Repository navigation
plugin-security: delegated-admin gate follow-ups after #32538 — direct-grant refusal wording, the stale re-stamp leg in directGrantSet, and extra gate pins #32720
Description
epic:#31527#2 · os-bill · session_01Utp6Ca5UHVBDE3DqQXgJsW
Filing gate: ① carried out of PR #32718 (card #32538): the dev's out-of-scope report 6822788987 and the contract review's non-blocking follow-ups, filed per the maintainer's rule that simple review items go to a follow-up card. Part of #31527 (ADR-0150). ⛔ Not a claim.
维护者速读
- 背景：plugin-security: the delegated-admin gate refuses an organization administrator who names one of two holders of a permission set #32538 修好了委托管理员授权门的组织边界那一腿：指定了包就只判那个持有者。
- 遗留 1：同一个门的委托作用域腿
directGrantSet仍按 feat(plugin-security, runtime, core)!: the permission-set grant, clone and activation doors take a package, and a grant is unique per package #32306 已删掉的「插入时补戳」前提推理，把指定了包的 insert 算作 restamped。读代码判断：包和环境同名时可能多拒，未实测。 - 遗留 2：直接授予的拒绝句仍写 "which the position cannot resolve"，在 feat(plugin-security, runtime, core)!: the permission-set grant, clone and activation doors take a package, and a grant is unique per package #32306 之后措辞不准。
- 遗留 3：补几个 pin：只有一个边界外持有者时指定非持有者、列值不是字符串、混合批量。
- 都不放宽准入；第 1 项先实测，确认多拒再修，修了按 widening 声明。
- 需要你做的：无。
Scope
- Measure
directGrantSet'srestampedleg for an insert that names a package, on a name a package and the environment both hold. If it over-refuses, judge the named holder only (same rule as plugin-security: the delegated-admin gate refuses an organization administrator who names one of two holders of a permission set #32538) and declare FROM → TO. Fix the stale re-stamp comment either way. - Reword the direct-grant refusal sentence so it matches the seam after feat(plugin-security, runtime, core)!: the permission-set grant, clone and activation doors take a package, and a grant is unique per package #32306.
- Pins (plugin-security
delegated-admin-gate.test.ts): a named non-holder beside one outside holder is refused; a non-string column; a mixed batch. - A comment nit: the grant leg's new comment leans on the seam's refusal; the gate is right without it, so say so.
Clause-②: the claimer measures (item 1 is likely yes (widening) or no). Dedupe (directGrantSet restamped, position cannot resolve): none found.
class: d · type: Task
Grade: p2 proposed.
Activity
objectstack-fleet commentedon Nov 12, 2026
triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH
Path: none
Triage: first touch →
domain:server· p2 ·pm:queue· 2026-11-12T12:45Z⛔ Not a claim.
domain:server(packages/plugins/plugin-security, the delegated-admin gate'sdirectGrantSetleg and its refusal wording). Part of design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527.Generated by Claude Code
objectstack-fleet commentedon Nov 14, 2026
domain:server#5 · os-elon-musk · session_016WV4czXwx6JtQPvacrzzUw
Regrade p2 → p3 · W0 of the area-lease pilot (#33059) · 2026-11-14T15:04Z
Items 2–4 are wording and pins. Item 1 is measured first; if it really over-refuses, a widened security gate is a maintainer decision and gets its own decision card. The maintainer approved the W0 list: 「以上都同意」.
Generated by Claude Code