[finding] Two comments still describe the walled platform-admin elevation gate that L4 retired — one of them ships in the types package declarations #13661

Activity

1. claude

   added

   domain:servicesRetired 2026-10-22, alias of domain:server (services surface); in-flight cards keep it until landedRetired 2026-10-22, alias of domain:server (services surface); in-flight cards keep it until landed

   findingRecorded observation — held, not dispatchable until the findings triage round grades itRecorded observation — held, not dispatchable until the findings triage round grades it

   on Aug 31, 2026
2. os-steve commented on Aug 31, 2026

   

   os-steve

   on Aug 31, 2026 – with Claude

   Collaborator

   More actions

   定级 (domain:services 座位 #6021, 2026-08-31) — finding → pm:queue · priority:p2 · documentation。两处都复核为仍然存活，并且比原报告多两句。

   复核:两处都还在,不是已经被别的腿顺手改掉了

   原报告成文于 L4 落地之后、L3 (#11973 / PR #13685) 交付之前。L3 恰好重写了 last-admin-guard.ts 的 41 行注释,所以第一件要排除的可能是「L3 已经顺手改了」。没有 —— 在 PR #13685 的头 df17ff0a7 上实测:

   处	位置(实测)	状态
   1	packages/types/src/email-verified.ts:13-15(origin/main)	✅ 仍在:ONE resolution, two consumers, by design (#12751): the walled platform-admin elevation gate …
   2	packages/plugins/plugin-auth/src/last-admin-guard.ts:635-636(df17ff0a7)	✅ 仍在:It now drops a DEACTIVATED set before any derivation, so \active: false` on `admin_full_access` un-makes every platform admin at once`

   原报告把处 2 说成「PERMISSION_SET_STANDING_KEYS 上方的注释」—— 属实,该 docblock 从 :626 起,常量声明在 :668,引文一字不差。

   同一个 docblock 里还有两句同类的,原报告没点到 —— 一并纳入本卡

   同属 :626-667 这一块,同一个失效前提的另外两句:

   • :648-650 — 「resolveAuthzContext derives platform_admin from the NAME of an ACTIVE set, never from the capabilities it carries」。L2 之后,它也从配置锚(OS_PLATFORM_OWNER_EMAIL + 已验证的 sys_user 行)推导,never from 这半句把读者引向「只看 set 行」。
   • :663-665 — 「platform-admin standing is read from UNSCOPED sys_user_permission_set grants only (a position-bound admin_full_access never conferred it, in the resolver or here)」。only 在 L2 之后为假:配置锚的管理员一行 grant 都不需要。

   这两句和原报告点的那一句是同一个前提的三处后果,分开修会留下两句自相矛盾的邻居。所以本卡的范围是「那一个 docblock 整块 + email-verified.ts 的 docblock」,不是「两行」。

   定级理由

   • 纯注释,零行为。throw 普查在 L3 头上是 last-admin-guard.ts 6→6;这一卡不会动到任何一个。守卫保留 active 于 PERMISSION_SET_STANDING_KEYS 是安全方向的过近似,原报告这一判断我复核认同 —— ⛔ 本卡不得顺手把 active 摘掉,那是行为变更、要另走一张卡和条款②。
   • 但它不是可以耸肩放过的:处 1 的 docblock 随 types 包的 .d.ts 出货,处 2 的三句正是未来读者用来判断「active 这个 key 能不能删」的依据。错的理由比没有理由更贵。
   • p2:无用户可见影响,但会直接误导下一次改动。

   ⛔ 派发时机:热文件互斥,现在不能派

   packages/plugins/plugin-auth/src/last-admin-guard.ts 当前被开着的 PR #13685(L3,draft,挂 needs:contract-review,等项目总监席的复审链)占着单写手位。现在派发会直接撞上 CI 的 No other open PR may claim the same single-writer path。

   ⛔ 同样不采取的做法:把这两处塞进 #13685 当 rider —— 那会给一个已经复审完备的 needs:contract-review 增量凭空加面,是本仓明令禁止的搭车。

   放行条件:#13685 合并(或关闭)后即可派发,届时 origin/main 上重新核一遍两处引文仍在(L3 的注释重写可能已经带走其中一句)再下派发令。packages/types/src/email-verified.ts 那一半现在无人占用,但两处同源、拆成两个 PR 更贵,一并等。

   ---

   Generated by Claude Code
3. os-steve

   added

   documentationImprovements or additions to documentationImprovements or additions to documentation

   priority:p2Medium: important, M3Medium: important, M3

   pm:queueReady for the PM dispatch loopReady for the PM dispatch loop

   pm:dispatchedDispatched to a dev agent by /pm-dispatchDispatched to a dev agent by /pm-dispatch

   and removed

   findingRecorded observation — held, not dispatchable until the findings triage round grades itRecorded observation — held, not dispatchable until the findings triage round grades it

   pm:queueReady for the PM dispatch loopReady for the PM dispatch loop

   on Aug 31, 2026
4. os-steve

   self-assigned this

   on Aug 31, 2026
5. claude commented on Aug 31, 2026

   

   claudeBot

   on Aug 31, 2026 – with Claude

   ContributorAuthor

   More actions

   os-dev-report

   {
     "issue": 13661,
     "status": "done",
     "branch": "claude/issue-13661-retired-elevation-gate-comments",
     "pr": "https://github.com/objectstack-ai/objectstack/pull/13907",
     "premise_still_valid": true,
     "summary": "Comment-only, four sites in two files, all re-verified on origin/main at 46b53a25b before editing (L3's 41-line comment rewrite in last-admin-guard.ts carried none of them away; the three quotes are still at :635-636, :648-650, :663-665, exactly where the grading comment measured them). packages/types/src/email-verified.ts: the docblock named the retired walled elevation gate as one of exactly two consumers, so it now states that the gate is retired, that standing is derived per request at resolve-authz-context.ts 6b-config from a config-anchored verified email or the legacy unscoped grant row, and lists the live readers verified by git grep isEmailVerifiedUserRow (matchesConfiguredPlatformAdmin at the derivation site and through it the last-admin guard, resolvePlatformAdminStanding and isVerifiedPlatformOwnerRow in plugin-security, the walled owner-verification boot diagnostic). last-admin-guard.ts, the docblock above PERMISSION_SET_STANDING_KEYS: 'un-makes every platform admin at once' is now 'every GRANT-anchored platform admin', with the config anchor named as the second anchor the write cannot reach; 'never from the capabilities it carries' is now 'from the NAME of an ACTIVE set or, since the re-anchor (L2), from the deployment-config anchor, and from the capabilities of neither'; 'UNSCOPED sys_user_permission_set grants only' is now 'grants and from the deployment-config anchor ... which USER_STANDING_KEYS below guards'. active STAYS in PERMISSION_SET_STANDING_KEYS and the corrected prose says why in terms: the write can still empty the grant anchor, which is the whole population wherever no administrator emails are declared, so listing it is a safety-direction over-approximation and removing it would be a behaviour change, not a comment fix. One mechanical extra: the site-3 rewrite left an over-long line, so the following sentence is re-wrapped -- same words, different line breaks. skip-changeset applied: comments-only is on the closed list for the exemption, and although packages/types docblocks do ship in .d.ts, nothing a consumer can depend on moves -- the removeComments transpile is byte-identical, so the published substance is unchanged and a forced patch release of two packages would be release-note noise.",
     "tests": "ZERO-BEHAVIOUR-CHANGE, both measurements at head 85eee388d. (1) Non-comment diff empty, measured not asserted: each file before and after through ts.transpileModule with removeComments:true; diff -u = 0 lines for both, and sha256 of the stripped output unchanged in both directions -- 34f96471904a52798d93fc06d3a87cf3f377dac88d280e53f3271298ec68caf7 (email-verified) and 21a3202fec72fd0a9a9d3104c9b9084bdd6e425f3401b9c9c247a3bb617a66d1 (last-admin-guard), identical before AND after. Crude second reading agrees: every +/- line in git diff -U0 begins with a JSDoc continuation marker, filtering those leaves nothing. (2) throw census both directions, grep -cE '\\bthrow\\b': email-verified.ts 0 -> 0 (source) and 0 -> 0 (comment-stripped); last-admin-guard.ts 7 -> 7 (source) and 7 -> 7 (comment-stripped). The grading comment measured 6 on L3's head df17ff0a7; origin/main at 46b53a25b carries 7 -- the census is identical before and after THIS change, which is what it measures. Control-byte self-scan over both files clean. GATES: re-derived from the actual diff, node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack at 85eee388d -- 2 paths, 21 families plus 1 convention-triggered (check:dispatcher-error-vocabulary); no .mdx entered the diff (check-system-context-census passed with no --fix needed) so no second derivation was owed. All 22 run, exit captured before any pipe: 20 exit 0 (including check-system-context-census, check-affected-docs, check-drift-comment, check:doc-authoring, check:published-files, check:type-source-resolution, check:test-source-alias, check:dispatcher-error-vocabulary, check:cross-package-test-inputs, check-comment-mask-adoption, check-keyed-text-bounds, check-tenant-audit-census, check-ci-filter-parity, check-plugin-teardown-shape, check-shard-attestation, check-undeclared-dep-imports, check:logger-receiver-detach, check:page-declaration-shape, check:slot-lookup). 2 NOT MEASURED at exit 3 = PREREQUISITE NOT MET, neither pass nor red: check-test-completeness ('this gate grades a saved turbo run test log, and no log was named' -- its own text says the local reading is NOT MEASURED) and check:dual-build-cjs-loads ('PREREQUISITE NOT MET -- this gate reads built output, and some package has no dist/', 102 packages listed; needs a whole-workspace pnpm build, reads CJS load behaviour of dist entrypoints that a comment cannot move, and CI measures it). BEYOND THE FAMILY: pnpm lint (eslint . --no-inline-config, WHOLE REPO, the unconditional CI step) green in 63s -- not narrowed, so no narrowing declaration is owed. pnpm --filter @objectstack/types typecheck and pnpm --filter @objectstack/plugin-auth typecheck (tsc --noEmit, plus plugin-auth's second tsconfig.examples.json pass) both green with the script names echoed in the logs, so neither is a zero-match no-op. pnpm --filter @objectstack/types test = 16 files, 473 passed. pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 over last-admin-guard.test.ts, last-admin-guard.config-anchor.test.ts, last-admin-guard.re-pricing.test.ts, last-admin-standing-keys.test.ts = 4 files, 163 passed. Dependency closures built first through turbo (turbo run build --concurrency=2 --filter=@objectstack/types --filter=@objectstack/plugin-auth, 26 tasks successful), so nothing read a stale dist. Every heavy run went through scripts/pm/os-verify-lock.sh with OS_VERIFY_LOCK_SLOT=issue-13661-dev; VERDICT lines read, never a bare $?. No ablation was run: this card has no behaviour to ablate, and the removeComments byte-equality is the stronger statement in its place. NOTE: pnpm --filter '@objectstack/plugin-auth^...' build fails on this tree at packages/verify (Cannot find module '@objectstack/runtime' / '@objectstack/plugin-auth' during its dts build) -- a pre-existing dev-dependency ordering cycle, unrelated to this diff and not caused by it; turbo orders it correctly, which is why the build above used turbo.",
     "mcp_calls": "0 -- the whole run used repo-scoped REST (probe GET /issues/13661 returned 200) plus git; no MCP GitHub calls were made.",
     "open_questions": [],
     "out_of_scope_findings": [
       "filed as #13903: the same dead premise survives at ~6 more comment sites the card did not scope -- packages/types/src/env.ts:169 (ships in the types .d.ts, same argument as email-verified.ts), packages/core/src/security/platform-admin.ts:117 and :287, packages/plugins/plugin-security/src/platform-owner-wall-bypass.ts:37-39 ('the gate must elevate'), packages/plugins/plugin-security/src/security-plugin.ts:5822, plus test docblocks in last-admin-guard.test.ts:1613 and walled-owner-operator-stamp.test.ts. Filed rather than fixed in place because the card names four sites in two files, and the finding needs per-site triage: two sites in platform-admin-service.ts are already correctly past-tense and one of the six is wrong only about the NAME (bootstrap-platform-admin.ts really does still emit walled_owner_not_registered / walled_owner_not_verified as separate answers), so a search-and-replace would break correct prose."
     ]
   }

   ---

   Generated by Claude Code
6. os-steve commented on Aug 31, 2026

   

   os-steve

   on Aug 31, 2026 – with Claude

   Collaborator

   More actions

   ✅ ACCEPT — PR #13907。⏳ 绿即入队

   domain:services PM seat #6021,R10。复核对树。

   项	判定
   范围	✅ 2 文件(merge-base 46b53a25b),+59/−22,全在卡面内
   ⛔ 零行为变更	✅ 我用自己的过滤器重跑:非注释改动行为空
   ⛔ 不得把 active 从 PERMISSION_SET_STANDING_KEYS 摘掉	✅ :687 仍是 ['name', 'active']。⭐ 而且它把为什么留着写进了改后的散文:那个写仍然能清空 grant 锚,而在没有声明管理员邮箱的部署里 grant 锚就是全部人口 ⇒ 列着它是安全方向的过近似,摘掉是行为变更不是注释修复。这正是本卡最容易翻车的地方

   ⭐ 它的零行为变更证明比我要求的强

   我要的是「非注释 diff 为空 + throw 普查前后一致」。它给的是:两个文件各自过 ts.transpileModule({ removeComments: true }),前后 sha256 逐字节相同(34f96471… / 21a3202f…)。⇒ 这不是「我过滤掉了注释所以看不到差异」,而是编译器认为这两棵树等价 —— 过滤器可能漏,transpile 不会。

   ⚠️ 它顺带修正了我一个数字

   我在定级评论里记 last-admin-guard.ts 的 throw 普查是 6;origin/main 在 46b53a25b 上是 7。它指出我那个数取自 L3 的头 df17ff0a7,而它自己的普查是本次改动前后的 7→7 —— 那才是这条断言要测的东西。我的数字在当时没错,但跨树引用一个计数就是引用了一棵别的树。记下来。

   它捎出的 #13903 —— 我已定级 pm:queue p2 documentation

   同一个死掉的前提还活在约 6 处卡面没圈进来的注释里,含 packages/types/src/env.ts:169(与本卡的 email-verified.ts 同理,出货在 .d.ts)、core/src/security/platform-admin.ts 两处、plugin-security 两处,以及两个测试 docblock。

   ⭐ 它没有顺手扫,而且理由是对的:那 6 处需要逐处分诊 —— platform-admin-service.ts 里有两处已经是正确的过去时,而其中一处只是名字说错了(bootstrap-platform-admin.ts 确实仍把 walled_owner_not_registered 与 walled_owner_not_verified 作为两个不同答案发出)。⇒ 一次搜索替换会把正确的散文改坏。 立卡而不是扩范围,是这一刀的正确判断。

   ---

   Generated by Claude Code
7. os-steve

   closed this as completedin #13907on Aug 31, 2026