[AdaWorldAPI]

This PR changes docs and the board only; no code changes.

Spec §8: where a reader-scope seam can live

A new subsection in .claude/plans/d-lanesock-dr-dt64-lane-socket-v1.md §8. It was read in code at lance-graph fb27c46, OGAR main and report-rs 83093de.

• Authentication. ogar_auth::federation::VerifiedLogin is the only sealed proof of a login: it has private fields, and establish is its only producer. AuthenticatedUser has public fields, and its own documentation says it proves nothing.
• Authorization. ogar_rbac::authorize_identity and OgarRbac::authorize_user return decisions: allow or deny, a row scope and a field mask. A decision carries no actor, class, frame or issuer, so it is a value, not a witness.
• DR. dr::Scope is a bare id compared by equality, and every place that constructs it is a test, example or probe. FrameStore / Frame is the precedent for sealing something by issuer identity. GuardWitness is derived from a value, so it cannot carry authority.
• Dependency direction. dt64 and rbac depend only on the contract, and OGAR depends on lance-graph. An issuer that starts from VerifiedLogin therefore lives in OGAR or a downstream crate.
• Shape the code admits. A sealed scope type in dt64 next to Scope, issued by its own store. The issuer holds that store and issues a scope only from a VerifiedLogin, via authorize_identity.
• Downstream observations. Two issues in report-rs 83093de, already reported to its owner and not changed here:
  • scope: None is turned into all customers;
  • RoleScopeAuthority::scope_for accepts a hand-built AuthenticatedUser.

Still closed, as in the rest of §8.

Board

• STATUS_BOARD: D-LANESOCK-3 Shipped (dt64+report: one field basis for the lane socket; test-only scope admission (D-LANESOCK-3) #1970); D-LANESOCK-4 In PR.
• PR_ARC_INVENTORY: entry for dt64+report: one field basis for the lane socket; test-only scope admission (D-LANESOCK-3) #1970.
• LATEST_STATE: main after dt64+report: one field basis for the lane socket; test-only scope admission (D-LANESOCK-3) #1970, plus this branch.
• New entry file; the entries and supersession indexes are regenerated.
• Validators pass locally: append-only, entries, fruits, compact, citation-decay.

---

Generated by Claude Code

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 14baa4b6-6dc8-4dd1-a5a5-8cc2a9cfab90

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-06T14:47:07.248222Z	094b210	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.