plugin-security: delegation probes and diagnostics (canReadObject / canWriteObject / canExport, field mask, explain) answer for an on-behalf-of context the operation prologue now refuses (PR #25101) #25107

Activity

1. objectstack-fleet

   added

   area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guardsPermissions that actually hold — RLS/FLS, sharing model, write-path guards

   bugSomething isn't workingSomething isn't working

   domain:servicesRetired 2026-10-22, alias of domain:server (services surface); in-flight cards keep it until landedRetired 2026-10-22, alias of domain:server (services surface); in-flight cards keep it until landed

   pm:queue

   priority:p3

   on Oct 21, 2026
2. objectstack-fleet commented on Oct 22, 2026

   

   objectstack-fleetBot

   on Oct 22, 2026

   ContributorAuthor

   More actions

   Claim: card thread · domain:services seat 1 (seat post #6021, project run by the Sales account) · p3 · area:access · the whole card · 2026-10-22T19:03Z
   Session: session_01DPxprKQnzCbhdMTXUGRu31
   Account: os-sales (the seat's linked user; the card's assignee)
   Branch: claude/project-thread-a7kyo3 (the harness-pinned branch for this session; it names no issue, so the Duplicate Fix Guard's branch-name hint will not match — this claim is the identity record)
   Worktree: objectstack-issue-25107
   Domain: domain:services
   Seat: domain:services#1 (seat post #6021)
   File surface (read on origin/main cc8d886d4; stop on a breach and explain it in the report):

   • packages/plugins/plugin-security/src/explain-engine.ts: one exported helper beside resolveDelegatorContext that asks vetOrganizationClaim once with the prologue's inputs (the live organization, the delegator's own memberships, the posture); the explain engine's delegated path in explainOnce asks it and fails closed as it does for a missing delegator; ExplainEngineDeps gains a required tenancyPosture member (the module's own rule for a dep whose omission would misreport, as getPartialMaskRules is required); the resolveDelegatorContext docblock's "same org" sentence points at the prologue check.
   • packages/plugins/plugin-security/src/security-plugin.ts: the seven sites the card names (canReadObject, canWriteObject, canExport, resolveProjectionFieldMask behind getReadableFields and its siblings, describeDelegationNarrowing, delegatedWriteContexts, and the explain deps wiring) ask the helper at the prologue's point; the prologue (resolveOperationPrincipals) and computeDelegatedReadFilter are rerouted through the same helper with byte-identical behaviour, so the rule has one ask in the plugin.
   • Tests: new cases per path in delegated-organization-membership.test.ts (the rule's file); the test files that build ExplainEngineDeps by hand gain the tenancyPosture line.
   • One patch changeset for @objectstack/plugin-security.
   • ⛔ Not packages/core, packages/spec, plugin-sharing or any other plugin.
     Container & model: M, card thread (in-session executor), model: default tier (dispatch-gates.mjs --tier on this surface: "no path-derived mandate"), effort: xhigh (security family); a CONTRACT_REVIEW_TIER review of record before the queue (a narrowing)
     Clause-②: no (narrowing)
     Metadata-protocol: none
     Basis for the Clause-② line: probes and diagnostics that answered an admission for a context the operation prologue refuses now answer the refusal (allow to deny), aligned with the operation; nothing widens. As on plugin-security: the raw-SQL read-scope provider (getReadFilter) does not apply the delegated organization-membership rule PR #25101 enforces at the operation prologue; measure reach first (detail withheld) #25106 (PR fix(plugin-security)!: the raw-SQL read scope (getReadFilter) answers the deny sentinel where the delegated prologue refuses #25150): patch with the BREAKING banner and its ADR-0087 disposition.
     Responsibility: plugin-security's own probes, field projections and explain path resolve a delegator without the prologue's organization check | the prologue's refusal (ADR-0090 D10 via vetOrganizationClaim) already covers every operation, and #25106 mirrored it in getReadFilter | in-process callers only: the one producer of an on-behalf-of context never builds the shape (the card's reach)
     Thread-read: none
     Serial constraints cleared:
   • PR fix(plugin-security)!: under a controlled_by_parent declaration whose one master reference is readonly or system, every write that sets it is refused (ADR-0055 §1) #25256 (plugin-security: the controlled_by_parent detail write gate may not hold one more value of a master reference to ADR-0055 §1 and §3 (reach not measured; detail withheld under the disclosure ruling) #25095, open, ACCEPTed) edits security-plugin.ts in hunks near the imports and past line 8900 (the master-detail write gate); every site above is outside them, and explain-engine.ts is not in it. Whichever lands second merges main.
   • PR fix(plugin-sharing): the declared-rule organization walk ends on the rows read; ADR-0131 small carriers retire the NULL-means-global texts #25266 and PR fix(core,plugin-auth)!: the last-admin guard judges a sys_organization insert that moves the Default Organization; one Default Organization definition #25265 touch other plugin-security files (objects, translations, audience bindings), none on this surface.
   • plugin-security: the raw-SQL read-scope provider (getReadFilter) does not apply the delegated organization-membership rule PR #25101 enforces at the operation prologue; measure reach first (detail withheld) #25106 landed as PR fix(plugin-security)!: the raw-SQL read scope (getReadFilter) answers the deny sentinel where the delegated prologue refuses #25150; plugin-security: a controlled_by_parent child's read loads every readable master id with no limit (twice per request), so its CPU grows with the master table and the read answers 500 "too many SQL variables" past ~32.8k masters #24932 (the prerequisite PR fix(plugin-security): a controlled_by_parent detail's read scope is the engine's ReadableIds leaf over its master (ADR-0139 D6, seventh consumer); Q2 A in service-analytics; the Turso remote nested leaf #25198) landed 0b8bce40e0.
     Resume-from: none

   ⛔ Disclosure (#9387, 5323310017): this claim, the PR and every comment state the rule and an abstract reach only; no probe or context shape.

   ---

   Generated by Claude Code
3. objectstack-fleet

   added

   pm:dispatched

   and removed

   pm:queue

   on Oct 22, 2026
4. objectstack-fleet

   assigned

   os-sales

   on Oct 22, 2026
5. objectstack-fleet commented on Oct 22, 2026

   

   objectstack-fleetBot

   on Oct 22, 2026

   ContributorAuthor

   More actions

   os-dev-report
   {
   "issue": 25107,
   "status": "done",
   "branch": "claude/project-thread-a7kyo3",
   "pr": "#25288",
   "session": "session_01DPxprKQnzCbhdMTXUGRu31 (card thread)",
   "premise_still_valid": true,
   "summary": "One helper, delegatedOrganizationRefusal (explain-engine.ts, beside resolveDelegatorContext), asks vetOrganizationClaim once with the prologue inputs (live organization, the delegator own memberships, the posture). The prologue and computeDelegatedReadFilter now ask it (behaviour byte-identical, their 42 cells unchanged), and canReadObject, canWriteObject, canExport, resolveProjectionFieldMask (the four field projections), explainOnce, describeDelegationNarrowing and delegatedWriteContexts ask it at the prologue point, so on a walled posture each answers the refusal the operation already gets. ExplainEngineDeps gains a required tenancyPosture (wired by the plugin; the seven hand-built test deps pass single). Changeset patch with the BREAKING banner, Clause-②: no (narrowing), Metadata-protocol: none, ADR-0087 not-required (runtime-interface-only packages/plugins/plugin-security/src/explain-engine.ts#ExplainEngineDeps).",
   "tests": "Rule file delegated-organization-membership.test.ts 42 to 66 cases (refusal 10, preservation 11, parity 2, enumeration 1), 66/66. Red first (both sources at base cc8d886, new tests kept): Tests 13 failed | 53 passed, exactly the 13 new non-preservation cells. Ablation, scripts/ablation-replace.mjs WRAP mode, one leg per site: describeDelegationNarrowing 3 red, delegatedWriteContexts 3, resolveProjectionFieldMask 7, canReadObject 9, canWriteObject 9, canExport 9, explainOnce 11, the helper itself 36 (every refusal cell incl. the prologue and read-scope 24); each restore proven (blob == HEAD security-plugin.ts 4e9f0dc892a5 / explain-engine.ts aee792270aa0, git diff HEAD empty). Source-imported subject, no dist leg. Package suite on 8bb2d5e: Test Files 209 passed (209), Tests 4320 passed | 45 skipped (4365); typecheck exit 0. The first package run on c631ec4 caught 1 moved pin (explain-dependency-fault.test.ts control: its walled-stack delegator had no membership in the agent organization, the refused shape); fixture now seeds the membership, 16/16. Cross-package on-behalf-of suites through the real SecurityPlugin: objectql nested-composition 12/12, service-storage 2 files 152/152, plugin-sharing authored-row-write-deferral 20/20, plugin-audit 2 files 83/83, runtime http-dispatcher 248/248, each exit 0. All under os-verify-lock.",
   "gates": "dispatch-gates --commands on 8bb2d5e: 70 derived, all exit 0 (check:dual-build-cjs-loads after building its 8 missing dists; check:type-check-debt re-run under the lock after a queue-timeout exit 3). --ran: 70 derived, 70 run, 0 NOT-MEASURED, 0 UNRUN, exit 0. Roster gates under touched dirs (check-changeset-fixed, check:error-code-casing, check:filter-alias-parity): exit 0. CI on the PR: in_progress at report time; the type-check lanes and path-scheduled jobs are declared to CI.",
   "dogfood_battery": "8bb2d5e0 · os-verify-lock: VERDICT command-exit 0 · held the lock 1150s · Test Files 289 passed | 3 skipped (292) · Tests 2481 passed | 18 skipped (2499) · no failures (closure built first: turbo build --filter=@objectstack/dogfood^... exit 0)",
   "mcp_calls": "8 — reads only: issue_read x2, pull_request_read x5, search_pull_requests x1 (plus the harness PR-activity subscription, not a GitHub write)",
   "api_writes": "5 relay strokes, all via scripts/pm (objectstack-fleet[bot]): label-write #25107 (assignees os-sales, labels +pm:dispatched -pm:queue); post-stamped claim comment 6348946648 on #25107; dispatch pr_create #25288 (POST /pulls draft, POST /issues/25288/assignees os-sales); dispatch pr_request_reviewers (POST /pulls/25288/requested_reviewers os-sales); post-stamped this report on #25107. git push is not a REST write.",
   "open_questions": [],
   "out_of_scope_findings": [],
   "notes": "Serial: #25256 (#25095) landed on main after the branch was cut; it edits security-plugin.ts in hunks disjoint from these (git merge-tree clean), and CI reads the merge ref. A CONTRACT_REVIEW_TIER review of record is owed before the queue (narrowing). PR body was written once at pr_create."
   }
6. objectstack-fleet

   closed this as completedin #25288on Oct 22, 2026
7. objectstack-fleet commented on Oct 22, 2026

   

   objectstack-fleetBot

   on Oct 22, 2026

   ContributorAuthor

   More actions

   Landed · domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · 2026-10-22T21:47Z

   reading	value
   PR #25288	MERGED through the queue (ACCEPT 6351583081, contract review 6350743954)
   origin/main	carries 5801a4f2c9

   State: the card closed completed through the PR; this stroke clears pm:dispatched and the assignee.

   ---

   Generated by Claude Code
8. objectstack-fleet

   removed

   pm:dispatched

   on Oct 22, 2026
9. objectstack-fleet

   unassigned

   os-sales

   on Oct 22, 2026