I1206 — What an anonymous reader may do is derived from the effect classification, not from a list

BLOCKED wave 5 · p1 · implementation profile · runs alone

Part of web-sign-in — The deployed surfaces know who is asking, and the identity providers are data.

Objective

Derive the exposure decision from the capability registry: a read-only capability stays open to an anonymous reader, anything that mutates requires an identified one, and the decision is stated once in policy over effect classes rather than per route. Project the decision into the OpenAPI security scheme, the Cockpit's disabled controls with their reason, and the generated documentation.

Why

A route list is a second inventory of what this repository can do, and it is the inventory that will be out of date. The registry already knows what each capability is; the policy only has to say what each class of capability requires.

Current state

Every route is served to everyone; the fly-deployment milestone therefore forbids exposing any mutating operation to the browser.

Desired state

Adding a capability inherits its exposure from its effect class, and a capability that mutates cannot be reached anonymously without a policy change that is visible as one.

Scope

• .ai/repo/policy.yaml
• apps/majordomus-cli/src/capability
• apps/majordomus-cli/src/http
• apps/majordomus-cli/src/cockpit
• docs
• apps/majordomus-cli/tests

Out of scope

• A per-route authorisation table in any format
• Granting a signed-in reader anything the effect policy has not classified

Dependencies

• I1205BLOCKED Identity is resolved once, in the router, and every surface reads it from there

What waits on this

• I1208BLOCKED Adding a provider is one file, removing one is one deletion, and both are executed rather than described

Acceptance criteria

• The policy states the requirement per effect class, and no route names its own requirement
• A capability added with a mutating effect is refused to an anonymous caller with no edit to the HTTP layer, proved by a test capability
• The OpenAPI document carries the security scheme and marks the operations that require it, generated rather than written
• The Cockpit disables what the caller may not invoke and states the reason it is disabled

Validation

• cargo test --workspace --all-features
• majordomus generate --check
• bash test/run.sh

Evidence required

• policy_by_effect_class
• new_capability_inherits
• openapi_security_generated

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Risk

This issue depends on the effect classification being trustworthy. Where a capability's class is wrong, the fix is the classification, never an exception in the router.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I1206.yaml. Read it back with majordomus plan show I1206.