Repository navigation
docs(aaas): A0 design — per-tenant single-writer RFC and threat model - #675
Merged
Merged
Conversation
added 2 commits
October 26, 2026 17:00
The founder chartered AaaS on 2026-10-21, which met the D-15 trigger and fired four ADR re-review conditions, so A0 needs a reviewable design before any state-layer code is written. - rfc/aaas-rfc (en + zh-CN), status proposal: keyed single writer per tenant (one SQLite ledger per tenant behind an epoch-fenced lease), tenant vs organization model, a declared RPO (async off-node copies while writes stay sealed; RPO 0 before M5 unseals on AaaS), an intranet tier topology, failure modes, ADR-14/15/16/17/23 kickoff findings, founder decisions Q1-Q8 and read-only facts F-1 to F-4. - design/aaas-security-design (en + zh-CN): threat model S-1 to S-16, each with today's state, a proposed control and the falsification test of the phase that proves it. - Reconciled authorities: architecture §8 rows marked triggered 2026-10-21 plus one pointer note; §10 D-15 trigger met (row shortened, section now 7107 of 7300 bytes); roadmap §1 AaaS row; master outline gate G6; docs index; decision queue. Refs: #674 Constraint: Docs only; no runtime, schema, dependency or kernel-manifest change; writes stay sealed. Rejected: cr-sqlite for service state | eventual consistency cannot guarantee consume-once. Rejected: shared Postgres/MySQL as the primary binding | rewrites the synchronous kernel-pinned ledger; kept as the named fallback. Confidence: medium (design proposal; facts F-1 to F-4 not yet verified) Scope-risk: narrow Tested: check-docs-i18n (93 pairs OK); check-doc-readability and --self-test OK; g5-guard OK; relative-link check over the 14 files, 0 broken. Not-tested: full run-all locally (docs only). tsc --noEmit exits 2 identically on main (58 pre-existing errors in ts/scripts/booking-copilot-gateway-chat-adapter-tests.ts, tracked in #672); this commit changes no TypeScript.
… tsc The proof broke the whole-project strict typecheck (58 errors), and CI stops at that Typecheck step before smoke and the full regression, so every PR on main, this one included, lost its regression signal. - Declare the surface the proof drives on the undeclared JS adapter (dependencies, stream options, model info) and type emitted chunks with the harness's own StreamChunk union from @deepseek-ai/dsh-llm. - Type the mock server (RequestListener, ServerResponse, AddressInfo narrowing) and the wire request bodies; make adapterFor's captured argument optional. - Narrow chunks and the tool-call block through small helpers instead of unchecked property reads, and read error codes from unknown via one guard. - Every assertion is unchanged. Fixes #672 Constraint: Test file only; no suppression directive, no src, tsconfig or package change. Rejected: A .d.ts beside dsh-llm-gateway-chat.js | widens the change into src and the shipped package. Confidence: high Scope-risk: narrow Tested: Node v26.9.0: cd ts && npx tsc --noEmit exit 0 (was exit 2, 58 errors); adapter proof exit 0 before and after; smoke.ts exit 0; mutation check: a misspelled chunk field and an un-narrowed tool-call read both fail tsc. Not-tested: full run-all locally; CI runs it on Node 22/24 once Typecheck passes.
The founder judged the file-permission discussion over-designed: access control belongs at the presentation layer, and ops-level redundancy waits for a real need (2026-10-26). - RFC: forget deletes the tenant ledger and its off-node copies, with no per-tenant keys; the boundary ADR drops the network ACL; a non-goal records the rule; decision Q5 (crypto-shredding) is removed, so Q6-Q8 become Q5-Q7. - Security design: drops the operator actor, the operator-reads-files threat (umask, encrypted copies, audit), key rotation and principal audit, and the encryption and retention open questions; S-12 now deletes the copies; a rejected option records the rule; threats renumber to S-15. - Decision queue: seven decisions instead of eight. Refs: #674 Constraint: Docs only; bilingual pairs edited together. Confidence: high Scope-risk: narrow Tested: check-docs-i18n (93 pairs OK); check-doc-readability OK; relative-link check over the 6 files, 0 broken; zh-CN punctuation scan clean. Not-tested: nothing beyond the doc gates (no code changed).
Danceiny
added a commit
that referenced
this pull request
Oct 27, 2026
…676) #669's fresh-port retries ask the task factory for a new port after retiring the current one. A factory that returns one shared instance handed back the closed port, so next() rejected untyped with booking_planner_run_port_closed. main's full regression had failed on this since 6599423 (Node 22 and 24). - Both retry branches refuse a port the planner already retired and settle typed, exactly as when the deadline cannot fund a retry. Factories that return a new port behave as before. - The readiness proof asserts the refused retry and adds a real-subprocess case for the retry itself; the planner proof adds one case per retry branch. - Carries the #672 strict-typecheck fix for the gateway-chat adapter proof (the same change as #675's 3acb2a0) so CI reaches the full regression. Fixes #672 Refs #660
Danceiny
added a commit
that referenced
this pull request
Oct 28, 2026
…e writer (#677) The founder merged the A0 proposal (#675) and directed development to start with no per-question override, so Q1–Q7 stand as recommended; the owning authorities change together as the RFC's same-commit rule requires. Docs only, nothing changes at runtime. Refs #674 Co-authored-by: huangzhen.0505 <huangzhen.0505@bytedance.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #674
The founder chartered AaaS on 2026-10-21. That met the D-15 trigger (the old tracker #275 stays as history) and fired the re-review conditions of ADR-14, ADR-15, ADR-17 and ADR-23. This PR is #674's A0 step: a reviewable design before any state-layer code. It is docs only; nothing changes at runtime.
What it proposes (
docs/rfc/aaas-rfc.md, status proposal, with its zh-CN mirror)docs/design/aaas-security-design.md): threats S-1 to S-16, each with today's state, a proposed control and the falsification test of the phase that proves it.Evidence on
8b126e6b3e7a7781c0d278217f13167a72a22ea1node scripts/check-docs-i18n.mjs: exit 0 (DOCS I18N SYNC OK: 93 对双语文档结构对等).node scripts/check-doc-readability.mjsand--self-test: exit 0.cd ts && npx tsx scripts/g5-guard.ts: exit 0 (722 tracked files, no unauthorized G5 reference).cd ts && npx tsc --noEmit: exit 2, 58 errors, all ints/scripts/booking-copilot-gateway-chat-adapter-tests.ts. The same 58 errors occur onmainatda99c5eand are tracked in test: make gateway-chat adapter proof pass strict TypeScript #672. This PR changes no TypeScript (git diff --stat origin/main -- ts/is empty).run-all-tests.sh: not run locally, because the change is docs only.CI note. On
mainatda99c5e, the "typecheck + full regression (22/24)" jobs already stop at the Typecheck step with those 58 errors (#672). This PR's CI will stop there too; the dist-compatibility jobs remain a meaningful signal.Review ask. Answer Q1–Q8 in RFC §8.1. Replying "as recommended" accepts all eight. A1 starts only after acceptance.