access model: ownership + visibility over the node graph (ReBAC / Zanzibar)

[briansrls]

First step of dismantling ctrl: model code visibility/privacy as a real fact instead of a
git-topology nickname, so private parts of the (public) gunbc tree are kept private by a label
rather than by which repo a file sits in.

The reframe (DESIGN §2/§3)

Today the only privacy lever is the repo split — repo == privacy. That fuses facts that must
live apart. The informal version already exists as comments (operator_fleet_network.dag:8
"secrets remain in ctrl"; ci_fleet.dag:4 "operator inventory remains private (ctrl)"). This
separates them:

Concept	What it is	Status
Ownership	who owns a node (root of authority)	this PR
Visibility	who may read/write a node (ReBAC)	this PR
Repo	where code is stored + its own access level	extdeps/github — referenced, not re-coined
Publication	(labeled tree + audience) → which units → which repo/CI	follow-up; the 2-repo split = one handler

Composes with SecretRef (orthogonal axis): SecretRef keeps secret values out of git; this keeps
private code/data out of the public projection.

Anchor & grounding

• Google Zanzibar / ReBAC. A relation tuple ⟨object, relation, subject⟩ is structurally a
  substrate Edge, so the access graph is a subgraph of the node graph. Subjects are usersets:
  Everyone (public), Is (a specific node), MembersOf (members of an org / readers of a node).
• Real .dag nodes. Principals (operator, org, alice, bob) are real nodes referenced by node
  identity (Symbol) — no minted id (§3 anti-nickname).
• Placement. src/v2/std/ because the model references real node ids and dsl/ cannot import
  v2.std.node. Precedent: src/v2/lens/extdeps_shape_transport_policy keys facts on QualifiedName.

What's here

• src/v2/std/access.dag — the framework. Ownership: owner_of / effective_owner
  (unowned ⇒ operator, fail-closed) / is_owner. Visibility: can_read / can_write
  (Owner ⊒ Writer ⊒ Reader), subject_admits (public / direct / one-level org membership),
  is_public, and the leak rule effective_public (a node is publishable only if it's public
  and every dependency it exposes is — so a public node importing a private one can't leak).
• src/v2/std/access_test.dag — 17 executed test fn witnesses.

Verification (DESIGN §5 — green by execution, not just typecheck)

• Compile 0 diagnostics; perturbation produces a located error (the file is really checked).
• 17/17 witnesses green by execution (gunbc run --claim-run): public read, stranger denied,
  owner-implies-read, org-member read, non-member denied, writer can/can't write, writer-implies-read,
  public classification both ways, and the three leak-rule cases.
• Targeted discriminating check: breaking effective_public to ignore dependencies turns the leak
  witness red.

Deferred to the enforcement lens (next PR)

The "exactly one owner" / inheritance-along-containment / DAC ("only the owner may grant")
invariants are modeled as intent but not yet enforced; recursive userset resolution is
one-level; and effective_public currently takes pre-folded dependency flags rather than walking
the real import DAG via fold_node. That lens is the next step.

🤖 Generated with Claude Code

[briansrls]

Superseding this approach. src/v2/std/access.dag here silently re-coined Zanzibar as a std abstraction — the §3 nickname violation. Corrected method (per discussion): model several real access-control systems faithfully in dsl/extdeps/access/ (Zanzibar ✓, AWS IAM, POSIX, NIST RBAC — alongside the existing extdeps/cloud/gcp/iam + extdeps/github), then DERIVE the std abstraction from their commonality and validate it against each. The Step-3 visibility lens is independent and survives. New work continues on access-model-step3 / a follow-up PR.