docs(adr): ADR-0118 非用户 actor 的平台契约 —— null 表示、fail-closed、显式 isSystem (#4608) - #4609
Merged
Conversation
#4608) 四处现场各自发明「系统在操作」的表示法(#4556 哨兵字符串、#2991 缺省即特权、 #4560 令牌下沉存储、#3166 自愿声明),本 ADR 统一为:用户 lookup 列中系统 actor = null(不造魔法账号、不存哨兵);缺 actor 一律 fail-closed,isSystem 是唯一显式提权入口;系统上下文只在入口点构造、跨异步边界显式重建;框架令牌 永不下沉存储层;归因靠关联字段,不设 actor_kind。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PRJtkgUAaVG11FsJQbvZWA
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
github-actions
Bot
added
size/m
documentation
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PRJtkgUAaVG11FsJQbvZWA
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #4608。
新增
docs/adr/0118-non-user-actor-contract.md(docs-only,无包变更、无 changeset)。动因
平台里「没有人在场但平台在写」的时刻(boot、迁移、调度任务、流程、AI 工具服务端调用),至少四处现场各自发明了行为主体的表示法:#4556 在
lookup('sys_user')列存哨兵'system';#2991 曾把缺 actor 文档化为 system 级缺省(fall-open);#4560 让current_user令牌下沉为列 DEFAULT;#3166 的isSystem是自愿声明。不统一,平台会长出三种「系统」方言,统一要动审计数据迁移,越晚越贵。决策(正文 D1–D6)
null;不造魔法账号(sys_user归 better-auth 管,ADR-0092,伪用户行是安全面)、不存哨兵;UI 显示「系统」是渲染规则不是数据。isSystem: true是唯一显式提权入口——把ai-service.ts:394-404已落的契约文本升为全平台规则。actor_kind。owner_id(ownership轴,ADR-0117);不做多态 actor 引用。执行项(不在本 PR)
#4556(D1 迁移)、#2991(D2 执行器验证)、#4560(D4 驱动修复)、#3166(D3 可检查化)——均已在 backlog,其中 #4556/#2991 属 v17
protocol:breaking清单。🤖 Generated with Claude Code
https://claude.ai/code/session_01PRJtkgUAaVG11FsJQbvZWA
Generated by Claude Code