[authz] archtest: owner-scoped permission must use RequirePermissionForResource/Self (not bare RequirePermission) #2357

现状

#2207 made permission scope machine-readable (authz.Permission.IsOwnerScoped()). On the gRPC side this drives a Hard generate-time cross-check (owner-scoped ⟺ resource selector). The HTTP side has no equivalent machine check: choosing RequirePermission vs RequirePermissionForResource/RequirePermissionForSelf for an owner-scoped permission is a manual developer decision (documented Medium Go ceiling). An owner-scoped permission gated with bare RequirePermission would forward r.URL.Path and silently lock out the owner — the HTTP analog of the hole #2207 closed for gRPC.

修复方向

Add an archtest (type-aware AST scan, scope corecells/ + examples/) asserting: every route gate using an owner-scoped authz.Permission (per IsOwnerScoped()) is wired via RequirePermissionForResource/RequirePermissionForSelf, never bare RequirePermission. Anti-vacuity + RED fixture. Tightens the existing OWNER-SCOPED-GATE-EXACT-SET-01 from a frozen exact-set to a derived-from-scope invariant.

Files

• tools/archtest/ (new or extend owner_scoped_gate_01_test.go)
• framework/runtime/auth/permission.go (RequirePermission family — read-only reference)

Source

Derived via /ship #1795+#2207. Enabled by the A0 typed scope marker; explicit scope carve-out from PR #2349.