[cuibonobo]

Summary

Closes #419.

A creator removed from the roster that gave them read could still reshare their Record. editAccess(), setAccess() and setUnlisted() asked only owner-or-creator, never whether the requester can read the Record. That let a removed member grant themselves back in. Fixing it surfaced two related gaps, and the PR closes all three with existing rules rather than exceptions.

1. Resharing needs read. Authority.canReshare() asks owner-or-creator, on both sides of a delegation, plus read. _group Records keep their own rule: roster management.

2. Authority written at create() is gated as a later write of it would be. The gate is asked of the Record the create would make:

• That Record carries its creator, and a _group's stamped first admin (via createAssociations() in access.ts, shared with Stack.create()).
• It carries none of the authority the call writes, neither permissions nor a roster, so no call can satisfy its own gate.
• The gates themselves are the update path's own: passesWriterFence() is one predicate deciding every family's fence (owner-alone for _grant/_install, managers for _group, none otherwise) on both create and update, and canReshare() decides permissions and unlisted.

mayGrantAccess(), the two delegated-only refusals in create(), requireOwnerAloneWriter(), and gateVerb()'s separate group branch are gone.

3. A roster entry never counts on the principal's side. Group-targeted grants already followed this rule; Group management didn't. A delegated app could name itself admin and then manage and reshare that Group, through editAccess() on main too. Under delegation, isGroupManager() now requires the principal to be the owner and the subject to be an admin or the owner. So a delegated app neither creates nor manages a Group, and the owner's own software acting for a subject still can.

Tests pin:

• read lost through a group-targeted grant and through a record-level group grantee;
• the drop-box contributor, refused after the create and within it, while a read-own contributor passes;
• the delegated unlisted refusal at create;
• an app on a roster, with full _group grants, refused management (editAccess, patchContent);
• an app refused group creation, with or without naming itself admin;
• the owner's own software creating and managing a Group for its subject.

Changeset: minor for @haverstack/core.

Spec

• access-control.md § Write implies read: resharing reads the same way, asked at create of the Record being made, which carries none of the authority being written. Authorship alone confers no read.
• access-control.md § Delegation: principal and subject: Group management is the owner on the principal's side; a rostered app manages a Group only when signing as itself; authority written at create() is gated as later.
• access-control.md § Reference-creation gating: permissions and unlisted at create pass the reshare gate.
• access-control.md § Per-verb gates: the reshare row says "asked of both sides of a delegation", and the family fences apply to create() too.
• identity.md § Group: the delegated management rule; the create bullet asks the management rule of the Group being made; removal withdraws what the roster conveyed.

Verification

All pass locally: pnpm run format:check, check:refs, lint, test, build, typecheck. Each new test fails without its fix.

Notes for reviewers

• A delegated app can no longer manage a Group, even one it created and named itself admin of. That's observable on main. A later way for the owner to give an app management directly, through a grant rather than a roster entry, would add to this without undoing it.
• On a _group create that also sets permissions or unlisted, the management check is asked twice: once as the family fence, once inside canReshare(). That's the same order the update path uses (gateReshare()), and the second can't fail once the first passes. Folding them would need a _group branch at create, which is what this PR removes.
• An app signing as itself, undelegated, is an ordinary entity, and its roster entries count. That's unchanged.
• A creator refused after the create gets StackNotFoundError (disclosure.md). At create time the refusal is StackPermissionError.

🤖 Generated with Claude Code

https://claude.ai/code/session_01C1hFUmrN4Jzp8KUz6mdMsY

[changeset-bot]

🦋 Changeset detected

Latest commit: 4366c68

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages

Name	Type
@haverstack/core	Minor
@haverstack/adapter-api	Patch
@haverstack/adapter-conformance	Patch
@haverstack/adapter-local	Patch
@haverstack/blob-adapter-disk	Patch
@haverstack/blob-adapter-s3	Patch
@haverstack/commons	Patch
@haverstack/record-adapter-do-sqlite	Patch
@haverstack/record-adapter-sqlite	Patch
@haverstack/wire-types	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR