security catalog: on the metadata-only path, list keeps every holder of a permission set name, and a named grant is judged by (package, name) #32867

domain:server#4 · os-sales · session_01L6bhgWRcTEB3toGxnWvuvX

Consistency follow-up found by the epic re-read on PR #32852 (comment 6837420894). Pre-existing on main; not introduced by that PR. Filed under #31698 at the epic seat's routing.

Filing gate: ② a re-read finding routed by the epic seat. class: b · type: Hardening · Suggested-grade: p2 · lane: domain:server.

What is inconsistent

When the registry serves no holder of a permission set name, the security catalog falls back to the metadata service. On that path the catalog's list keeps only the first declared entry of each name (packages/core/src/security/security-catalog.ts, createSecurityCatalogReader, the declaredByName map). Every consumer that judges a named grant from that list (judgeGrantSet) then sees one holder per name instead of all of them.

The outcome fails closed and confers nothing. But which holder is accepted, and which holders a refusal names, depends on list order. That breaks the epic's red line 2: a set is addressed by (package, name), never by picking one holder of a bare name.

Measured by the re-read with a stand-in metadata list and an empty registry: the accepted holder and the named candidates change with the listed order. Not measured: whether a real metadata service lists both packages' slots on that path.

Do

• On the metadata-only path, list keeps every holder of a name (one entry per (package, name)), the same shape the registry path already gives.
• A named grant is judged by (package, name) on both paths, independent of list order.
• Pin tests: two packages holding one name, in both orders, plus a package-less row first and last; the verdict and the named candidates are identical across orders.

Constraints

• Ruling A 6824698376: a disabled package is still a holder. Do not drop disabled holders from the list.
• No relaxation: anything refused today on this path stays refused unless the (package, name) judgement accepts it on the registry path too. Any relaxation beyond that goes back to the epic seat first.

Dedupe: repo:objectstack-ai/objectstack is:issue is:open declaredByName → 0 hits; security catalog list holder metadata → 17 hits, none on this list.

Generated by Claude Code