Repository navigation
cloud-connection: on a platform-managed runtime, bind/start and bind/poll still run, so a device bind persists a credential the service key shadows and can move the cloud-side connection row #25113
Description
Filing gate ①: a product defect with a named location and a measured reading. Filed by domain:cli seat 2 (seat post #22648) · os-justin · session session_01LmjU2x1faLZ39DVTFyVca6. The source is the CONTRACT_REVIEW_TIER review of record on PR #25110 (#25097), out-of-scope finding 1. ⛔ Not a claim.
Reader, and what they do: domain:cli seat 2 dispatches it when p3 is in this lane's dispatch scope, or sooner if the maintainer re-grades it. Today the maintainer's scope is p1/p2 only.
What
#25097 (PR #25110, ruling 甲) made a runtime holding the env service key platform-managed. Such a runtime registers no Cloud Connection page and refuses unbind. Its other two doors are unchanged:
bind/startandbind/poll(packages/cloud-connection/src/cloud-connection-plugin.ts) still run on a managed runtime for a caller holdingsetup.access.- A completed device bind persists a local credential that
credential()never presents, because the service key wins. - The bind presents the service key to the control plane, so it can move the environment's cloud-side connection row through a door this runtime cannot act on.
- A completed device bind persists a local credential that
- Reading: PR fix(cloud-connection)!: a runtime holding the env service key is platform-managed: no Setup page, disconnect refused; the entry moves to Integrations #25110's managed CONTROL in
cloud-connection-setup-access.pin.test.tsshows the device credential persisted on a keyed mount, and the refusedunbindthen leaves it in place. - Reach: no product page reaches these doors on a managed runtime, because the page is not registered there. They are public routes, so a caller holding
setup.accesscan drive them directly.
Shape (for the dev to measure, not decided here)
- Under the same predicate (
platformManaged),bind/startandbind/pollrefuse asunbinddoes: 409RESOURCE_CONFLICT, after the identity andsetup.accesschecks and before any control-plane call or store write. Pins cover both shapes. - This interacts with the maintainer's open question from the same review: whether the doors should follow the Integrations group's
manage_platform_settings. If that ruling changes the doors' gate, this card's refusal sits behind it.
Dedupe
One MCP search_issues query returned 4 hits: #25097 (this card's source, open), #24150, #24148 and #14514 (closed, different defects). New.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 21, 2026
Folded ·
domain:cliseat 2 ·os-justin· sessionsession_01LmjU2x1faLZ39DVTFyVca6· 2026-10-21T13:48Z. ⛔ Not a claim.This card's fix rides with #25119 (p2): ruling 乙, the maintainer's answer in this seat's session chat, 「乙 统一成一套」. That card's managed-runtime item makes
bind/startandbind/pollrefuse asunbinddoes, and its PR carriesFixes #25113. This card stays open until then. It is not dispatched separately.Generated by Claude Code
objectstack-fleet commentedon Oct 21, 2026
Claim: PM loop round 1 ·
domain:cliseat 2 · p3 · folded into #25119 (ruling 乙), whose claim6327811194carries the chain's full serial-constraint check · 2026-10-21T23:51ZSession:
session_01AFrKwndmrCLtF5V9hNtrw3Account:
os-bill(the seat's linked user asGET /useranswers it; always the card's assignee)Branch:
claude/issue-25119-cloud-connection-one-ruleWorktree:
objectstack-issue-25119Domain:
domain:cliSeat:
domain:cli#2(seat post #22648)File surface: the chain head's (#25119, claim
6327811194). This card's item, a managed runtime refusingbind/startandbind/poll, is built in PR #25143 (Fixes #25113on its own line).Container & model:
M,mode:subagent,model: default tier(dispatch-gates.mjs --tierat60b42cd0b: "no path-derived mandate")Clause-②: no (narrowing)
Responsibility: this lane's
packages/cloud-connection; the platform path that already covers it isunbind's managed refusal; it reaches every platform-managed runtime's bind doors.Thread-read: 6317706016
Serial constraints cleared: see the chain head's claim
6327811194; no open PR other than PR #25143 touchespackages/cloud-connection/**.Generated by Claude Code
objectstack-fleet commentedon Oct 22, 2026
Landed with #25119 ·
domain:cliseat 2 · sessionsession_01AFrKwndmrCLtF5V9hNtrw3· 2026-10-22T01:10Z. PR #25143 merged asc71d03a5a(onorigin/main); this card closedcompletedby itsFixes #25113line;pm:dispatchedremoved. A platform-managed runtime now refusesbind/startandbind/poll409RESOURCE_CONFLICT, as it refusesunbind.Generated by Claude Code