§22 S3: scope-role enforcement + collection-grain visibility — v0.42.0 (@S3) #1
Reference in New Issue
Block a user
Delete Branch "feat/s3-scope-roles-collection-visibility"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
§22 S3 — scope-role enforcement + collection-grain visibility (
@S3) — v0.42.0Implements slice S3 of the §22 three-tier refactor (deployment → project → RFC collection), per
docs/design/2026-06-05-three-tier-projects-collections.mdPart B/C.1/E, plus the operator's mid-session visibility requirements.What lands
auth.effective_scope_role(user, collection)folds global → project → collection grants over the unified{owner, contributor}roles, most-permissive, no negative override.030_global_scope.sqlextendsmemberships.scope_typeto{global, project, collection}(the "global RFC Contributor" tier; sentinelscope_id='*').gatedcollection is hidden from the public (404, omitted from the directory) yet readable + listed for any scope-role holder reaching it. A collection may be set only as strict or stricter than its project (public<unlisted<gated) — validated at create (422), clamped at the mirror.Keystone decision (logged in transcript 0076)
§B.1/§B.3's literal "deployment contributor = global RFC Contributor" contradicted the C.1 "hana" scenario and the M2 implicit-public baseline. Resolved as: a plain granted account is a granted account, not a write-everywhere global role; "global RFC Contributor" is an explicit
scope_type='global'grant; the implicit-public write baseline is grandfathered onto the migration-seededdefaultcollection only → the N=1 deployment loses no capability. Reinterprets §B.1/§B.3 — flagged for the SPEC merge (S6).Breaking + upgrade steps
Write standing now requires an explicit scope grant outside the default collection (and beyond the default project). N=1 deployments need no action; multi-collection deployments must grant scope roles. Full upgrade steps in
CHANGELOG.md(0.42.0).Tests
test_s3_scope_roles_vertical.py(8 C.1 scenarios ada/ben/cleo/dan/eve/fay/gil/hana + hidden-collection + strictness + create-authority),test_migration_030_global_scope.py. Full backend suite: 493 passed.🤖 Generated with Claude Code
Splits the original §22 two-tier model (deployment → project=corpus) into three tiers (deployment → project → RFC collection). Project owns one content repo; collections are typed subfolders declared by .collection.yaml manifests (git-truth). Reconciles the accumulated role vocabulary onto one {owner, contributor} enum attached at {global, project, collection}, with downward additive inheritance and no negative override. Adds BDD scenarios (Part C) for role usage, invitation, and empty states. Re-slots the roadmap to fold the tier into the not-yet-shipped Plan B (mig 028) + M3-frontend. Session 0072 (spec). Revises docs/design/multi-project-spec.md §22. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>Implement slice S3 of the §22 three-tier refactor: the four-layer most-permissive scope-role resolver (§B.2) over {owner, contributor} grants at {global, project, collection}, with the §22.5 visibility gate enforced at the collection grain. - migration 030: memberships.scope_type += 'global' (the global RFC Contributor tier; sentinel scope_id '*'). - auth.effective_scope_role folds global → project → collection, most-permissive, no negative override; can_read_collection / can_contribute_in_collection / is_collection_superuser / can_create_collection gate reads, writes, admin, and create. - collection-grain visibility: a gated collection is hidden from the public (404, omitted from the directory) yet visible+listed for a scope-role holder; a collection may be set only as strict or stricter than its project (public < unlisted < gated), validated at create and clamped at the mirror. - entry-scoped authority (mark-reviewed, graduate, branch read/contribute, PR/discussion/contribution moderation) re-pointed from the project grain to the entry's collection. - create-collection authority widened to a project/global-scope grant holder (§B.1), not only a deployment owner/admin. Keystone reconciliation (session 0076): a plain granted account is a granted *account*, not a write-everywhere global role; the implicit-public write baseline is grandfathered onto the migration-seeded `default` collection only, so the N=1 deployment loses no capability. Reinterprets §B.1/§B.3 literally — flagged for the SPEC merge (S6). Completes @S3 (C1.1–C1.8). Tests: test_s3_scope_roles_vertical.py (8 C.1 scenarios + visibility/strictness), test_migration_030_global_scope.py. Full backend suite 493 passed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>