[PM seat] domain:identity — 🟢 os-zhuang

[claude]

Single-writer seat post for the domain:identity execution lane. Index entry: #4604.

🟢 ACTIVE

范围 | Scope

packages/plugins/plugin-auth · plugin-security · plugin-sharing · plugin-audit.
packages/spec semantic surfaces transfer to the domain:spec seat.

当前 PM | Current PM

• GitHub account: os-zhuang
• Session: session_01PEVB6w7D7uCszR9Mw1BL73
• Took over: 2026-08-12T13:45Z via /pm-dispatch identity; maintainer-confirmed at ~13:47Z (「前任刚交接完，你可以接手了」). The 13:45Z audit comment recorded it as a unilateral liveness call and was corrected in a follow-up — the measured facts were unchanged by the confirmation.
• Predecessor: huangyiirene / session_01D6Qi9sYxhaRwj7TYiD5MWg, last output 11:43Z, no de-registration comment.

继承台账 | Ledger (re-measured from labels, 2026-08-12T15:05Z)

Whole-lane read in one query (labels: [domain:identity], minimal fields), states intersected locally — ⛔ never one query per pm-state, which is structurally blind to the others.

bucket	count	cards
pm:dispatched	3 (batch full)	#7807 target:v17 (plugin-sharing) · #8049 target:v17 (plugin-auth) · #7809 (plugin-security) — all dev-in-flight, dispatched 14:29–15:03Z
pm:queue (unassigned)	5	#8053 target:v17 · #7994 · #7858 · #7795 · #7675
finding	5 in-lane	#8060 (CRM positions) · #8019 (change-email old mailbox) · #7988 (read-scope disclosure on CRUD) · #7881 (rethrowAsBetterAuthError) · #7826 (sys_session retention). Plus #8074, filed by this seat, awaiting triage grading and not yet domain-labelled.
needs-user-decision	0	—
pm:blocked	0	—
pm:on-hold	4	#6736 · #3653 · #3002 · #1883 — ⛔ do not dispatch, ⛔ do not nag

MERGED this shift (this seat): 3 — all landing-verified by content on origin/main including negative space:

card	PR	landed	negative space verified
#7861 target:v17	#7974	✅	object.zod.ts contract text untouched
#7735	#8017	✅	user.deleteUser still unconfigured (zero occurrences); ledger row disabled
#8023 target:v17	#8072	8c767f5f0	owner_only_deletes floor intact; unit_and_subordinates untouched (#7807's defect confirmed still live)

Release board (target:v17) on this lane: 3 — #8053 (queued, package undetermined) · #8049 (in flight) · #7807 (in flight).

热文件串行队 | Hot-file serial queue

package	ordered cards	note
plugin-sharing	#7807 (in flight) → #7858 → #7795	all three land here; #7858/#7795 wait for #7807 MERGED, ⛔ not armed
plugin-auth	#8049 (in flight) → #7994	#7994 is ruled (Option B: map twoFactor/jwks/deviceCode, retire the three #7770 exemptions)
plugin-security	#7809 (in flight)	#8023 cleared this package at 15:00Z
plugin-audit	#7675	⛔ blocked on a triage split, not on this lane
undetermined	#8053	⚠️ target:v17 and could land in either plugin-security or plugin-auth. Read it fully to fix the package before claiming — guessing costs a serialization breach.

常设承诺 | Standing commitments

1. Drive the three in-flight cards to MERGED, verifying landing content on origin/main each time — the queue squashes, so merge-base --is-ancestor never fires.
2. Serialized cards dispatch on MERGED, not on armed, and their file surfaces are re-verified on the merged ref first — the merge that closes the predecessor is the one most likely to have moved them. ([finding] The bulk AST write path passes opCtx.operation raw, so purge / transfer / restore derive no row scope while update / delete now do (#7665 asymmetry) #7809's anchors drifted twice for exactly this reason.)
3. audit-log-browser: 4 of 10 declared sys_audit_log actions have no writer anywhere (login/logout/permission_change/config_change/export/import never materialize) #7675 is blocked on a triage split spanning three seats and two repos; re-surfaced 13:49Z because the session that first requested it had died. ⛔ Do not split it from this seat — domain:* has one producer. ⛔ Do not dispatch the plugin-auth half alone: it would take the spec-enum-vs-consumer ordering decision by accident.
4. Findings stay held; this seat adds measured evidence or files disagreement — grading is the triage seat's single channel.
5. packages/spec semantic surfaces transfer to the spec seat. The error-code ledger is the registration surface a new code mechanically requires and was accepted in-bounds on fix(sharing): publicSharing.eligibility is declared-but-unenforced — a draft or internal record mints a public share link and is served anonymously #7861 with a cross-seat declaration — that precedent is narrow and ⛔ does not extend to object.zod.ts contract text.

说明 | Notes

Predecessor ops notes are preserved in the body revisions of 2026-08-11T17:13Z and 20:15Z. The load-bearing ones, plus this shift's:

• An ACCEPT is not a landing. Found at takeover: two ACCEPTed, fully-green PRs sat unarmed for ~2 h because the reviewing session ended between the verdict and the arming step, and both states look identical on the card. Arm inside the same turn as the verdict, or schedule a check-in that reads the PR's state.
• Flip ready BEFORE enabling auto-merge. Auto-merge does not survive a draft conversion; arming first and flipping second silently disarms it.
• Per-job CI, never the aggregate. get_status on this repo returns only a Vercel status and reads success while saying nothing about any gate.
• A grep count is not a verification until someone reads the hit. fix(plugin-security): a public_read_write OWD opens row-level writes, not just the creator's (#8023) #8072's review claimed effectiveSharingModel is never consulted; the count came back 1, not 0. It was a pre-existing doc comment on an unrelated concern — but "1, not 0" is exactly the shape that gets waved through.
• A fixture that cannot fail is worse than no fixture — and the live instance here is structural: the write floor is positions-gated to org_member, so an org-less harness sees a real 403 defect answer 200. A public_read_write object is only writable by the row's creator — showcase_contributor gets 403 editing a showcase_project it can read, where the access matrix declares edit:true #8023's dev's first fixture was org-less and passed against the known-broken build. Filed as [finding] An org-less test fixture cannot observe the org_member-gated write floor, so a real 403 defect records as a PASSING cell #8074. Any fixture asserting row-level write permission needs an org context.
• An assertion whose expectation and reality derive from the same source cannot fail — keep predict-then-mutate mandatory in every dispatch prompt. It has now paid three times in two shifts, and normal review missed all three.
• Watch the OUTCOME, not the instrument. A re-arm condition must read the state that matters (main content / MERGED), never a specific PR number.
• Queue membership: trust the added_to_merge_queue timeline event or the webhook. gh-readonly-queue/* refs false-positive on stale refs and false-negative at capacity.
• Only converting to draft removes an enqueued PR; disable_pr_auto_merge alone does not.
• os-regen check is per-PR and ⛔ not inheritable. content/docs/references/** is merge=os-regen, but the silent-drop hazard needs the same path touched by both sides — compute the intersection of the PR's changed files against main's since that PR's merge-base. Empty ⇒ the four-step regen merge is not required. Measured empty for fix(sharing): enforce the declared publicSharing.eligibility predicate at link creation #7974 and fix(plugin-auth): enable better-auth user.changeEmail, and de-book delete-user in the auth route ledger (#7735) #8017; ⛔ re-measure每次.
• The queue runs the FULL suite; PR CI runs the affected subset.
• MANAGED_EXTENSION_FIELDS doubles as the ADR-0092 D2 write whitelist — completing it to make a test meaningful is a security change. Relevant to [Decision] D7 now derives the twoFactor / jwks / deviceCode models — map them and retire their three #7770 exemptions? #7994.
• A dev disputing a PM instruction with code is the system working. fix(plugin-auth): enable better-auth user.changeEmail, and de-book delete-user in the auth route ledger (#7735) #8017's dev corrected three PM premises, one load-bearing; fix(plugin-security): a public_read_write OWD opens row-level writes, not just the creator's (#8023) #8072's dev corrected the card's file attribution.
• subscribe_pr_activity fails on PRs authored by a different account — it was refused for fix(sharing): enforce the declared publicSharing.eligibility predicate at link creation #7974/fix(plugin-auth): enable better-auth user.changeEmail, and de-book delete-user in the auth route ledger (#7735) #8017 (predecessor's account). Fall back to round-cadence polling; PRs this seat's devs open subscribe fine.
• ⚠️ Angle-bracket placeholders are destroyed on write to a GitHub issue body. Use {curly}; re-read every body write.
• mcp__github__pull_request_read get_files overflows on a large PR. Use git diff --name-only origin/main...refs/pull/{n}/head instead — git over the proxy works normally.

[baozhoutao]

移交存档(session_01JwwiU9bjhwy2SWj13ho8uv → 空缺待接管,2026-08-08 08:5xZ)

维护者指令:在飞做完即停,车道转交其他会话。已按纪律收官,无半状态:

• 在飞清零:最后一件 plugin-audit 的 5 个 hook 全部无 object 注册 ⇒ 引擎「按对象」需求门(#5284 单 id / #5038 批量)在 audit 启用时恒真 #5860→PR perf(plugin-audit): 审计跳过名单上到注册面,SKIP_OBJECTS 表不再买单前置行读 (#5860) #6614 已 MERGED(0f8d16a05),ACCEPT 评论与关单齐备;此前 同族第三处组装:share-link 路由把授权信封裁成 4 个字段后直接当 enforcement context 喂给 engine.find —— group 租户姿态下 Layer 0 墙恒判否 #6206→fix(plugin-sharing): share-link enforcement 吃完整授权信封,修复 group 姿态建链恒 403 (#6206) #6552、vama-write-path-convergence.test.ts 的 DELETE 用例喂的是引擎会拒绝的调用形状,安全侧前像门在这一半从未被执行 #6277→test(plugin-security): feed the VAMA DELETE half a call shape the engine accepts (#6277) #6502 均已落地关单。
• 无遗留认领:本会话所有 assign + 认领评论对应的单要么已合入关单、要么已按裁决转入 blocked 并写明机器行(Blocked-by:),下一任无需继承任何在飞认领。
• 定时器已停:本会话的巡检唤醒均为一次性且已到期,未再武装;不会有幽灵唤醒代表本席写入。
• 状态全部落在 GitHub:正文已刷新为完整交接快照(等 ISharingService 写判定补三态(放行/不表态/拒绝)—— #5492 裁决 B 案的 step1,二态 canEdit 已实测产出 fail-open #6428 的配对批次执行计划与其两条实测指引、待评估三张的相互关系、blocked 与决策箱、findings)。接管者按「从 labels 重建状态」即可直接开工,⛔ 无需读本会话历史。

正文的座位栏已置空并清 assignee,标题改 🔴;接管 = 编辑正文该栏 + 一条审计评论。

---

Generated by Claude Code

[os-zhuang]

Takeover audit — seat claimed from vacancy.

• GitHub: os-zhuang
• Session: session_01BM1tNf5U3nEbHKR4fo5qVQ
• Time: 2026-08-08 08:32Z
• Basis: predecessor's close-out comment (08:28Z) records zero in-flight and no inherited claims; seat body re-read immediately before this edit (residual-race discipline). Title / assignee / body updated in the same stroke.

Round-1 plan: verify #6428 state (gate for the #5492 + #5491 paired dispatch), evaluate #6352 / #6216 / #6551, sweep pm:blocked unlock conditions (#5893 → drivers #5702), rescan the lane queue for new cards.

---

Generated by Claude Code

[os-zhuang]

Cross-seat notice (post-hoc): domain:engine-core → domain:identity — PR #6697 (#5574/#5846 engine half) touches packages/plugins/plugin-auth/src/last-admin-guard.ts (+ its test).

From the engine-core seat (#6019), session session_01MwoubC3jL271FYt9rGXwxb. This seat post is currently ⏳ vacant; recording here for the next holder and any identity-side reviewer.

Why the touch could not stay out. The PR moves predicate (multi:true) before* hooks to per-row dispatch (maintainer ruling B on #5574). Under per-row dispatch, plugin-auth's last-administrator break-glass guard had a security regression: it resolved its target set as "scalar input.id if present, else the caller's predicate" — sound only while a predicate write's before phase carried no per-row id. Per-row, a multi ban of ALL administrators arrives as N individually-legitimate by-id bans (banning one admin of three leaves two), so the batch would pass with no refusal and lock the environment out. Shipping the dispatch change without the guard fix would have opened that hole on merge — the fix rides the same PR by necessity, not convenience.

The fix (one function): resolveTargetIds consults options.multi FIRST and uses the id only for genuine by-id writes (input.options stays the caller's bag during before* by contract D1/D2, multi included — preserved deliberately for exactly this kind of population-level guard). Dedicated changeset (last-admin-guard-per-row-dispatch.md); regression pinned in last-admin-guard.test.ts. The dev also reviewed the other six input.options.where readers (service-storage ×3, plugin-sharing, plugin-approvals, plugin-audit): all per-row permission/reconcile questions where the per-row view is exact or strictly better — plugin-auth was the only population-invariant guard.

Veto/objection path: comment here or on PR #6697; post-merge, a revert of the guard hunk alone would REOPEN the lockout hole, so any objection should propose an alternative guard shape rather than a bare revert.

---

Generated by Claude Code