User principals and delegated communication permissions

[Mearman]

The mesh has no concept of a user. Every bridge is a peer and every issuer is a device, so there is no way to say "these agents act for me", or to grant and revoke communication permissions as a person rather than device by device. Rooms already solve this shape locally: a room owner is the root issuer and membership is a token. This epic generalises that to the user.

The architectural anchor: "user" maps onto a principal wire-mesh already has. The group scope kind (a person's owned devices) given its own device-id via a group key is exactly the identity the threshold-signing design produces (ExaDev/wire-mesh#29), so a user principal can optionally require T-of-N device approval before issuing anything, rather than trusting any single device.

Sibling to #153 (the cross-machine epic): that one changes the machine boundary, this one changes the principal model. They compose, but neither contains the other.

Already shipped and merely mapped, recorded so it is not rebuilt:

• allow / deny / ask tiers: allow is a held token for the verb and scope; deny is never issued, or revoked via a revocation entry; ask is capability-request (core/management: add capability-request / capability-grant-ok verbs wire-mesh#78), the held-open-until-someone-decides primitive. canGrant (core/tokens: expose canGrant() as a queryable narrowing check wire-mesh#79) is the grantability query.
• delegation.maxDepth is delegations-remaining, an exact match already enforced on every chain walk.
• per-agent overrides are independently minted per-bearer grants; replace-not-merge falls out because each agent's token is its own mint with its own narrowed scope.

Genuinely new, and the sub-issues: the user principal as a first-class issuer (issuers are devices today), device-to-user membership tokens, receiver-side DM gating with user-issued capabilities, issuer-side nonDelegable policy, bubble-up routing along the issuer chain, and the ask tier surfaced in the tool layer.

Ownership and persistence across devices:

Entities root at the user principal, never at an individual device. An entity's ownership persists exactly as long as the key anchoring it: device-rooted ownership (today's only mode) is machine-local and orphans on device loss, the outcome wire-mesh's identity.cddl already documents as a deliberate non-goal. Under the user-rooted model, persistence of ownership reduces to persistence of the group key, which has two known routes:

• Duplication: export the group key onto further devices. Available now; all copies share one device-id, so no single copy can be revoked without revoking them all. Solves loss, not compromise.
• Threshold resharing (core/threshold: FROST-based threshold signing for a person's own devices wire-mesh#29): T survivors re-share the same secret, so the group device-id and everything rooted at it survives untouched. T=2 with N>=3 is the recommended shape; T=2 with N=2 has zero loss tolerance. Lost shares are neutralised by the reshare rather than cryptographically revoked, and a lost device's own grants become revocable by the surviving group, which nothing can do today.

Devices belong to the user through membership tokens; individual bridge identities deliberately stay per-device (members of the user, never the user itself), so a bridge remains individually revocable without touching the principal. User data follows the principal across devices through core/data mailbox replication rather than any new sync mechanism.

The principal is framed as a user throughout, but wire-mesh's group scope kind is already person/team/org shaped, so team and org principals are the same mechanism with a wider membership: nothing here is single-user by construction.

A design note for later, not a work item: auditability of grants composes from existing pieces. Tokens and revocation entries are already signed artifacts; recording issued grants and approvals in the issuer's own core/data oplog is the same signed-envelope-over-oplog pattern as the redemption-notice design (ExaDev/wire-mesh#115), giving a tamper-evident history of who granted what if audit ever becomes a requirement.

Build order across the three layers, each step independently valuable: the cross-machine epic (#153) first (self-contained, delivers cross-machine communication with machine-level trust), this epic second (introduces the principal layer on the token substrate), and the threshold root (ExaDev/wire-mesh#29) last as the upgrade of the principal from a duplicated key to a threshold one, changing nothing above it.

[Mearman]

All six sub-issues (#160-#165) are closed and merged. The user-principal layer is real: a machine-account-scoped identity issuing device membership tokens, DM gating, delegation policy, issuer-chain bubble-up, and the ask-tier surfaced at the tool layer.