feat(spec): explicit engine-owned managedBy bucket (ADR-0103 addendum, #3343)#3352
Merged
Conversation
…dendum, #3343) ADR-0103 deferred the enum split ("revisitable later as a rename") because a new `managedBy` value would fall through to the fully-editable `platform` default on deployed Console clients. Both objections are now retired — the server-side write guard / apiMethods reconciliation / /me/permissions clamp make that fallthrough cosmetic (the write is rejected regardless of what the client renders), and objectui#2712 closed the UI union — so v16 lands it additively. - spec: new enum value `engine-owned` with the same all-locked default affordance row as `system`; joins ENGINE_OWNED_BUCKETS (guard) + GUARDED_WRITE_BUCKETS (clamp). Guard / reconcile / clamp MECHANISMS unchanged — engine-owned is an explicit member of the set they already covered by resolved affordance. - relabel 20 objects `system → engine-owned` (metadata store, jobs, approvals runtime rows, sharing rows, automation runs, messaging delivery/receipt, secrets, settings) — one-line, behaviour-identical each. - 8 admin/user-writable objects keep `managedBy: 'system'` (RBAC link tables, prefs, approval delegation, messaging config) — `system` now means "engine-managed schema, writable via userActions". - tests: engine-owned coverage in system-write-guard / fold-wildcard-superuser / object affordance-matrix; ADR-0103 addendum; objects.mdx + regenerated ref. Behaviour-, enforcement- and wire-identical: a self-documenting relabel, no data migration, no code branches on the `'system'` literal. Retiring the overloaded `system` (moving the 8 writable objects out) is a breaking rename deferred to v17. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 9 package(s): 112 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Item #2 of the
managedBytaxonomy tracking issue #3343 — the enum split ADR-0103 explicitly deferred ("revisitable later as a rename"), landed for v16 as an additive, self-documenting relabel.Why now (the ADR-0103 D1 objections, resolved)
ADR-0103 chose
userActionsover a new enum value for two reasons, both now retired:apiMethodsreconciliation,/me/permissionsclamp). An unknown bucket resolving to theplatformdefault on an old client is now cosmetic — the write is rejected regardless of what the client renders. (Re-verified: a generic/datacreate on an engine-owned object returns 405.)ManagedByBucketunion is now a single closed type, so a missed reference is a compile error.Full rationale in the ADR-0103 addendum (in this diff).
What changed (additive —
systemis retained)engine-ownedwith the same all-locked default affordance row assystem. JoinsENGINE_OWNED_BUCKETS(guard) +GUARDED_WRITE_BUCKETS(clamp). The guard /reconcileManagedApiMethods/ clamp mechanisms are unchanged — engine-owned is an explicit member of the set they already covered by resolved affordance.system → engine-owned— the ones the engine owns end to end with no write-openinguserActions(metadata store, jobs, approval runtime rows, sharing rows,sys_automation_run, messaging delivery/receipt, secrets, settings). One-line, behaviour-identical each.managedBy: 'system'(RBAC link tables,sys_user_preference,sys_approval_delegation, messaging config grids) —systemnow reads as "engine-managed schema, writable viauserActions".Not a behaviour/enforcement change
Resolved affordances, the guard verdict, the 405 reconciliation, and the permissions clamp are identical before and after — a self-documenting relabel. No data migration (
managedByis schema metadata), and no code branches on the'system'literal (all enforcement keys offresolveCrudAffordances/ bucket-set membership — verified by grep).Tests / gates
engine-ownedcoverage:system-write-guard.test(guard fires on the explicit bucket),fold-wildcard-superuser.test(/me/permissionsclamp),object.test(affordance matrix parity + enum accepts the value). All existing affordance/guard tests green (spec 107, plugin-security 12, hono 10, registry 73, identity 15).tsc --noEmitclean; generated references regenerated (check:docs/check:api-surface/check:spec-changes/check:upgrade-guide/check:skill-refs/check:react-blocksall green).objects.mdxupdated.Companion / sequencing
Paired with objectui#2739 (the
ManagedByBucketunion + badge). The vendored console is re-pinned before v16 GA; during any sync window an old console renders anengine-ownedobject editable but the server still 405s the write. Retiring the overloadedsystem(moving the 8 writable objects to a dedicated bucket) is a breaking rename deferred to v17.🤖 Generated with Claude Code