bindings: 1 },
+      { cubes: 1, roles: 2, grants: 1, cube_create_bindings: 1, repository_associations: 1 },
       'Cross-client cube create',
     );
     invariant(
@@ -776,24 +880,35 @@ export async function runAdapterConformance(
       createProtocolEnvelope('cube-cross-client-retry', crossClientRequest),
     );
     expectStatus(crossClientRetry, 201, 'Exact cross-client cube-create retry');
+    const crossClientResolved = decodeCreateCubeResponseEnvelope(crossClientRetry.body).payload;
     invariant(
-      same(decodeCreateCubeResponseEnvelope(crossClientRetry.body).payload, crossClientCreated),
-      'Exact cross-client cube-create retry returned different identities.',
+      crossClientResolved.result === 'resolved',
+      'Exact cross-client cube-create retry did not report resolved readback.',
+    );
+    invariant(
+      same(
+        { ...crossClientResolved, result: 'created' },
+        crossClientCreated,
+      ),
+      'Exact cross-client cube-create retry returned different authoritative fields.',
     );
     assertStateDelta(beforeCrossClientRetry, await environment.admin.observeAuthorityState(), {}, 'Exact cross-client cube-create retry');
+    const differentAssociationVector = CREATE_CUBE_ASSOCIATION_CONFORMANCE.find(
+      (vector) => vector.expected.outcome === 'created',
+    );
+    invariant(differentAssociationVector !== undefined, 'Missing different-repository association vector.');
     const beforeSecondCreate = await environment.admin.observeAuthorityState();
-    const secondCreatedResponse = await environment.operations.createCube(ownerCredential, createProtocolEnvelope('cube-create-second', {
-      ...cubeRequest,
-      retry_key: '00000000-0000-4000-8000-000000000214',
-      name: 'repository-two',
-    }));
+    const secondCreatedResponse = await environment.operations.createCube(
+      ownerCredential,
+      createProtocolEnvelope('cube-create-second', differentAssociationVector.request),
+    );
     expectStatus(secondCreatedResponse, 201, 'Second cube create');
     const secondCreated = decodeCreateCubeResponseEnvelope(secondCreatedResponse.body).payload;
     invariant(secondCreated.cube_id !== created.cube_id, 'Fresh cube-create retry key reused an existing cube.');
     assertStateDelta(
       beforeSecondCreate,
       await environment.admin.observeAuthorityState(),
-      { cubes: 1, roles: 2, grants: 1, cube_create_bindings: 1 },
+      differentAssociationVector.expected.authority_state_delta,
       'Second cube create',
     );
     await environment.admin.revokePrincipal(ownerPrincipal);

package/src/conformance/index.ts

@@ -1,5 +1,9 @@
 import type { BroadcastHwm } from '../log-stream-hwm.js';
-import type { AttachResponse, EnrollmentExchangeRequest } from '../protocol/contract.js';
+import type {
+  AttachResponse,
+  CreateCubeRequest,
+  EnrollmentExchangeRequest,
+} from '../protocol/contract.js';
 
 export * from './adapter.js';
 
@@ -167,6 +171,126 @@ export const ENROLLMENT_RETRY_CONFORMANCE: readonly EnrollmentRetryConformanceVe
   },
 ];
 
+export interface CreateCubeRetryConformanceVector {
+  name: string;
+  initial: CreateCubeRequest;
+  retry: CreateCubeRequest;
+  expected:
+    | { outcome: 'resolved_response'; status: 201 }
+    | { outcome: 'retry_tuple_mismatch'; status: 409; error: 'INVALID_INPUT' };
+}
+
+const CREATE_CUBE_RETRY_KEY = '00000000-0000-4000-8000-000000000121';
+const CREATE_CUBE_INITIAL: CreateCubeRequest = {
+  retry_key: CREATE_CUBE_RETRY_KEY,
+  name: 'Repository One',
+  working_repo_name: 'repository-one',
+  repository: { kind: 'origin', value: 'https://github.com/Byte-Ventures/repository-one' },
+  template: 'default',
+};
+
+/** Stateful vectors: name, repository identity, and template bind the retry key. */
+export const CREATE_CUBE_RETRY_CONFORMANCE: readonly CreateCubeRetryConformanceVector[] = [
+  {
+    name: 'exact retry resolves the authoritative response',
+    initial: CREATE_CUBE_INITIAL,
+    retry: CREATE_CUBE_INITIAL,
+    expected: { outcome: 'resolved_response', status: 201 },
+  },
+  {
+    name: 'changed repository display metadata resolves stored authoritative display',
+    initial: CREATE_CUBE_INITIAL,
+    retry: { ...CREATE_CUBE_INITIAL, working_repo_name: 'repository-one-renamed' },
+    expected: { outcome: 'resolved_response', status: 201 },
+  },
+  {
+    name: 'cube-name mismatch is rejected',
+    initial: CREATE_CUBE_INITIAL,
+    retry: { ...CREATE_CUBE_INITIAL, name: 'Repository One Renamed' },
+    expected: { outcome: 'retry_tuple_mismatch', status: 409, error: 'INVALID_INPUT' },
+  },
+  {
+    name: 'template mismatch is rejected',
+    initial: CREATE_CUBE_INITIAL,
+    retry: { ...CREATE_CUBE_INITIAL, template: 'software-dev' },
+    expected: { outcome: 'retry_tuple_mismatch', status: 409, error: 'INVALID_INPUT' },
+  },
+  {
+    name: 'repository kind mismatch is rejected',
+    initial: CREATE_CUBE_INITIAL,
+    retry: {
+      ...CREATE_CUBE_INITIAL,
+      repository: { kind: 'local', value: '00000000-0000-4000-8000-000000000122' },
+    },
+    expected: { outcome: 'retry_tuple_mismatch', status: 409, error: 'INVALID_INPUT' },
+  },
+  {
+    name: 'repository value mismatch is rejected',
+    initial: CREATE_CUBE_INITIAL,
+    retry: {
+      ...CREATE_CUBE_INITIAL,
+      repository: { kind: 'origin', value: 'https://github.com/Byte-Ventures/repository-two' },
+    },
+    expected: { outcome: 'retry_tuple_mismatch', status: 409, error: 'INVALID_INPUT' },
+  },
+];
+
+export interface CreateCubeAssociationConformanceVector {
+  name: string;
+  created: CreateCubeRequest;
+  request: CreateCubeRequest;
+  expected:
+    | { outcome: 'resolved'; authority_state_delta: Record<string, never> }
+    | {
+      outcome: 'created';
+      authority_state_delta: {
+        cubes: 1;
+        roles: 2;
+        grants: 1;
+        cube_create_bindings: 1;
+        repository_associations: 1;
+      };
+    };
+}
+
+/** A creator-scoped repository association resolves independently of operation retry keys. */
+export const CREATE_CUBE_ASSOCIATION_CONFORMANCE:
+readonly CreateCubeAssociationConformanceVector[] = [
+  {
+    name: 'fresh retry for the same repository resolves stored authoritative fields',
+    created: CREATE_CUBE_INITIAL,
+    request: {
+      ...CREATE_CUBE_INITIAL,
+      retry_key: '00000000-0000-4000-8000-000000000123',
+      name: 'Ignored New Cube Name',
+      working_repo_name: 'ignored-new-display',
+      template: 'starter',
+    },
+    expected: { outcome: 'resolved', authority_state_delta: {} },
+  },
+  {
+    name: 'fresh retry for a different repository may create',
+    created: CREATE_CUBE_INITIAL,
+    request: {
+      ...CREATE_CUBE_INITIAL,
+      retry_key: '00000000-0000-4000-8000-000000000124',
+      name: 'Repository Two',
+      working_repo_name: 'repository-two',
+      repository: { kind: 'origin', value: 'https://github.com/Byte-Ventures/repository-two' },
+    },
+    expected: {
+      outcome: 'created',
+      authority_state_delta: {
+        cubes: 1,
+        roles: 2,
+        grants: 1,
+        cube_create_bindings: 1,
+        repository_associations: 1,
+      },
+    },
+  },
+];
+
 export const ENROLLMENT_AUTHORITY_CONFORMANCE = [
   {
     name: 'ordinary enrollment creates no authority or cube state',