docs(spec): mark feature-absent security props EXPERIMENTAL (ADR-0049)#1902
Merged
Conversation
… SharingRule, flow runAs (ADR-0049) Completes the pre-MVP "stop the spec from promising what it doesn't enforce" sweep of the #1878 P0 cluster. These three name security boundaries but have no runtime enforcement and the underlying feature does not exist yet, so per ADR-0049 they are explicitly marked `[EXPERIMENTAL — not enforced]` rather than left silently dead. No behaviour change; enforcement is deferred to M2. - PolicySchema (#1882): not registered, no consumer; better-auth runs hardcoded defaults. Schema-level warning + name field annotated. - SharingRuleSchema (#1887): live engine uses a divergent `sys_sharing_rule` model; spec CEL `condition` is never compiled. Schema-level warning. - flow `runAs` (#1888): service-automation engine ignores it (no identity switch). Field annotated. Refs #1878 #1882 #1887 #1888 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This was referenced Jun 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Completes the pre-MVP no-regret sweep of the #1878 P0 security cluster under ADR-0049: a spec property naming a security boundary must be enforced, explicitly
experimental, or absent — never parsed-but-silently-unenforced.These three name security boundaries, have no runtime enforcement, and the underlying feature doesn't exist yet, so they are marked
[EXPERIMENTAL — not enforced](vs left silently dead). No behaviour change.better-authruns hardcoded defaults. Schema-level warning +nameannotated.sys_sharing_rulemodel; the spec's CELconditionis never compiled. Schema-level warning.runAs([P0][security] Flow runAs never switches execution identity #1888) — service-automation engine ignores it (no identity switch). Field annotated.Enforcement (or removal, with the feature) is deferred to M2 and tracked by each issue.
Tests
spec security + flow suites: 208 passed (annotation-only change; no test asserts the edited describe strings).
Refs #1878 #1882 #1887 #1888
🤖 Generated with Claude Code