List grants no plugin declares with a Remove, and save a permission change as one Keto transaction

2026-11-08 22:04:52 +01:00
parent 1cc98017d2
commit 4d2e7b59fd
20 changed files with 318 additions and 160 deletions
@@ -198,7 +198,7 @@ The host collects every installed plugin's declarations into one catalog (`decla
 Permissions admin screen: nothing in a GUI invents a name, and holding one is a property of a user
 or group, edited as a checkbox list there. A Keto tuple naming something no installed plugin
 declares gates nothing, is not offered, and is never revoked by an unrelated save: the picker only
-speaks for what it showed.
+speaks for what it showed. The subject's page lists such a direct grant apart, with a Remove of its own.

 ## A permission's `<resource>` is global, not plugin-scoped

@@ -474,3 +474,14 @@ Read most (opens and searches):
 - `src/plugin-host/conflicts.ts` 3
 - `AGENTS.md` 2
 - `compose.yml` 2
+
+## Reading cost, chunk 0d9d4ffb47aa, finished 2026-11-08T20:58:38Z
+
+48347 new input tokens before the first commit.
+
+Read most (opens and searches):
+
+- `src/http/app.ts` 4
+- `src/http/app.test.ts` 2
+- `todo.md` 2
+- `src/plugin-host/plugin.ts` 1