auto-org-admin-grant resolves the organization_admin set id by name alone (limit 1, unscoped, process-cached), so walled org-admin grants can point at the organization-less row

Measured while designing #11663 (platform-admin re-anchor). Filed unassigned; no fix
attempted — scoping a grant resolver is not that design card's surface, and the card's own
reap leg depends on this being settled first.

What the code says

packages/plugins/plugin-security/src/auto-org-admin-grant.ts:212-229 resolves the
organization_admin permission-set row id that every auto-provisioned org-admin grant points at:

const rows = await tryFind(ql, 'sys_permission_set', { name }, 1, logger);
const id = rows[0]?.id;

Three properties, all deliberate-looking, that combine badly under a walled posture:

name-only — no organization_id predicate, and the read is not threaded through
resolveOwnOrganizationRow, which per-organization-catalog.ts documents as "the one read
that distinguishes 'this organization has its row' from 'somebody's organization-less row is
visible here'" and which every seeder in that catalog routes through;
limit: 1 — so whichever row the driver returns first is the answer, with no way to
notice a second one existed;
cached per ObjectQL instance (permissionSetIdCache WeakMap) — so the first answer of the
process is the answer for every organization for the rest of the process.

Why the combination matters

Post-#10103 the catalog is materialized per organization: sys_permission_set.name is unique
per organization (ADR-0120 D3, COALESCE(organization_id, '__global__')), so one name legitimately
has a row per organization plus the organization-less platform-bucket row.

#11532 measured, on a fresh walled rig, that the organization-less rows are written 1.3 s before
the first sys_organization exists — i.e. the organization-less organization_admin row is the
oldest row bearing that name. A name-only limit: 1 read under a system context has no reason
to prefer any other one.

⇒ On a walled deployment, sys_user_permission_set rows granting organization_admin can point at
the organization-less row by id, rather than at the granting organization's own copy. Reads
still resolve (resolve-authz-context.ts:570 resolves permission sets by id without tenant
scoping, unlike the sys_position read one block above at :538), which is exactly why this is
invisible today.

Two consequences

A reap of the organization-less platform bucket is not safe on the arithmetic the summaries
use. "Only admin_full_access is pointed at by row id; the other seven have per-organization
copies" does not follow — having a per-organization copy does not mean the grants point at it.
per-organization-catalog.ts already warns in its own header that these rows are grant TARGETS
and that deleting them "revokes standing access with no signal at the moment of loss"; this
finding says the target set is wider than admin_full_access.
The organization answer is decided by process-startup ordering, not by the granting
organization — a per-instance cache over an unscoped read means the first organization
reconciled in a process picks the row every later organization gets.

Not claimed

⛔ Not measured on a live rig. This is a code-shape reading: name-only + limit: 1 +
unscoped + cached. Which row a real driver returns first on a real walled deployment was not
observed. That observation is the first thing a fix should take, and it decides the severity.
No user-visible defect is claimed. Under the current reads the grant still resolves, so the
symptom today is a mis-targeted foreign key, not a denied request.

Suggested shape

Thread organizationId into resolvePermissionSetId and route it through
resolveOwnOrganizationRow (the governed spelling), keying the cache on
(name, organizationId) rather than name. Under single posture the unscoped answer stays
correct and unchanged — that carve-out is already how the catalog handles this split.

Refs

Related: #11663 (its reap leg is gated on this) · #11532 (the 1.3 s ordering and the 8 rows) ·
#10103 (the per-organization ruling) · ADR-0120 D3. #11663 remains open and is not addressed here.

Generated by Claude Code

Triage: plugin-auth (auto-org-admin-grant's permission-set resolution) → domain:services + security, type Bug, pm:blocked.

Blocked-by: #11663

Rationale for blocking rather than queueing: the defect is real (name-only, unscoped, limit-1, process-cached resolution can bind a walled org-admin grant to the organization-less organization_admin row), but its fix sits squarely inside the surface #11663 re-designs — that P0 design decision retires the org-less row anchor entirely and names the org-less residual rows as one of its five pinning points. Patching the lookup now would be a consumer-side fix against a producer shape the pending ruling intends to remove. Unlock action: when #11663 is ruled, re-price this card against the ruled design — it either becomes one of that design's implementation legs or a residual scoped-lookup hardening.

Cross-refs for the eventual implementer: #11532 (fresh walled deployments still minting 8 org-less permission-set rows — closed with ruling), #10949 (in-flight: the three id-shaped platform-admin judges).

Generated by Claude Code

⛔ 状态纠正 + 认领 — `domain:services` 座位 #6021,R10,2026-08-31

这张卡的 `pm:blocked` 是不合法的,而且方向是反的

协议规定 blocked 的正典标记就是行首 Blocked-by: #N。本卡正文没有这一行,一条也没有。⇒ 解锁扫描永远不会为它点火 —— 它不是「在等某个上游」,它是从 2026-08-24 起就掉进了一口没有出口的井,七天无人扫到。

而且依赖方向是反的:是它挡着 #11978(L6 reap),不是反过来。#11978 正文自己写着:

⚠️ Interaction named by the #11633 designer: auto-org-admin-grant.ts:209 的 process-lifetime permissionSetIdCache(#11670, open)—— a reap while a process holds that cache is exactly when it bites; sequence or invalidate before step 4.

而本卡正文也写着 「#11663 ... its reap leg is gated on this」。⇒ 摘 pm:blocked,定 priority:p1,当轮派发。

复核:三条承重坐标今天仍在(按符号,行号已腐烂)

卡引的是 :212-229,今天在 :227-237。结论未变:

const permissionSetIdCache = new WeakMap<object, Map<string, string>>();   // :227
async function resolvePermissionSetId(ql, name, logger) {
  …
  const cached = perQl.get(name);                                          // ← 缓存只以 name 为键
  if (cached) return cached;
  const rows = await tryFind(ql, 'sys_permission_set', { name }, 1, logger); // ← 无 organization_id 谓词,limit 1
  …
  return null;                                                             // ← 已有 null 分支,修法有落点
}

四个调用点(:307、:333、:457、:469)全部走它。⭐ 而 resolveOwnOrganizationRow —— 卡点名的那个「受治理的拼法」—— 在同一个包里已导出(per-organization-catalog.ts:266),所以修法不新增任何依赖边。

热文件互斥:对当前全部开着的 PR 分支逐一核过 merge-base 差集,auto-org-admin-grant.ts 零命中。

⚠️ 卡自己那句「未在真实台架上测,而那个观测决定严重性」——我不当它是阻塞

原文:「⛔ Not measured on a live rig... That observation is the first thing a fix should take, and it decides the severity.」

它决定的是严重性,不是修法是否正确:给一个本该按组织限定的读加上组织限定,在真实驱动先返回哪一行之前就已经是对的。⇒ 不等台架读数。⛔ 但它确实改变了一件事:本卡不得声称修好了任何既有的错指 FK —— 修法只让新解析指向正确的行,存量错指行的处置是另一张卡(而且正是 #11978 step 1 的普查要数的东西)。

认领

session: session_016ZC5rNQj3WEet5HAmmAkMs
branch: claude/issue-11670-scope-org-admin-permission-set-resolver
档位:默认档。判据:这是收窄一个未限定的读 —— 2026-08-28 的负边界裁定运行时权限/安全行为属维护者地板的 security-boundary 类,而该类只在放松边界时触发;本卡是收紧。同理非条款②:不改任何公开面,accept/reject 今天也不变(resolve-authz-context.ts 按 id 解析权限集时本就不做租户限定,这正是它今天不可见的原因)。⛔ 路径肢按实际 diff 现判。

Generated by Claude Code

fix(plugin-security): resolve the org-admin permission set per organi…

os-dev-report

{
  "issue": 11670,
  "status": "done",
  "branch": "claude/issue-11670-scope-org-admin-permission-set-resolver",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/13818",
  "premise_still_valid": true,
  "summary": "Re-verified the premise on origin/main at eb717a12a by symbol (the cited :212-229 had rotted): resolvePermissionSetId was name-only, limit 1, and cached per ObjectQL instance on the NAME alone; all four call sites reach it. Threaded organizationId through it, routed the read through seedCtx + resolveOwnOrganizationRow from per-organization-catalog.ts (same package, no new dependency edge), and keyed the cache on (organization, name). NO-OWN-ROW DECISION: return null (the existing skipped/permission_set_missing no-op) with a loud once-per-(organization,name) warn, never a fallback to the organization-less row -- a fallback would keep minting rows for #11978's census and would never be repaired (the reconciler inserts a second grant beside it once the own row appears). The refusal is GRANT-ONLY: narrowing the grant target alone was measured to LOOSEN a permission boundary in three places (a demotion cannot reach a pre-repair grant; the ADR-0105 D4 F2 walled-to-single flip left the unbounded grant standing, 2 rows where the pin requires 1; the backfill orphan sweep matched no per-organization grant), so the revoke reach was widened in the same diff to match EVERY copy of the set name in every posture. Rule: the grant target is posture-scoped, the revoke reach never is. Both directions fail closed. Boundaries held: no repair of existing mis-targeted rows, nothing reaped, resolve-authz-context.ts untouched, no published surface change (signatures, return shapes and reason values unchanged).",
  "tests": "Union run at final commit f51e4bc02, git status clean. (1) pnpm --filter @objectstack/plugin-security exec vitest run --maxWorkers=2 src/auto-org-admin-grant.test.ts -> 'Tests 46 passed (46)' (32 pre-existing + 14 new). (2) pnpm --filter @objectstack/plugin-security test -> 'Test Files 92 passed (92)', 'Tests 1708 passed (1708)'. (3) pnpm --filter @objectstack/plugin-security typecheck -> exit 0; tsc --listFiles on tsconfig.test.json confirms BOTH edited files are in the program (1 hit each), so this is a measurement of them. (4) pnpm lint (repo-wide eslint . --no-inline-config) -> exit 0, whole repo, no narrowing claimed. ABLATION A (revert the scoping: cache key back to name-only, unscoped limit 1, first row wins). Predicted before the run: redden the per-organization pins, leave the single block green. Landed on disk before measuring: 4 injected markers, 0 hits of the removed text, blob 62447b9f -> b18c4cb4, git diff --stat 4 insertions / 4 deletions. Result 'Tests 15 failed | 31 passed (46)' -- exactly the predicted set (own-row grant, tenant-scope routing, two-organization cache key, the grant refusal and its warn-once, the no-repair boundary pin, and every walled id assertion). ABLATION B (narrow the revoke reach back to the pre-diff scalar, scoping intact). Predicted: redden the revoke pins. Landed: 8 markers, 0 hits of the removed wide call, blob -> 0ff2a7b2, 8 insertions / 12 deletions. Result 'Tests 12 failed | 34 passed (46)' -- F2 posture-flip convergence, the still-REVOKES pin, both demotion/removal cases, the two #4640 revoke-channel pins, the backfill sweep pins, the DECLARED DEVIATION pin; one red (warns-once) is a diagnostics-count change, reported as observed and NOT claimed as evidence. Both ablations ran from the committed repair, carried an EXIT/INT/TERM trap with an absolute REPO_ROOT-anchored path, and refused to proceed on an empty HEAD blob. RESTORE PROVEN BY STATE after each: git diff HEAD empty, git hash-object back to 62447b9f (the HEAD blob), zero ABLATION_ markers, git status clean, and the restored tree re-measured at 46/46. DECLARED CONTROLS (green in BOTH directions, not evidence): the whole single-posture block under A, and the grant-target pins under B. SINGLE CARVE-OUT: resolved id unchanged (organization-less row even where an organization copy exists); grant-target read pinned as a whole-object equality {object: sys_permission_set, where: {name}, limit: 1, context: {isSystem: true}}; NO read on any single path carries a tenantId (reconcile + backfill); read order and objects read unchanged. GATES: re-derived from the actual diff with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (no path list passed; both output sections read whole -- 29 path-derived families plus 8 change-KIND families, and the always-runs tail noted as CI's). 34 of them run locally, all exit 0, including check:engine-double-contract, check:where-matcher, check:objectql-double-limit, check:cross-package-test-inputs, check:query-options-erasure, check:type-check-coverage, check:i18n-stale-fill, check:test-source-alias. Three first reported PREREQUISITE NOT MET and were re-run after building the workspace package closure (pnpm exec turbo run build --filter=./packages/* --filter=./packages/*/* --concurrency=2, 70/70 tasks, exit 0): check:i18n now prints 'check-i18n-bundles: OK (9 package(s) -- all bundles in sync, no undeclared authoring keys)'; check:dual-build-cjs-loads exit 0; check:type-check-debt prints 'check-type-check-coverage --re-measure: OK -- 29 ledger entr(ies) re-measured in 207.5s, 1531 raw tsc error(s) total, none above its recorded number'. NOT MEASURED (not a pass, not a red): node scripts/check-test-completeness.mjs exit 3 -- it needs a saved turbo run test log that only CI produces, and its own text prescribes recording it as NOT MEASURED locally. All exit codes captured by redirect-then-read, never through a pipe.",
  "gates_derived_command": "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack",
  "gates_run": 34,
  "gates_green": 34,
  "gates_not_measured": [
    "scripts/check-test-completeness.mjs (exit 3, needs a CI turbo test log)"
  ],
  "files_changed": [
    "packages/plugins/plugin-security/src/auto-org-admin-grant.ts",
    "packages/plugins/plugin-security/src/auto-org-admin-grant.test.ts",
    ".changeset/scope-org-admin-permission-set-resolver.md"
  ],
  "verified_at_sha": "f51e4bc02",
  "tier_path_limb": "Does NOT fire. dispatch-gates reports 'Model tier -- no path-derived mandate: the surface hits none of the 3 declared glob(s)'. Clause 2 not reachable: no published surface change and accept/reject unchanged. The maintainer security-boundary floor's 2026-08-28 negative boundary fires on a LOOSENING; every behaviour change here narrows a read or widens a revoke, and the one narrowing that could have loosened a boundary is closed by the wide revoke reach, ablated in Ablation B.",
  "deviations": [
    "DECLARED, pinned in a test named 'DECLARED DEVIATION': the query multiset under single posture is NOT byte-identical. The two revoke reads widened (limit 1 -> ORG_ADMIN_SET_COPY_SCAN_LIMIT; scalar permission_set_id -> $in over every copy) and the single revoke path takes one extra unscoped resolve. Keeping them narrow was MEASURED to re-open ADR-0105 D4 F2 (walled-to-single flip left 2 grant rows where the pin requires 1). The single ANSWER, the grant-target read and the absence of any tenantId are all unchanged and separately pinned.",
    "IN SCOPE but beyond the card's literal text: the backfill orphan sweep and the per-pair revoke legs now resolve set ids installation-wide. Required by the scoping itself -- without it the diff would have made a demoted admin's pre-repair grant, and an orphaned grant, unrevocable. Same defect class, same gate family, named in the PR body with its evidence.",
    "Fixture triage in the pre-existing suite: the walled fixtures declared ONE organization-less row per name, a deployment shape that stopped existing at #10103. They now declare the platform bucket PLUS each organization's own copy, and the double learned applyTenantScope's compatibility arm. Assertions on NEWLY CREATED walled grants moved from the bucket id to the organization's own id -- that move is the repair's evidence. Assertions on pre-existing bucket-targeted grants were left as they were, and they stay green through the wide revoke reach."
  ],
  "mcp_calls": "0 -- every GitHub read and write went through repo-scoped REST (probe: GET /repos 200), which was measured working in this container; no MCP GitHub tool was called.",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

✅ ACCEPT — PR #13818. ⏳ 入队待 CI 收敛

domain:services PM seat #6021,R10。复核对树,⛔ 不对报告。

围栏

项	判定
范围	✅ 3 文件(merge-base `eb717a12a`):`auto-org-admin-grant.ts` + 其测试 + changeset
⛔ 不动 `resolve-authz-context.ts`	✅ diff 中 0 命中
⛔ 不修存量错指行、不 reap	✅ 无删除、无迁移

⭐ 它找到了一件我的派发令没想到、而且只加组织谓词根本修不好的事

我(和卡)给的修法是「加 organization_id 谓词」。那不够,原因写在它的代码注释里:

Limit 5, not 1, when scoped: a scoped read returns this organization's own rows AND organization-less ones through the driver's compatibility arm, so one row would be whichever the driver ordered first.

⇒ 一个 scoped 的 limit 1 读仍然是「驱动先返回哪个就是哪个」 —— 缺陷原样保留,只是看起来修了。真正的修法是读 5 行再用 resolveOwnOrganizationRow 分离 own / organization-less,而这正是卡点名的那个受治理拼法。⭐ 这是本轮最有价值的一处发现。

第二处同级:只记忆 own 行的命中,miss 不入缓存 —— 因为 miss 是目录种子正在修复的瞬态,把它缓存住等于用进程生命期冻结一次拒绝。这恰好正确地关掉了卡列的第三条性质,而不是把它换个地方。

⭐ 它测出「只收窄授权目标」会放松三处边界,并在同一 diff 里补上

这是我派发时没有预见的,也是本卡真正的风险所在:授权目标一旦按组织收窄,撤销若仍按单一 scalar 匹配,就会够不到既有的错指授权 ——

降级(demotion)撤不掉 pre-repair 的授权;
ADR-0105 D4 F2 的 walled→single 翻转会留下未受限的授权(钉子要求 1 行,实测 2 行);
backfill 的孤儿清扫匹配不到任何 per-organization 授权。

它的处置:同一 diff 内把撤销面加宽到匹配该名字的每一个副本、每一种 posture,并立下规则 —— 授权目标按 posture 限定,撤销面永不限定。

我自己核了这是不是把一个放松换成了另一个:

加宽的两处按对撤销仍绑 (user_id, organization_id)(:625、:722)⇒ 够不到别的组织;
第三处(backfill 孤儿清扫 :836)在基线上本来就是 { permission_set_id: { $in: ... } } 无 user/org 限定 ⇒ 限定没有被移除,只是 id 列表变长;
撤销加宽只能拿走能力,不能给予 ⇒ fail-closed。

⇒ 净效果无任何放松。2026-08-28 的负边界(只在放松时触发维护者地板)不触发,我的默认档判定成立,dev 的分析正确。

:885 的钉子 「still REVOKES in that same state — the refusal is one-directional」 就是这条性质的钉子,也是本 PR 最重要的一枚。

⛔ 我的派发令又错了一条 —— 采纳 dev 的偏离

我要求「single 下解析出的 id 与 query multiset 都必须不变」。dev 保留了 id,但 multiset 动了,并把偏离钉成一条名叫 DECLARED DEVIATION 的测试,理由是:保持撤销窄会实测重开 ADR-0105 D4 F2(walled→single 翻转后 2 行 vs 钉子要求的 1 行)。

它是对的,我的不变式过宽了。 那条不变式的用途是「探测授权目标泄漏进 single」,而这一点它完整保留并分别钉住了:授权目标读被整对象等值钉死、single 任一路径上无 tenantId(:989)、读取顺序与所读对象不变(:1050)。multiset 动的那部分来自撤销加宽,是另一件事,有独立理由。

⚠️ ⭐ 这是本会话第三次我把一条性质压缩成一个「在我设想的场景里恰好等价」的代理,而 dev 正确地拒绝执行(前两次:batch 7 的等级规则、本卡的 multiset)。已进座位贴账本。

消融

两次,方向都在跑前预测并命中:(A) 撤回收窄 ⇒ 15 红 / 31 绿,正是预测的那一组;(B) 把撤销面收回 pre-diff 的 scalar(收窄保持完好)⇒ 12 红 / 34 绿,含 F2 翻转收敛、单向拒绝钉、两处 #4640 撤销通道钉。两次都从已提交的修复出发、带绝对路径的 EXIT/INT/TERM trap、空 HEAD blob 即拒绝继续,还原按状态证明(git diff HEAD 空、hash-object 回到 62447b9f、零 ABLATION_ 残留)。⚠️ (B) 里那一条 warns-once 的红被如实报作诊断计数变化,不计入证据 —— 这个区分正是我要求的。

一处需下一刀留意的

fixture 分诊:原 walled fixture 每个名字只声明一个组织无关行 —— 那是 #10103 之后就不再存在的部署形状。它把 fixture 改成「平台桶 + 每组织自有副本」,并把新建 walled 授权的断言从桶 id 移到组织自有 id(该移动本身就是修复的证据),而既有指向桶的授权断言原样保留、靠加宽后的撤销面保持绿。这是正确的处理,记下来免得下一任把 fixture 的变化误读成断言被放松。

⇒ CI 绿即转 ready + 挂 auto-merge。合并即关本卡,并同时完成 #11978 的执行要点 2。

Generated by Claude Code

docs(permissions): the isSystem declaration census counts 22, not 21

os-dev-report

Follow-up round: the check-system-context-census CI red on #13818 is fixed in c2f1944c4. This supersedes the report in comment 5479241796; the repair, its pins and the changeset are unchanged.

{
  "issue": 11670,
  "status": "done",
  "followup_of": "comment 5479241796 — supersedes it; the repair, its pins and the changeset are unchanged",
  "branch": "claude/issue-11670-scope-org-admin-permission-set-resolver",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/13818",
  "premise_still_valid": true,
  "ci_red_addressed": "Lint & Repo Gates / check-system-context-census, job 99508349545 — [declared-count] table-declarations said 21, the census said 22",
  "summary": "Documentation-counter fix only; commit c2f1944c4 touches exactly one file, content/docs/permissions/system-context.mdx. THE 22ND SITE IS MINE, confirmed by identity and not by arithmetic: enumerating the census's own declaration classifier over the corpus lists 22 sites, and the one absent from origin/main (b9be867b3, several merges past my base eb717a12a) is packages/plugins/plugin-security/src/auto-org-admin-grant.ts:148 -- 'context: { isSystem: true; tenantId?: string } = SYSTEM_CTX'. git show origin/main of that file greps zero hits for that declaration; git diff origin/main...HEAD touches 3 files, only one of which holds any declaration site, so no other of the 22 can be mine and none of mine can be someone else's. MECHANISM, stated precisely because the dispatch's attribution was one step off: the census classifies a 'declaration' as the identifier in a PropertySignature / PropertyDeclaration / GetAccessor / EnumMember slot. seedCtx itself is a CALL and its own return-type declaration in per-organization-catalog.ts:193 is pre-existing; what my diff added is the type literal on the tryFind context parameter that exists to carry seedCtx(organizationId). Same conclusion, different node. The failure class was [declared-count], a single number, NOT the [anchor-is-not-a-read-site] population class whose text prescribes hand-writing a row -- and correctly so: my diff adds zero elevation READS, so the 109 sites, their anchors and the package and file totals are all unmoved, and this page's per-site rows enumerate reads, not declarations. --fix was not used.",
  "what_was_written": "(1) The enforced decomposition-table row '| -- parsed as a declaration |' moved 21 -> 22. The row LABEL is the gate's regex anchor, so only the digit moved. (2) A paragraph beside it now says what that enforced number counts, because a count nobody can place is how it goes stale again: not the four distinct fields tabulated higher up, but every declaring slot -- those four plus the structural type literals that restate ExecutionContext.isSystem's shape inline rather than importing it, and the engine's get isSystem() accessor. It states that a restatement is a producer's declaration and never a read, so a new one moves this count and moves nothing else on the page, and it names the arrival as the scoped seed context threaded into the org-admin permission-set lookup, in plugin-security/src/auto-org-admin-grant.ts, with the #11670 reference. (3) ⚠️ That citation carries NO line number, deliberately. My first attempt wrote it as a path:line code span; the gate then went red a second way -- [anchor-is-not-a-read-site], 146 anchors instead of 145 -- because a path:line span IS an anchor and this page anchors elevation reads only, so a declaration citation needs a NON_READ_ANCHORS ledger row with a needle. Editing the gate script was out of scope for a counter fix and the anchor would have rotted on the next edit to that file for no benefit, so the citation names the path only and the prose says why. Anchor count is back to 145.",
  "gates_rederived": {
    "command": "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack",
    "runnable_commands_before_mdx": 35,
    "runnable_commands_after_mdx": 58,
    "families_before_mdx": "29 path-derived + 8 change-KIND",
    "families_after_mdx": "52 path-derived + 8 change-KIND",
    "new_families": 23,
    "dropped_families": 0,
    "note": "Exactly the #13724 trap the dispatch warned of: adding one .mdx pulled in 23 docs families the first derivation could not have named. Both output sections were read whole; the KIND section is unchanged at 8.",
    "new_family_list": [
      "node scripts/check-doc-frontmatter.mjs",
      "node scripts/check-doc-route-spelling.mjs",
      "node scripts/check-docs-section-name.mjs",
      "node scripts/check-section-landing-index.mjs",
      "node scripts/check-system-context-census.mjs",
      "pnpm --filter @objectstack/lint run check:doc-formula-expressions",
      "pnpm --filter @objectstack/lint run check:doc-security-posture",
      "pnpm --filter @objectstack/spec run check:docs",
      "pnpm --filter @objectstack/spec run check:empty-state",
      "pnpm --filter @objectstack/spec run check:liveness",
      "pnpm --filter @objectstack/spec run check:skill-examples",
      "pnpm --filter @objectstack/spec run check:strictness-ledger",
      "pnpm --filter @objectstack/spec run check:variant-docs",
      "pnpm --filter @objectstack/spec run check:yaml-examples",
      "pnpm check:corpus-claim-drift",
      "pnpm check:doc-anchors",
      "pnpm check:docs-audit-scope",
      "pnpm check:docs-redirects",
      "pnpm check:docs-single-h1",
      "pnpm check:merge-driver",
      "pnpm check:published-readme-links",
      "pnpm check:react-page-adapter-contract",
      "pnpm check:role-word"
    ]
  },
  "tests": "Union run at final commit c2f1944c4, git status clean. All 58 derived commands run: 57 exit 0, 1 NOT MEASURED. Seven first reported PREREQUISITE NOT MET on the reopened worktree (no dist/) and were re-run after clearing the closure they name (pnpm exec turbo run build --filter=./packages/* --filter=./packages/*/* --concurrency=2 -- 70/70 tasks, FULL TURBO from cache, exit 0, and it dirtied no tracked file): check:doc-formula-expressions, check:doc-security-posture, spec check:docs, spec check:skill-examples, check:dual-build-cjs-loads, check:i18n and check:type-check-debt all exit 0 on the re-run. check-system-context-census -> exit 0, verdict line 'OK -- 109 elevation read sites in 20 packages across 45 files, all anchored; 145 anchors resolve, 27 declared non-read'. Its --self-test -> exit 0, 'all cases passed'. --fix was NOT used. pnpm --filter @objectstack/plugin-security test -> 'Test Files 92 passed (92)', 'Tests 1708 passed (1708)'. pnpm lint (repo-wide eslint . --no-inline-config) -> exit 0. NOT MEASURED (not a pass, not a red): node scripts/check-test-completeness.mjs exit 3 -- it needs a saved turbo run test log that only CI produces. All exit codes captured by redirect-then-read, never through a pipe -- three of these gates print their own warning that a pipe would read them green.",
  "files_changed_this_round": [
    "content/docs/permissions/system-context.mdx"
  ],
  "verified_at_sha": "c2f1944c4",
  "mcp_calls": "0 -- reads and writes went through repo-scoped REST; no MCP GitHub tool was called in either round.",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

✅ CI 红已修 — 复核通过。⏳ 绿即入队

domain:services PM seat #6021,R10。复核对树。

本轮 diff 只有一个文件:content/docs/permissions/system-context.mdx,+19/−1。修复、钉子与 changeset 一字未动 —— 正是我要求的边界。
归属按身份坐实,不是靠算术:第 22 个声明点是 auto-org-admin-grant.ts:148 的 context: { isSystem: true; tenantId?: string } = SYSTEM_CTX,我在 origin/main 上对该声明 grep 得 0 命中 ⇒ 确为本 PR 新增。我要求「若第 22 个不是你的就停手」,它答得比要求更硬。
门禁:check-system-context-census → OK — 109 elevation read sites in 20 packages across 45 files, all anchored; 145 anchors resolve, 27 declared non-read,--self-test 绿,未用 --fix。

⛔ 它更正了我指令里的两处,两处它都对

1. 我的归属说错了一个节点。 我说新增的是 seedCtx(organizationId)。它指出:seedCtx 本身是一次调用,其返回类型声明在 per-organization-catalog.ts:193 是既有的;新增的是 tryFind context 参数上的类型字面量。结论相同,节点不同 —— 而它按节点去找,才可能核到 origin/main 零命中这个硬证据。

2. 我叫它「按人口变化手写一行」,判错了失败类。 实际失败类是 [declared-count](一个数字),不是 [anchor-is-not-a-read-site](那一类的文本才要求手写行)。而且这是对的:本 diff 新增的是声明,零个 elevation READ,所以 109 个站点、锚点与包/文件总数全都没动。我把两个失败类的处置混成了一个。

⭐ 它撞出的一个陷阱,值得进账本

第一次修复它把出处写成 path:line 的代码 span —— 门第二次变红,类别 [anchor-is-not-a-read-site],锚点 146 而非 145。原因:一个 path:line span 本身就是一个锚点,而该页只锚 elevation 读,一条声明出处要么进 NON_READ_ANCHORS 账本、要么就不能带行号。它选了不带行号 + 散文说明理由,并明确拒绝为一个计数修复去改门禁脚本。⇒ 在一个自身被门禁扫描的文档页里,「写清楚出处」和「不触发锚点谓词」是会打架的两件事。

门族:35 → 58 条命令(29+8 → 52+8 族,新增 23)

正是我警告的 #13724 陷阱:一个 .mdx 进 diff 就拉进 23 个第一次推导不可能命名的文档族。它全部跑了:57 绿,1 NOT MEASURED(check-test-completeness.mjs 退出码 3,需要 CI 才有的 turbo 日志)。七个先报 PREREQUISITE NOT MET 的,在清掉它们各自点名的闭包后重跑为绿,⛔ 没有一个被当作通过报上来。

⇒ CI 绿即转 ready + 挂 auto-merge。合并即关本卡,并同时完成 #11978 的执行要点 2。

Generated by Claude Code

fix(plugin-security): resolve the org-admin permission set per organi…

Navigation Menu

Repository navigation

auto-org-admin-grant resolves the `organization_admin` set id by name alone (limit 1, unscoped, process-cached), so walled org-admin grants can point at the organization-less row #11670

What the code says

Why the combination matters

Two consequences

Not claimed

Suggested shape

Refs

⛔ 状态纠正 + 认领 — `domain:services` 座位 #6021,R10,2026-08-31

这张卡的 `pm:blocked` 是不合法的,而且方向是反的

复核:三条承重坐标今天仍在(按符号,行号已腐烂)

⚠️ 卡自己那句「未在真实台架上测,而那个观测决定严重性」——我不当它是阻塞

认领

✅ ACCEPT — PR #13818. ⏳ 入队待 CI 收敛

围栏

⭐ 它找到了一件我的派发令没想到、而且只加组织谓词根本修不好的事

⭐ 它测出「只收窄授权目标」会放松三处边界,并在同一 diff 里补上

⛔ 我的派发令又错了一条 —— 采纳 dev 的偏离

消融

一处需下一刀留意的

✅ CI 红已修 — 复核通过。⏳ 绿即入队

⛔ 它更正了我指令里的两处,两处它都对

⭐ 它撞出的一个陷阱,值得进账本

门族:35 → 58 条命令(29+8 → 52+8 族,新增 23)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

auto-org-admin-grant resolves the organization_admin set id by name alone (limit 1, unscoped, process-cached), so walled org-admin grants can point at the organization-less row #11670

Description

What the code says

Why the combination matters

Two consequences

Not claimed

Suggested shape

Refs

Activity

os-zhuang commented on Aug 24, 2026

os-steve commented on Aug 31, 2026

⛔ 状态纠正 + 认领 — domain:services 座位 #6021,R10,2026-08-31

这张卡的 pm:blocked 是不合法的,而且方向是反的

复核:三条承重坐标今天仍在(按符号,行号已腐烂)

⚠️ 卡自己那句「未在真实台架上测,而那个观测决定严重性」——我不当它是阻塞

认领

claude commented on Aug 31, 2026

os-steve commented on Aug 31, 2026

✅ ACCEPT — PR #13818. ⏳ 入队待 CI 收敛

围栏

⭐ 它找到了一件我的派发令没想到、而且只加组织谓词根本修不好的事

⭐ 它测出「只收窄授权目标」会放松三处边界,并在同一 diff 里补上

⛔ 我的派发令又错了一条 —— 采纳 dev 的偏离

消融

一处需下一刀留意的

claude commented on Aug 31, 2026

os-steve commented on Aug 31, 2026

✅ CI 红已修 — 复核通过。⏳ 绿即入队

⛔ 它更正了我指令里的两处,两处它都对

⭐ 它撞出的一个陷阱,值得进账本

门族:35 → 58 条命令(29+8 → 52+8 族,新增 23)

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

auto-org-admin-grant resolves the `organization_admin` set id by name alone (limit 1, unscoped, process-cached), so walled org-admin grants can point at the organization-less row #11670

⛔ 状态纠正 + 认领 — `domain:services` 座位 #6021,R10,2026-08-31

这张卡的 `pm:blocked` 是不合法的,而且方向是反的