claude
958d2a2fc8
scope.domain.action, the shape Hexis has always spoken, derived from the row rather than stored — a derivation is one place to argue with, a column is whatever the last person to enable the tool typed. The name stays the primary key and nothing about lookup or execution changes: this is a way to read the allowlist, not a second allowlist. MatchCapability widens one way, so house.lock covers every action on the locks and nothing narrower can claim a wider pattern.