# M10 — Governance & Agent Rights: UAT Results

**Run ID:** 20260304-060225-kgy
**Date:** 2026-03-04
**Verdict:** PASS

## Checklist

### Feature 1: Community Policy Engine

- [x] **CP-1:** `SchemaBuilder::community_policy()` accepts `CommunityPolicy` and validates at `build()` time
- [x] **CP-2:** `TidalDb::signal_with_community_policy()` enforces write rules, returns `PolicyViolation` on rejection
- [x] **CP-3:** `Retrieve::builder().community()` threads `CommunityContext`, suppresses denied-read signals
- [x] **CP-4:** Schema validation: unknown signal in policy → rejected
- [x] **CP-5:** Schema validation: allow/deny conflict → rejected
- [x] **CP-6:** Schema validation: duplicate policy name → rejected
- [x] **CP-7:** Admin role with empty allow/deny → permits all writes
- [x] **CP-8:** Write with unknown role → `TidalError::NotFound`
- [x] **CP-9:** Retrieve without community context → all signals included (no regression)
- [x] **CP-10:** All 10 integration tests pass (`m10_community_policy`)

### Feature 2: Agent Capability Boundaries

- [x] **AB-1:** Session with `allowed_read_signals: ["view"]` reads `view` OK; `like` → `ReadNotAllowed`
- [x] **AB-2:** Session with `denied_read_signals: ["hide"]` → `ReadDenied`
- [x] **AB-3:** Session with `allowed_user_attributes: ["locale"]` reads `locale` OK; `age_range` → `AttributeReadNotAllowed`
- [x] **AB-4:** Empty `allowed_profile_overrides` → unrestricted (backward compatible)
- [x] **AB-5:** Session with `allowed_profile_overrides: ["search", "trending"]` → can override to those, not `for_you`
- [x] **AB-6:** All violations recorded in session audit log with correct `AuditKind`
- [x] **AB-7:** Empty new fields → identical to pre-M10 `AgentPolicy` (no regression)
- [x] **AB-8:** Schema rejects policy with non-existent signal in `allowed_read_signals`
- [x] **AB-9:** Schema rejects policy with same signal in both allow and deny lists
- [x] **AB-10:** `signals_rejected` and `overrides_rejected` counters increment correctly
- [x] **AB-11:** `read_decay_score` (without session) unaffected
- [x] **AB-12:** All 18 PolicyEvaluator unit tests pass

### Feature 3: Signal Revocation Controls

- [x] **SR-1:** SignalType revocation suppresses sort score
- [x] **SR-2:** TimeRange revocation suppresses all signals in range
- [x] **SR-3:** Cancel revocation restores scoring immediately
- [x] **SR-4:** Unrevoked signals unaffected
- [x] **SR-5:** List revocations includes active and cancelled
- [x] **SR-6:** Revocation scoped to requesting user only
- [x] **SR-7:** Multiple overlapping revocations → union semantics
- [x] **SR-8:** Revocation persists across DB reopen (durable)
- [x] **SR-9:** Cancellation persists across DB reopen
- [x] **SR-10:** Anonymous query (no `for_user`) → never suppressed

### Regression Suites

- [x] `cargo test --lib` — 1317 passed
- [x] `m4_uat` — 12 passed
- [x] `m7_uat` — 10 passed
- [x] `m8_uat` — 8 passed
- [x] `m9_community_sync` — 10 passed
- [x] `m9_leave_revocation` — 7 passed
- [x] `session_durability` — 9 passed

## Totals

| Metric | Value |
|--------|-------|
| Tests total | 1393 |
| Tests passed | 1393 |
| Tests failed | 0 |
| Tasks created | 0 |

**Signed off:** UAT PASS — all M10 acceptance criteria verified.