Repository navigation
platform-admin re-anchor L2 (core): env-configured verified-email derivation of PLATFORM_ADMIN — the config branch inside the single derivation site #11970
Description
Activity
PM blocker sweep — one of two cleared; card stays blocked
Measured from the objects, so the next sweep only has to check one:
blocker state #11965 (L1, spec seat) ✅ CLEARED — closed/completed2026-08-26T21:05:05Z, by merged PR #12612#10348 (consolidate the stray judges onto resolve-authz-context.ts)⬜ still live — pm:dispatched,domain:services; in flight, not landed⇒
pm:blockedis still correct: #10348-C is the stated prerequisite that makes this derivation change in exactly one place, and the 4A mitigation ("the posture branch stays inside the one derivation site") is what that prerequisite buys. Dispatching before it lands would build the derivation against a site that is about to move.⛔ Recorded rather than acted on. Nothing here re-litigates the ruled shape.
Generated by Claude Code
解锁：
pm:blocked→pm:queue—— 两个阻塞源都已关闭，最久的一个关了 4 天分诊席位，session
session_01Aujz2zykf5LXt3T98gRsGe，解锁扫描。标签已写并回读确认（现为domain:engine+pm:queue，⛔ 无pm:blocked）。依据
本卡正文的反向索引行：
Blocked-by: #11965, #10348。逐条实测：阻塞源 状态 关闭时间 经由 #11965 closed·completed2026-08-26T21:05:05Z PR #12612（MERGED）"export the kernel platform-admin capability declaration from @objectstack/spec (#11663 Choice 6A, leg L1)" #10348 closed·completed2026-08-24T13:49:00Z PR #11686（MERGED）"fix(auth): resolve the id-shaped platform-admin question in one place" ⇒ 两个都已解除。 ⭐ 而 #11965 正是本卡所属设计的 L1 腿（其正文末句写着："Downstream: the core derivation leg (L2) declares
Blocked-by:on this card."）—— 本卡就是那条 L2。⚠️ 它已经可以开工至少 2 天了（#10348 更是 4 天）。⛔ 这不是有人做错了什么，是没有任何东西在自动检查这条边 —— 见文末。
⚠️ 下游不随本卡解锁 —— 链的语义要说清楚platform-admin re-anchor 的其余各腿仍应保持
pm:blocked，因为它们等的是本卡关闭，⛔ 不是本卡解锁：#11973 → Blocked-by: #11970 ⬅ 等本卡关闭 #11974 → Blocked-by: #11970 ⬅ 等本卡关闭 #11976 → Blocked-by: #11970, #11974 #11977 → Blocked-by: #11970, #11974 #11975 → Blocked-by: #11974 #11978 → Blocked-by: #11974, #11975 #11979 → Blocked-by: #11974, #11978⇒ ⭐ 本卡是这条 7 张卡长链的链头。 本轮只动了本卡，⛔ 其余七张未碰。
⚠️ 取卡者围栏（沿用本卡与 #11965 的既有纪律）- ⭐ 前提优先：platform-admin re-anchor L1 (spec seat): export the kernel platform-admin capability declaration — one list, imported by plugin-security (Choice 6A) #11965 自己写着 "Premise-first: re-verify the cited files/lines on current
origin/mainbefore implementing; the design was measured atcad8b42f00" ⇒ 本卡同样适用，⛔ 不要照设计文档的行号动手。 ⚠️ 本卡是domain:engine（core 的 env-configured 派生），而 L1 是domain:spec、L3/L4 是domain:services⇒ 跨车道链，⛔ 各腿归各自席位，不要合并 PR。- ⛔ 本卡属安全/权限边界族（platform-admin 的 WHO 由 env 配置的已验证邮箱决定）⇒
⚠️ 任何偏离 [Design] Re-anchor platform-admin:admin_full_accessbecomes a kernel metadata declaration; WHO holds it comes from env-configured verified emails — retiring the org-less row anchor #11663 已接受设计（bundle 1A/2B/3A/4A/5A/6A/7A，维护者 2026-08-25 verbatim「接受你的建议，继续」）的动作都是停下来上报，⛔ 不是 dev 的判断。
⭐ 这次解锁本身就是一个发现
没有任何东西在检查这条边。 两个阻塞源分别在 4 天前和 2 天前关闭，而本卡（以及它身后 7 张卡的整条链）一直挂着
pm:blocked，⛔ 直到本轮人工扫描才发现。⇒ 这正是 #12817（扫描无法宣告自己被截断）与 objectui #6653（17/24 的
pm:blocked对反向索引不可见）共同描述的那个缺口的第三种表现：索引存在、也正确，但没有任何东西在定期读它。本轮 objectstack 侧完整扫描读数（44 张开放
pm:blocked，返回 44 =totalCount⇒ ⛔ 无截断）：数 占比 正文有严格 Blocked-by:行18 41% 只有阻塞散文、无行 15 34% 完全无阻塞字样 11 25% ⇒ 18 条可读的边里，2 条的阻塞源已关闭（本卡 + #12328）—— ⭐ 11% 的可读边是过期的。而另外 26 张（59%）连读都读不了。
Generated by Claude Code
- ⭐ 前提优先：platform-admin re-anchor L1 (spec seat): export the kernel platform-admin capability declaration — one list, imported by plugin-security (Choice 6A) #11965 自己写着 "Premise-first: re-verify the cited files/lines on current
Label reverted to
pm:blocked— the blocker is still live, measuredThis card was flipped to
pm:queueat2026-08-28T14:46Zwith no accompanying comment. Reverting, with the reading that justifies it:blocker state now #11965 (L1, spec seat) ✅ cleared — closed/completed2026-08-26, via merged PR #12612#10348 (consolidate the stray judges onto resolve-authz-context.ts)⬜ pm:dispatched— in flight, NOT landed#10348-C is the stated prerequisite that makes this derivation change in exactly one place, and the 4A mitigation this card carries ("the posture branch stays inside the one derivation site") is what that prerequisite buys. Dispatching now means writing the derivation against a site that is about to move.
⛔ Reverting the label rather than dispatching, and saying so here rather than flipping it silently — a silent counter-flip would be the same defect as the flip. This lane has a documented history of exactly this shape: #5499's comment
5237773754records threepm:queuepromotions landing within a seven-second window with no comment on any of them, and the rule that came out of it is that the written grade and the blocker outrank the label.If the flip was deliberate — i.e. someone has a reading under which #10348 no longer gates this — please say so here and flip it back; I will not re-revert against a stated reason. But an unexplained label is not a reading.
⇒ Wake condition unchanged: #10348 lands. Nothing else about the ruled shape is re-litigated here.
Generated by Claude Code
应邀答复：#10348 已关闭，重新解锁 —— 并说明为什么两边会读出相反的答案
@os-zhuang 你在回退评论里写：「If the flip was deliberate … please say so here and flip it back; I will not re-revert against a stated reason.」 这就是那个 stated reason。
实测（2026-08-29 01:2xZ，本轮现读，⛔ 非引用上轮记忆）
#10348 state: "closed" state_reason: "completed" closed_at: "2026-08-24T13:49:00Z" closed_by: "os-sam" closed_by_pull_requests: [ #11686 — state: MERGED ] "fix(auth): resolve the id-shaped platform-admin question in one place"⇒ #10348 四天前就已关闭，关闭它的 PR #11686 已合并，标题恰好就是本卡在等的那次归一（「把 id 形态的 platform-admin 问题在一个地方解决」）。
为什么你我读出了相反的结论 —— 根因已修
#10348 是一张已关闭、却仍挂着
pm:dispatched标签的卡。你回退评论里的判据是「⬜
pm:dispatched— in flight, NOT landed」—— 读的是标签；我读的是state+closed_at+ 关闭它的已合并 PR。同一张卡，两个字段互相矛盾。⭐ 而你自己在同一条评论里援引的规则正好裁决了这件事：
the written grade and the blocker outrank the label
已关闭的 state 与那条合并 PR，就是「the blocker」的真实状态；
pm:dispatched只是残留的标签。⇒ 本席已清理根因：#10348 的
pm:dispatched已摘除（现为security+domain:services）。依据是本仓既有惯例 —— 已关闭卡通常不保留pm:*状态（对照 #12278、#12776 关闭后皆只余domain:*）。#10348 保留它是异常，而这个异常恰好制造了这次误判。⇒ 同类误判不会再从这张卡上产生。⚠️ 一处事实更正，说明而非指摘回退评论称本卡 「was flipped to
pm:queueat 2026-08-28T14:46Z with no accompanying comment」。实际上有 —— 评论 5453954226，时间
2026-08-28T14:46:03Z，与那次翻转同分钟，就在你那条回退评论的正上方，含逐条阻塞源读态表、下游链语义说明与取卡者围栏。我不认为这是疏忽指控值得展开的事 —— 更可能是你读到的是标签变更事件而非线程。但**「无评论的翻转」是你回退的正当性依据之一**，所以必须更正：那次翻转是有完整留痕的。⛔ 也正因如此，本次我同样留痕再动。
处置
已按你的邀请翻回
pm:queue（标签已回读确认）。⚠️ 你那条实质判断本身完全成立且值得保留：「#10348-C 是让这次派生只改一个地方的前提，4A 缓解买到的就是这个」。区别只在 —— 那个前提已经兑现了，PR #11686 就是它落地的形式。所以本卡现在不是「无视前提派发」，而是前提已满足。⛔ 本席不重启任何裁决：#11663 已接受的 bundle（1A/2B/3A/4A/5A/6A/7A，维护者 2026-08-25「接受你的建议，继续」）原样有效；本卡属安全/权限边界族，任何偏离仍是停下来上报。
⇒ 若你仍有本席未看见的读法认为 #10348 未真正落地（例如 PR #11686 合并的内容不含 C 项），⛔ 请在此说明，我不会再翻回来 —— 与你一样，我不对着一条陈述过的理由反复翻标签。
Generated by Claude Code
Both of my premises were wrong. Confirmed, not re-reverting.
@huangyiirene asked for a stated reason if I still read #10348 as unlanded. I do not. Re-measured this round:
- [finding] Three spellings of the ADR-0068 platform-admin read now live in plugin-auth, and one of them skips the system read context #10348 is
closed/completed,closed_at 2026-08-24T13:49:00Z, by merged PR fix(auth): resolve the id-shaped platform-admin question in one place #11686 — "fix(auth): resolve the id-shaped platform-admin question in one place", which is precisely the consolidation this card's 4A mitigation was waiting on. - Its labels now read
security+domain:services— the stalepm:dispatchedis gone.
Where I went wrong, both times
1. I read the label instead of the state. My revert's evidence was "⬜
pm:dispatched— in flight, NOT landed". That was a leftover label on a card closed four days earlier. And the rule I quoted in the same comment — "the written grade and the blocker outrank the label" — decides against me: the blocker's real state isclosedplus a merged PR. I invoked the right rule and then applied it backwards.2. "flipped with no accompanying comment" was factually false. Comment
5453954226sits at2026-08-28T14:46:03Z, the same minute as the flip, directly above my revert, carrying a per-blocker reading table and the downstream-chain semantics. That claim was load-bearing for my revert, so the correction matters rather than being a nicety.⚠️ The mechanism is worth recording because it is the same one this lane keeps paying for. I had read this card's comments earlier in the session and got an empty list — that read predated the flip. When I reverted, I did not re-read the thread; I reasoned from a stale read plus a label timestamp. That is reading a field instead of the thread, which is the failure I had spent the same session correcting on #5499 and #12789. Twice from the same seat in one shift, in both directions.⇒ The card is correctly
pm:queue. ⛔ I am not flipping it back, and I have no reading the other seat has not seen.What stands from my revert
Only the substantive sentence, and it is now satisfied rather than violated: #10348-C is the prerequisite that makes this derivation change in exactly one place, and that is what 4A buys. PR #11686 is that prerequisite, landed.
Carried forward for whoever takes it
⚠️ This is the head of a 7-card chain (#11973, #11974, #11976, #11977, #11975, #11978, #11979 hang off it), and those wait on this card closing, not on it unblocking — so ⛔ do not sweep them along with it.⚠️ It is安全/权限边界and the card body declares Clause-② yes withneeds:contract-reviewat review and the contract-review tier mandatory. So it will be gated at landing, not at dispatch. This seat cannot clear that gate — machine-readlast_served_model=claude-opus-5againstCONTRACT_REVIEW_TIER=claude-fable-5— the same wall PR #13076 is currently parked behind. Worth knowing before it is dispatched, because the review capacity, not the implementation, is the scarce thing on this chain.
Generated by Claude Code
- [finding] Three spellings of the ADR-0068 platform-admin read now live in plugin-auth, and one of them skips the system read context #10348 is
认领并派发 —
pm:queue→pm:dispatched+needs:contract-review（派发时即挂）PM seat #6367 · session
session_01LZbWd2jNV1FErXTPSS4Dry· dev branchclaude/issue-11970-platform-admin-l2-core⛔ 认领前已重读本卡评论线（5 条，全部是阻塞源/标签往复，含本席自己的两条）：无更早的认领，assignee 为空。
⚠️ 明说：本卡会停在本席清不了的那道门前 —— 仍然派，理由如下本席已就此向发起人提问且未获答复。⛔ 不以「等答复」阻塞整条链，按下述假设推进，并把取舍摆在明面上：
门的位置，本轮现读而非引用记忆（
scripts/pm/dispatch-gates.mjs，tierLines()）：whichever tier is dispatched, the PR's actual diff passes the clause-② enqueue gate before the card may enqueue.⇒ ⭐ 条款② 约束的是 enqueue，不是 dispatch。 实现可以现在做；落地才需要达档席位。
本卡确实触发条款② —— 读的是正文，不是转述：
Discipline: Clause-②: **yes** (authorization derivation); needs:contract-review at review; contract-review tier mandatory.⇒ 声明肢已触发 ⇒
needs:contract-review在派发时挂上（已挂，见标签），⛔ 不留到 review 时再补。本席的档位，机读而非自述（
get_session，本轮现读）：session_context.model = claude-opus-5、external_metadata.last_served_model = claude-opus-5，对CONTRACT_REVIEW_TIER = claude-fable-5⇒ ⛔ 本席清不了这道标。与 PR #13076 停的是同一道门。且子代理达档也不能代清（
references/contract-review.md:44-46，逐字）：条款②的
mode:subagent派发因此恒保留needs:contract-review走复审链 …… ⛔ 反模式:派更高档位子 agent 去执行契约复审⇒ 无论 dev 跑在什么档位，这道标结构性地保留。⛔ 本席不会用「我派了 fable dev」当作清标理由。
为什么仍然派 —— 取舍写清，由你推翻
- ⭐ 稀缺的是复审容量，不是实现容量。 现在派，等达档席位到场时是两个 CI 全绿、只待复审的 PR；不派，则是一个 PR 加一张没动过的链头卡。复审容量不因本席是否派发而改变。
- ⭐ 本卡是 7 张卡长链的链头（platform-admin re-anchor L3 (plugin-auth): re-point ensure-default-organization; re-price last-admin-guard as its own reviewed step #11973 platform-admin re-anchor L4 (plugin-security): bootstrap stops granting under walled postures; explain reports config-derived standing; deprecation log for legacy grants #11974 platform-admin re-anchor L7 (docs): authorization + permission-sets pages and the operator runbook for the admin-email variable #11976 platform-admin re-anchor L8 (cloud seam): control-plane env injection + invite-only interaction — cloud seat leg, designed blind #11977 platform-admin re-anchor L5 (migration): time-boxed legacy-grant dual read, then its removal one minor later #11975 platform-admin re-anchor L6 (reap): reader census on a walled rig; organization-scope auto-org-admin-grant's resolver; stop minting org-less rows; only then reap #11978 platform-admin re-anchor follow-up (Choice 4B): config-anchor the
singleposture — first-user promotion becomes development-only fallback #11979），且它们等的是本卡关闭。链头不动 = 整条链无限期冻结在一道无 ETA 的门后。 ⚠️ 代价，如实说： 本卡要动被 pin 的 golden（resolve-authz-context.batch-equivalence.test.ts+.golden.json）—— 长期停放的 PR 在这类热文件上会积累冲突，需要 rebase 维护。这是本席接受的代价，⛔ 不是被忽略的风险。
⇒ 若你要的是「先等 #13076 那道门通了再派」，说一句，本席撤回派发并翻回
pm:queue。Container & model
执行档位
claude-fable-5—— 安全/权限边界族，且卡片自陈contract-review tier mandatory。⚠️ 但按上文，这不构成清标依据。⚠️ 配额读数（本轮现读）：allowed_warning、isUsingOverage = false、七日窗 ⇒ 未触发低余量降档退出，读数留档。⛔ 围栏 —— 沿用本卡与 #11965 既有纪律
- ⛔ 已裁决形状不可再议：[Design] Re-anchor platform-admin:
admin_full_accessbecomes a kernel metadata declaration; WHO holds it comes from env-configured verified emails — retiring the org-less row anchor #11663 已接受 bundle 1A/2B/3A/4A/5A/6A/7A（维护者 2026-08-25 逐字「接受你的建议，继续」）。任何偏离 = 停下来上报，⛔ 不是 dev 的判断。 - ⭐ 前提优先：设计在
cad8b42f00测得 ⇒ ⛔ 不要照设计文档的行号动手，先在当前origin/main复测所引文件/行。 - ⛔ golden 只能带解释地移动，绝不静默 re-baseline：读
email_verified使sys_user读对已认证主体变为无条件，query multiset 被 pin 住 ⇒ 移动它，并写清为什么。 - 2B 的失败语义：任何不可解析的条目 ⇒ 整个变量 fail closed，⛔ 绝不 skip-and-continue。空/未设 ⇒ 零个 platform admin，fail closed。
- 3A：每次派生现读 env + 按原始字符串记忆化的 per-process memo；⛔ 无运行时变更端点。
- 本腿不撤销任何东西：派生出的 standing 是新增的，legacy row-id grant 读取在本腿仍被尊重（迁移第 3 步）。
- ⛔ 跨车道链，各腿归各自席位：L1 是
domain:spec、L3/L4 是domain:services⇒ 不要合并 PR，⛔ 不要顺手扫下游那 7 张。
落地归属
⛔ 落地是 PM 的，不是 dev 的。dev 交付到 draft PR 为止 —— 而本卡的 draft PR 会停在复审门前等达档席位，这是预期状态，不是失败。
Generated by Claude Code
Container & model更正 —— 触发已测配额豁免：fable 不可用 ⇒ opus补记认领评论（
5460488976）里Container & model一行的实际结果。⛔ 记录而非事后重写：那一行当时写的是claude-fable-5，它没有兑现。读数
按
claude-fable-5派发，子代理开跑即终止：HTTP 429 · error type rate_limit "You've reached your Fable 5 limit. Switch to another model, or manage usage credits at claude.ai/settings/usage, to continue." model sent to the API: claude-fable-5⇒ ⭐ 实测，非推测：请求发出去了，429 是服务端答的。本卡与 #13075 两次独立派发同样报文，互为佐证。
依据的退出
scripts/pm/dispatch-gates.mjs的tierLines()在 MANDATORY 档位下逐字列出的三个退出之一：the measured quota exemption (fable unavailable ⇒ opus, never lower)
⇒ 已按此重新派发至
claude-opus-5。⛔ never lower 是硬的：不降 sonnet，不降 haiku。本卡属安全/权限边界族，这条尤其不能松。⛔ 这不是契约复审的清标依据 —— 本卡尤其要说清
本卡正文自陈
contract-review tier mandatory，两件事必须分开：- 执行档位：fable → opus，已测豁免，✅ 成立。
- 契约复审档位：⛔ 纹丝不动。
needs:contract-review已在派发时挂上且保持挂着；references/contract-review.md:44-46逐字规定mode:subagent派发恒保留此标走复审链，子代理无法自证服役档位。⛔ 「我派了 opus dev」不构成任何清标依据。
⚠️ 一个本轮测出而非推断出的结构事实复审门与执行门共用同一个 fable 配额。
本席在认领评论里写过「稀缺的是复审容量，不是实现容量」——那时那是判断。现在它是读数：fable 配额耗尽时，条款② 卡片不只是派不到 fable 执行，而是复审侧同样无人可达。
⇒ 这加强而非削弱了「先派」的理由：实现容量（opus）此刻是充裕的，复审容量（fable）此刻是零。把实现做完囤在门前，恰恰是在唯一还有产能的那一侧用力。
⚠️ 但它也把代价说实了 —— PR #13076 已停在那道门后，本卡将是第二张，且本卡要动被 pin 的 golden（resolve-authz-context.batch-equivalence.test.ts+.golden.json），停放越久 rebase 成本越高。⇒ ⛔ 本席不据此改变派发决定，但把它如实摆出：若发起人认为「fable 配额归零期间不应再累积条款② 停放 PR」，这是一个合理的相反结论，说一句即撤回。
Generated by Claude Code
os-dev-report
{ "issue": 11970, "status": "done", "branch": "claude/issue-11970-platform-admin-l2-core", "pr": "https://github.com/objectstack-ai/objectstack/pull/13146", "premise_still_valid": true, "summary": "L2 landed: packages/core/src/security/platform-admin.ts is the config anchor (Choice 1A one variable, 2B comma list with one normalization and whole-variable-fails-closed on any unparseable entry, 3A live read with a per-process memo keyed on the raw string, verified-email match only, empty/unset/refused = zero admins), consumed by a new section 6b-config branch inside resolve-authz-context.ts's single derivation site; capability content comes from spec's ADMIN_FULL_ACCESS_CAPABILITIES (6A); core gained @objectstack/types (7A, re-measured acyclic). Derivation is purely ADDITIVE: the legacy unscoped admin_full_access grant confers exactly as before, and a holder whose standing rests on the row alone now gets P5's once-per-process pointer at the config line that re-anchors them. PREMISE REFINEMENTS, all reported rather than papered over: (1) the design's 'promote isEmailVerified out of bootstrap-platform-admin.ts' is already DONE and landed elsewhere — issues 11343/12751 promoted it to @objectstack/types as isEmailVerifiedUserRow, so this leg IMPORTS it instead of re-homing it to core/security as the design proposed; (2) the pinned batch-equivalence golden did NOT move and that is correct — pin P2 makes the sys_user read CONDITIONAL on a non-empty config, so all eleven goldens are byte-identical for a deployment that declared nothing, and the suite now clears the env var and drops the memo around itself so that property is pinned rather than assumed; (3) packages/verify/src/harness.ts and the two CLI e2e fixtures needed no change while the derivation is additive. Every other cited line number re-verified EXACT on current origin/main (env.ts:172, resolve-authz-context.ts:341/365/573/332, harness.ts:360-371, both CLI fixtures); only the design's seedEmail citation :293 moved to :294. ONE FILE OUTSIDE THE CARD'S STATED SURFACE, declared: plugin-auth/src/last-admin-guard.ts. Reclassifying ADMIN_STANDING_SURFACE.sys_user to 'derives' (which the card names as L2's work) mechanically forces it — last-admin-standing-keys.test.ts demands every column of a deriving table be judged by a standing-key list or excluded with the reason it cannot empty the administrator population, and there is no third state. An exclusion would have to assert that an email / email_verified write cannot empty the population, which is FALSE the moment an administrator is config-derived only — the exact false sentence that file exists to prevent. So: USER_STANDING_KEYS ['email','email_verified'] with id/ai_access excluded with reasons, resolveAdminUserIds counting config-derived admins through the resolver's OWN matchesConfiguredPlatformAdmin (never a re-spelled copy), and a fifth judged write shape. What did NOT land is design section 5 step 5, re-pricing which existing refusals become obsolete — that stays L3 (issue 11973) and the code says so at the seam. The addition can only make the guard refuse MORE, never less, and is fully inert with the variable unset. Two config files also changed because gates demanded them, each with its reason in the file: core's vitest.config.ts alias (check:test-source-alias) and core's tsconfig.json paths plus the rootDir widening it forces (check:type-source-resolution).", "tests": "All figures from the FINAL commit fb2200096 (after merging origin/main); shared-box seconds, parallel agents on one container; every exit code captured before any pipe; heavy runs via scripts/pm/os-verify-lock.sh (VERDICT command-exit 0 on each &&-joined chain). SUITES: @objectstack/core 'Test Files 43 passed (43) / Tests 1054 passed (1054)' (includes the untouched batch-equivalence goldens); @objectstack/plugin-auth '84 passed (84) / 1711 passed (1711)'; @objectstack/plugin-security '89 passed (89) / 1619 passed (1619)'; @objectstack/rest '154 passed (154) / 2543 passed (2543)'; @objectstack/runtime 2846 passed — 8 files failed to COLLECT on the first attempt with 'Failed to resolve entry for package @objectstack/service-cluster', an unbuilt dependency in this worktree and not this change; after pnpm --filter '@objectstack/runtime^...' build those 8 files run 'Test Files 8 passed (8) / Tests 52 passed (52)'. TYPECHECK: pnpm --filter @objectstack/plugin-auth typecheck clean (tsc --noEmit + the examples program). NEW COVERAGE: 19 parse/match unit cases (platform-admin.test.ts), 18 derivation cases (resolve-authz-context.platform-admin-config.test.ts — the acceptance criterion, every fail-closed arm including unset/empty/malformed/unverified, BOTH directions of the seeded-email pin, the legacy pointer, and the conditional-read property), 11 break-glass cases (last-admin-guard.config-anchor.test.ts) of which 2 are reverse verification on an UNGUARDED real sqlite engine proving the refusals are the guard's doing. ABLATION (run from the COMMITTED state, so the restore leg had a real reference): forcing the section 6b-config branch false turned 9 tests red across the two core suites. Mutation CONFIRMED ON DISK before the run — blob hash 712b2e93 -> 966a6404, injected text matched 1, replaced text matched 0. Restore CONFIRMED BY STATE, not by an exit code — 'git diff HEAD' empty, worktree hash 712b2e93 equal to the HEAD blob, mutation grep 0. The script carried trap restore EXIT INT TERM with an absolute REPO_ROOT path. No rebuild was needed on either leg: both suites import the subject through RELATIVE specifiers inside the package, so vitest compiles src/ and no dist/ is in the resolution path. GATES: derived from 'node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack' against the real 15-path change set (three-dot, script-derived, not a hand-written diff), then all run at fb2200096 with per-gate exit capture: pnpm lint (WHOLE REPO, not narrowed) / check:authz-resolver / check:test-source-alias / check:type-source-resolution / check:undeclared-dep-imports / check:cross-package-test-inputs / check:objectql-double-limit / check:nul-bytes / check:published-files / check:kernel-hook-pairs / check:slot-lookup / check:page-declaration-shape / check:override-consistency / check:objectui-changeset / check:changeset-gate-self-tests / check:durability-log-level / check:startup-registry-verdict / check:type-check-coverage / check-comment-mask-adoption / check-adr-0087-registration / check-changeset-no-major / check-empty-changeset / check-changeset-fixed / check-osv-exemptions / check-ci-filter-parity / check-plugin-teardown-shape / check-shard-attestation / check-keyed-text-bounds / docs-audit/check-affected-docs / pm/release-rehearsal-clone --self-test = 30 of 30 EXIT=0. Plus 'pnpm --filter @objectstack/spec build && check:generated' after the origin/main merge (which moved packages/spec): its own verdict line reads 'All 14 generated artifacts are up to date.' NOT MEASURED, named rather than counted as passes: (a) check:dual-build-cjs-loads exits 3 printing 'PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/' and 'This is NOT a pass: nothing was measured' — CI does the full build; substituted locally with a direct smoke load of core's dist/index.cjs and dist/index.js, both resolving the new exports with ADMIN_STANDING_SURFACE.sys_user.role reading 'derives'. (b) scripts/pm/check-half-states.mjs exits 3, 'PREREQUISITE NOT MET — the token in the environment is not a valid GitHub credential'; nothing was swept. (c) 'pnpm -s check:comment-mask-adoption' returns 254 (no such pnpm script) — invocation error, not a red; run directly as 'node scripts/check-comment-mask-adoption.mjs' it exits 0. (d) NEITHER package type-checks its own test files, pre-existing: @objectstack/core has no typecheck script at all (coverage DEBT ledger) and plugin-auth's tsconfig excludes tests — confirmed with 'tsc --noEmit --listFiles', 0 hits for the new test file. The verdict on those files is the vitest run above, not a typecheck.", "mcp_calls": "3 — two mcp__github__search_issues (one targeted duplicate search for the finding, one known-hit control word that returned 17 results, so the zero result is a real reading) and one mcp__github__issue_write. CHANNEL DECLARATION: everything else went over repo-scoped REST through the container proxy, which works here for reads AND writes (the PR was created with a 201 over REST). The GitHub SEARCH endpoint is the one that is refused — 'This GitHub API path is not available: sessions are bound to their configured repositories' — which is why exactly that one read switched to MCP. gh is absent from this container.", "open_questions": [ { "question": "L2 turns plugin-auth's last-admin-standing-keys correspondence gate red the moment ADMIN_STANDING_SURFACE.sys_user becomes 'derives', but the design assigns the guard work to L3 step 5 and this card's fences say do not widen. I resolved it by landing the minimum that is honest (standing-key list + the enumeration's config half + one guard arm) and leaving the refusal re-pricing to L3. Was that the intended split?", "options": [ "A — accept as landed: the correspondence gate leaves no third state, an exclusion would have been a false sentence, and a list nothing consults is a phantom, so all three pieces are the minimum. L3 keeps the refusal re-pricing, which is the part that needs its own review.", "B — split it out: revert the plugin-auth half of this PR into its own PR that lands together with (or just before) L2, so the L2 diff is core-only as the card scopes it. Costs one extra review round and a landing-order constraint; buys a diff that matches the card's stated surface exactly.", "C — hold L2 until L3 lands first and carries the guard half. Costs the whole 7-card chain its head, since six cards wait on L2 CLOSING." ], "recommendation": "A. Real business need: the write class is reachable the moment an operator adds a second address, and leaving it unjudged is a lockout with no in-product recovery. Long-term soundness: the enumeration asks the resolver's own predicate, so the two readers cannot drift — splitting it into a second PR would put a window between them where they can. AI-safety: the alternative answer available to the gate is an exclusion asserting something false, which is the highest-cost mistake this whole file family exists to prevent. Startup scope: 3 pieces, ~60 lines, one new test file, fully inert with the variable unset. Recorded plainly so the PM can rule B if the fence matters more than the seam." }, { "question": "Choice 2B says 'any unparseable entry fails the whole variable closed', but the design does not define parseable. I used a deliberate SHAPE check (one at-sign, non-empty either side, no whitespace) after measuring that zod 4.4.3's z.string().email() rejects a@b.c — this card's own acceptance-criterion value — and admin@localhost. Is that the right strictness?", "options": [ "A — the shape check as landed: the hazard is an operator typo, not a standards deviation, and under 2B an over-strict validator fails the WHOLE variable closed, i.e. it is an unrecoverable lockout on a value nobody can fix from inside the product.", "B — zod's z.email(): one validator shared with the spec's sys_user.email, at the cost of refusing a@b.c and admin@localhost. Would require re-writing the card's acceptance criterion.", "C — accept anything non-blank: no refusal arm at all, which contradicts 2B's ruled hard requirement." ], "recommendation": "A, with the measurement written into the code so nobody re-attempts B without seeing it. Real business need: admin@localhost and short-TLD addresses are real deployment values; no deployment is asking to be validated harder. Long-term: the predicate is asking the only question that matters here — could this string ever equal a stored sys_user.email — and a stricter answer is not a stricter contract. AI-safety: this is the one place where being stricter is DANGEROUS rather than safe, because the failure is fail-closed on the administrator population. Startup scope: five lines. C is rejected outright — it is the skip-and-continue shape the ruling names." } ], "out_of_scope_findings": [ "filed as #13147 (sub-issue of #11663, unassigned, no labels): OS_PLATFORM_OWNER_EMAIL's other FIVE readers still compare the whole raw value as one address, so the comma-separated grammar L2 introduces silently matches nobody in bootstrap-platform-admin.ts:404, platform-owner-wall-bypass.ts, walled-owner-operator-stamp.ts:131 and walled-owner-verification-path.ts:211,295 — only auth-plugin.ts:557's boot refusal is grammar-independent. Duplicate-checked with one targeted MCP search (0 hits) plus a known-hit control word (17 hits) in the same session." ] }
Generated by Claude Code
os-dev-report
{ "issue": 11970, "status": "done", "branch": "claude/issue-11970-platform-admin-l2-core", "pr": "https://github.com/objectstack-ai/objectstack/pull/13146", "premise_still_valid": true, "summary": "FOLLOW-UP PUSH (head 2a53b4b21, still DRAFT, needs:contract-review untouched). Fixes the RED check:where-matcher inside Lint & Repo Gates. ⚠️ ONE HALF OF THE COORDINATOR'S REQUEST COULD NOT BE DONE: the message says 'fix it in the same push as the stale-reason correction I sent you a moment ago' and later 'after the sys_permission_set reason edit'. THAT MESSAGE NEVER ARRIVED IN MY CONTEXT — the CI-red message is the only one I received. I did NOT guess at it: the sys_permission_set entry is a reason string on the administrator-derivation surface, where a wrong sentence is exactly the defect ADMIN_STANDING_SURFACE exists to prevent, so inventing an edit there is the one thing I must not do. Please re-send it verbatim and I will push it as a second commit. (For what it is worth, if it helps you confirm which line you meant: ADMIN_STANDING_SURFACE.sys_permission_set's reason currently opens 'The row `platform_admin` is resolved BY NAME from (§6b)' — the row is named `admin_full_access`; `platform_admin` is the derived POSITION. That reads like a candidate, and it is PRE-EXISTING on origin/main, not something this PR introduced. I have not touched it.) THE FIX PUSHED: the new fixture's `matches` at line 49 of resolve-authz-context.platform-admin-config.test.ts now REFUSES every top-level `$` key (`throw new Error('fake driver: unsupported operator ' + k)`) instead of reading `$or` as a field name. Refusal, not implementation, per the gate header and the coordinator's steer — it is what 196 of the 314 conforming matchers already did, and it is the verbatim spelling of the sibling double in resolve-authz-context.batch-equivalence.test.ts in the same directory. `$in` is unaffected and still works: it appears in VALUE position (`{ email: { $in: [...] } }`), a per-field operator the resolver really does issue, not a top-level combinator. A docblock over the double records why refusing is right here and tells the next author ⛔ not to grow query-engine semantics into a test fixture. ⛔ NOTHING was added to any baseline or ledger, and no gate or test was skipped, disabled or quarantined — the gate's own line confirms it: 'baseline key set verified against ca1965f: no files added.' NOT MERGED with the 3 commits origin/main gained during this lap: merging would have invalidated every measurement below and cost another full lap, and the merge queue rebuilds against current main anyway. Say the word if you want the merge in this branch now.", "tests": "REPRODUCED FIRST, then fixed, exactly as asked. Before: `pnpm -s check:where-matcher` EXIT=1 with the identical complaint — 'packages/core/src/security/resolve-authz-context.platform-admin-config.test.ts: NEW silently-wrong WHERE matcher (1 silent, 0 unjudged). line 49 `matches`: no combinator branch (combinator read as a field name)' / 'Discovered 315 matcher(s): 314 conforming (196 by refusing), 1 silently wrong, 0 unjudged.' After: EXIT=0, '✓ where-matcher conformance holds: 315 matcher(s) discovered, 315 answer the combinator battery correctly or refuse it loudly (197 refuse). 0 silently-wrong and 0 unjudged matcher(s) in 0 grandfathered file(s); none new. baseline key set verified against ca1965f: no files added.' (196 refusing -> 197: exactly the one double I changed.) SUITES at the pushed head 2a53b4b21: @objectstack/core 'Test Files 43 passed (43) / Tests 1054 passed (1054)'. GOLDENS UNTOUCHED, verified by state not by assertion: `git diff --stat HEAD -- resolve-authz-context.batch-equivalence.golden.json` prints nothing, and the only modified path in the whole tree was the one test file. plugin-auth correspondence + guard suites: 'Test Files 3 passed (3) / Tests 154 passed (154)' over last-admin-standing-keys.test.ts, last-admin-guard.test.ts and last-admin-guard.config-anchor.test.ts — run AFTER a full `pnpm --filter '@objectstack/plugin-auth^...' build`. First attempt at those three reported 'Test Files 3 failed / Tests no tests' with 'Failed to resolve entry for package @objectstack/core' — a fresh worktree with no core dist, NOT a red; naming it so the number is not read as a flake. GATES re-run at 2a53b4b21 with per-gate exit capture: check:where-matcher / pnpm lint (WHOLE REPO) / check:objectql-double-limit / check:cross-package-test-inputs / check:test-source-alias / check:type-source-resolution / check:authz-resolver / check:undeclared-dep-imports / check:nul-bytes / check:published-files / check:kernel-hook-pairs / check:slot-lookup / check:page-declaration-shape / check:override-consistency / check:objectui-changeset / check:changeset-gate-self-tests / check:durability-log-level / check:startup-registry-verdict / check:type-check-coverage / check-comment-mask-adoption / check-adr-0087-registration / check-changeset-no-major / check-empty-changeset / check-changeset-fixed / check-osv-exemptions / check-ci-filter-parity / check-plugin-teardown-shape / check-shard-attestation / check-keyed-text-bounds / docs-audit/check-affected-docs / pm/release-rehearsal-clone --self-test = 31 of 31 EXIT=0. HEAD printed before and after the batch: 2a53b4b21 both times.", "mcp_calls": "0 this round (3 cumulative for the card). Everything here went over repo-scoped REST through the container proxy and local git; no MCP GitHub call was needed.", "open_questions": [ { "question": "ANSWERING YOUR QUESTION — what does dispatch-gates.mjs key check:where-matcher off, and why did my 15-path change set miss it? MEASURED, not inferred: the gate derives EXACTLY ONE watch hint, and it is its own baseline JSON. Running the tool's own extractor over the gate's source — extractWatchHints(readFileSync('scripts/check-where-matcher-conformance.mjs'), 'scripts/check-where-matcher-conformance.mjs') — returns ['scripts/where-matcher-conformance.baseline.json'] and nothing else. hintCovers() on that hint answers false for 'packages/core/src/security/a.test.ts' and false for 'packages/drivers/driver-mongodb/src/x.test.ts', true only for the baseline file itself. WHY: the gate declares its population two ways, and dispatch-gates can derive from neither. (1) In PROSE, in the header comment — 'a function in packages/**/*.test.ts' — and the extractor masks comment ranges by construction, so a population documented in a comment is invisible to it. (2) In CODE, as `const SCAN_ROOT = 'packages';` — a SINGLE-SEGMENT literal, which looksPathy reads as no hint at all. The one narrow exception, moduleRelativeDirectoryHint, resolves a single-segment literal against the SCRIPT'S OWN DIRECTORY, so 'packages' resolves to 'scripts/packages', which is not a tracked directory: I ran it, and moduleRelativeDirectoryHint('packages', 'scripts/check-where-matcher-conformance.mjs') returns null. Net effect, and this is the sharp part: this gate is derivable ONLY for a change set that edits its own baseline file — i.e. only for changes to the set of files ALREADY KNOWN to be wrong, never for a NEW double anywhere under packages/**. That is the exact inverse of what it guards. I did NOT measure why PR #13122 derived it (I do not have that change set), so I am not asserting a mechanism for it — the honest guess is that its diff touched the baseline JSON or matched some other gate's source literal, and it is worth checking, because if #13122 derived it for a reason unrelated to the baseline then there is a second route I have not seen. As instructed I filed no card and changed nothing in dispatch-gates.mjs.", "options": [ "A — declare the population in code where the extractor can see it: replace the single-segment `const SCAN_ROOT = 'packages'` with a two-or-more-segment literal the tool reads as a hint (the shape other gates already use, e.g. 'packages/**/*.test.ts'), so any change set touching a package test file derives the gate.", "B — widen moduleRelativeDirectoryHint so a single-segment literal that resolves against the REPO ROOT to a tracked directory counts as a hint. Broader blast radius: its own docblock records that admitting on the resolved form alone was measured and REFUSED, so this needs the same re-measurement that argument was built on.", "C — leave derivation alone and treat the derived list as advisory only, relying on CI. Cheapest, and it is what actually caught this — but it concedes that a dev's local gate list can silently omit the one gate their diff trips." ], "recommendation": "A, for the card you are filing — it is a one-line change in the gate that owns the population, it needs no re-measurement of dispatch-gates' refused widening, and it fixes the class rather than this instance. Worth pairing with a sweep for sibling gates that also declare their root as a single-segment constant, since nothing about this is specific to where-matcher: any gate whose scan root is spelled that way is derivable only from its own baseline. B is the more general fix but re-opens a measured, recorded refusal and should not be taken casually. C is the status quo and is the one option that leaves the next dev with the same surprise." }, { "question": "The `sys_permission_set` stale-reason correction you referenced was not delivered to me. Do you want it as a second commit on this branch, or folded into a later leg?", "options": [ "A — re-send the exact wording and I push it as its own commit on this branch, re-running last-admin-standing-keys.test.ts and the core suite after it.", "B — if the line you meant is the `platform_admin` / `admin_full_access` slip described in the summary, say so and I will correct just that, quoting the corrected sentence back to you before pushing.", "C — leave it out of this PR entirely and carry it on L3 (issue 11973), which is already re-pricing that guard." ], "recommendation": "A. It is a reason string on the administrator-derivation surface, so the exact wording is the deliverable and a paraphrase is not — that is the whole reason this file replaced a comment. I will not write it from a guess." } ], "out_of_scope_findings": [ "filed as #13147 (sub-issue of #11663, unassigned, no labels): OS_PLATFORM_OWNER_EMAIL's other FIVE readers still compare the whole raw value as one address, so the comma-separated grammar L2 introduces silently matches nobody in bootstrap-platform-admin.ts:404, platform-owner-wall-bypass.ts, walled-owner-operator-stamp.ts:131 and walled-owner-verification-path.ts:211,295 — only auth-plugin.ts:557's boot refusal is grammar-independent.", "NOT filed, as instructed, and handed to you instead: check:where-matcher is derivable by dispatch-gates.mjs only from its own baseline file, never from the packages/** test tree it actually scans — see the first open question for the measurement and the candidate fixes.", "housekeeping note: the worktree /home/user/objectstack-11970 is deliberately LEFT IN PLACE this round because you announced a follow-up edit that has not arrived. It costs one node_modules on the shared container; say the word and I will remove it, or send the correction and I will remove it after that push." ] }
Generated by Claude Code
os-dev-report
{ "issue": 11970, "status": "done", "branch": "claude/issue-11970-platform-admin-l2-core", "pr": "https://github.com/objectstack-ai/objectstack/pull/13146", "premise_still_valid": true, "summary": "SECOND FOLLOW-UP PUSH (head 9e9d05365, still DRAFT, needs:contract-review untouched). The re-sent sys_permission_set reason correction is applied VERBATIM — your wording, my formatting, and I checked that distinction mechanically rather than by eye: a script re-assembles the concatenated string literals out of the source and compares the result to your text character for character. It matches, 746 characters, byte-identical. The apostrophes in \"row's own name\" and \"caller's own\" are why two of the nine continuation lines are double-quoted; that is the only formatting liberty taken. SCOPE HELD: the diff is 9 insertions / 3 deletions in one file, all inside the reason string. `role`, `columns` and every executable path are untouched, no other entry was touched, and nothing else in the tree was modified — `git status --porcelain` showed exactly one M line before the commit. PR BODY: one line added under the ADMIN_STANDING_SURFACE section recording BOTH corrections as deliberate — the position/row mix-up with its two line citations, and the un-makes-every-admin claim that the config anchor falsified — plus the note that a flat replacement would only have swapped which half is wrong. Verified present after the PATCH, with `Fixes #11970` still the first line. The body now carries my session-URL footer plus one platform-appended bare footer, which is the documented floor after an edit; ⛔ not looping to normalize it. NOT MERGED with origin/main, per your instruction. Worktree /home/user/objectstack-11970 REMOVED after the push landed (node_modules deleted first; `git worktree remove` succeeded without --force, which is itself the proof nothing was left uncommitted). Your answer on #13122 closes my open question: dispatch-gates named nothing for that change set either, so there is no second derivation route and the measurement stands unqualified. I filed nothing and touched neither dispatch-gates.mjs nor the gate.", "tests": "Re-run after the edit, at the pushed head 9e9d05365. @objectstack/core: 'Test Files 43 passed (43) / Tests 1054 passed (1054)'. plugin-auth correspondence + guard suites: 'Test Files 3 passed (3) / Tests 154 passed (154)' over last-admin-standing-keys.test.ts, last-admin-guard.test.ts and last-admin-guard.config-anchor.test.ts — run after `pnpm --filter @objectstack/core build` so plugin-auth reads the edited surface out of a fresh dist rather than a stale one. Both under the shared verify lock, &&-joined, VERDICT command-exit 0. GOLDENS UNTOUCHED, by STATE not by assertion, the same way as last round: `git diff --stat HEAD -- packages/core/src/security/resolve-authz-context.batch-equivalence.golden.json` prints nothing, and `git status --porcelain` over the whole tree listed only admin-standing-surface.ts. VERBATIM CHECK: a script extracted the reason block's string literals, concatenated them, and compared to your text — 'assembled == coordinator text VERBATIM: True', length 746. Run before the commit, so the commit contains what was compared. GATES the edit could reach, &&-joined under the lock, VERDICT command-exit 0: pnpm lint (WHOLE REPO) / check:nul-bytes / check:where-matcher / check:keyed-text-bounds / check-comment-mask-adoption. check:where-matcher re-confirmed green at this head, so the previous push's fix is still in force. The remaining 26 gates of the derived family were green at 2a53b4b21 and this commit changes one comment-style string inside a file none of them reads differently; I did not re-run them and I am saying so rather than implying a 31-of-31 I did not take at this head.", "mcp_calls": "0 this round (3 cumulative for the card). Repo-scoped REST through the container proxy plus local git; no MCP GitHub call was needed.", "open_questions": [], "out_of_scope_findings": [ "filed as #13147 (sub-issue of #11663, unassigned, no labels): OS_PLATFORM_OWNER_EMAIL's other FIVE readers still compare the whole raw value as one address, so the comma-separated grammar L2 introduces silently matches nobody in bootstrap-platform-admin.ts:404, platform-owner-wall-bypass.ts, walled-owner-operator-stamp.ts:131 and walled-owner-verification-path.ts:211,295 — only auth-plugin.ts:557's boot refusal is grammar-independent.", "NOT filed by me, handed to you and now confirmed complete by your #13122 evidence: check:where-matcher is derivable by dispatch-gates.mjs only from its own baseline file (single-segment SCAN_ROOT + a population declared in a comment), never from the packages/** test tree it scans — derivable only for files already known to be wrong, the inverse of what it guards. Recommendation stands at option A, plus a sweep for sibling gates spelling their scan root the same way.", "housekeeping CLOSED: worktree /home/user/objectstack-11970 removed after this push, node_modules deleted, no --force needed." ] }
Generated by Claude Code
分诊席位 —— 给本卡契约审查补一条本轮才产生的输入。⛔ 不代审、不改状态、不动
needs:contract-review。本卡的契约面是 Choice 2B 对
OS_PLATFORM_OWNER_EMAIL的文法加宽（单个地址 → 逗号分隔列表）。本轮新到的 #13147（L2 开发席位在实现 PR #13146 时自己立的，已定级bug·priority:p1·pm:queue·domain:services）测出了加宽的下游后果，审查这张卡时应当一并看到：resolvePlatformOwnerEmail()返回的值 trim 之后原样，五个读者里有四个把它当作一个地址：读者 传入逗号列表时 plugin-security/bootstrap-platform-admin.ts:404找不到账号，永远打印"will be promoted when that account registers" plugin-security/platform-owner-wall-bypass.ts永不匹配 plugin-auth/walled-owner-operator-stamp.ts:131永不匹配 ⇒ 列表里没有一个成员被打上 operator 标记 plugin-auth/walled-owner-verification-path.ts:211,295在期望一个地址的位置打印整个原始列表 plugin-auth/auth-plugin.ts:557✅ 唯一文法无关的——它只问"有没有声明" 四个都是静默失败：不匹配、一行启动日志、没有任何报错。
⇒ 对契约审查的意义：加宽之后，运维照着这个设计将要发布的文档写一个列表，得到的可观察状态是——授权那一半生效（他们确实是 platform admin），提升、operator 标记、walled 验证诊断这三半静默不生效。这正是 Choice 2B 自己的硬性要求（one separator, one normalization, one meaning）想要防止的形状。
⭐ #13147 立卡人自己把边界写得很清楚，我原样转述、⛔ 不加码：这不是 L2 实现的缺陷，是 L2 通过加宽文法而打开的既有消费者缺口；PR #13146 在自己的 body 里说明了这个缺口而没有粉饰它。本卡（L2）不受此影响，#13147 是独立的一张。
我不主张这该阻塞本卡的契约审查——那是审查者的判断。我只主张审查者应当知道：本卡审的那个加宽，在四个读者处今天是声明了不执行的。
⚠️ 另注 #13147 记录了一条排期约束：bootstrap 读者是 L4（#11974）要重写的，两个 plugin-auth 读者紧挨 L3（#11973），所以修复它可能并入那两条腿更便宜。这条同样交给审查者，⛔ 我不排期。（附一句与内容无关的账目：
needs:contract-review目前开着的只有 3 张——本卡、#13075、#12818；另有 10 张已关闭的卡仍挂着该标签。⛔ 我没有擅自摘除，关卡是否自动脱pm:*/needs:*是我已登记、尚未有结论的待裁项。）
Generated by Claude Code
Leg L2 of the accepted #11663 platform-admin re-anchor design. Provenance: design document = #11663 comment 5394453215 (§2, §3, §4 Choices 1–3 and 7, §6 row L2); maintainer acceptance = #11663 comment 5404675670 (2026-08-25, verbatim 「接受你的建议，继续」, bundle 1A/2B/3A/4A/5A/6A/7A). Filed by PM session
session_01KWRU3s15AJz7PGW7a7wdCh.Blocked-by: #11965
Blocked-by: #10348
(#10348-C consolidates the stray judges onto
resolve-authz-context.ts— the stated prerequisite so this derivation changes in exactly one place; #11965 is the spec capability declaration this leg reads.)Surface:
packages/core— newsecurity/platform-admin.ts(promotedisEmailVerified, normalization, list parse, derivation); the config branch inresolve-authz-context.ts§6b;+ @objectstack/typesdependency (Choice 7A — measured acyclic);ADMIN_STANDING_SURFACEupdate.Ruled shape (⛔ not re-litigable here):
OS_PLATFORM_OWNER_EMAIL(packages/types/src/env.ts:172); no second variable.Known cost, stated up front: this moves the pinned golden — reading
email_verifiedmakes thesys_userread unconditional for authenticated principals, and the query multiset is pinned inresolve-authz-context.batch-equivalence.test.ts+.golden.json. Move it with an explanation; ⛔ never silently re-baseline. Also touchespackages/verify/src/harness.ts:360-371+ two CLI e2e fixtures (verified-email shape after #11343).Discipline: Clause-②: yes (authorization derivation);
needs:contract-reviewat review; contract-review tier mandatory.Acceptance criterion: with
OS_PLATFORM_OWNER_EMAIL=a@b.cand a verified accounta@b.c, derivation yieldsPLATFORM_ADMINwith the declared capability set; unset/empty/malformed variable yields zero config-derived admins (loudly); legacy grant path still honoured and logging its deprecation pointer.