Auto-Follow Group Membership

Flow

0. (NEW, #2422) A new member is added to the group via
   GroupOp::MemberAdded / GroupOp::MemberJoinedViaTeeAttestation /
   RootOp::MemberJoined (open-subgroup self-join).
   └─ Apply path writes a fresh GroupMember row with default flags
      (contexts: true, subgroups: false).
   └─ build_auto_follow_set_if_enabled synthesises
      OpEvent::AutoFollowSet { member, contexts: true, subgroups: false }
      so the on-join backfill cascade fires without requiring an
      explicit MemberSetAutoFollow op. This closes the Ronit/Fran
      regression where a joiner saw no pre-existing contexts until an
      admin manually flipped a flag.

1. Admin or member publishes MemberSetAutoFollow { target, contexts, subgroups }.
   └─ Authorized by admin-or-self check in apply_group_op_mutations.
   └─ Store updates GroupMemberValue.auto_follow.
   └─ op_events::notify(OpEvent::AutoFollowSet { ... }).

2. Auto-follow handler (spawned once from ContextManager::started) observes
   AutoFollowSet { member = self, contexts: true } and backfills: enumerate
   up to BACKFILL_LIMIT contexts in the group, emit JoinContext for each.
   Backfill is rate-limited to DEFAULT_BURST / DEFAULT_PER. Idempotent on
   already-joined contexts, so steps 0 + 1 firing for the same member is
   safe (e.g. TEE fleet-join: synthesised from MemberJoinedViaTeeAttestation
   then explicit MemberSetAutoFollow from fleet_join.rs).

3. Later, anyone registers a new context in the group.
   └─ GroupOp::ContextRegistered applied.
   └─ op_events::notify(OpEvent::ContextRegistered { group, context }).
   └─ Handler checks: is self a member with auto_follow.contexts = true?
   └─ If yes, emit JoinContext — same rate limit.

4. Later, an admin creates a subgroup under this group.
   └─ RootOp::GroupCreated { group_id, parent_id } applied on namespace DAG
       (atomic create+nest — strict-tree invariant).
   └─ op_events::notify(OpEvent::SubgroupCreated { parent, child }).
   └─ The auto-follow handler IGNORES this event today (the SubgroupCreated /
      AutoFollowSet { subgroups: true } variants fall through the catch-all
      match arm). Subgroup membership is handled elsewhere — see TEE Fleet HA.

4b. Admin moves an existing subgroup to a new parent.
    └─ RootOp::GroupReparented { child, new_parent } applied.
    └─ op_events::notify(OpEvent::SubgroupReparented
        { old_parent, new_parent, child }).

Key Files

• crates/context/src/op_events.rs — op-apply event channel + OpEvent enum.
• crates/context/src/auto_follow.rs — handler task, rate limiter, spawn/shutdown.
• crates/context/src/group_store/mod.rs — apply_group_op_mutations (now accepts parents and authorizer) handles MemberSetAutoFollow; apply_local_signed_group_op_at_cut is the new authorizer-aware public entry point; apply_local_signed_group_op is now a shim forwarding to it with the inert LIVE_FALLBACK_AUTHORIZER.
• crates/context/src/group_store/membership.rs — set_member_auto_follow helper.
• crates/context/primitives/src/local_governance/mod.rs — the MemberSetAutoFollow op variant.
• crates/store/src/key/group/mod.rs — AutoFollowFlags and the backward-compatible BorshDeserialize for GroupMemberValue.
• crates/context/src/handlers/admit_tee_node.rs — TEE admission publishes the op only; flags are set by the admitted node itself.
• crates/server/src/admin/handlers/tee/fleet_join.rs — after admission, the member publishes MemberSetAutoFollow signed by self.
• crates/context/src/group_store/permission.rs (or equivalent) — PermissionChecker gains with_apply_auth; is_admin and is_authorized_with_capability use the projection-at-cut verdict as the authoritative decision when AtCutAuthorizer returns Some, falling back to live store queries otherwise. The shadow_admin helper and unified_projection_divergence logging have been removed. MembershipPolicy now optionally carries the op's parent cut hashes and an AtCutAuthorizer reference, set via the new with_apply_auth builder method. ensure_not_last_admin_removal and ensure_not_last_admin_demotion now delegate to the new would_orphan_admins helper, which calls AtCutAuthorizer::is_last_admin_at_cut to read the pre-mutation admin set from the projection as of the op's parent cut. The live membership computation is used only as a fallback when no apply-auth context is present (local pre-checks, cascades, tests) or the fold is incomplete. The shadow_last_admin helper and all unified_projection_divergence / plane=last-admin warnings have been deleted. GroupApplyCtx::new calls .with_apply_auth(parents, authorizer) on the MembershipPolicy it constructs, activating the projection-at-cut last-admin gate for all group-op apply paths.
• crates/context/src/authorizer.rs (or equivalent) — AtCutAuthorizer trait gains the required is_admin_or_capability_at_cut method, the is_last_admin_at_cut method, and the new required membership_path_at_cut method. All methods must return None when parents is empty (the empty-cut contract), so that genesis ops are never falsely rejected. EphemeralProjectionAuthorizer delegates is_last_admin_at_cut to ScopeProjections::is_last_admin_at_cut and implements membership_path_at_cut by delegating to ScopeProjections::membership_path_at_cut, mapping the result to the new AtCutMembershipPath enum (projecting away role/anchor detail). An empty parents slice returns None (defer to live), consistent with the existing is_admin_at_cut pattern. LiveFallbackAuthorizer implements all three methods as always-None, keeping all non-apply-auth constructions on the live-fallback path.
  Note: the live governance-cut resolver (acl_view_at, MembershipStatus, prefix_walk_membership, MembershipTransition, resolve_membership_from_transitions, heads_equal, MAX_PREFIX_WALK_NODES) has been deleted from governance-store/src/membership/status.rs. Membership authorization is now handled entirely by the unified projection; do not reference these removed symbols.
FIND>>> <<crates/context/src/authorizer.rs (or equivalent) — AtCutAuthorizer trait gains the required is_admin_or_capability_at_cut method, the is_last_admin_at_cut method, and the new required membership_path_at_cut method. All methods must return None when parents is empty (the empty-cut contract), so that genesis ops are never falsely rejected. EphemeralProjectionAuthorizer delegates is_last_admin_at_cut to ScopeProjections::is_last_admin_at_cut and implements membership_path_at_cut by delegating to ScopeProjections::membership_path_at_cut, mapping the result to the new AtCutMembershipPath enum (projecting away role/anchor detail). An empty parents slice returns None (defer to live), consistent with the existing is_admin_at_cut pattern. LiveFallbackAuthorizer implements all three methods as always-None, keeping all non-apply-auth constructions on the live-fallback path.

State-Hash Staleness Checks Removed

As of this change, the state_hash field has been removed from the governance op wire format entirely. The warn-and-apply staleness check that previously existed in apply_local_signed_group_op_at_cut and apply_group_op_inner has been deleted along with all supporting infrastructure. The per-signer nonce window is now the sole anti-replay and deduplication gate on the apply path.

What Was Removed

• Staleness check blocks in apply_local_signed_group_op_at_cut and NamespaceGovernance::apply_group_op_inner — the code that recomputed the group or namespace state hash and emitted a tracing::warn! on mismatch is gone. No warning of the form local group op state_hash mismatch will ever appear; any monitoring or alerting on that string can be retired.
• NamespaceGovernance::state_hash_for_op() — computed the appropriate hash domain for a namespace op at sign time.
• root_op_commits_to_namespace_state() — a module-level whitelist of RootOp variants whose correctness previously depended on namespace state.
• pre_apply_state_hash capture in GroupGovernancePublisher and the state_hash parameter threading through publish_post_gate, sign_and_publish_post_gate, and sign_and_publish_without_apply.
• GroupHandle::compute_state_hash() — a public thin wrapper over MetaRepository::compute_state_hash that had no remaining callers.

Wire and Serialization Impact

The synthesized SignedGroupOp inside decrypt_and_apply_group_op no longer copies ns_op.state_hash (the field is gone from the struct). The DAG delta helpers signed_op_to_delta and signed_namespace_op_to_delta now pass [0u8; 32] as expected_root_hash because governance ops no longer carry a meaningful root claim.

Deleted Tests

The following unit tests and their shared setup_state_hash_test_fixture helper were deleted because they pinned behaviour that no longer exists:

• namespace_group_op_zero_state_hash_bypasses_check
• namespace_group_op_with_current_state_hash_applies
• namespace_group_op_with_stale_state_hash_applies_with_warning
• group_op_with_stale_hash_and_absent_meta_applies
• namespace_root_op_with_current_state_hash_applies
• namespace_root_op_with_stale_state_hash_applies_with_warning
• state_hash_allows_sequential_ops
• state_hash_zero_skips_validation

Operator Notes

• The absent-meta bypass documented in the Re-drive Buffered Ops section (skip the staleness check when the subgroup GroupMeta row does not yet exist) is also gone — there is no check left to bypass. The absent-meta case is now unremarkable.
• Any tooling or client library that populated state_hash when constructing a SignedGroupOp or SignedNamespaceOp must be updated to omit the field. Passing a non-zero value is a wire error on the new schema.
• The nonce-window dedup path is unchanged. A replayed op is still detected and returns Ok(()) early, as before.