- Shipped
- August 14, 2026 at 9:22 PM UTC
- Author
- Kamo
- Commit
- 3242986
RoleRightType has declared a 'parent' field and a public getParent() for years. Every constant passed null and nothing ever called it. This finishes that scaffolding: 135 children, 34 roots, 30 standalone, max depth 3, derived from an audit of all 199 rights over 15,081 source files across the 40 repos. TWO enforcement points, and the split is the design: normalizeLevel() is AUTHORING. It makes ONE level self-consistent — a granted child pulls its ancestors up at that level, a denied parent pushes NUKE down its subtree there. Applied in the role, department and job-title write paths. Because each level stays coherent, a job title that grants a child also grants the parent THERE, and the existing waterfall already lets the more specific level beat a department that denied it. No cross-level precedence rule was added and the waterfall is untouched. applyClosure() is RESOLUTION, appended after applyTemplateRules. It is a safety net for the only two things authoring cannot reach: a security model FORCE_NUKE on a parent (absolute, applied last, so without this a forced-off parent leaves its children granted) and rows written before any of this. Two pairs stay deliberately FLAT because separation of duties depends on it: APPROVE_TIMECARD_ADJUSTMENTS / FINALIZE_PAY_PERIODS, and APPROVE_ORG_PAYOUTS as a sibling of MANAGE_ORG_FINANCES rather than its child — nesting the latter would force every payout approver to also be an issuer. Design: kamo-internal ****************