Policy: let a grant on a declared operation admit a caller who isn't signed in

.claude/skills/operations-diagnosis/SKILL.md

@@ -116,7 +116,7 @@ The fault line is plain text, so its filter needs no unwrap. `--no-follow` retur
 The fields that answer "why" (cost fields are `policy-performance`'s):
 
 - `outcome` — `allow`, `deny`, `error`, or `pending` (trap 5).
-- `reason` — `granted`; `pending`; a refusal before any predicate ran: `non-grantable` (the operation is declared `nonGrantable`, or is an explain or a validate), `query-lane` (a query, which only the search lane grants), `authorization-infrastructure` (the realm's policy card or config card, or any policy card), `unmatchable-target` (a card whose index row is an error row, a type for anything but `create`, a file for anything but `readSource`, or stored bytes with no type, such as module source), `no-grant` (no rule on the type has a grant for the operation, or the realm names no policy at all); `predicate` (every matching grant's predicate ran and none held); `target-missing` (no index row); `stored-card-refused` (under the lock: the card is gone, stored as another type, or stored as a policy card); `policy-unavailable` (the policy did not compile); `predicate-threw`; `gate-failed` (anything else that threw).
+- `reason` — `granted`; `pending`; a refusal before any predicate ran: `non-grantable` (the operation is declared `nonGrantable`, or is an explain or a validate), `query-lane` (a query, which only the search lane grants), `authorization-infrastructure` (the realm's policy card or config card, or any policy card), `unmatchable-target` (a card whose index row is an error row, a type for anything but `create`, a file for anything but `readSource`, or stored bytes with no type, such as module source), `no-grant` (no rule on the type has a grant for the operation, or the realm names no policy at all), `reads-actor` (a grant opens the operation to a caller who isn't signed in, but the operation as the target's type declares it reads `actor()`); `predicate` (every matching grant's predicate ran and none held); `target-missing` (no index row); `stored-card-refused` (under the lock: the card is gone, stored as another type, or stored as a policy card); `policy-unavailable` (the policy did not compile); `predicate-threw`; `gate-failed` (anything else that threw).
 - `rules` / `grants` — every rule matched on the target's type and every grant in them for the operation, comma-separated in policy order: what a denial was judged by. Empty `rules` means no rule governs the type; `rules` with empty `grants` means a rule governs it but grants nothing under that name.
 - `rule` / `grant` — the one that admitted the invocation; null on anything but an allow.
 - `tier` — `none` (no predicate ran), `stored` (the card's own source), `snapshot` (at least one read the index row).

packages/catalog/test-subset.json

@@ -1,6 +1,6 @@
 {
   "repository": "cardstack/boxel-catalog",
-  "revision": "069ceb061e597b478bb9cd8dfe263826d17805cb",
+  "revision": "776baef8ccd1bc4c370711797374a79905c4e965",
   "files": [
     {
       "path": "realm-policy/realm-policy.gts",
@@ -21,6 +21,7 @@
     "realmServer": [
       "catalog-test-subset-test",
       "realm-policy-activation-test",
+      "realm-policy-anonymous-named-operation-test",
       "realm-policy-anonymous-read-test",
       "realm-policy-anonymous-search-test",
       "realm-policy-anonymous-write-test",

packages/host/tests/integration/realm-policy-test.gts

@@ -756,6 +756,12 @@ module('Integration | realm policy', function (hooks) {
     await renderClassroomPolicy();
 
     assert.dom('[data-test-realm-policy-explain]').exists();
+    assert
+      .dom('[data-test-explain-actor-hint]')
+      .hasText(
+        "Leave this empty to check what someone who isn't signed in can do.",
+        'the person field says how to ask about someone who is not signed in',
+      );
     assert.dom('[data-test-explain-submit]').isDisabled('nothing to ask yet');
     await ask(TEACHER, `${testRealmURL}classrooms/room-204`, 'delete');