feat(security): permission-set package provenance + bootstrapDeclaredPermissions (ADR-0086 P1)#2566
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 3 package(s): 95 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
This was referenced Jul 4, 2026
This was referenced Jul 4, 2026
os-zhuang
force-pushed
the
claude/adr-0086-p1-permission-provenance
branch
from
July 4, 2026 08:36
a411557 to
007d196
Compare
…Permissions (ADR-0086 P1) Packages now ship working default access for their own objects, with a machine-checkable metadata↔config boundary: - spec (D3): PermissionSetSchema.packageId (owning package; absent = env-authored) + per-record managedBy provenance on the existing metadata-persistence axis (package | platform | user). Persisted on sys_permission_set as package_id / managed_by (+ package_id index for uninstall/upgrade queries). - seeding (D5): bootstrapDeclaredPermissions — the sibling of bootstrapDeclaredRoles — materializes stack.permissions into sys_permission_set at boot with managed_by:'package' + package_id. Idempotent + upgrade-aware: own rows re-seeded to the shipped declaration every boot; foreign-package rows refused loudly (D4: a package never writes into a foreign record); env-authored platform/user/legacy rows (incl. bootstrapPlatformAdmin defaults) never clobbered. Closes the ADR-0078 inert-metadata violation for stack.permissions. - conformance matrix row declarative-permission-seeding (ADR-0056 D10) + dogfood proof (showcase-permission-seeding) pin the behavior; liveness ledger entries for the two new spec props. Verified: plugin-security 7 files / spec 245 files / dogfood 37 files green; live showcase boot shows showcase_contributor + showcase_member_default seeded with package provenance while admin_full_access / member_default stay env-owned. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014y5kiH3aPLWtRRRGcVrXcT
os-zhuang
force-pushed
the
claude/adr-0086-p1-permission-provenance
branch
from
July 4, 2026 08:58
007d196 to
2159184
Compare
os-zhuang
marked this pull request as ready for review
July 4, 2026 09:10
8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概述
落地 ADR-0086 P1(framework 侧)(#2561 P1 首项;ADR 正文见 #2559):权限集的包来源轴 + 声明式播种,让「包为自己的对象自带默认访问」成立,并关闭
stack.permissions的 ADR-0078 惰性元数据违规。与 objectui#2221(ADR-0086 P0,Access 矩阵按包限定作用域)是同一 ADR 的两端:本 PR 落地记录级
package_id后,前端切片合并可以直接用来源轴,不必依赖 manifest 对象清单的临时方案。变更
Spec(ADR-0086 D3)
PermissionSetSchema.packageId—— 包携带的权限集的属主包(缺省 = 环境自建)PermissionSetSchema.managedBy—— 每记录来源,复用 metadata-persistence 既有词汇(package | platform | user),不引入新轴sys_permission_set对象新增package_id/managed_by列 +package_id索引(卸载/升级按包查询)播种(ADR-0086 D5)
新增
bootstrapDeclaredPermissions——bootstrapDeclaredRoles的严格同构兄弟,kernel:ready时把stack.permissions物化进sys_permission_set:managed_by:'package'+package_id(registry_packageId优先,specpackageId兜底;二者皆无 → warn + 跳过)managed_by:'package'且同包managed_by:'package'且异包platform/user/ 无来源(遗留行,含 bootstrapPlatformAdmin 默认集)护栏
declarative-permission-seeding(enforced,ADR-0056 D10)——播种不可能再静默退回惰性showcase-permission-seeding.dogfood.test.tspackageId/managedBy两条(live + 证据)验证
--fresh启动,登录 admin 后查 API):声明集带来源落库、平台默认集保持环境所有——与 D3/D5 语义逐条对应。
关联
🤖 Generated with Claude Code
https://claude.ai/code/session_014y5kiH3aPLWtRRRGcVrXcT
Generated by Claude Code