Default-export slot treated as an export name at both ends (helper-side
export-default passes, consumer-side bare-default-import resolution);
namespace-member write targets match the source's exported names via a
per-file memberSyms union; factory conduits carry a name map computed to
a fixpoint so renames propagate hop by hop (export-from, export-of-local,
export default); tracked dynamic imports of capability conduits confer
capability; factory destructure-rename from a schema namespace; static
module-namespace createRequire destructure; spread-argument writes; DCL
keywords (GRANT/REVOKE ON, LOCK TABLE); bracketed conventional DI
receiver. Permanent controls E40-E53.
Per the second M4-1a detached review (REQUEST_CHANGES, R1-R8):
- R1: prong (i) now tracks namespace destructuring, nested namespace
re-exports (ns.schema.companies), and literal dynamic-import bindings
(destructured and namespace) per contract rev 9.
- R2: capability-conduit fixpoint (computeCapabilityConduits) closes
driver/factory laundering through export-from modules.
- R3: dynamic-import check is per call site with a full-literal tail
match, so concatenated specifiers no longer pass.
- R4: computed-member calls with literal verb names (obj['insert'],
obj['query']) and spaced member access are flagged.
- R5: prong (ii) adjacency tolerates schema qualification, interposed
block comments, COPY, and escaped quotes.
- R6/R8: header documents KNOWN RESIDUALS (DI receiver rename in
capability-free files, computed non-literal member access, scan
perimeter) with the measured counterfactuals.
- createRequire fails outside a 5-module measured register (R1 route).
- 15 new permanent evasion controls (E9-E23) with helper-file conduits
run through the production analyzer.
Calibration: tree-wide prong test green with zero new exclusions;
tsc, eslint, and the full package suite pass.
Review findings F1-F8 (REQUEST_CHANGES) addressed:
- F5: replace regex comment stripping with a string-aware lexer producing
comment-free code plus accurate string/template spans (handles nesting,
regex literals, escapes)
- F3: prong (i) now tracks namespace imports and re-export conduits via a
fixpoint over the scanned import graph
- F1/F2: tagged-template exemption dropped; backlog.ts joins the infra
register; capability-gated prong (iii) — driver import flags any-receiver
execute/query/unsafe, factory import flags any-receiver execute/unsafe,
db-shaped receiver backstop covers DI'd handles; sql.raw tracked through
aliases and namespaces
- F4: closed importer enumeration added for createDb/createPgliteDb;
composition property of remaining register modules documented
- F6: plugins/ added to scan roots
- F7: per-parent slug scoping witnessed at platform_projects and workspaces
- F8: dynamic-import disposition register added; stricter-than-contract
stances documented in the header
The review's 8 evasion samples are embedded as permanent controls run
through the production analyzer, plus clean controls guarding against
false positives.
Implements docs/requirements/hierarchy-schema.md sections 2-4 and the
schema-layer half of section 6:
- Five class tables (companies, estates, platform_projects, workspaces,
hierarchy_grants) with the section 2.7 exhaustive column sets: child
node tables carry no timestamps (renames are audited via events), no
owner_id anywhere (section 4.4 - ownership is computed from grants).
- Grant constraints per section 3: exactly-one-subject and
exactly-one-target num_nonnulls CHECKs, six-column UNIQUE NULLS NOT
DISTINCT, target FKs CASCADE / principal FKs RESTRICT, six btree
indexes.
- Migration 0018 generated by drizzle-kit; SQL verified against the
contract text and applied on PGlite.
- hierarchy-schema.witness.test.ts: dual-leg witness suite (PGlite
always; real PostgreSQL under DATABASE_URL, the section 6.8 binding
leg in CI). Covers parent-FK integrity + catalog assertion, slug
scoping, column allowlist (6.2), all six grant subject/target forms,
CHECK refusals, NULLS NOT DISTINCT duplicates, NOT NULL refusals, and
deletion semantics (6.6): fail-closed parent delete, leaf cascade of
exactly its grants, principal RESTRICT.
- hierarchy-writer-coverage.test.ts: section 6.3(b) three-prong static
assertion (alias-aware symbol writes, class-table names in SQL
literals, raw-execution primitives) with empty writer allowlist,
closed infrastructure register, and closed importer enumerations for
the migration runner and migrate-tier. All prongs proven able to fire
via a planted-violation control.
Command family, audit events, and route inventory land in M4-1b.
- docs/PRD.md: Part I product north star authored from ratified decisions
D1-D14; Part II preserves all active workstream contracts verbatim
(KBN-101, FCM #758, FCOM #766, TESS, #756, MOS-PORT, #1150, #1174, #1194,
RI #1275, M1). Referenced anchors unchanged.
- docs/archive/PRD-v0.1.md: v0.1.0 beta PRD body archived verbatim with
supersession header.
- docs/ROADMAP.md: all phases P0-P5 present from day one per D11
(P2-P5 as explicit placeholders).
- docs/requirements/native-kanban-sot.md: Amendment A1 (D13) - hierarchy
parentage + RBAC chain above workspaces; sections 1-7 untouched.
fred
orch-01
fred
jason.woltje
ops-deploy-01
code-infra-01
code-be-02andorch-01
veronicaandorch-01
code-be-01andorch-01
fargoandfred