[PiquelChips]

Replaces the old origin.toml permissions. policy.toml now says who may do what:

• [[paths]] gives each user, node or group none, read or write under a path.
• [grants] gives the annotate, land and admin capabilities.

Only admin lands on policy, so nobody can grant themselves rights.

Tokens:

• Servers accept static tokens from their configuration.
• They also accept short-lived scoped tokens, signed with the server's node key and verified without storage (origin token issue).
• A scope only narrows its holder's current rights, admin included.
• A token lasts at most 7 days, and never longer than the token that issued it.

Reading:

• A caller who can read no path sees nothing at all.
• Snapshot walks withhold the content of unreadable paths.
• Revisions that only change such paths are hidden, along with their statements and events.
• Descriptions and payloads become attachments, an object kind of their own, so no record can carry a file's content.

Writing:

• Records must be the caller's, and statements must be about records the caller can see, of a kind they may annotate. That includes promotions, and reserved kinds come only from their authors.
• Revisions may only change paths the caller can write, and may only hold content they sent or that already sits at the same path in a snapshot they refer to.
• Landings may only change what the submitter can write.

Taking over a change: on paths a writer can't write, a new revision must have exactly the effect of each of its predecessors. That means the same files, changed from the same contents to the same ones, on the same change below, with the same conflicts unresolved.

• Anyone can take a change over and pass it on.
• But no choice of base, chain of revisions or detour through another change lets them empty, revert or resolve what they can't write.
• A change's history is fixed: no new first revision, and no predecessor from another change. Only its creator, or an admin, can abandon it.

Clones:

• They record each user's rights, keyed by user and token scope, and keep withheld files out of the working copy.
• They check pushes locally, the same way the server would.

New commands and endpoints:

• whoami, permissions and token issue.
• GET /tree and GET /file, which browse any snapshot without its history.

Benchmarks: permission checks cost nothing measurable. A landing takes about 16 ms with or without rules, and a 20k-file snapshot walk about 38 ms.

Review fixes: a pushed core.conflict must come with its list, or be refused. Proved with focused tests that fail without their fix, and just (332 tests).

Reviewed with review-loop: 2 rounds with 2× GPT-6.1 Sol and Claude Opus 5.5. Verdict: approved

Note

Written by Claude Opus 5.5 in Claude Code, reviewed by GPT-6.1 Sol and Claude Opus 5.5 over three review rounds (via T3 Code).

🤖 Generated with Claude Code