feat(spec)!: HierarchyScopeContext 增必填 posture 信号 —— single 姿态下 DEPTH 合法解析 (#6139) - #6366
Merged
Merged
Conversation
origin/main 上两个已接受立场互相矛盾,resolver 无法同时满足: 1. `IHierarchyScopeResolver.resolveOwnerIds` 要求实现在 `organizationId` 为 `null` 时**无条件** fail closed(「no org 不是 every org」,#5852/#5973)。 2. 裁 C(#5859,PR #6067 落地)要求 single 姿态部署 —— 根本没有组织 —— 喂显式 null 且 DEPTH 照常生效。 `HierarchyScopeContext` 无从分辨这两个 `null`,于是严格 spec-conformant 的 resolver(cloud PR #1196 就是照字面无条件 fail-close)必然杀死每一个 single 姿态部署上的企业 DEPTH。契约要求的,正是平台裁决禁止的。 FROM `{ userId, organizationId: string | null, tenantId? }`,null 组织 ⇒ 永远 fail closed。 TO 同上 + **必填** `posture: TenancyPosture`(ADR-0105 D1),义务改为由两个 字段共同判读: - `single` + `organizationId: null` —— **合法**。压根没有组织维度,`null` 即 那唯一的隐式租户;resolver 必须照常解析 DEPTH。在此拒绝不是保守,而是为每一个 无组织部署退役了层级作用域。 - `group` / `isolated` + `null` —— **严格 fail closed**。墙在生效,`null` 是 缺失的约束。这一半未变、未放松 —— 它正是关掉 #5852 跨组织提权的那一半。 选结构化信号而非散文豁免:散文无法被真正需要据此行动的代码读到 —— resolver 跑在 企业包里,它需要的是调用时的部署事实,不是一段话。 `posture` 必填,理由与 #5858 令 `organizationId` 必填完全同构:漏传的 producer 必须**编译失败**,而不是把 `undefined` 丢给每个 resolver 去猜 —— 一种猜法跨组织 泄露,另一种静默杀死 DEPTH。对**构造** HierarchyScopeContext 的一方这是破坏性 变更;IHierarchyScopeResolver 的实现方源码兼容,但只看 organizationId 的 resolver 不再 conformant,应改为两字段合读。 producer 侧不增成本:开源 sharing 层本就要解析姿态来决定是否咨询 resolver。该 推导现在收敛到一处(effectiveTenancyPosture()),本地拒绝改由它表达,使「拒绝」 与「上报的姿态」不可能各走各的。仍然 fail closed —— 姿态不可解析时上报最严格的 带墙姿态,绝不是 `single`。 showcase-scope-depth dogfood 用例改用**spec-conformant** 参考 resolver,并按真实 接口定型。原 fixture 取 `c: any` 且完全无视租户字段 —— 这正是 20 条 single 姿态 e2e 一路绿灯的原因:从来没有 spec-conformant 的 resolver 被练到,CI 因此看不见这 个矛盾。已验证非空转:把旧的无条件规则放回去,三条 DEPTH 证明立刻失败。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011M7UwH25Unfi73UHim7ajY
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
Contributor
📓 Docs Drift CheckThis PR changes 2 package(s): 112 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
github-actions
Bot
added
size/m
documentation
qq9340100
marked this pull request as ready for review
August 7, 2026 16:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #6139
执行 2026-08-07 维护者裁决,取结构化信号路线(散文豁免未启用):
HierarchyScopeContext增必填posture: TenancyPosture(复用 ADR-0105 D1 既有词汇,type-only import,契约模块零运行时耦合);resolveOwnerIds义务改为双字段判读 ——single+null org 合法、DEPTH 照常;group/isolated+null 的 fail-closed 义务逐字保持(#5852 那半边显式重 pin 为 STRICT)。生产侧收敛为单一effectiveTenancyPosture()计算,本地拒绝与上报姿态同源、不可漂移;不可解析姿态回落'isolated'(最严),永不猜'single'。反空洞实测(本卡最要紧的验证):dogfood 参考 resolver 改为 spec-conformant 并类型化后,临时恢复旧的无条件
null→[meId]会让 3 条 DEPTH 证明转红 —— 直接测量了「CI 看不见矛盾」的原病灶(旧c: anyfixture 下同样 3 条在杀 DEPTH 的 resolver 面前保持绿)。HierarchyScopeContext未声明organizationId/tenantId哪个权威 —— producer 只填一个、consumer 只读另一个,两边都「符合契约」 #5858 在同一接口加必填 organizationId 的同款定级先例);posture必填是 deliberate call(可选会逼 resolver 猜,两种猜法都是缺陷);若倾向 optional-then-required 两段迁移,回退成本已在终报写明;context.posture !== 'single'门),参考实现可逐字照抄本 PR 的 dogfood resolver。Generated by Claude Code