104 lines
3.8 KiB
Markdown
104 lines
3.8 KiB
Markdown
# Availability and Boundary Conformance Vectors (v1)
|
|
|
|
This document defines deterministic vectors for org-boundary enforcement and availability classes.
|
|
|
|
## Vector Group AB1: Org Boundary Binding
|
|
|
|
1. `AB1-001` workspace_within_org_root_allows_paid_action
|
|
- Given workspace `W1` bound to `org_root_id=ORG_A`
|
|
- And suite entitlement for `ORG_A` is active
|
|
- When paid action is requested inside `W1`
|
|
- Then action is allowed (subject to other gates)
|
|
|
|
2. `AB1-002` workspace_boundary_mismatch_blocks_paid_action
|
|
- Given workspace `W2` bound to `ORG_B`
|
|
- And requester entitlement bound only to `ORG_A`
|
|
- When paid action is requested in `W2`
|
|
- Then action is blocked with `boundary_mismatch`
|
|
|
|
3. `AB1-003` delegated_actor_no_boundary_transfer
|
|
- Given human from `ORG_A` delegated role in `ORG_B`
|
|
- And no active suite entitlement for `ORG_B`
|
|
- When paid action is requested
|
|
- Then action is blocked with `target_org_suite_required`
|
|
|
|
## Vector Group AB2: Connected Access Class
|
|
|
|
1. `AB2-001` connected_active_with_fresh_heartbeat
|
|
- Given `access_class=connected`
|
|
- And lease heartbeat age inside policy window
|
|
- Then availability state is `ACTIVE`
|
|
|
|
2. `AB2-002` connected_enters_grace_after_missed_heartbeat
|
|
- Given `access_class=connected`
|
|
- And heartbeat missed past active window but inside grace window
|
|
- Then state is `GRACE`
|
|
- And paid execution remains allowed
|
|
|
|
3. `AB2-003` connected_continuity_blocks_growth_actions
|
|
- Given `access_class=connected` in `CONTINUITY`
|
|
- When attempting growth action (new member/workspace/tool install/worker spawn)
|
|
- Then request is blocked with `continuity_growth_blocked`
|
|
|
|
4. `AB2-004` connected_parked_blocks_paid_execution
|
|
- Given `access_class=connected` in `PARKED`
|
|
- When paid action is requested
|
|
- Then action is blocked with `entitlement_parked`
|
|
- And read/search/export remains allowed
|
|
|
|
## Vector Group AB3: Sovereign Access Class
|
|
|
|
1. `AB3-001` sovereign_active_offline_with_valid_capsule
|
|
- Given `access_class=sovereign`
|
|
- And local entitlement capsule is valid
|
|
- And no network connectivity
|
|
- Then state remains `ACTIVE`
|
|
|
|
2. `AB3-002` sovereign_transitions_on_capsule_expiry
|
|
- Given `access_class=sovereign`
|
|
- And capsule renewal evidence ages past active window
|
|
- Then state transitions `ACTIVE -> GRACE -> CONTINUITY -> PARKED` by policy thresholds
|
|
|
|
3. `AB3-003` sovereign_offline_renewal_restores_active
|
|
- Given `access_class=sovereign` in `CONTINUITY` or `PARKED`
|
|
- When signed offline renewal package is applied and verified
|
|
- Then state becomes `ACTIVE`
|
|
|
|
## Vector Group AB4: Offboarding and Token Revocation
|
|
|
|
1. `AB4-001` offboarded_human_cannot_get_new_action_token
|
|
- Given human delegation revoked at time `T`
|
|
- When requesting new paid action token after `T`
|
|
- Then token issuance is denied
|
|
|
|
2. `AB4-002` offboarding_does_not_remove_local_read_access_snapshot
|
|
- Given org access revoked and local data retention policy active
|
|
- When user opens local history view
|
|
- Then read/search/export policy behaves per retention rules without re-enabling paid execution
|
|
|
|
## Vector Group AB5: Admin Plane Ownership Gating
|
|
|
|
1. `AB5-001` only_root_owner_can_open_support_channel
|
|
- Given principal role `workspace_member`
|
|
- When calling support/admin channel endpoint
|
|
- Then response is denied with `contact_your_org_admin`
|
|
|
|
2. `AB5-002` root_owner_receives_admin_health_events
|
|
- Given principal role `org_root_owner`
|
|
- When health/config/update admin events are emitted
|
|
- Then events are visible in owner stream
|
|
- And not visible in member-only streams
|
|
|
|
3. `AB5-003` member_cannot_mutate_admin_configuration
|
|
- Given principal role `workspace_member`
|
|
- When attempting org-level config mutation
|
|
- Then request is denied
|
|
|
|
## Pass Criteria
|
|
|
|
Build is conformant only when all vectors pass.
|
|
|
|
## Fail-Closed Rule
|
|
|
|
Unknown boundary binding, unknown availability state, or unverifiable renewal evidence must block paid execution by default.
|