life-as-api 0.2.0

package/dist/auth/production-scoped-life-api.js

@@ -0,0 +1,802 @@
+// Production-06d-d-b — ProductionScopedLifeApi facade.
+// Production Auth Closure M3 Runtime — rejectProposal facade added (owner-only).
+// Production Auth Closure M2 Runtime — createProposal facade added (agent + owner-self).
+//
+// PRODUCTION_API_ERASURE_SUBJECT_SCOPE_ENFORCED_001: production facade enforces
+//   owner-self-only erasure — kind check + personId self-match.
+// PRODUCTION_API_ERASURE_OWNER_SELF_REQUIRED_001: requestErasure / getErasureStatus
+//   require owner kind AND ctx.personId === subject; agents denied even if subject-authorized.
+// PRODUCTION_API_ERASURE_AGENT_DENIED_001: thrown when mintedCtx.context.kind !== "owner".
+// PRODUCTION_API_ERASURE_CROSS_SUBJECT_DENIED_001: thrown when owner.personId !== subject.
+// PRODUCTION_API_QUERY_SUBJECT_SCOPE_ENFORCED_001: queryContracts delegates to
+//   SubjectScopedLifeApi which enforces Cases A/B/C.
+// PRODUCTION_API_PROPOSAL_SCOPE_ENFORCED_001: proposal operations delegate to
+//   ProposalScopedLifeApi which runs the full ProposalScopeInspector chain.
+// PRODUCTION_API_PROPOSAL_ACCEPT_SCOPE_ENFORCED_001: acceptProposal enforces proposal
+//   subject-scope (empty candidates, multi-subject, subject mismatch all denied).
+// Post-MVP Proposal Read Facade — scoped getProposal/listProposals (spec 9c4ecf2, accepted):
+// PRODUCTION_API_GET_PROPOSAL_SUBJECT_SCOPE_ENFORCED_001: getProposal enforces subject scope;
+//   cross-subject/unknown-subject proposals return undefined.
+// PRODUCTION_API_GET_PROPOSAL_SAFE_NOT_FOUND_001: missing/cross-subject/unknown/multi all → undefined.
+// PRODUCTION_API_LIST_PROPOSALS_SUBJECT_SCOPE_ENFORCED_001: listProposals auto-scoped to bound personId.
+// PRODUCTION_API_LIST_PROPOSALS_NO_CROSS_SUBJECT_RESULTS_001: result contains only own-subject proposals.
+// PRODUCTION_API_PROPOSAL_READ_AGENT_AUTHORIZED_PERSON_REQUIRED_001: agent without authorizedPersonId
+//   throws before any proposal fetch.
+// PRODUCTION_API_PROPOSAL_READ_UNSUPPORTED_CONTEXT_DENIED_001: non-owner/non-agent denied.
+// PRODUCTION_API_PROPOSAL_READ_UNKNOWN_SUBJECT_DENIED_001: empty candidateClaims → safe-not-found/omit.
+// PRODUCTION_API_PROPOSAL_READ_MULTI_SUBJECT_DENIED_001: multi-subject → same treatment.
+// PRODUCTION_API_PROPOSAL_READ_NO_RAW_BYPASS_001: raw LifeApi.getProposal/listProposals not re-exposed.
+// PRODUCTION_FACTORY_ASSEMBLY_DEFERRED_001: remains active — factory still Promise<never>;
+//   this file defines the facade type/impl; factory wiring is a separate slice.
+//
+// M2 createProposal invariants:
+// PRODUCTION_API_CREATE_PROPOSAL_AGENT_SUBJECT_SCOPE_ENFORCED_001: agent path requires all
+//   candidateClaims.subject === authorizedPersonId.
+// PRODUCTION_API_CREATE_PROPOSAL_AGENT_AUTHORIZED_PERSON_REQUIRED_001: authorizedPersonId must
+//   be present on agent minted context; absent → fail closed.
+// PRODUCTION_API_CREATE_PROPOSAL_CANDIDATE_SUBJECT_REQUIRED_001: candidateClaims must be
+//   non-empty (shared: agent + owner).
+// PRODUCTION_API_CREATE_PROPOSAL_MULTI_SUBJECT_DENIED_001: candidateClaims with multiple
+//   distinct subjects denied (shared: agent + owner).
+// PRODUCTION_API_CREATE_PROPOSAL_CROSS_SUBJECT_DENIED_001: agent: subject ≠ authorizedPersonId.
+// PRODUCTION_API_CREATE_PROPOSAL_OWNER_SELF_SCOPE_ENFORCED_001: owner path requires all
+//   candidateClaims.subject === ownerCtx.personId (Option A).
+// PRODUCTION_API_CREATE_PROPOSAL_OWNER_CROSS_SUBJECT_DENIED_001: owner: subject ≠ personId.
+// PRODUCTION_API_CREATE_PROPOSAL_UNSUPPORTED_CONTEXT_DENIED_001: non-owner/non-agent kinds
+//   denied before input inspection.
+// PRODUCTION_API_CREATE_PROPOSAL_NO_RAW_BYPASS_001: all callers must use
+//   ProductionScopedLifeApi.createProposal; raw LifeApi.createProposal not re-exposed.
+//
+// Platform-03 — Guardianship facade wiring:
+// GUARDIAN_SCOPE_ENFORCED_AT_FACADE_001: _assertGuardianScope gates acceptProposal,
+//   rejectProposal (shares the "proposal:accept" scope with acceptProposal), and
+//   createProposal ("proposal:create") — called at the top, before any other logic.
+// GUARDIAN_READ_IMPLIED_BY_MINT_001: queryContracts, getProposal, listProposals receive NO
+//   extra scope check — read access is implied by a successfully minted guardian context.
+// GUARDIAN_ERASURE_DENIED_001: requestErasure / getErasureStatus are ALWAYS denied for
+//   guardian contexts, regardless of guardianScopes — erasure is owner-personal and
+//   non-delegable. Without this explicit gate, a guardian's owner-context personId === wardId
+//   would otherwise pass assertOwnerSelfForErasure (context.kind === "owner" and
+//   personId === wardId === subject), silently allowing delegated erasure.
+// GUARDIAN_GRANT_CREATED_CODE_DECLARED_HOST_EMITTED_001: there is no grant-creation method
+//   on this facade — GUARDIAN_GRANT_CREATED is declared in AuditReasonCode for host-side
+//   grant stores to emit; no method here produces it.
+// GUARDIAN_QUERY_AUDIT_MARKING_DEFERRED_001: audit events written internally by
+//   EvidenceBackedContextQueryService (deep inside queryContracts) do NOT carry guardian
+//   marking — deferred; src/surface/evidence-backed-context-query.ts is not modified here.
+import { buildAuditEvent } from "../audit/audit-log.js";
+import { asISOTime } from "../types/ids.js";
+import { SubjectScopedLifeApi } from "./subject-scoped-life-api.js";
+import { ProposalScopedLifeApi } from "./proposal-scoped-life-api.js";
+import { safeLog } from "../observability/logger.js";
+import { safeRecord } from "../observability/metrics.js";
+// ─── assertOwnerSelfForErasure ────────────────────────────────────────────────
+// PRODUCTION_API_ERASURE_OWNER_SELF_REQUIRED_001: enforces both conditions:
+//   1. context.kind === "owner"  (PRODUCTION_API_ERASURE_AGENT_DENIED_001 if not)
+//   2. owner.personId === subject (PRODUCTION_API_ERASURE_CROSS_SUBJECT_DENIED_001 if not)
+//
+// Why not assertAuthorizedForSubject: an AgentConsentContext with authorizedPersonId === X
+// passes assertAuthorizedForSubject for subject X — but agents must never trigger or read
+// erasure operations. The kind check blocks agents (and all non-owner contexts) unconditionally.
+export function assertOwnerSelfForErasure(subject, mintedCtx) {
+    if (mintedCtx.context.kind !== "owner") {
+        throw Object.assign(new Error(`PRODUCTION_API_ERASURE_AGENT_DENIED_001: context kind "${mintedCtx.context.kind}" ` +
+            `may not request or read erasure; only the subject's owner context is permitted`), { code: "PRODUCTION_API_ERASURE_AGENT_DENIED_001" });
+    }
+    const ownerCtx = mintedCtx.context;
+    if (ownerCtx.personId !== subject) {
+        throw Object.assign(new Error(`PRODUCTION_API_ERASURE_CROSS_SUBJECT_DENIED_001: owner personId does not match ` +
+            `erasure subject; cross-subject erasure is not permitted`), { code: "PRODUCTION_API_ERASURE_CROSS_SUBJECT_DENIED_001" });
+    }
+}
+// ─── assertOwnerOwnsProposalSubjectForReject ──────────────────────────────────
+// PRODUCTION_API_REJECT_PROPOSAL_OWNER_SUBJECT_SCOPE_ENFORCED_001
+// PRODUCTION_API_REJECT_PROPOSAL_UNKNOWN_SUBJECT_DENIED_001
+export function assertOwnerOwnsProposalSubjectForReject(proposal, mintedCtx) {
+    const { candidateClaims } = proposal;
+    if (candidateClaims.length === 0) {
+        throw Object.assign(new Error("PRODUCTION_API_REJECT_PROPOSAL_SAFE_NOT_FOUND_001: proposal has no candidate claims — " +
+            "subject cannot be determined"), { code: "PRODUCTION_API_REJECT_PROPOSAL_SAFE_NOT_FOUND_001" });
+    }
+    const uniqueSubjects = new Set(candidateClaims.map(c => c.subject));
+    if (uniqueSubjects.size !== 1) {
+        throw Object.assign(new Error("PRODUCTION_API_REJECT_PROPOSAL_SAFE_NOT_FOUND_001: proposal has multiple candidate subjects — " +
+            "subject cannot be determined"), { code: "PRODUCTION_API_REJECT_PROPOSAL_SAFE_NOT_FOUND_001" });
+    }
+    const proposalSubject = [...uniqueSubjects][0];
+    // Use ownerCtx.personId — NOT authorizedPersonId
+    // PRODUCTION_API_REJECT_PROPOSAL_OWNER_SUBJECT_SCOPE_ENFORCED_001
+    const ownerCtx = mintedCtx.context;
+    if (ownerCtx.personId !== proposalSubject) {
+        throw Object.assign(new Error("PRODUCTION_API_REJECT_PROPOSAL_SAFE_NOT_FOUND_001: proposal subject does not match owner"), { code: "PRODUCTION_API_REJECT_PROPOSAL_SAFE_NOT_FOUND_001" });
+    }
+}
+// ─── extractSingleSubject ─────────────────────────────────────────────────────
+// Returns the unique candidate subject as string, or undefined if:
+//   - candidateClaims is empty   (PRODUCTION_API_PROPOSAL_READ_UNKNOWN_SUBJECT_DENIED_001)
+//   - candidateClaims span > 1 distinct subjects (PRODUCTION_API_PROPOSAL_READ_MULTI_SUBJECT_DENIED_001)
+// Never throws — callers decide what to do with undefined.
+// Module-private: not exported.
+function extractSingleSubject(proposal) {
+    const { candidateClaims } = proposal;
+    if (candidateClaims.length === 0)
+        return undefined;
+    const subjects = new Set(candidateClaims.map(c => c.subject));
+    if (subjects.size !== 1)
+        return undefined;
+    return [...subjects][0];
+}
+// ─── resolveProposalReadSubject ───────────────────────────────────────────────
+// Returns the bound person scope for proposal reads, or throws a named error.
+// Owner  → ownerCtx.personId
+// Agent  → authorizedPersonId (absent → throw PRODUCTION_API_PROPOSAL_READ_AGENT_AUTHORIZED_PERSON_REQUIRED_001)
+// Other  → throw PRODUCTION_API_PROPOSAL_READ_UNSUPPORTED_CONTEXT_DENIED_001
+// Module-private: not exported.
+function resolveProposalReadSubject(mintedCtx) {
+    const kind = mintedCtx.context.kind;
+    if (kind === "owner") {
+        const ownerCtx = mintedCtx.context;
+        return ownerCtx.personId;
+    }
+    if (kind === "agent") {
+        const authorizedPersonId = mintedCtx.authorizedPersonId;
+        if (authorizedPersonId === undefined) {
+            throw Object.assign(new Error("PRODUCTION_API_PROPOSAL_READ_AGENT_AUTHORIZED_PERSON_REQUIRED_001: " +
+                "authorizedPersonId missing from minted agent context — broad grants not permitted for proposal reads"), { code: "PRODUCTION_API_PROPOSAL_READ_AGENT_AUTHORIZED_PERSON_REQUIRED_001" });
+        }
+        return authorizedPersonId;
+    }
+    throw Object.assign(new Error(`PRODUCTION_API_PROPOSAL_READ_UNSUPPORTED_CONTEXT_DENIED_001: ` +
+        `context kind "${kind}" is not permitted to read proposals`), { code: "PRODUCTION_API_PROPOSAL_READ_UNSUPPORTED_CONTEXT_DENIED_001" });
+}
+// ─── ProductionScopedLifeApiImpl ──────────────────────────────────────────────
+export class ProductionScopedLifeApiImpl {
+    _api;
+    _minted;
+    _audit;
+    _mutationLog;
+    _uow;
+    _logger;
+    _metricsRecorder;
+    _subjectApi;
+    _proposalApi;
+    // PRODUCTION_AUDIT_ALLOW_MUTATION_ATOMIC_001 (C2a): _mutationLog is the internal allow-path
+    // audit log sharing config.db; _uow wraps allow-path audit write + mutation in one SAVEPOINT.
+    // _audit remains the caller-supplied deny-path / standalone audit log.
+    constructor(_api, _minted, _audit, _mutationLog, _uow, _logger, _metricsRecorder) {
+        this._api = _api;
+        this._minted = _minted;
+        this._audit = _audit;
+        this._mutationLog = _mutationLog;
+        this._uow = _uow;
+        this._logger = _logger;
+        this._metricsRecorder = _metricsRecorder;
+        this._subjectApi = new SubjectScopedLifeApi(_api, _minted);
+        this._proposalApi = new ProposalScopedLifeApi(_api, _minted, _audit, _mutationLog, _uow, _logger);
+    }
+    // Emit proposal.mutation.outcome counter. Swallowed via safeRecord.
+    // PRODUCTION_METRICS_FAILURE_NON_INTERFERING_001
+    _emitProposalOutcome(operation, status, contextKind) {
+        safeRecord(this._metricsRecorder, "proposal.mutation.outcome", 1, {
+            component: "ProductionScopedLifeApiImpl",
+            operation,
+            status,
+            ...(contextKind !== undefined ? { contextKind } : {}),
+        });
+    }
+    // PRODUCTION_AUDIT_FAIL_CLOSED_001: if the audit write fails, throw the fail-closed
+    // error — NOT the original denial. Operation must not proceed without a recorded event.
+    async _writeAuditOrFail(event) {
+        try {
+            await this._audit.write(event);
+        }
+        catch (err) {
+            safeLog(this._logger, {
+                level: "error", code: "LOG_AUDIT_WRITE_FAILED_001",
+                component: "ProductionScopedLifeApiImpl", operation: "_writeAuditOrFail",
+                message: "audit write failed — operation aborted fail-closed",
+                timestamp: new Date().toISOString(),
+                ...(err instanceof Error ? { errorName: err.name } : {}),
+            });
+            safeRecord(this._metricsRecorder, "audit.write.failure", 1, {
+                component: "ProductionScopedLifeApiImpl", operation: "_writeAuditOrFail", status: "failed",
+            });
+            throw Object.assign(new Error("PRODUCTION_AUDIT_FAIL_CLOSED_001: audit write failed — operation aborted fail-closed"), { code: "PRODUCTION_AUDIT_FAIL_CLOSED_001" });
+        }
+    }
+    _actorLabel() {
+        return `${this._minted.principalType}:${this._minted.principalId}`;
+    }
+    _now() {
+        return asISOTime(new Date().toISOString());
+    }
+    // Platform-03 — Guardianship: spread into every buildAuditEvent call in this file.
+    // GUARDIAN_AUDIT_MARKED_001: only set when this context is a guardian context.
+    _guardianFields() {
+        return this._minted.guardianOf !== undefined
+            ? { actingAsGuardian: true, wardId: this._minted.guardianOf }
+            : {};
+    }
+    // GUARDIAN_SCOPE_ENFORCED_AT_FACADE_001: guardian contexts must carry requiredScope in
+    // guardianScopes. Non-guardian contexts (guardianOf undefined) are unaffected — no-op.
+    async _assertGuardianScope(operation, requiredScope) {
+        if (this._minted.guardianOf === undefined)
+            return; // not a guardian context — no extra gate
+        const scopes = this._minted.guardianScopes ?? [];
+        if (scopes.includes(requiredScope))
+            return;
+        const wardId = this._minted.guardianOf;
+        await this._writeAuditOrFail(buildAuditEvent({
+            actor: this._actorLabel(),
+            decision: "deny",
+            reasonCode: "GUARDIAN_ACTION_UNAUTHORIZED",
+            selectorFingerprint: `guardian:${operation}:ward=${wardId}`,
+            resultCount: 0,
+            resultClaimIds: [],
+            actingAsGuardian: true,
+            wardId,
+            now: this._now(),
+        }));
+        throw Object.assign(new Error(`GUARDIAN_ACTION_UNAUTHORIZED_001: operation "${operation}" is not permitted — ` +
+            `the guardianship scope does not include "${requiredScope}"`), { code: "GUARDIAN_ACTION_UNAUTHORIZED_001" });
+    }
+    // GUARDIAN_ERASURE_DENIED_001: erasure is owner-personal and non-delegable — guardian
+    // contexts are always denied, regardless of guardianScopes. Called BEFORE
+    // assertOwnerSelfForErasure in both requestErasure and getErasureStatus.
+    async _denyGuardianErasure(operation) {
+        if (this._minted.guardianOf === undefined)
+            return;
+        const wardId = this._minted.guardianOf;
+        await this._writeAuditOrFail(buildAuditEvent({
+            actor: this._actorLabel(),
+            decision: "deny",
+            reasonCode: "GUARDIAN_ACTION_UNAUTHORIZED",
+            selectorFingerprint: `guardian:${operation}:ward=${wardId}`,
+            resultCount: 0,
+            resultClaimIds: [],
+            actingAsGuardian: true,
+            wardId,
+            now: this._now(),
+        }));
+        throw Object.assign(new Error("GUARDIAN_ERASURE_DENIED_001: erasure is owner-personal and non-delegable — " +
+            "guardian contexts may never request or read erasure status"), { code: "GUARDIAN_ERASURE_DENIED_001" });
+    }
+    // PRODUCTION_API_ERASURE_SUBJECT_SCOPE_ENFORCED_001: assertOwnerSelfForErasure fires
+    // before any delegation. Agent contexts are denied regardless of their authorizedPersonId.
+    // PRODUCTION_AUDIT_ERASURE_DENIAL_RECORDED_001: deny paths recorded via _audit (caller-supplied,
+    //   rollback-independent). Allow path audit is written by the underlying LifeApi.requestErasure
+    //   into _erasureMutationAuditLog (C2b); double-auditing is avoided.
+    // PRODUCTION_AUDIT_REQUEST_ERASURE_AUDIT_ATOMIC_001 (C2b): _uow.run() provides the SAVEPOINT
+    //   scope — the underlying api writes audit + tombstone on config.db inside the same SAVEPOINT.
+    async requestErasure(subject) {
+        // GUARDIAN_ERASURE_DENIED_001: fires before assertOwnerSelfForErasure — guardian
+        // contexts are always denied, regardless of guardianScopes.
+        await this._denyGuardianErasure("requestErasure");
+        try {
+            assertOwnerSelfForErasure(subject, this._minted);
+        }
+        catch (err) {
+            const code = err.code;
+            const reasonCode = code === "PRODUCTION_API_ERASURE_CROSS_SUBJECT_DENIED_001"
+                ? "ERASURE_CROSS_SUBJECT_DENIED"
+                : "ERASURE_AGENT_DENIED";
+            await this._writeAuditOrFail(buildAuditEvent({
+                actor: this._actorLabel(),
+                decision: "deny",
+                reasonCode,
+                selectorFingerprint: `erasure:subject:${subject}`,
+                resultCount: 0,
+                resultClaimIds: [],
+                now: this._now(),
+                ...this._guardianFields(),
+            }));
+            throw err;
+        }
+        const ownerCtx = this._minted.context;
+        try {
+            return await this._uow.run(async () => this._api.requestErasure(ownerCtx, subject));
+        }
+        catch (err) {
+            const code = err.code;
+            const isKnownCode = typeof code === "string" && (code === "PRODUCTION_AUDIT_FAIL_CLOSED_001" ||
+                code === "ERASURE_SUBJECT_ALREADY_ERASED_001" ||
+                code === "ERASURE_REQUEST_DENIED_001");
+            if (!isKnownCode) {
+                safeLog(this._logger, {
+                    level: "warn", code: "LOG_REQUEST_ERASURE_ROLLBACK_001",
+                    component: "ProductionScopedLifeApiImpl", operation: "requestErasure",
+                    message: "requestErasure allow-path rolled back due to internal error",
+                    timestamp: new Date().toISOString(),
+                    ...(err instanceof Error ? { errorName: err.name } : {}),
+                });
+                safeRecord(this._metricsRecorder, "allow_path.rollback", 1, {
+                    component: "ProductionScopedLifeApiImpl", operation: "requestErasure", status: "failed",
+                });
+            }
+            throw err;
+        }
+    }
+    // PRODUCTION_AUDIT_ERASURE_DENIAL_RECORDED_001: deny paths recorded.
+    // PRODUCTION_AUDIT_READ_ALLOW_PATH_RECORDED_001 (C3): allow path fail-closed.
+    async getErasureStatus(subject) {
+        // GUARDIAN_ERASURE_DENIED_001: fires before assertOwnerSelfForErasure — guardian
+        // contexts are always denied, regardless of guardianScopes.
+        await this._denyGuardianErasure("getErasureStatus");
+        try {
+            assertOwnerSelfForErasure(subject, this._minted);
+        }
+        catch (err) {
+            const code = err.code;
+            const reasonCode = code === "PRODUCTION_API_ERASURE_CROSS_SUBJECT_DENIED_001"
+                ? "ERASURE_CROSS_SUBJECT_DENIED"
+                : "ERASURE_AGENT_DENIED";
+            await this._writeAuditOrFail(buildAuditEvent({
+                actor: this._actorLabel(),
+                decision: "deny",
+                reasonCode,
+                selectorFingerprint: `erasure:subject:${subject}`,
+                resultCount: 0,
+                resultClaimIds: [],
+                now: this._now(),
+                ...this._guardianFields(),
+            }));
+            throw err;
+        }
+        const ownerCtx = this._minted.context;
+        const status = await this._api.getErasureStatus(ownerCtx, subject);
+        await this._writeAuditOrFail(buildAuditEvent({
+            actor: this._actorLabel(),
+            decision: "allow",
+            reasonCode: "ERASURE_STATUS_ALLOWED",
+            selectorFingerprint: `erasure:status:subject=${subject}`,
+            resultCount: 0,
+            resultClaimIds: [],
+            now: this._now(),
+            ...this._guardianFields(),
+        }));
+        return status;
+    }
+    // PRODUCTION_API_QUERY_SUBJECT_SCOPE_ENFORCED_001: delegates to SubjectScopedLifeApi
+    // which enforces Cases A (subject match), B (person-scoped deny no-subject), C (pass).
+    // GUARDIAN_READ_IMPLIED_BY_MINT_001: no additional guardian scope check — read access is
+    //   implied by a successfully minted guardian context.
+    // GUARDIAN_QUERY_AUDIT_MARKING_DEFERRED_001: internal audit events written deep inside
+    //   EvidenceBackedContextQueryService do NOT carry actingAsGuardian/wardId — deferred.
+    async queryContracts(input) {
+        return this._subjectApi.queryContracts(input);
+    }
+    // PRODUCTION_API_PROPOSAL_ACCEPT_SCOPE_ENFORCED_001: delegates to ProposalScopedLifeApi
+    // which enforces the full ProposalScopeInspector chain before delegation.
+    // GUARDIAN_SCOPE_ENFORCED_AT_FACADE_001: acceptProposal and rejectProposal share the
+    //   "proposal:accept" scope (both are proposal decisions).
+    async acceptProposal(proposalId, options) {
+        await this._assertGuardianScope("acceptProposal", "proposal:accept");
+        try {
+            const result = await this._proposalApi.acceptProposal(proposalId, options);
+            this._emitProposalOutcome("acceptProposal", "success", this._minted.context.kind);
+            return result;
+        }
+        catch (err) {
+            const code = err.code;
+            const status = code === "PRODUCTION_AUDIT_FAIL_CLOSED_001" ? "failed" : "denied";
+            this._emitProposalOutcome("acceptProposal", status, this._minted.context.kind);
+            throw err;
+        }
+    }
+    // PRODUCTION_API_CREATE_PROPOSAL_NO_RAW_BYPASS_001
+    // PRODUCTION_API_CREATE_PROPOSAL_UNSUPPORTED_CONTEXT_DENIED_001: denied before input inspection.
+    // PRODUCTION_AUDIT_PROPOSAL_MUTATION_RECORDED_001 / PRODUCTION_AUDIT_FACADE_DENIAL_RECORDED_001:
+    //   every deny path and the allow path (before mutation) is recorded.
+    async createProposal(input) {
+        await this._assertGuardianScope("createProposal", "proposal:create");
+        const kind = this._minted.context.kind;
+        if (kind === "owner") {
+            // PRODUCTION_API_CREATE_PROPOSAL_OWNER_SELF_SCOPE_ENFORCED_001 (Option A)
+            const ownerCtx = this._minted.context;
+            if (input.candidateClaims.length === 0) {
+                await this._writeAuditOrFail(buildAuditEvent({
+                    actor: this._actorLabel(),
+                    decision: "deny",
+                    reasonCode: "PROPOSAL_EMPTY_CANDIDATES_DENIED",
+                    selectorFingerprint: "proposal:create:owner:empty-candidates",
+                    resultCount: 0,
+                    resultClaimIds: [],
+                    now: this._now(),
+                    ...this._guardianFields(),
+                }));
+                this._emitProposalOutcome("createProposal", "denied", kind);
+                throw Object.assign(new Error("PRODUCTION_API_CREATE_PROPOSAL_CANDIDATE_SUBJECT_REQUIRED_001: " +
+                    "candidateClaims must not be empty"), { code: "PRODUCTION_API_CREATE_PROPOSAL_CANDIDATE_SUBJECT_REQUIRED_001" });
+            }
+            const ownerSubjects = new Set(input.candidateClaims.map(c => c.subject));
+            if (ownerSubjects.size !== 1) {
+                await this._writeAuditOrFail(buildAuditEvent({
+                    actor: this._actorLabel(),
+                    decision: "deny",
+                    reasonCode: "PROPOSAL_MULTI_SUBJECT_DENIED",
+                    selectorFingerprint: "proposal:create:owner:multi-subject",
+                    resultCount: 0,
+                    resultClaimIds: [],
+                    now: this._now(),
+                    ...this._guardianFields(),
+                }));
+                this._emitProposalOutcome("createProposal", "denied", kind);
+                throw Object.assign(new Error("PRODUCTION_API_CREATE_PROPOSAL_MULTI_SUBJECT_DENIED_001: " +
+                    "candidateClaims must resolve to exactly one subject"), { code: "PRODUCTION_API_CREATE_PROPOSAL_MULTI_SUBJECT_DENIED_001" });
+            }
+            const ownerProposalSubject = [...ownerSubjects][0];
+            if (ownerProposalSubject !== ownerCtx.personId) {
+                await this._writeAuditOrFail(buildAuditEvent({
+                    actor: this._actorLabel(),
+                    decision: "deny",
+                    reasonCode: "PROPOSAL_CROSS_SUBJECT_DENIED",
+                    selectorFingerprint: `proposal:create:owner:cross-subject:subject=${ownerProposalSubject}`,
+                    resultCount: 0,
+                    resultClaimIds: [],
+                    now: this._now(),
+                    ...this._guardianFields(),
+                }));
+                this._emitProposalOutcome("createProposal", "denied", kind);
+                throw Object.assign(new Error("PRODUCTION_API_CREATE_PROPOSAL_OWNER_CROSS_SUBJECT_DENIED_001: " +
+                    "proposal subject does not match owner personId — cross-subject creation is not permitted"), { code: "PRODUCTION_API_CREATE_PROPOSAL_OWNER_CROSS_SUBJECT_DENIED_001" });
+            }
+            // Allow path — PRODUCTION_AUDIT_ALLOW_MUTATION_ATOMIC_001 (C2a): audit + mutation atomic.
+            const ownerAllowEvent = buildAuditEvent({
+                actor: this._actorLabel(),
+                decision: "allow",
+                reasonCode: "PROPOSAL_ALLOWED",
+                selectorFingerprint: `proposal:create:subject=${ownerProposalSubject}:candidateCount=${input.candidateClaims.length}`,
+                resultCount: 0,
+                resultClaimIds: [],
+                now: this._now(),
+                ...this._guardianFields(),
+            });
+            const ownerResult = await this._uow.run(async () => {
+                try {
+                    await this._mutationLog.write(ownerAllowEvent);
+                }
+                catch (err) {
+                    safeLog(this._logger, {
+                        level: "error", code: "LOG_AUDIT_WRITE_FAILED_001",
+                        component: "ProductionScopedLifeApiImpl", operation: "createProposal",
+                        message: "audit write failed — operation aborted fail-closed",
+                        timestamp: new Date().toISOString(),
+                        ...(err instanceof Error ? { errorName: err.name } : {}),
+                    });
+                    safeRecord(this._metricsRecorder, "audit.write.failure", 1, {
+                        component: "ProductionScopedLifeApiImpl", operation: "createProposal", status: "failed",
+                    });
+                    this._emitProposalOutcome("createProposal", "failed", kind);
+                    throw Object.assign(new Error("PRODUCTION_AUDIT_FAIL_CLOSED_001: audit write failed — operation aborted fail-closed"), { code: "PRODUCTION_AUDIT_FAIL_CLOSED_001" });
+                }
+                return this._api.createProposal(this._minted.context, input);
+            });
+            this._emitProposalOutcome("createProposal", "success", kind);
+            return ownerResult;
+        }
+        if (kind === "agent") {
+            // PRODUCTION_API_CREATE_PROPOSAL_AGENT_SUBJECT_SCOPE_ENFORCED_001
+            const authorizedPersonId = this._minted.authorizedPersonId;
+            if (authorizedPersonId === undefined) {
+                await this._writeAuditOrFail(buildAuditEvent({
+                    actor: this._actorLabel(),
+                    decision: "deny",
+                    reasonCode: "PROPOSAL_BROAD_GRANT_DENIED",
+                    selectorFingerprint: "proposal:create:agent:broad-grant",
+                    resultCount: 0,
+                    resultClaimIds: [],
+                    now: this._now(),
+                    ...this._guardianFields(),
+                }));
+                this._emitProposalOutcome("createProposal", "denied", kind);
+                throw Object.assign(new Error("PRODUCTION_API_CREATE_PROPOSAL_AGENT_AUTHORIZED_PERSON_REQUIRED_001: " +
+                    "authorizedPersonId missing from minted agent context — broad grants not permitted"), { code: "PRODUCTION_API_CREATE_PROPOSAL_AGENT_AUTHORIZED_PERSON_REQUIRED_001" });
+            }
+            if (input.candidateClaims.length === 0) {
+                await this._writeAuditOrFail(buildAuditEvent({
+                    actor: this._actorLabel(),
+                    decision: "deny",
+                    reasonCode: "PROPOSAL_EMPTY_CANDIDATES_DENIED",
+                    selectorFingerprint: "proposal:create:agent:empty-candidates",
+                    resultCount: 0,
+                    resultClaimIds: [],
+                    now: this._now(),
+                    ...this._guardianFields(),
+                }));
+                this._emitProposalOutcome("createProposal", "denied", kind);
+                throw Object.assign(new Error("PRODUCTION_API_CREATE_PROPOSAL_CANDIDATE_SUBJECT_REQUIRED_001: " +
+                    "candidateClaims must not be empty"), { code: "PRODUCTION_API_CREATE_PROPOSAL_CANDIDATE_SUBJECT_REQUIRED_001" });
+            }
+            const agentSubjects = new Set(input.candidateClaims.map(c => c.subject));
+            if (agentSubjects.size !== 1) {
+                await this._writeAuditOrFail(buildAuditEvent({
+                    actor: this._actorLabel(),
+                    decision: "deny",
+                    reasonCode: "PROPOSAL_MULTI_SUBJECT_DENIED",
+                    selectorFingerprint: "proposal:create:agent:multi-subject",
+                    resultCount: 0,
+                    resultClaimIds: [],
+                    now: this._now(),
+                    ...this._guardianFields(),
+                }));
+                this._emitProposalOutcome("createProposal", "denied", kind);
+                throw Object.assign(new Error("PRODUCTION_API_CREATE_PROPOSAL_MULTI_SUBJECT_DENIED_001: " +
+                    "candidateClaims must resolve to exactly one subject"), { code: "PRODUCTION_API_CREATE_PROPOSAL_MULTI_SUBJECT_DENIED_001" });
+            }
+            const agentProposalSubject = [...agentSubjects][0];
+            if (agentProposalSubject !== authorizedPersonId) {
+                await this._writeAuditOrFail(buildAuditEvent({
+                    actor: this._actorLabel(),
+                    decision: "deny",
+                    reasonCode: "PROPOSAL_CROSS_SUBJECT_DENIED",
+                    selectorFingerprint: `proposal:create:agent:cross-subject:subject=${agentProposalSubject}`,
+                    resultCount: 0,
+                    resultClaimIds: [],
+                    now: this._now(),
+                    ...this._guardianFields(),
+                }));
+                this._emitProposalOutcome("createProposal", "denied", kind);
+                throw Object.assign(new Error("PRODUCTION_API_CREATE_PROPOSAL_CROSS_SUBJECT_DENIED_001: " +
+                    "proposal subject does not match agent authorizedPersonId"), { code: "PRODUCTION_API_CREATE_PROPOSAL_CROSS_SUBJECT_DENIED_001" });
+            }
+            // Allow path — PRODUCTION_AUDIT_ALLOW_MUTATION_ATOMIC_001 (C2a): audit + mutation atomic.
+            const agentAllowEvent = buildAuditEvent({
+                actor: this._actorLabel(),
+                decision: "allow",
+                reasonCode: "PROPOSAL_ALLOWED",
+                selectorFingerprint: `proposal:create:subject=${agentProposalSubject}:candidateCount=${input.candidateClaims.length}`,
+                resultCount: 0,
+                resultClaimIds: [],
+                now: this._now(),
+                ...this._guardianFields(),
+            });
+            const agentResult = await this._uow.run(async () => {
+                try {
+                    await this._mutationLog.write(agentAllowEvent);
+                }
+                catch (err) {
+                    safeLog(this._logger, {
+                        level: "error", code: "LOG_AUDIT_WRITE_FAILED_001",
+                        component: "ProductionScopedLifeApiImpl", operation: "createProposal",
+                        message: "audit write failed — operation aborted fail-closed",
+                        timestamp: new Date().toISOString(),
+                        ...(err instanceof Error ? { errorName: err.name } : {}),
+                    });
+                    safeRecord(this._metricsRecorder, "audit.write.failure", 1, {
+                        component: "ProductionScopedLifeApiImpl", operation: "createProposal", status: "failed",
+                    });
+                    this._emitProposalOutcome("createProposal", "failed", kind);
+                    throw Object.assign(new Error("PRODUCTION_AUDIT_FAIL_CLOSED_001: audit write failed — operation aborted fail-closed"), { code: "PRODUCTION_AUDIT_FAIL_CLOSED_001" });
+                }
+                return this._api.createProposal(this._minted.context, input);
+            });
+            this._emitProposalOutcome("createProposal", "success", kind);
+            return agentResult;
+        }
+        await this._writeAuditOrFail(buildAuditEvent({
+            actor: this._actorLabel(),
+            decision: "deny",
+            reasonCode: "PROPOSAL_UNSUPPORTED_CONTEXT_DENIED",
+            selectorFingerprint: `proposal:create:context-kind=${kind}`,
+            resultCount: 0,
+            resultClaimIds: [],
+            now: this._now(),
+            ...this._guardianFields(),
+        }));
+        this._emitProposalOutcome("createProposal", "denied", kind);
+        throw Object.assign(new Error(`PRODUCTION_API_CREATE_PROPOSAL_UNSUPPORTED_CONTEXT_DENIED_001: ` +
+            `context kind "${kind}" is not permitted to create proposals`), { code: "PRODUCTION_API_CREATE_PROPOSAL_UNSUPPORTED_CONTEXT_DENIED_001" });
+    }
+    // PRODUCTION_API_GET_PROPOSAL_SUBJECT_SCOPE_ENFORCED_001
+    // PRODUCTION_API_GET_PROPOSAL_SAFE_NOT_FOUND_001
+    // PRODUCTION_API_PROPOSAL_READ_NO_RAW_BYPASS_001
+    // PRODUCTION_AUDIT_READ_ALLOW_PATH_RECORDED_001 (C3): allow path fail-closed; safe-not-found best-effort.
+    async getProposal(proposalId) {
+        // resolveProposalReadSubject throws for agent-without-authorizedPersonId and unsupported kinds.
+        // These named errors propagate — they are NOT collapsed to undefined.
+        // PRODUCTION_AUDIT_PROPOSAL_DENIAL_RECORDED_001: pre-fetch denials recorded.
+        let boundSubject;
+        try {
+            boundSubject = resolveProposalReadSubject(this._minted);
+        }
+        catch (err) {
+            const isAgentDenied = err.code === "PRODUCTION_API_PROPOSAL_READ_AGENT_AUTHORIZED_PERSON_REQUIRED_001";
+            await this._writeAuditOrFail(buildAuditEvent({
+                actor: this._actorLabel(),
+                decision: "deny",
+                reasonCode: isAgentDenied ? "PROPOSAL_READ_AGENT_DENIED" : "PROPOSAL_READ_UNSUPPORTED_CONTEXT_DENIED",
+                selectorFingerprint: isAgentDenied ? "proposal:read:agent-denied" : "proposal:read:unsupported-context",
+                resultCount: 0,
+                resultClaimIds: [],
+                now: this._now(),
+                ...this._guardianFields(),
+            }));
+            throw err;
+        }
+        // PRODUCTION_API_GET_PROPOSAL_SAFE_NOT_FOUND_001: all of the following collapse to undefined:
+        //   - proposal not found
+        //   - proposal has empty candidateClaims (unknown subject)
+        //   - proposal has multiple distinct subjects
+        //   - proposal subject !== bound person scope (cross-subject)
+        const proposal = this._api.getProposal(this._minted.context, proposalId);
+        if (proposal === undefined) {
+            try {
+                await this._writeAuditOrFail(buildAuditEvent({
+                    actor: this._actorLabel(),
+                    decision: "deny",
+                    reasonCode: "PROPOSAL_READ_SAFE_NOT_FOUND",
+                    selectorFingerprint: "proposal:read:safe-not-found",
+                    resultCount: 0,
+                    resultClaimIds: [],
+                    now: this._now(),
+                    ...this._guardianFields(),
+                }));
+            }
+            catch { /* best-effort: swallow, still return undefined */ }
+            return undefined;
+        }
+        const proposalSubject = extractSingleSubject(proposal);
+        if (proposalSubject === undefined || proposalSubject !== boundSubject) {
+            try {
+                await this._writeAuditOrFail(buildAuditEvent({
+                    actor: this._actorLabel(),
+                    decision: "deny",
+                    reasonCode: "PROPOSAL_READ_SAFE_NOT_FOUND",
+                    selectorFingerprint: "proposal:read:safe-not-found",
+                    resultCount: 0,
+                    resultClaimIds: [],
+                    now: this._now(),
+                    ...this._guardianFields(),
+                }));
+            }
+            catch { /* best-effort: swallow, still return undefined */ }
+            return undefined;
+        }
+        await this._writeAuditOrFail(buildAuditEvent({
+            actor: this._actorLabel(),
+            decision: "allow",
+            reasonCode: "PROPOSAL_READ_ALLOWED",
+            selectorFingerprint: `proposal:read:proposalId=${proposalId}`,
+            resultCount: 1,
+            resultClaimIds: [],
+            now: this._now(),
+            ...this._guardianFields(),
+        }));
+        return proposal;
+    }
+    // PRODUCTION_API_LIST_PROPOSALS_SUBJECT_SCOPE_ENFORCED_001
+    // PRODUCTION_API_LIST_PROPOSALS_NO_CROSS_SUBJECT_RESULTS_001
+    // PRODUCTION_API_PROPOSAL_READ_NO_RAW_BYPASS_001
+    // PRODUCTION_AUDIT_READ_ALLOW_PATH_RECORDED_001 (C3): allow path fail-closed.
+    async listProposals(input) {
+        // resolveProposalReadSubject throws for agent-without-authorizedPersonId and unsupported kinds.
+        // PRODUCTION_AUDIT_PROPOSAL_DENIAL_RECORDED_001: pre-fetch denials recorded.
+        let boundSubject;
+        try {
+            boundSubject = resolveProposalReadSubject(this._minted);
+        }
+        catch (err) {
+            const isAgentDenied = err.code === "PRODUCTION_API_PROPOSAL_READ_AGENT_AUTHORIZED_PERSON_REQUIRED_001";
+            await this._writeAuditOrFail(buildAuditEvent({
+                actor: this._actorLabel(),
+                decision: "deny",
+                reasonCode: isAgentDenied ? "PROPOSAL_READ_AGENT_DENIED" : "PROPOSAL_READ_UNSUPPORTED_CONTEXT_DENIED",
+                selectorFingerprint: "proposal:read:list:denied",
+                resultCount: 0,
+                resultClaimIds: [],
+                now: this._now(),
+                ...this._guardianFields(),
+            }));
+            throw err;
+        }
+        // Broad internal fetch — raw result must not escape; immediately filtered below.
+        // Only status filter is forwarded; underGrant and proposedByAgent are not exposed.
+        const rawFilter = input?.status !== undefined ? { status: input.status } : undefined;
+        const raw = this._api.listProposals(this._minted.context, rawFilter);
+        // PRODUCTION_API_LIST_PROPOSALS_NO_CROSS_SUBJECT_RESULTS_001:
+        // Only proposals whose single extracted subject equals the bound person scope are returned.
+        // Unknown-subject (empty candidateClaims) and multi-subject proposals are silently omitted.
+        const filtered = raw.filter(p => {
+            const s = extractSingleSubject(p);
+            return s !== undefined && s === boundSubject;
+        });
+        await this._writeAuditOrFail(buildAuditEvent({
+            actor: this._actorLabel(),
+            decision: "allow",
+            reasonCode: "PROPOSAL_READ_ALLOWED",
+            selectorFingerprint: `proposal:read:list:count=${filtered.length}`,
+            resultCount: filtered.length,
+            resultClaimIds: [],
+            now: this._now(),
+            ...this._guardianFields(),
+        }));
+        return Object.freeze(filtered);
+    }
+    // PRODUCTION_API_REJECT_PROPOSAL_OWNER_ONLY_001
+    // PRODUCTION_API_REJECT_PROPOSAL_NO_RAW_BYPASS_001
+    // GUARDIAN_SCOPE_ENFORCED_AT_FACADE_001: rejectProposal shares the "proposal:accept" scope
+    //   with acceptProposal — both are proposal decisions.
+    async rejectProposal(proposalId, options) {
+        await this._assertGuardianScope("rejectProposal", "proposal:accept");
+        // PRODUCTION_API_REJECT_PROPOSAL_AGENT_DENIED_001: fires before any proposal fetch
+        // PRODUCTION_AUDIT_PROPOSAL_MUTATION_RECORDED_001 / PRODUCTION_AUDIT_PROPOSAL_DENIAL_RECORDED_001
+        if (this._minted.context.kind !== "owner") {
+            await this._writeAuditOrFail(buildAuditEvent({
+                actor: this._actorLabel(),
+                decision: "deny",
+                reasonCode: "PROPOSAL_UNSUPPORTED_CONTEXT_DENIED",
+                selectorFingerprint: `proposal:reject:proposalId=${proposalId}:context-kind=${this._minted.context.kind}`,
+                resultCount: 0,
+                resultClaimIds: [],
+                now: this._now(),
+                ...this._guardianFields(),
+            }));
+            this._emitProposalOutcome("rejectProposal", "denied", this._minted.context.kind);
+            throw Object.assign(new Error(`PRODUCTION_API_REJECT_PROPOSAL_AGENT_DENIED_001: context kind ` +
+                `"${this._minted.context.kind}" may not reject proposals; only owner is permitted`), { code: "PRODUCTION_API_REJECT_PROPOSAL_AGENT_DENIED_001" });
+        }
+        // Phase A: fetch proposal — not found → safe not-found
+        const proposal = this._api.getProposal(this._minted.context, proposalId);
+        if (proposal === undefined) {
+            await this._writeAuditOrFail(buildAuditEvent({
+                actor: this._actorLabel(),
+                decision: "deny",
+                reasonCode: "PROPOSAL_NOT_FOUND",
+                selectorFingerprint: `proposal:reject:proposalId=${proposalId}`,
+                resultCount: 0,
+                resultClaimIds: [],
+                now: this._now(),
+                ...this._guardianFields(),
+            }));
+            this._emitProposalOutcome("rejectProposal", "denied", this._minted.context.kind);
+            throw Object.assign(new Error("PRODUCTION_API_REJECT_PROPOSAL_SAFE_NOT_FOUND_001: proposal not found"), { code: "PRODUCTION_API_REJECT_PROPOSAL_SAFE_NOT_FOUND_001" });
+        }
+        // Phase A: owner-subject ownership check — any failure → safe not-found
+        // PRODUCTION_API_REJECT_PROPOSAL_OWNER_SUBJECT_SCOPE_ENFORCED_001
+        try {
+            assertOwnerOwnsProposalSubjectForReject(proposal, this._minted);
+        }
+        catch (err) {
+            await this._writeAuditOrFail(buildAuditEvent({
+                actor: this._actorLabel(),
+                decision: "deny",
+                reasonCode: "PROPOSAL_CROSS_SUBJECT_DENIED",
+                selectorFingerprint: `proposal:reject:proposalId=${proposalId}`,
+                resultCount: 0,
+                resultClaimIds: [],
+                now: this._now(),
+                ...this._guardianFields(),
+            }));
+            this._emitProposalOutcome("rejectProposal", "denied", this._minted.context.kind);
+            throw err;
+        }
+        // Allow path — PRODUCTION_AUDIT_ALLOW_MUTATION_ATOMIC_001 (C2a): audit + mutation atomic.
+        const rejectAllowEvent = buildAuditEvent({
+            actor: this._actorLabel(),
+            decision: "allow",
+            reasonCode: "PROPOSAL_ALLOWED",
+            selectorFingerprint: `proposal:reject:proposalId=${proposalId}`,
+            resultCount: 0,
+            resultClaimIds: [],
+            now: this._now(),
+            ...this._guardianFields(),
+        });
+        const rejectResult = await this._uow.run(async () => {
+            try {
+                await this._mutationLog.write(rejectAllowEvent);
+            }
+            catch {
+                safeRecord(this._metricsRecorder, "audit.write.failure", 1, {
+                    component: "ProductionScopedLifeApiImpl", operation: "rejectProposal", status: "failed",
+                });
+                this._emitProposalOutcome("rejectProposal", "failed", this._minted.context.kind);
+                throw Object.assign(new Error("PRODUCTION_AUDIT_FAIL_CLOSED_001: audit write failed — operation aborted fail-closed"), { code: "PRODUCTION_AUDIT_FAIL_CLOSED_001" });
+            }
+            // Phase B: ownership confirmed — delegate; status errors may propagate
+            return this._api.rejectProposal(this._minted.context, proposalId, options.reason);
+        });
+        this._emitProposalOutcome("rejectProposal", "success", this._minted.context.kind);
+        return rejectResult;
+    }
+}
+//# sourceMappingURL=production-scoped-life-api.js.map