docs: comments outside packages/spec say a principal-less context is refused since ADR-0096 D5

Comment and docstring text only: the sentences that described the
security middleware handing through, skipping or falling open for a
context with no principal now say that it used to, and that D5 refuses it.
No executable line moves.

Claude-Session: https://claude.ai/code/session_01WkL6Eijt432S1Y7ekb6ovQ
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

examples/app-showcase/src/automation/flows/index.ts

@@ -1581,9 +1581,11 @@ export const InboundTaskWebhookFlow = defineFlow({
   type: 'api',
   status: 'active',
   // An inbound webhook has no authenticated user, so the create must run as the
-  // system principal (#1888 runAs is now enforced). Without this it relies on the
-  // "no identity → security-skipped" fall-through, which breaks the moment the
-  // target object carries row-level security.
+  // system principal (#1888 runAs is now enforced). Without this the run is
+  // user-less under the default `runAs:'user'`, so its create is refused
+  // (`AUTOMATION_UNSCOPED_RUN_DATA_ACCESS`); the "no identity → security-skipped"
+  // fall-through it once relied on is gone (ADR-0096 D5 refuses a principal-less
+  // context in the security middleware too).
   runAs: 'system',
   nodes: [
     {

packages/metadata-protocol/src/protocol.platform-store-system-opt-in.test.ts

@@ -4,9 +4,10 @@
  * [#21911, ADR-0096] The metadata protocol's platform-store calls carry the
  * EXPLICIT system opt-in, never a principal-less context.
  *
- * plugin-security hands an engine operation whose context carries no user, no
- * position, no permission set and no `isSystem` straight to `next()` (the
- * ADR-0096 E1 hand-off). The protocol's own reads and writes of the
+ * plugin-security used to hand an engine operation whose context carries no
+ * user, no position, no permission set and no `isSystem` straight to `next()`
+ * (the ADR-0096 E1 hand-off); since ADR-0096 D5 it refuses one. The protocol's
+ * own reads and writes of the
  * `sys_metadata` family reached the engine exactly that way — a `{ where }`
  * with no `context`, or a repository transaction context with only its
  * handle — so they worked only because the hand-off let them through. They

packages/metadata-protocol/src/protocol.ts

@@ -11230,11 +11230,13 @@ export class ObjectStackProtocolImplementation implements
         // were eliminated by measurement, not by reading:
         //  - the driver's tenant wall never engages — `buildDriverOptions`
         //    sets `DriverOptions.tenantId` only from `execCtx.tenantId`
-        //    (`objectql/engine.ts`), and this read passes no context;
-        //  - plugin-security's Layer 0 never engages — the middleware takes
-        //    its principal-less `return next()` thousands of lines before the
-        //    `objectFields.has('organization_id')` gate that would have
-        //    carried it;
+        //    (`objectql/engine.ts`), and this read's context carries no
+        //    `tenantId` (only the system opt-in below);
+        //  - plugin-security's Layer 0 never engages — the middleware
+        //    short-circuits on that `isSystem` opt-in (it used to take its
+        //    principal-less `return next()`, refused since ADR-0096 D5)
+        //    thousands of lines before the `objectFields.has('organization_id')`
+        //    gate that would have carried it;
         //  - no posture would save it anyway: `computeTenantLayer0Filter`
         //    yields `null` under `single` and the deny sentinel under
         //    `isolated` with no tenantId.

packages/platform-objects/src/system/sys-secret.object.ts

@@ -46,9 +46,10 @@ export const SysSecret = ObjectSchema.create({
   // store (settings/datasource credentials). Not covered by the wildcard `'*'`
   // grant — ordinary members get 403 from the generic data layer. Platform
   // admins retain access via the posture-gated superuser bypass. Internal
-  // readers are unaffected: `engine.resolveSecret` reads at DRIVER level,
-  // SettingsService / the datasource secret-binder read with no principal
-  // (middleware falls open for principal-less internal calls).
+  // readers are unaffected: `engine.resolveSecret` reads at DRIVER level, and
+  // SettingsService / the datasource secret-binder read with the explicit system
+  // opt-in (`isSystem: true`), which the middleware short-circuits. A
+  // principal-less read is refused (ADR-0096 D5).
   access: { default: 'private' },
   description:
     'Cipher store written by three privileged producers (see managedBy); each holds its handle in its own column. Never holds plaintext.',

packages/plugins/plugin-auth/src/auth-manager.ts

@@ -3382,8 +3382,8 @@ export class AuthManager {
             // Both reads run as the platform (`withSystemContext`): this hook
             // IS the slug guard — the organization id is the `where`, not the
             // reader — so neither read reaches the engine with no principal
-            // and no opt-in (the security middleware's principal-less
-            // hand-off, ADR-0096).
+            // and no opt-in (the security middleware's former principal-less
+            // hand-off, which ADR-0096 D5 replaced with a refusal).
             const dataEngine = withSystemContext(rawEngine) as any;
 
             let currentSlug: string | undefined;

packages/plugins/plugin-auth/src/auth-plugin.ts

@@ -2478,8 +2478,8 @@ export class AuthPlugin implements Plugin {
         // the write both carry the explicit system opt-in (`isSystem: true`).
         // The platform-admin judge above is this route's authorization; the
         // raw engine would have handed the security middleware a context with
-        // no principal and no opt-in — the principal-less hand-off (ADR-0096),
-        // which is not an authorization at all.
+        // no principal and no opt-in — the principal-less hand-off it no longer
+        // makes (ADR-0096 D5 refuses that context), and never an authorization.
         const rawEngine = this.authManager!.getDataEngine();
         if (!rawEngine) {
           return c.json({ success: false, error: { code: 'SERVICE_UNAVAILABLE', message: 'Data engine unavailable' } }, 503);

packages/plugins/plugin-auth/src/principal-less-producers-system-context.test.ts

@@ -10,9 +10,10 @@
  *  - the SCIM bearer verifier (`verifyScimBearerToken`): its credential probe
  *    carries the opt-in in the read's trailing options.
  *
- * A context with neither a principal nor `isSystem` is the security
- * middleware's principal-less hand-off (ADR-0096), which is not an
- * authorization: each of these calls is already authorized by its own door
+ * A context with neither a principal nor `isSystem` was the security
+ * middleware's principal-less hand-off (ADR-0096 E1) and is refused since
+ * ADR-0096 D5; it was never an authorization: each of these calls is already
+ * authorized by its own door
  * (the platform-admin judge; the bearer digest). The opt-in names that.
  *
  * Measured on a REAL engine: a middleware registered on it records the context

packages/plugins/plugin-auth/src/scim-connection-service.ts

@@ -119,7 +119,8 @@ interface CredentialEngine {
  * verifier runs BEFORE any caller is known — the bearer it is verifying is the
  * only identity on the request — so there is no principal to carry, and the
  * read must say so rather than reach the engine with no principal and no
- * opt-in (the security middleware's principal-less hand-off, ADR-0096). The
+ * opt-in (the security middleware's former principal-less hand-off, which
+ * ADR-0096 D5 replaced with a refusal). The
  * digest equality in the `where` is the whole of what the probe may match.
  */
 const CREDENTIAL_PROBE_CONTEXT = { context: { isSystem: true } } as const;

packages/plugins/plugin-security/src/get-metadata-readable-fields.test.ts

@@ -5,10 +5,11 @@
  * `getReadableFields`.
  *
  * The two differ in exactly one place: what a caller resolving to ZERO
- * permission sets gets. On the DATA plane, falling open is the drift-free
- * answer — the engine middleware skips its whole gate for such a caller, and
- * reporting a narrowing the data path would not enforce is its own kind of
- * drift. On the METADATA plane the question is disclosure, and D7 rules that a
+ * permission sets gets. On the DATA plane `getReadableFields` keeps its
+ * fall-open answer, written when the engine middleware skipped its whole gate
+ * for such a caller (the middleware now refuses it: ADR-0056 D2's deny
+ * baseline at object admission, and ADR-0096 D5 outright for a principal-less
+ * one). On the METADATA plane the question is disclosure, and D7 rules that a
  * guest/public deployment's schema exposure must be a deliberate
  * permission-set decision rather than an accidental everything-default. So the
  * zero-set caller goes through the same fallback resolution
@@ -81,7 +82,8 @@ describe('[ADR-0106 D7] SecurityPlugin.getMetadataReadableFields', () => {
     const dataPlane = await plugin.getReadableFields('deal', context);
     const metadataPlane = await plugin.getMetadataReadableFields('deal', context);
 
-    // The data plane keeps its middleware-mirroring fall-open — unchanged.
+    // The data plane keeps its fall-open answer — unchanged (the middleware it
+    // once mirrored refuses this principal-less caller since ADR-0096 D5).
     expect(dataPlane).toEqual(['id', 'name', 'secret']);
     // The metadata plane does not.
     expect(metadataPlane).toEqual(['id', 'name']);

packages/plugins/plugin-security/src/security-plugin.ts

@@ -6058,11 +6058,14 @@ export class SecurityPlugin implements Plugin {
    * `/auth/me/permissions` uses ({@link fallbackPermissionSet}, default
    * `member_default`) instead of falling open to the full field set.
    *
-   * Why the two differ rather than converge. `getReadableFields` mirrors the
-   * engine middleware, which skips its grant-based gates for a caller with no
-   * permission sets — reporting a narrowing the data path would not enforce is
-   * its own kind of drift, so on the DATA plane falling open is the correct,
-   * drift-free answer. What reaches that caller is the object's posture
+   * Why the two differ rather than converge. `getReadableFields` keeps the
+   * answer it gave when the engine middleware skipped its grant-based gates for
+   * a caller with no permission sets — reporting a narrowing the data path did
+   * not enforce was its own kind of drift, so on the DATA plane falling open was
+   * the drift-free answer. The middleware no longer serves that caller: object
+   * admission refuses it (ADR-0056 D2's deny baseline) and a principal-less one
+   * is refused outright (ADR-0096 D5), so no data-plane read reaches the fields
+   * named here. What reaches that caller is the object's posture
    * ({@link resolveCallerPosture}): [#20995] its masking rules, and a masked
    * field is a served column, so it stays; [#21063] its per-field capability
    * contract, and a capability-gated field is not served, so it leaves. The