Merge remote-tracking branch 'origin/main' into claude/issue-13900-rest-channel-prescriptions

Author: claude

packages/core/src/security/platform-admin.ts

@@ -17,9 +17,13 @@
  *
  * - **Choice 1A — one variable.** `OS_PLATFORM_OWNER_EMAIL`
  *   ({@link PLATFORM_OWNER_EMAIL_ENV}), the name plugin-auth's walled boot
- *   refusal and plugin-security's elevation refusal already quote. A second
- *   spelling is a second door: generated configs and docs would carry both and
- *   one of them would silently do nothing.
+ *   refusal and plugin-security's `bootstrapPlatformAdmin` already quote — the
+ *   latter in its fail-closed backstop for an undeclared or refused config, and
+ *   in the config-derived standing it logs beside it. ⚠️ That second site is no
+ *   longer an ELEVATION refusal: since the #11663 platform-admin re-anchor
+ *   (leg L4) the walled `bootstrapPlatformAdmin` writes no grant row and
+ *   elevates nobody — it reports. A second spelling is a second door: generated
+ *   configs and docs would carry both and one of them would silently do nothing.
  * - **Choice 2B — a comma-separated LIST**, because a single configured address
  *   is a single point of human failure and losing that mailbox leaves a
  *   deployment with no administrator and no in-product recovery. One separator,

packages/plugins/plugin-auth/src/walled-owner-operator-stamp.test.ts

@@ -32,9 +32,10 @@
  * Standing is derived PER REQUEST instead, and the implementation this file
  * covers says the same ([#11973] note in `walled-owner-operator-stamp.ts`:
  * "the invariant is enforced at the derivation site … rather than by an
- * elevation write; the stamp's value is unchanged"). One `it()` title below
- * still names the gate; correcting a title is an executable change, not a
- * comment fix, so it is left for the card that can price it.
+ * elevation write; the stamp's value is unchanged"). The one `it()` title that
+ * still named the gate now names the platform-admin derivation it actually
+ * mirrors — a title is a string literal, so correcting it was an executable
+ * change rather than a comment fix, and it was priced as one.
  */
 
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
@@ -267,7 +268,7 @@ describe('#12751 — shouldStampOwnerVerifiedAtCreation, the contract as a matri
     ).toBe(false);
   });
 
-  it('the email comparison MIRRORS the elevation gate: trimmed, case-insensitive, both sides', () => {
+  it('the email comparison MIRRORS the platform-admin derivation: trimmed, case-insensitive, both sides', () => {
     // The env declaration arrives padded and cased however the operator typed
     // it; `resolvePlatformOwnerEmail` trims, the comparison lowercases — the
     // exact treatment `bootstrapPlatformAdmin` gives the same pair.

packages/plugins/plugin-security/src/platform-owner-wall-bypass.test.ts

@@ -317,7 +317,7 @@ describe('[#12974] audit — the ruled floor', () => {
   });
 });
 
-describe('[#12974] the shared row predicate (the elevation gate’s twin)', () => {
+describe('[#12974] the shared row predicate (the per-request derivation’s twin)', () => {
   it('matchesDeclaredOwnerEmail — canonical comparison: trimmed, case-insensitive', () => {
     expect(matchesDeclaredOwnerEmail({ email: 'Operator@Corp.Example' }, SOLO)).toBe(true);
     expect(matchesDeclaredOwnerEmail({ email: '  operator@corp.example  ' }, SOLO)).toBe(true);

packages/plugins/plugin-security/src/walled-platform-bucket-diagnostic.test.ts

@@ -102,7 +102,7 @@ function recordingLogger() {
     logger: {
       info: (message: string, meta?: any) => { infos.push({ message, meta }); },
       warn: (message: string, meta?: any) => { warns.push({ message, meta }); },
-      error: (_m: string, _meta?: any) => { /* the walled elevation refusal; not this card's subject */ },
+      error: (_m: string, _meta?: any) => { /* the walled "ZERO config-derived platform administrators" backstop — over CONFIGURATION, not elevation; not this card's subject */ },
     },
   };
 }