Freeze the approved IAM design and I1 permission contract so system administration no longer implies project business access. Define position roles separately from users, with project grants constrained by current role caps, resource ownership and document duties.
Evidence:
Independent stage 8 document Review passed on ba9d76426d after replaying action scopes, R1–R20 traceability, local links and the approved plan digest. The full SELF replay receipt is 6a39ff76afb42b5c9a4f91b38616db713ff6195f95a9f53f56c4801a7c36681a. Documents has no CI workflow or required CI context; parent Dev composition CI remains required for adoption.
Impact:
Preserve the approved plan, record user stage 6 and 7 acceptance, and distinguish I1's existing single-binding adapter from the later multi-role, account profile, matrix UI and migration work. This PR changes documentation only.
Refs:
Task record; docs/proposals/2026-10-13-iam-i1-permission-contract.md; docs/proposals/2026-10-13-iam-i1-acceptance.md. Deployment and later increments are outside this delivery.
Why:
Freeze the approved IAM design and I1 permission contract so system administration no longer implies project business access. Define position roles separately from users, with project grants constrained by current role caps, resource ownership and document duties.
Evidence:
Independent stage 8 document Review passed on ba9d76426ded94b0ab760b25201c3a389541b4ee after replaying action scopes, R1–R20 traceability, local links and the approved plan digest. The full SELF replay receipt is 6a39ff76afb42b5c9a4f91b38616db713ff6195f95a9f53f56c4801a7c36681a. Documents has no CI workflow or required CI context; parent Dev composition CI remains required for adoption.
Impact:
Preserve the approved plan, record user stage 6 and 7 acceptance, and distinguish I1's existing single-binding adapter from the later multi-role, account profile, matrix UI and migration work. This PR changes documentation only.
Refs:
[Task record](https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Dev/src/branch/feature/iam-i1-permission-boundaries/.task/feature-iam-i1-permission-boundaries.md); docs/proposals/2026-10-13-iam-i1-permission-contract.md; docs/proposals/2026-10-13-iam-i1-acceptance.md. Deployment and later increments are outside this delivery.
Why: provide the approved contract for the I1 implementation without altering its accepted content.
Evidence: SELF source artifact SHA-256 39b8e9a6e078dc509bd80118c1807ce6ed23e4466e5902b51f4bfa255d55c0a1; user approved the plan and authorized U1-U2.
Impact: documentation checkpoint only; no production code or runtime changes.
Refs: Agent-System-Dev feature/iam-i1-permission-boundaries
Why: separate protected system actions from project authority and freeze the approved identity and resource boundaries.
Evidence: SELF document check recorded by Dev evidence; approved plan digest retained and fixed-base core rules preserved.
Impact: contract and navigation only; provider implementations, multi-role migration and deployment remain later increments.
Refs: IAM plan r1 U1; Agent-System-Dev feature/iam-i1-permission-boundaries
Why: Existing public host contracts cannot prove source ownership, scoped revocation or private artifact filtering.
Evidence: The I1 documentation consistency checker preserves the approved plan digest and fixed RDM core rules; behavior verification is recorded in the owning task.
Impact: Record conservative I1 defaults and explicit follow-up provider requirements without adding public implementations.
Refs: IAM plan r1, I1 U1-U2
Why: The approved plan needs traceable local progress and explicit capability limitations before human implementation review.
Evidence: The owning task cards retain full local SELF startup, sync, red and green outputs; final combination checks and independent review are pending in this checkpoint.
Impact: Preserve the original approved plan and identify I1 behavior, deferred capabilities and the next separately authorized unit.
Refs: IAM plan r1; I1 U1-U2
Why: Separate observed local implementation and test results from formal acceptance, CI and deployment.
Evidence: Complete SELF outputs and fixed subjects are in the owning Dev and RDM task cards; independent preliminary review passed on dfb9c407.
Impact: Update review progress and explicit follow-up boundaries only; preserve approved plan and permission contract.
Refs: IAM I1 U1-U2
Why: The user approved the previously delivered local implementation and compatibility effects.
Evidence: This chat reply says approval; its objects remain c023551 Documents, b93908e RDM and 72ed8b4 Dev. Execution receipts are separate from this human decision.
Impact: Stage 6 passes and planned stage 7 begins; acceptance, shipping, later increments and production operations are not approved by substitution.
Refs: I1 implementation review on 2026-10-13
Why: Stage 6 is approved and formal command/API results need a version-bound human acceptance decision.
Evidence: Complete SELF receipts and independent replays are linked to fixed Dev/RDM subjects; the original implementation approval is retained.
Impact: Record test coverage, predicate corrections, immutable product digests and explicitly untested later scopes. Do not mark user acceptance or shipping complete.
Refs: IAM I1 U1-U2; phase 7 acceptance
Why: Preserve the explicit stage 7 decision before formal review and integration.
Evidence: User confirmation in this session; document consistency receipt 17a3542f8e69fc899a05a152d258b721a8aaab4cd0a3629f8f5cbb7364d77d84 (SELF).
Impact: Record acceptance of the fixed I1 candidate and its stated limitations; leave the approved plan unchanged.
Refs: Dev policy/delivery.md stages 7-9; IAM I1 permission contract.
Why: Remove stale local-review and pending-acceptance statements after user confirmation.
Evidence: Independent stage 8 documentation review identified the status mismatch.
Impact: Update delivery status only; preserve permission semantics and the approved plan digest.
Refs: 2026-10-13 IAM I1 acceptance record; Dev policy/delivery.md.
Why: Avoid presenting an earlier extension surface as the current provider after main advances.
Evidence: Independent documentation review identified a non-blocking version attribution issue.
Impact: Attribute the existing-capability table to Backend 0f192a48; preserve contract semantics and approved plan digest.
Refs: IAM I1 stage 8 document review.
weichen
merged commit 3cf263962b into main2026-10-13 15:39:54 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why:
Freeze the approved IAM design and I1 permission contract so system administration no longer implies project business access. Define position roles separately from users, with project grants constrained by current role caps, resource ownership and document duties.
Evidence:
Independent stage 8 document Review passed on
ba9d76426dafter replaying action scopes, R1–R20 traceability, local links and the approved plan digest. The full SELF replay receipt is 6a39ff76afb42b5c9a4f91b38616db713ff6195f95a9f53f56c4801a7c36681a. Documents has no CI workflow or required CI context; parent Dev composition CI remains required for adoption.Impact:
Preserve the approved plan, record user stage 6 and 7 acceptance, and distinguish I1's existing single-binding adapter from the later multi-role, account profile, matrix UI and migration work. This PR changes documentation only.
Refs:
Task record; docs/proposals/2026-10-13-iam-i1-permission-contract.md; docs/proposals/2026-10-13-iam-i1-acceptance.md. Deployment and later increments are outside this delivery.