[codex] fix RFC-011 follow-up regressions (#258)

* fix rfc-011 follow-up regressions

* test(cli): remove served schema-apply tests obsoleted by the cluster 409

This PR disables server-side schema apply for cluster-backed serving (409 →
`omnigraph cluster apply`). Two system_local tests still drove *served* schema
apply against a spawned `--cluster` server and asserted the pre-409 behavior, so
they failed under `cargo test --workspace`:

- `local_cli_schema_apply_enforces_engine_layer_policy` — expected a per-actor
  policy `denied`/allow on the served route; the route now 409s for everyone
  before policy runs.
- `local_cli_schema_apply_rejects_stored_query_breakage_before_publish` —
  expected a served apply to reject a stored-query breakage; the route now 409s
  before any apply.

Both exercise a path the PR intentionally removed. Their surviving coverage:
the 409 itself is pinned by `schema_routes::schema_apply_route_refuses_cluster_backed_server_mode`
(asserts 409 + no mutation); stored-query-breakage-before-publish stays covered
by `schema_routes::schema_apply_route_rejects_stored_query_breakage_before_publish`
(single-mode); engine-layer schema_apply Cedar enforcement stays covered by
`policy_engine_chassis`. Remove the obsolete served versions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(server): report the cluster-backed schema-apply 409 after the Cedar gate

The 409 ("schema apply is disabled for cluster-backed serving") fired at the top
of `server_schema_apply`, before `authorize_request`. An authenticated-but-
unauthorized actor therefore learned the server is cluster-backed (409) instead
of getting a normal 403 — leaking topology before authorization, against the
same posture that keeps `GET /graphs` default-deny.

Move the 409 below the Cedar gate so the route reports 401 → 403 → 409: an
unauthorized actor gets 403, and only an actor authorized for `schema_apply`
sees the actionable "use `omnigraph cluster apply`" 409. (An open/unauthenticated
server still 409s, as it has no topology to protect.)

Regression: `schema_apply_route_cluster_backed_denies_unauthorized_actor_before_409`
(POLICY_YAML grants no schema_apply → act-ragnor gets 403, not 409). Addresses the
bot-review finding on #258.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

crates/omnigraph-cli/src/cli.rs

@@ -21,7 +21,7 @@ direct — direct storage access; reject --server (init, optimize, repair, clean
 schema plan, lint).\n  \
 control — manage or inspect a cluster (cluster via --config; policy & queries via \
 --cluster).\n  \
-local — no graph; local config & tooling: embed, login, logout, profile, version.\n\
+local — no explicit graph scope; local config & tooling: alias, embed, login, logout, profile, version.\n\
 See the 'Command capabilities' section of the CLI reference for which flags apply where.")]
 pub(crate) struct Cli {
     /// Actor id for direct-engine writes; overrides `cli.actor`. No effect on
@@ -325,8 +325,7 @@ pub(crate) enum Command {
         command: ClusterCommand,
     },
 
-    // ── Session / config ── no graph addressing; local tooling.
-    /// Policy administration and diagnostics
+    /// Policy administration and diagnostics against a cluster's applied bundles
     Policy {
         #[command(subcommand)]
         command: PolicyCommand,

crates/omnigraph-cli/src/helpers.rs

@@ -367,12 +367,16 @@ pub(crate) async fn execute_operator_alias(
         }
     }
 
-    let body = (!params.is_empty()).then(|| serde_json::json!({ "params": params }));
+    let mut body = serde_json::Map::new();
+    body.insert("expect_mutation".to_string(), Value::Bool(false));
+    if !params.is_empty() {
+        body.insert("params".to_string(), Value::Object(params));
+    }
     remote_json(
         client,
         Method::POST,
         remote_url(&uri, &["queries", &alias.query], &[])?,
-        body,
+        Some(Value::Object(body)),
         bearer_token.as_deref(),
     )
     .await

crates/omnigraph-cli/src/main.rs

@@ -106,15 +106,44 @@ async fn main() -> Result<()> {
                         .profiles
                         .iter()
                         .map(|(name, profile)| {
-                            let binding = match profile.binding(name) {
-                                Ok(ScopeBinding::Server(s)) => format!("server: {s}"),
-                                Ok(ScopeBinding::Cluster(c)) => format!("cluster: {c}"),
-                                Ok(ScopeBinding::Store(u)) => format!("store: {u}"),
-                                Err(e) => format!("invalid: {e}"),
-                            };
+                            let (binding, scope_kind, target, valid, error) =
+                                match profile.binding(name) {
+                                    Ok(ScopeBinding::Server(s)) => (
+                                        format!("server: {s}"),
+                                        "server".to_string(),
+                                        Some(s),
+                                        true,
+                                        None,
+                                    ),
+                                    Ok(ScopeBinding::Cluster(c)) => (
+                                        format!("cluster: {c}"),
+                                        "cluster".to_string(),
+                                        Some(c),
+                                        true,
+                                        None,
+                                    ),
+                                    Ok(ScopeBinding::Store(u)) => (
+                                        format!("store: {u}"),
+                                        "store".to_string(),
+                                        Some(u),
+                                        true,
+                                        None,
+                                    ),
+                                    Err(e) => (
+                                        format!("invalid: {e}"),
+                                        "invalid".to_string(),
+                                        None,
+                                        false,
+                                        Some(e.to_string()),
+                                    ),
+                                };
                             ProfileListItem {
                                 name: name.clone(),
                                 binding,
+                                scope_kind,
+                                target,
+                                valid,
+                                error,
                                 default_graph: profile.default_graph.clone(),
                                 active: active.as_deref() == Some(name.as_str()),
                             }

crates/omnigraph-cli/src/output.rs

@@ -892,6 +892,12 @@ pub(crate) struct ProfileListItem {
     pub(crate) name: String,
     /// `server: <n>` / `cluster: <n>` / `store: <uri>` / `invalid: <reason>`.
     pub(crate) binding: String,
+    /// `server` | `cluster` | `store` | `invalid`.
+    pub(crate) scope_kind: String,
+    /// The bound server/cluster name, or the store URI. `None` when invalid.
+    pub(crate) target: Option<String>,
+    pub(crate) valid: bool,
+    pub(crate) error: Option<String>,
     pub(crate) default_graph: Option<String>,
     pub(crate) active: bool,
 }

crates/omnigraph-cli/src/planes.rs

@@ -98,13 +98,11 @@ pub(crate) fn command_capability(cmd: &Command) -> Capability {
 /// The plane a subcommand belongs to. Exhaustive — a new `Command` variant
 /// will not compile until classified. Descends into the nested enums where
 /// the plane differs per subcommand (`schema plan` is storage while `schema
-/// show`/`apply` are data; `queries validate` opens the graph while `queries
-/// list` only reads config).
+/// show`/`apply` are data; `queries`/`policy` read cluster applied state).
 pub(crate) fn command_plane(cmd: &Command) -> Plane {
     match cmd {
         Command::Query { .. }
         | Command::Mutate { .. }
-        | Command::Alias { .. }
         | Command::Load { .. }
         | Command::Ingest { .. }
         | Command::Branch { .. }
@@ -129,7 +127,8 @@ pub(crate) fn command_plane(cmd: &Command) -> Plane {
         | Command::Cleanup { .. }
         | Command::Lint { .. } => Plane::Storage,
         Command::Cluster { .. } => Plane::Control,
-        Command::Embed(_)
+        Command::Alias { .. }
+        | Command::Embed(_)
         | Command::Login { .. }
         | Command::Logout { .. }
         | Command::Profile { .. }
@@ -175,12 +174,13 @@ pub(crate) fn command_label(cmd: &Command) -> &'static str {
     }
 }
 
-/// The verbs that address an existing graph through a cluster scope
-/// (`--cluster <root> --graph <id>`): the storage-maintenance commands.
-/// `init` is storage-plane too but *creates* a graph (cluster graphs are born
-/// from `cluster apply`, not `init`), and `schema plan` / `lint` take a
-/// positional URI — none consume cluster addressing, so the guard rejects
-/// `--cluster`/`--graph` on them rather than silently dropping the flag.
+/// The verbs that consume a cluster scope. Maintenance/lint select a graph with
+/// `--cluster <root> --graph <id>`; policy/queries inspect the cluster's
+/// applied control-plane state and may optionally use `--graph` to select one
+/// bundle/registry. `init` is storage-plane too but *creates* a graph (cluster
+/// graphs are born from `cluster apply`, not `init`), and `schema plan` takes a
+/// positional URI, so the guard rejects `--cluster`/`--graph` there rather than
+/// silently dropping the flag.
 pub(crate) fn accepts_cluster_addressing(cmd: &Command) -> bool {
     matches!(
         cmd,
@@ -201,12 +201,43 @@ pub(crate) fn accepts_cluster_addressing(cmd: &Command) -> bool {
 /// Reject a scope-addressing flag (`--server`/`--cluster`/`--graph`) on a verb
 /// that cannot consume it, rather than silently dropping it (the old behavior:
 /// e.g. `optimize --server prod` dropped `--server` and failed later with an
-/// unrelated message). Each flag has a distinct valid surface:
+/// unrelated message). `alias` gets an extra guard because its binding owns all
+/// addressing and several ignored globals sit outside this three-flag guard.
+/// Each flag has a distinct valid surface:
 /// - `--server` → served-graph scopes (`any`/`served`);
-/// - `--cluster` → the cluster-maintenance verbs (optimize/repair/cleanup);
+/// - `--cluster` → cluster-scoped direct/control verbs;
 /// - `--graph` → any multi-graph scope: a served scope *or* a cluster one.
 /// RFC-010 Slice 1, generalized for RFC-011 cluster addressing.
 pub(crate) fn guard_addressing(cli: &Cli) -> Result<()> {
+    if let Command::Alias { .. } = &cli.command {
+        let mut flags = Vec::new();
+        if cli.server.is_some() {
+            flags.push("--server");
+        }
+        if cli.graph.is_some() {
+            flags.push("--graph");
+        }
+        if cli.store.is_some() {
+            flags.push("--store");
+        }
+        if cli.cluster.is_some() {
+            flags.push("--cluster");
+        }
+        if cli.profile.is_some() {
+            flags.push("--profile");
+        }
+        if cli.as_actor.is_some() {
+            flags.push("--as");
+        }
+        if !flags.is_empty() {
+            bail!(
+                "`alias` uses the server, graph, and stored query declared in \
+                 `aliases.<name>` in ~/.omnigraph/config.yaml; remove global scope \
+                 flag(s): {}",
+                flags.join(", ")
+            );
+        }
+    }
     if cli.server.is_none() && cli.cluster.is_none() && cli.graph.is_none() {
         return Ok(());
     }
@@ -223,8 +254,8 @@ pub(crate) fn guard_addressing(cli: &Cli) -> Result<()> {
     }
     if cli.cluster.is_some() && !cluster_ok {
         bail!(
-            "`{label}` is a {} command; --cluster addresses a cluster-managed graph for \
-             maintenance (optimize/repair/cleanup) and does not apply.{}",
+            "`{label}` is a {} command; --cluster addresses a cluster-scoped command \
+             and does not apply.{}",
             capability.describe(),
             remediation(capability, &cli.command),
         );
@@ -253,7 +284,15 @@ fn remediation(capability: Capability, cmd: &Command) -> &'static str {
             }
             _ => " Pass a storage URI.",
         },
-        Capability::Control => " It operates on a cluster (pass --config <dir>).",
+        Capability::Control => match cmd {
+            Command::Cluster { .. } => {
+                " It operates on a cluster config directory (pass --config <dir>)."
+            }
+            Command::Policy { .. } | Command::Queries { .. } => {
+                " It operates on a cluster (pass --cluster <dir|uri>, or select a cluster profile)."
+            }
+            _ => " It operates on a cluster.",
+        },
         Capability::Local => " It does not address a graph.",
         Capability::Any | Capability::Served => "",
     }
@@ -286,6 +325,7 @@ mod tests {
         // The one Data→Served refinement — if the `graphs` guard were deleted,
         // every other assertion here would still pass.
         assert_eq!(cap(&["omnigraph", "graphs", "list"]), Capability::Served);
+        assert_eq!(cap(&["omnigraph", "alias", "who"]), Capability::Local);
         assert_eq!(cap(&["omnigraph", "optimize", "graph.omni"]), Capability::Direct);
         assert_eq!(cap(&["omnigraph", "schema", "plan", "--schema", "s.pg", "graph.omni"]), Capability::Direct);
         assert_eq!(cap(&["omnigraph", "cluster", "status", "--config", "."]), Capability::Control);

crates/omnigraph-cli/src/scope.rs

@@ -186,9 +186,9 @@ fn scope_from_binding(
         ScopeBinding::Cluster(cluster) => {
             if capability == Capability::Any {
                 bail!(
-                    "{source} resolves a cluster scope, which is maintenance-only; run \
-                     data commands through a server, or use --store <uri> for ad-hoc \
-                     direct access"
+                    "{source} resolves a cluster scope, which is not valid for graph data \
+                     commands; run data commands through a server, or use --store <uri> \
+                     for ad-hoc direct access"
                 );
             }
             // A cluster value is a config name (resolved against `clusters:`)
@@ -501,7 +501,7 @@ mod tests {
         )
         .unwrap_err()
         .to_string();
-        assert!(err.contains("maintenance-only"), "{err}");
+        assert!(err.contains("not valid for graph data commands"), "{err}");
     }
 
     #[test]