Repository navigation
plugin-sharing's read-path merge is a THIRD read-scope boundary the #8220 provenance mark does not cover — sharing-composed queries withhold the author diagnostic (fail-closed, but restorable) #8430
Description
Activity
Triage: lands in
packages/plugins/plugin-sharing(sharing-plugin.tscomposeAndsites) →domain:identityper the lane table (plugin-sharingis identity's family). Type: Bug — once the #7929/#8220 mark is the declared mechanism, an author's own cross-field refusal staying redacted on the sharing-composed path violates the contract that card exists to restore; the fail-closed direction is correct but the author-diagnostic half is a real gap.Graded
pm:blocked, notpm:queue:Blocked-by: #8220 — the fix consumes
markFilterSubtreeProvenance/resolveFilterSubtreeProvenancefrom@objectstack/spec/data, which land via #8220's PR #8429, still in flight (pm:dispatched) at triage time. Dispatching before those exports are onorigin/mainproduces a PR that cannot build.⚠️ Carried here in the triage comment rather than edited into the body: an MCP-backed body round-trip risks corrupting the original text (HTML-entity escaping, the knownissue_readtrap) — identity seat, read this comment before the unlock scan trusts the body's absence of aBlocked-by:line. On #8220's close, re-verify this card's file surface on the merged ref before queueing (the merge most likely to close #8220 is also the one most likely to have moved these seams).Constraints already stated on-card are binding and correctly sourced (fail-closed default; consume the one provenance mechanism, never invent a parallel one).
Size/model suggestion: M,
mode:subagent, opus.
Generated by Claude Code
Unlock sweep: blocker cleared.
pm:blocked→pm:queue.Declared blocker: objectstack#8220 and objectstack#8429 — verified closed against the GitHub API on 2026-08-14. No other blocker is declared on this card.
⚠️ This card'sBlocked-by:line lives in a comment, not the body. The unlock sweep greps the body, so this card was not discoverable by the automated sweep and was found only by a manual read of everypm:blockedcard. Several seats recorded that they placed the line in a comment deliberately, to avoid the MCP body round-trip re-encoding the card's punctuation as HTML entities. That trade-off is sound per card and structurally lossy in aggregate: 26 of the 40 openpm:blockedcards across the three repos carry no body-levelBlocked-by:. The durable fix belongs in the sweep (grep comments too), not in asking seats to risk body rewrites.Authorization: maintainer directive (this session) —「先做 23 张 blocked 解锁 10 张 on-hold 按各自自述处理」· PM session
01JaVVMrSxt7Tgi1uwEuDtH7
Generated by Claude Code
Out-of-scope finding from #8220 / PR #8429, measured by its dev (cloud session
session_01AkiE189Csm7aBT2qCVSx3X) and filed by the dispatching PM on its behalf (the dev's environment had no GitHub API egress — provenance in theos-dev-reporton #8220). Unassigned, for triage; lands inpackages/plugins/plugin-sharing(identity lane's family).The gap
#8220 declared the filter-subtree provenance mark and set it at TWO read-scope merge boundaries (plugin-security's RLS injection; service-analytics'
withReadScope).plugin-sharing's read-path merge (sharing-plugin.tscomposeAndsites, ~:871/:896) is a third merge boundary outside that card's declared file surface:ast.wherehas already been rewritten by the sharing composition), so the author's OWN cross-field refusal stays redacted — the exact author-experience cost [A of #7929] a spec-declared provenance mark set at both read-scope merge boundaries, so the driver can restore the author-facing cross-field diagnostic without re-disclosing policy #8220 existed to remove, surviving on one composition path.The fix shape (for whoever takes it)
Mark at plugin-sharing with the #8220 spec exports (
markFilterSubtreeProvenancefrom@objectstack/spec/data):'policy'on its injected sharing filters; it can also preserve the author vouch across its rewrite (mark the caller's subtree'author'under the same identity-vouch discipline plugin-security uses — a rewritten sibling tree is vouched for nobody). Pins per the #8220 pattern: author names columns / policy withholds / unmarked withholds, at a real driver.Constraints inherited from #8220 (binding on any implementation)
resolveFilterSubtreeProvenance— ⛔ do not invent a parallel provenance concept.Refs: #8220 (the mark + both existing boundaries), PR #8429, #8198 (the B-phase redaction), #7929 (the ruling).