acl: Phase 2 inheritance (groups, resource trees, roles) + 30 tests

eff_grant/eff_deny derived relations inherit through member_of (group +
role membership) and child_of (resource hierarchy); role_grant confers
role capabilities. Deny-overrides via stratified negation, deny
authoritative across the inheritance closure. Cyclic membership
terminates. Phase 1 suite unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/acl-on-sx.md

@@ -15,7 +15,7 @@ and federation extension. Reuses `lib/datalog/` evaluator and term model where p
 
 ## Status (rolling)
 
-`bash lib/acl/conformance.sh` → **24/24** (Phase 1 complete)
+`bash lib/acl/conformance.sh` → **54/54** (Phases 1-2 complete)
 
 ## Ground rules
 
@@ -69,13 +69,32 @@ lib/acl/facts.sx                  — builds Datalog query
 
 ## Phase 2 — Inheritance
 
-- [ ] `member_of(actor, group)` chain — group grants apply to members (transitive)
-- [ ] `child_of(res, parent)` chain — parent grants apply to children (transitive)
-- [ ] role expansion — role contains list of (action, resource) tuples
-- [ ] deny-overrides — explicit deny wins over inherited allow
-- [ ] `lib/acl/tests/inherit.sx` — 25+ cases: nested groups, deep resource trees,
+- [x] `member_of(actor, group)` chain — group grants apply to members (transitive)
+- [x] `child_of(res, parent)` chain — parent grants apply to children (transitive)
+- [x] role expansion — role contains list of (action, resource) tuples
+- [x] deny-overrides — explicit deny wins over inherited allow
+- [x] `lib/acl/tests/inherit.sx` — 25+ cases: nested groups, deep resource trees,
   conflict resolution, deny precedence
-- [ ] document the deny-overrides choice in plan
+- [x] document the deny-overrides choice in plan
+
+### deny-overrides policy (the choice)
+
+Encoded as stratified negation: `permit(S,A,R) :- eff_grant(S,A,R), not
+eff_deny(S,A,R)`. Both `eff_grant` and `eff_deny` inherit through the *same*
+`member_of` (group/role) and `child_of` (resource) chains. Consequences:
+
+- An explicit deny on the exact (S,A,R) defeats any inherited allow.
+- A **group-level** or **ancestor-resource** deny inherits down and defeats a
+  member's/descendant's grant — deny is authoritative across the closure, not
+  only at the leaf. This is the fail-safe reading: the most permissive
+  interpretation of "deny wins" would let a narrow grant escape a broad deny;
+  we chose the opposite.
+- Deny is dimension-scoped: a deny on (S, edit, R) never blocks (S, read, R).
+
+Stratifiable because neither `eff_grant` nor `eff_deny` depends on `permit`;
+`permit` sits in a strictly higher stratum. Termination is guaranteed —
+recursion is only over EDB `member_of`/`child_of` (no function symbols), so
+cyclic membership/containment reaches a fixpoint rather than looping (tested).
 
 ## Phase 3 — Explanation + audit
 
@@ -118,6 +137,18 @@ lib/acl/facts.sx                  — builds Datalog query
     seam is engine.sx's two functions — facts→db and ground-query→bool — both
     pure pass-throughs to the rule engine. Not extracting yet (wait for mod-sx as
     second consumer per ground rules).
+- **Phase 2 complete (54/54, +30 inherit).** Extended `acl-rules` with
+  `eff_grant`/`eff_deny` derived relations; `member_of` carries both group and
+  role membership, `child_of` carries resource trees, `role_grant` confers a
+  role's (action,resource) capabilities. Direct grants unchanged (base case of
+  `eff_grant`), Phase 1 suite still green. Constructors `acl-member-of`,
+  `acl-child-of`, `acl-role-grant` added; schema arity table extended. See the
+  deny-overrides policy section above. Verified cyclic membership terminates.
+  - **Shared-plumbing update:** the reusable seam is still just engine.sx's
+    `facts -> db` + `ground-query -> bool`. The inheritance *rules* are
+    ACL-specific (group/resource/role vocabulary); mod-sx will have its own. So
+    the `lib/guest/rules/` extraction stays at the build/decide level, not the
+    ruleset level.
   - **Tooling note:** sx-tree path-based edit tools (`sx_replace_node`,
     `sx_read_subtree` with a path) ignored the path argument in this worktree
     (always resolved to index 0 / `[0,..]`). `sx_write_file`, `sx_validate`,