Fix Permission custom pivots and relation scope safety

AGENTS.md

@@ -129,7 +129,7 @@ The Working rules and the Avoid overengineering rules apply to all work in this
 - **Read the source before describing behavior** — never state how code behaves from memory or Laravel assumptions. Hypervel's coroutine runtime breaks many Laravel assumptions; if you haven't read the relevant source, read it first.
 - **Treat past owner decisions as context, not constraints** — Previous owner approvals and completed plans explain history but do not determine the best design today. Never retain or reject a design merely because it was previously approved; decide from current requirements, code, and evidence.
 - **Revert failed attempts immediately** — when a fix doesn't work, revert it before trying another approach. Don't leave experimental code in place.
-- **Use `composer require` for root dependencies** — the root `composer.json` has a lockfile, so dependency entries go through Composer, never hand-edits. Direct edits are fine for metadata sections no command can write (`autoload`, `replace`, `extra`, `scripts`) and for the sub-package `src/{package}/composer.json` files, which have no lockfile.
+- **Check dependency versions before adding them** — Before adding a package dependency to the root `composer.json`, check Packagist for the latest compatible stable version. The root `composer.lock` is intentionally untracked; run `composer update` after adding or merging dependency changes, do not treat an outdated local lock as a repository defect, and never commit it.
 
 ### Documentation
 

composer.json

@@ -336,6 +336,7 @@
                 "Hypervel\\Events\\EventServiceProvider",
                 "Hypervel\\Filesystem\\FilesystemServiceProvider",
                 "Hypervel\\Hashing\\HashingServiceProvider",
+                "Hypervel\\Horizon\\HorizonServiceProvider",
                 "Hypervel\\Http\\HttpServiceProvider",
                 "Hypervel\\Inertia\\InertiaServiceProvider",
                 "Hypervel\\Jwt\\JwtServiceProvider",
@@ -349,6 +350,7 @@
                 "Hypervel\\Passkeys\\PasskeysServiceProvider",
                 "Hypervel\\Fortify\\FortifyServiceProvider",
                 "Hypervel\\Grpc\\GrpcServiceProvider",
+                "Hypervel\\Permission\\PermissionServiceProvider",
                 "Hypervel\\Pipeline\\PipelineServiceProvider",
                 "Hypervel\\Queue\\QueueServiceProvider",
                 "Hypervel\\RateLimiter\\RateLimiterServiceProvider",
@@ -366,6 +368,7 @@
                 "Hypervel\\Tinker\\TinkerServiceProvider",
                 "Hypervel\\Translation\\TranslationServiceProvider",
                 "Hypervel\\Validation\\ValidationServiceProvider",
+                "Hypervel\\Wayfinder\\WayfinderServiceProvider",
                 "Hypervel\\WebSocketServer\\WebSocketServerServiceProvider",
                 "Hypervel\\Scout\\ScoutServiceProvider",
                 "Hypervel\\Telescope\\TelescopeServiceProvider",

docs/plans/2026-07-12-0900-framework-coroutine-state-lifecycle-audit.md

@@ -990,9 +990,9 @@ An exceptionally large shared work unit may receive its own linked detail plan w
 
 This compact index routes the completed-work history that must be consulted with the full plan after compaction. Detailed history remains in the [companion ledger](2026-07-12-0915-framework-coroutine-state-lifecycle-audit-ledger.md).
 
-- **Active package or work unit:** None. `json-schema` is complete; detail plan `2026-08-07-2015-json-schema-correctness-current-parity-and-bounded-reconstruction.md`.
-- **Ledger entries required for the active work:** None. The completed JSON Schema work is recorded under `Complete JSON Schema correctness, current parity, and bounded reconstruction`.
-- **Pending revalidation carried into the active work:** None. JSON Schema changed no lower-level assumption and has no repository runtime consumer requiring revalidation.
+- **Active package or work unit:** `permission`; targeted correctness, custom-pivot, relation-scope, and metadata maintenance is recorded under `Complete Permission correctness, custom pivots, and relation scope safety`; detail plan `2026-08-08-0059-permission-correctness-extension-parity-and-relation-scope-safety.md`. The later fresh Permission audit remains open.
+- **Ledger entries required for the active work:** `Complete Permission correctness, custom pivots, and relation scope safety`.
+- **Pending revalidation carried into the active work:** None. Permission revalidated `support-02`; Database and every corrected metadata sibling were revalidated in the same work unit.
 
 Update these three lines when a package starts, completes, or gains a cross-package dependency. Name exact work-unit headings or shared finding IDs from the companion ledger; never use “see recent entries” or require a full-ledger reread.
 
@@ -1053,7 +1053,7 @@ Add one row only for a shared finding or changed lower-level assumption that ano
 | `queue-11` | `queue` | `events`, `queue`, and `broadcasting` (revalidation complete) | `Correct event dispatch, queued-consumer isolation, and queue interoperability`; finding `queue-11` |
 | `queue-12` | `bus`, `queue` | `events`, `bus`, `queue`, and `broadcasting` (revalidation complete) | `Correct event dispatch, queued-consumer isolation, and queue interoperability`; finding `queue-12` |
 | `foundation-01` | `foundation` | `support` and `foundation` (revalidation complete) | `Correct event dispatch, queued-consumer isolation, and queue interoperability`; finding `foundation-01` |
-| `support-02` | `support` | `auth` (revalidation complete), `broadcasting` (revalidation complete), `bus` (revalidation complete), `cache` (revalidation complete), `concurrency`, `console` (revalidation complete), `container`, `contracts`, `cookie`, `database` (revalidation complete), `events`, `filesystem` (revalidation complete), `foundation` (revalidation complete), `hashing` (revalidation complete), `horizon` (revalidation complete), `inertia` (revalidation complete), `jwt`, `log`, `mail`, `notifications` (revalidation complete), `permission`, `pipeline`, `queue` (revalidation complete), `redis` (revalidation complete), `reverb` (revalidation complete), `routing` (revalidation complete), `sanctum` (revalidation complete), `scout`, `session` (revalidation complete), `socialite` (revalidation complete), `telescope`, `testbench`; `translation` (revalidation complete); later full remaining consumer audits | `Normalize framework enum identifiers at string boundaries`; finding `support-02`; sibling findings `translation-01` and `reverb-03`; linked detail plan `2026-07-15-0920-framework-enum-identifier-contracts.md` |
+| `support-02` | `support` | `auth` (revalidation complete), `broadcasting` (revalidation complete), `bus` (revalidation complete), `cache` (revalidation complete), `concurrency`, `console` (revalidation complete), `container`, `contracts`, `cookie`, `database` (revalidation complete), `events`, `filesystem` (revalidation complete), `foundation` (revalidation complete), `hashing` (revalidation complete), `horizon` (revalidation complete), `inertia` (revalidation complete), `jwt`, `log`, `mail`, `notifications` (revalidation complete), `permission` (revalidation complete), `pipeline`, `queue` (revalidation complete), `redis` (revalidation complete), `reverb` (revalidation complete), `routing` (revalidation complete), `sanctum` (revalidation complete), `scout`, `session` (revalidation complete), `socialite` (revalidation complete), `telescope`, `testbench`; `translation` (revalidation complete); later full remaining consumer audits | `Normalize framework enum identifiers at string boundaries`; finding `support-02`; sibling findings `translation-01` and `reverb-03`; linked detail plan `2026-07-15-0920-framework-enum-identifier-contracts.md` |
 | `macroable-03` | `macroable` | `cookie`, `log`, and `notifications` (revalidation complete); later full `jwt` audit | `Complete Macroable callable and test-state handling`; finding `macroable-03` |
 | `auth-01` | `support`, `auth` | `auth` (revalidation complete) | `Correct Support utility boundaries and authentication timing isolation`; finding `auth-01` |
 | `encryption-03` | `encryption` | `contracts`, `support`, `filesystem`, and `foundation` (revalidation complete) | `Harden encryption rotation, key publication, and global lifecycle state`; finding `encryption-03` |
@@ -1146,6 +1146,19 @@ Add one row only for a shared finding or changed lower-level assumption that ano
 | `permission-03` | `permission` | `permission` (targeted correction complete); later full `permission` audit | `Harden Eloquent identity and partial-projection safety`; finding `permission-03` |
 | `permission-04` | `permission` | `permission` (targeted correction complete); later full `permission` audit | `Harden Eloquent identity and partial-projection safety`; finding `permission-04` |
 | `permission-05` | `permission` | `permission` (targeted correction complete); later full `permission` audit | `Harden Eloquent identity and partial-projection safety`; finding `permission-05` |
+| `permission-06` | `permission` | `permission` (targeted correction complete); later full `permission` audit | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `permission-06` |
+| `permission-07` | `permission` | `permission` (targeted correction complete); later full `permission` audit | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `permission-07` |
+| `permission-08` | `permission` | `permission` (targeted correction complete); later full `permission` audit | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `permission-08` |
+| `permission-09` | `permission` | `permission` (targeted correction complete); later full `permission` audit | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `permission-09` |
+| `permission-10` | `permission` | `permission` (targeted correction complete); later full `permission` audit | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `permission-10` |
+| `permission-11` | `permission` | `permission` (targeted correction complete); later full `permission` audit | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `permission-11` |
+| `permission-12` | `permission` | `permission` (targeted correction complete); later full `permission` audit | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `permission-12` |
+| `permission-13` | `permission` | `permission` (targeted correction complete); later full `permission` audit | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `permission-13` |
+| `permission-14` | `permission` | `permission` (targeted correction complete); later full `permission` audit | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `permission-14` |
+| `permission-15` | `permission` | `permission` (targeted correction complete); later full `permission` audit | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `permission-15` |
+| `permission-16` | `permission` | `permission` (targeted correction complete); later full `permission` audit | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `permission-16` |
+| `permission-17` | `permission` | `permission` (targeted correction complete); later full `permission` audit | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `permission-17` |
+| `permission-18` | `permission` | `permission` (targeted correction complete); later full `permission` audit | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `permission-18` |
 | `fortify-02` | `fortify` | `fortify` (revalidation complete) | `Harden Eloquent identity and partial-projection safety`; finding `fortify-02` |
 | `pagination-01` | `pagination` | `pagination` (revalidation complete) | `Complete Pagination correctness, current parity, and query contracts`; finding `pagination-01` |
 | `pagination-02` | `pagination` | `pagination` (revalidation complete) | `Complete Pagination correctness, current parity, and query contracts`; finding `pagination-02` |
@@ -1171,6 +1184,21 @@ Add one row only for a shared finding or changed lower-level assumption that ano
 | `database-26` | `database` | `database`, `auth`, and `sanctum` (revalidation complete) | `Complete Sanctum correctness, cache settlement, and current parity`; finding `database-26` |
 | `database-27` | `database` | `database`, `bus`, `foundation`, `queue`, `events`, `mail`, `notifications`, `broadcasting`, `scout`, and `sanctum` (revalidation complete) | `Complete Sanctum correctness, cache settlement, and current parity`; finding `database-27` |
 | `database-28` | `database` | `database`, `auth`, and `sanctum` (revalidation complete) | `Complete Sanctum correctness, cache settlement, and current parity`; finding `database-28` |
+| `database-29` | `database` | `database` and `permission` (revalidation complete) | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `database-29` |
+| `database-30` | `database` | `database` and `permission` (revalidation complete) | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `database-30` |
+| `database-31` | `database` | `database` and `permission` (revalidation complete) | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `database-31` |
+| `database-32` | `database` | `database` and `permission` (revalidation complete) | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `database-32` |
+| `database-33` | `database` | `database` and `permission` (revalidation complete) | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `database-33` |
+| `horizon-22` | `horizon` | `horizon` (revalidation complete) | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `horizon-22` |
+| `wayfinder-01` | `wayfinder` | `wayfinder` (targeted correction complete); later full `wayfinder` audit | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `wayfinder-01` |
+| `broadcasting-17` | `broadcasting` | `broadcasting` (revalidation complete) | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `broadcasting-17` |
+| `contracts-12` | `contracts` | `contracts` (revalidation complete) | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `contracts-12` |
+| `concurrency-08` | `concurrency` | `concurrency` (targeted correction complete); later full `concurrency` audit | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `concurrency-08` |
+| `di-06` | `di` | `di` (targeted correction complete); later full `di` audit | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `di-06` |
+| `notifications-21` | `notifications` | `notifications` (revalidation complete) | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `notifications-21` |
+| `passkeys-15` | `passkeys` | `passkeys` (revalidation complete) | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `passkeys-15` |
+| `process-11` | `process` | `process` (targeted correction complete); later full `process` audit | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `process-11` |
+| `telescope-04` | `telescope` | `telescope` (targeted correction complete); later full `telescope` audit | `Complete Permission correctness, custom pivots, and relation scope safety`; finding `telescope-04` |
 | `auth-18` | `auth` | `auth` and `sanctum` (revalidation complete) | `Complete Sanctum correctness, cache settlement, and current parity`; finding `auth-18` |
 | `api-client-01` | `api-client` | `api-client` (targeted correction complete); later full `api-client` audit | `Complete Pagination correctness, current parity, and query contracts`; finding `api-client-01` |
 | `database-24` | `database` | `database` and `pagination` (revalidation complete) | `Complete Pagination correctness, current parity, and query contracts`; finding `database-24` |