51 lines
2.6 KiB
YAML
51 lines
2.6 KiB
YAML
id: 1c-change-workflow-policy
|
|
status: active
|
|
default_mode: propose-only
|
|
rules:
|
|
- "Application data is read-only; no workflow may insert, update, or delete rows in application tables."
|
|
- "SQL identities and permissions are out of scope and must never be created or changed by this connector."
|
|
- "The model must not directly apply changes to a live 1C database."
|
|
- "Write operations to 1C configuration data must target only ConfigSave (base config) and ConfigCASSave (extension config) as the saved layer."
|
|
- "Do not write to Config or ConfigCAS from connector workflows; these are active-applied layers and read-only in the adapter path."
|
|
- "Before any write proposal, resolve user-facing targets to full 1C canonical paths or concrete saved-state references."
|
|
- "Before any write proposal, read origin/layer evidence for the effective target."
|
|
- "Before any apply method, require metadata.write.plan allowed=true for the same target and intent."
|
|
- "When the base repository is configured, require a verified adapter-owned repository lock session before any saved-state apply."
|
|
- "Repository backend, endpoint, bridge identity, runtime, and credentials must come from the selected base runtime settings; never infer them from hard-coded names."
|
|
- "Repository commit requires an explicit approval flag and a non-empty version comment."
|
|
- "Concrete saved-state references must be compatible with the selected target kind; do not use form_guid for module writes or module_ref for form writes."
|
|
- "Do not treat a local BSL symbol path as a metadata path until it is resolved inside the current code context."
|
|
- "Do not write effective module or form text directly; route through a write plan with layer provenance."
|
|
- "After modifying saved layers, require explicit compare and human approval before any production apply step."
|
|
- "The model may generate a change proposal, patch, or review checklist."
|
|
- "Human approval is required before apply."
|
|
- "Production changes require backup, test run, and rollback plan."
|
|
stages:
|
|
- propose_change
|
|
- static_review
|
|
- run_tests
|
|
- expert_review
|
|
- manual_approve
|
|
- apply_change
|
|
- verify
|
|
- rollback_if_needed
|
|
required_for_approval:
|
|
- risk_summary
|
|
- affected_objects
|
|
- canonical_paths
|
|
- layer_provenance
|
|
- references_found
|
|
- test_plan
|
|
- rollback_plan
|
|
denied_without_approval:
|
|
- modify_configuration
|
|
- update_database
|
|
- run_data_processor
|
|
- delete_objects
|
|
- change_roles_or_permissions
|
|
- write_active_configuration
|
|
- write_ambiguous_target
|
|
- write_without_origin_evidence
|
|
- write_when_plan_blocked
|
|
- write_concrete_reference_kind_mismatch
|