GroupRevision

Purpose

One immutable epoch of a group's membership. A group never edits its membership: every change — a member brought in, a member taken out — mints a new revision with a fresh key, and the old revision stands untouched. Access is bounded by epoch: members hold exactly the keys of the epochs they belong to, so a removed member keeps what they could already read and gets nothing after, and a new member gets the new epoch and nothing before. The founding revision begins its lineage: its id is the lineage itself, and it has no parent.

Attributes

• revision id: is Text that identifies the revision, such as "g-7421.2"
• lineage: is Text that names the lineage the revision belongs to, such as "g-7421"
• parent: is Text that names the revision id this one succeeds; empty for the founding revision
• key id: is Text that identifies this epoch's key, such as "k-0150" — the identifier only; the key itself never appears in a revision
• created by: the sub of the Member who minted the revision
• members: the subs of the Members who belong to this epoch

Invariants

• The founding revision — the one with no parent — carries its lineage as its own revision id.
• A revision that is not the founding one names its parent.
• The creator is among the members.

Scenarios

A founding revision begins its lineage

Given: revision id "g-7421", lineage "g-7421", no parent, key id "k-0142", created by "anne.bruun", and members "anne.bruun" When: a GroupRevision is created Then: it is accepted as the founding revision of lineage "g-7421" with "anne.bruun" its sole member

A successor names its parent

Given: revision id "g-7421.2", lineage "g-7421", parent "g-7421", key id "k-0150", created by "anne.bruun", and members "anne.bruun" and "sofie.lind" When: a GroupRevision is created Then: it is accepted with parent "g-7421" and both members

A founding revision under a different id is rejected

Given: revision id "g-7421.1", lineage "g-7421", no parent, key id "k-0142", created by "anne.bruun", and members "anne.bruun" When: a GroupRevision is created Then: the creation is rejected because a founding revision carries its lineage as its own id

A creator outside the membership is rejected

Given: revision id "g-7421", lineage "g-7421", no parent, key id "k-0142", created by "anne.bruun", and members "sofie.lind" When: a GroupRevision is created Then: the creation is rejected because the creator is not among the members