chore(spec): govern identity in the spec-liveness gate#1924
Merged
Conversation
Second category for the liveness gate (after security), completing the security/identity audit cluster. Adds `identity` to GOVERNED and seeds packages/spec/liveness/identity.json: - Role (the one author-written RBAC type): name live (sys_role.name reused as a permission-set name, permission-evaluator.ts:113), label/description live as display metadata, parent DEAD — the org hierarchy walks sys_department.parent_department_id via department-graph.ts, nothing reads sys_role.parent (removal candidate, ADR-0049). - Everything else in identity is NOT authorable metadata: SCIM 2.0 provisioning DTOs, better-auth runtime tables (User/Session/Account/VerificationToken/ ApiKey), and org primitives (Member/Organization/Invitation) → `internal`. Gate: identity 4 props (3 live, 1 dead), 0 unclassified. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 1 package(s): 89 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
os-zhuang
added a commit
that referenced
this pull request
Jun 16, 2026
…iveness gate
Third category for the spec-liveness gate. Two gate capabilities make noisy
categories tractable:
- allowlist mode (`"mode":"allowlist"` + `"governed":[...]`) — only the named
authorable schemas are checked; the rest of the category is out of scope. The
json-schema categories don't map to authorable types (ai is mostly embedder/
knowledge/model DTOs), so blanket per-category classification doesn't scale. A
governed name that no longer resolves is reported (catches renames).
- auto-classify ADR-0010 framework provenance/lock fields (_lock*, _provenance,
_packageId/Version, _lockDocsUrl, protection) as `live`, so every type's ledger
doesn't repeat them.
ai ledger seeded from docs/audits/2026-06-{agent,tool,skill}schema-*.md:
- 63 props: 46 live / 5 experimental / 12 dead, 0 unclassified.
- Agent: core + model/skills/tools/active/planning live; access/permissions/
visibility/tenantId/knowledge DEAD (access-control is a no-op — chat route
hardcodes ['ai:chat','ai:agents'], ADR-0049 #1884); lifecycle/memory/guardrails/
structuredOutput experimental (aspirational autonomy).
- Tool: write-only metadata — name/description/parameters/objectName live (via the
parallel AIToolDefinition); category/requiresConfirmation/active/builtIn/
permissions dead; outputSchema experimental.
- Skill: name/label/description/instructions/tools/triggerConditions/active live;
triggerPhrases dead (no matcher), permissions dead (+ requiredPermissions drift).
Stacked on #1924 (identity). GOVERNED = security, identity, ai.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
os-zhuang
added a commit
that referenced
this pull request
Jun 16, 2026
…iveness gate (#1932) Third category for the spec-liveness gate. Two gate capabilities make noisy categories tractable: - allowlist mode (`"mode":"allowlist"` + `"governed":[...]`) — only the named authorable schemas are checked; the rest of the category is out of scope. The json-schema categories don't map to authorable types (ai is mostly embedder/ knowledge/model DTOs), so blanket per-category classification doesn't scale. A governed name that no longer resolves is reported (catches renames). - auto-classify ADR-0010 framework provenance/lock fields (_lock*, _provenance, _packageId/Version, _lockDocsUrl, protection) as `live`, so every type's ledger doesn't repeat them. ai ledger seeded from docs/audits/2026-06-{agent,tool,skill}schema-*.md: - 63 props: 46 live / 5 experimental / 12 dead, 0 unclassified. - Agent: core + model/skills/tools/active/planning live; access/permissions/ visibility/tenantId/knowledge DEAD (access-control is a no-op — chat route hardcodes ['ai:chat','ai:agents'], ADR-0049 #1884); lifecycle/memory/guardrails/ structuredOutput experimental (aspirational autonomy). - Tool: write-only metadata — name/description/parameters/objectName live (via the parallel AIToolDefinition); category/requiresConfirmation/active/builtIn/ permissions dead; outputSchema experimental. - Skill: name/label/description/instructions/tools/triggerConditions/active live; triggerPhrases dead (no matcher), permissions dead (+ requiredPermissions drift). Stacked on #1924 (identity). GOVERNED = security, identity, ai. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Second category for the spec-liveness gate (#1919), completing the security/identity audit cluster.
What it governs
Role— the one author-written RBAC metadata type:name→ live (sys_role.nameis reused as a permission-set name;permission-evaluator.ts:113)label/description→ live (display metadata)parent→ dead — the "Reports To" rollup is unimplemented; the org hierarchy walkssys_department.parent_department_idviadepartment-graph.ts, nothing readssys_role.parent. Removal candidate (ADR-0049).identityis not authorable metadata →internal: SCIM 2.0 provisioning DTOs (16), better-auth runtime tables (User/Session/Account/VerificationToken/ApiKey), and org primitives (Member/Organization/Invitation).Gate result
Note on rollout (for reviewers)
The json-schema categories don't map cleanly to "authorable metadata types" — most categories (
data,automation,ui,kernel, …) are dominated by ObjectQL/engine/protocol DTOs, not author-written metadata.security/identitywere the clean, fully-authorable cluster. Future categories will need either an explicit per-category authorable allowlist or per-type seeding from each type's liveness audit, rather than blanket per-category classification. Flagged so the next rollout step is scoped deliberately.Independent of #1923 (depends only on the merged #1919).
🤖 Generated with Claude Code