[maintainer] refactor(plugin-security): split src/security-plugin.ts (10,746 lines, +2,803 in 30 days) along its SecurityPlugin seams, one move-only slice per PR #25223

Filing gate ③: a task the maintainer dispatched, quoted verbatim below. Filed by domain:cli seat 1 (seat post #6024) · os-sales · session session_01CxBKycaiUpA1yGx1XyoGqX, as the restart act of #24586. ⛔ Not a claim.

The maintainer's words, verbatim (#24586, recorded in 6270097840): 「24586 同意A，是否建议这波分拆等 v18 发布之后再处理。」 The restart condition (npm @objectstack/spec latest ≥ 18.0.0) was read true by triage in 6291735609. The ruling's restart act: "one [maintainer] card per file over 10,000 lines into its owning lane … Each card starts with a fresh seam measurement taken at that time, in #23050's shape." This file was under the line at the ruling (7,943 lines 30 days ago) and is over it now, so the ruling's per-file rule covers it.

Reader who acts: the domain:services seat (packages/plugins/plugin-security is that lane's), one dispatch per slice.

Measured (on origin/main 123ff6f4e, 2026-10-22)

History note: this clone's history starts 2026-09-17, so "total" commit counts are lower bounds; the 7- and 30-day windows are complete, and git blame --since=2026-09-22 agrees with a diff against the last pre-window commit fa2980341 to within 7 lines.

• Size and churn: 10,746 lines (7,943 thirty days ago: +2,803, +35.3%). 20 commits in 7 days, 98 in 30 days. git blame --since=2026-09-22 attributes 4,847 lines (45.1%) to the last 30 days.
• Structure: a 1,247-line module preamble, then one SecurityPlugin class (9,499 lines, 124 members). start() alone is 3,197 lines: setup and service registration, the main ql.registerMiddleware authz middleware (2,203 lines), a second middleware, bootstrap and the org-admin auto-grant. The largest sections:

• Shared state a split must pass: ql (61 refs), permissionEvaluator (57), logger (43), resolvePermissionSetsForContext (30), tenancyPosture (27), the field-name and CBP caches. The start() middleware closes over locals and calls into nearly every later section, so it is the costliest slice; the CBP, RLS and read-filter sections share the caches.
• What reads it by path: 9 scripts/ files, including the ADR anchor scripts/adr-anchors/packages__plugins__plugin-security__src__security-plugin.ts.json (ADR-0055, ADR-0106, ADR-0123, ADR-0138; its invariant names resolveCbpRelation, which a CBP slice moves), check-position-name-fold-loaders.mjs, check-system-context-census.mjs, symbol-anchors.mjs and three contract baselines; 28 files under content/ and docs/; 171 test files.
• In flight: 2 of the 10 open PRs touch the file: fix(objectql,plugin-security): the write preview answers a row's organization from the tenant wall's own verdict #25215 (draft, +560/−297) and fix(plugin-security): a controlled_by_parent detail's read scope is the engine's ReadableIds leaf over its master (ADR-0139 D6, seventh consumer); Q2 A in service-analytics; the Turso remote nested leaf #25198 (draft, +191/−191, the CBP read scope). Slices touching their regions wait for them.
• ⚠️ This is a permission boundary. Move-only is the whole contract here: a slice that changes any verdict is out of scope.

The ask (from #24586's ruling and #23050's shape)

1. Split along the existing seams, one area per PR. Each slice is move-only: no logic changes.
2. Shared state stays explicit: moved code reaches the class's shared members through one named context object. ⛔ Not a second copy of a helper, ⛔ not a re-derivation.
3. Every slice proves it moved nothing: every gate, baseline, ADR anchor and docs anchor that reads the file by path is migrated in the same PR and stays green. ⛔ A gate whose target moved must not go silently empty.
4. Serial with the file's in-flight PRs (a slice waits for an open PR on the same region, or the PR merges main after the slice).
5. ⛔ No new gate.

Not in this card

Any behaviour change. A design change to the shared members beyond giving them an explicit context. Splitting files in other lanes (#24586 hands those to their own seats).

Dedupe

MCP search_issues on this repository, closed included: "split large file move-only service-automation engine.ts security-plugin.ts auth-manager.ts decompose modules" → 2 hits: #24586 (the ruling this card carries out) and #23050 (closed, rest-server.ts). New.

Generated by Claude Code