fix(spec): ADR-0005 白名单强制 —— 九类未获批 allowOrgOverride:true 回滚为 false (#6483) - #6608
Open
qq9340100 wants to merge 2 commits into
Open
fix(spec): ADR-0005 白名单强制 —— 九类未获批 allowOrgOverride:true 回滚为 false (#6483)#6608qq9340100 wants to merge 2 commits into
qq9340100 wants to merge 2 commits into
Conversation
…6483) 依据 2026-08-08 维护者三段式裁决(issue #6483,os-project-manager 评论)执行, 与 #6283(flow)同一裁决家族。ADR 锚:docs/adr/0005-metadata-customization-overlay.md:53-68 (租户可定制类型白名单 + 收尾段「新类型默认 false + admission pair」)。 ━━━ 逐类型交付表(registry 行号为本分支最终行号 / origin/main 行号)━━━ 裁决分支①(立即回滚,免测量;row counts 仍测量入档): - permission registry 877 (main 820) true→false 测量: 0 条仓内活 org-scoped overlay 行; 但发现 1 条生产写路径:plugin-security ADR-0094 write-through (permission-set-projection.ts:713/752/794/928,方向确认注释 2026-07-14)。 详见下方「ADR-0094 冲突证据」。ADR 锚: ADR-0005 security 行(:58) - tool registry 970 (main 904) true→false 测量: 0 行、0 生产写点。ADR 锚: ai 行(:60) - skill registry 971 (main 905) true→false 测量: 0 行、0 生产写点。ADR 锚: ai 行(:60) 裁决分支②(先测量后定;六类全部测得 0 行 ⇒ 全部回滚): - page registry 675 (main 653) true→false 0 行。ADR 锚: ui ❌ 行(:62) - app registry 677 (main 655) true→false 0 行;生产写点 runtime/domains/packages.ts:232 (ADR-0045 publish unhide)经核实走 allowRuntimeCreate 层(DB-materialized 行, sys_metadata provenance ≠ artifact),不受影响。ADR 锚: ui ❌ 行(:62) - action registry 681 (main 656) true→false 0 行;其 supportsOverlay:false 与 true 并存 即 #6283 flow 的 #6190 幽灵写形态,本次一并关闭。ADR 锚: ui ❌ 行(:62) - dataset registry 685 (main 660) true→false 0 行;表中缺席 ⇒ 收尾段默认 false。 - book registry 852 (main 817) true→false 0 行;表中缺席 ⇒ 默认 false。 - position registry 878 (main 821) true→false 0 行;表中缺席 ⇒ 默认 false。 admission pair 测量:九类均有 resolveOverlaySchema() 接受的 overlay schema (schema registry 统一后 (a) 恒真),九类均无 ADR-0005 要求的书面 render-only 理据 ⇒ (b) 全部不成立。无「有行且理据齐全」形态,无需 promote 保留。 对照组不动(核实):view 674 / dashboard 676 / report 682 = true; translation/email_template = true;flow 717 = false(#6283/PR #6478 已合并,未触碰)。 ━━━ 测量方法(入档)━━━ 1. 种子/夹具静态扫描: grep 全仓 *.seed.{ts,yml,json}·examples/·dogfood 数据· sys_metadata insert 点 —— 仅 1 个生产 insert(repository 本身),0 条九类 overlay 行。 2. 逐类型字面量普查: grep "type: '<t>'" 全仓非测试代码,逐文件人工分类 (artifact 定义 vs overlay 写)。 3. 决定性实验:九类临时全部翻 false,跑 spec/metadata-protocol/objectql/rest/runtime/metadata/plugin-security/dogfood 全套 —— 失败 16 例 = 精确爆炸半径(全部为测试对旧 true 值的依赖,逐一如实对齐, 无一静默放宽;清单见下)。 ━━━ 写侧消费者核实 ━━━ - OVERLAY_ALLOWED_TYPES (metadata-protocol/src/protocol.ts:6954) 派生读取 ✓ 自然收敛 - assertAllowed 白名单 (metadata-protocol/src/sys-metadata-repository.ts:184,995) 派生读取 ✓ 自然收敛 - 无任何硬编码副本需要对齐;promoteDraft 生产调用方(protocol.ts:8799)已正确 按 isArtifactBacked 传 intent,无需改动(仅测试补传 intent)。 ━━━ 测试随动(16 处失败 → 全绿)━━━ 新增: metadata-protocol/src/protocol.adr0005-org-override-rollback.test.ts (40 例:9×声明 pin + 9×2 403 拒绝(org-scoped/无 environmentId)+ 9×runtime-create 仍开 + 派生集 pin + action 幽灵形态 pin + view/dashboard/report 对照) 对齐(specimen 改走 OS_METADATA_WRITABLE 文档化逃生门,机制覆盖不降): - protocol.save-receipt-wording.test.ts / protocol.delete-receipt-wording.test.ts (overlay-less-yet-overridable 种群 pin 为空集 + ACTION 收据案例挂逃生门) - objectql/protocol-registry-shadow.test.ts(4 例,app 信封机制) - objectql/protocol-meta.test.ts([#5265] app 收据案例) - runtime/meta-overlay-read-your-writes.test.ts(action shadow/restore 机制) 对齐(断言新行为): - objectql/overlay-precedence.test.ts(permission/position 期望 false + 重引入护栏注释) - objectql/sys-metadata-repository.test.ts(promoteDraft 测试补 intent:'runtime-only', 与生产调用方一致) 反转(ADR-0094 行为 pin → 403 拒绝 pin,见冲突证据): - dogfood/showcase-permission-projection.dogfood.test.ts(2 例反转 + 文件头改述) - dogfood/two-doors-permission.dogfood.test.ts(块2 两例反转 + env-authored 案例 换真正 runtime-authored specimen + 新增 artifact-backed 拒绝案例) ━━━ ③ 治理锚 ━━━ - registry 四个域段落均加 ADR-0005 + #6483 注释(ui 段 675-685 前、book 852 前、 security 877 前、ai 970 前),含「promote 须修订 ADR-0005 而非改本文件」指路。 - scripts/adr-anchors.json 新增 packages/spec/src/kernel/metadata-plugin.zod.ts → ADR-0005 锚(#6191 同机制);check:adr-anchors 39/39 OK。 ━━━ 验证读数 ━━━ - spec test: 342 files / 8786 全绿;spec typecheck 绿 - metadata-protocol test: 58 files / 651+40 全绿 - objectql: 147 files / 2470 全绿;runtime: 111 files / 1611 全绿 - metadata / plugin-security / rest / dogfood: 全绿(dogfood 86 files, permission 两文件 13/13) - check:adr-anchors OK(39);check:generated 10/10(registry 值不入生成物, authorable-defaults 仅含 schema 默认值 false,无需重生成) - pnpm lint(改动文件)0 error;三示例 objectstack validate exit 0/0/0 (仓内自身元数据不依赖被回滚的 overlay 能力,warnings 为存量与本单无关) - 逆向验证(方向先判后跑):skill false→true 重建后,预测 4 红 (声明 pin + 派生集 pin + 2 拒绝断言以「promise resolved {success:true} instead of rejecting」形态红)/其余 36 绿;实测 4 红/36 绿,恢复后 40/40 绿。 - push 前已 merge 最新 origin/main(d0a5ceb,快进,无重叠文件);合并基座上 复跑:metadata-protocol 58 files/651 全绿、spec test+typecheck 与 objectql 全绿、check:adr-anchors 39 OK、check:generated 10/10、ADR-0087 门禁绿。 ━━━ ADR-0094 冲突证据(留独立 ADR-0005 修订单裁处)━━━ permission 回滚与 ADR-0094「2026-07-14 方向确认:package 集经 ADR-0005 overlay 做环境定制」直接冲突。证据链: 1. plugin-security/src/permission-set-projection.ts 文件头注释明写该方向及日期; 写路径 4 处 saveMetaItem({type:'permission'})。 2. dogfood 两文件 4 例曾以功能 pin 固化该行为(本 commit 已按裁决反转为 403 pin)。 3. 其单测 permission-set-projection.test.ts 为 mock saveMetaItem 的隔离 harness, 感知不到真实门 —— 回滚后依旧全绿(未改动;真实门行为由 dogfood + 新增 403 套件覆盖)。 4. 行为边界实测:门读 artifact-backing 而非记录 managed_by —— code-declared 集(member_default、bootStack 下的 showcase_contributor)拒 403; runtime-created / metadata-door materialized 集(sys_metadata provenance) 经 allowRuntimeCreate 层不受影响。 若维护者意图保留 ADR-0094 定制通道,应在独立修订单中为 permission 补 admission pair 后 promote —— 本 PR 未做任何 promote。 changeset: .changeset/adr0005-nine-type-org-override-rollback.md(minor —— 实测 全类型 0 活行,按裁决口径 minor 如实写明 403 行为收紧;ADR-0087 门禁绿, 无 breaking 声明故无需处置标记)。 范围红线遵守:未动 flow 行;未做 promote;未动 objectui(#5768 症状在 changeset/注释中交叉引用);未动 content/docs/releases/。 Closes #6483 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DE52u4GiUSiVh1F7F75arw
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
Contributor
📓 Docs Drift CheckThis PR changes 1 package(s): 112 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
github-actions
Bot
added
documentation
…teral union check:type-check-debt --re-measure caught +2 in metadata-protocol's DEBT layer (63 -> 65): ROLLED_BACK and CONTROLS were bare string[], and the derived-set pin calls Set<RegistryType>.has() on them. Typed via the registry's own literal union — as const satisfies for the controls, a cast for Object.keys(BODIES) whose keys are the nine rolled-back types by construction. tsc raw count back to 63; the 40-case suite stays green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #6483
依据 2026-08-08 维护者三段式裁决(issue 评论)执行,与 #6283(flow 行)同一裁决家族。完整交付表、测量方法、16 处测试随动清单与验证读数见分支 head commit message(
95ef570fb)—— 本正文摘要三个复核要点与一处需维护者知情的冲突。交付摘要
permission/tool/skill→false(row counts 仍测量入档:全部 0 条仓内活 org-scoped overlay 行)。page/app/action/dataset/book/position六类全部实测 0 行 ⇒ 全部回滚。admission pair 测量:九类均无 ADR-0005 要求的书面 render-only 理据,无「有行且理据齐全」形态,无 promote。scripts/adr-anchors.json登记(ADR-0005 的租户可定制白名单表说flow/workflow/approval一律 ❌ per-org override,注册表却写着allowOrgOverride: true——反转没有走 ADR(Prime Directive #13) #6191 同机制),check:adr-anchors39/39 OK。OVERLAY_ALLOWED_TYPES/assertAllowed)均为派生读取,自然收敛,零硬编码副本。allowOrgOverride:true回滚为 false——#6155 Q1=B 裁决的契约半边,同步了结 #6191 #6283 已落)核实未触碰。permission回滚与 ADR-0094「2026-07-14 方向确认:package 集经 ADR-0005 overlay 做环境定制」直接冲突 —— plugin-security 的permission-set-projection.ts有 4 处生产写点(:713/:752/:794/:928),回滚后 code-declared 集的 write-through 拒 403(runtime-created / metadata-door materialized 集经 allowRuntimeCreate 层不受影响)。裁决①明令 permission 免测量回滚且「爆炸半径入档」,故本 PR 按裁决执行并把 dogfood 两文件 4 条功能 pin 反转为 403 pin;若维护者意图保留 ADR-0094 定制通道,应在独立修订单中为 permission 补 admission pair 后 promote —— 本 PR 未做任何 promote。该裁处已由 PM 立决策卡跟踪。交付通道注记
云端工头 F 会话(
session_01DE52u4GiUSiVh1F7F75arw)无 GitHub 工具,走交付降级通道:dev 实现并 push 分支,PM(session_011M7UwH25Unfi73UHim7ajY)代开本 PR 并跟进 CI 至合并。Generated by Claude Code