Scope codec and intent frame; D0's intent and purpose use them (d0_store_operation_wall PR 2/5)

[gunbai-bot]

PR 2 of the d0_store_operation_wall sequence (#12458 is PR 1). It is independent of #12458 and branches off main.

Why. The fabric store door must learn which scope the operator approved for the operation it is admitting. The approval broker records no scope: it brokers one authority, and its request stores purpose and revision only. Adding a field to the stored request would break the operator's phone app, whose apps/approve-ios Wire.swift decodes that JSON against a strict field allowlist.

The approved revision is already the SHA-256 of the operation's intent text. So proud-deer-538 ruled option A: the intent text states its scope, through ONE typed codec that the filer writes and the store reads. The store never parses free text.

What lands.

• std.effect_grant verb_of_label / namespace_tree_of_label: the exact inverses of the existing labels.
• std.scoped_authorization:
  • authorization_scope_wire / parse_authorization_scope_wire: verb, tree, path and action as four fields. A scope with no unambiguous wire is refused at encode, and decode admits only what encode writes (checked by round trip).
  • authorization_scope_eq: exact scope identity.
  • The intent frame, intent_frame_head / parse_intent_scopes: a schema line, then one scope= line per scope. A verifier reads the scopes by position with no domain knowledge. An intent with no decodable scope has no frame, so it is refused rather than read as requiring nothing.
• gunbc.spark.pair_serving_d0:
  • D0's intent (schema v1 → v2) is written through the frame, and parse_d0_intent_text refuses any text whose frame does not state exactly D0's scope.
  • The filed purpose is now rendered from the same typed scope and subject (d0_purpose). The operator's notification shows the purpose, not the intent text. Before this change D0's purpose was a constant sentence, so the operator approved without seeing the scope or the hosts. The operator now reads a rendering of what the store will check.
  • The schema bump is safe because no D0 filing exists: the wall has kept D0 from running.

Consumers. The D0 filing and parse execute the codec in this PR. The fabric store door (PR 3) consumes parse_intent_scopes over the frozen filing whose SHA-256 is the approved revision.

Evidence. The new witnesses are in test.claim.scoped_authorization_scope_wire (round trip across all four trees, no-wire refusals, undecodable bytes, frame read-back, frame RED) and in pair_serving_d0_witness (the_intent_text_states_its_scope_in_the_shared_frame). They have not executed before CI: remote claim_batch was OOM-killed on BuildBuddy after corpus warm, even for this std-only file. The floor lane is their first run.

🤖 Generated with Claude Code

[gunbai-bot]

Addressing review 72009 in fcc900a. Both findings are fixed.

1. The rationale comment is back directly above authorization_scopes_render.
2. d0_intent_text returns String?, and the refusal now happens at the filer. d0_intent_hash, the parser's round-trip check, and the D0 door (D0RunRefused before any filing is frozen) all carry it. Tests match on it too, so a refused intent fails them rather than passing because two empty strings compare equal.

— sent from lively-dove-256