Initial SQL-only 1C adapter baseline

2026-07-22 03:03:47 +03:00
commit e2503b77e7
545 changed files with 184711 additions and 0 deletions
@@ -0,0 +1,50 @@
+id: 1c-change-workflow-policy
+status: active
+default_mode: propose-only
+rules:
+  - "Application data is read-only; no workflow may insert, update, or delete rows in application tables."
+  - "SQL identities and permissions are out of scope and must never be created or changed by this connector."
+  - "The model must not directly apply changes to a live 1C database."
+  - "Write operations to 1C configuration data must target only ConfigSave (base config) and ConfigCASSave (extension config) as the saved layer."
+  - "Do not write to Config or ConfigCAS from connector workflows; these are active-applied layers and read-only in the adapter path."
+  - "Before any write proposal, resolve user-facing targets to full 1C canonical paths or concrete saved-state references."
+  - "Before any write proposal, read origin/layer evidence for the effective target."
+  - "Before any apply method, require metadata.write.plan allowed=true for the same target and intent."
+  - "When the base repository is configured, require a verified adapter-owned repository lock session before any saved-state apply."
+  - "Repository backend, endpoint, bridge identity, runtime, and credentials must come from the selected base runtime settings; never infer them from hard-coded names."
+  - "Repository commit requires an explicit approval flag and a non-empty version comment."
+  - "Concrete saved-state references must be compatible with the selected target kind; do not use form_guid for module writes or module_ref for form writes."
+  - "Do not treat a local BSL symbol path as a metadata path until it is resolved inside the current code context."
+  - "Do not write effective module or form text directly; route through a write plan with layer provenance."
+  - "After modifying saved layers, require explicit compare and human approval before any production apply step."
+  - "The model may generate a change proposal, patch, or review checklist."
+  - "Human approval is required before apply."
+  - "Production changes require backup, test run, and rollback plan."
+stages:
+  - propose_change
+  - static_review
+  - run_tests
+  - expert_review
+  - manual_approve
+  - apply_change
+  - verify
+  - rollback_if_needed
+required_for_approval:
+  - risk_summary
+  - affected_objects
+  - canonical_paths
+  - layer_provenance
+  - references_found
+  - test_plan
+  - rollback_plan
+denied_without_approval:
+  - modify_configuration
+  - update_database
+  - run_data_processor
+  - delete_objects
+  - change_roles_or_permissions
+  - write_active_configuration
+  - write_ambiguous_target
+  - write_without_origin_evidence
+  - write_when_plan_blocked
+  - write_concrete_reference_kind_mismatch
@@ -0,0 +1,36 @@
+id: 1c-config-layer-write-policy
+status: active
+default_mode: deny
+summary: "Writes to 1C configuration storage are read-first, save-layer-only."
+rules:
+  - "This exception permits metadata saved-state payloads only; it never permits application-data writes."
+  - "Active-applied layers are read-only in adapter workflows: Config and ConfigCAS."
+  - "Saved, not yet applied layers are the only writable targets for configuration edits: ConfigSave and ConfigCASSave."
+  - "Base configuration changes map to ConfigSave; extension configuration changes map to ConfigCASSave."
+  - "Comparisons of pending changes must be run as ConfigSave↔Config and ConfigCASSave↔ConfigCAS before proposing production apply."
+  - "Any claim of applied state must be backed by live reads from Config/ConfigCAS only after explicit apply workflow."
+  - "Agent-facing write intents must resolve to a full 1C canonical path or concrete saved-state reference before planning."
+  - "Effective views are read targets only; write plans must identify base, extension, generated extension source, or saved-state ownership."
+  - "Concrete references must match the planned target kind: module targets may use module_ref, module_id, or module file_name; form targets may use form file_name or form_guid."
+  - "If metadata.write.plan returns allowed=false, metadata.write must not call lower-level apply methods."
+  - "Extension code changes must preserve the operation type: insert_before, insert_after, replace, or replace_with_control."
+denied_actions:
+  - "write_to_Config"
+  - "write_to_ConfigCAS"
+  - "auto_apply_to_active_state"
+  - "direct_sql_apply_to_live_config"
+  - "write_effective_view_directly"
+  - "write_ambiguous_short_name"
+  - "write_plan_blocked_apply"
+  - "write_concrete_reference_kind_mismatch"
+allowed_actions:
+  - "propose_save_layer_change"
+  - "plan_full_path_change"
+  - "read_Config"
+  - "read_ConfigSave"
+  - "read_ConfigCAS"
+  - "read_ConfigCASSave"
+  - "compare_saved_state"
+notes:
+  - "Use this policy together with change-workflow to avoid mixing saved and active layers."
+  - "If a path requires production writes, treat it as out-of-band and human-controlled only."
@@ -0,0 +1,69 @@
+id: 1c-designer-sql-decoding-policy
+status: active
+summary: "Controlled changes in a disposable 1C base may be made only through 1C clients; the adapter observes and decodes SQL without writing application data."
+
+scope:
+  default_base_id: upo_test
+  allowed_base_class: disposable_test
+  forbidden_base_class: [production, unclassified]
+  platform_mutation_authority:
+    application_data: 1c_enterprise_client
+    metadata_working_state: 1c_designer
+  adapter_role: sql_observer_and_decoder
+
+credentials:
+  persistence: forbidden_in_repository
+  accepted_sources: [process_environment, operating_system_credential_store, interactive_session]
+  rules:
+    - "Do not put 1C user passwords, SQL passwords, tokens, or connection strings containing secrets in project files, reports, fixtures, or command examples."
+    - "Redact credentials from process reports and captured command lines."
+
+experiment:
+  isolation: one_intended_change_per_run
+  required_phases:
+    - identify_public_1c_target
+    - capture_sql_before
+    - change_through_1c
+    - save_in_1c
+    - capture_sql_after
+    - diff_sql
+    - decode_semantic_rule
+    - verify_with_second_value_or_object
+    - rollback_through_1c
+    - verify_rollback_in_sql
+  target_selectors: [public_ref, kind_and_name, form_and_element_name, record_ref]
+  forbidden_selectors_for_callers: [sql_number, physical_table, internal_guid_only]
+
+sql_observation:
+  adapter_access: read_only
+  allowed: [SELECT, metadata_schema_inspection, ConfigSave_read, ConfigCASSave_read, application_table_read]
+  forbidden:
+    - direct_application_data_write
+    - direct_Config_write
+    - direct_ConfigCAS_write
+    - sql_identity_or_permission_change
+    - trigger_or_profiler_installation
+  rule: "All experimental mutations happen through 1C; SQL is evidence, not the mutation transport."
+
+metadata_layers:
+  designer_save:
+    observe: [ConfigSave, ConfigCASSave]
+    apply_configuration: false
+  applied_configuration:
+    observe: [Config, ConfigCAS, physical_schema]
+    gate: explicit_experiment_requirement
+  extensions:
+    rule: "Capture the base and every extension as separate layers and record load order and ownership."
+
+xml:
+  role: offline_schema_reference_only
+  runtime_source: forbidden
+  rule: "XML may name the intended property and validate a learned rule, but live before/after evidence must come from SQL."
+
+promotion_gates:
+  - "The SQL diff is isolated from pre-existing Designer and configuration-check noise."
+  - "A stable public 1C property or value name is resolved without requiring callers to know GUIDs or SQL numbers."
+  - "The rule is reproduced with a second value or a second object of the same shape."
+  - "A regression fixture and decoder test are added."
+  - "Rollback through 1C restores the SQL evidence or the experiment documents an irreversible schema migration."
+
@@ -0,0 +1,40 @@
+id: 1c-readonly-query-policy
+status: active
+default_mode: deny
+allowed:
+  - select
+limits:
+  max_rows: 1000
+  default_rows: 100
+  timeout_seconds: 30
+  max_timeout_seconds: 120
+deny_patterns:
+  - "(?i)\\bВЫБРАТЬ\\s+РАЗРЕШЕННЫЕ\\b.*\\bПОМЕСТИТЬ\\b"
+  - "(?i)\\bПОМЕСТИТЬ\\b"
+  - "(?i)\\bУНИЧТОЖИТЬ\\b"
+  - "(?i)\\bОБНОВИТЬ\\b"
+  - "(?i)\\bВСТАВИТЬ\\b"
+  - "(?i)\\bУДАЛИТЬ\\b"
+  - "(?i)\\bALTER\\b"
+  - "(?i)\\bDROP\\b"
+  - "(?i)\\bUPDATE\\b"
+  - "(?i)\\bINSERT\\b"
+  - "(?i)\\bDELETE\\b"
+  - "(?i)\\bCREATE\\s+(LOGIN|USER|ROLE)\\b"
+  - "(?i)\\bALTER\\s+(LOGIN|USER|ROLE)\\b"
+  - "(?i)\\bDROP\\s+(LOGIN|USER|ROLE)\\b"
+  - "(?i)\\b(GRANT|DENY|REVOKE)\\b"
+masking:
+  enabled: true
+  fields:
+    - "(?i).*пароль.*"
+    - "(?i).*телефон.*"
+    - "(?i).*email.*"
+    - "(?i).*почта.*"
+    - "(?i).*паспорт.*"
+    - "(?i).*инн.*"
+audit:
+  log_queries: true
+  log_params: false
+  log_result_rows: false
+notes: "Read-only query runner policy. Connection identity comes only from the explicit base_id settings. Validate before execution and apply row limits/masking."
@@ -0,0 +1,65 @@
+id: 1c-sql-base-access-policy
+status: active
+default_mode: deny
+summary: "Every 1C base uses only its explicitly configured SQL connection; data is read-only and metadata writes are saved-state-only."
+
+base_settings:
+  selector: base_id
+  source:
+    - ONEC_SQL_BASES_JSON
+    - ONEC_SQL_BASES_JSON_FILE
+  required_fields:
+    - server
+    - database
+    - user
+  secret_fields_one_of:
+    - password
+    - password_env
+  rules:
+    - "Every live request must contain an explicit base_id."
+    - "Resolve server, database, user, and password only from the settings entry for that base_id."
+    - "Do not substitute another base, infer a SQL database name, or use shared/default SQL credentials."
+    - "Do not persist connection passwords in repository or project files."
+
+read_scope:
+  application_data: read_only
+  metadata_structure: read_only
+  configuration_tables:
+    Config: read_only
+    ConfigCAS: read_only
+    ConfigSave: read_only_except_saved_state_metadata_write
+    ConfigCASSave: read_only_except_saved_state_metadata_write
+
+write_scope:
+  allowed:
+    base_metadata_saved_state: ConfigSave
+    extension_metadata_saved_state: ConfigCASSave
+  forbidden:
+    - application_data_tables
+    - Config
+    - ConfigCAS
+    - SQL_system_tables
+    - SQL_security_objects
+  constraints:
+    - "The payload must be a metadata saved-state change, never application data."
+    - "The target table must be exactly ConfigSave or ConfigCASSave."
+    - "Require explicit saved-state write opt-in, expected SHA-1, backup, transaction, and readback verification."
+    - "A saved-state write must not activate or apply the configuration."
+
+sql_identity_management:
+  mode: forbidden
+  forbidden_actions:
+    - CREATE_LOGIN
+    - ALTER_LOGIN
+    - DROP_LOGIN
+    - CREATE_USER
+    - ALTER_USER
+    - DROP_USER
+    - CREATE_ROLE
+    - ALTER_ROLE
+    - DROP_ROLE
+    - GRANT
+    - DENY
+    - REVOKE
+  rule: "Use the login and password already stored in the selected base settings; never create or modify adapter-owned SQL identities or permissions."
+
@@ -0,0 +1,45 @@
+id: 1c-xml-decoding-reference-policy
+status: active
+summary: "XML exports are offline decoding evidence only; the running adapter is SQL-only."
+
+offline_analysis:
+  allowed: true
+  purposes:
+    - discover_metadata_kinds
+    - enumerate_declared_properties
+    - correlate_object_guids
+    - infer_binary_config_paths
+    - build_decoder_tests_and_fixtures
+  layer_rule: "Base configuration and every extension must be analyzed as separate layers."
+  output_rule: "Promote only generic, evidence-backed format rules and tests into the adapter; do not promote configuration-specific XML values as live answers."
+
+runtime:
+  source: sql_only
+  configured_by: base_id
+  settings:
+    - server
+    - database
+    - user
+    - password_or_password_env
+  xml_mount_required: false
+  xml_environment_variables_allowed: false
+  rejected_payload_arguments:
+    - xml_path
+    - xml_root
+    - meta_xml_path
+    - form_xml_path
+    - configuration_xml
+    - configuration_xml_path
+    - config_dump_info
+    - config_dump_info_path
+  rules:
+    - "Runtime metadata and data answers must be derived from the selected base_id SQL connection."
+    - "Runtime must not read Configuration.xml, ConfigDumpInfo.xml, form XML, extension XML, or an XML-derived object-value cache."
+    - "XML-derived decoder rules must remain generic and must be verified against live SQL bytes."
+    - "An XML export may differ from live extensions and therefore cannot establish the current runtime extension state."
+
+writes:
+  rule: "This policy does not broaden SQL write scope. Only the saved-state exceptions in sql-base-access-policy.yaml apply."
+  allowed_tables:
+    - ConfigSave
+    - ConfigCASSave