{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: an ordinary opener cannot claim or write a new space"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > leaves a new space unclaimed by an ordinary opener and returns `AuthorizationError` for their write"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: the space identity initializes a private space"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > accepts the space identity's genesis ACL, then admits the granted owner and refuses everyone else"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: WRITE grant allows transact but not ACL-doc writes"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > accepts a transact under a `WRITE` grant and returns `AuthorizationError` for its ACL-document write"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: READ grant allows queries but not writes"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > accepts a graph query under a `READ` grant and returns `AuthorizationError` for its write"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: '*' READ opens the space to any principal read-only"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > opens the space to any principal read-only under a `\"*\"` `READ` grant"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: service DIDs have implicit OWNER and do not claim spaces"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > gives a service DID implicit `OWNER` without claiming the space for it"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: principal equal to the space DID can claim it privately"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > accepts a private claim from the principal equal to the space DID"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: revoking a grant takes effect for subsequent messages"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > revokes the session of a principal whose grant is removed and refuses its later messages"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: revocation during resumed catch-up fails the open"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > fails a resumed open with `SessionRevokedError` when revocation lands during its catch-up"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: a taken-over session cannot finish an in-flight transaction"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > rejects a taken-over session's in-flight transaction with `SessionError`"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: a concurrent post-revocation write is rejected"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > rejects a write queued behind the revocation of its session"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: a concurrent graph query is evaluated before revocation"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > evaluates a graph query queued ahead of a revocation against the old ACL"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: revocation settles an in-flight query with a typed error"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > settles an in-flight query with `SessionRevokedError` after the revocation"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: a concurrent watch set is evaluated before revocation"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > evaluates a watch set queued ahead of a revocation against the old ACL"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: an in-flight refresh cannot emit after revocation"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > emits nothing from an in-flight refresh once the session is revoked"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: owner removing their own access still gets the commit response"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > returns the commit response to an owner who removes their own access before revoking them"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: legacy data without an ACL is authenticated public read/write"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > grants authenticated `READ` and `WRITE` but never `OWNER` on a legacy space without an ACL"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: the space identity can privatize a legacy home space"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > accepts the space identity's claim on a legacy home space and revokes its public readers"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: ACL mutations must preserve a concrete owner"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > returns `ProtocolError` for an ACL mutation that leaves no concrete owner"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: a genesis ACL without a concrete OWNER is refused and the space stays uninitialized"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > returns `ProtocolError` for a genesis ACL without a concrete `OWNER` and leaves the space uninitialized"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: ACL mutations are default-branch ACL-only commits"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > returns `ProtocolError` for an ACL mutation on a non-default branch or mixed with ordinary writes"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: auxiliary read and operator surfaces honor capabilities"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > gates the auxiliary read and operator surfaces by capability"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: entity identifier reads require READ capability"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > returns `AuthorizationError` for entity identifier reads without `READ`"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: direct writes cannot create or mutate ACL state"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > rejects a direct write that would create or mutate ACL state"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: direct writes reject malformed stored ACL state"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > rejects a direct write when the stored ACL state is malformed"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: malformed and ownerless stored ACLs fail closed"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > fails closed on a malformed or ownerless stored ACL, in `observe` mode as well"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl enforce: a retracted ACL fails closed instead of becoming public"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > fails closed on a retracted ACL instead of making the space public"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl observe: stranger is allowed but the would-deny is counted"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `observe` mode > admits a stranger and counts the would-deny"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl observe: fresh-space genesis remains a hard invariant"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `observe` mode > returns `AuthorizationError` for an ordinary write to a fresh space until its genesis ACL lands"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl off: no seeding, no gating"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `off` mode > seeds no commit and gates nothing"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"acl default: absent acl option behaves like off"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > no `acl` option > opens a new space without seeding a commit, as `off` mode does"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"OW31 acl enforce: a delegating principal acting as space-owner READS an owner-only space; its writes and ACL-doc writes stay refused"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > the delegated READ binding (OW31) > `enforce` mode > admits a delegating principal acting as space-owner to read an owner-only space, and refuses its writes and ACL-document writes"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"OW31 acl enforce: the actingAs marker from a NON-delegating principal is refused loudly"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > the delegated READ binding (OW31) > `enforce` mode > returns `AuthorizationError` naming the delegating class for an `actingAs` marker from a non-delegating principal"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"OW31 acl enforce: a delegating principal cannot initialize a fresh space's genesis (not a service DID)"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > the delegated READ binding (OW31) > `enforce` mode > refuses a fresh space's genesis ACL from a delegating principal that is not a service DID"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"OW31 acl enforce: an ACL change that removes the bound owner revokes the delegating session"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > the delegated READ binding (OW31) > `enforce` mode > revokes the delegating session when an ACL change removes the bound owner"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"OW31 acl enforce: an ownership TRANSFER re-binds — the bound session is revoked even when the stale acting principal retains READ (a self-owned space included)"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > the delegated READ binding (OW31) > `enforce` mode > revokes the bound session on an ownership transfer even when the stale acting principal retains `READ`"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"OW31 acl enforce: an unknown actingAs value is a ProtocolError; a multi-owner ACL binds the lexicographically first concrete owner"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > the delegated READ binding (OW31) > `enforce` mode > returns `ProtocolError` for an unknown `actingAs` value, and binds a multi-owner ACL to its lexicographically first concrete owner"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"OW31 acl enforce: an OWNER-class service envelope stores NO binding — its authority is the operator grant, and an ownership transfer does not revoke it (D2/D3)"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > the delegated READ binding (OW31) > `enforce` mode > stores no binding for an `OWNER`-class service envelope, so an ownership transfer does not revoke it"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"OW31 acl observe: a bound session's envelope write is a counted would-deny (the canary's mechanism)"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > the delegated READ binding (OW31) > `observe` mode > admits a bound session's envelope write and counts it as a would-deny"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"OW31 acl off: the actingAs marker is inert (off preserves historical behavior)"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > the delegated READ binding (OW31) > `off` mode > admits an open carrying the `actingAs` marker, which has no effect"}}
{"date":"2026-09-08","from":{"k":"unit","s":"memory","n":"sameAcl: exact principals and capabilities, key order free, never an array or scalar"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > sameAcl() > returns `true` only for the exact principals and capabilities in any key order, and `false` for an array or scalar"}}
{"date":"2026-09-28","from":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > accepts the space identity's claim on a legacy home space and revokes its public readers"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > `enforce` mode > returns `AuthorizationError` for the space identity's claim on a populated space without an ACL, and revokes its public readers once a service DID claims it"}}
{"date":"2026-09-29","from":{"k":"unit","s":"memory","n":"v2-server-acl > foreignWriteAuthorityFor() > returns a grant via `creation` to any principal, the space's own DID included, for a space with no store"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > foreignWriteAuthorityFor() > refuses every principal, the space's own DID included, a space with no store, and creates none"}}
{"date":"2026-09-29","from":{"k":"unit","s":"memory","n":"v2-server-acl > foreignWriteAuthorityFor() > returns a grant via `acl` to the space's own DID only when its space's ACL grants it `WRITE`"},"to":{"k":"unit","s":"memory","n":"v2-server-acl > foreignWriteAuthorityFor() > returns a grant to the space's own DID only when its space's ACL grants it `WRITE`"}}