[Cylop]

Phase 2 of the access-operations program: declare expected access and see what nobody explains.

What's new (experimental)

• profiles/*.yaml and people/*.yaml next to permesh.yaml, plus an optional profiles: section (enforce, directory_groups). Entries reference immutable provider IDs; includes are expanded with cycle detection; errors name the file.
• permesh profile check [--snapshot] [--policy]: per person, missing expected entries and unexplained access, with the group route (via) and certainty. Exits 0 / 6 findings / 4 incomplete / 3 all failed / 2 not configured.
• permesh profile suggest --group INSTANCE:GROUP_ID --name NAME [--min-percent N]: prints a reviewable YAML draft from what a group's members share.
• Policy version: 2: unexplained_access exceptions scoped to a membership (group) or one direct grant, with expiry. v1 files are unchanged.
• permesh check: unexplained_access and missing_access counts, report-only unless profiles.enforce: true (no effect on exit code, completeness or unfiltered notifications); profile_findings in detail payloads; summary stays counts-only.
• Starter ships README-only profiles/ and people/ (not configured until YAML is added); ADR 0033, docs/profiles.md, schema/stability/check/notification docs.

Safety properties

• "Missing" only for instances captured completely with the needed capability; otherwise cannot_tell and the comparison is incomplete.
• Ambiguous accounts, unknown people, conflicting identities and unresolved directory members never produce findings by guessing; they make the comparison incomplete.
• Exceptions apply only to findings, never to cannot_tell; expired exceptions don't apply.
• Draft YAML escapes control and bidi characters in IDs and labels.

Verification

cargo fmt --check && cargo clippy --workspace --all-targets -- -D warnings && cargo test --workspace (610 passed) and scripts/check_docs.py. A whole-branch review found one critical (ambiguous accounts hid access while reporting complete) and two important issues; all fixed with failing-first tests in the last commit. Deferred minors: per-person path index rebuild (perf), report-only check failing on malformed profile files, .yml ignored silently, config error hint wording, empty-provider exit, report-only label in detail notifications.