[objectstack-fleet]

Requested by Elon · project thread

Supersedes #32638.

维护者速读

• 改了什么:更正 ADR-0135“域名验证”一段:验证覆盖提供方列出的每个域名、改动域名列表会清除验证;开启验证后,提供方只能为其已证明的域名下的邮箱新建账号,精确比较,失败即拒,任何受众姿态、邀请或 JIT 开关都不放宽,已有账号不复查。本轮给两句规则补上指向代码的符号锚点,并在 D6 下加注记:这条规则是本仓自定、已获你批准,由 fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 实现。
• 为什么改:设计文本须与代码 PR fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 的规则一致;ADR-0135 要求每条机制陈述带符号锚点,方便不进 cloud 仓也能核对。
• 风险与回滚:仅文档,docs/adr/** 属 Tier H 受管面,不发布任何包;回滚即还原本 PR。新锚点指向 fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 新增的文件,所以 fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 合并前 check:adr-symbol-anchors 会红,这是有意为之,用门禁保证落地顺序。
• 先看:docs/adr/0135-identity-and-access-architecture.md 中 "Domain verification is opt-in" 一段(唯一改动)。
• 两分钟验证:fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 合并后运行 pnpm check:adr-symbol-anchors,预期 0 个发现。
• 需要你做的:规则本身你已于 2026-11-13 批准(无例外,网址写法不兼容),ADR 的 D6 注记已写明;fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 已于 02:27Z 合并。剩下作为 Tier H 受管面,请 os-zhuang 或 hotlong 审阅批准(或你亲手合并)本 PR。合同复核 PASS 评论 6841052407,经 Regen-provenance 6842991874 延至 Head-sha 970b3810a66dbab784c8863084796da2cdedc0f6。
• 席位意见(security#1):接受(ACCEPT 6843182577)。仅文档,与已合并的 fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 规则一致,CI 全绿;获批后由席位翻 ready 并入队。

What changes

docs/adr/0135-identity-and-access-architecture.md, the "Domain verification is opt-in" paragraph, states what verification guarantees:

• the DNS-TXT proof covers every domain a provider lists, a provider signs nobody in until that list is proven, and editing the list clears the proof;
• with verification on, where the platform admits a new account, a provider creates an account only for an email address at a domain it has proven, compared exactly (a subdomain counts only when it is itself listed and verified, and a listed entry counts only for the host the provider proved), failing closed, and relaxed by no audience posture, invitation or JIT toggle; accounts that already exist are not re-checked;
• with the rule that a domain is claimed by one provider at most, held where a provider is registered and where its domain list is edited, an SSO provider creates a new account at a domain only when it is the one provider that claims that domain and has proven it.

The two rule sentences carry symbol anchors (ADR-0135 Provenance point 2): packages/plugins/plugin-auth/src/sso-account-at-proven-domain.ts#refuseSsoAccountOutsideProvenDomain and packages/plugins/plugin-auth/src/sso-provider-lifecycle.ts#findSsoDomainClaim.

Whose rule this is. The exact comparison and the "no posture, invitation or JIT toggle relaxes it" clause are a rule made in this repository, not text carried from cloud ADR-0024. The ADR now says so in a dated note under D6, and "What this record does NOT settle" names that note as the one exception to "this file adds no clause". The maintainer ruled on it on 2026-11-13 (approved, no carve-out; a domain entry counts only when written as a bare host), and the note records that ruling and names #32669 as the PR that implements it.

The code that holds the rule, its tests, the code comments and content/docs/permissions/sso.mdx land in #32669. This PR is separate because docs/adr/** is a Tier H governed surface.

Tests

None: documentation only.

Acceptance notes

• The first anchor names a file that fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 adds, so check:adr-symbol-anchors answers one unresolved-path finding until fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 is on main. That red is the landing order held by a gate: this PR lands after fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669. The second anchor resolves on main today.
• No decision is reversed: the paragraph keeps D6 opt-in and off by default.

Verification

At head 54b1620a02 (5ad86211ce with origin/main merged in, then the anchor commit 4b57a83691, the delta-review fix 0815aea4b7, and the ruling note), node scripts/pm/dispatch-gates.mjs --commands derived 21 families from the 1 changed path; each was run with its exit captured before any pipe.

Gates

• 20 of 21 exit 0, among them check:adr-anchors, check:adr-index, check:adr-links, check:doc-authoring, check:nul-bytes, check:pm-governed-merges, check:pm-prior-rulings, and @objectstack/lint check:doc-formula-expressions (after building the lint closure).
• pnpm check:adr-symbol-anchors exit 1, one finding: [unresolved-path] for sso-account-at-proven-domain.ts#refuseSsoAccountOutsideProvenDomain, the intended red described above. The findSsoDomainClaim anchor resolves.
• dispatch-gates --ran: 21 derived, 21 run, 0 NOT-MEASURED, 0 UNRUN.

---

Generated by Claude Code

[objectstack-fleet]

security#1 · os-elon-musk · session_016WV4cx5nHfga3Hm9BzikGw

Contract-review-claim: session_016WV4cx5nHfga3Hm9BzikGw · head 4b57a83 · 2026-11-13T00:19Z

Delta review of the FAIL on #32638 (record 6839445979: M1, S1) plus a full governed-text review of this head; the lane seat takes it (rules face, CONTRACT_REVIEW_TIER).

[objectstack-fleet]

security#1 · os-elon-musk · session_016WV4cx5nHfga3Hm9BzikGw

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 4b57a83691b9a020e23c97295bef963ea5515e57
Local-runs: none
Scope: docs/adr/0135-identity-and-access-architecture.md + none

The face is rules: one governed path. This is a full review of this head, and the delta on record 6839445979 (#32638: M1, S1). Read: this PR's body, its 1-file list and its net diff against main (12 lines added, 4 removed, one paragraph); #32638's body and its 5 comments; and the 54 check-runs on this head. Read and not reviewed: the first consumer, #32669 at ec3a30773b (body, 10-file list, its non-test diff and the rule module in full); sso-provider-lifecycle.ts and auth-manager.ts on main; and the published @better-auth/sso 1.7.12, the version this tree pins.

① Derived judgments

Each change the diff implies, named right or wrong.

1. No accept set and no public surface moves: one paragraph of a governed record changes. Right.
2. Removed: the sentence that names an organization admin as the registrant. Right: on main, /sso/register admits platform administrators only.
3. Added: the proof covers every domain a provider lists; a provider signs nobody in until the list is proven; editing the list clears the proof. Right against @better-auth/sso 1.7.12 under this tree's sso() options: verify-domain reads every parsed entry of the list, the sign-in door and both callback paths refuse a provider that is not verified, and update-provider resets the flag when the stored domain value changes.
4. Added: the proven-domain rule for a new account. Right against fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 at ec3a30773b, clause by clause: judged at user.validateUserInfo for create-user from an sso-oidc or sso-saml source; equality in one spelling; an entry counted only when written as the bare host; refused on no engine, no row, another provider's row, a failed read, or a flag that does not read on; judged before the linking and audience gates, so no posture, invitation or allowJit reaches it.
5. Added: accounts that already exist are not re-checked. Right: the rule answers nothing for any action but create-user.
6. Added: the sentence resting on "a domain is claimed by one provider at most". Right as far as that rule reaches: findSsoDomainClaim on main refuses a second claim at /sso/register and at a domain edit, and both rules read a list entry through the same providerDomains. Its bound is N2.
7. Added: two symbol anchors. Right. sso-provider-lifecycle.ts#findSsoDomainClaim resolves on main. sso-account-at-proven-domain.ts#refuseSsoAccountOutsideProvenDomain names the path fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 adds and a declaration at its head; it does not resolve at this head, by design (see ④).
8. Kept: off by default. Right: the toggle resolves to false when neither config nor environment sets it.

② Semver level

The skip-changeset label and no changeset. It matches what the diff publishes: one file under docs/adr/**, and no package releases. The body carries no Clause-②: line and none is owed: nothing published widens or narrows, and the face is decided by the governed path. Check Changeset and PR-body guards concluded success. Right.

③ Boundary flags

Check-runs on this head: 54, all completed; 24 success, 28 skipped, 2 failure. The failures are Lint · docs & code guards (52 gates: 51 passed, 1 red) and its roll-up Lint & Repo Gates. The one red gate is "ADR symbol anchors resolve", with one finding: [unresolved-path] at line 265 for the first anchor. Nothing else is red.

• Dev flag, the intended red: right, judged in ④. It is not the carried-red exception of the dispatch skill: that gate runs on merge_group and nothing in source declares it red by design, so this head goes neither to approval nor to the queue while the lane is red.
• Dev flag, the split into two PRs and their order: answered. The order is now held by a gate (M1).
• Dev flag, "whose rule this is": the body now says it, which is what record 6839445979 asked of the body. The file does not say it: S2.
• Dev flag, no declaration lines: right, as ② says.
• N1 of record 6839445979 (the body trailed the head): resolved. This body states the entry clause, the claim sentence and both anchors, and its Verification names this head.
• No open_questions entry on this PR. fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669's open choice (how an entry not written as a bare host is read) does not touch the paragraph: "counts only for the host the provider proved" holds under either answer. fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669's note on the second domain-list parser is not this paragraph's subject and stays with the seat.
• Escalated to the maintainer. The body rests the rule on this PR's approval. The plan lands the rule's behaviour first: fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 is the seat's to land, and this PR is held behind it by its own gate, so when this PR can be put up for approval the rule is already on main. The approval then ratifies the rule; it does not precede it. If the maintainer's word is meant to come before the behaviour changes for deployments with verification on (the changeset's "Who moves"), it has to be asked on fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669, or before it lands. That choice is the maintainer's.
• Independence: the head was produced on claude/project-thread-ab4lnt. This record was rendered by an isolated reviewer and is adopted by the seat that also holds fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669; fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 is read here and not reviewed.
• Author: objectstack-fleet[bot]. Draft, no auto-merge armed, Governed Surface Queue Guard success.

④ Design judgment

The delta on record 6839445979.

• M1: resolved. The rule sentence carries packages/plugins/plugin-auth/src/sso-account-at-proven-domain.ts#refuseSsoAccountOutsideProvenDomain, the anchor that record named. The file's Provenance promise (every mechanism claim anchored into this tree) is met for it, and the tie between the sentence and its code is now read by a gate.
• S1: resolved. The claim sentence carries packages/plugins/plugin-auth/src/sso-provider-lifecycle.ts#findSsoDomainClaim, which resolves on main.

The delta between 5ad86211ce and this head, in the governed file, is those two anchors and nothing else.

Is the red right? Yes. The gate reports a true fact about this head: the tree does not hold the code the sentence describes. It clears with no edit to this PR once #32669 is on main and main is merged in, and it runs on merge_group, so the order holds at the queue as well as on the PR. No anchor-exempt marker is used, and none should be. Two conditions follow. This record read #32669 at ec3a30773b: if #32669 lands from another head, the four rule clauses are re-read against what landed. And the green head that follows is a new head, which the seat accounts for under the head-move rule.

The ADR against its first consumer. The 5 changed sentences were read against #32669 and the vendor code, as ① lists, and each holds. verify-domain proves, for each entry, the host the vendor's own parser reads from it; #32669 counts an entry only when it is already written as a bare host in its one spelling. So "counts only for the host the provider proved" holds as the upper bound it states: an entry counts for that host or for nothing. For an internationalised entry this rests on the vendor's host parser (tldts), which was not read.

The ADR against its own file.

• should-fix S2. The file does not say whose rule this is. By the body's own account the proven-domain rule is made in this repository and rests on this approval, and no input read here attributes it to cloud ADR-0024 or to a ruling. The file frames the paragraph otherwise: its Status says nothing is decided in it; the Decision preamble calls each clause cloud ADR-0024's; the paragraph opens as that record's clause ②; "What this record does NOT settle" says the file adds no clause; and Provenance says that where the file and the cloud record differ, the file is the bug. So a reader holding only the tree reads the rule as cloud's, or as a mirror defect to correct, and the approval meant to be the word on it leaves no trace in the tree. The file already has a form for a rule made here: the two dated Notes under D4 (2026-10-23 and 2026-11-12), each naming its authority and closing "Cloud ADR-0024's own text is not amended here". What the text must hold: the same for this rule, in a dated note under the paragraph or one clause in it, saying that the proven-domain account rule is this repository's, made with fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 and approved with this change, and that cloud ADR-0024's text is not amended. "plugin-auth's rule" says where the mechanism lives; it does not say who decided it.
• nit N1. "When the environment turns it on" opens the second sentence and is carried by context through the next three, and "It is off by default" now sits four sentences from "Domain verification". The rule sentence read alone has no condition; the code has one. A reader of the whole paragraph is not misled. An accepted deviation, or two words ("with it on") in the S2 edit.
• nit N2. "A domain is claimed by one provider at most" is stated without its bound: it is a check at /sso/register and at a domain edit, and the anchored module header names what that check does not close. The anchor is what takes the reader there. An accepted deviation.
• nit N3. fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669's body still names docs(adr-0135): with SSO domain verification on, a provider creates an account only at a domain it has proven #32638 as the ADR PR. docs(adr-0135): with SSO domain verification on, a provider creates an account only at a domain it has proven #32638 is closed and points on to docs(adr-0135): with SSO domain verification on, a provider creates an account only at a domain it has proven #32951. A body edit on fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669; no head moves.

No must-fix. The delta owed is S2: one note, or one clause, in the same paragraph.

Implemented-by: claude/project-thread-ab4lnt
Reviewed-by: session_016WV4cx5nHfga3Hm9BzikGw

VERDICT: PASS

[objectstack-fleet]

security#1 · os-elon-musk · session_016WV4cx5nHfga3Hm9BzikGw

Contract-review-claim: session_016WV4cx5nHfga3Hm9BzikGw · head 0815aea · 2026-11-13T00:42Z

Delta review of S2, N1, N2 (record 6840140663) by the same reviewer.

[objectstack-fleet]

security#1 · os-elon-musk · session_016WV4cx5nHfga3Hm9BzikGw

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0815aea4b701eef3e726ec24b8a5f18d3508e3eb
Local-runs: none
Scope: docs/adr/0135-identity-and-access-architecture.md + none

This is the delta on record 6840140663 (head 4b57a83691: S2, N1, N2). Read: the diff between 4b57a83691 and this head (one commit, one file, 17 lines added, 7 removed), this PR's refreshed body and its 1-file list, and the 48 check-runs on this head. The code read for record 6840140663 was not re-read, except auth-manager.ts and register-sso-provider.ts on main for the one new mechanism phrase. Where this record is brief, that record's ①–④ stand.

① Derived judgments

1. No accept set and no public surface moves: the delta is prose in one governed record. Right.
2. Changed: "With it on" now opens the rule sentence, and the last sentence names its subject, "Domain verification is off by default". Right: the rule answers nothing while verification is off.
3. Changed: the claim rule is "held where a provider is registered and where its domain list is edited". Right against main: the before-hook asks findSsoDomainClaim on /sso/register and on a domain edit on /sso/update-provider, and the admin form doors re-dispatch through /sso/register.
4. Added: a dated note under the paragraph naming the proven-domain account rule as this repository's own, and the matching exception in "What this record does NOT settle". Right; N4 and N5 are on its wording.
5. Unchanged: both anchors (the first is still at line 265), and every mechanism sentence judged in items 2 to 8 of record 6840140663. No mechanism sentence changed meaning.

② Semver level

Unchanged. The skip-changeset label and no changeset; one file under docs/adr/**; no package releases; no Clause-②: line and none owed. Check Changeset skipped on this head, and PR-body guards concluded success. Right.

③ Boundary flags

Check-runs on this head: 48, all completed; 24 success, 22 skipped, 2 failure. The failures are the same two as on 4b57a83691: Lint · docs & code guards (52 gates: 51 passed, 1 red) and its roll-up Lint & Repo Gates. The one red gate is "ADR symbol anchors resolve", with the same single finding: [unresolved-path] at line 265 for the first anchor. None is pending.

• The intended red: unchanged and still right, on the terms of record 6840140663. This head goes neither to approval nor to the queue while the lane is red, and that record's two conditions carry over: fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 was read at ec3a30773b, and the green head that follows is a new head.
• The body is refreshed to this head: it names the note and the exception, and its Verification names 0815aea4b7. It says this PR's approval is the word on the rule; the note says the ruling is pending and is the rule's authority. The two agree today.
• Escalated to the maintainer, carried from record 6840140663 and unchanged. The plan lands the rule's behaviour (fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669) before this PR can be put up for approval. The file now states the other half itself: the rule's authority is a ruling that is pending. Whether fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 lands before that ruling is given is the maintainer's choice.
• Independence, author, draft state and Governed Surface Queue Guard (success): as in record 6840140663. No auto-merge is armed.

④ Design judgment

The delta on record 6840140663.

• S2: resolved. The note says whose rule this is (this repository's), that it is not a clause of cloud ADR-0024, and that the cloud record's text is not amended. It puts the rule's authority in a ruling and not in the file, which keeps the file's Status true (nothing is decided in it). "This file adds no clause" now names its one exception. A reader holding only the tree no longer reads the rule as cloud's, or as a mirror defect to correct. The Decision preamble's "each clause below" and Provenance's "this file is the bug" are answered at the clause by the note; no further edit is asked.
• N1: resolved. The condition is bound to the rule sentence, and "off by default" has its subject back.
• N2: resolved. The claim rule carries its bound, and the bound matches the code.

Does the new text introduce anything wrong? No. Two wordings reach a little further than the file supports; neither changes the rule or who decides it.

• nit N4. "The one clause this file records that the cloud record did not decide" is true only in the file's own usage. The two Notes under D4 also record things made in this repository, each under a ruling of record, and what the cloud record did not decide is known here only at the granularity of its decision list (Provenance point 2). "The one clause here that rests on no ruling of record" would be exact. An accepted deviation.
• nit N5. The note names no record: neither fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669, which makes the rule, nor where the ruling is asked. The two Notes under D4 name theirs. It will land reading "pending". A follow-up: when the ruling is given, the note takes its record id, by a one-line governed edit or by the maintainer's amendment at merge.

Line 261 runs to 113 columns, the file's only line over 110. Cosmetic; no gate on this head flagged it.

No must-fix and no should-fix. Nits alone end the round.

Implemented-by: claude/project-thread-ab4lnt
Reviewed-by: session_016WV4cx5nHfga3Hm9BzikGw

VERDICT: PASS

[objectstack-fleet]

security#1 · os-elon-musk · session_016WV4cx5nHfga3Hm9BzikGw

Contract-review-claim: session_016WV4cx5nHfga3Hm9BzikGw · head 54b1620 · 2026-11-13T01:02Z

Delta review of N4, N5 and the ruling now cited in the D6 note (record 6840500717), same reviewer.

[objectstack-fleet]

security#1 · os-elon-musk · session_016WV4cx5nHfga3Hm9BzikGw

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 54b1620a026f6b23c3358f15ab26856a156c29d2
Local-runs: none
Scope: docs/adr/0135-identity-and-access-architecture.md + none

This is the delta on record 6840500717 (head 0815aea4b7: N4, N5). Read: the diff between 0815aea4b7 and this head (one commit, one file, 5 lines added, 3 removed, all inside the D6 note), this PR's refreshed body and its comments, the 48 check-runs on this head, and, for the ruling the note now cites, #32669's comments. Read and not reviewed: #32669 at its current head c4c70109fe, where the rule module is the blob this review read at ec3a30773b (record 6840981958 there). Where this record is brief, records 6840140663 and 6840500717 stand.

① Derived judgments

1. No accept set and no public surface moves: the delta is 5 lines of one note in a governed record. Right.
2. Changed: "the one clause this file records that the cloud record did not decide" becomes "like the repository-side facts the D4 notes record". Right: the two Notes under D4 do record things made in this repository, and the note no longer claims to be alone.
3. Changed: "the ruling is pending" becomes a ruling given: approved by the maintainer on 2026-11-13, with no carve-out, and with a domain entry counting only when written as a bare host name. Right against the record of it on GitHub, the seat's ACCEPT on fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 (comment 6840983842), which dates the ruling 2026-11-13 00:52Z and quotes the option chosen. Not checkable at its source: ③.
4. Added: "an entry written as a URL or with a port proves nothing". Right against fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669: the rule counts an entry only when it is already a bare host in its one spelling, one trailing root dot allowed. The paragraph's own clause ("counts only for the host the provider proved") was neutral between the two ways of reading an entry; the note now fixes the one the code holds and the ruling chose.
5. Added: "fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 implements it". Right, and true of main by the time this text can be there: the first anchor keeps this PR behind fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669.
6. Unchanged: the paragraph, both anchors (the first still at line 265), the exception in "What this record does NOT settle", and "That ruling, not this file, is its authority", which keeps the file's Status true.

② Semver level

Unchanged. The skip-changeset label and no changeset; one file under docs/adr/**; no package releases; no Clause-②: line and none owed. Check Changeset skipped on this head, and PR-body guards concluded success. Right.

③ Boundary flags

Check-runs on this head: 48, all completed; 24 success, 22 skipped, 2 failure. None is pending. The failures are the same two as on the two heads before: Lint · docs & code guards (52 gates: 51 passed, 1 red) and its roll-up Lint & Repo Gates. The one red gate is "ADR symbol anchors resolve", with the same single finding: [unresolved-path] at line 265 for the first anchor.

• The intended red: unchanged and still right, on the terms of record 6840140663. This head goes neither to approval nor to the queue while the lane is red; the green head that follows fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669's landing is a new head.
• The ruling is not an input this review can read at its source. It was given on a decision card outside the repository. What this review read is its record on GitHub: the seat's ACCEPT on fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 (comment 6840983842), a relay that quotes the option chosen. The note agrees with that relay on the date, on "no carve-out" and on the entry clause. The check on the sentence itself is the tier: docs/adr/** lands only by the maintainer's own hand, the body's first section tells the maintainer the note says the rule is already approved, and the sentence lands only if the maintainer, reading it, merges.
• The escalation carried from records 6840140663 and 6840500717 is answered. It asked whether the maintainer's word comes before fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 puts the rule on main. By the record above it was given on 2026-11-13, and fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 has not landed.
• fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669's open choice (how an entry not written as a bare host is read) is closed by the same ruling, and the note states the answer.
• The body is refreshed to this head: it names the ruling, the note and fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669, and its Verification names 54b1620a02. One stale phrase: N7.
• Independence, author, draft state and Governed Surface Queue Guard (success): as in record 6840140663. No auto-merge is armed.

④ Design judgment

The delta on record 6840500717.

• N4: resolved. The uniqueness claim is gone, and what replaces it is true of the file.
• N5: resolved in substance. The note no longer lands reading "pending", it names fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 as the PR that implements the rule, and it says where and when the ruling was given. What remains is N6.

Does the new text introduce anything wrong? No. Each new clause was read against #32669's rule module and against the relay of the ruling, and each agrees with both. The note states the ruling's content and adds no mechanism the paragraph's anchor does not already reach: the entry rule lives in the anchored module, sso-account-at-proven-domain.ts.

• nit N6. The note names the ruling's place by description ("the security lane's decision card"), which a reader holding only the repository cannot open. The two Notes under D4 cite a record id. The record exists and is one step away, through fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669: comment 6840983842 there. Citing that id in the note would close the gap. An accepted deviation, or one clause in a later governed edit.
• nit N7. The body's "先看" line still calls the paragraph the only change; the diff also holds the note and one line of "What this record does NOT settle". A body edit; no head moves.

No must-fix and no should-fix. Nits alone end the round.

Implemented-by: claude/project-thread-ab4lnt
Reviewed-by: session_016WV4cx5nHfga3Hm9BzikGw

VERDICT: PASS

[objectstack-fleet]

security#1 · os-elon-musk · session_016WV4cx5nHfga3Hm9BzikGw

Regen-provenance: 6841052407 · 54b1620 → 970b381 · relay pr_update_branch (merge of main, 45 behind; main touched no file of this PR, so the net diff against main is identical before and after) → (empty)

The merge brings in #32669, which the lint anchor in this ADR was waiting on.

[objectstack-fleet]

security#1 · os-elon-musk · session_016WV4cx5nHfga3Hm9BzikGw

席位核对 — ACCEPT · security#1 · head 970b3810a66dbab784c8863084796da2cdedc0f6

• 形态: docs-only, one file docs/adr/0135-identity-and-access-architecture.md (+25/−5). Governed surface docs/adr/** ⇒ Tier H: approval by a governed approver (os-zhuang or hotlong), or a direct human merge.
• 前提实测: the code PR fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 that the two new symbol anchors point at merged 2026-11-13T02:27Z; both anchors now resolve on main.
• 契约复核: contract review chain on this ADR ends with delta PASS 6841052407 at 54b1620a02 (nits N6/N7 accepted). Carried to this head by Regen-provenance 6842991874 (relay update-branch merge of main; main touched no file of this PR, so the net diff is identical).
• 门禁 check-runs: every check-run on 970b3810 green (25 success, 19 skipped). The Lint · docs & code guards red at the old head was the intended landing-order hold and cleared once fix(plugin-auth)!: with SSO domain verification on, a provider creates an account only for an email address at a domain it has proven #32669 was on main.
• 接受的偏差: none beyond the nits in 6841052407.
• 范围外去向: bare-hostname-on-write follow-up feat(plugin-auth): an SSO provider's domain list takes bare hostnames only, refused at register and edit #32960; SCIM parse unification fix(plugin-auth): every rule that reads an SSO provider's domain list reads each entry the same way #32975 (both pm:queue).
• 落地条款: the maintainer's ruling (2026-11-13, approved with no carve-out; a domain entry counts only as a bare host) is recorded in the ADR's D6 note. Remaining: a governed approver's review approval, then the seat marks ready and queues; or a human merges directly.