[nomed]

Summary

Executes #89 after preflight #90 on pinned Cognee 690c0ec023719a2a277dc893cdecfec1ca8012cc.

This gate is intentionally model-free: the protected object is the dataset itself, because Cognee's native ACL object is principal × permission × dataset. We do not invoke LLM/retrieval just to test ACL semantics.

Normalized executable contract

Through public FastAPI routes only, with backend access control enabled and file-backed default stores:

1. register active users A/B and API keys;
2. place B in A's tenant and select that tenant;
3. A creates dataset M;
4. prove A sees M and B does not;
5. A grants B read via public permissions API;
6. a fresh process proves B sees M;
7. A revokes B read while A, B and M remain alive;
8. a fresh process proves B no longer sees M while A still does;
9. another fresh application process reuses the same persisted storage and proves revoke persistence, A access, B liveness, and M survival.

Decision

COMPLEMENT_PASS requires every normalized observation to be true.

Limitations remain explicit:

• dataset/collection ACL granularity, not per-memory atom;
• the executable uses authorized dataset metadata visibility as the enforcement probe rather than LLM retrieval, keeping this qualification bounded and focused on provider-native ACL semantics.

No OpenViking replacement is implied. Yukh authority/evidence boundaries remain external.

Related: #63, #77, #87, #88, #89, #90, #86.