From 4fae70fe1fa33cb84757b5fde08e384394d71e43 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 6 Aug 2026 15:15:56 +0000 Subject: [PATCH] =?UTF-8?q?docs(adr-0094):=20sys=5Fcapability=20=E8=A1=8C?= =?UTF-8?q?=E6=8C=89=20curated/derived=20=E4=B8=A4=E5=8D=8A=E4=BF=AE?= =?UTF-8?q?=E6=AD=A3=20label/description=20=E7=9A=84=E5=88=B7=E6=96=B0?= =?UTF-8?q?=E5=8F=A3=E5=BE=84=20(#5935)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #5876(PR #5934)之后,`bootstrapSystemCapabilities` 的两半对既有行的 display 字段有不同权限:curated(`PLATFORM_CAPABILITIES`)仍每 boot 刷新 label/description (平台自撰文案,新版本合法地发新 copy);derived 占位符只 reconcile `managed_by:'platform'` 的行,admin/package 等其它出处一律跳过。 ADR-0094 2026-07-14 附录的 per-type 决策表里,`sys_capability` 行仍写着无限定的 "`label`/`description` are platform-owned and refresh each boot",单独读起来像是 "任何行的 display 字段都可以每 boot 覆盖" 的授权 —— 正是 Prime Directive #13 提醒的 形态(下一位作者读的是表格行,不是上方通则)。本次只把该行改到与其上方通则 ("the seeder must not clobber an environment-edited record")一致。 不含任何新决策内容:保留 `#2909 T3` 引用,追加 `#5876`;`managed_by`/`active` 仍为 preserved,`scope` 仍为 seed-once。docs-only,单文件单表行。 Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01JwwiU9bjhwy2SWj13ho8uv --- docs/adr/0094-sys-permission-set-pure-projection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/adr/0094-sys-permission-set-pure-projection.md b/docs/adr/0094-sys-permission-set-pure-projection.md index d366f5b220..16622c2aa9 100644 --- a/docs/adr/0094-sys-permission-set-pure-projection.md +++ b/docs/adr/0094-sys-permission-set-pure-projection.md @@ -303,7 +303,7 @@ only a seed-not-clobber discipline. | `sys_permission_set` | metadata (`PermissionEvaluator.resolvePermissionSets` → `metadata.list('permission')`, DB row only as fallback) | metadata-authoritative | **Record is a projection — done** (this ADR). | | `sys_sharing_rule` | the record, live (`sharing-plugin.ts` "rule evaluation reads `sys_sharing_rule` live"; `sharing-rule-service` `engine.find`) | **record-authoritative** | **Resolved (#2909 P0/T1)**: declared rules are a **boot seed**; the record is the authority; not projected. Rows carry readonly `managed_by` (unified A4 tri-state) + `customized` provenance; the seeder (`defineRule` in seed mode, `managedBy:'package'`) adopts pristine/legacy rows and keeps updating them, but **never overwrites admin-authored or `customized` rows** — an admin's `active:false` on an over-sharing rule survives redeploys. A `beforeUpdate` hook stamps `customized` on any non-system edit of a seeded row. | | `sys_position` | mixed — position→permission-set resolution is metadata-first for the *sets*, but the `sys_position` **record** (incl. its `permissions` field, bindings, `delegatable`, `admin` gating) is read live by the anchor gate and `DelegatedAdminGate` | **record-authoritative** (bindings and lifecycle), with metadata seeding **identity + display only** | **Resolved (#2909 T2)**: declared positions are seed-only — `bootstrapDeclaredPositions` refreshes `label`/`description` and nothing else; bindings/`active`/`is_default`/`delegatable`/`managed_by` belong to the runtime/admin. Locked by `bootstrap-declared-positions.test.ts`. | -| `sys_capability` | the record (curated registry read for capability existence) | record-authoritative (registry) | **Resolved (#2909 T3)**: seed-not-clobber holds — `label`/`description` are platform-owned and refresh each boot; `managed_by`/`active` were already preserved; `scope` is an admin-editable classification face and is now **seed-once** (insert only). Locked by `bootstrap-system-capabilities.test.ts`. | +| `sys_capability` | the record (curated registry read for capability existence) | record-authoritative (registry) | **Resolved (#2909 T3)**: seed-not-clobber holds — `label`/`description` refresh each boot **for the curated platform definitions** (`PLATFORM_CAPABILITIES`, platform-authored copy); the back-compat **derived** placeholders (`humanize(name)` label, generated `Capability` description) reconcile only rows the derivation itself owns (`managed_by:'platform'`), never a row authored elsewhere — `admin`, `package`, or any other provenance (#5876). `managed_by`/`active` were already preserved; `scope` is an admin-editable classification face and is now **seed-once** (insert only). Locked by `bootstrap-system-capabilities.test.ts`. | Only `sys_permission_set` was both metadata-authoritative **and** carried a harmful, actively-drifting split-brain, which is why it was fixed first and in