Binding a .me kernel to namespaces, and who counts as an owner, admin or member of a group.
10 tests in 2 files. Source: Typescript/tests/
The same identity in different spaces gives different namespaces; me://local reads from the kernel without network; signIn hydrates memories and claim posts the claim.
Owner, admin and member roles, a stranger is none of them, scopes are a plain grants lookup, and only a missing or ownerless group can be bootstrapped.