U1: restrict role permissions to project access with R13 gate split #637

2026-10-19T16:09:45Z

weichen commented

2026-10-19 16:09:45 +00:00

目标（计划 U1：R1/R2/R9/R11/R13）

角色权限收窄为单一「项目访问」布尔：读面过滤旧 system/user 行（保留审计数据）；有效值 = allowed&&capAllowed 归一（true,true→允许；false,true→拒绝）；写时双写两列、仅接受 project.create。
R13 门禁拆分：ReplaceRolePermissions 门禁 system.permissions.manage→system.roles.manage；角色读=system.roles.view；system grants/平台上限保持 system.permissions.manage（负控测试在）。
管理员不再绕过项目创建检查（AuthorizeSystem 中 project.create 先于 is_admin/system-grant）；受保护系统动作判定不变。
Frontend：角色编辑单「项目访问」checkbox，可编辑性只看 system.roles.manage，只读有原因文案；409 重放；旧模型测试重写。

证据

Backend：4 次派发（2 次合理 scope-expansion、1 次 cursor 网络失败）后 success，transport cf9c35a；过滤套件+vet PASS。
Frontend：1 次 success，transport 2c19439；vitest+design-guard+tsc PASS。
组合：child @ 7519672（backend 03646b5 含 review 修复 + frontend 2c19439）；make test-affected PASS（/tmp/pal-u1-affected3.json）。
独立 Review：全新 cursor 会话；结论 BLOCKED(1)→修复（03646b5）后闭环；报告存 /tmp/pal-u1-review-output.txt，记录在任务卡。

Impact

组合 gitlink：backend c8b1b7e→03646b5、frontend dab1605→2c19439。任务卡随 PR 合入（已合入前闭合）。

Refs

计划 2026-10-19-1440 U1；L1 PR #634。

## 目标（计划 U1：R1/R2/R9/R11/R13） - 角色权限收窄为单一「项目访问」布尔：读面过滤旧 system/user 行（保留审计数据）；有效值 = allowed&&capAllowed 归一（true,true→允许；false,true→拒绝）；写时双写两列、仅接受 project.create。 - R13 门禁拆分：ReplaceRolePermissions 门禁 system.permissions.manage→system.roles.manage；角色读=system.roles.view；system grants/平台上限保持 system.permissions.manage（负控测试在）。 - 管理员不再绕过项目创建检查（AuthorizeSystem 中 project.create 先于 is_admin/system-grant）；受保护系统动作判定不变。 - Frontend：角色编辑单「项目访问」checkbox，可编辑性只看 system.roles.manage，只读有原因文案；409 重放；旧模型测试重写。 ## 证据 - Backend：4 次派发（2 次合理 scope-expansion、1 次 cursor 网络失败）后 success，transport cf9c35a；过滤套件+vet PASS。 - Frontend：1 次 success，transport 2c19439；vitest+design-guard+tsc PASS。 - 组合：child @ 7519672（backend 03646b5 含 review 修复 + frontend 2c19439）；make test-affected PASS（/tmp/pal-u1-affected3.json）。 - 独立 Review：全新 cursor 会话；结论 BLOCKED(1)→修复（03646b5）后闭环；报告存 /tmp/pal-u1-review-output.txt，记录在任务卡。 ## Impact 组合 gitlink：backend c8b1b7e→03646b5、frontend dab1605→2c19439。任务卡随 PR 合入（已合入前闭合）。 ## Refs 计划 2026-10-19-1440 U1；L1 PR #634。

weichen added 8 commits 2026-10-19 16:09:45 +00:00

Record the task card for feature-project-access-lifecycle-u1-role-project-access a455919908

Why: establish the authorized task workspace and its initial baseline.

Evidence: preserved precheck receipt in .task/feature-project-access-lifecycle-u1-role-project-access.md; R0=3e70d76a20a6caf6f2edfd738a86f501c31064b6.

Impact: task metadata only; the feature workspace starts at a8557f27ed.

Refs: .task/feature-project-access-lifecycle-u1-role-project-access.md

Record U1 backend dispatch receipts and host verification d2e78d53be

Why: the U1 backend unit (single project-access boolean, R13 gate split,
admin bypass removal, legacy-row normalization) was delivered after four
dispatches — two legitimate scope-expansions (old-model test files, scratch
dir), one cursor network failure — and applied as transport cf9c35a.

Evidence: /tmp/pal-u1a-verify.json (build, filtered tests, vet, clean tree).

Impact: task card only.

Refs: plan 2026-10-19-1440 U1; PR #634.

Record U1 frontend delivery and verification 2fab81d3a6

Why: the U1 frontend unit (single project-access checkbox gated by
system.roles.manage, legacy dual-control model removed, tests rewritten)
was delivered in one cursor dispatch and applied as transport 2c19439.

Evidence: /tmp/pal-u1b-verify2.json (vitest suites + design guard + tsc).

Impact: task card only.

Refs: plan 2026-10-19-1440 U1; PR #634.

agent-exec transport 5aff33eabf4e1815994d44ec1c13abf3/36dd05125970 ef8d142a8a

Record U1 composition gate pass before independent review 66578e778c

Why: the composed child (backend cf9c35a + frontend 2c19439) passed
make test-affected; recording it fixes the dirty checkout that blocked the
review dispatch.

Evidence: /tmp/pal-u1-affected.json (exit 0).

Impact: task card only.

Refs: PR #634.

agent-exec transport f1fc92dcc0f0c67dbb8424a65d9ccb4c/ee07ab37e9bb 8417e356db

agent-exec transport 8e131e4c97857700601ef84749cea69e/f859169b4489 75196728eb

Record independent review closure and final composition

ci / svc-realcombo (pull_request) Skipped

Details

ci / test (pull_request) Failing after 3s

Details

ci / test-pg (pull_request) Skipped

Details

0c5a5674d6

Why: the independent reviewer blocked on the missing provider-failure test
scenario; the repair transport 03646b5 added it and the filtered suite
passes. pins2 mistakenly reverted the frontend pin and pins3 restored the
final composition (backend 03646b5 + frontend 2c19439).

Evidence: /tmp/pal-u1-affected3.json (test-affected exit 0 on 7519672).

Impact: task card only.

Refs: PR #634.

weichen referenced this issue from a commit

2026-10-19 16:09:53 +00:00

Fold-close the task card before merge

weichen added 1 commit 2026-10-19 16:09:53 +00:00

Fold-close the task card before merge

ci / test-pg (pull_request) Skipped

Details

ci / test (pull_request) Successful in 8m56s

Details

ci / svc-realcombo (pull_request) Skipped

Details

7e3d09faf9

Why: close the task card inside its own PR so landing it needs no post-merge backfill or separate close PR.
Evidence: .task/feature-project-access-lifecycle-u1-role-project-access.md -> .task/archive/feature-project-access-lifecycle-u1-role-project-access.md; status 已完成（合入前闭合）; PR #637 https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/pulls/637.
Impact: task metadata only; the card is archived within PR #637 and lands with its merge commit.
Refs: task.sh close --self

weichen merged commit a32e2227b0 into feature/project-access-lifecycle

2026-10-19 16:21:47 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: weichen/Agent-System-Dev#637