[决策] permission 的 ADR-0094 write-through 通道 vs ADR-0005 回滚:补 admission pair 促 promote,还是接受 403 收紧并修订 ADR-0094

[qq9340100]

从 #6483 / PR #6608 的实施测量中拆出(spec 车道 PM 立卡,session_011M7UwH25Unfi73UHim7ajY)。

冲突事实(工头 F 实测,证据链在 PR #6608 分支 head commit)

2026-08-08 三段式裁决把 permission 的 allowOrgOverride 免测量回滚为 false(理据:ADR-0005 原文「silent privilege drift」,未获批的 true 不享疑点利益)。实施测量发现裁决未见的对向事实:

1. ADR-0094 有 2026-07-14 的方向确认:「package 集经 ADR-0005 overlay 做环境定制」—— 写在 plugin-security/src/permission-set-projection.ts 文件头;
2. 该文件 4 处生产写点(:713/:752/:794/:928)saveMetaItem({type:'permission'}) 是活的 write-through 投影路径;
3. 回滚后边界实测:门读 artifact-backing —— code-declared 集(member_default、bootStack 的 showcase_contributor)write-through 拒 403;runtime-created / metadata-door materialized 集不受影响;
4. dogfood 4 条功能 pin 已按裁决①反转为 403 pin(PR fix(spec): ADR-0005 白名单强制 —— 九类未获批 allowOrgOverride:true 回滚为 false (#6483) #6608);仓内活 org-scoped overlay 行 = 0(通道声明了方向但从未在语料里被行使)。

请裁

• A(现状即 PR fix(spec): ADR-0005 白名单强制 —— 九类未获批 allowOrgOverride:true 回滚为 false (#6483) #6608 落地态):接受 403 收紧,修订 ADR-0094 —— 其 write-through 改走别的通道(如 allowRuntimeCreate 层的 materialized 行,边界实测显示该层不受影响)或废弃该方向确认。安全轴最紧;代价 = ADR-0094 的设计方向作废,plugin-security 投影如仍需 artifact-backed 集的环境定制须重新设计。
• B:为 permission 补 ADR-0005 admission pair(overlay schema + 书面 render-only 理据)后 promote 回 true —— 独立 ADR-0005 修订 PR,按 report 先例(2026-05-22)走完整评审。⚠️ ADR-0005 自己的话:「Authorization correctness; overlays would create silent privilege drift」—— render-only 理据在 permission 上可能根本写不出来,写不出来即 B 不可行,自动落 A。
• C:回滚 PR fix(spec): ADR-0005 白名单强制 —— 九类未获批 allowOrgOverride:true 回滚为 false (#6483) #6608 的 permission 一行(保持 true)等 ADR 修订 —— ⛔ 不建议:恢复裁决明指的安全敞口,且与裁决①正文直接冲突。

建议 A,理由:B 的 admission pair 第二半(render-only 理据)与 permission 的授权正确性语义结构性矛盾 —— ADR-0005 把它列 ❌ 正是因为 overlay 改写授权面不可能 render-only;ADR-0094 要的「环境定制」实测已有不受影响的替代层(runtime-create materialized 行)。

Refs #6483、PR #6608、ADR-0005、ADR-0094、#5768(objectui 消费端症状)。

[os-zhuang]

Maintainer ruling (2026-08-08): Option A — approved. Accept the 403 tightening and revise ADR-0094: permission stays non-overridable (allowOrgOverride false per the #6483 ruling), and the write-through direction moves to the allowRuntimeCreate materialized-row layer (measured unaffected) — or the ADR-0094 direction-confirmation is amended accordingly. Option B falls structurally: ADR-0005 lists permission as excluded precisely because an overlay that rewrites the authorization surface can never be render-only, so the admission pair B requires cannot be written. Option C stays excluded per the #6483 ruling.

Completion of this ruling includes landing PR #6608 (currently open) — the code half of option A lives on that branch.

Rationale (three-axis review): the environment customization ADR-0094 wants has an unaffected alternative layer (business); the ADR inventory stays honest instead of carrying a confirmed-but-impossible direction (long-term); on the authorization surface, tightening always beats widening (containment).

State: needs-user-decision removed; pm:queue restored — spec lane (ADR revision plus shepherding #6608).

Maintainer directive (verbatim, covering all 14 inbox cards): 「你的建议全部接受」. Recorded by PM session session_01JaVVMrSxt7Tgi1uwEuDtH7.

---

Generated by Claude Code