Repository navigation
[Security] Access denied copy — the remaining 38 templates, classified: admin-surface should be RETAINED as developer copy, four end-user sites need their own decision #7475
Description
Activity
Triage:
needs-user-decision+domain:identity.- Classification: both halves of the card are rulings, not scheduled work. Part 1 asks for a written retain-as-developer-copy verdict on the ~30 admin-surface templates (localization policy for ADR-citing operator copy = product-surface semantics — outside the triage seat's close authority, since this is a fresh decision card, not a graded
finding). Part 2's four sites each hinge on their own decision (one is already split out asassertControlledByParentWriteanswers a metadata defect and a missing row with the same403 PERMISSION_DENIED"requires edit access to its master record" #7474). Routed so the identity seat picks it up once the maintainer rules; the seat can then close Part 1 with the verdict sentence and file/queue whatever Part 2 yields. - Landing anchor (read, not inferred): the named template families all exist on
origin/main@c6a4eeb—delegated-admin-gate,suggested-audience-bindings,permission-set-projection,system-write-guardunderpackages/plugins/plugin-security/src/, andpackages/plugins/plugin-auth/src/invitation-role-cap.ts— all inside identity-lane packages ⇒domain:identity. - Dup check: keyword sweep over open issues/PRs in all three repos — no duplicate. Predecessor The other ~40
[Security] Access deniedsentences are still English-only developer copy shown verbatim to end users (same class as #7414, one template fixed) #7451 is closed by PR fix(plugin-security,spec): the end-user-facing[Security] Access deniedgates stop showing developer copy (#7451) #7471; The runtime dispatcher serialises a PermissionDeniedError'sdetailsto the client, sopositions/permissionSetsreach the browser on the/datatransport #7450 (dispatcherdetailsdisclosure) is explicitly out of scope per the body;assertControlledByParentWriteanswers a metadata defect and a missing row with the same403 PERMISSION_DENIED"requires edit access to its master record" #7474 carries theassertControlledByParentWritesite separately. - Stale-premise check: premise is the state PR fix(plugin-security,spec): the end-user-facing
[Security] Access deniedgates stop showing developer copy (#7451) #7471 left behind (merged to main today); template files verified present as above. Premise stands. target:v17: not applied — a classification/policy decision card; nothing here is a shipped-surface defect in the four blocking classes.
本评论来自分诊座位 Routine（#5474 试点），不构成认领。
Generated by Claude Code
- Classification: both halves of the card are rulings, not scheduled work. Part 1 asks for a written retain-as-developer-copy verdict on the ~30 admin-surface templates (localization policy for ADR-citing operator copy = product-surface semantics — outside the triage seat's close authority, since this is a fresh decision card, not a graded
Maintainer ruling — 2026-08-11. From the four-lens decision review (platform long-term coherence / measured business pull / AI-agent error-resistance / startup scope discipline); the maintainer accepted the recommendation set in full.
Ruling: Part 1 approved — the admin-surface family (~30 templates across
delegated-admin-gate.ts,suggested-audience-bindings.ts,permission-set-projection.ts,system-write-guard.ts,invitation-role-cap.ts, andsecurity-plugin.ts's admin-door family) is correctly developer-facing: RETAIN as developer copy, do not localize. ADR-clause citations are load-bearing for operators; localizing destroys the citation without helping anyone.Closing this card not-planned per its own suggestion, so the next census does not re-file the family as a translation backlog. Part 2 is NOT swallowed by this close:
:3981lives on as #7474 (ruled separately today);:1657stays unconverted (zero measured pull); the fail-closed sites:1069/:1140remain a candidate for their own card if degradation UX becomes a priority; the remaining sites stay unconverted by design.Recorded by the triage seat Routine (#5474 pilot) on the maintainer's direct instruction — ruling record, not a claim.
Generated by Claude Code
Successor to #7451, which is closed by PR #7471. Filed unassigned, no
domain:*label — routing and grading are the triage seat's call.#7451 was a ~40-template sweep card. PR #7471 implemented the end-user-facing half under a scope limit set at claim time, and produced an audience classification of every producer template with evidence. This card carries the remainder, so the classification does not die inside a merged PR.
The remainder is not one backlog. It splits into a decision and a short list of open questions, and conflating them is what made #7451 hard to price.
Part 1 — the admin-surface family: recommend RETAIN, do not translate (~30 templates)
delegated-admin-gate.ts(13),suggested-audience-bindings.ts(3),permission-set-projection.ts(1),system-write-guard.ts(1),plugin-auth/invitation-role-cap.ts(3), andsecurity-plugin.ts's admin-door family (:2457,:3314,:3339,:3376,:3389,:3456,:3482,:3500).These are reached from an admin console by someone administering the system, and most cite ADR clauses (ADR-0090 D5/D9 and D6/D12, ADR-0091 D3, ADR-0103). Localizing copy that cites an ADR clause destroys the citation without helping anyone: the reader is an operator who benefits from the clause number.
This is a decision to record, not work to schedule. The useful outcome is a written verdict — "this family is correctly developer-facing" — so the next census does not re-file it as a translation backlog. If triage agrees, closing this part as
not plannedwith that sentence in the thread is a better artifact than a card that stays open forever.Part 2 — four end-user-reachable sites that are NOT cleanly one situation
Each was measured as end-user reachable but declined conversion for a stated reason. None is a copy fix; each needs a decision first.
security-plugin.ts:3981assertControlledByParentWritedeny()multiplexes six conditions, three of which are not access verdicts (a metadata defect, a not-found, a null master FK). User copy would tell a user they lack access when their app is misconfigured.security-plugin.ts:1657owner_id transfer grantallowTransferappears in neither example app. Converting on speculation is the capability-expansion this repo defers.security-plugin.ts:1069/:1140fail-closed:953public-form grant ·:1891tenant wall ·:1094/:1265on-behalf-of ·predicate-guard.ts:122What PR #7471 leaves for whoever takes any of this
@objectstack/spec/system'srenderOperationMessage/BUILTIN_OPERATION_MESSAGES,errors.<key>override address, four-rung ladder.[Security] Access deniedgates stop showing developer copy (#7451) #7471 gave three gates two new keys and reused a third).developerMessageis a sibling ofdetails, never a member, becausedetailsis what the runtime dispatcher serialises.details.positionsdisclosure is The runtime dispatcher serialises a PermissionDeniedError'sdetailsto the client, sopositions/permissionSetsreach the browser on the/datatransport #7450 (needs-user-decision, cli lane), not part of this.[Security] Access deniedgates stop showing developer copy (#7451) #7471's repo-wide grep found three pins, and two more were found only by running the suites — one pinned a fragment, one pinned a regex (toThrow(/denied|permission/i)) that matched only because the English sentence happened to start with "Access denied". Grep is necessary and not sufficient here.Refs: #7451 (predecessor), PR #7471, #7414 / PR #7449, #7307 / PR #7423, #7450, #7474.