docs(cmf): settle the extensions bag contract

[mkoushni]

Summary

• Document the CMF bag contract: per-type absent values, original vs flattened keys, and why subject.claims is not a bag key (docs/cmf-extensions.md).
• Bridge tests assert present-empty StringSets, omitted optionals, and paired original/flattened members.
• ppe-pdp-diff moves present-empty sets into the agreement subset (APL, CEL, cedar-direct, OPA Deny together); unguarded omitted scalars stay on the allowlist.

Closes #18

Changes

Added

• docs/cmf-extensions.md — normative bag contract:
  • per-type absent-value table (StringSet present-empty; optional String/Int/Float omitted; flattened member bools presence-only; non-option scalars always written)
  • original collections vs flattened role.* / perm.* / team.* / client.role.* (authors should use the original set; last bag.set wins if they disagree)
  • why there is no subject.claims map in the bag (would need a sixth AttributeValue variant and would duplicate flattened claim.*)
  • what APL, CEL, cedar-direct, and OPA do with a missing key
  • catalog of all twelve extract_extensions slots, keys, and types
  • payloads that are not slots (args.* / result.* / data.*; raw_credentials and candidate_constraint stay out of the bag)

ppe-apl-cmf

• src/lib.rs — rustdoc points at docs/cmf-extensions.md.
• src/extensions_bridge.rs — rustdoc on extract_extensions restates the per-type contract.
  • present_slots_follow_the_absent_value_contract — present empty slots emit empty sets, omit optionals, skip flattened bools, write non-option zeros/false, and never emit a subject.claims parent key.
  • original_set_and_flattened_bools_stay_paired — a member in the set also appears as the flattened bool, and both stay in lockstep.

ppe-pdp-diff

• Cargo.toml / Cargo.lock — dev-deps on praxis-policy-apl-cmf and praxis-policy-core so cases can build bags through extract_extensions.
• README.md — present-empty StringSet is in the semantic subset; new allowlist rows for omitted claim scalars; pointer to docs/cmf-extensions.md.
• src/cases.rs
  • Case.apl_rule + with_apl so agreement cases also run the native APL evaluator.
  • alice_via_bridge() — bag from extract_extensions, not a hand-built set.
  • empty-set — recategorized from Diverge to AgreeDeny; APL require(subject.teams contains "eng").
  • bridge-empty-teams — same intent, bag from the bridge.
  • bridge-empty-roles — empty subject.roles / no role.* keys; Cedar principal.roles.contains("hr") vs CEL/OPA original set vs APL require(subject.roles contains "hr").
  • missing-claim-string / missing-claim-int — unguarded omitted scalars (allowlisted).
• src/allowlist.rs
  • removed empty-set (now subset).
  • added missing-claim-string and missing-claim-int.
  • rewrote missing-collection to point at the contract and the original-set cases.
• src/lib.rs
  • assert_apl on AgreeAllow / AgreeDeny.
  • absent_value_agreement_cases_check_apl — empty-set, bridge-empty-teams, and bridge-empty-roles must carry an APL rule.

Changelog

• CHANGELOG.md — Unreleased Added bullet for fix(cmf): settle the extensions model and document the extension types #18; feat(test): differential testing across cedar, cel, and opa #25 subset text updated (present-empty sets in subset; omitted claim scalars on the allowlist).

Test plan

• make lint
• cargo test -p praxis-policy-apl-cmf
• cargo test -p praxis-policy-pdp-diff
• make coverage (95.74% lines, floor 95%)
• CI on this PR