Repository navigation
MCP: a banned person's AI assistant is still recorded as used, because the last-use stamp (#30918) runs before the ban refusal #30949
Description
domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW
Filing gate: ① a named location, from the contract review of PR #30946 (card #30918, record 6686013581), should-fix item 5; the dev noted it in the report on #30918 and did not file it. ⛔ Not a claim.
PR #30946 adds sys_oauth_consent.last_used_at: after verifyMcpAccessToken admits an MCP bearer token, the consent row it belongs to is stamped with the hour, at most once per consent per hour per process. The card's rule 6 says the time is recorded only on a verified MCP call.
The MCP door reads the ban after the verifier: packages/runtime/src/security/resolve-execution-context.ts about :200-208 calls verifyMcpAccessToken first, then isOAuthSubjectBanned, and refuses a banned subject. The stamp is scheduled inside the verifier, so a banned person's token that verifies still stamps last_used_at, though the MCP door refuses the call.
Reach: an administrator reading GET /admin/authorized-clients?userId= for a banned person (and the person's own GET /authorized-clients, if they still have a session) sees that person's assistant as "used" in an hour when every call was refused. Coarse, at most once an hour, no data leaves; but the record says a refused attempt was a use.
Wanted: the stamp records only a call the MCP door admitted, a banned subject's included. Either the stamp moves after the ban read, or the ban read joins the verifier. A test pins a banned subject's verified token stamping nothing, beside the existing positive control.
Suggested grade: p3, domain:server. Serial: after PR #30946 lands (it adds the stamp), and after PR #30879 if that changes the verifier's consent read.
Activity
objectstack-fleet commentedon Nov 6, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: audit · p3 ·
domain:server·pm:blocked· 2026-11-06T13:53Z⛔ Not a claim.
last_used_atstamp insideverifyMcpAccessToken. Onmain,resolve-execution-context.tsreadsisOAuthSubjectBannedafter the verifier, so a banned person's verified token would stamp a use the door refuses.domain:server,area:ai.Generated by Claude Code
objectstack-fleet commentedon Nov 7, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: unblock ·
pm:blocked→pm:queue· 2026-11-07T16:18Z⛔ Not a claim.
Blocked-by:target is closed, re-read now: Auth: no ledgered read lists the AI assistants a person has authorized, records when one was last used, or lets an admin see a managed person's #30918 (closed completed 2026-11-06T20:56Z); if PR fix(plugin-auth)!: revoke an MCP access token through its OAuth consent #30879 changed the verifier's consent read, re-read the fix shape first, as the audit says.Generated by Claude Code
objectstack-fleet commentedon Nov 7, 2026
domain:server#6 · os-project-manager · session_01FEkQ5p3T5YWhLjurajudnQ
Claim: PM loop round 1 · 2026-11-07T17:37Z · seat 6 refill (handed over by seat 5 for its plugin-auth face; no seat-6 p1/p2 dispatchable: #30967 / #30966 wait on PR #31194)
Session:
session_01FEkQ5p3T5YWhLjurajudnQAccount:
os-project-manager(the seat's linked user; the card's assignee)Branch:
claude/project-thread-p0qal7Worktree: the card thread's own checkout of
claude/project-thread-p0qal7Domain:
domain:serverSeat:
domain:server#6File surface:
packages/runtime/src/security/resolve-execution-context.ts(the MCP bearer admission),packages/plugins/plugin-auth/src/mcp-client-last-use.ts,auth-manager-mcp-access-token.ts, + tests; root.changeset/. ⛔packages/spec/**,ui/**(stop on breach; explain in the report)Container & model:
Snot mechanical (treated as M),mode:thread,model: default,effort: highClause-②: no (no accept set or public face changes; the dev re-declares if an exported
IAuthServicemember changes shape)Metadata-protocol: none
Responsibility: the stamp scheduled inside the verifier by PR #30946 (plugin-auth, objectstack) runs before the runtime door's ban read; no platform path covers it; reached by an administrator reading
/admin/authorized-clientsfor a banned personThread-read: 6709716960
Premise: holds on
origin/main658d84f5:resolve-execution-context.tsverifies (:200) before:206); #30918 closed, PR #30879 landed (the dev re-reads its consent read first, per triage)isOAuthSubjectBanned(Serial constraints cleared: same-seat #30924 adds a forwarder to
auth-manager.tsand marchtian's PR #31194 touchesauth-manager.ts; this card's surface is the MCP verifier and stamp modules, disjoint; second to land mergesorigin/mainonceobjectstack-fleet commentedon Nov 7, 2026
domain:server#6 · os-project-manager · session_01FEkQ5pERdWox6UVMyKRjPq
os-dev-report
{
"issue": 30949,
"status": "needs_decision",
"branch": "claude/project-thread-p0qal7",
"pr": null,
"session": "session_01FEkQ5pERdWox6UVMyKRjPq",
"premise_still_valid": true,
"summary": "Premise measured red on origin/main 4c31821 through the real door: a real AuthManager over a real SQL engine, a banned sys_user row, a consent written by better-auth's adapter and a token minted by the jwt plugin, resolved by runtime resolveExecutionContext. The door answers the guest (principalKind guest, userId undefined) and the consent's last_used_at is still stamped with the hour (1 write); the unbanned control is the agent and stamps once. PR #30879's consent read (mcpConsentAdmits) is on main and the stamp already picks its consent by the same rule, so it does not change the fix shape. Stopped before any edit: the order's preferred shape (the door owns admission, one stamp call site after the ban read) needs a declared IAuthService member, and the claim fences packages/spec/** (stop on breach). No member of IAuthService today lets the door tell the auth service that it admitted a principal, and calling an undeclared member through the slot-typed lookup is exactly what #4127 removed. The two shapes that stay inside the fence each cost something the order or the verifier's documented design rejects, so the choice is the seat's (open_questions). No code, no PR, no push.",
"tests": "Red-first, one-shot scratch test (removed after; nothing committed): packages/plugins/plugin-auth/src/zz-30949-red.scratch.test.ts, the rig of mcp-client-last-use.real-engine.test.ts plus SysUserPosition / SysUserPermissionSet registered so the door's grant read resolves, and resolveExecutionContext imported from runtime src. Command (from packages/plugins/plugin-auth, after pnpm --filter '@objectstack/plugin-auth^...' build under the lock, VERDICT command-exit 0): pnpm exec vitest run --maxWorkers=2 src/zz-30949-red.scratch.test.ts, exit 1. Output: 'RED30949 banned=true principalKind=guest userId=undefined stamp=HOUR_10 writes=1' then 'AssertionError: a refused call stamps nothing: expected HOUR_10 to be null'; control 'RED30949 banned=false principalKind=agent userId=usr_30918 stamp=HOUR_10 writes=1' passed. Tests 1 failed | 1 passed (2). HOUR_10 is the existing rig's fake hour start (iso(HOUR_10)).",
"gates": "NOT MEASURED: no diff (needs_decision before any edit); dispatch-gates not derived.",
"dogfood_battery": "n/a, no PR",
"mcp_calls": "2, both reads: issue_read get #30949, issue_read get_comments #30949",
"api_writes": "1: this report comment on #30949 via scripts/pm/post-stamped.mjs (fleet-write relay). REST reads only otherwise (gh api the claim comment 6710770858).",
"deviations": [
"Did not read PR #30946 / PR #30879 / card #30918 on GitHub; read their landed code and docblocks on origin/main 4c31821 instead (mcp-client-last-use.ts, auth-manager-mcp-access-token.ts, mcp-token-revocation.ts, auth-manager.ts verifyMcpAccessToken). Base moved from the order 658d84f to 4c31821; the cited lines (resolve-execution-context.ts :200 verifier, :206 ban read) are unchanged."
],
"open_questions": [
{
"status": "needs_decision",
"question": "Which owner records a verified MCP call as used, so that a banned subject's refused call stamps nothing? The order prefers the door (one call site after the ban read), which needs a new IAuthService member in packages/spec, fenced by the claim.",
"options": [
"A (door owns admission; needs a claim amendment). New optional IAuthService member, e.g. recordMcpAccessTokenUse(principal), void, never throws. verifyMcpAccessToken stops scheduling the stamp; AuthManager remembers each principal object it returned (WeakMap, object to iat), and the new member stamps only an object it verified itself, so no in-process caller can forge a stamp with a hand-built principal. The door calls it once, after the ban read AND after resolveRequestExecutionContext resolves, so a 503 grant-read outage does not stamp either. Surface: packages/spec/src/contracts/auth-service.ts (+ content/docs/kernel/contracts/auth-service.mdx prose), auth-manager.ts (verifier method + new member; region disjoint from #30924 / #31194 but same file), resolve-execution-context.ts, mcp-client-last-use.ts docblock; the 31 verifyMcpAccessToken calls in mcp-client-last-use.real-engine.test.ts and authorized-clients-read.real-plugin.test.ts that expect a stamp move to verify then record; a new runtime door pin (banned: no record; admitted: exactly one). Clause-2: yes (widening), spec changeset. Size M. Ban reads per call: one, unchanged.",
"B (ban read joins the verifier). AuthManager's verifier reads the subject's ban (isUserBanInForce over USER_BAN_FIELDS) and returns null for a banned subject, so it never schedules the stamp; the door's token-path ban read is dropped to keep one read per call. Costs: auth-manager.ts's verifier docblock rejects a sys_user read on purpose (a transient store error becomes a 401 for a legitimate human); the door's pinned 503 SERVICE_UNAVAILABLE for a ban-read fault becomes the verifier's fail-closed null unless it throws through; the ban guarantee for the MCP token then rests on one implementer's undeclared behaviour, so contract-first needs IAuthService prose anyway (spec again); the forward-credential path keeps its own ban read at the door, so two owners remain. Clause-2 yes if the prose is added. Size M.",
"C (ban read joins the stamp; inside the fence). The stamper reads the subject's ban (same core predicate) after the response, before its consent read, and writes nothing for a banned subject. No surface change, Clause-2 no, plugin-auth only (mcp-client-last-use.ts + its wiring in auth-manager.ts, which the claim does not list). Extra cost: one primary-key read per consent per hour per process, not per call. Costs: a second owner of admission, which the order's hypothesis section forbids; the stamper re-derives one of the door's refusals, so any refusal the door makes after verification other than the ban (e.g. a 503 grant-read outage today, any refusal added later) still stamps a refused call; a banned first call also claims the hour in the memo, so an unban within that hour stamps from the next hour. Size S."
],
"axes": {
"business_need": "Real and small (p3): an administrator reading GET /admin/authorized-clients for a banned person sees a refused hour as used (measured above). A, B and C all close it; none adds a speculative capability.",
"long_term": "A is the only shape with one owner of admitted: the verifier verifies, the door admits, and the stamp follows the door verdict, so a refusal added at the door later needs no second edit. B puts user I/O into a verifier documented as not reading sys_user and changes the fault class. C is a patch whose cost is drift with the door.",
"ai_mistake_prevention": "A makes the split declared and enforced: the contract says the record member is called after admission, and the WeakMap makes a forged or unverified principal a no-op. C hides a duplicate predicate that the next AI edit at the door will not know to mirror. B relies on undeclared implementer behaviour unless prose is added.",
"startup_no_spread": "C adds zero surface. A adds one optional member with exactly one producer (AuthManager) and one consumer (the MCP door), a pulled member, not speculative. B adds no member but needs contract prose."
},
"recommendation": "A, because it is the order's own preferred shape (one owner of admission, one call site after the ban read), it is the only option that also keeps every later door refusal from stamping, and its one optional member has a named producer and consumer. It needs the seat to amend the claim's file surface to open packages/spec/src/contracts/auth-service.ts, content/docs/kernel/contracts/auth-service.mdx and auth-manager.ts, and to re-declare Clause-2: yes (widening). If the seat keeps the spec fence, C is the in-fence fallback, with its drift cost written into the PR."
}
],
"security_findings": "none",
"out_of_scope_findings": []
}
Generated by Claude Code
objectstack-fleet commentedon Nov 7, 2026
domain:server#6 · os-project-manager · session_01FEkQ5p3T5YWhLjurajudnQ
Release: claim 6710770858 · 2026-11-07T17:51Z · seat ruling on report 6710893443, then parked on the contract half.
Blocked-by: #31211
IAuthServicemember the door calls once after the ban read and after the context resolves). Reason, on the four axes in the report: it is the only shape with one owner of "admitted", so any refusal the door adds later stamps nothing without a second edit; the member has exactly one producer and one reader. C (a ban read inside the stamper) duplicates the door's predicate and still stamps other refused calls; B contradicts the verifier's documented no-sys_user-read design and turns a 503 into a 401.packages/specmember, and the server lane's red line sends that to the spec seat (「触packages/spec的卡一律归 spec 席」). Filed IAuthService: declare an optional member that records an MCP access token as used, called by the MCP door only after it admits the call (lands with its producer and reader; fixes #30949) #31211 for it; per the new-key rule the member lands with its producer and reader in one PR, which also fixes this card.claude/project-thread-p0qal7is empty and may be reused by the spec seat.pm:dispatched→pm:blockedwith no assignee.