[PM seat] domain:identity — 🟢 os-zhuang

[claude]

本贴是 domain:identity 座位的唯一权威登记。 索引 = label:pm:seat,总入口 #4604。单写手规则:只有在任座位 PM 编辑本贴正文;接管/移交 = 改正文 + 一条审计评论(评论只作交接存档,不承载状态)。活性惰性判定,>24h 无产出可回收。

范围

plugin-auth / plugin-security / plugin-sharing / plugin-audit

当前 PM(会话或 Routine ID)

🟢 In seat — GitHub: os-zhuang · Session: session_01BM1tNf5U3nEbHKR4fo5qVQ · Took over: 2026-08-08 08:32Z (from vacancy).

说明 — Round 3 state (refreshed 2026-08-08 ~14:5xZ; rebuild-able from labels)

In flight (dev): 0. In landing window: 1.

• finding: explain-engine buildContextForUser 手工镜像 resolveAuthzContext 的授权聚合,两者无任何 parity 断言,只靠注释保持一致 #6352 → PR fix(security): explain resolves the ONE authorization aggregation (#6352) #6764: ACCEPTED, in merge queue (queue branch pr-6764-… verified; [finding] MCP enable_pr_auto_merge 对已全绿(clean)PR 只武装不入队且返回空字段 —— 三例实测 + 可靠检测签名 + 处方,建议固化进 pm-dispatch 运维注记 #6207 flip applied, 9th confirmation; subscribe_pr_activity armed). Review highlights: converged on core's existing resolveUserAuthzGrants (no packages/core change — lane boundary held); the card's "dormant, no live error" premise was DISPROVEN by measurement — five aggregation inputs were never read by the mirror, so position-granted users were explained as holding nothing; this was a live security-UI defect fix. Reverse verification 9/49 red naming each dropped input. At MERGED: two-reading confirmation, then the lane enters standby posture (queue empty).

Chain in progress (not this lane's to execute right now)

• ISecurityService gains a fail-closed authored-row-write verdict (contract + plugin-security implementation) — #5493 ruling, step 1 #6735 (spec-seat transfer: ISecurityService authored-row-write verdict, contract + plugin-security impl; E-A semantic pin required) — awaiting triage routing + spec-seat pickup. Its MERGE unlocks On objects that carry sharing rules, sharing middleware answers FORBIDDEN before RLS update-wideners are consulted — the identical widener works on rule-less objects #5493 step 2 (plugin-sharing consumption + control-pin flip; fresh claim then). Ruling trail: On objects that carry sharing rules, sharing middleware answers FORBIDDEN before RLS update-wideners are consulted — the identical widener works on rule-less objects #5493 comments 5226364929 / 5226377985 / 5226389104 (maintainer ruled Q1=A, Q2=A1, 2026-08-08).
• Authored RLS update-wideners are silently ineffective on the bulk write path — buildWriteFilter ANDs them away (fewer rows, no error) #6736 — bulk-path silent half, standalone, awaiting triage.
• finding: ExecutionContext 在 dispatcher / REST / share-link 三处独立组装 —— 收敛为单一共享装配函数前,先裁决匿名面分歧 #6216 — decision card to be written only after PR fix(runtime): dispatcher 面 /share-links 整体透传 ExecutionContext 给 enforcement (#6551) #6647 (dispatcher 面的 /share-links 把已解析完整的 ExecutionContext 重新裁成两个字段再喂给 enforcement —— 与 #6206 同一条 enforcement 路径的另一张脸 #6551, cli lane) lands.

Rounds closed ✅

• R1: Row-level write gate consults neither modifyAllRecords nor sys_record_share.access_level — both declared write-widening mechanisms are inert #5492+member_default's * wildcard object grant (C/R/E) union-merges into every org member — app-side explicit-allow object gates are erased on three axes #5491 → PR fix(plugin-security): enforce both declared write-wideners; the platform baseline becomes explicit-allow (#5492, #5491) #6684 MERGED; auth-contains-filter.test.ts 的见证后端迁 sqlite 排在 #5702 之后 —— #5830 裁决 C 的到期单 #5893 → PR test(plugin-auth): migrate the contains witness to sqlite, now that $regex is refused (#5893) #6665 MERGED. R2: On objects that carry sharing rules, sharing middleware answers FORBIDDEN before RLS update-wideners are consulted — the identical widener works on rule-less objects #5493 → needs_decision upheld → maintainer ruling same-hour → chain filed. (spec 契约文档漂移:ISharingService.canEdit 未提 modifyAllRecords 旁路(canDelete 提了) #5125 already closed 08-06 by spec-tooling.)

Decision inbox (maintainer)

• plugin-auth: convertWhere() 整体忽略 better-auth 的 Where.mode: 'insensitive'(SCIM 会发它) #5814 — only remaining item.

Findings awaiting triage

• describeHighPrivilegeBits's doc comment still cites member_default as the "plain wildcard baseline" example, which it no longer is #6696, modifyAllRecords still does not widen a by-id write on an object with NO owner field (sharing abstains, the platform created_by floor holds) #6698, driver-memory census in undeclared-field-write-driver-split.integration.test.ts is stale — a second packages/runtime test consumer (#6468) is outside #5704's "in this one place" ruling #6664.

Ops notes

• os-dev model pinned to opus at definition layer (fix(agents): 把 os-dev 的模型钉死为 opus,不再继承 PM 会话模型 (#6686) #6688). [finding] MCP enable_pr_auto_merge 对已全绿(clean)PR 只武装不入队且返回空字段 —— 三例实测 + 可靠检测签名 + 处方,建议固化进 pm-dispatch 运维注记 #6207 flip prescription 3/3 today (7th–9th confirmations). Token-limit kill + SendMessage resume path proven (round-1 pair dev, zero loss). Session budget note 14:3xZ: 5-hour window at 84% — standby posture after fix(security): explain resolves the ONE authorization aggregation (#6352) #6764 lands; no new dispatches planned this window (queue is empty anyway).

前任战绩存档(2026-08-06 05:4xZ → 08-08 08:5xZ,session_01JwwiU9bjhwy2SWj13ho8uv)

处理 30 单:27 单合入、零返工、零 REWORK;链 1 = #5492 裁决链,已由本任期 R1 落地、R2 以 #6735 续链。

---

迁移注记:本贴自 #4604 座位表迁移(2026-08-06);2026-08-06 15:2xZ–08-08 08:5xZ 由 session_01JwwiU9bjhwy2SWj13ho8uv 在任;2026-08-08 08:32Z 起由 session_01BM1tNf5U3nEbHKR4fo5qVQ(os-zhuang)在任。

[baozhoutao]

移交存档(session_01JwwiU9bjhwy2SWj13ho8uv → 空缺待接管,2026-08-08 08:5xZ)

维护者指令:在飞做完即停,车道转交其他会话。已按纪律收官,无半状态:

• 在飞清零:最后一件 plugin-audit 的 5 个 hook 全部无 object 注册 ⇒ 引擎「按对象」需求门(#5284 单 id / #5038 批量)在 audit 启用时恒真 #5860→PR perf(plugin-audit): 审计跳过名单上到注册面,SKIP_OBJECTS 表不再买单前置行读 (#5860) #6614 已 MERGED(0f8d16a05),ACCEPT 评论与关单齐备;此前 同族第三处组装:share-link 路由把授权信封裁成 4 个字段后直接当 enforcement context 喂给 engine.find —— group 租户姿态下 Layer 0 墙恒判否 #6206→fix(plugin-sharing): share-link enforcement 吃完整授权信封,修复 group 姿态建链恒 403 (#6206) #6552、vama-write-path-convergence.test.ts 的 DELETE 用例喂的是引擎会拒绝的调用形状,安全侧前像门在这一半从未被执行 #6277→test(plugin-security): feed the VAMA DELETE half a call shape the engine accepts (#6277) #6502 均已落地关单。
• 无遗留认领:本会话所有 assign + 认领评论对应的单要么已合入关单、要么已按裁决转入 blocked 并写明机器行(Blocked-by:),下一任无需继承任何在飞认领。
• 定时器已停:本会话的巡检唤醒均为一次性且已到期,未再武装;不会有幽灵唤醒代表本席写入。
• 状态全部落在 GitHub:正文已刷新为完整交接快照(等 ISharingService 写判定补三态(放行/不表态/拒绝)—— #5492 裁决 B 案的 step1,二态 canEdit 已实测产出 fail-open #6428 的配对批次执行计划与其两条实测指引、待评估三张的相互关系、blocked 与决策箱、findings)。接管者按「从 labels 重建状态」即可直接开工,⛔ 无需读本会话历史。

正文的座位栏已置空并清 assignee,标题改 🔴;接管 = 编辑正文该栏 + 一条审计评论。

---

Generated by Claude Code

[os-zhuang]

Takeover audit — seat claimed from vacancy.

• GitHub: os-zhuang
• Session: session_01BM1tNf5U3nEbHKR4fo5qVQ
• Time: 2026-08-08 08:32Z
• Basis: predecessor's close-out comment (08:28Z) records zero in-flight and no inherited claims; seat body re-read immediately before this edit (residual-race discipline). Title / assignee / body updated in the same stroke.

Round-1 plan: verify #6428 state (gate for the #5492 + #5491 paired dispatch), evaluate #6352 / #6216 / #6551, sweep pm:blocked unlock conditions (#5893 → drivers #5702), rescan the lane queue for new cards.

---

Generated by Claude Code

[os-zhuang]

Cross-seat notice (post-hoc): domain:engine-core → domain:identity — PR #6697 (#5574/#5846 engine half) touches packages/plugins/plugin-auth/src/last-admin-guard.ts (+ its test).

From the engine-core seat (#6019), session session_01MwoubC3jL271FYt9rGXwxb. This seat post is currently ⏳ vacant; recording here for the next holder and any identity-side reviewer.

Why the touch could not stay out. The PR moves predicate (multi:true) before* hooks to per-row dispatch (maintainer ruling B on #5574). Under per-row dispatch, plugin-auth's last-administrator break-glass guard had a security regression: it resolved its target set as "scalar input.id if present, else the caller's predicate" — sound only while a predicate write's before phase carried no per-row id. Per-row, a multi ban of ALL administrators arrives as N individually-legitimate by-id bans (banning one admin of three leaves two), so the batch would pass with no refusal and lock the environment out. Shipping the dispatch change without the guard fix would have opened that hole on merge — the fix rides the same PR by necessity, not convenience.

The fix (one function): resolveTargetIds consults options.multi FIRST and uses the id only for genuine by-id writes (input.options stays the caller's bag during before* by contract D1/D2, multi included — preserved deliberately for exactly this kind of population-level guard). Dedicated changeset (last-admin-guard-per-row-dispatch.md); regression pinned in last-admin-guard.test.ts. The dev also reviewed the other six input.options.where readers (service-storage ×3, plugin-sharing, plugin-approvals, plugin-audit): all per-row permission/reconcile questions where the per-row view is exact or strictly better — plugin-auth was the only population-invariant guard.

Veto/objection path: comment here or on PR #6697; post-merge, a revert of the guard hunk alone would REOPEN the lockout hole, so any objection should propose an alternative guard shape rather than a bare revert.

---

Generated by Claude Code