fred
a3446a13e2
ci/woodpecker/pr/ci Pipeline was successful
Implements the ratified hierarchy command surface per contract 1 (hierarchy-schema.md) and contract 2 (rbac-grant-model.md), brief M4-1B-II: - HierarchyRepository: the closed command family (company/estate/ platform-project create/rename/transfer/delete, grant create/change/ revoke, directory + granted-companies reads). Every mutation runs in one transaction through the M4-1b-i audit machinery (event + outbox, idempotency-key replay, causation-linked composite operations). - HierarchyGrantEvaluationService: live deny-by-default evaluation — effective role is the max over ancestor-chain user grants, fail-closed, team subjects suspended (§1.4), platform admin confers no tenant access (§1.1). - companies.visibility column (private default, directory carve-out) with migration 0020, admin-only audited visibility_change (§5.5), closed-field directory listing (§2.8), no-existence-oracle refusals (§6.7). - hierarchy_grants role CHECK pinned to the ratified vocabulary; namespaced serialized roles (hierarchy:*, §4.5). - §1.1 bypass retirement: role-derived MCP scope elevation and hasScope admin shortcuts removed; specs updated to the granted-scope path. - Witnesses: schema-level (role CHECK, visibility class/default), §6.3 closed route inventory, §6.4 per-mutation-class commit+rollback legs, §6.5 authorization, §6.7 oracle indistinguishability, §6.9 visibility, grant-evaluation semantics (chain inheritance, max-role, live revocation).
153 lines
3.1 KiB
JSON
153 lines
3.1 KiB
JSON
{
|
|
"version": "7",
|
|
"dialect": "postgresql",
|
|
"entries": [
|
|
{
|
|
"idx": 0,
|
|
"version": "7",
|
|
"when": 1773368153122,
|
|
"tag": "0000_loud_ezekiel_stane",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 1,
|
|
"version": "7",
|
|
"when": 1773602195608,
|
|
"tag": "0001_cynical_ultimatum",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 2,
|
|
"version": "7",
|
|
"when": 1773602195609,
|
|
"tag": "0001_magical_rattler",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 3,
|
|
"version": "7",
|
|
"when": 1773625181629,
|
|
"tag": "0002_nebulous_mimic",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 4,
|
|
"version": "7",
|
|
"when": 1773887085247,
|
|
"tag": "0003_p8003_perf_indexes",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 5,
|
|
"version": "7",
|
|
"when": 1774224004898,
|
|
"tag": "0004_bumpy_miracleman",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 6,
|
|
"version": "7",
|
|
"when": 1774225763410,
|
|
"tag": "0005_minor_champions",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 7,
|
|
"version": "7",
|
|
"when": 1774227064500,
|
|
"tag": "0006_swift_shen",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 8,
|
|
"version": "7",
|
|
"when": 1776822435828,
|
|
"tag": "0008_smart_lyja",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 9,
|
|
"version": "7",
|
|
"when": 1745280000000,
|
|
"tag": "0009_federation_grant_pending",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 10,
|
|
"version": "7",
|
|
"when": 1745366400000,
|
|
"tag": "0010_federation_enrollment_tokens",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 11,
|
|
"version": "7",
|
|
"when": 1782310438919,
|
|
"tag": "0011_bitter_gateway",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 12,
|
|
"version": "7",
|
|
"when": 1783911983447,
|
|
"tag": "0012_interaction_durable_state",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 13,
|
|
"version": "7",
|
|
"when": 1783913232578,
|
|
"tag": "0013_interaction_checkpoint_history",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 14,
|
|
"version": "7",
|
|
"when": 1783913398006,
|
|
"tag": "0014_interaction_outbox_channel_scope",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 15,
|
|
"version": "7",
|
|
"when": 1783942610000,
|
|
"tag": "0015_interaction_checkpoint_payload_digest",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 16,
|
|
"version": "7",
|
|
"when": 1784050648841,
|
|
"tag": "0016_salty_morlocks",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 17,
|
|
"version": "7",
|
|
"when": 1787609223282,
|
|
"tag": "0017_accounts_issuer",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 18,
|
|
"version": "7",
|
|
"when": 1787862158838,
|
|
"tag": "0018_clean_cobalt_man",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 19,
|
|
"version": "7",
|
|
"when": 1787880918208,
|
|
"tag": "0019_volatile_killraven",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 20,
|
|
"version": "7",
|
|
"when": 1787963521142,
|
|
"tag": "0020_special_betty_brant",
|
|
"breakpoints": true
|
|
}
|
|
]
|
|
} |