fix(plugin-security): an organization administrator's assignment removal is judged on the stored row, and its refusal names only values the caller can read - #30248

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-security, touching 5 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/permissions/delegated-administration.mdx (via DelegatedAdminGate (symbol, a top-level class))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v13.mdx (via DelegatedAdminGate (symbol, a top-level class))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 3fbc14233b1bda266ab6bfd81aa844700ea4abb8 && git checkout 3fbc14233b1bda266ab6bfd81aa844700ea4abb8
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 771b2db20ac08d78b7fec5c2bd1ee30de9aa26dc 0b0d0e216f41f563de1d94a86e9e985d7f673c3f && git checkout -B drift-repro 771b2db20ac08d78b7fec5c2bd1ee30de9aa26dc && git merge --no-ff 0b0d0e216f41f563de1d94a86e9e985d7f673c3f

node scripts/docs-audit/affected-docs.mjs --json 771b2db20ac08d78b7fec5c2bd1ee30de9aa26dc

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 771b2db20ac08d78b7fec5c2bd1ee30de9aa26dc → pass the list as
args.docs, on the commit named under Which tree this was computed on.

security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: d33de915d2443d420720cf532d47ac5d7b741dfb
Local-runs: none
Scope: packages/plugins/plugin-security/src/delegated-admin-gate.ts, packages/plugins/plugin-security/src/delegated-admin-gate.test.ts, packages/plugins/plugin-security/src/org-admin-assignment-boundary.posture.test.ts, .changeset/org-admin-removal-caller-read.md, .changeset/org-admin-removal-stored-row-verdict.md + packages/plugins/plugin-security/src/security-plugin-authz-middleware.ts (readDoorAnswerForGateRefusal, the gate call site, step 2.7, the query guard), packages/plugins/plugin-security/src/security-plugin.ts (getCallerPreImage, readRowById, callerCannotReadAddressedRow), packages/plugins/plugin-security/src/security-plugin-addressed-writes.ts, packages/plugins/plugin-security/src/grant-permission-set-name.ts, packages/plugins/plugin-security/src/organization-scope.ts, packages/plugins/plugin-security/src/index.ts, packages/plugins/plugin-security/CHANGELOG.md, the gate at tag @objectstack/plugin-security@18.3.0, docs/adr/0090-permission-model-v2-concept-convergence.md (D12 and its 2026-10-17 note), scripts/check-empty-changeset.mjs, ruling comment 5985885287 and the rest of the #21771 thread, the #30165 thread (records 6638950952 and 6640676948), the #30200 body, the PR body, file list, net diff and the check-runs on this head.

Review order: an at-tier review on a security hardening PR (the ruling's own landing condition). Read-only: the diff against origin/main, the PR body, the cited code at this head and the check-runs. Nothing built, run or re-run. Mechanism, where a judgment needed one, is in the reviewer's local security-note and nowhere in this record (security-findings.md section 6).

① Derived judgments

Accept-set and public-surface changes the diff implies, each judged:

1. The organization branch now judges a by-id removal on the stored row once the caller's own read returns the row. organizationTargets asks callerRead whether there is a row, and only then reads the stored row; organizationAdminFailure runs the organization, position and permission-set checks on that row. Right. ADR-0090 D12 (2026-10-17 note) defines the organization administrator's right over "every permission set the row distributes", a fact of the stored row, so judging on a read that a field rule or masking rule has thinned judges less than the row. It is also the rule the delegated branch has held all along (delegatedTargets). Consequence, declared in the body and the changeset: a removal of an in-boundary row whose judged column the administrator does not read at its stored value is now admitted where published 18.3.0 refused it; an out-of-boundary one stays refused. A widening of admitted writes, not of the published contract (see ②).
2. A refusal names a value only when the caller can read it at its stored value (or wrote it). Three new unnamed sentences (organization, position, permission set), each behind mayName, each with meta: {}; the position's carried set is named only beside a named position; the grant's column asked of mayName is GRANT_SET_NAME_FIELD, the same column grantSetNameOf reads. Right. columnsReadAsStored is strict equality against the system read, so a hidden column (absent) and a masked column (different string) are both unnamed; an object-valued column compares unequal and is left unnamed, which is the safe direction.
3. A row the caller cannot read and an id naming no row keep the read door's not-found. prev is null when callerRead returns null, the unreadable refusal is unchanged, and readDoorAnswerForGateRefusal still maps it to recordNotFoundError for the addressed id. Right, and no stored read is made for such a row (the stored read is conditional on the caller's read; pinned in the unit file).
4. Inserts unchanged. The insert target now carries wrote: null, which makes mayName true for every column of a payload row, so every insert sentence names what it named. Right.
5. Update unchanged. The update refusal is taken before any lookup (fix(plugin-security): an organization administrator's update by id is refused before the row is looked up, whatever the id names #30200's order); the merge kept both docblock texts and the code path. Right.
6. A read refusal or a store fault still propagates from either read; the middleware answers a declared 4xx read refusal with that refusal and lets a 5xx through. Unchanged from the base.
7. Public surface unchanged. DelegatedTarget is a module-private interface; GRANT_SET_NAME_FIELD is an internal import; index.ts still re-exports DelegatedAdminGate, isTenantAdmin and the DelegatedAdminGateDeps type from the gate module and nothing more; no error code, no spec schema, no metadata key moves. Right.
8. One extra system read per admitted-or-refused removal of a readable row. A cost, not a surface change; the unit file pins that it is not issued for an unreadable row.

Disclosure rule (security-findings.md section 6) on the PR title, body, commit messages, both changesets, test names and code comments: each states the hardening rule (what the verdict is taken on, what a refusal names, what answers not-found); none describes a probe or how the pre-fix door could be made to misbehave. The ablation lines name the pins they red, not a recipe. No breach.

② Semver level

• @objectstack/plugin-security at patch; Clause-②: no with no arm; Metadata-protocol: none, on the body and on both changesets. Right. The brief's question, answered from the repo's rules: this change admits removals the published release refused, but Clause ② reads only the published contract surface (execution-duties.md: "条款②只指已发布契约面"; contract-review.md: the package's exports map, the schema, the error-code ledger), and its negative boundary places a runtime permission or security behaviour change outside Clause ② and on the human floor's security/permission class. No export, schema or error code moves, so the declaration is no; no (widening) is malformed under AGENTS.md's closed pair, and (narrowing) is false. The widening is declared in prose, which is where it belongs, and the compensating control the rules name for that class is this at-tier review before landing. The level follows the kind: none takes patch.
• The corrected pending changeset (.changeset/org-admin-removal-caller-read.md): the rewritten lead sentence, "now asks the administrator's own read, in its own context, whether that row is there to remove", is true of this tree. One note: the gate at tag 18.3.0 already read the row under the caller's context, so the sentence's "now" overstates the delta from the published release; what moved since 18.3.0 is the answer, which the first bullet states. Not a finding. Should-fix (text): the second bullet, "A row the administrator can read keeps the answer it had, including the guidance that names the organization boundary", is no longer true of this tree for a row whose judged column the administrator does not read at its stored value (the new changeset in this same PR says the opposite, correctly). The body's "Its bullets stay true" is wrong on that bullet. The file is already under this PR's deliberate correction, so the fix rides the same confirmation.
• Check Changeset is red on this head by the gate's own design: the foreign-changeset rule (finding: random changeset filenames collide silently across parallel agents — a round overwrote a sibling PR's minor changeset and every gate stayed green #17712) names .changeset/org-admin-removal-caller-read.md as present on the merge base and changed by this PR, and its text classes the case as a DELIBERATE CORRECTION whose remedy is to say so on the PR and get it confirmed. The PR does. The maintainer's confirmation on record (fix(plugin-security): an assignment write the administrator cannot address answers not-found, as a read does; a refusal names only values the caller can read #30165's thread, 2026-11-05T00:47Z) names fix(plugin-auth): a verification-email resend from a visitor who is not signed in answers the same whatever the send does #30144 and fix(plugin-security): an assignment write the administrator cannot address answers not-found, as a read does; a refusal names only values the caller can read #30165 only; a confirmation for this PR's edit is still owed before a Tier S landing, with a PR comment recording the gate and the cause (SKILL.md's three conditions for carrying a by-design red).

③ Boundary flags

1. "Correcting a pending release note: please confirm." Judged under ②: the sentence is true of the tree; the second bullet is not, should-fix. Confirmation for this PR owed to the maintainer.
2. "The row's organization column ... how the write door's own row-level check treats a caller who does not read the organization column is with the seat." Read, not pinned by me: under the walled postures the write door's own row-level re-read is asked under the caller's context with a predicate on that column, and the door's query guard refuses a caller-context read whose predicate names a column the caller cannot read, so such a caller's by-id removal is refused by the door whatever the gate decided, before and after this PR. Pre-existing, outside this PR's files, fail-closed, names nothing. The rig's choice to pin the gate's verdict under group and isolated and the door end to end under single is the honest shape. Escalated to the seat as the body asks; the seat decides whether a false refusal in that configuration is a finding to file. Not this PR's defect.
3. "fix(plugin-security): an organization administrator's update by id is refused before the row is looked up, whatever the id names #30200 is merged in ... the merge conflicted in that docblock only." Read at this head: the organizationAdminFailure docblock carries both texts coherently (read question first, stored-row verdict, mayName, then the update-order sentences), and the code keeps fix(plugin-security): an organization administrator's update by id is refused before the row is looked up, whatever the id names #30200's update refusal before any lookup. Resolved.
4. Verification claims (85/85, 157/157, the whole suite, ablations A1 and A2, 60 derived gates). Not reproduced here (read-only). CI at the time of this read: every finished check green except Check Changeset (by design, above), including Lint & Repo Gates, TypeScript Type Check, Build Core, Governed Surface Queue Guard, Test UI, Live E2E UI, the Dogfood Regression Gate and Test Core shards 1, 2, 3, 5, 6, 7 and 8 of 8; Test Core 4/8 still in progress. Their conclusions are the gate verdicts; the record names what it read.
5. Provenance of the rule. The body, the new docblock lines, two new code comments and both new describe names cite "ruling of record 5985885287, sub-item B ('the verdict stays on the stored row')". Comment 5985885287 on security(data): a by-id write answers 403 for a row the caller cannot read and 404 for an id that does not exist, for principals the write pre-image check does not bind: an existence signal the read door withholds #21771 is ruling letter A and carries no sub-item B and no such sentence; its only "B" is the option not taken. The stored-row and wording rule is the 2026-11-04 batch-4 item-2 maintainer ruling that the fix(plugin-security): an assignment write the administrator cannot address answers not-found, as a read does; a refusal names only values the caller can read #30165 contract-review record (6638950952) names, and I found no tracker record carrying it. The citation pre-exists on main from fix(plugin-security): an assignment write the administrator cannot address answers not-found, as a read does; a refusal names only values the caller can read #30165 at four sites; this PR extends it at five more. Should-fix: cite the record that decided the rule, and if that ruling has no written record of record, the seat writes one (as 5985885287 was written) and the code points at it. The design does not depend on the citation (①.1), so this is provenance, not a FAIL.
6. Author is objectstack-fleet[bot]; no off-relay login to name.
7. The Implemented-by branch and the adopting seat share one session id; ④ below was run by an isolated subagent of that seat, fed the inputs the brief names and not the seat's conclusions, as the independence rule requires.

④ Design judgment

For packages/plugins/plugin-security/src/delegated-admin-gate.ts, against the ruling it implements (5985885287: a row the caller cannot read answers as a nonexistent id; a reader who may not write keeps 403 and sees nothing new), ADR-0090 D12 as amended 2026-10-17, and the code it cites. Tried to break it:

• A caller who cannot read the row. callerRead returns null, no stored read, the unreadable refusal, the middleware's not-found for the addressed id; a caller who also holds an adminScope falls to the delegated walk, which reads as the caller again, gets null and refuses the same way without a stored read. Holds, on both tables, in every posture the rig boots.
• A missing or non-scalar id. Refused as a filter delete before any read; an insert has no id. Holds.
• A row that vanishes between the two reads. The stored read returns null, the branch answers the unreadable refusal, the middleware re-asks the caller's read and maps to not-found. Holds.
• Masked versus hidden. Both fall outside reads under strict equality; neither reaches the sentence or details. A mask that is a fixed point of its value counts as read and may be named, which discloses nothing the caller does not already see. Holds; pinned at the gate (both administrator sets, both tables, each of the three judged columns, hidden and masked) and through the door (position and permission set under group and isolated, hidden and masked; organization under single).
• The three tenancy postures. Under the walled postures the caller's read is tenant-scoped, so another organization's row is unreadable and answers not-found; under single it is readable and is refused on the stored organization without naming it when the caller cannot read that column. Holds; the single control pins it end to end.
• The delegated branch. Untouched in code; DelegatedTarget is shared without changing its shape. Holds.
• Refusal wording that could name a value the caller cannot read. Every value a sentence or details can carry on the removal path (organization, position, the set a position carries, permission set) is behind mayName; the business-unit sentence is reachable only from an insert payload, which the caller wrote. Holds. A catalog fact (which sets a position carries) is named only beside a position the caller reads.
• An extra read for a row the caller cannot read. None: the stored read is conditional on the caller's read returning a row, and the unit file pins the absence of a system read of the addressed object for both an unreadable row and an id naming no row.
• Explain and the write-admission preview. explainAccess asks the gate only whether the caller covers the user; canWriteObject folds every refusal to a boolean. Neither can split by presence or by column visibility.

Findings: no must-fix. Should-fix: ② the second bullet of .changeset/org-admin-removal-caller-read.md is now false and should be corrected under the same confirmation; ③.5 the "sub-item B" citations name a record that does not carry that sub-item, so the rule's provenance should point at the record that decided it (and that ruling should have one). Escalated, not a finding of this PR: ③.2, the door's own refusal of a by-id removal by a caller whose field rules hide the organization column under the walled postures, which the seat should classify. Owed before a Tier S landing: the maintainer's confirmation of this PR's changeset correction, the by-design-red comment on this PR, and green on the three Test Core shards still running.

Implemented-by: claude/sec-hardening-r2
Reviewed-by: session_01QSeKYn5CmmdShCJifm6WYj

VERDICT: PASS

security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0b0d0e216f41f563de1d94a86e9e985d7f673c3f
Local-runs: none
Scope: packages/plugins/plugin-security/src/delegated-admin-gate.ts, packages/plugins/plugin-security/src/delegated-admin-gate.test.ts, packages/plugins/plugin-security/src/org-admin-assignment-boundary.posture.test.ts, .changeset/org-admin-removal-caller-read.md (the delta d33de915d2..0b0d0e216f, commits 0cc6f17 and 0b0d0e2) + the rewritten PR body, ruling comment 6649064874 on #21771, every ruling citation left in packages/plugins/plugin-security/src and .changeset at this head, the check-runs on this head, and the earlier record on d33de915d2 (comment 6649074186) this delta builds on.

Delta review by the same reviewer: the two findings-only commits since the PASS record on d33de915d2. Read-only, nothing built or run.

① Derived judgments

• No accept-set or public-surface change. Every hunk of the delta is inside a docblock, a line comment or a describe string: columnsReadAsStored and mayName docblocks, the organizationAdminFailure, organizationTargets and delegatedTargets docblocks, two delegated-walk comments, two describe names in the posture rig and one in the unit file, and three lines of one pending changeset. No executable line moves, no test assertion moves, no export, schema or error code moves. The behaviour judged on d33de915d2 stands unchanged at this head.
• Should-fix (provenance) closed. Every citation of the stored-row verdict and of the naming rule in the package now names ruling of record 6649064874, which exists on security(data): a by-id write answers 403 for a row the caller cannot read and 404 for an id that does not exist, for principals the write pre-image check does not bind: an existence signal the read door withholds #21771 as a written record (letter B, maintainer 「其他同意」 2026-11-04, written 2026-11-05T03:41Z, stated to add to 5985885287 and not replace it): the two helper docblocks, the organization branch's docblock and comment, the two delegated-walk comments, the delegatedTargets docblock, and the three describe names. The citations of 5985885287 are kept where they belong (the read door's not-found answer: callerRead, UnreadableAddressedRowRefusal, organizationTargets's first paragraph, delegatedTargets's first paragraph, the middleware's readDoorAnswerForGateRefusal, the rig's not-found describes). No "sub-item B" remains anywhere in the package or in .changeset. The ruling record's text matches what the code does: the verdict on the stored row in both branches once the caller's own read returns the row; a value named only when the caller reads that column at its stored value; the unreadable row and the missing id unchanged.
• The delegatedTargets docblock's last sentence now says the guidance "names only what the caller may be told (mayName)" where it said the row "keeps its verdict and its guidance". True of the code since fix(plugin-security): an assignment write the administrator cannot address answers not-found, as a read does; a refusal names only values the caller can read #30165; a comment correction, no behaviour.

§6 (security-findings.md) on the new public text: both commit messages, the rewritten body (the new "One ruling record for the rule" bullet, the rewritten Acceptance note, the findings-commit Verification block), the corrected changeset and the new ruling record each state the rule (what is judged on, what a refusal names, what answers not-found); none describes a probe or how a pre-fix door could be made to misbehave. No breach.

② Semver level

• Unchanged: @objectstack/plugin-security at patch, Clause-②: no with no arm, Metadata-protocol: none, on the body and both changesets. The delta publishes no code.
• Should-fix (text) closed — every sentence of the corrected pending changeset is true of the tree. Title: a refused write answers the same for a row it cannot read as for a missing one — true (the not-found for both). Lead sentence: the gate asks the administrator's own read whether the row is there to remove — true (organizationTargets → callerRead); the "now" overstates the delta from 18.3.0, which already read under the caller's context, a nit noted before and not a finding. Bullet 1, now scoped to a removal: the removal of an unreadable row answers as the removal of a missing id, the read door's 404 RECORD_NOT_FOUND for that object and id — true (unreadable refusal → recordNotFoundError; an edit in place is refused before any lookup, so the scoping is right). Bullet 2: a readable row is judged on the stored row; a refusal names the organization boundary, and names the organization, position or permission set only when the administrator's own read returns that value as stored — true (storedRow, mayName on organization_id, position, GRANT_SET_NAME_FIELD; every organization-branch refusal is thrown with the "(ADR-0090 D12, the organization boundary)" tail). Bullet 3: an edit in place of a readable row is refused as before, every removal admitted before is still admitted, a tenant-level administrator is judged as before — true (the stored-row verdict admits a superset of the caller-read verdict; isTenantLevelAdmin returns before the branch). Read together with the new changeset org-admin-removal-stored-row-verdict.md, the two notes no longer contradict each other.
• Check Changeset will stay red on this head by the foreign-changeset rule, as designed; the maintainer's confirmation of this PR's correction is still the owed human step, now for the three corrected lines rather than one, and the body asks for it.

③ Boundary flags

1. The changeset confirmation request is restated in the body for the sentence and the two bullets; the Acceptance note's account of what each line now says matches the file byte for byte in substance. Owed to the maintainer; not this record's to give.
2. The organization-column question is now worded as "a separate change the seat has ordered". Consistent with the earlier record's reading (pre-existing, fail-closed, outside this PR's files); nothing in the delta touches it.
3. Verification claims for the findings commits (typecheck, 85/85, 157/157, the changeset gate reading only the declared correction, six text gates green) are not reproduced here. CI on this head at the time of this read: finished checks green (Governed Surface Queue Guard, PR-body guards, Test UI, Check PR Size, Auto Label, Flag docs, two Lint families); Build Core, Check Changeset, the Dogfood Regression Gate, the remaining Lint families, Live E2E UI, the Test Core planner and the Type Check families still in progress. Their conclusions are the gate verdicts; the Tier S landing waits on them.
4. Head moved by findings-only commits: the earlier record's ① to ④ on d33de915d2 carry; this delta re-reads only what moved and finds no behaviour moved.
5. Author objectstack-fleet[bot]; the Implemented-by branch and the adopting seat share a session id, and this delta was again run by an isolated subagent of that seat on the inputs the brief names.

④ Design judgment

No hits file changed in behaviour, so ④ is the earlier record's, re-checked against the delta: the three docblock rewrites describe the code as it is (the stored read conditional on the caller's read; reads by strict equality; wording through mayName; the read-refusal and fault paths unchanged), and the new ruling record's four bullets are each implemented at the sites that now cite it. Nothing in the delta can change a verdict, a sentence or a read. No finding.

Findings: no must-fix; both earlier should-fixes closed; no new should-fix. Owed before a Tier S landing: the maintainer's written confirmation of this PR's changeset correction, the by-design-red comment on this PR for Check Changeset, and green on the gate-carrying checks still running on this head.

Implemented-by: claude/sec-hardening-r2
Reviewed-by: session_01QSeKYn5CmmdShCJifm6WYj

VERDICT: PASS

security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

Changeset correction confirmed by the maintainer, 2026-11-05T04:23Z. The confirmation was given in session session_01QSeKYn5CmmdShCJifm6WYj (seat security#1); verbatim:

changeset 改写确认 #30248 同意，并立卡修改 skills，changeset 都同意

This is the written confirmation that scripts/check-empty-changeset.mjs names as the human path for its DELIBERATE CORRECTION class. It covers the three corrected lines of .changeset/org-admin-removal-caller-read.md on this PR. Check Changeset stays red by its own design, and the merge goes over it: the check is not a required context and does not run on merge_group.

security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

席位核对

ACCEPT · head 0b0d0e216f41f563de1d94a86e9e985d7f673c3f · 2026-11-05T04:23Z

• Shape: 5 files. Not governed. Patch for plugin-security, Clause-②: no, Metadata-protocol: none. The widening against 18.3.0 is declared in the body and the changeset.
• Rule held (ruling of record 6649064874 on security(data): a by-id write answers 403 for a row the caller cannot read and 404 for an id that does not exist, for principals the write pre-image check does not bind: an existence signal the read door withholds #21771, with 5985885287 for the not-found answer): an organization administrator's assignment removal is judged on the stored row once the caller's own read returns the row. A refusal names a value only when the caller reads it at its stored value. A row the caller cannot read and a missing id keep the read door's not-found.
• Contract review at CONTRACT_REVIEW_TIER:
  • The full record at d33de915d2 (comment 6649074186) was PASS with two should-fixes: one changeset sentence untrue of the tree, and a citation naming the wrong ruling.
  • Both were closed in findings-only commits 0cc6f17e95 and 0b0d0e216f; the seat rewrote the body to match.
  • The delta record by the same reviewer on this head (comment 6649362306) is PASS.
• Open questions:
  • Clause-② stays no: execution-duties places runtime permission behaviour outside Clause ②, and no published surface moves (the review agrees).
  • The write door's own row re-read for a caller who does not read the organization column is ordered separately (seat order R3).
• Check-runs at this head: 33 success, 15 skipped. The only red is Check Changeset, by design: the foreign-changeset rule names .changeset/org-admin-removal-caller-read.md, a declared DELIBERATE CORRECTION. The maintainer's written confirmation is on this PR. It is not a required context.
• Gates (dev): 60/60 run at d33de915d2; the plugin-security suite has 5318 passed; posture rig 85/85; gate 157/157; ablations red, then restored. Findings commits: typecheck plus both test files re-run green.
• Landing: ready, then auto-merge.