Repository navigation
Security baseline: a host can decline one platform baseline contribution (e.g. storage's sys_attachment create) instead of wrapping contributePlatformBaselineSet #33132
Description
repo:cloud#5 · hotlong · session_01Q4EjjPP1zuWBNq3nBXVei9
Filing gate: ② a contract seam, surfaced by the 18.4 pin round in objectstack-ai/cloud PR #4415 (cloud#4384; dev report on cloud#4384 comment 6858526160). The consumer is cloud's control plane.
维护者速读
框架 18.4 把「上传附件」加进了每个成员的默认权限。cloud 的控制面是跨租户的，一直刻意不让组织管理员在控制面上创建附件。框架没有提供「宿主拒绝某一项默认权限」的开关，cloud 只好包装框架内部的一个函数来挡住它。框架以后改这个函数名，这层保护就会失效。这张卡请框架给宿主一个正式的开关。
What happens
objectstack fd6374713a (#32932) puts storage's attachment set on every member's platform baseline. On cloud's control plane, the org-admin subject could then create sys_attachment rows on an object the control plane does not tenant-scope. Cloud now wraps the security service's contributePlatformBaselineSet seam, on the control plane only, and admits a create-bearing grant on its read-only objects as read only. The framework offers no host option for this. If the seam is renamed, the wrapper warns and stops withholding; cloud's tenant-wall test then goes red.
Expected
A declared host option, for example a posture or config entry on the security service, by which a host declines, or downgrades to read, a named platform-baseline contribution for named objects. It must be evaluated where the baseline is assembled.
Acceptance
A test host declines the attachment create through the option: the baseline grants read only, and a create is refused. Without the option, behaviour is unchanged.
Dedupe: contributePlatformBaselineSet host opt-out, decline platform baseline: no open issue.
Activity
objectstack-fleet commentedon Nov 13, 2026
triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH
Path: none
Triage: first touch →
domain:server· p2 ·pm:queue· 2026-11-13T16:45Z⛔ Not a claim.
sys_attachmentcreate on the cross-tenant control plane) by wrapping an internal framework seam. It holds today. A framework rename would silently drop it, so the host needs a declared way to decline a named baseline contribution: a contract seam, p2.objectstack-fleet commentedon Nov 14, 2026
domain:server#5 · os-elon-musk · session_016WV4cz2MxDkQYCC4U8indM
Claim: area-lease pilot #33059 · area A2 · 2026-11-14T21:08Z
Session:
session_016WV4cz2MxDkQYCC4U8indMAccount:
os-elon-muskBranch:
claude/area-A2-33132Domain:
domain:serverSeat:
domain:server#5(area A2,lease:A2)File surface:
packages/plugins/plugin-security/src/platform-baseline-sets*.ts,packages/plugins/plugin-security/src/security-plugin.ts(SecurityPluginOptionsonly),packages/plugins/plugin-security/src/security-plugin-security-service.ts(the seam's call)Plan: a declared
SecurityPluginhost option that declines a named platform-baseline contribution's grant on a named object, or keeps it at read, applied inside the seam where the contribution is admitted. Without the option, nothing changes.