From cb602a03b3d2b1a092f544d8c65de6cebb212c52 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 17 Sep 2026 11:58:49 +0000 Subject: [PATCH] =?UTF-8?q?docs(core):=20re-key=20the=20=C2=A76b-config=20?= =?UTF-8?q?posture-gate=20comment=20to=20the=20ruling=20it=20cites?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The comment justifying the posture gate on the legacy-grant deprecation notice stated the PRE-reversal rule as current fact — "the `single` promotion is pinned NEVER to consult that variable" — and cited bootstrap-platform-admin-walled-owner.test.ts as live support for it. The maintainer ruling of 2026-09-08 (decision batch #100, recorded on #16682) reversed exactly that point: under `single` posture the first-boot promotion consults OS_PLATFORM_OWNER_EMAIL first. The cited string survives in that test only inside its re-authored block's account of what the case USED to assert, so a reader following the citation landed on text contradicting the comment that sent them there. Re-keyed to the post-ruling behaviour, with the citation re-pointed at what the pin records now, and the neighbouring "whichever way Choice 4B is eventually ruled" clause corrected: 4B is ruled and filed, not landed. The gate's actual justification is restated from what the reversal did NOT change — the declared-owner leg mints the same unscoped admin_full_access row, and a rig already holding one answers already_have_admin before that leg runs — so the migration notice stays scoped to walled rigs. Comment-only: no behaviour, no assertion, no logic touched. Co-authored-by: Claude Claude-Session: https://claude.ai/code/session_01CqmCgU5RGDoJYhHUMVp2af --- .../src/security/resolve-authz-context.ts | 43 ++++++++++++++----- 1 file changed, 32 insertions(+), 11 deletions(-) diff --git a/packages/core/src/security/resolve-authz-context.ts b/packages/core/src/security/resolve-authz-context.ts index 2695db85c45..112da35d248 100644 --- a/packages/core/src/security/resolve-authz-context.ts +++ b/packages/core/src/security/resolve-authz-context.ts @@ -998,17 +998,38 @@ export async function resolveUserAuthzGrants( // detector (`plugin-security/src/bootstrap-platform-admin.ts` §2, which // spells the same `postureEnforcesWall(resolveTenancyPosture())`). Under // `single` — the DEFAULT posture — `bootstrapPlatformAdmin` MINTS this very - // row to promote the first human user, and Choice 4A rules that promotion, - // and its row, correct and UNCHANGED. Both halves of the notice are - // therefore false for such a rig: the row is not "removed in a later - // release", and re-anchoring through the config line gets the operator - // nothing, because the `single` promotion is pinned NEVER to consult that - // variable (`bootstrap-platform-admin-walled-owner.test.ts`, "never - // consults the owner-email variable"). That holds whichever way Choice 4B - // (#11979) is eventually ruled: under 4A the row is that rig's permanent - // anchor, and under 4B the advice only becomes true once 4B actually lands. - // So the migration window's loudness is scoped to the rigs actually in it — - // the walled ones, where the row really is the LEGACY anchor. + // row, so the notice's FIRST half is false for such a rig: the row is not + // "removed in a later release", it is the row that rig's own boot writes. + // Choice 4A rules that promotion, and its row, correct, and the maintainer + // ruling of 2026-09-08 (decision batch #100, on #16682) left that standing + // while re-keying WHO is promoted — verbatim: "The rest of Choice 4A + // (#11974, 2026-08-25) stands: retiring the walled write must not retire + // the `single` one, and the over-denial invariant (`adminPromoted === true` + // with a grant row minted) stays pinned." + // + // ⚠️ The SECOND half — "Re-anchor this deployment by declaring its + // administrators in configuration" — is NOT inert under `single`. The same + // ruling, verbatim: "Under `single` posture the first-boot promotion + // consults `OS_PLATFORM_OWNER_EMAIL` first." So a declaration DOES decide + // the `single` promotion, and the pin records THAT now: + // `bootstrap-platform-admin-walled-owner.test.ts` asserts "a declared owner + // DOES redirect the single-org promotion (#16682)". ⛔ The string "never + // consults the owner-email variable" survives in that file ONLY inside the + // re-authored block's account of what the case USED to assert — ⛔ never + // cite it as live support for the pre-ruling rule, which is what an earlier + // revision of THIS comment did (#18380). + // + // What the reversal did not change is the thing this gate turns on: + // declaring the variable does not move a `single` rig OFF the grant row. + // The declared-owner leg mints the same unscoped `admin_full_access` row + // (one `promote()` call site serves both legs), and a rig that already + // holds one never reaches that leg — the existing-admin check answers + // `already_have_admin` before it. Choice 4B (#11979) is the card that would + // end that, and it is ruled and filed, ⛔ not landed (#11663 comment + // 5404675670, verbatim: "4B is ruled as the sequenced follow-up, not + // dropped"). So the migration window's loudness is scoped to the rigs + // actually in it — the walled ones, where the row really is the LEGACY + // anchor. // // ⛔ This gates the NOTICE and nothing else. Standing is derived by the // `if (configConfersPlatformAdmin) / else if (hasPlatformAdminGrant)` chain