StandingGrant

A STANDING GRANT: what a person signs once so that a seat may repeat an act without asking — under a ceiling, on conditions, and only while its falsifier stays quiet (greenhouse decisions/0613, 0615). ── WHAT IT REPLACES ──────────────────────────────────────────────────────────────────────────── Not the signature on each call. Measured on the published family (greenhouse decisions/0615): what makes an act «the person's» is the scope a seat lacks, and the only way to let a seat repeat that act was to hand it the scope whole — no ceiling, no condition, nothing to take it back when the evidence changes. A grant is narrower than that on every count, and it is the first thing in the family that can say «only this candidate, and only measured». ── WHAT IT CARRIES, AND WHY EACH PART ────────────────────────────────────────────────────────── · `to` the seats it lends to. Never «anyone». · `covers` the operations it names, with the arguments it fixes. A positive, closed list: what is not named is not covered, and nothing here is a pattern. · `ceiling` the widest effect a covered call may have, on every axis. · `conditions` what must have been MEASURED on the very content an act touches, each by the operation that measures it. · `undo` how an absorbed act is taken back, in words, for the record of each one. · `falsifier` what would show the grant wrong, and the operation that watches for it. · `expiresAt` optional; it only ever narrows. ── THE FLOORS NO GRANT CROSSES (Rod, 2026-10-11) ─────────────────────────────────────────────── Refused HERE, at construction, so that no such document can exist to be signed: · a ceiling with an unclassified axis — measured: an unclassified ceiling admits everything; · a ceiling above «compensatable» — a grant never lends what cannot at least be compensated; · a ceiling whose AUTHORITY is above «write_as_user» — nothing a grant lends may itself give authority. The floor is the axis that says it, not a list of words: measured on the published catalogue, thirteen operations declare institutional authority and four of them ask for the word a list would have looked for (greenhouse decisions/0615, «Lo que la revisión encontró», 4); · covering any `standing.*` operation — nothing a grant lends may give, restore or withdraw a grant; · no condition at all — that is the scope handed over whole, with a watcher; · a falsifier nothing watches — {@see Falsifier}. The other half of the first floor — never an operation that gives authority by the HOST's own words — needs the host's catalogue and is asked there. ── WHAT IT CANNOT SAY ────────────────────────────────────────────────────────────────────────── MONEY. There is no axis for it, so no ceiling here can bound what a call spends, and nothing in an operation's declaration says that it spends. «Do not grant over an operation that spends» is a rule for whoever signs, not something this class or any judge of it can hold. ── WHAT IT IS NOT ────────────────────────────────────────────────────────────────────────────── An authority. This is the document; whether a person signed it, whether it is still in force and whether a given call passes are asked elsewhere ({@see StandingJudge}), with facts a host gathers. Its state is never a field of it: what was signed is not edited.

public function __construct(string $id, array $to, array $covers, Milpa\Command\Effect\EffectProfile $ceiling, array $conditions, string $undo, Milpa\Command\Standing\Falsifier $falsifier, ?string $supersedes = null, ?DateTimeImmutable $expiresAt = null, ?string $lifts = null):

Parameters

public function lendsTo(string $seat): bool

Whether this grant lends to that seat, by the key exactly as the grant spells it.

Parameters

public function namesOperation(Milpa\Command\Consent\OperationId|string $operation): bool

Whether this grant names that operation at all, whatever arguments it fixes for it.

Parameters

public function covering(Milpa\Command\Consent\OperationId|string $operation, array $arguments): ?Milpa\Command\Standing\NamedCall

The named call that covers this one, or `null` when none does.

Parameters

public function toArray(): array

The grant as data — the document a person reads and signs.

public function canonical(): string

The exact bytes that identify this grant — one spelling, whatever order its author wrote it in.

public function digest(): string

`sha256:` of {@see self::canonical()}: what a record of this grant is checked against.

public static function fromArray(array $data): self

A grant from the document a person wrote, already read into an array. Every refusal names what is missing or what is not read. WHAT AN ARRAY NO LONGER SAYS. A text that says a key twice, or writes a list as an object, is refused by {@see self::fromJson()}, which reads the text: this cannot see a key said twice, because the array holds the last one only. Whoever holds the text a person signed reads it with `fromJson()`.

Parameters

public static function fromJson(string $json): self

A grant from its JSON text — the text a person signed. ONE READER, FOR A NEW DOCUMENT AND FOR ONE ALREADY SIGNED. What this refuses, it refuses the same way whether the text was never a grant or was one under an earlier version of this contract: a host that keeps signed documents and reads them again with a later contract cannot tell the two apart here. So such a host treats a document it kept and can no longer read as a FAULT of its record — never as a grant that is not there, which would bring back whatever that grant had replaced or stopped. And it says so to the judge: such a document is no grant it can hand in, so the fault is the third thing {@see StandingJudge::among()} asks for, and with it nothing is lent to any seat. A text longer than {@see self::LONGEST} bytes is refused before it is read — and so is one whose own CANONICAL spelling would be longer: that spelling says `supersedes`, `lifts` and `expires_at` also when the text left them out, and a text the reader took and whose spelling it refused would be a document its house cannot read back. The limit is of this reader: a grant put together in code has none of its own.

Parameters