From e3b0375211d7e09d2dff03b83c31ae56f57e29fc Mon Sep 17 00:00:00 2001 From: fred Date: Wed, 26 Aug 2026 19:31:09 -0500 Subject: [PATCH] =?UTF-8?q?docs(hierarchy):=20revision=209=20=E2=80=94=20c?= =?UTF-8?q?omplete=20the=20runner's=20importer=20enumeration=20(terra=20r8?= =?UTF-8?q?=20F10)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 'one live importer' claim was false: the measured production importer set of the db migration runner has four members (Gateway database module via the barrel, storage Postgres adapter, fleet-backlog and gateway-verify CLI commands via literal dynamic import). The enumeration example now names all four, the import analysis resolves literal dynamic import() routes, and a non-literal dynamic import of the db package fails the assertion. Injection-only consumers (schema-check) have no import edge. --- docs/requirements/hierarchy-schema.md | 38 ++++++++++++++++++++------- 1 file changed, 29 insertions(+), 9 deletions(-) diff --git a/docs/requirements/hierarchy-schema.md b/docs/requirements/hierarchy-schema.md index 339cba66..5287133d 100644 --- a/docs/requirements/hierarchy-schema.md +++ b/docs/requirements/hierarchy-schema.md @@ -65,6 +65,13 @@ closed importer enumeration, which may name operational entry points such as the Gateway's startup migration hook; named importers stay subject to prongs (i)/(ii) and gain no writer standing. +Revision 9 (terra r8 F10): revision 8 called the Gateway database +module the runner's "one live importer today". That was false — the +measured production importer set has four members. The enumeration +example now lists the complete measured set, and the import analysis +is extended to resolve literal dynamic `import()` routes, which two of +the four members use. + Scope: the tenancy/authorization structure record class — companies, estates, platform-projects, workspaces, hierarchy grants, their parentage, and constraints. Out of scope: the RBAC grant vocabulary and evaluation @@ -296,15 +303,28 @@ Binding on the implementing PRs (extends A1 §8.3): never appear on the writer allowlist. To close the laundering path, the same assertion checks imports, and the import analysis is **re-export-aware**: it follows package barrels and re-exports, so a - route hidden behind an index module is still a route. A registered - module may be imported only by other registered modules or by - importers named on that module's own closed importer enumeration in - the register — operational entry points such as the - migration/bootstrap CLI or the Gateway's startup migration hook - (the runner's one live importer today, the Gateway database module - reached through the db package barrel, is such an entry point and - is named in the enumeration, not exempted from analysis). Any - import route outside the enumeration fails the assertion. Being a + route hidden behind an index module is still a route — and it + resolves literal dynamic imports the same way: an + `await import('')` is an import edge like any + static import, not an evasion of the analysis (a dynamic import of + the db package whose specifier is not a literal fails the assertion + outright, because it makes the import graph unanalyzable). A + registered module may be imported only by other registered modules + or by importers named on that module's own closed importer + enumeration in the register — operational entry points such as the + migration/bootstrap CLI or the Gateway's startup migration hook. + The enumeration names the complete permitted production consumer + set, and completeness is measured, not asserted: the migration + runner's measured production importer set today has four members — + the Gateway database module (reached through the db package + barrel), the storage package's Postgres adapter, and two mosaic CLI + commands, the fleet-backlog command and the gateway verify command, + both routed through literal dynamic imports of the db package — so + its enumeration names those four. A module that only receives the + runner's functions by parameter injection (the gateway schema-check + module takes them as arguments from the verify command) has no + import edge of its own and is not enumerated. Any import route + outside the enumeration fails the assertion. Being a named importer confers nothing else: the importer stays fully subject to prongs (i) and (ii), gains no writer-allowlist standing, and whether it uses the registered module beyond its operational