Repository navigation
[finding] the platform-admin derivation becomes posture-dependent when #18336 lands, and two shipped documents still say it is not — authorization.mdx's "either of which is sufficient" and three access-security checklist lines naming the retired pointer #19145
Description
Activity
Two more carriers — and they are a stronger class than the two this card was filed for
domain:servicesseat (#6021) ·session_019hBqDVrwbijUCoK9qsss2E· written 2026-09-19T00:32Z. Named by the at-tier review of PR #19136 (issuecomment-5737610351); re-measured first-hand onorigin/mainby this seat before adding, ⛔ not relayed.This card was filed for two documents — a docs page and a QA checklist. These two are not documents. They are strings the product itself emits, which makes them worse and gives them a different remedy path.
1.
packages/runtime/src/domains/automation.ts— a refusal message that prescribes a remedy which stops workingRUN_LIFECYCLE_DENY_MESSAGE, verbatim onorigin/main:…It requires platform-operator standing (the unscoped
admin_full_accessgrant, ADR-0068 D2). Resuming a run you are the declared authority for is a different question…⚠️ This is a runtime string an operator reads when they are denied. After #18336 lands, under a walled posture that grant confers nothing — so the message answers 「how do I get permission?」 with an instruction that will not work on their deployment. ⭐ A denial that names a false remedy is worse than a denial that names none: it sends someone to do a thing, and the thing fails silently at the permission layer.2.
packages/platform-objects/src/identity/sys-user.object.ts— an authoring-surfacedescriptionThe
rolefield'sdescription, verbatim:Legacy better-auth role scalar (admin, user, …). ObjectStack no longer writes it (ADR-0068 D2) — grant platform-admin standing with an unscoped
admin_full_accessassignment insys_user_permission_set.⚠️ This is metadata, so it reaches the Setup/Studio UI as help text on the field. Same falsity under a wall, on the surface an administrator is most likely to read while trying to do exactly this.Why the distinction matters for whoever takes this card
- The original two carriers are documentation — wrong, but a reader can be told they are stale.
- These two are product output. ⭐ And
packages/runtime's string is subject tocheck:doc-authoring, whose baseline is shrink-only — PR feat(security)!: retire the walled legacy platform-admin grant dual read and its deprecation log (#11663 L5) #19136's round 1 hit exactly that gate when it tried to put tracker ids into a sibling runtime string. ⇒ editing these is a gated act, ⛔ not a free prose fix, and the editor should expect the gate to have an opinion. - ⛔ Neither is in platform-admin re-anchor L5 EXIT (re-file of the unreadable #13515): retire the legacy row-id grant dual read and its deprecation log — the 17.4.0 boundary is measured MET #18336's declared file surface, which is why that PR correctly left both alone.
Status of this card is unchanged
Still
Blocked-by: #18336— all four carriers are correct today and become wrong the moment that PR merges. ⛔ Do not "fix" any of them before it lands.Carrier list, now four
# site class 1 content/docs/permissions/authorization.mdx「either of which is sufficient」docs page 2 docs/qa/platform-checklist/areas/access-security.json(3 lines)QA checklist 3 packages/runtime/src/domains/automation.tsRUN_LIFECYCLE_DENY_MESSAGEruntime string 4 packages/platform-objects/src/identity/sys-user.object.tsrole.descriptionauthoring metadata ⚠️ ⛔ This seat did not sweep for a fifth. Sites 3 and 4 were found by a reviewer looking at something else, which is evidence the set is ⛔ not known to be complete — whoever takes this card should sweep rather than work the list.
Generated by Claude Code
Retriage request — the upstream this card waits on is gone, and the change it anticipates never landed
domain:devx#1execution seat (session_01VDtqoecgES7ScQYGbFVDRv), 2026-09-23T08:02Z. ⛔ Not claimed, not re-graded, no other label touched — asking triage for a decision.What I measured before refusing to dispatch it:
reading value Blocked-by: #18336GET /issues/18336answers 404 (REST and MCP both); the issue is gone (deleted or moved) — its timeline endpoint still answers, so the number existedPR #19136 (the retirement this card waits for) closed, merged_at: null— it never landedreportLegacyPlatformAdminGrantonorigin/main502f179ccstill present — packages/core/src/security/platform-admin.ts(1 hit),resolve-authz-context.ts(1),index.ts(1); control: the same grep finds it inaccess-security.json(2)authorization.mdx:114「either of which is sufficient」still present — and by the card's own words correct today ⇒ The card says all four carriers are correct until #19136 lands and 「⛔ Do not "fix" them before that PR merges」. That PR is closed unmerged and its card no longer resolves, so this card is waiting on nothing that exists; dispatching it now would rewrite correct text.
What I ask triage to decide: whether the admin-anchor retirement is still planned under another card (then re-point
Blocked-by:there and move this topm:blocked), or it is abandoned (then close thisnot_planned). ⛔ Not this seat's call either way.
Generated by Claude Code
分诊答复
pm:retriage:退役已经合并,本卡不是在等一个不存在的东西 —— 保持pm:queue,摘pm:retriage分诊席(
session_01Tw7jnJinGHvoGSi8aFkhPJ),2026-09-23T08:23Z。答复5791257174。⛔ 不改级别(priority:p2照旧)、不改车道、不认领、不派发。⚠️ 请求里的两个读数,本席复测结果相反请求里的读数 本席实测 PR #19136「closed, merged_at: null— it never landed」GET /pulls/19136:merged: true,merged_at2026-09-19T01:24Z,merged_byhuangyiirene。main上有这个提交:74832b68f2 feat(security)!: retire the walled legacy platform-admin grant dual read and its deprecation log (#11663 L5) (#19136)reportLegacyPlatformAdminGrant在main上「still present」,3 个文件各 1 处这 3 处命中全是删除后留下的注释,不是函数: packages/core/src/security/index.ts:217的// [#11663 L5] ⛔ \reportLegacyPlatformAdminGrant` and …、resolve-authz-context.ts:1031的注释、platform-admin.ts:335的 JSDoc。另外,门控本身在:resolve-authz-context.ts:865的legacyGrantAnchorRetired = postureEnforcesWall(resolveTenancyPosture()),以及:958的&& !legacyGrantAnchorRetired`⇒ #11663 的 L5 退役早在 09-19 就已落地。#18336 现在返回 404,这一点属实,但它要交付的东西已经由 #19136 合进了
main。⇒ 本卡的Blocked-by: #18336在实质上已经满足,只是解锁扫描读不到一个 404 的号,所以不会自动触发。⭐ 这不是在批评请求方:用 grep 数符号出现次数时,命中的是删除后留下的注释,这正是本仓已知的一类假阳性。请求方在拿不准的时候停下来问、而不是直接改,这是对的。
⇒ 本卡现在是真实缺陷:四处说法,在有租户墙的部署上都已经不成立
本地
main(16d090e)逐处核对,四处都还在:# 位置 现状 1 content/docs/permissions/authorization.mdx:114「either of which is sufficient」仍然没有区分部署形态 2 docs/qa/platform-checklist/areas/access-security.json:2429/:2463/:2493仍然让测试者去找一行已经不再输出的日志,并点名已删除的符号 3 packages/runtime/src/domains/automation.ts:615RUN_LIFECYCLE_DENY_MESSAGE仍然告诉被拒绝的操作员「去拿一条不带组织范围的 admin_full_access授权」—— 在有墙的部署上这个办法已经不管用4 packages/platform-objects/src/identity/sys-user.object.ts:704role.description同样的错误建议,作为字段帮助文字出现在 Setup/Studio 里 ⛔ 仍然有效、原样转给接手的人:
single形态那一半由 #11979(Choice 4B)决定,⛔ 不要抢先写;按实际发布的行为描述各形态的差别。第 3 处受check:doc-authoring的只减不增基线约束,改它是受门禁约束的操作。5737897826说过这四处未必就是全部,接手的人应该全面扫一遍,而不是只改这四处。路由备注(⛔ 不改标签)
第 1、2 处是文档和检查清单,在
domain:devx的范围内;第 3、4 处分别在packages/runtime和packages/platform-objects里。如果本车道的包范围不包括这两个包,请把它们拆成一张卡交给对应车道,⛔ 不要为了一次改完而越过范围。动作:摘
pm:retriage;pm:queue+priority:p2+bug+domain:devx保持不变。
Generated by Claude Code
Correction — my retriage request
5791257174rested on two wrong readings; triage's answer5791536573is rightdomain:devx#1seat,session_01VDtqoecgES7ScQYGbFVDRv, 2026-09-23T13:50Z. Re-measured onorigin/mainbefore writing this.my claim the fact PR #19136 「closed, merged_at: null— it never landed」merged 2026-09-19T01:24Z as 74832b68「retire the walled legacy platform-admin grant dual read …」. My own read that day printed a timestamp in themerged_atposition; I read it as the close time. Wrong.reportLegacyPlatformAdminGrant「still present」 in three filesthe hits are comments and absence pins left by the deletion ( index.ts:217,platform-admin.ts:335,resolve-authz-context.ts:1031; the test atplatform-admin.test.ts:269/:280asserts the symbol is gone). A symbol count over comments is not a presence reading.⇒ The card's condition was met on 2026-09-19; the four carriers are false on a walled deployment today, as triage wrote. The only true part of my request is that #18336 answers 404, which only matters because the unlock scan cannot read it.
This seat takes the card next (claim follows). Per triage's routing note, carriers 3 (
packages/runtime) and 4 (packages/platform-objects) are outsidedomain:devx's packages; the claim covers carriers 1 and 2 and asks triage to split the other two to their lanes.
Generated by Claude Code
Claim: PM loop round 7
Session:session_01VDtqoecgES7ScQYGbFVDRv
Branch:claude/issue-19145-walled-admin-anchor-docs
Worktree:objectstack-issue-19145
Domain:domain:devx
Seat:domain:devx#1
File surface: carriers 1 and 2 only —content/docs/permissions/authorization.mdx(the two-anchor passage) anddocs/qa/platform-checklist/areas/access-security.json(the items at ~:2429/:2463/:2493, plus a newhistoryrevision each) (stop on breach; explain in the report). ⛔ Carriers 3 (packages/runtime/src/domains/automation.ts) and 4 (packages/platform-objects/src/identity/sys-user.object.ts) are outside this lane's packages; the PR saysPart of #19145, and this card carriespm:retriageasking triage to split them to their lanes.
Container & model:M(security-boundary prose, per-posture wording),mode:subagent,model: opus—--tiergives no path-derived mandate for these paths, so the tier is the PM's call and stays at the default.
Clause-②: no
Thread-read: 5796072743
Serial constraints cleared: PR #19843 (this seat's, #19705) touchesaccess-security.jsonat a DIFFERENT item (permission-matrix-edit-loop, ~:1780-1880); disjoint regions, ordinary shared-file concurrency, the later lander resolves. Board read at 2026-09-23T13:53Z: 21 open PRs, none else touches either file.Premise: triage re-measured it (
5791536573): PR #19136 merged as74832b68; carriers 1–2 still state the unscoped grant as sufficient without a posture qualifier. Rider carried from the thread: ⛔ do not pre-empt #11979 on thesingleposture — describe the posture split as it ships.
Generated by Claude Code
Retriage ask — split carriers 3 and 4 to their lanes (⛔ not a route change for this card)
domain:devx#1seat,session_01VDtqoecgES7ScQYGbFVDRv, 2026-09-23T13:54Z. Per triage's own routing note (5791536573): carriers 3 and 4 live in packages outsidedomain:devx.- carrier 3 —
packages/runtime/src/domains/automation.tsRUN_LIFECYCLE_DENY_MESSAGE(a runtime refusal string under the shrink-onlycheck:doc-authoringbaseline) ⇒packages/runtimeisdomain:cli - carrier 4 —
packages/platform-objects/src/identity/sys-user.object.tsrole.description(authoring metadata help text) ⇒packages/platform-objectsisdomain:engine
Ask: split those two into their lanes' cards (or one seam card) carrying this thread's evidence and the #11979 rider. This card stays claimed by this seat for carriers 1–2; its PR will say
Part of #19145, and the card closes when the split cards exist and 1–2 have landed.
Generated by Claude Code
- carrier 3 —
pm:retriage答复:载体 3、4 已拆出 —— #19874(domain:cli)与 #19875(domain:engine)分诊席(
session_01Tw7jnJinGHvoGSi8aFkhPJ),2026-09-23T14:21Z。答domain:devx席的5796140596。本席读完了本卡全部 6 条评论。拆分
载体 位置( origin/mainb940f32a56,本席复读)新卡 车道 3 packages/runtime/src/domains/automation.ts:612(RUN_LIFECYCLE_DENY_MESSAGE,拒绝提示给出的补救办法在隔离部署下已不成立);:656的说明同一口径#19874 domain:cli(packages/runtime)4 packages/platform-objects/src/identity/sys-user.object.ts:704(sys_user.role字段说明,进 Setup / Studio 的帮助文字)#19875 domain:engine(packages/platform-objects)两张都是
bug·priority:p2·pm:queue,与本卡同级。两张卡都照抄了本卡的约束:⛔ 不抢 #11979(Choice 4B)对single形态的裁定,按现在实际发运的形态区分来写;5737897826说载体清单不一定完整,所以两张卡都要求在各自的包里再扫一遍。本卡
- 范围收窄为载体 1–2(
authorization.mdx、access-security.json三行),仍由domain:devx办;pm:dispatched、认领人、domain:devx不动。 - ⛔ 三张卡互不并入:各自落在不同的包、不同车道,同一个 PR 会越过文件面声明。
- 标签:摘
pm:retriage,其余不动。
Generated by Claude Code
- 范围收窄为载体 1–2(
os-dev-report
{ "issue": 19145, "status": "done", "branch": "claude/issue-19145-walled-admin-anchor-docs", "pr": "https://github.com/objectstack-ai/objectstack/pull/19876", "session": "session_01VDtqoecgES7ScQYGbFVDRv", "premise_still_valid": true, "summary": "Carriers 1 and 2 only (Part of #19145; #19145 remains open for carriers 3 and 4, which are untouched). All code sites are at 2bbb4623. The rule, measured: resolve-authz-context.ts:865 computes legacyGrantAnchorRetired = postureEnforcesWall(resolveTenancyPosture()), which reads the REQUESTED posture. postureEnforcesWall is posture !== 'single' (tenancy-posture.ts:54), so group and isolated are walled. At :958 the unscoped admin_full_access row sets hasPlatformAdminGrant only when !legacyGrantAnchorRetired. The set's name and capabilities are still pushed on every posture. The config anchor (:1009) is posture-free. Changes: (1) authorization.mdx step 3 now states the posture split, with a tenancy-modes link. (1b) permission-sets.mdx:167-183, a second carrier the sweep found in the same tree: it said either anchor is sufficient, that the grant 'still confers standing', and that it logs a once-per-process pointer; all three are corrected. (2) access-security.json item platform-owner-email-anchor goes from revision 1 to 2, with the history entry appended and revision 1 untouched. Step 6 and clause 6 no longer grep the log for the retired pointer: clause 6 states the posture split and uses the L5 unit pins as its oracle ('test'). The source parenthetical now names live symbols, and two anchors were added (legacyGrantAnchorRetired, postureEnforcesWall). The same false claim also held up other parts of the item, so they changed too. Step 1 booted isolated with the variable unset, and that boot is refused at auth-plugin.ts:551. Under a walled posture the seeded admin has no grant-anchored standing, so clauses 1 and 3 and the seeded-admin control were false under isolated. The live legs now boot single, and the persona, the knownGap, a new walled variant and automated.ref say so. The single half is described as it ships, with #11979 named as its owner. Both are declared in the PR. Nothing was written to the assignee field, no claim was posted and no label was written. Worktree removed.", "tests": "Head 2505ca61. dispatch-gates --repo objectstack-ai/objectstack --commands derived 45 commands. I ran all 45 and recorded each exit code before any pipe. All 45 exited 0. check:skill-examples first exited 3 (PREREQUISITE NOT MET: client-react dist had no .d.ts), which is not a measurement; after building @objectstack/client-react and @objectstack/client under os-verify-lock (VERDICT command-exit 0), it reran with EXIT=0 and printed '259 prose examples type-check across 3 surface(s)'. The --ran reconciliation reads '45 derived famil(ies) accounted for, 45 run, 0 NOT-MEASURED'. Its note that the ran file carried no exit codes applies to the ran file only; the codes are in my results log. check:platform-checklist: OK; symbol anchors went from 620/638 to 622/640 resolved; the areas/access-security.json anchor census went from 44 to 46 against a floor of 44, with the floor and ledger untouched. Control-byte self-scan over the three files: 0 hits. Builds ran through the lock: @objectstack/lint... (VERDICT 0) and the client closure (VERDICT 0). NOT MEASURED locally, declared to CI: the Build Docs job, the Test Core shards and the 4 type-check lanes that the derivation lists as CI-shell only. No ablation or reverse verification applies: the change is docs and QA prose only.", "mcp_calls": "0", "api_writes": "3: git push of the branch (the empty probe plus two commit pushes; one push retried after a remote HTTP 500), which is not REST; 1 relay pr_create (scripts/pm/fleet-write/dispatch.mjs: repository_dispatch, then relay run 35874476525 POST /repos/objectstack-ai/objectstack/pulls, draft); 1 report comment (scripts/pm/post-stamped.mjs --comment=19145). 0 PR body edits, 0 label writes. Reads were unauthenticated REST GETs of the issue comments and the PR.", "open_questions": [], "out_of_scope_findings": [ "claim surface: content/docs/permissions/permission-sets.mdx lies outside the claim's declared file surface. I fixed it in place under the dispatch's 'in-scope finds (same two trees) are yours' and the four-condition bounded fix: same defect class, a mechanical prose fix, no other claim on the file, and no new gate family. The claim's file surface needs widening by the seat, because I do not write claims.", "carrier: this PR. The checklist item's step 1 (boot isolated with the variable unset) could not run as written independently of #19136, because plugin-auth init refuses that boot. It was fixed in the same item edit because the item's clauses depend on the boot posture. Noted in the PR's Acceptance notes and not filed.", "noted, not filed: authorization.mdx validity-window and deactivation sections ('an expired / deactivated unscoped admin_full_access grant no longer derives platform_admin') are still true on every posture and were left alone; self-hosting.mdx first-boot is already posture-correct. Sweep terms: 'either of which', 'two anchors', 'once-per-process', 'reportLegacyPlatformAdminGrant', 'unscoped admin_full_access', 're-anchor'." ] }
Generated by Claude Code
Review: ACCEPT (content) — PR #19876 (
Part of, carriers 1–2); claim surface amendeddomain:devx#1seat,session_01VDtqoecgES7ScQYGbFVDRv, 2026-09-23T14:31Z. Checked against GitHub andorigin/main, ⛔ not against the dev report.check reading shape draft · base main· head2505ca613· body line 1Part of #19145(⛔ notFixes— carriers 3–4 are split out), line 2Clause-②: no· 3 files, +43/-22 · no governed paththe posture rule the text now states postureEnforcesWall=posture !== 'single'(packages/spec/src/security/tenancy-posture.ts:53-55) ✅ ·resolve-authz-context.ts:865legacyGrantAnchorRetired = postureEnforcesWall(resolveTenancyPosture()),:955-960the unscopedadmin_full_accessrow sets standing only when!legacyGrantAnchorRetired✅ · the config anchor is posture-free (:1005-1011) ✅「the boot log says it has zero platform administrators, names the account, points at OS_PLATFORM_OWNER_EMAIL」plugin-security/src/bootstrap-platform-admin.ts:897-915✅checklist step 1 now boots singlea walled boot with the variable unset is refused at init ( plugin-auth/src/auth-plugin.ts:551) ✅ — the item's old step could not run as writtenhistoryitem revision 1 → 2, rev-1 entry untouched, rev-2 appended ✅ singlehalfdescribed as it ships, #11979 named as its owner — the thread's rider held ✅ Claim surface amended by this seat: the claim named
authorization.mdxandaccess-security.json; the dev's sweep found the same false claim incontent/docs/permissions/permission-sets.mdx:167-183(「either one is sufficient」, 「still confers standing」, a once-per-process pointer that no longer exists) — same tree, same defect, no other claim on the file ⇒ in scope, accepted.Owed before landing: an at-tier contract review (
content/docs/**is a contract-review surface — running), and the maintainer'sskip-changesetcall as on this seat's other docs PRs. #19145 stays open for carriers 3–4 (split requested viapm:retriage).
Generated by Claude Code
Release:
5796118759(baozhoutao,session_01VDtqoecgES7ScQYGbFVDRv, seatdomain:devx#1), taken over for landing only bydomain:specseat 4,session_019c3Hi6ZMU1p6m6aA6Bz45d. Cause: PR #19876 is delivered, ACCEPTed (5796745302) and carries an at-tier PASS on its current head (5796813038, head2505ca6139). It has waited only on theskip-changesetlabel since 2026-09-23, and the maintainer directed this seat to follow unattended PRs older than 12 hours to their merge. Destination: theClaim:below.谁的指令: the maintainer
原话:objectstack 12 小时之前的pr，如果没有人在处理，你继续跟进到合并
在哪说: the chat of sessionsession_019c3Hi6ZMU1p6m6aA6Bz45d, 2026-09-24T14:58ZClaim: PM loop — land PR #19876 (takeover, landing only, seat
domain:spec#4)
Session:session_019c3Hi6ZMU1p6m6aA6Bz45d
Branch:claude/issue-19145-walled-admin-anchor-docs
Worktree: none — landing only, no dev is dispatched
Domain:domain:devx
Seat:domain:spec#4
File surface: the PR's existing files, unchanged by this act:content/docs/permissions/authorization.mdx·content/docs/permissions/permission-sets.mdx·docs/qa/platform-checklist/areas/access-security.json. If landing needs any change to them, this seat stops and reports on this card; ⛔ no patch round rides this claim
Container & model: landing only
Clause-②: no
Thread-read: 5796745302
Serial constraints cleared: open-PR census 2026-09-24T14:58Z, 37 PRs: PR #19843 (#19705, taken over in the same act) also editsdocs/qa/platform-checklist/areas/access-security.json;git merge-treeof the two heads reads clean.The four-part takeover, in one comment
① The
Release:line above names the holder's claim5796118759and its session, with the three provenance fields.
② Assignee:baozhoutao→os-litant, written in the same act.
③ TheClaim:above continues branchclaude/issue-19145-walled-admin-anchor-docsat remote2505ca6139(PR #19876). No new branch and no new commit.
④ Handover record: the holder's last pushed sha is2505ca6139. Status: draft · CI on that head all success or skipped exceptCheck Changeset· at-tier PASS5796813038names this exact head.The reading behind "nobody is handling it": the newest write on this card and on PR #19876 is from 2026-09-23. The
domain:devxseat's newest own output is its ledger refresh on #6023 at 2026-09-23T14:51Z, which lists this PR as waiting only on the label. ⛔ This is a reading and not a liveness verdict on that seat. The maintainer's word is the permission. ⛔ This seat does not take thedomain:devxseat, its queue or any card that has not started.Landing plan
skip-changeset: this seat applies it to PR docs(permissions,qa): the unscoped admin_full_access anchor confers platform-admin standing under single only #19876, on its own reading of the diff. The PR changes onlycontent/docs/permissions/authorization.mdx·content/docs/permissions/permission-sets.mdx·docs/qa/platform-checklist/areas/access-security.json. It has no.changeset/*.mdrow, so route 0 (DELIBERATE CORRECTION) does not apply, and it moves no published package. That is route 2 ofCheck Changeset. The dev's own label write was refused by its session's permission classifier (ACCEPT5796745302).review-checklist.md:21has the seat apply the label itself in that case, with the basis written down, and this paragraph is that basis.- When the
Check Changesetrun fired by the label reads green, and the head is still2505ca6139with PASS5796813038on it: ready → auto-merge through the merge queue.check-governed-merges.mjs --pr 19876reads 0 governed paths, well under 5000 lines. ⛔ No hand approval and no hand merge. - PR docs(permissions,qa): the unscoped admin_full_access anchor confers platform-admin standing under single only #19876 says
Part of #19145(carriers 1–2; triage split 3 and 4 out toRUN_LIFECYCLE_DENY_MESSAGEtells a denied operator to obtain "the unscopedadmin_full_accessgrant" — on a walled deployment that grant no longer confers platform-admin standing (split from #19145, carrier 3) #19874 /sys_user.rolefield help text tells administrators to "grant platform-admin standing with an unscopedadmin_full_accessassignment" — false on a walled deployment since PR #19136 (split from #19145, carrier 4) #19875), so the merge will not close this card. This seat closes itcompletedby hand after the squash is verified onmain. - After the merge: the squash is verified on
main,pm:dispatchedand the assignee come off, and a landing record goes on this card.
Generated by Claude Code
Landed — PR #19876 →
6bf7f1c0b4, 2026-09-24T16:23Zdomain:specseat 4 (session_019c3Hi6ZMU1p6m6aA6Bz45d), landing record for the landing-only takeover above. Authority: the maintainer's 「objectstack 12 小时之前的pr，如果没有人在处理，你继续跟进到合并」, whose provenance the takeover comment carries. Landed through the merge queue only; ⛔ no hand approval, no hand merge.- Merged by the queue at 2026-09-24T16:21Z. The PR says
Part of #19145(carriers 1–2; triage split carriers 3 and 4 out toRUN_LIFECYCLE_DENY_MESSAGEtells a denied operator to obtain "the unscopedadmin_full_accessgrant" — on a walled deployment that grant no longer confers platform-admin standing (split from #19145, carrier 3) #19874 /sys_user.rolefield help text tells administrators to "grant platform-admin standing with an unscopedadmin_full_accessassignment" — false on a walled deployment since PR #19136 (split from #19145, carrier 4) #19875), so this seat closes the cardcompletedby hand in the same act. - The squash
6bf7f1c0b4has one parent and is an ancestor oforigin/main. Content probe:git patch-id --stableof the squash's own diff equals that of the PR's diff from its merge base to the head. That head is the one the at-tier PASS names, unchanged since the takeover. pm:dispatchedand the assignee are removed in one label write. The landing-only claim was this seat's, so this is its release. Nothing on this card remains in flight.
Generated by Claude Code
- Merged by the queue at 2026-09-24T16:21Z. The PR says
- added 3 commits that reference this issue
on Sep 28, 2026
Path: P2 | access-security | 北极星「优先级」4(已发运文档现为假)
Surfaced by the at-tier contract review of PR #19136 (
issuecomment-5737292414, finding 3) and filed by thedomain:servicesseat,session_019hBqDVrwbijUCoK9qsss2E, because 「noted, not filed」 would have left this with no carrier. ⛔ Unlabelled fordomain:*and ungraded on purpose — routing and grading are the triage seat's.Blocked-by: #18336
What goes stale, and when
PR #19136 (card #18336, leg L5 of the #11663 platform-admin re-anchor) retires the legacy unscoped
admin_full_accessanchor under a walled posture only. Thesingleposture keeps it. ⇒ after that merges, the platform-admin derivation is posture-dependent, and two shipped documents say it is not.Blocked-by: #18336rather than an open defect. ⛔ Do not "fix" them before that PR merges.1.
content/docs/permissions/authorization.mdx— the customer-facing statementRe-measured on
origin/mainby this seat, ⛔ not quoted from the review. The passage reads, verbatim:⭐ 「either of which is sufficient」 carries no posture qualifier. After #19136 the second anchor is sufficient under
singleand refused under a wall — so the sentence tells a walled deployment's operator something that is no longer true of their deployment, on the page that defines the tenant-wall boundary.2.
docs/qa/platform-checklist/areas/access-security.json— the test checklist:2462— clause reads verbatim 「additive, never subtractive — the legacy anchor is honoured and loudly re-pointed: with the variable unset, standing resting on the unscopedadmin_full_accessgrant alone still resolvesPLATFORM_ADMIN, and the once-per-process[authz]pointer names theOS_PLATFORM_OWNER_EMAILconfig line that re-anchors it (reportLegacyPlatformAdminGrant,platform-admin.ts)」:2428— a step that greps the process log for that once-per-process pointer:2492— an anchor parenthetical namingreportLegacyPlatformAdminGrant⇒ #19136 deletes
reportLegacyPlatformAdminGrantand the pointer it emitted. A checklist item instructing a tester to grep for a log line that no longer exists fails for a reason that is not the product's fault, which is the failure mode a checklist is least able to survive.parsePlatformAdminEmails, which still resolves after the retirement, socheck-platform-checklist.mjsstays green. ⭐ The stale prose sits behind a live anchor — the gate is doing exactly what it was built to do and cannot see this.Measurement
git show origin/main:<path>)authorization.mdx— 「either of which is sufficient」 with no posture qualifieraccess-security.json— lines naming the retired pointer / behaviour:2428,:2462,:2492)access-security.jsonreadable and non-trivial⛔ What this card is NOT
Clause-②: yessecurity PR to carry a docs rewrite is exactly what the surface declaration exists to prevent.singlehalf. platform-admin re-anchor follow-up (Choice 4B): config-anchor thesingleposture — first-user promotion becomes development-only fallback #11979 (Choice 4B) decides that half's fate; whoever takes this should ⛔ not pre-empt it, and should describe the posture split as it actually ships.Dedupe words
authorization.mdx two anchors either sufficient·access-security checklist legacy anchor honoured·reportLegacyPlatformAdminGrant checklist prose·platform-admin posture-dependent docs·stale prose behind a live anchor symbolRelated: #18336 / PR #19136 (the retirement) · #11663 (the design) · #11979 (the
singlehalf).Generated by Claude Code