glm-5.2
1baa619ce9
The monolithic open-questions.md (1310 lines, 47 OQs) was large enough to be unmanageable, with high size variance (OQ-42 at 220 lines next to OQ-06 at 8). Decomposed into one file per OQ under docs/architecture/questions/ (NNN-slug.md, mirroring the ADR convention), with open-questions.md retained as the index: theme-grouped tables plus a cross-theme Deferred/Blocked section that surfaces the 6 deferred OQs with their Blocked-on conditions inline (the safe-exit visibility surface). Per-OQ content moved verbatim; all 62 inbound links stay valid (none used anchors). README's curated OQ summary dropped (now redundant with the index tables). Also seeds tasks/architecture/ with this task plus two follow-ups found during the decompose: OQ-09/10 missing structured Blocked-on fields, and the tasks/architecture/ blocker-task half of the Safe Exit protocol being unenforced.
1.2 KiB
1.2 KiB
OQ-18: Privilege Model and Authority Context
- Origin: operation-registry.md
- Status: resolved
- Door type: One-way (ACL model), two-way (specific APIs)
- Priority: high
- Resolution: The
internalflag onOperationContextmarks calls that originated from composition (a handler calling another operation viaOperationEnv), as opposed to external calls that arrived ascall.requestedfrom a wire client. Theinternalflag switches the authority context: the ACL check runs against the composing handler's identity (set at registration), not the caller's identity and not as a blanket skip. This replaces the previoustrustedflag, which skipped ACL entirely — a privilege escalation vector. Operations have External/Internal visibility. Internal operations returnNOT_FOUNDwhen called from the wire and are excluded fromservices/list. The composition env is scoped — a handler can only invoke a declared set of operations. Handler identity is carried onOperationContextalongside caller identity (the principal/agent pair). See ADR-015. - Cross-references: ADR-014, ADR-015, call-protocol.md, operation-registry.md