Class ScopeDimensionResolver

Apply a declared defaultValue when nothing resolved.

A default may NOT stand in for a restricting dimension: for a bound, "absent" has to mean deny. Allowing a default there would let an author turn a failed derivation into a silent grant, which is the inverse of what the bound is for.

Derive a ServerDerived value: an approved MJ: Queries row, else nothing.

First rule whose every when entry matches. Order in the array IS the precedence order.

A set-valued resolved dimension matches by MEMBERSHIP, so an author writes when: { ActiveSkillIDs: '<exam-writer>' } without needing to know whether the dimension is scalar or a set. Comparison is case-insensitive: MJ UUID casing is inconsistent, and a rule that never fires because of letter case would be effectively undebuggable.

Lattice meet — a caller may only NARROW. set intersects; scalar must match exactly; opaque forbids narrowing entirely.

Meet a caller value against a SET-valued server bound.

A scalar caller value is a MEMBERSHIP test — "pick one of the allowed values" — not equality against the set. An earlier version compared the scalar to a stringified array and therefore rejected every legitimate pick, which is why the two shapes are handled apart here.

Resolve narrowingOf targets before their dependents; otherwise declaration order.

Parse the scope's declaration; a malformed config fails closed rather than being ignored.

strictValidation with teeth — previously this only warned and used the value anyway.

Resolve an advisory (§5.12 supersession) dimension. Never throws.

Every failure path here degrades to "no supersession" rather than to a refused search. That asymmetry with resolveOne is the entire point of the section: entitlement composes by intersection and fails closed; supersession only subtracts and fails soft.

Produce a value according to the dimension's TRUST, which is the whole security hinge.

ServerDerived never merges a caller value — it discards it and derives its own. The discard also wins the provenance label even when a server value replaced it, because an audit needs to see that someone tried; a successful override would otherwise look identical to a quiet run.

Resolve a single dimension, enforcing trust, grammar, narrowing and required-ness.

Validate the DECLARATION itself, before any dimension is dispatched.

This has to run here rather than inside per-dimension resolution. advisory routes to a fail-soft path that deliberately swallows errors, so a contradiction checked inside that path would be swallowed too — and the failure mode was the worst available one: a dimension declaring restricts: true alongside advisory: true was silently given the advisory posture, i.e. a declared boundary quietly became droppable. Found by a test, not by review.

Enforce the declared grammar. A failure REJECTS — never coerce, never drop-and-continue.