Module delegation 

Delegation & credential-chain logic (§21, legal_logic.md) — the trust fabric.

Legal power and identity flow through chains of authorization. This module governs how authority propagates along a delegation DAG and how revocation of an upstream node cascades to defeat every downstream dependent (ZCAP-LD / capability chains; Open Badges EndorsementCredential). Authority delegation edges are (delegator, q42:delegatesTo, delegatee). Bounded BFS, zero-heap.

Constants

MAX_DELEGATION_NODES

Bound on distinct nodes in one delegation query.

Functions

attenuates

Attenuation (ZCAP-LD / Macaroons): a sub-delegation’s capability set child is valid only if a SUBSET of the delegator’s parent set — a delegatee never gains MORE authority than the delegator holds. (Empty child trivially attenuates.)

authority_after_crl

Does agent still hold authority from root_authority after excising EVERY node on the revocation list crl (a real-time CRL check across the whole chain)? Zero-heap (bounded BFS).

authority_after_revocation

Revocation cascade: after revoked is revoked, does agent still hold authority from root_authority? An agent whose only chain ran through revoked is now defeated.

delegates_predicate

The delegation-edge predicate (delegator, q42:delegatesTo, delegatee).

delegation_in_force

Is a delegation temporally in-force at now? [from, until] Unix-epoch bounds, where from == 0 means “no start bound” and until == 0 means “open-ended”.

delegation_in_region

Is a delegation valid in location? Its scope_region (0 = unbounded / global) must equal location. Spatial bounding of delegated authority.

has_delegated_authority

Does agent hold authority delegated (transitively) from root_authority? Auth(α,p) ∧ Deleg*(α,…,β) → Auth(β,p).

is_revoked

Is node on the cryptographic revocation list crl?

revoked_descendants

Collect, into out, the candidates defeated by revoking revoked — held authority before, lost it after. Returns the count. Zero-heap.