agent-exec transport dd2fa5d8f3774523c4c97a4afaa4360d/4fd52114d316

pkg/extension/extension.go

@@ -65,7 +65,9 @@ import (
 // SystemActionProvider for the Backend-owned single-effective-role policy;
 // resource queries carry the current authority epoch so downstream caches can
 // reject stale role snapshots.
-const SurfaceVersion = "2.25.0-experimental"
+// 2.26.0-experimental: IAM link U1 RolePolicySnapshot.Linked carries the
+// Backend-computed project.create own-project management link and its source.
+const SurfaceVersion = "2.26.0-experimental"
 
 // ErrNotLinked 表示进程没有空白导入 link 包，Main 无法启动服务。
 var ErrNotLinked = errors.New("extension: runner not linked; blank-import agent-system-backend/pkg/extension/link")

pkg/extension/role_policy.go

@@ -24,6 +24,18 @@ type RolePolicySnapshot struct {
 	RoleVersion     int64                     `json:"roleVersion,omitempty"`
 	AuthorityEpoch  int64                     `json:"authorityEpoch"`
 	Permissions     map[string]RolePermission `json:"permissions"`
+	Linked          LinkedCapabilities        `json:"linked"`
+}
+
+// LinkedCapabilities is the Backend-computed project.create link for one
+// account. Actions apply only to projects the account created; Source names
+// where project.create comes from (bootstrap-admin, system-grant or role) and
+// Conflicts lists linked actions that the account's enabled role caps off.
+type LinkedCapabilities struct {
+	ProjectCreate bool     `json:"projectCreate"`
+	Source        string   `json:"source,omitempty"`
+	Actions       []string `json:"actions"`
+	Conflicts     []string `json:"conflicts,omitempty"`
 }
 
 type RoleActionDecision struct {

pkg/extension/surface.txt

@@ -64,6 +64,7 @@ HumanDecisionVerifier.RevokeHumanDecision
 HumanDecisionVerifier.VerifyHumanDecision
 InProc
 IntentSpec
+LinkedCapabilities
 Main
 MergeHostOptions
 NewHostClient