dir-sim: read group grants from the authority's versioned policy

[AdaWorldAPI]

What

HubSPO wishlist #2, following decisions 4(b) and 5(a). This was pushed to #1485's branch after #1485 merged, so it is re-opened here on top of main.

GroupRoles::from_policy builds ViewActors' grants from one version of OGAR's ogar_rbac::GroupRolePolicy. The grants now have one home: the directory supplies membership, and the authority's versioned policy supplies which roles a group confers, with provenance kept in the policy.

• Never named: a group the policy never named stays unread. It grants nothing, and unread_groups names it.
• All revoked: a group whose grants were all revoked is read with no roles, which is not the same as unread.
• Earlier versions: an earlier policy version gives the roles that stood then.

Dependency

dir-sim's rbac feature now pulls in ogar-rbac by git. The crate's own [patch] maps ogar-rbac, ogar-auth and ogar-vocab to the OGAR sibling. It also maps lance-graph-contract and lance-graph-rbac to this checkout, so ViewActors and the policy share one RoleId. No consumer enables rbac. Spear and lance-graph-dir-sim-lance still resolve.

Tests

• New test: roles_come_from_one_version_of_the_group_role_policy. It fails to compile without from_policy.
• Disable run: dropping groups with no standing roles fails the test at view_actors.rs:220 (u4 then reports S3 as unread).
• Local gates: cargo +1.99.0 clippy --all-targets --all-features -D warnings and the full dir-sim suite pass, with debug info off.

Board

• Row D-DSP-3b added.
• D-DSP-2 marked Shipped (dir-sim: the history log in Lance; group grants read from the authority's policy #1485).

🤖 Generated with Claude Code

https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

---

Generated by Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

Next included review available in 9 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 64 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: e46d79a8-68e0-4f1d-a490-5a93967a5500

---

📥 Commits

Reviewing files that changed from the base of the PR and between 4c3e813 and 6c635a9.

---

📒 Files selected for processing (4)

• .claude/board/STATUS_BOARD.md
• crates/lance-graph-dir-sim/Cargo.toml
• crates/lance-graph-dir-sim/src/actors.rs
• crates/lance-graph-dir-sim/tests/view_actors.rs

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

---

_{Comment @coderabbitai help to get the list of available commands.}