VerifiedPrincipal

What a channel proved about who is calling — and exactly how much of it (greenhouse decisions/0055). This sits at the boundary decisions/0054 drew: identity produces FACTS about identity, the policy produces CONSEQUENCES of authority. So this object has scopes and a verification story, and it has no authority field. An authenticator that named authority would have made the channel a legislator — the collapse decisions/0031 separated between a token and a principal. THE ONE INVARIANT: a verified grade is PRODUCED by re-verifying a proof, never READ from a stored field. greenhouse evidence/0254 forged the old version — verified:true with a plausible method and issuer, hand-written — and authority came down, because a string is not a proof. So the grade has exactly one door, {@see admit()}, which a channel calls after it has re-verified. {@see fromArray()} reconstructs the ASSERTION and NEVER carries the grade across the data boundary: what is persisted is the signed assertion, re-verified on admission, which is the receipt doctrine of decisions/0053 made mandatory for identity — a verified fact is a receipt, not currency.

public static function admit(string $principal, string $channel, array $scopes, string $method, string $issuer): self

The one door to a verified grade: a channel calls this AFTER it has re-verified a proof, live. The constructor is private precisely so no caller can hand-build a verified principal from data — the grade cannot exist without a channel having just checked the proof that backs it.

Parameters

public static function fromTerminal(?string $user, ?string $host): self

The os-user a terminal reports: a fact, but an UNVERIFIED one, by construction. It is the best hint available with no credential behind it — anyone at that terminal is it — so it can never be talked up. There is no proof to carry, so `verified` stays false forever.

Parameters

public static function fromArray(array $row): ?self

Reconstruct the ASSERTION from a payload — and NEVER the grade. evidence/0254 forged exactly what an earlier version honoured: verified:true with a plausible method and issuer, hand-written into a blob. So this returns an UNVERIFIED principal always, whatever the row claims. The grade is not data to be carried; it is produced by {@see admit()} when a channel re-verifies. A caller that wants the grade must re-admit through its proof, not read it back from storage.

Parameters

public function toArray(): array

The payload form, carrying the proof alongside the grade so {@see fromArray()} can refuse to honour a grade whose proof did not survive the round trip.

public function toFacts(): Milpa\Command\Effect\ContextFacts

The facts the authority policy consumes — carrying exactly what was proved, no more.