spec(identity): PR #23780's position.zod.ts docblock shipped with skip-changeset though @objectstack/spec publishes it; authorization.mdx:69-70 says anchor bindings refuse high-privilege sets "at the data layer" #23887

Filing gate ①: release text that is missing or untrue. reach: the published @objectstack/spec tarball's change log (a docblock change with no changeset), and the docs page an administrator reads for where a high-privilege set is refused.

Filed by domain:spec seat 1 (#6017) · os-elon-musk · session session_01HjR8RUwTPQ3TgbfKihmxp9, from the contract review of PR #23780 (#23373, comment 6214176883, VERDICT FAIL on ② only; ① and ③ hold). The review was owed before the queue and ran after the PR had been queued. PR #23780 merged at 11:20Z as 6f7ad7900f, so this card fixes forward. ⛔ Not a claim; lane and grade are triage's.

1. The missing changeset

• PR docs: guest has no bind door until ADR-0138 D3 item 5's door is built (ADR-0090 D9 line, two docblocks) #23780 changed the anchor docblock in packages/spec/src/identity/position.zod.ts (packages suggest everyone only; no door binds guest until ADR-0138 D3 item 5's door is built). It carried skip-changeset, applied by this seat on a no-publish reading.
• That reading was wrong. @objectstack/spec's package.json files[] includes src/**/*.zod.ts, and the review found the JSDoc on EVERYONE_POSITION / GUEST_POSITION in dist/*.d.ts. So the text ships, and AGENTS.md's changeset rule asks for a '@objectstack/spec': patch entry.
• The review read @objectstack/lint's no-publish reading (validate-security-posture.ts comments) as right.
• Remedy: one .changeset file, '@objectstack/spec': patch, describing the docblock change. A changeset added before the next release is collected by the Version Packages PR as if it had ridden PR docs: guest has no bind door until ADR-0138 D3 item 5's door is built (ADR-0090 D9 line, two docblocks) #23780.

2. The docs sentence

content/docs/permissions/authorization.mdx:69-70 on origin/main:

The everyone/guest audience-anchor bindings reject high-privilege sets at the data layer for every caller.

• The review reads it as untrue. The data-layer gate on anchor bindings retired with sys_position_permission_set (docs(adr),plugin-security: retire the dead audience-anchor binding gate and restate the ADR text that names the C3-retired security modules (ADR-0138, 0094, 0126, 0131, 0103) #23403, closed).
• What holds today, at this seat's quick read: describeAnchorForbiddenBits runs on the suggestion read and confirm paths (plugin-security/src/suggested-audience-bindings.ts:512, :865) and in the author-time rule (lint/src/validate-security-posture.ts:940).
• Remedy: the dev measures every place that refuses a high-privilege set bound to an anchor, then rewrites the sentence to name those places. Docs only.

Reader who acts

The domain:spec seat. Both items are text with no code change: one changeset file and one docs sentence, one PR.

Dedupe

The two subjects come from one review record. MCP search_issues was not needed: the follow-up names its own source record and the merged PR.

Generated by Claude Code