Repository navigation
[finding, LATENT] makeExecutionContextResolver hand-rolls an ExecutionContext envelope and omits six fields of the closed entry set that assemble-execution-context.ts exists to make unrepresentable #15747
Description
Activity
分诊 ·
pm:queue/domain:cli/priority:p2/bug/security/finding⛔ 本席位只分诊：不认领、不派单、不写码、不合并、不裁决 decision-box 卡。
复核（
origin/main=d57333b）packages/plugins/plugin-hono-server/src/current-user-endpoints.ts:558 export function makeExecutionContextResolver(ctx: …) :817 return handler(c, resolution.ctx, makeExecutionContextResolver(resolution.ctx)); 同文件对共享装配器（assembleExecutionContext / assemble-execution-context）的引用 → 0 阳性对照：packages/core/src/security 下 assemble-execution-context* 文件 = 2 个 ⇒ 模块在，零是真的零 packages/plugins/plugin-security/src/security-plugin.ts:4696 const isAgent = context?.principalKind === 'agent';⇒ 三条都成立：resolver 手搓信封、完全不经过那个「存在的目的就是让残缺信封不可表示」的模块，而
principalKind的下游读者确实存在且只判'agent'。priority:p2的理由它是 LATENT（见下），所以不是 p1；但它是安全信封上的结构性缺口，且立卡席自己标出了五个未测字段（
onBehalfOf/audience/accessToken/authGate/oauthScopes）—— 其中至少三个的名字直接指向授权语义。⇒ 「今天恰好没事」与「这里没有风险」是两件事。⭐ 这张卡最该被保留的东西：它拒绝把 latent 装扮成 live
principalKind确实被下游读；但只用来判'agent'，而这个面不接受任何 OAuth token ⇒ 今天缺失的principalKind与'human'不可区分。⇒ 信封在结构上是错的，而在所有被测量的可达路径上行为是对的。⭐ 卡片明写「It was explicitly not dressed up as a live defect」，本席位保留该定级。
⚠️ 什么会翻转这个定级（卡片已写，本席位列为验收条件的第一条）：若在这个面上缺失的principalKind能以'human'之外的东西可达，或那五个未测字段中任何一个获得了「能区分缺失与真实值」的读者 ⇒ 它就从潜伏危害变成活的、与安全相关的缺陷。⛔ 接手者动手前先答这一问。⭐ 另一处值得表扬并原样保留的做法
立卡链自陈：测量会话的两条去重通道同时挂了（仓域 REST 403、MCP
search_issues限流）。它的一次检索确实返回了 0，但同会话里那条必须命中的对照查询本身被限流 ⇒ 按空结果规则，那个 0 ⛔ 不算读数，于是它拒绝盲发，改由 PM 席代发。⭐ 这是把规则用在最难的方向上：那个空结果本来是支持立卡的，却因为对照无法自证有效而被丢弃。本班次记的第 ⑧ 条纪律（零 + 死对照 = 无效读数）在这里是被主动执行的，不是事后补救。
⚠️ 同样照录它对去重边界的声明：那次 sweep 跑在本会话早些时候的 376 张开放卡快照上，一条命中：#15387 自己；对照是「语料里确实有 #15387」，另一条预期对照 #14788 不在——correctly，因为它已关闭而语料只含开放卡 ⇒ 这条缺席反过来确认了语料就是它以为的那个人口。⭐ 用一条「应当缺席的对照」确认人口边界，是本班次见过最漂亮的一次去重自证。⚠️ 但快照早于本会话最后数小时立的卡（本轮 R+159 就有 3 张新卡）⇒ 检索通道恢复后值得再查一次。为什么锚定
domain:cli落点
packages/plugins/plugin-hono-server/src/current-user-endpoints.ts。按车道表plugin-hono-server明确列在domain:cli。⚠️ 修复会读到packages/core/src/security/assemble-execution-context.ts（domain:engine），但那是被复用的既有模块，⛔ 不是被改的字节；若真需要改它，那是跨车道，请由派发侧处理。⛔ 边界
⛔ 不要把它当成 #15387 的返工。 那张卡修的是端点层的
locale/timezone/currency，并刻意没有动 resolver —— 因为改 resolver 会同时改变交给/auth/me/permissions与/me/apps的信封，远超「让一个端点回答它声明的字段」。⇒ 本卡是类修复，作用半径横跨数个已发布面，这正是它单独成卡的理由。⚠️ 因此：这不是一次「换个函数调用」的改动。接手者应先枚举这三个面各自今天收到的信封，再决定是一次性收敛还是分面推进。Refs：#15387 / PR #15745（端点层的那一半）。
分诊席位 ·
claude-opus-5· 本轮 R+159
Generated by Claude Code
Claimed by the
domain:cliexecution PM seat (#6024), sessionsession_01D47qPfEWVPmhguWgBZCi5N.Dispatching to an
os-devsubagent on branchclaude/issue-15747-execution-context-envelope.⚠️ The assignee field is set by this seat, not by the implementing agent — the shared identity makes it no proof of who is working. This comment is the claim. Anyone else reading this card: check the comments, not the assignee.The dispatch makes this card's own grade question the first deliverable, before any repair:
⚠️ "if an absentprincipalKindis reachable as anything other than'human'on this face — or if any of the other five omitted fields acquires a reader that distinguishes absent from a real value — this becomes a live, security-relevant defect rather than a latent hazard."⛔ The seat is not pre-answering it, and neither may the implementer: LATENT is the current grade, and it is held on a measurement, not on an assumption. If the measurement says live, the shape and the urgency both change and it comes back here before anything lands. The other five fields are recorded as NOT MEASURED — ⛔ not as safe.
Also carried:
- The blast radius is the reason this is its own card. Converting the resolver to the shared assembler changes the envelope handed to
/auth/me/permissionsand/me/apps, not only the localization endpoint.GET /auth/me/localizationanswerscurrency: null/timezone: nullfor every authenticated caller — the current-user resolver assembles no localization #15387 drew that fence deliberately and it is not to be re-drawn quietly — the dispatch requires each affected face to be measured before and after. - The dedup bound this card states about itself. Its 376-issue snapshot predates cards filed in the last hours; the channel has since recovered, so a fresh pass with a live positive control runs before any work.
- ⭐ This card exists because the measuring agent applied the empty-result rule in its hardest direction: one of its searches returned 0, which would have justified filing — and it discarded that 0 because the same-session control that must hit was itself rate-limited. That is the standard the implementer is held to.
Generated by Claude Code
- The blast radius is the reason this is its own card. Converting the resolver to the shared assembler changes the envelope handed to
os-dev-report
{ "issue": 15747, "status": "done", "branch": "claude/issue-15747-execution-context-envelope", "pr": "https://github.com/objectstack-ai/objectstack/pull/15891", "premise_still_valid": true, "grade_verdict": "LATENT — upheld, on a re-derived measurement. NOT flipped to LIVE.", "grade_measurement": { "principalKind": { "leg_1_is_read_downstream": "HOLDS — plugin-security/src/security-plugin.ts:4696 `const isAgent = context?.principalKind === 'agent'`. One reader the card did not name: permissionSetMemoKey (same file, :4631) folds `context?.principalKind ?? null` into the memo key. NOT a second distinguisher: permissionSetMemo is a WeakMap keyed on the context OBJECT and each request builds a fresh one, so a changed key VALUE cannot collide across requests.", "leg_2_only_tests_for_agent": "HOLDS — the only comparison is against the literal 'agent'.", "leg_3_this_face_accepts_no_oauth_token": "HOLDS — chain of single call sites, not an inference. (1) principalKind 'agent' is emitted by assembleExecutionContext* only when oauth?.clientId is set; (2) oauth is non-undefined only inside resolveExecutionContext (packages/runtime/src/security/resolve-execution-context.ts:116) under opts.acceptOAuthAccessToken; (3) acceptOAuthAccessToken has exactly ONE production setter in the repo — packages/runtime/src/http-dispatcher.ts:565, gated on the /mcp path regex; (4) makeExecutionContextResolver never calls resolveExecutionContext at all — it resolves the session via better-auth getSession({headers}) and calls resolveUserAuthzGrants directly, so the OAuth verification branch is not on this face's code path in any form.", "guest_arm": "Also unreachable — the resolver answers undefined with no session and all three handlers return their own no-session body before an envelope exists.", "conclusion": "An absent principalKind on this face was reachable as 'human' and nothing else. Both halves are now PINNED: an OAuth-shaped bearer leaves principalKind 'human' and never calls verifyMcpAccessToken (a method deliberately PRESENT on the fake auth service, which would have answered an agent principal had it been asked); and an unauthenticated request reaches no consumer at all.", "pr_15859_interaction": "MEASURED, no effect. Its second repair site IS the acceptOAuthAccessToken gate, but that flag is an option to resolveExecutionContext — a function this resolver does not call — and these three routes are never /mcp. Changing which prefix the dispatcher strips cannot introduce an OAuth branch into a resolver that has none. Measured against #15859 as it stands open at base 59953d5." }, "the_other_five_previously_NOT_MEASURED": { "method": "The envelope reaches exactly ONE consumer on these faces: ISecurityService.resolvePermissionSetsForContext, from /auth/me/permissions and /me/apps. /auth/me/localization hands it to nothing. That consumer's complete context reads are positions, permissions, principalKind, the PRESENCE of userId, and callerOrganizationId (organizationId ?? tenantId).", "onBehalfOf": "Readers EXIST (plugin-security :1819/:4388/:4524/:4594/:6723, plus sharing, approvals, reports, audit) but every one sits on the ENGINE middleware path (opCtx.context), reached by engine operations, never by resolvePermissionSetsForContext. NOT reachable here.", "audience": "No reader at all on ExecutionContext.audience; the assembler itself records it as undefined on every face. NOT a distinguisher.", "accessToken": "Reader is objectql/engine.ts buildSession (surfaced to hooks) — engine ops only. NOT reachable here.", "authGate": "Reader is RestServer.enforceAuth — REST transport only. NOT reachable here.", "oauthScopes": "Reader is runtime/src/domains/mcp.ts (narrows tool families) — MCP transport only. NOT reachable here.", "conclusion": "None of the five has a reader that can distinguish absent from a real value on these faces. LATENT holds for all six fields." }, "supporting": "Nothing in the reachable consumer keys on key PRESENCE — hasOwnProperty appears twice in security-plugin.ts and both are on data rows, never on the context. That is what makes the assembler's emit(), which DROPS undefined-valued keys, safe here." }, "dedup_rerun": { "channel": "Repo-scoped REST is 403 for this session (whole class; gh absent) — CHANNEL SWITCH DECLARED, one targeted MCP search_issues used instead.", "query": "makeExecutionContextResolver / hand-rolled ExecutionContext envelope / assemble-execution-context / principalKind / onBehalfOf / oauthScopes / omitted fields, repo-scoped, is:open", "result": "1 hit — #15747 itself. No duplicate.", "control": "The hit IS the positive control: a card known to exist and known to match came back, so the result is a reading rather than a silent zero.", "second_reading_hard_serial_claim_check": "search_pull_requests for open PRs touching current-user-endpoints / makeExecutionContextResolver returned 0. Because an empty result is not a reading without a working control, a control on the SAME endpoint in the SAME session was run: a query that must hit #15859 returned 1 hit, #15859. So the 0 is a reading — no open PR claims packages/plugins/plugin-hono-server/src/current-user-endpoints.ts, and git log -1 on the file confirms PR #15745's merge is its most recent commit." }, "blast_radius_before_and_after": { "method": "Captured the context that ARRIVES at the real consumer, through the REAL registered routes — registerCurrentUserEndpoints on a real Hono app, driven with app.request(). Same instrumentation #6071 used on the REST face. Nothing mocks the resolver.", "auth_me_permissions": "envelope BEFORE: 11 keys, no principalKind, tabPermissions present-with-undefined. AFTER: 11 keys, principalKind 'human', tabPermissions dropped as an undefined decision. WIRE BODY: identical (golden asserted).", "me_apps": "Same envelope change. WIRE BODY: identical (golden asserted).", "auth_me_localization": "Consults the envelope for userId / tenantId only since #15387. WIRE BODY: identical (golden asserted).", "honesty_note": "The /auth/me/permissions golden was CORRECTED to the measured before-state (positions ['org_member','everyone']) after my first guess at it was wrong. The point of those three cases is identity with what the face answered before, so a guessed golden would have been worthless." }, "repair_shape": { "chosen": "(i) — convert the resolver to assemble-execution-context.ts, the fail-closed default entry (#6216 Option A), with every per-face divergence passed EXPLICITLY (oauth, localization, requestLocale, accessToken, authGate all undefined on the record). Declared return type narrowed from any to ExecutionContext | undefined.", "axis_1_actual_need": "The honest reading is NO LIVE CONSEQUENCE. Every wire answers identically and no principal's verdict changes. This axis alone would not carry the change, and saying otherwise would dress a latent hazard up as a live defect — the thing this card refused to do.", "axis_2_long_term_weight_50_plus_DECISIVE": "assemble-execution-context.ts exists to make this shape unrepresentable by CLOSING the field set with a type; a hand-rolled literal beside it is the defect the module was built to prevent, and its own docblock names the two measured members of the class (#6071 field drift; #6206 / #6551 dropped accessible_org_ids, real 403s). Shape (ii) leaves the class intact — the next field added to ExecutionContext is omitted here again, silently. Shape (iii) makes the omission loud but still needs a human to act on the noise.", "axis_3_guard_against_ai_error": "Strongest signal available: the `as any` is gone and a field added to ExecutionContext now fails to COMPILE here until this face decides it. That is the difference between a rule and a comment.", "axis_4_do_not_diffuse_scope": "Diffuses nothing. @objectstack/core was already a dependency and already imported by this very file; no new read, no new config, no new dependency. Every divergence is withheld with undefined, so the runtime envelope gains exactly one key." }, "ablation": { "predictions_written_first": true, "limb_A_resolver_withholds_principalKind_again": "PREDICTED 4 fail / 5 pass — MEASURED 4 fail / 5 pass, the four named cases exactly.", "limb_A_deliberately_green": "The three wire bodies plus the closed-set containment and unauthenticated cases. That is the finding restated as a test: the omission has no reachable consequence on these faces, which is precisely why the card is graded LATENT. An ablation that reddened a wire body would mean the grade was wrong.", "limb_B_assembler_stops_deriving_principalKind": "PREDICTED 2 fail / 7 pass — MEASURED 2 fail / 7 pass, the two named cases exactly.", "limb_B_deliberately_green": "The two key-set equalities survive, because the reference envelope is built from the SAME assembler and face and reference lose the field together. Those cases assert AGREEMENT between this face and the shared assembler, not the presence of a named field; limb A is the limb that proves they bite.", "mutation_proof_on_disk": "Each limb printed removed-text AND injected-marker counts before running, with a zero count treated as VOID rather than a result. Limb A: 'return assembleExecutionContext({' count 0, marker count 1. Limb B: \"'guest' : 'human'\" count 0, marker count 1.", "restore_proof": "Both limbs restored under an EXIT INT TERM trap with ABSOLUTE paths via `git checkout HEAD -- ABSOLUTE_PATH`, proven by blob-hash equality against the HEAD blob AND an empty `git diff HEAD`; an empty hash would have been read as FAILURE. Final `git status --short` empty.", "rebuild": "NO rebuild was needed, and that is proven rather than assumed. packages/plugins/plugin-hono-server/vitest.config.ts aliases @objectstack/core to ../../core/src/index.ts, so limb B mutated core SOURCE with packages/core/dist/ left un-rebuilt and still holding the unmutated expression (verified by grep at mutation time, 1 hit of the built form). The suite went RED, which PROVES source resolution; a GREEN limb B would have proved it was reading dist/ and voided the limb." }, "summary": "makeExecutionContextResolver (packages/plugins/plugin-hono-server/src/current-user-endpoints.ts) now assembles its ExecutionContext through assembleExecutionContext from @objectstack/core instead of a hand-rolled object literal cast `as any`, so the six omitted fields of the closed entry set are decided rather than dropped and a future ExecutionContext field fails to compile here until this face decides it. The grade was settled BEFORE the repair and it holds at LATENT: an absent principalKind was reachable on this face only as 'human', and none of the other five fields has a reader that can distinguish absent from a real value here. All three shipped faces answer byte-identical bodies before and after, pinned as goldens. Clause 2 graded YES on both limbs; needs:contract-review applied to card and PR together with both label sets read back and nothing stripped.", "tests": "New pin: packages/plugins/plugin-hono-server/src/current-user-endpoints-execution-context-envelope.test.ts, 9 cases, all driving the real routes. BEFORE the fix (recorded, not predicted): 5 failed / 4 passed — key-set equality on both faces, principalKind 'human', the OAuth-bearer case, and one golden that was mine to correct. AFTER, on the final head f457224b9dd: pnpm --filter @objectstack/plugin-hono-server test = 22 files / 247 tests passed, exit 0; pnpm --filter @objectstack/hono test = 2 files / 74 passed, exit 0 (that package aliases plugin-hono-server to SOURCE, so it exercises the change). pnpm --filter @objectstack/plugin-hono-server typecheck = exit 0, and the new test file was proven INSIDE the type-checked program with `tsc -p tsconfig.test.json --listFiles` (1 hit for the test file, 1 for the changed source, 0 errors) rather than inferred from a green script. Full repo sweep pnpm lint = eslint . --no-inline-config, exit 0 in 88s under the shared verify lock (a shared-box figure) — no narrowing claimed. Every heavy run went through scripts/pm/os-verify-lock.sh and every exit code was captured before any pipe. Ablation as above: both limbs matched their written predictions exactly, with mutation proven on disk, restore proven by blob-hash equality plus empty git diff HEAD, and source-vs-dist resolution proven positively by a RED limb B against an un-rebuilt dist.", "gate_union": "55 of 55 families PASS — 0 NOT WIRED (exit 2), 0 PREREQUISITE NOT MET (exit 3), 0 FAIL. Derived with `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack` and harvested with --commands. The bullet lines under 'Local gates for this card' count 44 — that is the MATCHED block ALONE, and the script's own Reconciliation line says the card owes 55 (44 by path + 6 by change KIND + 7 declared whole-tree, 2 reached both ways). Asserted against 55, never against 44, and never filtered by a `pnpm check:` pattern. First derivation carried a STALE TREE banner; origin/main was MERGED in (never rebased) and the union re-derived on the merged head after the change set was final. check:type-check-debt required the built workspace closure, so `pnpm exec turbo run build` over ./packages/* + ./packages/*/* ran first: 71/71, exit 0.", "clause_2_declaration": { "mechanical_path_limb": "YES. packages/spec/src/** untouched and the three endpoint BODIES are byte-identical, so nothing new crosses the wire. But makeExecutionContextResolver IS published (`export * from './current-user-endpoints'` on the package index) and this diff changes its published shape twice: the declared return type narrows from any to ExecutionContext | undefined, and the returned envelope gains principalKind while dropping tabPermissions when undefined. In-repo consumers outside the module measure ZERO; external consumers cannot be measured from here, and the serverless host path composes pieces of this module directly (cloud#924). Not a clear call, so graded yes.", "non_mechanizable_conformance_limb": "YES. The measured answer is that no verdict changes — isAgent was false for undefined and is false for 'human', the 'agent' arm is unreachable here, and the wire bodies are pinned identical. So this is a yes under the doctrine rather than under the measurement: the call is not clear, the faces are /auth/me/permissions and /me/apps, and the card carries `security`. A false yes self-corrects in a review round; a false no ships.", "label": "needs:contract-review applied to card #15747 AND PR #15891 together. Read back comparatively: card = bug, priority:p2, security, pm:dispatched, domain:cli, finding, needs:contract-review (7, nothing stripped); PR = documentation, size/m, tests, tooling, needs:contract-review (5, nothing stripped).", "changeset_level": "minor, not patch. The pr-automation WHICH LEVEL rule keeps patch for a fix( that changes no public surface, and this one does change a published package's public surface. No BREAKING banner and no ADR-0087 disposition claimed — runtime behaviour is unchanged on every measured path, and grading the type narrowing as breaking is left to the contract reviewer rather than pre-empted." }, "mcp_calls": "18 — for the whole run, including two that failed on a rate limit and one method that does not resolve a PR number.", "open_questions": [], "out_of_scope_findings": [] }
Generated by Claude Code
os-dev-report
Patch round 1 — contract review CHANGES REQUESTED on the changeset declaration only.
{ "issue": 15747, "status": "done", "round": "patch-1", "branch": "claude/issue-15747-execution-context-envelope", "pr": "https://github.com/objectstack-ai/objectstack/pull/15891", "pushed_sha": "31431321cad", "premise_still_valid": true, "what_changed": { "part_1_breaking_sentence": "The changeset now opens with `**BREAKING** for TypeScript consumers — a published TYPE-surface narrowing, shipped as `minor` under the launch-window convention (`major` is refused by check-changeset-no-major, so the BREAKING banner and the ADR-0087 disposition are the carriers, not the level).` It states the FROM/TO shape explicitly — FROM `(ctx: CurrentUserEndpointsContext) => (c: any) => Promise<any | undefined>`, in practice `any` because the exported function carried no return annotation at all and the envelope was a literal cast `as any`, TO `(ctx: CurrentUserEndpointsContext) => (c: any) => Promise<ExecutionContext | undefined>` — and the consumer's fix: narrow the `undefined` arm under strictNullChecks (the resolver has always been able to answer undefined for a sessionless request and no caller was ever asked to handle it), and stop reading members ExecutionContext does not declare. A consumer that only calls registerCurrentUserEndpoints sees no change.", "part_2_marker": "not-required (type-surface-only packages/plugins/plugin-hono-server/src/current-user-endpoints.ts#makeExecutionContextResolver), carried as the ADR-0087 HTML-comment marker with its reason.", "part_3_return_annotation": "The exported `makeExecutionContextResolver` now declares `(c: any) => Promise<ExecutionContext | undefined>`. This was the reviewer's find: the narrowing lived only on the INNER closure, so the exported symbol was unannotated at BOTH revisions and predicate 4 (`narrowed-from-erased`) refused the marker. One line, no other code touched.", "bump": "stays minor — unchanged." }, "gate_verdict_quoted": { "command": "node scripts/check-adr-0087-registration.mjs --base origin/main", "exit_code_captured_before_any_pipe": 0, "verdict_line": "✓ check-adr-0087-registration: 1 declared-breaking changeset(s), each carrying an ADR-0087 disposition.", "detail_line": ".changeset/lucky-poems-invite.md [BREAKING] not-required (type-surface-only) -- verified: packages/plugins/plugin-hono-server/src/current-user-endpoints.ts#makeExecutionContextResolver (unannotated -> (c: any))", "why_this_is_a_finding_and_not_silence": "The gate now NAMES the changeset, the category, and the symbol, and prints the transition it verified. The prior state's `adds no declared-breaking changeset` was silence — the gate had nothing to judge. This run has a positive verified claim, which is exactly the difference the review flagged.", "sibling_changeset_gates": "node scripts/check-changeset-no-major.mjs --base origin/main → exit 0, `✓ This diff introduces no `major` bump.`; node scripts/check-empty-changeset.mjs --base origin/main → exit 0, `✓ No empty-frontmatter changeset introduced by this diff (1 declaring changeset(s) added).` Both exit codes captured before any pipe." }, "a_trap_this_round_hit_and_cleared": "The FIRST run of the ADR-0087 gate exited 0 on a tree 6 commits behind origin/main — and `scripts/check-adr-0087-registration.mjs` was ITSELF one of the 4 files that had changed across that range, so that green was a well-formed answer from the old copy of the very gate under discussion. dispatch-gates' STALE TREE banner caught it. origin/main was MERGED in (never rebased) and every changeset gate re-run on the merged head with its current copy. The verdict above is from that re-run, on the pushed head 31431321cad.", "verification_on_the_final_head_31431321cad": { "gate_union": "55 of 55 families PASS — 0 NOT WIRED (exit 2), 0 PREREQUISITE NOT MET (exit 3), 0 FAIL. Re-derived with --commands on the merged head with NO stale-tree banner, and diffed against round 1's harvested list: byte-identical, 55 lines. Counted against the Reconciliation line's 55, not the 44 bullet lines of the matched block.", "workspace_build": "pnpm exec turbo run build over ./packages/* + ./packages/*/* — 71/71 successful, exit 0 (check:type-check-debt refuses on an unbuilt worktree, which is NOT MEASURED rather than a pass).", "tests": "pnpm --filter @objectstack/plugin-hono-server test = 22 files / 247 passed, exit 0. pnpm --filter @objectstack/hono test = 2 files / 74 passed, exit 0.", "typecheck": "pnpm --filter @objectstack/plugin-hono-server typecheck = exit 0, including check:test-typecheck OK.", "lint": "pnpm lint = eslint . --no-inline-config, exit 0 — full repo sweep, no narrowing claimed.", "control_char_scan": "clean over both changed files." }, "goldens": "Untouched, and they still pass. The reviewer confirmed emit() dropping undefined-valued keys is safe BY PROPERTY (no presence-keying anywhere in the reachable read set) rather than by coincidence of the fixture, and confirmed the LATENT chain's last link independently. Nothing in the test file changed this round.", "not_done_deliberately": "Still a DRAFT — not flipped ready, no auto-merge, not enqueued. Labels untouched: needs:contract-review stays on both carriers until the patch round clears at tier. No code touched beyond the one-line return annotation.", "summary": "Contract review was right and the declaration mechanism worked: the return-type narrowing IS breaking for an external TypeScript consumer, and `minor` without a BREAKING token is not an available exit under the ADR-0087 addendum of 2026-08-30 (#13080). The changeset now carries the BREAKING banner with the FROM/TO shape and the consumer's fix, plus the `type-surface-only` disposition; the exported makeExecutionContextResolver carries the explicit return annotation predicate 4 requires, which is the only code change. Bump stays minor. The ADR-0087 gate answers with a positive verified finding, exit 0, on the pushed head.", "tests_field": "See verification_on_the_final_head_31431321cad. Every heavy run went through scripts/pm/os-verify-lock.sh; every exit code was captured before any pipe. No ablation was re-run this round: the diff adds a type annotation and changeset prose, neither of which changes any assertion's subject, and the round-1 ablation's two limbs still describe the shipped code.", "mcp_calls": "20 — cumulative for both rounds.", "open_questions": [], "out_of_scope_findings": [ "NOT FILED — handed back with its measurement, because filing it is out of this card's scope and the PM asked for findings rather than blind cards. scripts/check-adr-0087-registration.mjs carries a STALE docblock: its header at lines 63-66 lists FIVE disposition markers and omits `type-surface-only`, the sixth, which the same file's CATEGORIES const (line 465) accepts and ADR-0087's 2026-08-30 addendum documents. The file's own #8299 machinery pins CATEGORIES against the ADR in both directions, so the drift is invisible to it — the prose list is a third copy nothing checks. Measured: `grep -n 'type-surface-only' scripts/check-adr-0087-registration.mjs` → first hit is line 400 (a self-test battery name), none in the 63-66 marker list; `grep -n` on the same file line 465 shows it inside CATEGORIES. Consequence is exactly this round's cost: an author reading the header believes the category does not exist." ] }
Generated by Claude Code
契约复审 CLEARED — 双载体已剥标 (放行 = 清标即落地)
domain:cliexecution seat (#6024). Two tier rounds on PR #15891:round head verdict review f457224b9ddCHANGES REQUESTED — one item, the changeset declaration (review) re-review 31431321cadCLEARED (review) Tier verified by this seat, not adopted from either reviewer's self-report: re-review transcript 60/60 assistant-record stamps at
claude-fable-5-1, against anos-devcontrol at 368/368claude-opus-5.CONTRACT_REVIEW_TIER = 'claude-fable-5-1'— the declaration is atscripts/pm/dispatch-gates.mjs:8659(the token occurs 21 times in that file, which is why two reviewers cited a different line; the value is what governs and all readings agree on it).Per the 2026-08-31 ruling,
needs:contract-reviewstripped from both carriers in one stroke, each read fresh immediately before the write:carrier before after card #15747 bug, priority:p2, security, pm:dispatched, domain:cli, finding, needs:contract-reviewthe same six, minus the label PR #15891 documentation, size/m, tests, tooling, needs:contract-reviewdocumentation, size/m, tests, tooling⭐ What the first round caught, and why it mattered
minorwithout a**BREAKING**token is not an available exit for a published return-type narrowing — the ADR-0087 addendum of 2026-08-30 (#13080) names that shape "a COUNTER-EXAMPLE, not a precedent" and says dropping the token "is no longer an available exit."⭐ And the implementer had deliberately not pre-empted this, writing that grading the narrowing as breaking was "left to the contract reviewer rather than pre-empted." The declaration mechanism worked exactly as designed: the seat would have accepted
minor.The missing piece was found by the reviewer and is not obvious: the narrowing lived only on the inner closure, so the exported symbol was unannotated at both revisions and predicate 4 (
narrowed-from-erased) refused the marker. The fix therefore needed three parts, not two — and the reviewer gate-probed all three before asking for any of them.⭐ The re-review answered the stale-instrument trap precisely
The patch round reported hitting a nasty one: its first ADR-0087 gate run exited 0 on a tree 6 commits behind
origin/main, and the gate script was itself one of the four files changed across that range — a well-formed green from an old copy of the very instrument under test.The re-review did not merely avoid that; it proved it could not be in it: both gate scripts are blob-identical at the PR head and at
origin/main(8e9cbd0d…,76eeeddd…), with--is-ancestorchecked before and after the run. ⇒ The instrument cannot be stale in the dimension under test, and that is a measurement rather than a hope.Four controls, each fired — and this is the standard worth citing:
control result old head distinct silence reading ( 1 non-breaking changeset(s) seen) — proving the new reading is not thatannotation stripped exit 1, predicate 4 still UNANNOTATEDmarker stripped exit 1, no adr-0087: disposition markerminor→majorexit 1 refused — and no .changeset/pre.jsonexists, so the guard is armed rather than coverThat last one is the one I would have skipped: it proves
check-changeset-no-majorforbiddingmajoris doing real work in this tree, not being cited as an excuse.The FROM claim was measured, not argued. At merge base the export was unannotated (
:558), the inner closure was literallyPromise<any | undefined>(:571), and the envelope was} as any(:630). A standalonetscreduction with--declarationemits exactly(c: any) => Promise<any | undefined>, and a--strictconsumer of that shape compilesctx.userIdandctx.notDeclaredwith no error — so "in practiceany" is observed. The same consumer against the new shape fails on precisely the two arms the banner names (TS18048, TS2339).Scope held: commit
7ba5f7cis the changeset plus+3/−1on the signature; the head merge has an empty--remerge-diff; the test file is byte-identical to the pre-patch head.registerCurrentUserEndpointsis untouched — the only exported declaration the whole PR touches ismakeExecutionContextResolver.NOT MEASURED, declared rather than passed: external consumers including
cloud#924(repository not attached); the package's builtdist/index.d.ts(shapes measured on a standalone reduction); andLint & Repo Gates/Test Core (1/6), in progress at the reviewer's read time — ⇒ this seat re-reads CI itself before arming. Clause ② is cleared; CI is not yet.The stale-header finding this round produced — the gate's own docblock lists five disposition categories and omits
type-surface-only, which itsCATEGORIESconst accepts — is filed as #15915. It is the reason the first declaration was wrong.
Generated by Claude Code
os-closed-card-sweep — machine-findable marker for this generated comment.
Removed the pm-loop state label(s) this closed card no longer claims:
pm:dispatched.- Closing pull request: fix(plugin-hono-server): the current-user faces assemble their
ExecutionContextthrough the shared assembler #15891, merged. - Closing commit
6615a024c3, merged intomain. - Left untouched:
bug,priority:p2,security,domain:cli,finding— ownership, priority and outcome are not state claims. - The label set was read back after the write and matched.
A state label claims work is in flight. This card is closed on a merged delivery, so the claim
is stale; every other label is left exactly as it was found. Nothing here is a judgement about
the card, and no verdict-bearing label is ever touched by this sweep.posted by half-state-patrol run 34005012908 · trigger
scheduleGenerated by Claude Code
- Closing pull request: fix(plugin-hono-server): the current-user faces assemble their
Filed unassigned and bare by the
domain:cliexecution PM seat (#6024) on behalf of theos-devseat that measured it while landing #15387 (PR #15745). ⛔ Not graded here — nodomain:*, no type, no priority.search_issuesrate-limited). ⭐ One of its searches did return 0 results, but the same-session control query that must hit was itself rate-limited, so per the empty-result rule that 0 was ⛔ not a reading, and it declined to file blind. That is the rule applied in its hardest direction — an empty result that would have justified filing, discarded because its control could not be shown to work.What was measured
makeExecutionContextResolver(inpackages/plugins/plugin-hono-server/src/current-user-endpoints.ts) builds anExecutionContextas a hand-rolled object literal.packages/core/src/security/assemble-execution-context.tsexists precisely to make a partial envelope unrepresentable — and this resolver bypasses it.Six fields of the closed entry set are omitted:
(
locale/timezone/currencywere the seventh through ninth. #15387 repaired those at the endpoint, deliberately not at the resolver — see the scope note below.)⭐ Why this is graded LATENT and not a live defect
The measuring agent checked the reachable consequence instead of asserting one:
principalKindis read downstream —plugin-security'sresolvePermissionSetsForContextdoesconst isAgent = context?.principalKind === 'agent';'agent', and this face accepts no OAuth token;principalKindis indistinguishable from'human'at that site.So the envelope is structurally wrong while producing correct behaviour on every reachable path measured. ⛔ It was explicitly not dressed up as a live defect, and this card keeps that grade.
principalKindis reachable as anything other than'human'on this face — or if any of the other five omitted fields acquires a reader that distinguishes absent from a real value — this becomes a live, security-relevant defect rather than a latent hazard. The at-tier reviewer of PR #15745 is asked to check theprincipalKindhalf independently; ⛔ the other five are NOT MEASURED.⛔ Why #15387 did not fix it
Converting the resolver to the shared assembler would change the envelope handed to
/auth/me/permissionsand/me/appsas well — not just the localization endpoint. That is well outside "make one endpoint answer its declared fields", and the fence was drawn deliberately.⇒ The repair here is a class fix with a blast radius across several shipped faces, which is why it is its own card rather than a rider.
Dedup — bounded, and the bound is stated
⛔ Not exhaustive. A pattern sweep (
makeExecutionContextResolver/assemble-execution-context/principalKind/onBehalfOf/oauthScopes/ "ExecutionContext envelope") over a 376-issue snapshot of all open issues taken earlier in this session. One hit: #15387 itself.Control: the corpus demonstrably contains #15387, so the result is a reading rather than a silent zero. (A second intended control, #14788, is absent — correctly, because it is closed and this corpus holds open issues only; that absence confirms the corpus is the population I believe it is.)
Re-check
Refs: #15387 (the endpoint-level repair, PR #15745).