Repository navigation
feat(data): enable.feeds/activities real opt-out gates + trackHistory contract (#2707) - #2733
Merged
Merged
Conversation
…istory contract defined (#2707) Disposition per flag (enforce-or-remove; removal rejected — trackHistory is live in the console, spec removal = platform major, and the flags match the industry-standard object-capability model): - enable.activities: opt-OUT writer gate. Spec default false→true; plugin-audit skips ONLY the sys_activity timeline mirror on explicit `activities:false` (audit row untouched). Behavior-preserving; gives ADR-0057 its per-object activity-growth lever. - enable.feeds: opt-OUT + server-side enforcement. Spec default false→true; explicit `feeds:false` rejects sys_comment creation at the engine hook seam, 403 FEEDS_DISABLED (fail-closed, CLONE_DISABLED pattern) + a mapDataError branch so generic data routes surface the 403 (they bypass sendError's .status passthrough — caught in the runtime smoke test). - enable.trackHistory: ledger misclassified it dead — objectui has gated the record History tab on it since 2026-05 (a live consumer under the ledger's own rules). Reclassified live; the old authorWarn hint ("use Field.trackHistory instead") would have lost users the History tab and is replaced by the two-grain contract (object flag = History-tab master switch; Field.trackHistory = diff selector; audit capture stays unconditional as a compliance ledger). - enable.files: stays dead + authorWarn — reserved for the generic Attachments related-list, tracked in #2727; describe() now says so instead of advertising a capability that doesn't exist. Default flips are required for opt-out semantics: default(false) materializes `false` for every enable-block object, making explicit opt-out indistinguishable from the default. Verified: unit (plugin-audit gates, mapDataError, lint contract tests, spec defaults), liveness gate green, app-todo compile now warns only on enable.files, and a live showcase run — default object: activity mirrored + comment 201; probe object with explicit false flags: 0 activity rows, 1 audit row, comment → 403 FEEDS_DISABLED. Companion objectui PR gates the record feed/timeline UI on the same flags. Closes #2707. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 4 package(s): 98 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2707。按"分 flag 接线(enforce),不移除"处置——评估结论:四个 flag 并不同质,移除方案不可行(trackHistory 实为 live;spec 在 fixed 组移字段=全平台 major;examples/下游有真实使用)。
分 flag 处置
activitiesfalse→true;显式false时 plugin-audit 只跳过 sys_activity 时间线镜像(审计行不受影响)。行为兼容;同时是 ADR-0057 想要的按对象 activity 增长控制杆feedsfalse→true;显式false→ 引擎 hook 缝拒绝 sys_comment 创建,403FEEDS_DISABLED(fail-closed,复用CLONE_DISABLED模式)+mapDataError专属分支(通用 data 路由不走sendError的.status透传——运行时冒烟抓到 403 退化成 400 后补)trackHistoryField.trackHistory=diff 选择器;审计采集保持无条件(合规账本)filesdescribe()改为如实标注 RESERVED,不再宣传不存在的能力默认值翻转是必须的:
default(false)会把"没设"编译成显式false,opt-out 语义无法区分"作者显式关"和"默认"——与trash/mru/clone同姿态。为什么不把 lint 升级成 error
advisory-only 是 lint-liveness-properties 文件头写明的设计决定(signal over noise);修复路线是把 flag 变 live(enforce-or-remove 里选 enforce),不是把警告变错误。收口后 authorWarn 只剩
enable.files一个,警告面从 4 降到 1。验证
check:liveness✓、check:api-surface✓(表面无变化)enable.files,hint 已更新)feeds:false, activities:false)=0 条 activity 镜像 + 1 条审计行 + 评论 403FEEDS_DISABLED✓配套
🤖 Generated with Claude Code