auth follow-ups of #30922: an org admin cannot read the judged client address before saving an IP list, and the console MFA notices over sys_organization.require_mfa are inert #31030

Activity

1. objectstack-fleet

   added

   enhancementNew feature or requestNew feature or request

   priority:p2Medium: important, M3Medium: important, M3

   repo:cloudCard routed whole to the cloud PM: needs cloud code, a producer or a fact (cloud owns it to closure)Card routed whole to the cloud PM: needs cloud code, a producer or a fact (cloud owns it to closure)

   pm:blockedBlocked by another issue/PR — body carries Blocked-by: #NBlocked by another issue/PR — body carries Blocked-by: #N

   domain:serverDomain lane — seat card indexed by label:pm:seatDomain lane — seat card indexed by label:pm:seat

   priority:p1High: required for production / M2High: required for production / M2

   and removed

   priority:p2Medium: important, M3Medium: important, M3

   on Nov 6, 2026
2. objectstack-fleet commented on Nov 6, 2026

   

   objectstack-fleetBot

   on Nov 6, 2026

   ContributorAuthor

   More actions

   triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

   Path: none

   Triage: audit · p2 → p1 · domain:server · pm:blocked · 2026-11-06T18:58Z

   ⛔ Not a claim.

   • Follow-ups of Access policy per organization: allowed IP ranges, session idle/absolute/concurrent limits and an MFA requirement of off / administrators / everyone, with the deployment value as default and floor #30922 from PR feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013's contract review: S7 is an org-admin read of the judged client address, gated by setup.write; S6 removes or re-points the inert require_mfa console notices.
   • Raised to p1: S7 is a new served read (「协议新增定 p1」), on the Enterprise access-policy work the maintainer prioritized. Lane domain:server (S6 touches ui/packages/app-shell; the seat posts a cross-seat note for it).
   • Blocked-by: Access policy per organization: allowed IP ranges, session idle/absolute/concurrent limits and an MFA requirement of off / administrators / everyone, with the deployment value as default and floor #30922
   • The card's "after objectstack#31013 lands" had no Blocked-by: line; PR feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013 fixes Access policy per organization: allowed IP ranges, session idle/absolute/concurrent limits and an MFA requirement of off / administrators / everyone, with the deployment value as default and floor #30922.
   • ⚠️ S7 returns the caller's own judged address only, never another member's.

   ---

   Generated by Claude Code
3. objectstack-fleet commented on Nov 7, 2026

   

   objectstack-fleetBot

   on Nov 7, 2026

   ContributorAuthor

   More actions

   repo:cloud#3 · hotlong · session_01Q4EjjRhUZjdy8VXs6Kkur2

   Carried from objectstack#31013's delta contract review 6695328434 (should-fix) · 2026-11-07T00:49Z

   • D1: ip_not_allowed is a new sys_session.revoke_reason value. Add it to the field description's published vocabulary in sys-session.object.ts, which calls itself the only contract a consumer can read.
   • D2: "no heartbeat before the switch judgement" is pinned only by calling hooks.session.update.before. Pin it through the real /organization/set-active route as well; if better-auth's session middleware ever ran customSession first, the switch idle rule would be silently defeated.
4. objectstack-fleet commented on Nov 7, 2026

   

   objectstack-fleetBot

   on Nov 7, 2026

   ContributorAuthor

   More actions

   repo:cloud#3 · hotlong · session_01Q4EjjRhUZjdy8VXs6Kkur2

   Carried from objectstack#31013's delta review 6702665651 (D3, should-fix) · 2026-11-07T05:14Z · The organization IP list is re-judged on a session read only when ctx.request is present: the better-auth-served door (auth-manager-plugin-list.ts, whose door comes from readRequestClientAddress()). An objectstack-mount route that reads the session in-process (gateAdmin at auth-plugin.ts:3731, plus main's six new routes) judges the organization's limits but not its list. The deployment list still gates them. Either pass the mount's established address as door, or narrow the sentence in the PR body, the manifest and the changeset.
5. objectstack-fleet

   added

   pm:queueReady for the PM dispatch loopReady for the PM dispatch loop

   and removed

   repo:cloudCard routed whole to the cloud PM: needs cloud code, a producer or a fact (cloud owns it to closure)Card routed whole to the cloud PM: needs cloud code, a producer or a fact (cloud owns it to closure)

   pm:blockedBlocked by another issue/PR — body carries Blocked-by: #NBlocked by another issue/PR — body carries Blocked-by: #N

   on Nov 7, 2026
6. objectstack-fleet commented on Nov 7, 2026

   

   objectstack-fleetBot

   on Nov 7, 2026

   ContributorAuthor

   More actions

   triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

   Path: none

   Triage: unblock · pm:blocked → pm:queue · 2026-11-07T16:16Z

   ⛔ Not a claim.

   • Every Blocked-by: target is closed, re-read now: Access policy per organization: allowed IP ranges, session idle/absolute/concurrent limits and an MFA requirement of off / administrators / everyone, with the deployment value as default and floor #30922 (closed completed 2026-11-07T13:45Z).
   • Grade and lane are kept. The unlock sweep had not returned this card, because the line sits in a comment.

   ---

   Generated by Claude Code
7. objectstack-fleet commented on Nov 7, 2026

   

   objectstack-fleetBot

   on Nov 7, 2026

   ContributorAuthor

   More actions

   domain:server#6 · os-project-manager · session_01FEkQ5p3T5YWhLjurajudnQ

   Claim: PM loop round 1 · 2026-11-07T17:19Z · seat 6's pick in the A/B server split (B = the plugin-auth cluster)
   Session: session_01FEkQ5p3T5YWhLjurajudnQ
   Account: os-project-manager (the seat's linked user; the card's assignee)
   Branch: claude/project-thread-em08na
   Worktree: the card thread's own checkout of claude/project-thread-em08na
   Domain: domain:server
   Seat: domain:server#6
   File surface: packages/plugins/plugin-auth/src/ (a new org-admin client-address read + route ledger/mount, auth-plugin.ts gateAdmin / in-process session door region, the /organization/set-active pin, + tests); packages/platform-objects/src/identity/sys-session.object.ts (description vocabulary only); ui/packages/app-shell/src/console/organizationMfaNotices.ts, AppContent.tsx notice call and its i18n strings; docs sentences on the read; root .changeset/. ⛔ packages/spec/**, skills/** (stop on breach; explain in the report)
   Container & model: M, mode:thread, model: default, effort: xhigh (p1)
   Clause-②: yes (widening) (a new served read; the console string removal measured and declared by the dev)
   Metadata-protocol: none
   Responsibility: n/a — not a defect card (should-fixes carried from PR #31013 contract reviews 6692495550 / 6695328434 / 6702665651)
   Thread-read: 6709681591
   Premise: holds per triage unblock 6709681591 (#30922 closed); D1–D3 are re-checked against b5696b49 by the dev (work-item face) and reported done-or-not
   Serial constraints cleared: same-seat parallel #30924 (auth-plugin.ts sign-in IP gate region, disjoint function); ui/**: ui seat 1 #30974 in flight, the dev reads its claim surface before touching AppContent.tsx; second to land merges origin/main once
8. objectstack-fleet

   added

   pm:dispatchedDispatched to a dev agent by /pm-dispatchDispatched to a dev agent by /pm-dispatch

   and removed

   pm:queueReady for the PM dispatch loopReady for the PM dispatch loop

   on Nov 7, 2026
9. objectstack-fleet

   assigned

   os-project-manager

   on Nov 7, 2026
10. objectstack-fleet commented on Nov 7, 2026

    

    objectstack-fleetBot

    on Nov 7, 2026

    ContributorAuthor

    More actions

    domain:server#6 · os-project-manager · session_01FEkQ5p3T5YWhLjurajudnQ

    Claim amendment · 2026-11-07T17:32Z · claim 6710570984 · the declaration, measured by the dev

    Clause-②: yes (narrowing)
    Metadata-protocol: none

    The claim said Clause-②: yes (widening). The diff widens (a new served read, GET /api/v1/auth/client-address) and narrows: S6 is removed under the seat's ruling (no reader that a notice would serve), which deletes console.organizationMfa.needsTwoFactor and console.organizationMfa.nowRequired from all 11 locale bundles of the published @object-ui/i18n. Precedent: .changeset/30206-first-run-checklist.md declared the same kind of key removal yes (narrowing). Consequences: the PR title carries !, the full dogfood battery runs on the final head, and a CONTRACT_REVIEW_TIER review on that head is owed before landing; the seat runs it. Everything else in the claim stands.