2 Commits

Author	SHA1	Message	Date
glm-5.2	40f6468e18	docs(architecture): fix spec/ADR inconsistencies from pre-decomposition review ... Critical: - operation-registry: remove stale duplicate OperationEnv impl that propagated parent.metadata through composition (violated ADR-014); collapse to one canonical block with metadata: HashMap::new() - operation-registry: fix request_id collision — format!("env-{name}") produced identical IDs across concurrent invocations, corrupting PendingRequestMap correlation and the abort-cascade tree (ADR-016) - operation-registry + ADR-015: fix OperationContext.internal visibility — pub field let handlers mark their own call internal (privilege escalation per ADR-015); change to pub(crate) with pub fn is_internal Warnings: - core-types: add Connection::set_identity/identity (OQ-11) to the Connection type spec — was specified in auth.md but missing from the type definition - operation-registry: add Capabilities: Clone design note — invoke() clones capabilities through composition; explicit security implication - call-protocol: add CallAdapter root OperationContext construction example showing internal: false wire path, complementing OperationEnv::invoke() internal: true composition path - overview: remove alknet/agent from ALPN registry — agent is a future consumer of alknet-call (call-protocol operations), not a separate ALPN - call-protocol: clarify call.requested payload schema and the leading-slash convention (wire operationId has slash, registry name does not) Suggestions: - operation-registry: cross-reference ResponseEnvelope definition - core-types: add StreamError to HandlerError mapping table	2026-06-19 09:13:10 +00:00
glm-5.2	6285779c30	docs(architecture): add ADR-015 privilege model and authority context, resolve OQ-18 ... ADR-015 locks the call protocol's security model: - internal flag switches authority context to handler identity, not skip ACL - Operations have External/Internal visibility (Internal returns NOT_FOUND from wire, excluded from services/list) - OperationContext carries both identity (caller/principal) and handler_identity (handler/agent) - Scoped composition env bounds reachability (handler can only invoke declared operations) - Three controls together: visibility (wire boundary) + handler identity (authority) + scoped env (reachability) = least privilege Spec updates: - OperationSpec gains Visibility field (External/Internal) - OperationContext gains handler_identity field - AccessControl section: ACL runs against caller identity for external, handler identity for internal - LocalOperationEnv propagates handler_identity - services/list only returns External operations - Adapter-registered operations are Internal by default - OQ-18 resolved, ADR-015 referenced across all call crate specs	2026-06-18 08:55:34 +00:00