glm-5.3-flash
c4b9c53674
Resolves review 001 finding A-1 (critical): ADR-012 §3's "scope
git:admin OR ownership" gate is not expressible in alkcall's
AccessControl (AND-composition). Resolution is the review's option (a)
shape with the OR-term generalized: the per-repo grant action set gains
manage, authorize(record, identity, read|write|manage) becomes the
single policy function for git access and repo administration, and the
delete/update/get gate is admin scope OR manage grant (handler-side,
generic FORBIDDEN, unknown-repo = unauthorized per ADR-008). Repo
create seeds the creator's {read, write, manage} grants —
administration is grantable, so collaborators/bots/app-compiled roles
work without global scopes. Ownership stays as alkcall spawn-tracking
(mint at create unchanged); "ownership never implies git access" is
superseded.
- ADR-015 (new): manage grant tier, op gate, flat-grants-as-replication-
substrate, opaque grant-key rule
- ADR-011: action set + policy domain amended, references updated
- ADR-012 §3: gate table replaced, two-tier paragraph superseded
- backend.md/doors.md/overview.md: gate + grant restatements, ADR tables
- OQ-16 (new, deferred(scope)): grant-key identity namespace —
globally-comparable ids for cross-assembly/replicator grant state;
tracker task tasks/architecture/oq-16-grant-identity-namespace.md
- review 001: A-1 marked resolved (ADR-015)
- vision.md: supersession notes (Internal-ops framing, v1 grant set)
Verification: cargo test, clippy -D warnings, fmt --check, doc --no-deps
all clean.
53 lines
1.9 KiB
Markdown
53 lines
1.9 KiB
Markdown
---
|
|
id: architecture/oq-16-grant-identity-namespace
|
|
name: OQ-16 unblock — first cross-assembly record sharing
|
|
status: pending
|
|
depends_on: []
|
|
scope: narrow
|
|
risk: trivial
|
|
impact: component
|
|
level: research
|
|
tags: [external-trigger, deferred-oq]
|
|
---
|
|
|
|
## Description
|
|
|
|
Tracker for OQ-16 (`deferred(scope)`): the grant-key identity namespace.
|
|
Grants on `RepoRecord` key on opaque identity-id strings (ADR-011,
|
|
ADR-015 §7). Within one assembly those are alkcall's cluster-local
|
|
`Identity.id` — sufficient for v1. The question of a
|
|
globally-comparable id format (compound `{namespace}/{id}` shapes,
|
|
did-key/contract-derived identifiers, or (authority, local-id)
|
|
tuples) only becomes real when repo records are shared across
|
|
assemblies — the distributed-git/replicator phase, where a hub mirrors
|
|
grant state published by an external authority.
|
|
|
|
Constraints any resolution must satisfy are already recorded in the OQ
|
|
entry (ADR-015 §7): grants stay flat sets keyed on opaque strings;
|
|
alkgit never parses or interprets the id; collision-freedom is the
|
|
identity-provider's guarantee.
|
|
|
|
## Work
|
|
|
|
None while blocked. When the first cross-assembly record-sharing
|
|
deployment is designed (the distributed-git phase, or a platform app
|
|
that federates grant state), decide the id format: either a
|
|
payload-level namespace convention (alkgit-side, opaque strings with a
|
|
namespaced grammar) or a family-wide identity-id format (alkcall-level
|
|
change). Record the resolution in an ADR; update the OQ entry.
|
|
|
|
## Verification
|
|
|
|
- OQ-16 status matches `docs/architecture/open-questions.md`.
|
|
- If resolved: an ADR exists and the grant-schema freeze inventory
|
|
(OQ-03) reflects the chosen id format.
|
|
|
|
## Out of scope
|
|
|
|
- Building the distributed-git replication machinery (separate phase).
|
|
- Changing alkcall's `Identity` model (only if the family-wide option
|
|
is chosen, and as that crate's own decision).
|
|
|
|
## Summary
|
|
|
|
> Filled on completion. |