(groovy) branch doc/architecture-lookup-module-rule created (now 0cb27cccd8)

[bl...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

blackdrag pushed a change to branch doc/architecture-lookup-module-rule
in repository https://gitbox.apache.org/repos/asf/groovy.git


      at 0cb27cccd8 Update ARCHITECTURE.md

This branch includes the following new commits:

     new 0cb27cccd8 Update ARCHITECTURE.md

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(groovy) 01/01: Update ARCHITECTURE.md

[bl...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

blackdrag pushed a commit to branch doc/architecture-lookup-module-rule
in repository https://gitbox.apache.org/repos/asf/groovy.git

commit 0cb27cccd83c4402de0158bca5d586f5d9e8ec38
Author: Jochen Theodorou <bl...@gmx.org>
AuthorDate: Sat Aug 29 02:35:04 2026 +0200

    Update ARCHITECTURE.md
    
    Update ARCHITECTURE.md to include how a access control should be done in indy.
---
 ARCHITECTURE.md | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index 5c73176864..272e7e21d8 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -253,6 +253,16 @@ above. Each bites contributors quickly if missed:
   `@ASTTest` is the one first-party transform needing this: it
   rebuilds its closure from the raw source text and compiles it in
   a separate shell, so that code never appears in the AST at all.
+- **Use the call-site `MethodHandles.Lookup` for access checks.**
+  In indy linkage, member accessibility is determined by the
+  access context of the call site, not by whether Groovy's own
+  reflection context can make the member accessible. Prefer the
+  `Lookup` associated with the caller when creating method handles;
+  do not use `ReflectionUtils.makeAccessible` or cache a
+  caller-independent accessibility result as a substitute. Do not
+  reproduce Java/module access rules manually when a `Lookup` can
+  perform the check. The cached member representation describes
+  the member; the call site supplies the access context.
 
 ## Operator families