Reply to ADR-010 with the eight requested decisions - #97
Open
heijiLee wants to merge 1 commit into
Open
Conversation
ADR-010 (PR #90) asked the development team eight questions. Answer each, marked as answered, needs-verification, or returned as a counter-question. The main substantive update: G-3's premise has changed since the ADR was written, and not by the author's error. Commit `4d38b28` was authored 2026-08-23 but only merged to main via PR #89 on 2026-09-04, after ADR-010 was written on 08-26, so the overwritable `registerElement` the ADR quoted was accurate against the main the author inspected. It is now one-shot immutable. That closes G-3's silent-relaxation risk and makes Q6 largely moot, but it did not deliver what PD-6 asked for (timelock plus append-only history plus role separation). It substituted immutability, which raises a question the ADR did not ask and which we return: with in-place replacement impossible, what is the procedure when a deployed element has a bug? Today that path is also the emergency path. For the same reason D-3 (hashing implementation addresses into `policyId`) now looks unnecessary: the engine holds its registries as `immutable` and element registration is one-shot, so an elementId hash is equivalent to an address hash for a fixed deployment. Offered as reasoning to check, not a decree. D-1's core claim is confirmed correct: `manifest.factsPacked` is already hashed into `policyId`, so parameters moved there enter it for free. Q3 and Q8 are answered with measurements: adding `elementId` to `check()` touches 1 interface, 25 element files, exactly 1 engine call site and 26 test files, which supports the assessment that now is the cheapest time. Q7, which the ADR left explicitly unverified, is answered directly: recipe address overwriting and alias hijacking are already guarded, leaving only the `latest` pointer transition uncontrolled, and no production path reads that overload, so it is a latent rather than live gap. Also notes that the external advisory input ("policy configuration belongs in on-chain contracts") does not resolve any of Q1 through Q8: both options under discussion are already fully on-chain, and the open question is where within the on-chain system the parameters live.
This was referenced Sep 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ADR-010(PR #90)이 개발팀에 물은 8개 질문에 대한 회신이다. 각 항목을 [답변]/[확인 필요]/[반문]으로 표시했다. 코드 변경은 없다.
관련: #90
먼저, 상태 변경 안내
ADR-010 §G-3은
registerElement가 기존 elementId의 주소를 조용히 덮어쓸 수 있다고 지적했다. 이 지적은 작성 시점 기준으로 정확했다. 커밋4d38b28은 2026-08-23에 작성됐지만 main에는 PR #89를 통해 2026-09-04에야 병합됐고, ADR-010은 그 사이인 08-26에 작성됐다. 즉 검토자가 실제로 본 main 기준으로는 맞았다. author error가 아니라 overtaken by events로 기록해주시면 된다.그런데 이 수정이 PD-6이 요청한 것을 그대로 준 건 아니다. PD-6은 timelock + append-only 이력 + 역할 분리를 요청했고, 실제로 반영된 것은 불변화다. 그래서 Q6은 사실상 moot가 되는 대신, ADR이 묻지 않은 질문이 새로 생겼고 이것을 되돌려 드린다: 교체가 아예 불가능해진 지금, 배포된 element에 버그가 있으면 어떤 절차로 고치는가? 지금은 이 경로가 긴급 교체 절차이기도 하다.
주요 답변
immutable로 들고 있고(ComplianceEngine.sol:62-64) element 등록이 1회성이므로, 고정된 배포에서 elementId 해시는 주소 해시와 동치다. 검증이 필요한 추론으로 제시했다.manifest.factsPacked가 이미policyId에 해시되므로(ComplianceEngine.sol:478-496), 파라미터를 거기로 옮기면 자동으로 들어온다.check()에elementId를 추가하면 interface 1곳, element 파일 25개, engine 호출부는 정확히 1곳(ComplianceEngine.sol:243), 테스트 26개 파일이 영향받는다. 리스크 낮은 기계적 작업이며, "지금이 가장 싸다"는 리걸 측 판단을 코드가 뒷받침한다.latest포인터 전환만 통제가 없다. 다만 이 오버로드를 읽는 production 경로가 없어(recipeOf호출부 3곳 모두 2-인자) 잠재 간극이며 오늘의 판정 경로에는 도달하지 않는다. 우선순위는 D-4보다 낮게 두자고 제안했다.외부 자문 의견에 대하여
"정책 설정을 온체인 컨트랙트로 정의하는 게 맞다"는 의견은 Q1
Q8 중 어느 것도 해소하지 않는다는 점을 적어두었다. 논의 중인 두 선택지(Manifest 저장 vs Element 컨트랙트 저장)는 이미 둘 다 완전히 온체인이고, 열린 질문은 온체인 시스템 안에서 어디에 두느냐와 그 값이Q8을 해소한 것으로 기록되면 안 된다는 취지다.policyId에 들어가느냐다. 방향 자체를 지지하는 입력으로는 환영하지만, Q1검증
docs 전용이라 build/test 영향 없음.