Repository navigation
Revise ADR-0094: the permission write-through path 403s under the ADR-0005 rollback — move it to the materialized layer or retire the 2026-07-14 direction confirmation (#6609 ruling A follow-through) #6858
Description
Part of #6609 (maintainer ruling 2026-08-09, verbatim: 「同意 A」— recorded in #6609 comment 5229170354). Filed by the domain:spec seat as the ruling's follow-through; routing label left to the triage seat (the ADR text lives in docs/adr/, the affected implementation in packages/plugins/plugin-security — principal landing site is triage's call).
What the ruling requires
ADR-0094 carries a 2026-07-14 direction confirmation — «package 集经 ADR-0005 overlay 做环境定制» — written into the plugin-security/src/permission-set-projection.ts file header, with 4 production write points (saveMetaItem({type:'permission'}) at :713/:752/:794/:928 as of the #6608 measurement). Under the ruled ADR-0005 rollback (PR #6608, permission.allowOrgOverride: false), the write-through for code-declared sets now refuses with 403. Ruling A accepts the tightening and requires the ADR to stop pointing at a path that 403s:
- either re-route the environment-customization intent to the layer measured UNAFFECTED at the fix(spec): ADR-0005 白名单强制 —— 九类未获批 allowOrgOverride:true 回滚为 false (#6483) #6608 boundary probe (runtime-create / metadata-door materialized rows via the
allowRuntimeCreatelayer), - or retire the direction confirmation outright.
Whichever way, the permission-set-projection.ts header prose and the ADR text must agree with the enforced reality after PR #6608 merges.
Boundaries
- ⛔ No behavior change to the rollback itself — Option C was explicitly closed.
- The projection's 4 write points: whether they are re-pointed, guarded, or left to 403 loudly is part of this card's design work (the 403 is fail-closed and currently exercised by zero in-repo corpus rows — measured 0 live org-scoped overlay rows).
- Blocked-by: ADR-0005:57 白名单表与注册表的分歧不止 flow：page/app/action/permission/tool/skill 六类 ADR 写 ❌ 而 allowOrgOverride:true，另有 dataset/book/position 三类表里没有却默认成了 true #6483 (lands via PR fix(spec): ADR-0005 白名单强制 —— 九类未获批 allowOrgOverride:true 回滚为 false (#6483) #6608 — the ADR revision describes the post-merge world; write it against that reality).
Refs: #6609 (ruling + full evidence chain), PR #6608 (implementation + boundary probe), ADR-0005, ADR-0094, #5768 (objectui consumer symptom).
Activity
os-zhuang commentedon Aug 9, 2026
Triage: +
domain:identity+pm:blocked(pm:queuestays — execution card of the recorded #6609 ruling A, not a decision card).packages/plugins/plugin-security— the direction-confirmation prose sits inpermission-set-projection.ts's header and the 4 write points are live onorigin/main@41610f6(:713verified verbatim,saveMetaItem({ type: 'permission', … })). The ADR text edit indocs/adr/rides the same PR; the package decides the lane per the anchoring rule ⇒domain:identity.Blocked-by: #6483);pm:blockedadded so selection skips it until fix(spec): ADR-0005 白名单强制 —— 九类未获批 allowOrgOverride:true 回滚为 false (#6483) #6608 lands. Unlock note per the merged-ref discipline: when fix(spec): ADR-0005 白名单强制 —— 九类未获批 allowOrgOverride:true 回滚为 false (#6483) #6608 merges, re-verify the projection header and the four write points at the merged ref before dispatch — that merge is exactly the commit most likely to have moved them.本评论来自分诊座位 Routine（#5474 试点），不构成认领。
Generated by Claude Code
os-zhuang commentedon Aug 9, 2026
Claim — identity-lane PM seat (#6022), session
session_01BM1tNf5U3nEbHKR4fo5qVQ. Dispatching to anos-devsubagent now.claude/issue-6858-adr0094-revision../objectstack-issue-6858(dedicated per-task worktree; never the shared checkout)domain:identity— label untouched (single-producer rule; the triage seat routed it, this seat does not rewrite it)Blocked-by: #6483is closed/completed and its implementation PR fix(spec): ADR-0005 白名单强制 —— 九类未获批 allowOrgOverride:true 回滚为 false (#6483) #6608 merged 2026-08-09T05:05:06Z.pm:blockedremoved →pm:dispatched. The card asks for the ADR revision to be written against the post-merge world, and that world now exists onorigin/main.docs/adr/0094-*.md,packages/plugins/plugin-security/src/permission-set-projection.ts(header prose + the 4 write points), possiblyscripts/adr-anchors.json.permission-set-projection.ts; the sibling identity dispatch in this batch (audience-anchors.test.tsstill namesmember_defaultas the plain-wildcard shape — the same stale illustration #6696 fixes, one package over #6842) touchesplugin-securityonly viaaudience-anchors.test.ts, a disjoint file. PR fix(spec): ADR-0005 白名单强制 —— 九类未获批 allowOrgOverride:true 回滚为 false (#6483) #6608's own dogfood 403 pins are already onmainand are this card's baseline, not its target.If a claim comment with a different session ID appears above this one, that claim wins by timestamp and this seat stands down.
Generated by Claude Code
docs(adr): mark ADR-0094 D2's env-overlay cross-reference as retired,…
docs(adr): mark ADR-0086's three ADR-0094 D5 pointers as retired, poi…
docs(adr): re-point ADR-0066 D1's self-cite from ADR-0094 D5 to ADR-0…
docs(qa): correct two dogfood headers that still state ADR-0094's ret…
docs(permissions): state the 403 not_overridable refusal for admin-do…
docs(plugin-security): re-anchor the dead tracker citations to the co…