From 0c177741be4728b9ad3113ca41dea7a8465a37be Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 04:47:17 +0000 Subject: [PATCH] docs(qa): re-point the platform-owner-email item's legacy-grant anchor at grantAnchorsPlatformStanding b2e78701f7 replaced the posture flag legacyGrantAnchorRetired in packages/core/src/security/resolve-authz-context.ts with the predicate grantAnchorsPlatformStanding(grant, { walled, defaultOrganizationId }). Under a walled posture it anchors nothing; under single the organization-less admin_full_access row still anchors, which is what the source parenthetical states. The anchor now names that predicate. Prose, clauses, steps and oracles are unchanged. Claude-Session: https://claude.ai/code/session_01FM29ZqLTrnPNXxijioZwMp Co-authored-by: Claude --- docs/qa/platform-checklist/areas/access-security.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/qa/platform-checklist/areas/access-security.json b/docs/qa/platform-checklist/areas/access-security.json index f28b01e49b1..6f7c9862b87 100644 --- a/docs/qa/platform-checklist/areas/access-security.json +++ b/docs/qa/platform-checklist/areas/access-security.json @@ -2820,7 +2820,7 @@ "source": [ "packages/core/src/security/resolve-authz-context.ts#hasPlatformAdminStanding (§6b-config — the config anchor inside the ONE derivation site; additive, never subtractive) + (hasPlatformAdminStanding, the id-shaped projection)", "packages/core/src/security/platform-admin.ts#parsePlatformAdminEmails (parsePlatformAdminEmails whole-variable refusal, resolvePlatformAdminEmails loud-once resolve, matchesConfiguredPlatformAdmin verified-only)", - "packages/core/src/security/resolve-authz-context.ts#legacyGrantAnchorRetired (#11663 L5 — the unscoped admin_full_access row derives PLATFORM_ADMIN only when the requested posture enforces no wall)", + "packages/core/src/security/resolve-authz-context.ts#grantAnchorsPlatformStanding (#11663 L5 — the unscoped admin_full_access row derives PLATFORM_ADMIN only when the requested posture enforces no wall)", "packages/spec/src/security/tenancy-posture.ts#postureEnforcesWall (walled = every posture except single)", "packages/core/src/security/admin-standing-surface.ts (the env declared a non-table derivation input — no break-glass write can reach it)", "packages/types/src/env.ts#PLATFORM_OWNER_EMAIL_ENV,200 (PLATFORM_OWNER_EMAIL_ENV / resolvePlatformOwnerEmail)",