Repository navigation
docs: define ownership data and privacy contract - #75
Merged
Merged
Conversation
Authoritative Phase-1 data contract derived from the approved RFC and the measured GraphQL spike: - allowed/prohibited persisted fields with per-field justification - repo-scoped contributor identity (github_user_id + login; one "Unlinked contributor" bucket; no global contributor table) - directory-path storage policy (dir display paths yes, file paths never) - four-table candidate model with cardinality guardrails - deletion/cascade, RLS/service-role, versioning, telemetry, backup and migration/rollback contracts - draft privacy-page copy (not applied) + methodology disclosure - implementation test contract and go/no-go gates No migrations, no production code, no privacy-page changes. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
- linked identity keyed by GraphQL node id (author.user.id), not numeric user id; databaseId not requested - calculation_version is part of snapshot identity; explicit active_version/building_version serve gate with build-alongside, atomic flip, post-flip GC - corrected RLS wording: isolation rests on API scoping + user_id constraints + tests; RLS blocks direct client access only - scope_path_hash defined as current-path lookup key; renames create new scope identity; no lineage in V1 - unlinked is unresolved attribution, never a person; excluded from concentration metrics; new 'aggregate' kind for top-25 'other' bucket - monthly rows are immutable period facts; current-state fields moved to head rows; HEAD cardinality corrected - rollout gate: 2%-of-floor applies to HEAD blame only; total-cycle budget must be measured pre-GA - unlinked methodology copy tightened to non-speculative language - test contract extended: version coexistence/flip/GC, unlinked and aggregate semantics, foreign-user isolation Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- initial version bootstrap: active_version/building_version nullable; first build writes V1 under building_version with active null until validated completion promotes it atomically - tenant consistency enforced by composite foreign keys at the database, not application checks (repositories(id,user_id) surrogate unique; snapshot scope/contributor FKs tenant-qualified) - backup classification corrected: scopes/contributors/snapshots are CORE (irreplaceable for retained-disconnected repos); sync_state OPERATIONAL - privacy draft: identity storage stated transparently (minimal linked identity + aggregates), no "aggregates only" overclaim - durable-identity minimization: overflow contributors folded into 'other' transiently, no identity rows created for them - concentration metrics renamed human_*; bots excluded from contributor/maintainer/concentration counts by default - excluded-scope contradiction resolved: vendor/generated/binary/ submodule paths never persisted; excluded flag only for cardinality-capped persisted scopes - test contract: bootstrap/promotion, DB-level tenant mismatch rejection, backup class split, identity minimization, bot exclusion, path non-persistence Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Wave 3C Phase 1A — converts the approved ownership RFC (PR #73) and the measured Phase-0.5 GraphQL spike (PR #74) into an implementation-grade production data/privacy contract before any schema or ingestion work.
docs/ownership-data-privacy-spec.md: exact allowed/prohibited persisted fields, repo-scoped contributor identity model, path-storage policy, four-table candidate schema with cardinality guardrails, deletion/RLS/versioning/telemetry/backup/migration contracts, draft privacy-page copy (not applied), methodology disclosure, test contract, and go/no-go gates.docs/code-ownership-over-time-rfc.md.Firm decisions made (not TBD): dir display paths stored / file paths never;
github_user_id+ login persisted; single "Unlinked contributor" bucket; full monthly history no compaction; one snapshots table w/headgranularity; repository-scoped contributor identity (no global table).Docs-only — no migrations, production code, privacy-page, UI, or wiring changes.
Test plan
npm test— 505/505 passnpm run typecheck— cleannpm run build— cleannpm audit --audit-level=moderate— 0 vulnerabilitiesGenerated with Devin