[samgbafa]

Policy registration accepts a space-owner register grant as an authorization fallback. No database migration. Stacked on #362.

What the new right allows

tinycloud.policy/register on <space>/policy/<digest> lets its holder register a policy root whose template digest equals <digest>. The template digest is SHA-256 over the domain xyz.tinycloud.policy/RegisterTemplate/v1\0 followed by the JCS encoding of the policy with policyId, createdAt, expiresAt and signature removed.

The fallback runs only when ordinary owner authority selection fails. Owners with ordinary authority take the existing path.

Who can grant it

Only the space owner, as delegator, to the policy owner. The grant must be a root delegation with no parents. Core /delegate requires the space owner as issuer for this ability, and refuses any delegation with parents that carries a tinycloud.policy/* ability (policy-register-grant-must-be-parentless; the check runs after main's key-delete refusal and before the parent-based authorization).

Properties

• Exact-digest. A grant names one template. Changing any field outside the excluded set needs a new grant.
• Revocable. A revoked grant does not authorize.
• Bounded to the space owner's own space. The grant is valid only in [nbf, exp). A root that expires after the grant is refused (policy-root-outlives-register-grant) in both modes.
• No migration. Classifier version 3 carries register_grant in memory only. Rollback is the previous image with no database step.

Tests

owner_authority_tests.rs, on SQLite and on PostgreSQL (CI-only): a register grant authorizes the owner for its template; a grant on another template digest does not; a revoked grant does not; a root that outlives the grant is refused in both modes; the authority ends with the grant; re-classification against a remaining grant (background and backfill); a delegation with parents carrying a tinycloud.policy/* ability is refused. child_policy_grant_is_refused_before_parent_check (core, models/delegation.rs) pins the policy code for a child delegation that has no other violation.

The closure check of rule 4 (closure == {D}) is a second line behind the core rule above: no stored delegation with parents can carry the register ability, so no test reaches it without writing rows directly.

Verification

At this head, on SQLite: cargo fmt --all -- --check; cargo clippy --workspace --all-targets and cargo clippy -p tinycloud-core --features duckdb --all-targets, both with RUSTFLAGS=-Dwarnings; node scripts/gen-capabilities.mjs --check (the capability registry files are regenerated); and every test binary of tinycloud-core, tinycloud-node and tinycloud-auth pass, except the three startup_identity cases (the host has a dstack socket, so the node binary refuses to create an identity) and the three account_alias_tests, which time out when other jobs share the host and pass when the tinycloud-node lib tests run alone. PostgreSQL-backed tests run in CI.

Details: TC-1718

[samgbafa]

APPROVE: see TC-1718 (reviewed exact head e8b877a)