[Decision] Restriction profile vocabulary: which flow nodes a hosted environment can list (ADR-0031 containers, the Team approval pair), and whether allowCode splits off sandboxed lifecycle hooks #31354

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Filing gate: ② a decision only the maintainer can make (a protocol vocabulary key, under cloud#3659 ruling A). It collects three forks that already wait on the maintainer:

• spec: a restriction profile cannot list the ADR-0031 containers (parallel, try_catch), devPlugins counts as code under allowCode, and the allowedFlowNodeTypes docblock omits the reader rules #31239 item 1: "pending the maintainer's pick between C and B", PR fix(cli): os validate --target allows the ADR-0031 parallel / try_catch containers, and the restriction profile docblocks state the reader rules #31277, spec#1 dev report;
• spec: a restriction profile cannot list the approval / approval_revise nodes a hosted Team engine runs, and allowCode is one boolean that also refuses sandboxed lifecycle hooks #31344 item 1: the approval pair, the same mechanism;
• spec: a restriction profile cannot list the approval / approval_revise nodes a hosted Team engine runs, and allowCode is one boolean that also refuses sandboxed lifecycle hooks #31344 item 2: allowCode granularity.

⛔ Not a claim.

维护者速读

• 一句话问题： 环境用「限制档案」声明自己能跑哪些流程节点、能不能跑代码，os validate --target 按它预检作者的应用。现在档案写不出托管环境的真实能力，导致在 Team 上本来能跑的东西被预检拒掉。
• 三个缺口：
  • ① parallel / try_catch：引擎自带的容器节点，每个环境都能跑；
  • ② approval / approval_revise：只有 Team 套餐的托管引擎能跑（cloud#3497），别的环境不一定能跑；
  • ③ allowCode 只有一个开关，托管内核上已发布包里的沙箱钩子照常绑定，但 allowCode: false 把所有钩子都拒了。
• 选项：
  • D（推荐）：分开处理。
    • ① 按 C 处理，与 start/end 一样视为结构节点、始终放行。PR fix(cli): os validate --target allows the ADR-0031 parallel / try_catch containers, and the restriction profile docblocks state the reader rules #31277 已经这样实现，不改协议。
    • ② 按 B 处理，approval 这一对进入档案可列举的节点词表。因为它随套餐变化，必须由环境自己声明能不能跑。这是协议词表新增，p1。
    • ③ 拆出新键 allowSandboxedHooks（名字可以再议）。托管档案声明 allowCode: false 加 allowSandboxedHooks: true，如实反映内核行为。这也是协议键新增，p1。
  • B： 容器和审批节点全部进入可列举词表，环境要把容器节点也写上才放行。最统一，但每个档案都得列一遍到处都能跑的东西。
  • C： 容器和审批节点全部始终放行。最省事，但审批节点在没有审批引擎的环境里也会被放行，部署后才失败。
  • ③ 的另一种答法： 把沙箱钩子算作"非代码"，读取方直接豁免，不新增键。省一个键，但"沙箱里跑的东西算不算代码"就成了隐含规则，而这正是安全边界。
• 不裁的后果： os validate --target 会继续把 Team 环境能跑的审批流程和沙箱钩子判成违规；cloud 的限制档案（cloud#3713）也无法如实发布。

Four facets

• ① Long-term soundness: D lets each capability be declared where it varies. Engine built-ins are structural; plan-dependent nodes and a sandbox tier are listed. B over-declares invariants; C under-declares a plan-gated capability.
• ② Business pull: now. cloud#3713 (publishing the profile) is in flight, and it is the cloud#3659 ruling A execution, 「全部立卡并p1」. Team customers' approval flows are what the profile currently refuses.
• ③ AI-error resistance: an author or agent runs os validate --target and trusts its verdict. Under C, an approval flow passes on an environment that cannot run it, a false green. An implicit "sandboxed is not code" rule is one an agent cannot read off the schema; D's explicit key is.
• ④ Startup-stage scope: D adds two protocol entries, the approval pair and one boolean key. Both are p1 under 「协议新增定 p1」. No new gate.

Confidence gap: whether cloud intends to gate sandboxed hooks per plan. If it never will, ③ could be the "not code" reading instead.

Prior rulings read: cloud#3659 ruling A; #26368 ruling A (protocol additions are p1); the reader rule in review 6710350208 (a type outside FlowNodeAction is governed by allowCode).

After the ruling

• D:
  • PR fix(cli): os validate --target allows the ADR-0031 parallel / try_catch containers, and the restriction profile docblocks state the reader rules #31277 keeps option C for the containers and drops its "pending" note.
  • spec: a restriction profile cannot list the approval / approval_revise nodes a hosted Team engine runs, and allowCode is one boolean that also refuses sandboxed lifecycle hooks #31344 item 1 adds the approval pair to the profile's node vocabulary. Item 2 adds the new key, plus the reader rule and docs.
  • Then the cloud seat lists both in cloud#3713's Team profile.
• B: PR fix(cli): os validate --target allows the ADR-0031 parallel / try_catch containers, and the restriction profile docblocks state the reader rules #31277 switches its containers to B, and spec: a restriction profile cannot list the approval / approval_revise nodes a hosted Team engine runs, and allowCode is one boolean that also refuses sandboxed lifecycle hooks #31344 item 1 follows B.
• C: spec: a restriction profile cannot list the approval / approval_revise nodes a hosted Team engine runs, and allowCode is one boolean that also refuses sandboxed lifecycle hooks #31344 item 1 follows C. Item 2 then still needs ③'s answer.
• spec: a restriction profile cannot list the approval / approval_revise nodes a hosted Team engine runs, and allowCode is one boolean that also refuses sandboxed lifecycle hooks #31344 stays pm:blocked on this card until the ruling.

Generated by Claude Code