[PM seat] security — 🟢 sunhaolin #29740

security#1 · sunhaolin · session_017xRBcT1w3zpekijraHJE4f

⚠️ Seat stub. Job description: .claude/skills/pm-dispatch/references/lanes/security.md (⛔ not copied here). Never-public rules: .claude/skills/pm-dispatch/references/security-findings.md. This is security seat 1. This post carries no finding, path, object name or mechanism, by rule.

Current PM — 🟢 sunhaolin

• Holder: sunhaolin (GET /user) · session_017xRBcT1w3zpekijraHJE4f · seated 2026-11-08T04:13Z on the maintainer's summons (/pm-dispatch security). Effort note: this session runs below high; the account owner is asked to reopen the seat at high at the next natural boundary.
• Patrol: trig_01B4cyQdRef1vx3n5y13Ed47 · 12 * * * * (hourly, self-bound).
• Mailbox: PR pm:mailbox — security#1 · sunhaolin #31360 (head claude/wonderful-noether-hondyj: this session may push only that branch, so the mailbox rides it instead of claude/mailbox-security-1; --close deletes it).
• Previous holder: os-bob · session_012dn2AdqWnb3ndnEacKvJvF · seated 2026-11-07T14:35Z, clocked out 2026-11-08T03:46Z (brief comment 6716891187). Archive: that holder's body is the revision of 2026-11-08T03:48Z.
• Takeover: /pm-dispatch security, then read this post first, then Resume-from: the clock-out hand-over below. Advisory text is read only through the relay advisory_read; this post carries no finding, path or mechanism.
• Ledger rule: one row per advisory, opaque id · session · state, ⛔ no detail. Claims on advisory fixes live here, never in session memory.

Ledger

Maintainer rulings, 2026-11-08T08:23Z, in this seat's session (session_017xRBcT1w3zpekijraHJE4f), verbatim:

• The maintainer's instruction: 「需要我确认的，用fable审核后，用中文给我解释」. Every decision is put to the maintainer only after an isolated contract-tier review, and is explained in Chinese.
• The answer 「都同意」, to the seat's four recommendations as put in the session: GHSA-c62f takes options C+E (this names the new refusal at the request seam); GHSA-4wfc's held half and its sibling door take option A, as one breaking order with a contract-tier review before dispatch; GHSA-4wfc and GHSA-vjxm close, and the sibling finding gets its own draft advisory; GHSA-mhf8 takes option E; GHSA-4rwh part 1 takes option A.
• Dispatch is serial where orders share a file: plugin-auth (GHSA-c62f first, then GHSA-mhf8), and delegated-admin-gate.ts (PR fix(plugin-security)!: a delegated business-unit walk never starts at a unit outside the caller's organization #31442 first, then GHSA-4rwh part 1 and the GHSA-4wfc order).

Maintainer instructions, 2026-11-08T16:13Z, in this seat's session, verbatim: 「31469 这种你应该自己处理」, 「skills应该立卡更新，以后这种问题都应该自己处理」 (card #31582), and 「关闭为什么要我确认，你应该使用 pm-dispatch 技能处理」. Under the standing order, the seat closes an advisory once its fix merges, with no per-advisory confirmation. It also clears an infra-red check (one whose log shows it measured nothing) on its own, by a relay re-run or by bringing origin/main in, never by asking the maintainer to click.

Maintainer instruction, 2026-11-08T22:10Z, in this seat's session, verbatim: 「当前任务处理完，后续只处理高风险任务」 (it replaces the same session's earlier 「当前任务处理完，合并后下班」). From here the seat dispatches only high-severity items. Moderate and low items are held, not dispatched, until the maintainer names one. The publish-or-not list stays owed before the next release: no closed advisory's fix is an ancestor of the 18.3.0 tag (83d7e4ae33).

Standing orders (inherited: the maintainer's, given in the previous holder's session session_01QSeKYn5CmmdShCJifm6WYj, verbatim):

• 「目前的修复都关闭」 and 「你处理完的可以都先关闭」: once an advisory's fix merges, the seat closes it through the relay advisory_state and records it here.
• 「哪些高危要发布应该在我版本发布前决策吧」: before each version release, the seat puts a publish-or-not list to the maintainer, covering the closed advisories since the last release (high and moderate first), reviewed at CONTRACT_REVIEW_TIER first. Publishing is the maintainer's: they reopen and publish in the advisory UI, since the relay cannot move a closed advisory.
• 「同意,batch 调到 5」: the previous holder ran at most 5 slots. The os-sales holder ran at most 4 per seat (its maintainer's word at 2026-11-05T21:32Z); this holder runs at most 5 (see Current PM).
• 「只记录,暂停派发」 (2026-11-04), lifted by 「可以继续派发」: the fourth and fifth decision batches are ruled and recorded in the seat's private notes, and dispatch has resumed.
• 「changeset 改写确认都同意」 (2026-11-05): a pending-changeset DELIBERATE CORRECTION lands on the seat's own record, as landing-operations.md already says (the ACCEPT quoting before and after, or the same-head at-tier PASS). The seat does not wait on the maintainer for it. Skills card: pm-dispatch skills: say who confirms a pending-changeset correction (the seat's record, never a maintainer wait) everywhere a dev or the gate is told to "get it confirmed", and keep PR bodies from narrating pre-fix behaviour on security fixes #30271.
• Maintainer rulings 2026-11-05T21:32Z (decision cards in this seat's thread): an API-key credential whose owner record no longer exists is refused at verification (in flight, PR fix(core)!: an API key authenticates only as an owner who exists #30783); on the 2.8 detail-write master re-read, both legs report a store fault as a fault and only a real permission verdict answers 403 (not dispatched). Security seat concurrency 4.

Clock-out hand-over (2026-11-08T03:46Z)

In flight (2026-11-08T23:20Z, session_017xRBcT1w3zpekijraHJE4f): nothing. No high-severity item is open: every high advisory is closed with its fix on main. Landed this shift: #31384, #31404, #31442, #31500, #31556, #31469, #31634, #31686. A design question for the maintainer: whether a position assignment should also judge the target user's own units. The listing gap is #31368; the reading-order rule conflict is #31372; the infra-red re-run gap is #31582.

Scope ruling (maintainer, this seat's session, verbatim): 「我理解的是这里的任务 https://github.com/objectstack-ai/objectstack/security/advisories 才归安全席位」 and 「是的，立卡改规则，cloud#3727 交给 cloud 车道」. This seat owns only the public repository's security advisories; a private repository's security issue belongs to that repository's lane. The rule text change is #31301 (governed, lands on the maintainer's approval). cloud#3727 is handed to the cloud lane (pm:queue on the card).

For the maintainer:

• GHSA-xh7r: the fix needs a contract ruling (the analysis, the contract-tier review and every objection were put to the maintainer in this seat's session on 2026-11-07); nothing dispatched; branch claude/sec-sso-jit-domain is empty.
• fix(plugin-security)!: a delegated business-unit subtree stays inside one organization, whether or not the caller's context names one #31295's review asked one policy question: whether a business-unit tree whose root carries no organization should be refused outright (the fix keeps today's behaviour for that shape).
• Unchanged from the earlier hand-over: GHSA-6pr9, GHSA-8gmf, GHSA-5654, GHSA-c62f, GHSA-hjqw, the in-process handler retirement card, the whole-object describe question, and the publish-or-not list before the next release.

Not dispatched (next orders):

• GHSA-mhf8 (medium on read): measure first, then a contract-tier review, then to the maintainer (it touches documented defaults).
• GHSA-4rwh (low, two parts): part 2 needs a runtime measurement; part 1 may need a ruling.
• GHSA-4wfc (low on read): measure, then order the fix.
• The older queue (GHSA-883m sibling path, follow-ups owed) is unchanged from the earlier hand-over.

Follow-ups owed (rule level, not dispatched): after #31244: a below-priority-40 hook that fills the grant holder when the caller named none is named in the stand-down list (or membership is judged when the payload did not name the holder); and when the hook's own holder read fails it judges membership rather than handing off. After #31295: one wording nit in its Acceptance notes. After objectstack-ai/cloud#3726: the stored-key-reference rule could move to one shared door.

Hot-file serial queue

⛔ Re-derive from live claims and each open PR's file list before every dispatch.

• None held as a lane: fixes land in their owning packages through no-card orders.
• The skills-lane cards on lanes/security.md and security-findings.md that the previous holder queued (pm/fleet-write: the relay publishes a security advisory on the maintainer's list: reopen, set the affected and patched versions, publish #30110, pm-dispatch skills: the security seat's triage of a non-finding, its ledger states after the close-on-merge order, a release's contents read by ancestry, and the CI recoveries the relay leaves #30111) are both closed; nothing is held on those files.

Notes

• Write path: the relay (post-stamped.mjs, label-write.mjs, issue-create.mjs, fleet-write/dispatch.mjs). ⛔ No GitHub MCP writes. Advisory text is read only through the relay advisory_read.
• domain:skills#2 ([PM seat] domain:skills · seat 2 — 🟢 zhuangjianguo · 由 zhuangjianguo 账户的项目负责 #19287), held by the previous holder's session for the security work's skills-lane cards, was handed back once they landed (clock-out brief 6598110373).