share-link 契约:enforcement 路径改收完整 ExecutionContext,窄的 ShareLinkExecutionContext 只服务路由 401 —— #6206 裁决 A 案的契约半边

[baozhoutao]

Part of #6206(维护者 2026-08-07 裁决 A 案,见 #6206 comment 5219847367)

要做什么

packages/spec/src/contracts/share-link-service.ts(:100-112 的 ShareLinkExecutionContext,仅五字段)按裁决调整:share-link 的可见性校验(enforcement)路径必须收完整的 resolveAuthzContext 信封(含 accessible_org_ids、org_user_ids、systemPermissions、posture、tabPermissions),窄类型可保留但只准服务路由自身的 401 判断,不得再进任何 enforcement 路径——契约形状要让这条边界可见(如可见性校验的签名改收 ExecutionContext,并在 TSDoc 写明窄类型的边界)。

依据

• ADR-0095 D2:posture 解析一次、随上下文流动、永不在 enforcement 处重推;
• 裁决理由原文:裁剪信封喂 enforcement 是 bypass 形状的模式,本例是同族第三处组装(前两处 两处手写的 ExecutionContext 组装已漂移:REST 传输不带 principalKind / onBehalfOf,而 explain / security 会读它 #6071/HookContext 契约表把 before* 的 input.options 记成 DriverOptions —— 实测那里仍是调用方的 engine options(含 where),两个 break-glass 守卫正读它 #5997),治理默认收敛到完整信封,不留 per-site 子集;
• 今天的失效是 fail-closed(group 姿态下 share-link 创建全量 403,可用性缺陷非泄露),tenant-layer.ts 的 TSDoc 自证(accessibleOrgIds 在 group 姿态缺席即拒)。

排序(contract-first)

本卡先落;plugin-sharing 消费半边(sharing-plugin.ts contextFromRequest / share-link-service.ts 喂 engine.find 处)留 identity 车道,已挂 Blocked-by: 指向本卡。消费半边的 before-red 证据将同时兑现分诊留下的 repro 义务(group 姿态 403 实测,修后转 200)。

落点 packages/spec ⇒ 归 spec 座位;本卡由 identity 车道 PM 按跨座位转移协议代立(session_01JwwiU9bjhwy2SWj13ho8uv),domain:* 留分诊补。

[os-zhuang]

Triage — routing label added: domain:spec (blind-spot A: this card sat in pm:queue with no domain:*, i.e. queued but unroutable — no lane could see it as theirs.)

spec, not spec-surface. The change is to the shape of a contract, not to the prose describing one: ShareLinkExecutionContext at packages/spec/src/contracts/share-link-service.ts:100 gets replaced by the full ExecutionContext envelope on the enforcement path, and the narrow type's remaining legality is narrowed to route-level 401. A caller that compiles today stops compiling (or stops being accepted) after it, so the accept face moves ⇒ domain:spec. The split criterion inside packages/spec is exactly this: only a change where every input legal before stays legal byte-for-byte afterwards is spec-surface — a TSDoc note about the boundary rides along with this card rather than making it a text-face card.

Stale-premise check against origin/main (fetched, 26b72e0): ShareLinkExecutionContext is still the five-field interface at :100 (userId / tenantId / isSystem / positions / permissions) and is still the parameter type of createLink (:123), revokeLink (:126) and listLinks (:129). Ruling anchor #6206 (comment 5219847367) intact; nothing has landed on this file since.

Ordering is already correct, no pm:blocked needed here. This is the head of the chain — the plugin-sharing consumer half sits in the identity lane carrying Blocked-by: pointed at this card, which is the contract-first order the protocol asks for. Filed by the identity lane PM via the cross-seat transfer protocol; packages/spec has one owner regardless of who needs it, so the claim belongs to the domain:spec seat (#6017).

On target:v17: kept, and independently re-checked rather than inherited — criterion ① holds (in group posture, share-link creation returns a blanket 403 today, a shipped-surface availability failure a user hits). One process note, no action needed on this card: target:* is produced by the triage seat alone, the same single-producer rule as domain:*; the label arrived here from the filing lane. It is correct, so it stays — flagging only so the producer boundary does not erode by precedent.

Duplicate search across all three repos (ShareLinkExecutionContext, share-link enforcement envelope, resolveAuthzContext trimming): parent #6206 and the two prior assemblies it names (#6071 / #5997) — this is the third instance of the same shape, which is the ruling's own rationale, not a duplicate.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[qq9340100]

认领:PM 循环轮 6(高并发常态化批次,第 5/5 单)
会话:session_011M7UwH25Unfi73UHim7ajY
分支:claude/issue-6430-sharelink-execution-context
Worktree:objectstack-issue-6430
域:domain:spec
文件面:packages/spec/src/contracts/share-link-service.ts(enforcement 签名改收完整 ExecutionContext,窄类型边界 TSDoc)+ pin 测试、.changeset/。⛔ 不触 plugin-sharing 消费半边(identity 车道,Blocked-by 本卡)。越界即停,报告说明。

---

Generated by Claude Code

[qq9340100]

验收(ACCEPT):PR #6511 已复核通过,转 ready 并挂 auto-merge 入队。

• 三个裁定访问方法改收完整 ExecutionContext,窄类型保留但 TSDoc 边界写死(路由 401 词汇,⛔ 不进 enforcement),裁决 A 案逐条落地;pin 测试含 7 条类型级身份断言 + 3 条运行时整信封抵达断言。
• dev 证伪了分诊的一个预期并如实报告:结构化子类型 + 参数双变使消费方在本分支上仍编译绿——下游半边没有编译器推动,必须有意识做掉。该事实已三处留档(窄类型 TSDoc / pin 头注释 / PR 正文),且正确地拒绝了伪 @ts-expect-error。⚠️ identity 车道注意:Blocked-by: #6430 解锁后,消费半边(sharing-plugin.ts:633-639 contextFromRequest 不再裁剪 + share-link-service.ts 实现类签名跟改)不会有 CI 红提醒,落点已写进 PR 正文「下游半边的解锁点」一节。
• 反向验证方向先写(7 条错误逐条与预测吻合,第 7 条正是 excess-property 的 before-red);CI 25 项全 success/skipped,门禁 job 结论亲核 success。
• 范围外发现 finding: SharingExecutionContext 是同族第四个窄 enforcement 契约类型(sharing / approval / report 三个服务共用),#6206 裁决的「不留 per-site 子集」默认尚未覆盖它 #6523(SharingExecutionContext 同族第四窄类型,20+ 方法签名共用)已立、已查重、挂 finding 待分诊——处置正确。

---

Generated by Claude Code