RBAC permissions fixture proof.

The first Capability Buildprint dogfood proof without external keys. The live RBAC packet was loaded with agb start, applied to a small host fixture, and verified with allow, deny, missing-role, and central-helper tests.

Fixture proof passed4/4 testsNo external keysReceipt written

Open summary Use RBAC Buildprint Capability Standard

14snapshot files

3local checkpoints

4/4tests passed

fixtureproof level

⌁ Capability verified

Deny-by-default RBAC graft

What was validated

Live RBAC package manifest loaded through agb start.
.buildprint/host-assessment.md was written before implementation.
.buildprint/capability-plan.md mapped the host-specific policy.
Central RBAC helper denied unknown users, unknown roles, and missing roles.
Admin access passed; member and missing-role access were denied.
.buildprint/capability-receipt.md recorded proof level and non-claims.

✓ Verification

npm test

npm test ran Node's built-in test runner. Final result: 4/4 passing.

Selected depth: fixture proof. No database, HTTP router, or production authorization behavior is claimed.

↳ Artifacts

Open the proof files

PUBLIC_PROOF_SUMMARY.md

PUBLIC_PROOF_SUMMARY

Public summary, claim boundary, command, result, and fixture scope.

QA_REPORT.md

QA_REPORT

Exact RBAC fixture checks and test output.

CAPABILITY_RECEIPT.md

CAPABILITY_RECEIPT

Host assessment, plan, changed files, proof level, risks, and non-claims.

! Honest boundary

This proves fixture RBAC behavior, not production auth.

The proof validates the Capability Buildprint workflow and local authorization behavior. It does not claim database-backed role persistence, HTTP middleware integration, team/workspace scoping, or production authorization behavior.