37 lines
2.1 KiB
YAML
37 lines
2.1 KiB
YAML
id: 1c-config-layer-write-policy
|
|
status: active
|
|
default_mode: deny
|
|
summary: "Writes to 1C configuration storage are read-first, save-layer-only."
|
|
rules:
|
|
- "This exception permits metadata saved-state payloads only; it never permits application-data writes."
|
|
- "Active-applied layers are read-only in adapter workflows: Config and ConfigCAS."
|
|
- "Saved, not yet applied layers are the only writable targets for configuration edits: ConfigSave and ConfigCASSave."
|
|
- "Base configuration changes map to ConfigSave; extension configuration changes map to ConfigCASSave."
|
|
- "Comparisons of pending changes must be run as ConfigSave↔Config and ConfigCASSave↔ConfigCAS before proposing production apply."
|
|
- "Any claim of applied state must be backed by live reads from Config/ConfigCAS only after explicit apply workflow."
|
|
- "Agent-facing write intents must resolve to a full 1C canonical path or concrete saved-state reference before planning."
|
|
- "Effective views are read targets only; write plans must identify base, extension, generated extension source, or saved-state ownership."
|
|
- "Concrete references must match the planned target kind: module targets may use module_ref, module_id, or module file_name; form targets may use form file_name or form_guid."
|
|
- "If metadata.write.plan returns allowed=false, metadata.write must not call lower-level apply methods."
|
|
- "Extension code changes must preserve the operation type: insert_before, insert_after, replace, or replace_with_control."
|
|
denied_actions:
|
|
- "write_to_Config"
|
|
- "write_to_ConfigCAS"
|
|
- "auto_apply_to_active_state"
|
|
- "direct_sql_apply_to_live_config"
|
|
- "write_effective_view_directly"
|
|
- "write_ambiguous_short_name"
|
|
- "write_plan_blocked_apply"
|
|
- "write_concrete_reference_kind_mismatch"
|
|
allowed_actions:
|
|
- "propose_save_layer_change"
|
|
- "plan_full_path_change"
|
|
- "read_Config"
|
|
- "read_ConfigSave"
|
|
- "read_ConfigCAS"
|
|
- "read_ConfigCASSave"
|
|
- "compare_saved_state"
|
|
notes:
|
|
- "Use this policy together with change-workflow to avoid mixing saved and active layers."
|
|
- "If a path requires production writes, treat it as out-of-band and human-controlled only."
|