id: 1c-config-layer-write-policy
status: active
default_mode: deny
summary: "Writes to 1C configuration storage are read-first, save-layer-only."
rules:
  - "This exception permits metadata saved-state payloads only; it never permits application-data writes."
  - "Active-applied layers are read-only in adapter workflows: Config and ConfigCAS."
  - "Saved, not yet applied layers are the only writable targets for configuration edits: ConfigSave and ConfigCASSave."
  - "Base configuration changes map to ConfigSave; extension configuration changes map to ConfigCASSave."
  - "Comparisons of pending changes must be run as ConfigSave↔Config and ConfigCASSave↔ConfigCAS before proposing production apply."
  - "Any claim of applied state must be backed by live reads from Config/ConfigCAS only after explicit apply workflow."
  - "Agent-facing write intents must resolve to a full 1C canonical path or concrete saved-state reference before planning."
  - "Effective views are read targets only; write plans must identify base, extension, generated extension source, or saved-state ownership."
  - "Concrete references must match the planned target kind: module targets may use module_ref, module_id, or module file_name; form targets may use form file_name or form_guid."
  - "If metadata.write.plan returns allowed=false, metadata.write must not call lower-level apply methods."
  - "Extension code changes must preserve the operation type: insert_before, insert_after, replace, or replace_with_control."
denied_actions:
  - "write_to_Config"
  - "write_to_ConfigCAS"
  - "auto_apply_to_active_state"
  - "direct_sql_apply_to_live_config"
  - "write_effective_view_directly"
  - "write_ambiguous_short_name"
  - "write_plan_blocked_apply"
  - "write_concrete_reference_kind_mismatch"
allowed_actions:
  - "propose_save_layer_change"
  - "plan_full_path_change"
  - "read_Config"
  - "read_ConfigSave"
  - "read_ConfigCAS"
  - "read_ConfigCASSave"
  - "compare_saved_state"
notes:
  - "Use this policy together with change-workflow to avoid mixing saved and active layers."
  - "If a path requires production writes, treat it as out-of-band and human-controlled only."