[objectstack-fleet]

Requested by Steve · project thread

Part of #31739

Clause-②: no (narrowing)
Metadata-protocol: none
Skills-docs: follow-up owed — content/docs/ai/agents.mdx, content/docs/permissions/index.mdx (the AI service account and the agent ceiling its sets are read under; an author first meets an account at PR-3's registration door, so the teaching lands with it)

Clause-② measured: no published key, export or shape is removed or retyped; one package-root export is added to core (isAgentAccountRow) and one module export to plugin-security (DESTRUCTIVE_CLASS_KEYS, not re-exported from its root), and the connector-connection door's delegated-caller union gains agent_account. The narrowing: every agent principal's permission sets are read under the agent ceiling, and a non-system write giving an AI service account a set above it is refused. Measured first-party: 0 of the 3 OAuth agent ceiling sets carries a clamped bit, and no account row can exist until PR-3. Changeset level patch, ! in its headline, ADR-0087 not-required (no-migration-prescription).

维护者速读

• 改了什么：AI 服务账号（principal_kind = agent 的 sys_user）用自己的 API 密钥访问时，就是它自己这个 agent 主体：principalKind: 'agent'、没有 onBehalfOf、拿不到 everyone 锚点权限集、没有系统权限、也永远不是平台或组织管理员。所有 agent 主体的权限集在求值时按「agent 上限」裁掉 View All、Modify All、转移/恢复/清除、系统权限和管理范围；给账号分配超上限的权限集（或绑定它的岗位）会被按名字拒绝。
• 为什么改：ADR-0151 D3，三步拆分的第二步（PR-1 feat(auth): an AI service account is a sys_user row of kind agent that never signs in #31779 已合并），PR-3 的注册与密钥入口建在它上面。
• 风险与回滚：解析权限时对 sys_user 的那一次读取改为无条件（原来只在配置了平台管理员时才读），每次解析多一次按主键读取；OAuth 连接的助手所用的 3 个第一方权限集不含任何被裁的位，行为不变（测试实测）。回滚即还原本 PR。
• 先看：packages/core/src/security/resolve-authz-context.ts（账号分支）、packages/plugins/plugin-security/src/agent-ceiling-clamp.ts 与 security-plugin-permission-sets.ts（唯一求值入口的裁剪）、agent-account-grant-refusal.ts（分配拒绝，留意「调用者读不到持有人就不判」的分支）。
• 两分钟验证：pnpm --filter @objectstack/plugin-security exec vitest run src/agent-ceiling-clamp.test.ts src/agent-account-grant-refusal.test.ts，应见 20 个用例全绿。
• 需要你做的：无，席位落地（席位按约定做 CONTRACT_REVIEW_TIER 评审）。

What changes

• D3, the account is its own subject. resolveUserAuthzGrants reads the user's sys_user row on every resolution (one read, by id, as the system; it used to be read only when a platform-admin config was set). A row whose principal_kind is agent resolves as principalKind: 'agent', without the everyone anchor's sets, with no system permission, and with no platform or organization administrator standing, whatever its grants say. It never carries admin_full_access or an organization administrator set by name either: standing is also read by name (the approvals override arms and admin_rescue slate, the explainer's tenant-admin read), and the ceiling clears bits, not names. assembleExecutionContext carries the kind onto the context, with no onBehalfOf. REST, /mcp and stdio keys all go through this one resolver, so the key admission needed no change of its own.
• The ceiling, at evaluation. resolvePermissionSetsForContextUnmemoized, the one choke point every evaluator reads, clamps every agent principal's sets (the account and the OAuth-delegated agent alike): viewAllRecords, modifyAllRecords and the destructive class's keys (DESTRUCTIVE_CLASS_KEYS, derived from DESTRUCTIVE_OPERATIONS) are cleared on every object entry, '*' included; systemPermissions is emptied and adminScope removed. A clean set is returned as the same object; a breaching one as a fresh copy, so the catalogs are never mutated. An account's floor is the restricted agent set, so a new account can do nothing until it is granted something.
• The ceiling, at assignment. A non-system insert or update on sys_user_permission_set or sys_user_position that would leave an AI service account holding a set above the ceiling (directly, or through a position that binds one) is refused 400 VALIDATION_FAILED, invalid_value at permission_set or position, naming the set and what in it breaches. Priority 45, after the ceiling-set (35) and membership (40) refusals. A holder the caller's own door does not read is not judged here (the engine's reference check answers it, and the membership refusal's per-write read is reused), so the refusal never names the kind of a user the caller cannot read. A person's grants are never judged. Registered on the system-context page as row 23g.
• Inventory. Flow runs (trigger door, action door, run setup, resume), the connector-connection door (new caller kind agent_account), the action audit line, attachment and comment access, the mention gate and the access explainer read an account as the agent it is.
• Standing guards. principal_kind is listed as an immutable non-standing column in the admin standing surface and the last-admin guard's exclusions.

Nothing registers an AI service account yet; the registration, key and lifecycle doors follow in PR-3 (Fixes #31739).

Tests

New, 55 cases, all green:

• core: resolve-authz-context.agent-account.test.ts (8), assemble-execution-context.test.ts (+3).
• plugin-security: agent-ceiling-clamp.test.ts (10, including the measured 0 of 3 first-party OAuth ceiling sets clamped), agent-account-grant-refusal.test.ts (10, real ObjectQL + SQLite with the real SecurityPlugin; two pin the unreadable-holder and no-sys_user stand-downs), effective-access.test.ts (+2).
• runtime: security/resolve-execution-context.agent-account.test.ts (real resolver + real SecurityPlugin over /mcp and the dispatcher; clamp; everyone and wildcard refused; human and OAuth CONTROLs), flow-run-agent-account-kind.test.ts, automation-connector-connection-door.test.ts (+1).
• service-automation: run-agent-account-kind.test.ts (5).
• rest: rest-api-key-agent-account.test.ts (2). mcp: __tests__/stdio-agent-account.test.ts (2).
• plugin-approvals: agent-account-not-an-administrator.integration.test.ts (6, real ApprovalService on ObjectQL + SQLite, envelopes from the real resolver): an account holding organization_admin is not on the admin_rescue slate and an account holding admin_full_access or organization_admin cannot decide a staffed request (answered as for a missing id, left pending); CONTROLs: a person holding the same grant is on the slate and overrides.

Forced test edits (the resolver's sys_user read is now unconditional, as approved):

• resolve-authz-context.batch-equivalence.golden.json: the seeded-permissions-and-email case records one more query, {"object":"sys_user","where":{"id":"u_seed"},"limit":1,"isSystem":true}; the header notes it as the sixth recorded move.
• resolve-authz-context.platform-admin-config.test.ts: the describe is renamed to say the read is one read, config or not; "fully-seeded" now expects one read and no PLATFORM_ADMIN; "…and costs no sys_user read of its own" now expects one read on both postures.
• resolve-user-grants-cache.test.ts pin 5: sys_user calls are two, one per real resolution.

Forced edits to this PR's own new fixtures after the contract review (F1, the account no longer carries administrative set names): resolve-authz-context.agent-account.test.ts ("is the agent kind…" now expects admin_full_access absent; "an organization administrator set confers no organization standing…" now expects organization_admin absent on the account and present on the person; plus a new pin over every ORGANIZATION_ADMIN_GRANTS name), and resolve-execution-context.agent-account.test.ts (the held sets contain crm_lead_super and not admin_full_access).

Acceptance notes

• PR-2 of the approved three-PR serial split. The card stays open; PR-3 carries the D4/D6 doors and the ADR-0151 status-line fix.
• The account's kind is read from the resolver's row read, not from the key admission projection: adding the column there could refuse keys on a store without it, and the resolver serves every caller.
• scripts/engine-double-contract.pinned.json gains one row for the new runtime test's findOne double, written by the gate's own --write, as its message asks.
• Seat: CONTRACT_REVIEW_TIER review owed on this PR.

Verification

Tests and typecheck

All under scripts/pm/os-verify-lock.sh, npx vitest run per package, after merging main at 015ae70:

• core 3301 passed; plugin-auth 4443 passed / 10 skipped; plugin-audit 1225; service-automation 3498; service-storage 1428; objectql 11821; rest 7940 passed / 355 skipped; mcp 981.
• plugin-security: the first run had 8 reds in grant-holder-membership-refusal.test.ts and tenant-wall-organization-removal.test.ts (the account refusal read an unreadable holder as the system, and threw where no sys_user object is composed). Fixed in 0c2ef42; the re-run at the final head: 6056 passed / 45 skipped, 0 failed.
• runtime: 10513 passed / 19 skipped, 1 failed: sandbox-relay-unique-violation-wire-code.test.ts "a script action body that lets the refusal of its write leave" timed out at 5000 ms while the gate loop shared the box; re-run alone, the file passes (13 of 13 with the agent-account file).
• tsc --noEmit: core, plugin-security, plugin-audit, service-automation, service-storage, objectql, rest, mcp, runtime, exit 0.
• eslint --no-inline-config on every touched .ts file: exit 0.
• Full build (turbo run build --filter='./packages/**', lock): 81 of 81 tasks.

Full dogfood battery (the `(narrowing)` arm)

pnpm --filter @objectstack/dogfood test at the final head 0c2ef42, under the lock, after the full build: 441 files passed / 3 skipped, 3662 tests passed / 42 skipped, 0 failed (VERDICT command-exit 0, 32m40s).

Ablations (each red, then restored: `git diff HEAD` empty)

Each through scripts/ablation-replace.mjs, committed first; the named pins went red and the file came back with blob == HEAD.

• core A1–A11: the everyone skip, the system-permission zeroing, the anchor and config standing checks, the kind stamp, the row predicate, the context copy, the organization-admin standing, and the assembler's account arm, system permissions and precedence.
• plugin-security B1–B10: the clamp wiring, the cleared bits, system permissions, admin scope, the destructive keys, the refusal verdict, its holder read, its registration, the update image, and the effective-access baseline.
• runtime C1–C4: trigger and action forwarding, the trigger CONTROL, the connector caller kind. service-automation D1–D3: run seed, run data context, unseed. E1: the runtime end-to-end clamp.
• F1: the kind on the runtime face. F3: REST and stdio read the core dist, so that leg was held, core rebuilt, both red, then restored and rebuilt green. (F2, the same leg without the rebuild, stayed green and measured nothing.)
• G1: the unreadable-holder stand-down removed: the new pin and the membership refusal's "a holder the caller cannot read is read only through the caller's own door" both red. G2: the no-sys_user guard removed: the composition pin red.
• Several first attempts used a replacement that the tool's own count refused (a substring of the anchor, or a common string); they measured nothing and were re-run with distinct replacements.

Delta after the contract review (head 1166ca5)

• CI: Type Check · workspace was red at 0c2ef42 on @objectstack/runtime#typecheck: a new test read executionContext.onBehalfOf where the test tsconfig types it possibly undefined. Fixed (a415adc); the new approvals file had the same class of error, fixed (1166ca5). check:test-typecheck OK on all eleven touched packages.
• F1 (e26e44a): the resolver withholds admin_full_access and every ORGANIZATION_ADMIN_GRANTS name from an account's permissions. Ablation H1 (filter removed, held, core rebuilt for the dist-reading approvals suite): core 3 pins, approvals 4 pins and the runtime rig red; restored, rebuilt, green, git diff HEAD empty.
• Suites under the lock at e26e44a: core 3302 passed; plugin-approvals 1508 passed; runtime 10514 passed / 19 skipped. tsc --noEmit exit 0 for all three. eslint exit 0.
• Dispatch gates at e26e44a: 120 derived, 120 run, all exit 0 (1166ca5 changes one test line only).
• Readers of those names, grep over packages/ (non-test): on an envelope's permissions, plugin-approvals isOverrideActor and holdsTenantAdminRung (closed here) and plugin-security explain-engine.ts#derivePosture on a posture-less context (closed here). On stored grant ROWS, which the resolver change does not reach: plugin-auth last-admin-guard.ts (counts a Default Organization admin_full_access row as an administrator) and plugin-security upgrade-report-delivery.ts (ADMINISTRATOR_SETS, report recipients). An account holds such a row only through a system or seed writer; both are named for PR-3, where an account's rows are born.

Dispatch gates

node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran: 120 derived, 120 run, 0 NOT-MEASURED, every exit 0 at 0c2ef42.
First round (82 families, before the docs row widened the derivation to 120) had six reds, fixed in 211f6ce (the changeset) and 0c2ef42 (the rest):

• check-adr-0087-registration: the narrowing had no disposition marker; the changeset now carries not-required (no-migration-prescription) and the BREAKING banner.
• check:engine-double-contract: the clamp test's undriven findOne double dropped; the runtime test's pinned findOne recorded by the gate's own --write.
• check:objectql-double-limit: the REST double applies limit after the filter.
• check:where-matcher: the stdio double refuses a combinator or operator.
• check:test-source-alias: module-top import '@objectstack/objectql' (REST) and import '@objectstack/metadata' (connector door test).
• check:system-context-census: row 23g added and the register regenerated.
• check:type-check-debt hit the 600 s loop timeout on the first round; it ran to exit 0 in the second.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ADHkmPK8RUPmLyYjQGCe58

[github-actions]

📓 Docs Drift Check

This PR changes 10 package(s): @objectstack/core, @objectstack/mcp, @objectstack/objectql, @objectstack/plugin-audit, @objectstack/plugin-auth, @objectstack/plugin-security, @objectstack/rest, @objectstack/runtime, @objectstack/service-automation, @objectstack/service-storage, touching 88 documentable anchor(s). ⚠️ 5 changed file(s) yielded no anchor (packages/core/src/security/index.ts, packages/core/src/security/resolve-authz-context.batch-equivalence.golden.json, packages/plugins/plugin-audit/src/comment-access-hooks.ts, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

64 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json ac8fede8f938439d2228f5b1404042d113a3812e.

⛔ 14 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 5 changed file(s) yielded no anchor (packages/core/src/security/index.ts, packages/core/src/security/resolve-authz-context.batch-equivalence.golden.json, packages/plugins/plugin-audit/src/comment-access-hooks.ts, …) — pages documenting those are invisible to this run
• 2 anchor(s) matched too much of the corpus to be a work list: sys_user (symbol, 50 pages), sys_user (literal, 50 pages)
• 10 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 65 of 231 client-bound route-ledger rows — the other 166 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 166: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 59 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 107 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 95 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json ac8fede8f938439d2228f5b1404042d113a3812e → packageMentionDocs.

Which tree this was computed on

This run read content/docs from c34259fe23d799a221db4be1d56b6557083ec9b0 — the merge of head 1a141938af8791a9c67908a55a8f23e2636d2e76 into base ac8fede8f938439d2228f5b1404042d113a3812e, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c34259fe23d799a221db4be1d56b6557083ec9b0 && git checkout c34259fe23d799a221db4be1d56b6557083ec9b0
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin ac8fede8f938439d2228f5b1404042d113a3812e 1a141938af8791a9c67908a55a8f23e2636d2e76 && git checkout -B drift-repro ac8fede8f938439d2228f5b1404042d113a3812e && git merge --no-ff 1a141938af8791a9c67908a55a8f23e2636d2e76

node scripts/docs-audit/affected-docs.mjs --json ac8fede8f938439d2228f5b1404042d113a3812e

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs ac8fede8f938439d2228f5b1404042d113a3812e → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:server#1 · os-steve · session_01ADHkmPF1skfu2kx89BEXZi

Contract-review-claim: session_01ADHkmPF1skfu2kx89BEXZi · head 0c2ef42 · 2026-11-09T08:20Z

Narrowing face (Clause-②: no (narrowing)). An isolated reviewer is reviewing this head at CONTRACT_REVIEW_TIER.

[objectstack-fleet]

domain:server#1 · os-steve · session_01ADHkmPF1skfu2kx89BEXZi

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0c2ef4252b3ed241d7091c490127d9ecae2f0d3f
Local-runs: none
Scope: packages/core/src/security/admin-standing-surface.ts, packages/core/src/security/assemble-execution-context.ts, packages/core/src/security/index.ts, packages/core/src/security/resolve-authz-context.ts, packages/core/src/security/resolve-authz-context.agent-account.test.ts, packages/core/src/security/assemble-execution-context.test.ts, packages/core/src/security/resolve-authz-context.batch-equivalence.golden.json, packages/core/src/security/resolve-authz-context.batch-equivalence.test.ts, packages/core/src/security/resolve-authz-context.platform-admin-config.test.ts, packages/core/src/security/resolve-user-grants-cache.test.ts, packages/mcp/src/plugin.ts, packages/mcp/src/tests/stdio-agent-account.test.ts, packages/objectql/src/engine-scoped-context.ts, packages/plugins/plugin-audit/src/comment-access-hooks.ts, packages/plugins/plugin-audit/src/mention-recipient-gate.ts, packages/plugins/plugin-auth/src/last-admin-guard.ts, packages/plugins/plugin-security/src/agent-account-grant-refusal.ts, packages/plugins/plugin-security/src/agent-account-grant-refusal.test.ts, packages/plugins/plugin-security/src/agent-ceiling-clamp.ts, packages/plugins/plugin-security/src/agent-ceiling-clamp.test.ts, packages/plugins/plugin-security/src/agent-ceiling-grant-refusal.ts, packages/plugins/plugin-security/src/effective-access.test.ts, packages/plugins/plugin-security/src/explain-engine.ts, packages/plugins/plugin-security/src/grant-holder-membership-refusal.ts, packages/plugins/plugin-security/src/permission-evaluator.ts, packages/plugins/plugin-security/src/security-plugin-effective-access.ts, packages/plugins/plugin-security/src/security-plugin-permission-sets.ts, packages/plugins/plugin-security/src/security-plugin-start-hooks.ts, packages/rest/src/rest-server.ts, packages/rest/src/rest-api-key-agent-account.test.ts, packages/runtime/src/action-execution.ts, packages/runtime/src/domains/automation.ts, packages/runtime/src/flow-run-agent-account-kind.test.ts, packages/runtime/src/automation-connector-connection-door.test.ts, packages/runtime/src/security/resolve-execution-context.agent-account.test.ts, packages/services/service-automation/src/engine.ts, packages/services/service-automation/src/plugin.ts, packages/services/service-automation/src/run-resume.ts, packages/services/service-automation/src/runtime-identity.ts, packages/services/service-automation/src/run-agent-account-kind.test.ts, packages/services/service-storage/src/attachment-access-hooks.ts, packages/services/service-storage/src/storage-service-plugin.ts, scripts/engine-double-contract.pinned.json (generated by the gate's own --write; read for provenance, not reviewed) + cited code read on the head and never reviewed: packages/core/src/security/resolve-authz-context.ts (tryFind, getUserRow, hasPlatformAdminStanding, AuthzStoreUnavailableError), packages/core/src/security/resolve-user-grants-cache.ts (the cache key), packages/core/src/security/api-key.ts and user-ban.ts (USER_BAN_FIELDS), packages/plugins/plugin-security/src/security-plugin-permission-sets.ts (permissionSetMemoKey), packages/plugins/plugin-security/src/security-plugin.ts (describePositionGrants, resolveFallbackPermissionSets, every resolvePermissionSetsForContext host wiring), the fourteen host modules that call resolvePermissionSetsForContext (authz middleware, read filter, field readers, object admission, operation principals, sharing verdicts, authored-row write, explain access, security service, effective access), packages/plugins/plugin-security/src/objects/default-permission-sets.ts (mcp_agent_data_read, mcp_agent_data_write, mcp_agent_restricted, organization_admin, deriveWallLessOrgAdmin), packages/spec/src/ai/mcp.zod.ts (MCP_AGENT_PERMISSION_SETS), packages/spec/src/identity/eval-user.zod.ts (ORGANIZATION_ADMIN_GRANTS, ADMIN_FULL_ACCESS_CAPABILITIES), packages/plugins/plugin-approvals/src/approval-service.ts (isOverrideActor, holdsTenantAdminRung, the admin_rescue slate), packages/plugins/plugin-security/src/explain-engine.ts (derivePosture), packages/runtime/src/domains/mcp.ts (the oauthScopes tool-family gate), packages/runtime/src/action-execution.ts (apiForwardAgentOf), packages/plugins/plugin-security/src/grant-holder-membership-refusal.ts (referenceCheckAsksCaller, callerReadsHolder), docs/adr/0151-ai-service-account-a-headless-agent-is-a-registered-principal-of-its-own.md on main. Prose faces read for ② and ③, not reviewed: .changeset/31739-ai-service-account-ceiling.md, content/docs/permissions/system-context.mdx.

Inputs: card #31739 (body and all five comments, the PR-1 and PR-2 os-dev-reports with their open questions), PR #31867 (body, file list, net diff against main at the head; merge-base ad622d30), the 64 check-runs on the head as of 08:28Z. Check-runs: every completed run is success (Check Changeset, Governed Surface Queue Guard, PR-body guards, Check PR Size, Spec property liveness, Lint & Repo Gates, Lint · ESLint / docs & code guards / repo & tooling / CI, release & engine / PM dispatch-gates / three scoped lints, Type Check · source gates, Build UI Deps, Build Docs, Build & E2E UI, Live E2E UI, Dogfood Regression Gate, Flag docs, Check Documentation Links, Auto Label); still pending at the time of this record: Build Core, Test Core (1–8), Type Check · workspace / consumer gates / debt ledger, Type Check UI, Test UI (1–16). No run has failed. The derived gate families those pending runs answer (the admin-standing-surface exactness pin, the batch-equivalence golden, the plugin-security and runtime suites) are read here from the tree, not from a local run; the queue leg still needs them green.

① Derived judgments

Each accept-set or public-surface change the diff implies, named right or wrong against ADR-0151 D3 on main:

1. The resolver's sys_user read is unconditional (resolve-authz-context.ts, getUserRow() joins wave 1 for every caller). Right. The only path that skipped it was a caller seeding both an email and ai_seat; key scopes are refused in keys.ts, so no live caller seeds ai_seat and no live path gains a read. The read is memoised (userRowLoaded), so the config-anchor and ai_access reads below reuse it: one read by primary key per resolution, as the forced pins now assert (platform-admin-config: 1 on both postures; cache pin 5: 2 for two real resolutions, 0 on a hit). Fault handling: tryFind throws AuthzStoreUnavailableError for any failed read that is not a missing table (commit 6a180e4), so a store fault on the kind read fails LOUD and closed, never as a person; a missing sys_user table ([]) reads as a person, which is the pre-column store and correct. The ADR's O3 paragraph had the kind carried on key admission's USER_BAN_FIELDS read instead; the tree reads it in the resolver, which every key face (REST computeExecCtx, /mcp, stdio) passes through, so the admitted set is identical and the dev's reason (a projected read naming a column an unmigrated store lacks could refuse every key) holds — nit F3, no contract effect.
2. An agent row resolves as principalKind: 'agent', is withheld the everyone anchor (!agentAccount && !holdsExternalIdentity(...)), carries systemPermissions: [], gains no platform standing from an anchor grant (anchorsPlatformStanding(grant) && active && !agentAccount) nor from the configured-administrator address (!agentAccount && ...), and isTenantAdmin is false whatever ORGANIZATION_ADMIN_GRANTS it holds, so posture is MEMBER. Right against D3 (explicit grants only; never an administrator). hasPlatformAdminStanding is posture === 'PLATFORM_ADMIN' over the same resolution, so the id-shaped predicate answers false for an account too (pinned). isAgentAccountRow reads principal_kind then principalKind, the exact literal 'agent' only; every other value and an absent row is a person — right, and matches plugin-auth's sign-in refusals.
3. The shared assembler: account = !anonymous && authz.principalKind === 'agent' takes precedence over the OAuth arm; the account gets principalKind: 'agent', systemPermissions: [], its own permissions, no onBehalfOf, no performedBy, no oauthScopes. Right. The precedence is safe because D2 (PR-1, merged) refuses every session for an agent row, so no OAuth consent and no token can name an account; the OAuth-delegated CONTROL keeps today's shape byte for byte (pinned in assemble-execution-context.test.ts and the runtime rig).
4. The clamp sits at the one choke point. resolvePermissionSetsForContextUnmemoized applies clampPermissionSetsToAgentCeiling after both resolutions (the named sets and the restricted fallback) for every principalKind === 'agent' context. Read on the head, every evaluator reaches sets through the memoised resolvePermissionSetsForContext: the authz middleware (object CRUD, VAMA, write-check, pre-image floor), the read filter and RLS, field readers (FLS masks and forbidden writes), object admission, operation principals (the batch path), all four sharing-verdict hosts, authored-row write, explain access, the security service and effective access. The two direct permissionEvaluator.resolvePermissionSets calls outside it are describePositionGrants (a description of a position's declared sets, no evaluation) and resolveFallbackPermissionSets (the HUMAN baseline, never reached on the agent branch, which floors at the restricted set). permissionSetMemoKey already keys on principalKind, so a person and an agent naming the same sets never share a memo entry; the grants cache keys on (userId, tenantId, seeds) and caches the envelope with its principalKind. Right: no cache, batch, FLS, sharing or explain path bypasses the clamp.
5. What the clamp clears: viewAllRecords, modifyAllRecords and DESTRUCTIVE_CLASS_KEYS on every objects entry including '*'; systemPermissions / system_permissions emptied; adminScope / admin_scope removed; JSON-string columns parsed as the delegated-administration gate parses them; a clean set returned as the same object, a breaching one as a fresh copy (catalogs never mutated). DESTRUCTIVE_CLASS_KEYS is derived from DESTRUCTIVE_OPERATIONS through OPERATION_TO_PERMISSION, so it reads allowTransfer, allowRestoreOwnDeleted, manageRecycleBin and follows the map. With both bypass bits cleared a '*' entry stops being the superuser wildcard (ADR-0066 D2 reads the two bits; the field merge's superuser vote reads the same two). Right against D3's list: View/Modify All, the destructive class, a system permission, a superuser wildcard, an admin scope.
6. The refusal at assignment (agent-account-grant-refusal.ts): beforeInsert/beforeUpdate at priority 45 on sys_user_permission_set and sys_user_position, after the ceiling-set (35) and membership (40) refusals; judges the row image AFTER the write (payload else previous); stands down on isSystem, on no sys_user object in the composition, on a holder the caller's own door does not read (callerReadsGrantHolder === false), and on a catalog read fault (warn, proceed); refuses 400 VALIDATION_FAILED / invalid_value at permission_set or position naming the set and each breaching bit. Right: the loud early answer D3 asks for, the clamp the guarantee. A person's grant is never judged (the isAgentAccount read gates it), so no existing write narrows. Pinned on a real ObjectQL + SQLite engine with the real SecurityPlugin, including the update that moves a person's breaching grant onto the account. One nit (F2 below).
7. callerReadsGrantHolder (new export of grant-holder-membership-refusal.ts): the membership refusal's per-write memoised caller read, now returning the tri-state (undefined when the dispatch carries no caller api) and holderLeftToReferenceCheck re-derived as reads === false. Right; the membership refusal's own behaviour is unchanged (its pins run in the plugin-security suite).
8. Inventory: dispatchFlowAction and buildAutomationContext forward principalKind: 'agent' only for an agent WITHOUT onBehalfOf; seedRunGrants seeds it from the resolver beside the grants and deletes it with them (needsGrants), and the decider switch drops it with the trigger user's other facts; resolveRunDataContext carries it onto every CRUD node; the action audit line names the account as acting for itself; connectorConnectionDelegatedCaller returns the new agent_account member before oauth/api_key (still refused by that door, as every non-person caller is); the comment, attachment and mention gates and buildContextForUser stamp the kind; describeEffectiveAccess lists the restricted set as the account's default. Right. Read beyond the inventory: apiForwardAgentOf returns undefined for an account (no oauthScopes), so an api action forward carries the account's own key — D3 rule 5 as written; the /mcp door treats an undefined oauthScopes as "not scope-limited", so the account's tools are bounded by its grants alone — D3's MCP paragraph as written. No remaining reader of principalKind === 'agent' in the tree assumes onBehalfOf or oauthScopes (grep over packages/, non-test).
9. Standing guards: ADMIN_STANDING_SURFACE.sys_user.columns gains principal_kind and principalKind with a reason, and STANDING_KEY_EXCLUSIONS.sys_user carries both with the immutability reason. Right; the exactness pin (admin-standing-surface.test.ts, "declares exactly the columns read") is in Test Core, pending.
10. Public surface: core root gains isAgentAccountRow (widening). ResolvedAuthzContext.principalKind, UserAuthzGrants.principalKind, FlowUserGrants.principalKind, RunIdentityContext.principalKind, SeededRunContext.principalKind are new optional fields (widening). DESTRUCTIVE_CLASS_KEYS, the clamp functions, registerAgentAccountGrantRefusal, callerReadsGrantHolder and runPrincipalKind are module exports, not package-root exports (plugin-security's root exports only PermissionEvaluator from that module; service-automation's root export list from runtime-identity.js does not name runPrincipalKind); ConnectorConnectionDelegatedCaller is not re-exported from the runtime root. Nothing is removed or retyped. The PR body's "one export is added to plugin-security" overstates a module export as a package export — nit F4.
11. WRONG at one consumer (should-fix F1): the account's envelope keeps the NAMES of the sets it holds on permissions (the test fixtures assert admin_full_access stays named; the clamp acts on bodies), and packages/plugins/plugin-approvals/src/approval-service.ts#isOverrideActor derives standing from those names — perms.includes(ADMIN_FULL_ACCESS) is the platform arm (it crosses the tenant wall) and holdsTenantAdminRung(perms) (ORGANIZATION_ADMIN_GRANTS.some(...)) the tenant arm, each deliberately kept beside the posture read "so a transport that never resolved posture still reads the held capability"; holdsTenantAdminRung also builds the admin_rescue administrators' slate over each candidate's resolveUserAuthzGrants. So an account whose grant row names admin_full_access or organization_admin* is an approvals override actor (approve, reject, reassign, recall any PENDING request; across every organization for admin_full_access) and a rescue-slate administrator — standing the changeset says it never has, "whatever it holds". Every one of those three sets breaches by body (ADMIN_FULL_ACCESS_CAPABILITIES carries the '*' bypass bits and system permissions; organization_admin carries them; organization_admin_no_bypass carries organization_admin's system permissions verbatim), so a NON-system assignment is refused by name; the row is reachable through a system or seed writer (row 23g admits it), through the refusal's own stand-downs (no hook registry, catalog read fault, unreadable holder), and no account row can exist before PR-3. The clamp cannot close it, because a name is not a bit it clears. Grade: should-fix. Fix: withhold the admin-standing names (ADMIN_FULL_ACCESS, ORGANIZATION_ADMIN_GRANTS) from an account's permissions in resolveUserAuthzGrants — the changeset's own remedy says an administrative grant "is a person's to hold" — or make the two approvals arms read posture alone when context.principalKind === 'agent'; either way pin it (an account holding admin_full_access is not an override actor and not on the rescue slate), and correct the changeset sentence if the name-withholding is not chosen.

② Semver level

Changeset .changeset/31739-ai-service-account-ceiling.md: patch on all ten packages the diff moves (core, mcp, objectql, plugin-audit, plugin-auth, plugin-security, rest, runtime, service-automation, service-storage; platform-objects is not touched, correctly absent). Both declarations line-initial in the PR body and the changeset body: Clause-②: no (narrowing) and Metadata-protocol: none. The level follows the kind alone: none takes patch; the (narrowing) arm is BREAKING, so the ! headline, the BREAKING banner and the ADR-0087 disposition not-required (no-migration-prescription) are present and correct (no key, export or shape removed or retyped; nothing stored to migrate; no tombstone). The banner carries the before/now/remedy and the measured first-party count (0 of 3). Check Changeset is green on the head. Right. Nit: the changeset's "is never a platform or organization administrator, whatever it holds" is the sentence F1 makes untrue at one consumer until the fix lands; the fix either makes it true or rewords it.

Clause-②: no (narrowing) — confirmed on the tree: no published key, export or shape is removed or retyped; the only published accept-set change is a narrowing of what an agent principal's sets grant at evaluation and one refused class of non-system assignment write.

③ Boundary flags

• Dev flag (1) — the assignment refusal's unreadable-holder stand-down and callerReadsGrantHolder. Answered. The first cut read an unreadable holder as the system (8 reds in the membership and tenant-wall suites); the head reuses the membership refusal's per-write memoised caller read and stands down when it answers false, so the refusal never names the kind of a user the caller cannot read; the clamp still holds for such a row. Consistent with the membership refusal's discipline and with ADR-0090 D6's indistinguishability. Nit F2: the account refusal does not consult referenceCheckAsksCaller first (the membership refusal does), so it stands down on an unreadable holder even where the engine's reference check reads as the system and will not refuse the row either; the grant is then stored unjudged and clamped at evaluation. Row 23g states the stand-down. No correctness effect.
• Dev flag (2) — off-surface edits. content/docs/permissions/system-context.mdx row 23g plus the regenerated register are what check:system-context-census demands for a new isSystem stand-down (both hooks named with their rows); the Lint gates on the head are green. scripts/engine-double-contract.pinned.json gains one row written by that gate's own --write for the runtime rig's driven findOne double. Both accepted as the gates' own output, not reviewed.
• Dev flag (3) — skills/docs follow-up owed (content/docs/ai/agents.mdx, content/docs/permissions/index.mdx). Acceptable to defer: an author first meets an account at PR-3's registration door, and documenting a door that does not exist advertises a capability the runtime does not yet deliver (Prime Directive chore: version packages #10). Condition: PR-3 carries the teaching in the same PR as the door; the card keeps the debt visible. No escalation.
• Dev flag (4a) — a runAs:'system' flow triggered by an account. Out of the declared narrowing: ADR-0151 Non-goals list "a flow or job runAs naming an account (ADR-0073's automation principal stays the identity of user-less runs)" as not decided, and D3's "never runs isSystem" reads on the principal, not on a flow the author declared system. A runAs:'system' run is the flow author's grant and is the same system run for any member who may trigger it; the account is the trigger, not the acting identity, and the trigger door now carries its kind. Refusing it at the trigger door would narrow every automation an account may trigger, which is a narrowing beyond this PR's declaration and ADR-0151's scope: it goes to the maintainer (an ADR-0151 amendment or an O6 decision), not into PR-3. B is safe: it adds no power the account did not have the moment a flow author chose runAs:'system', and O2/O6 are the ADR's named readers of principalKind. Recommend B with a follow-up card that names the question.
• Dev flag (4b) — sets bound through identity positions (org_owner, org_admin) clamped but not withheld. Within the declared narrowing's mechanism: the clamp is what the PR declares, and the positions reach positions as a projection the approvals and security plugin deliberately no longer read as authority. Withholding them would be a further narrowing on accounts only; nothing writes one today (PR-1's reconciler binds no identity position to an account; a non-system sys_user_position write naming a position whose sets breach is refused by this PR's position arm), so B is safe for this PR. PR-3 may revisit with its own declaration, since registration is where an account's membership row is born; it is not a maintainer question. Note the same name-based reader as F1 applies to permissions names, not to position names.
• Open question from the PR-1 report (ADR-0151 status line reads Proposed). Still open; docs/adr/** is Tier H and outside this PR, as it should be. The PR body says PR-3 carries the fix; a Tier H edit needs the maintainer's merge, so PR-3 becomes Tier H if it touches the ADR — flagging so the seat plans it (an amendment card to the spec/docs lane, the PR-1 report's option A, keeps PR-3 Tier S).

④ Design judgment

The narrowing against the published spec. ADR-0151 D3 on main (merged cae8d8fe) already states every refusal this PR makes real: explicit grants only (no everyone anchor, no member baseline, the restricted floor); rule 2's ceiling held at evaluation (View/Modify All, the destructive class, a system permission, a superuser wildcard, an admin scope); refusal by name at assignment; never an administrator. Nothing is taken from a consumer that the spec declared: an OAuth-delegated agent's three first-party sets (mcp_agent_data_read = {'*': {allowRead}}, mcp_agent_data_write = {'*': CRUD} plus the managed-write denies, mcp_agent_restricted = {}) carry none of the cleared bits, read in default-permission-sets.ts on the head, so the measured census (0 of 3 clamped) is credible from the tree and is pinned over the live defaultPermissionSets list with identity (toBe) on each. A deployment that edited its own mcp_agent_* set to carry a bypass bit sees a narrower answer, which is exactly what the changeset's BREAKING banner says.

Human principals and the OAuth CONTROL. Every behavioural branch is gated on agentAccount (resolver) or principalKind === 'agent' (plugin-security, assembler account arm, automation doors). A person holding the same rows as the account resolves with the everyone anchor, the system permission and platform standing (CONTROLs in core, rest, mcp, runtime, plugin-security). The OAuth-delegated agent keeps onBehalfOf, performedBy, scope-derived permissions and the delegator's systemPermissions under delegatesActions; its side of the intersection is clamped by the same line, a no-op on the first-party sets; the delegator's side (principalKind: 'human') is untouched. Correct.

Bypass hunt. Cache: the grants cache (resolve-user-grants-cache.ts) keys on identity and seeds and stores the envelope with principalKind; the set memo keys on principalKind. Batch: resolveOperationPrincipals is a host of the memoised resolver. FLS, sharing (all four verdict hosts), explain, effective access: hosts. Impersonation: a session for an agent row is refused by PR-1's sessionBefore. The OAuth ceiling path: the assembler's account arm precedes it and no token can name an account. Automation: the kind is seeded, forwarded, carried to every CRUD node and dropped at the decider switch; a body-supplied principalKind stays a flow param (pinned). Found one: the name-based standing read in plugin-approvals (F1, should-fix) — a standing consumer outside the ceiling's choke point that the clamp cannot reach because it reads set names, kept on the account's envelope by design. Grade stands at should-fix, not must-fix: the declared narrowing (clamp and refusal) is implemented at the one choke point every evaluation passes; the leak needs a system or seed writer to store an administrative set's name against an account, no account can exist before PR-3, and the fix is one guarded line in the resolver or the approvals gate plus a pin.

The unconditional sys_user read. Fail-closed (AuthzStoreUnavailableError on any read fault but a missing table), one primary-key read already memoised for the config anchor and ai_access, added only on the fully-seeded path no live caller takes, recorded as the sixth golden move with the pin's header saying why. Safe. The ADR's O3 paragraph placed the kind on USER_BAN_FIELDS; the resolver placement is a sound deviation (nit F3) and reaches every face, including a stdio process and an automation run that key admission never sees.

The refusal. Priority ordering, the post-write image on update, the previous binding, the holder-moved case and the system stand-down are right and pinned on a real engine. The catalog-fault branch proceeds with a warn rather than refusing; acceptable because the clamp is the guarantee and the sibling refusals do the same. isAgentAccount compares a placeholder-shaped id by $startsWith on its first character with limit: 2, as the membership refusal does; a placeholder-shaped id is never a stored holder, so this has no effect (nit F4b, folded into F4).

Findings.

• F1 — should-fix: plugin-approvals#isOverrideActor and the admin_rescue slate read admin_full_access / ORGANIZATION_ADMIN_GRANTS by NAME off permissions; the account's envelope keeps those names; the clamp clears bits, not names. Withhold the names for an account in the resolver (or read posture alone for principalKind === 'agent' in both arms), pin it, and keep or reword the changeset sentence.
• F2 — nit: the account refusal stands down on an unreadable holder without first asking referenceCheckAsksCaller, so where the reference check reads as the system the row is stored unjudged; clamp holds; row 23g says so.
• F3 — nit: the kind is read in the resolver, not on key admission's USER_BAN_FIELDS read as ADR-0151's O3 paragraph sketched; equivalent admitted set, sound reason, worth one sentence in PR-3's body.
• F4 — nit: the PR body counts DESTRUCTIVE_CLASS_KEYS as a plugin-security package export; it is a module export (the root exports only PermissionEvaluator from that module). The placeholder-id branch of isAgentAccount mirrors the sibling and has no effect.
• F5 — nit: the access explainer attributes an account's restricted floor as a baseline (the dev's own out-of-scope note); wording only.

No must-fix. F1 earns a delta review of its fix on the next head.

Implemented-by: claude/project-thread-ffxuzs
Reviewed-by: session_01ADHkmPF1skfu2kx89BEXZi

VERDICT: PASS

[objectstack-fleet]

domain:server#1 · os-steve · session_01ADHkmPF1skfu2kx89BEXZi

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 1166ca5fe95d6a8d65901dc56e6b84bf3dc5777b
Local-runs: none
Scope: packages/core/src/security/resolve-authz-context.ts, packages/core/src/security/resolve-authz-context.agent-account.test.ts, packages/plugins/plugin-approvals/src/agent-account-not-an-administrator.integration.test.ts, packages/runtime/src/automation-connector-connection-door.test.ts, packages/runtime/src/security/resolve-execution-context.agent-account.test.ts, .changeset/31739-ai-service-account-ceiling.md + none (every other path unchanged since 0c2ef42)

Delta review of record 6735749732 (head 0c2ef42, PASS, F1 should-fix). Three commits, no merge, no rebase: a415adc (runtime test reads executionContext?.onBehalfOf, a type fix for check:test-typecheck), e26e44a (F1), 1166ca5 (the new approvals test reads pending_approvers as optional, a type fix).

① Derived judgments

1. F1 closed at the root. In resolveUserAuthzGrants, the agentAccount arm now also filters ADMIN_FULL_ACCESS and every ORGANIZATION_ADMIN_GRANTS name off grants.permissions, beside the existing systemPermissions zeroing. It runs after §6b's name collection and after the configured-administrator arm (already gated !agentAccount), and before the envelope is built, so neither isTenantAdmin nor the ai_seat arm nor any later reader sees those names. Every name-based standing reader on permissions (approvals isOverrideActor both arms, the admin_rescue slate through holdsTenantAdminRung over resolveUserAuthzGrants, the explainer's posture-less derivePosture) is reached by the one filter. Right.
2. Person paths are unchanged. The filter sits inside if (agentAccount). The CONTROL in the new approvals test (a person holding the same grants is on the slate and overrides) and the existing person pins stay green. Right.
3. Pins. The core resolver pin covers every rung name. agent-account-not-an-administrator.integration.test.ts runs a real ApprovalService on ObjectQL + SQLite with envelopes from the real resolver: an account is not on the admin_rescue slate and cannot decide a staffed request (REQUEST_NOT_FOUND, left pending). Ablation H1 (filter off) turns core, approvals and the runtime rig red, then restored. The forced fixture edits (the account fixtures that asserted the administrative names stay) are named in the PR body. Right.
4. The two type fixes change no assertion. Right.

② Semver level

Unchanged: patch on the same ten packages, Clause-②: no (narrowing), Metadata-protocol: none. The changeset sentence now says the account never carries admin_full_access or an organization administrator set at all, which is what the tree does. Withholding the names is inside the declared narrowing ("never a platform or organization administrator, whatever it holds"), not a new one. Right.

③ Boundary flags

• Stored-row readers F1 does not reach (from the thread's grep). plugin-auth last-admin-guard.ts counts a stored admin_full_access grant row as an administrator, and plugin-security upgrade-report-delivery.ts ADMINISTRATOR_SETS picks report recipients from stored rows. Both read rows, not an envelope. A non-system write of such a row against an account is refused by this PR's assignment refusal, and no account can exist before PR-3. Ruled: PR-3 carries both (an account row is never counted as the last administrator, and never a report recipient), with pins. Not a blocker here.
• Rulings recorded on the card thread: 4a = B (decision card security: may an AI service account trigger a flow declared runAs system? (ADR-0151 non-goal, #31739 follow-up) #31874); 4b = B; docs ship with PR-3's door; the ADR-0151 status line goes to a separate amendment card.

④ Design judgment

Withholding the names in the resolver, rather than teaching each reader to read posture, is the root fix: a future reader that judges standing by name gets the same answer for free. A cost to note: an account that is somehow bound to admin_full_access now loses that set's non-breaching object grants too, not just its bits. That is the intended reading of "an administrative grant is a person's to hold". The dogfood battery was not rerun on the delta. That is acceptable: the change is inside if (agentAccount) and dogfood seeds no agent row. The queue's sharded dogfood leg still runs it. No new finding.

Implemented-by: claude/project-thread-ffxuzs
Reviewed-by: session_01ADHkmPF1skfu2kx89BEXZi

VERDICT: PASS

[objectstack-fleet]

domain:server#1 · os-steve · session_01ADHkmPF1skfu2kx89BEXZi

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 946a4d2bbcae5a8a882110541b4e9055258e834e
Local-runs: none
Scope: packages/core/src/security/resolve-authz-context.ts, packages/core/src/security/index.ts, packages/mcp/src/plugin.ts, packages/runtime/src/domains/automation.ts, packages/services/service-automation/src/engine.ts, packages/services/service-automation/src/plugin.ts (the files both this PR and the merged main range touch) + packages/plugins/plugin-security/src/security-plugin-permission-sets.ts, packages/plugins/plugin-security/src/delegated-admin-gate.ts (read on the merged head, not changed by the merge for this PR's lines)

Delta review of record 6736879466 (head 1166ca5, PASS). 946a4d2 is the seat's pr_update_branch merge of origin/main 1a66fcf onto 1166ca5 (K was 25), merged by the platform with no conflict and no rebase.

① Derived judgments

The main range touches six files this PR also touches, and none of its hunks overlap this PR's lines:

• E3 feat(core, plugin-security)!: permission sets resolve by (package, name), and a package position's sets resolve from its package (ADR-0150 E3) #31815 (resolve-authz-context.ts, core/security/index.ts). A position's sets now resolve from the package that declared it (catalogSetBody(…, position), PositionBindings). This only changes which set BODY a name reads. The account arm still zeroes systemPermissions and filters the administrative names after §6b's name collection, so no position-bound set gives an account a system permission or an administrative name. Right.
• E3's resolveCatalogReference in delegated-admin-gate.ts. This is the assignment-side organization-boundary check, by the position's package. It is not an evaluation path, and the account's evaluation sets still pass through resolvePermissionSetsForContextUnmemoized, whose ceiling clamp after both resolutions is unchanged on the merged head (read). Right.
• E5 feat(service-automation): a connector_action names its connector from the calling flow's package #31863 (service-automation engine.ts / plugin.ts). The connector name resolver and flowArms / registerFlow(…, contender) sit beside this PR's principalKind seeding and forwarding. They are independent. Right.
• fix(runtime): an App member's flow and permission-set copies land in its App's customization package #31837 (runtime/domains/automation.ts). The App-member clone pair judged before the ensure. It is independent of this PR's connectorConnectionDelegatedCaller agent_account member. Right.
• feat(mcp): bound read_file PDF and Word extraction with a CPU-time budget and a concurrency cap #31848 (mcp/plugin.ts). configureReadFileExtraction() at boot. It is independent of this PR's stdio key-admission kind. Right.

② Semver level

Unchanged: patch on the same ten packages, Clause-②: no (narrowing), Metadata-protocol: none.

③ Boundary flags

None new. The stored-row readers (last-admin-guard.ts, upgrade-report-delivery.ts) stay ruled to PR-3.

④ Design judgment

No interaction between the merged range and the ceiling: E3 narrows which body a name reads, and the account's ceiling acts on whatever body is read. CI on this head decides the rest (Test Core, the plugin-security and runtime suites, the queue's sharded dogfood). No new finding.

Implemented-by: claude/project-thread-ffxuzs
Reviewed-by: session_01ADHkmPF1skfu2kx89BEXZi

VERDICT: PASS

[objectstack-fleet]

domain:server#1 · os-steve · session_01ADHkmPF1skfu2kx89BEXZi

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 1166ca5fe95d6a8d65901dc56e6b84bf3dc5777b
Local-runs: none
Scope: packages/core/src/security/resolve-authz-context.ts, packages/core/src/security/resolve-authz-context.agent-account.test.ts, packages/plugins/plugin-approvals/src/agent-account-not-an-administrator.integration.test.ts, packages/runtime/src/automation-connector-connection-door.test.ts, packages/runtime/src/security/resolve-execution-context.agent-account.test.ts, .changeset/31739-ai-service-account-ceiling.md + none (every other path unchanged since 0c2ef42)

Delta review of record 6735749732 (head 0c2ef42, PASS, F1 should-fix). Three commits, no merge, no rebase: a415adc (runtime test reads executionContext?.onBehalfOf, a type fix for check:test-typecheck), e26e44a (F1), 1166ca5 (the new approvals test reads pending_approvers as optional, a type fix).

① Derived judgments

1. F1 closed at the root. In resolveUserAuthzGrants, the agentAccount arm now also filters ADMIN_FULL_ACCESS and every ORGANIZATION_ADMIN_GRANTS name off grants.permissions, beside the existing systemPermissions zeroing. It runs after §6b's name collection and after the configured-administrator arm (already gated !agentAccount), and before the envelope is built, so neither isTenantAdmin nor the ai_seat arm nor any later reader sees those names. Every name-based standing reader on permissions (approvals isOverrideActor both arms, the admin_rescue slate through holdsTenantAdminRung over resolveUserAuthzGrants, the explainer's posture-less derivePosture) is reached by the one filter. Right.
2. Person paths are unchanged. The filter sits inside if (agentAccount). The CONTROL in the new approvals test (a person holding the same grants is on the slate and overrides) and the existing person pins stay green. Right.
3. Pins. The core resolver pin covers every rung name. agent-account-not-an-administrator.integration.test.ts runs a real ApprovalService on ObjectQL + SQLite with envelopes from the real resolver: an account is not on the admin_rescue slate and cannot decide a staffed request (REQUEST_NOT_FOUND, left pending). Ablation H1 (filter off) turns core, approvals and the runtime rig red, then restored. The forced fixture edits (the account fixtures that asserted the administrative names stay) are named in the PR body. Right.
4. The two type fixes change no assertion. Right.

② Semver level

Unchanged: patch on the same ten packages, Clause-②: no (narrowing), Metadata-protocol: none. The changeset sentence now says the account never carries admin_full_access or an organization administrator set at all, which is what the tree does. Withholding the names is inside the declared narrowing ("never a platform or organization administrator, whatever it holds"), not a new one. Right.

③ Boundary flags

• Stored-row readers F1 does not reach (from the thread's grep). plugin-auth last-admin-guard.ts counts a stored admin_full_access grant row as an administrator, and plugin-security upgrade-report-delivery.ts ADMINISTRATOR_SETS picks report recipients from stored rows. Both read rows, not an envelope. A non-system write of such a row against an account is refused by this PR's assignment refusal, and no account can exist before PR-3. Ruled: PR-3 carries both (an account row is never counted as the last administrator, and never a report recipient), with pins. Not a blocker here.
• Rulings recorded on the card thread: 4a = B (decision card security: may an AI service account trigger a flow declared runAs system? (ADR-0151 non-goal, #31739 follow-up) #31874); 4b = B; docs ship with PR-3's door; the ADR-0151 status line goes to a separate amendment card.

④ Design judgment

Withholding the names in the resolver, rather than teaching each reader to read posture, is the root fix: a future reader that judges standing by name gets the same answer for free. A cost to note: an account that is somehow bound to admin_full_access now loses that set's non-breaching object grants too, not just its bits. That is the intended reading of "an administrative grant is a person's to hold". The dogfood battery was not rerun on the delta. That is acceptable: the change is inside if (agentAccount) and dogfood seeds no agent row. The queue's sharded dogfood leg still runs it. No new finding.

Implemented-by: claude/project-thread-ffxuzs
Reviewed-by: session_01ADHkmPF1skfu2kx89BEXZi

VERDICT: PASS

[objectstack-fleet]

domain:server#1 · os-steve · session_01ADHkmPF1skfu2kx89BEXZi

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 1a141938af8791a9c67908a55a8f23e2636d2e76
Local-runs: none
Scope: none of this PR's paths moved in the merge + read for interaction: packages/core/src/security/effective-object-permissions.ts (ef4af73)

Delta review of record 6736920285 (head 946a4d2, PASS). 1a14193 merges origin/main ac8fede onto 946a4d2 with no rebase and no conflict. The card thread pushed it because the relay's update-branch merge (946a4d2) triggered no workflows.

① Derived judgments

The merged range is four commits: #31883 (app-shell), #31878 (service-analytics), #31859 (spec ActionSchema.preflight) and #31877 (core recycle-bin annotation). None touches a path of this PR. #31877 changes how effective-object-permissions.ts annotates restore and purge for platform objects. It does not touch DESTRUCTIVE_OPERATIONS or OPERATION_TO_PERMISSION, from which the ceiling's DESTRUCTIVE_CLASS_KEYS is derived, so the clamp clears the same keys. Right.

② Semver level

Unchanged: patch on the same ten packages, Clause-②: no (narrowing), Metadata-protocol: none.

③ Boundary flags

None new.

④ Design judgment

No interaction. The thread's pre-push runs on this head: full build 81/81, core 3337, plugin-security 6072, and check:test-typecheck on all 11 touched packages. CI decides the rest.

Implemented-by: claude/project-thread-ffxuzs
Reviewed-by: session_01ADHkmPF1skfu2kx89BEXZi

VERDICT: PASS