- GatewayDispatch now refuses (FORBIDDEN, pre-dispatch) any op whose
spec gates on access_control.resource_type when no ownership
provider is wired — invoke, invoke_streaming, and invoke_sink alike
- Predicate is resource_type, not resource_id_path as review 012
first drafted: AccessControl::check consults the provider whenever
the resource type is set, including the list/owns_any case; the
refusal message is operator-directed and names both opt-ins
- Exemptions: resource_action-only ACLs (no provider is consulted on
the wire either) and Internal-visibility ops (spec-404, no
acknowledgment leak)
- with_static_ownership_fallback(): declared opt-out to the ADR-011
static fallback for deployments with no runtime ownership model —
the door contract becomes enforceable, not just documented
- Superseded the pre-ruling pin
gateway_without_provider_admits_only_the_static_claim with refusal/
opt-out/exemption tests (all three entry points covered)
- ADR-048 amendment records the ruling; review 012 status updated
Blast-radius survey: alkhttp is the only live GatewayDispatch
consumer (unpublished, three unwired sites); alkblobs the only live
resource_type op producer (serves native-wire, providers wired);
no published 0.9.0 consumer relies on the silent fallback for such ops.
Ships in the same unreleased batch as the review-012 amendment.
Verification: cargo test (697 pass), cargo test --features gateway
(720 pass), cargo clippy --all-features --all-targets -- -D warnings,
cargo fmt --check, fuzz corpus replay (5 pass)
glm-5.3-flash
9899b37a82