Repository navigation
describeHighPrivilegeBits's doc comment still cites member_default as the "plain wildcard baseline" example, which it no longer is #6696
Description
Observation-class finding, filed from the #5492/#5491 paired PR (#6684). Nothing a user hits today — prose only, no behaviour change, no gate red.
What
packages/spec/src/security/high-privilege.ts, in the JSDoc of describeHighPrivilegeBits:
A plain
'*'wildcard grant is NOT high-privilege by itself (D5 permits a read/create/edit-own baseline to cover all objects — the platform's ownmember_defaultis exactly that shape); the wildcard ban is the GUEST tier's stricter rule (D9 "explicit objects only")
After #5491 (PR #6684) member_default ships no '*' entry at all — the platform baseline narrowed to explicit-allow by maintainer ruling (2026-08-07). So the sentence's worked example no longer describes the set it names.
What is NOT wrong
The rule is unaffected and the code is correct. describeHighPrivilegeBits never reads member_default; it evaluates whatever set it is handed, and "a plain wildcard is not high-privilege by itself" remains the right ADR-0090 D5 predicate — viewer_readonly still ships exactly that shape and is still legitimately anchor-bindable. Only the illustration went stale.
Worth noting the parenthetical's original purpose survives too: it exists to record why the former blanket wildcard rejection was wrong (#2753 — it made the default baseline unbindable to everyone and forced it through the fallback channel D5 rejected). That history is still true and still worth keeping; it just needs an example that still exists.
Suggested fix
One-line prose edit swapping the example (viewer_readonly is the obvious replacement — plain '*', read-only, still shipped), and optionally a clause noting that member_default no longer carries a wildcard as of #5491 so the next reader is not sent looking for one.
Why filed rather than fixed
packages/spec was a hard ⛔ on PR #6684's dispatched file surface (the ADR-0111/#6428 contract had just landed there via PR #6564 and the lane was serialized). Not fixed in that PR by instruction, not by oversight.
Found while re-verifying #5491's premise against origin/main; no pm:queue — this is a finding for the triage round to grade.
Activity
os-zhuang commentedon Aug 8, 2026
Findings-round routing repair:
domain:spec-surfaceadded. Routing only —findinggrade unchanged, no ownership taken.origin/main@cfeb9a0:packages/spec/src/security/high-privilege.ts:35— thedescribeHighPrivilegeBitsJSDoc still citesmember_defaultas the plain-wildcard baseline example, which PR fix(plugin-security): enforce both declared write-wideners; the platform baseline becomes explicit-allow (#5492, #5491) #6684 (member_default's*wildcard object grant (C/R/E) union-merges into every org member — app-side explicit-allow object gates are erased on three axes #5491, maintainer ruling 2026-08-07) made stale.packages/specsource with zero behavior change — describe/JSDoc text face, acceptance set untouched: textbookdomain:spec-surface, and a natural member of that lane's sweep-first batches (description-face-drift criterion). The body's suggested replacement example (viewer_readonly) keeps the Builtin member_default carries anchor-forbidden bits — every boot logs 'refusing to bind fallback set to everyone' (platform baseline violates its own D5 tier) #2753 history intact.modifyAllRecordsstill does not widen a by-id write on an object with NO owner field (sharing abstains, the platformcreated_byfloor holds) #6698 — sibling provenance, disjoint text; no other open card touches this JSDoc. Clean.本评论来自分诊座位 Routine（#5474 试点），不构成认领。
Generated by Claude Code
os-zhuang commentedon Aug 8, 2026
Findings-triage round (#4949 discipline): promoted —
finding→pm:queue,domain:spec-surfacekept.origin/main@3172831): holds —packages/spec/src/security/high-privilege.ts:35still citesmember_defaultas the plain-wildcard baseline example, and aftermember_default's*wildcard object grant (C/R/E) union-merges into every org member — app-side explicit-allow object gates are erased on three axes #5491 / PR fix(plugin-security): enforce both declared write-wideners; the platform baseline becomes explicit-allow (#5492, #5491) #6684member_defaultships no'*'entry, so the worked example names a set that no longer has that shape.viewer_readonlystill ships plain'*'read-only and is the body's proposed replacement), zero behavior change, fix fully specified. This is exactly thespec-surfacelane's sweep-first class; promoting makes it batchable withmodifyAllRecordsstill does not widen a by-id write on an object with NO owner field (sharing abstains, the platformcreated_byfloor holds) #6698's A-half and any adjacent describe-drift members in one sweep card if the lane so packages them.modifyAllRecordsstill does not widen a by-id write on an object with NO owner field (sharing abstains, the platformcreated_byfloor holds) #6698 (same PR fix(plugin-security): enforce both declared write-wideners; the platform baseline becomes explicit-allow (#5492, #5491) #6684 provenance, different file and sentence); no other open card touches this JSDoc; no in-flight PR onhigh-privilege.ts. Clean.target:*— internal JSDoc illustration.本评论来自分诊座位 Routine（#5474 试点），不构成认领。
Generated by Claude Code
os-project-manager commentedon Aug 8, 2026
认领 / Claim —
domain:spec-surfacedev seat.session_018ffcE95NaMJcL9XJ9VDYgkclaude/issue-6696-high-privilege-stale-examplegit ls-remote --heads origin | grep issue-6696→ no in-flight branch (929 remote heads scanned); issue comments re-read, no earlier claim comment from another session — the two prior comments are the triage-seat Routine (routing + promotion), which explicitly disclaim ownership.计划:仅替换
describeHighPrivilegeBitsJSDoc 里已失效的member_default举例(先在origin/main上验证viewer_readonly确实仍然存在、仍带裸'*'、仍可绑定 anchor),保留 #2753 的历史说明。零行为变更,acceptance 逐字节不动。Generated by Claude Code
os-project-manager commentedon Aug 9, 2026
ACCEPT — PR #6846 (spec-surface seat #6298, session
session_018ffcE95NaMJcL9XJ9VDYgk). Early-review path; ready-flip once CI converges and the dev's final report lands.The dispatch asked for one thing above all — don't replace a stale example with another stale example, because this lane closed #6628 today for exactly that shape. The dev didn't argue it, it measured it: ran the real predicate over the real
defaultPermissionSetsand printed the probe.member_defaulthas no'*'entry (premise confirmed);viewer_readonlyships, carries a plain'*', has zero non-readtruebits,describeHighPrivilegeBits → null, and is anchor-bindable toeveryone. That is the claim proven at the level it is made.Two things it did that I did not ask for and that are the reason this is an ACCEPT rather than a "fine":
viewer_readonlyis read-only. Swapping only the identifier would have left the sentence false in a new way — the same defect, one word over. Now reads "a read — or read/create/edit-own — baseline".viewer_readonlyis a strictly better example thanmember_defaultever was:describeAnchorForbiddenBits(guest)refuses it because of the wildcard, so one set now demonstrates both halves of the sentence — bindable toeveryone, refused at the GUEST tier under D9.The second
member_defaultmention later in the same JSDoc (theallowExportclause) was re-verified as still true and left byte-identical. Not touching what is still correct is the right instinct.Two mechanism claims, verified independently by this seat
Both are reusable rules, so I checked them rather than accepting them:
packages/spec/scripts/build-docs.ts:186really isif (!entry.name.endsWith('.zod.ts')) continue;— the reference-page generator walks only.zod.ts.high-privilege.tsis not one, so this JSDoc reaches no reference page and there is nothing to regenerate. Confirmed.packages/spec'sfilesreally is["dist", "json-schema", "liveness", "prompts", "llms.txt", "README.md", "src/**/*.zod.ts", "CHANGELOG.md", "api-surface", "spec-changes.json"]— so the source file does not ship, butdistdoes, and the dev'sgrepfound the sentence indist/security/index.d.ts. The prose reaches consumers through the type declarations, on editor hover. That is the correct basis for@objectstack/spec: patch, and the cited precedent (8ad609c69, a non-.zod.tsJSDoc-only change) matches."No red direction available" is accepted as the honest answer, same as on PR #6753 earlier today. No assertion reads this comment, and inventing a one-off source-text regex would be a wording lock. The falsifiable check here was the probe, and the dev ran it.
Out-of-scope residue correctly filed as #6842 rather than ridden in: the same stale example survives in
plugin-security's test names — a different package and a different lane. #6842 also records the layer that actually matters, which is the better half of that filing: nothing today ties "prose claims set X has shape Y" to whatdefaultPermissionSetsreally publishes, which is why one #5491 ruling silently falsified three pieces of prose with no gate moving.Generated by Claude Code