qa(checklist): access-security — 65 ledger edits from the 18.2.0 release sweep (#25807) #25835

Filing gate: maintainer-directed task. Filed by the 18.2.0 release-assessment thread · session_01G3h9iZTpL8aCiXbfsp8H5u. ⛔ Not a claim, ⛔ not dispatched.

Maintainer's words (project thread, 2026-10-25, verbatim): 22:54Z 「约 300 条清单准确性问题：是不是应该开卡？」, then 22:55Z 「写issue，不派发」.

Parent: wave anchor #25807 (18.2.0 release test sweep). RUNNER's extraction obligation parks checklist-accuracy findings on the anchor; the maintainer asked for them as issues, so the wave's findings are split into one card per ledger file and the anchor links each card. This is not a release blocker, so it carries no target:v18.

Reader who acts: the lane owning docs/qa/platform-checklist/** (domain:devx). Dedupe (open and closed): no card holds these lines; the 18.0 precedent closed its accuracy rows on its anchor #24579.

Wanted

For each line below, edit docs/qa/platform-checklist/areas/access-security.json: revise the item's text, bump its revision, and append a history entry citing the run record the line comes from. Keep pnpm check:platform-checklist green. A line that turns out to describe a product defect rather than stale text gets its own card instead of a ledger edit.

Findings (65)

From #25812 — priority:P0, 23 items, at 6679644a, pin b41ed7f68956

• access-security.crud-permission-matrix knownGaps[1]: a plain member reads the whole org sys_user directory, not a self-scoped row (sys_account / sys_session are the self-scoped ones); the pin header says 6 delegate × sys_* rows, the matrix has 4.
• access-security.walled-environment-metadata-operator-only: steps name showcase objects while the wall-* dogfood pins boot the CRM app — worth stating in the item.

From #25815 — release-18.2.0-tier1, 156 items, at 6679644a, pin b41ed7f68956 (clause labels: aK = acceptance[K], nK = negative[K])

• access-security.activation-write-operator-gate a0/n2: ref claims the 'full posture x identity matrix' but automation-activation-posture-gate.test.ts has no caller-without-manage_metadata case; FLOW_ENABLEMENT_DENY_MESSAGE is asserted by no test in the repo
• access-security.activation-write-operator-gate a1: action-activation-posture-gate.test.ts › REFUSES a caller without manage_metadata, in every posture asserts only toContain('manage_metadata') at the unit layer — not the 'functionally equivalent to deleting it' rationale nor 'a packaged action' subject, and it runs only single
• access-security.activation-write-operator-gate a3: packages/qa/dogfood/test/packaged-activation-ledger-reach.dogfood.test.ts (not in ref) asserts one deployment-level row with no tenant column over HTTP, but as the dev admin, not a manage_metadata-without-platform_admin persona
• access-security.activation-write-operator-gate a5: boot-log restart re-hydration corroboration is not covered by any pin (test half only)
• access-security.anonymous-deny-surfaces a4: pin's /meta member contrast is .not.toBe(401), clause demands 200
• access-security.anonymous-deny-surfaces a5: ref lists seven families but not the public-forms both-sides contrast; no pin covers it
• access-security.anonymous-deny-surfaces n0: ref does not cover the post-DELETE authed GET /automation/showcase_reassign_wizard 200 read-back
• access-security.anonymous-floor-v18-doors a1: the sweep's EVERYTHING_ELSE expectation checks status 401 + an error envelope, never error.code; UNAUTHENTICATED is asserted only in the unit pins (i18n, settings, api-description), none for /notifications, /keys, /share-links
• access-security.anonymous-floor-v18-doors a3: DOOR_CLASSES[1] (share-link token face) uses REFUSED_WITHOUT_A_SUBJECT, which accepts 401 — the clause's 'not 401' is not asserted by any pin
• access-security.anonymous-floor-v18-doors a2: rest-docs-viewer-retired.pin asserts no registration on RestServer/route manager; no pin compares GET /api/v1/docs to the never-served control path, anonymous and admin
• access-security.anonymous-floor-v18-doors a4: the dogfood submit asserts 2xx and keys ['id'] on the showcase (step 4's forged owner_id/status not sent); exact 201 is asserted only by the Hono-transport pin over a protocol double
• access-security.crud-permission-matrix ref: packages/verify/src/verify.ts / rls.ts (objectstack verify --rls) are a CLI proof, not test files — no pin here drives them; the object-level RLS half is unscored by the dogfood pins.
• access-security.crud-permission-matrix a3: ref says the pin reaches clause 3; it probes only showcase_private_note (inquiry/invoice/invoice_line VAMA reads not asserted).
• access-security.crud-permission-matrix a6: verify text says '45 rows × 4 verbs at revision 6'; the pin judges 41 rows (164 cells) and explicitly excludes the 4 sys_* rows, so clause 6 cannot be pinned whole.
• access-security.crud-permission-matrix ref says 'showcase-permission-zoo pins on both sides' the delegate subtree gate: its out-of-subtree case asserts only non-2xx, not 403 PERMISSION_DENIED as the ref states.
• access-security.crud-permission-matrix ref header comment in the pin says '6 showcase_field_ops_delegate × sys_* rows'; the ref and the pin's own assertion say 4 (2 retired).
• access-security.deployment-tables-platform-only a0: packages/plugins/plugin-security/src/authz-identity-objects-boot-refusal.test.ts asserts SecurityPlugin's boot refusal when sys_user/sys_member/sys_organization are missing — nothing about the seven deployment tables or manage_platform_settings
• access-security.deployment-tables-platform-only a1/a2: no pin drives either door over HTTP; both remain live-run clauses
• access-security.fls-mask-and-strip a2: admin-side budget write (both sides of the lock) is asserted by neither pin, and the ref's STILL MANUAL list does not name it
• access-security.fls-mask-and-strip a0: zoo FLS case asserts the name PATCH status only; the clause's 're-reads changed' leg is unpinned
• access-security.grant-table-write-contract a1/a3/a4: api-oracle clauses are pinned only at the engine layer (real ObjectQL + SqlDriver, errors mapped by resolveThrownHttpError); no pin in the ref drives the /data door over HTTP for them
• access-security.grant-table-write-contract a2: permission-set-assignment-window.dogfood.test.ts › 'the door refuses a window whose end is not after its start…' asserts [400, VALIDATION_FAILED] and fields [[valid_until, rule_violation]] only; the authored message, constraint absent/not 'unevaluable' and the valid-window 201 control are not asserted over HTTP
• access-security.me-permissions-aggregation-parity a2: me-apps-and-everyone-baseline pin asserts only the member side (no gated app); the admin-sees-gated-app half is unpinned.
• access-security.me-permissions-aggregation-parity a3: the anonymous trio's 200 shapes are pinned only in hono-current-user-endpoints.test.ts on a bare HonoServerPlugin with no auth service or auth gate — the 401-floor regression the clause guards is not reachable there; the dogfood anonymous /me/apps case asserts body.apps ?? [] only, never the status.
• access-security.me-permissions-aggregation-parity a5: packages/plugins/plugin-hono-server/src/current-user-endpoints-localization.test.ts asserts the locale/timezone floors (unit) and is not in the ref.
• access-security.meta-authoring-trail-and-audience-gates a2: meta-view-dashboard-audience-gate.test.ts drives RestServer with a mock server/protocol (unit) and covers list pruning + by-name refusal only — no /published, /layers or ?state=draft door, and no /history case for a studio.access holder lacking the view's requiredPermissions
• access-security.meta-authoring-trail-and-audience-gates n0: the 304 assertion ('a caller who no longer holds the capability is never answered a 304…') exists only at the unit layer
• access-security.no-active-org-session-semantics ref prose is stale: it describes a group CONTROL 'a NON-EMPTY membership set lands, even with no active organization'; on this tree that case is 'a NON-EMPTY membership set with NO active organization: an insert has nowhere to land, and is refused the same way' (asserts refusal)
• access-security.no-active-org-session-semantics a1/a2/n1: packages/qa/dogfood/test/no-active-organization-write-refusal.dogfood.test.ts (HTTP 403 naming the missing org + nothing written) exists and is not in the ref
• access-security.no-active-org-session-semantics a3/n0: packages/qa/dogfood/test/sharing-rule-org-less-caller.dogfood.test.ts (plugin-sharing: a manage_sharing holder whose session has no ACTIVE organization reads every tenant's sharing rules (adminOrgScope falls open) #8158 org-scoped manage_sharing holder over HTTP) exists and is not in the ref
• access-security.no-active-org-session-semantics a7 (group, engine layer): packages/plugins/plugin-security/src/no-active-organization-insert-union-scope.test.ts (real ObjectQL + SqlDriver, group refusal and nothing stored) exists and is not in the ref; still in-process, not the live walled boot a7 requires
• access-security.no-active-org-session-semantics ref says the pin 'pins every clause of this item at unit level' — a3, a4, a5, a6 have no case in it at any level
• access-security.org-admin-assignment-boundary n2: the three-posture posture file only exercises admin_full_access out-of-boundary; the full set list (adminScope, platform-capability, org-admin sets, mcp agent ceilings) is asserted only by the unit gate in delegated-admin-gate.test.ts, not per posture
• access-security.owd-sharing-matrix a0: verify's admin re-read of the denied PATCH is not asserted by showcase-private-owd (status only); clause text otherwise pinned; by-id GET asserted as not-200 rather than non-2xx
• access-security.owd-sharing-matrix a2/a3/a5: ref implies all four OWD models pinned, but no pin covers modifyAllRecords bypass, public_read_write, or auditor VAMA
• access-security.owd-sharing-matrix a4: showcase-invoice-cbp boots a test-local fallback set (showcase_cbp_member), not the showcase C1/C2 personas, and asserts no list exclusion; controlled-by-parent.dogfood.test.ts uses a synthetic cbp_account/cbp_note fixture, not showcase_invoice_line
• access-security.parent-and-organization-write-guards a1/a2/n0: the walled organization-removal refusal and the unreadable-header parity are pinned only in-process (engine + SecurityPlugin over SQL drivers, thrown statusCode / resolveThrownHttpError) — the api-oracle legs have no HTTP pin; precedent QA run · tier1:24681-touched (63/82) · 307ce4c4 · 2026-10-20 · 10 PASS / 53 PARTIAL / 0 FAIL / 0 BLOCKED / 19 NOT-RUN #24840 scored them PASS (rev 4) before the layer rule.
• access-security.platform-owner-email-anchor n0: admin-standing-surface.test.ts never asserts ADMIN_STANDING_NON_TABLE_INPUTS (the OS_PLATFORM_OWNER_EMAIL non-table declaration n0 cites); the declaration is unpinned
• access-security.platform-owner-email-anchor a0-a3: ref correctly records these as STILL MANUAL live-HTTP arms; unit pins do not score them
• access-security.public-form-withdrawal-layers a0: ref concedes the no-organization read of step 4 has no end-to-end pin, so a0 cannot score from pins alone (the save 200 /env-wide/ and both doors 404 FORM_NOT_FOUND, landed 0, are pinned)
• access-security.public-form-withdrawal-layers a2-a5: the rest pin is a unit (RestServer over a mocked protocol), the protocol pin an in-process protocol over a stub registry; both fit the [test] oracle
• access-security.record-access-explain a1: ref 'explain vama_bypass case' asserts vama_bypass via in-process security.explain() (isSystem context), not the POST /api/v1/security/explain door the oracle names
• access-security.record-access-explain a2/a3/n0: pin has no plain-member (deny-side) explain call; only the GET denial half is pinned
• access-security.record-view-read-audit n0: the item says the ledger failure is 'reported once per process'; read-audit.test.ts '[finding] plugin-audit: a THIRD copy of both #15166 defects lives in read-audit.ts — process-wide boolean plus an unconditional datasource remedy #18247' cases pin once per CAUSE (a second distinct cause reports again at error) — item text is stale.
• access-security.record-view-read-audit a4: verify cites sys_job as the excluded name; the pin probes sys_audit_log / sys_session, and no pin observes the AuditPlugin install line ('record-view auditing installed on N object(s)').
• access-security.rls-both-sides a4: ref names packages/verify/src/rls.ts, a source file, not a test; no pin runs runRlsProofs over the showcase (rls-fixture/rls-multitenant dogfood run it on purpose-built fixtures only)
• access-security.rls-both-sides a2/n0: the pin's foreign PATCH asserts only status >=300; the row-unchanged re-read the clause requires is pinned for a fixture object in packages/qa/dogfood/test/rls-fixture.dogfood.test.ts, not for showcase_private_note
• access-security.security-catalog-activation-and-clone-doors a2: the audience-anchor 400 (everyone/guest) is asserted only in packages/runtime/src/domains/catalog-activation-door.test.ts (handler with fakes); the dogfood pin drives the 404 arm only
• access-security.security-catalog-activation-and-clone-doors a3: dogfood clone pin drives 200 + dropped keys, 409 (another set's name), 404, bad-name 400, 403; anonymous 401, the source's own name 409 and the closed-body 400 are unit-only
• access-security.security-catalog-one-holder-and-boot-report a1: packages/cloud-connection/src/marketplace-install-local-catalog-name-collision.test.ts (not in ref) asserts 422 PLUGIN_REGISTER_FAILED + nothing registered on POST /marketplace/install-local (in-process plugin, stubbed cloud fetch) — the ref's pins only reach manifest.register / boot refusal
• access-security.security-catalog-one-holder-and-boot-report a2: permission-set-owner-registration.test.ts proves VALIDATION_ERROR/400 at registerApp, not on a permission-set save door; no HTTP pin for the save
• access-security.security-catalog-one-holder-and-boot-report a3: CLI is run via MigrateSecurityCatalogOverlays.run in-process (oclif), not a spawned process — acceptable for the build oracle
• access-security.security-catalog-one-holder-and-boot-report a4: catalog-reference-report.test.ts asserts the [security] error/info lines on a vi.fn logger; the ≤50-names cap is not visibly asserted
• access-security.share-link-combined-gates a1/a2: packages/runtime/src/domains/share-links-refusal-order.test.ts asserts the anonymous no-password-oracle and email-audience identical-refusal rows but is not in the ref (in-process layer, would not score the api clause either)
• access-security.share-link-combined-gates a3: ref names share-links-messages-audience.test.ts for acceptance[3]; its harness is in-process route entries (no Hono/HTTP), so it scores a0 only, not the api oracle
• access-security.walled-environment-metadata-operator-only a2: single-posture leg is pinned as a manage_metadata holder below the operator (stronger than 'admin'); no case drives the seeded admin specifically on single
• access-security.write-path-guards a4/a6: ref names owner-anchor-and-bulk-writes for bulk writes, but its bulk cases are engine-direct ql.update/ql.delete owner scoping — no createMany stamping, no per-row validation
• access-security.write-path-guards a5: showcase-readonly-when-parent asserts single-row PATCH strips + header X-ObjectStack-Dropped-Fields; the mixed updateMany results[i].droppedFields leg and the line's product field are unpinned
• access-security.write-path-guards a0: showcase-static-readonly asserts no droppedFields on the INSERT strip (verify names droppedFields)
• access-security.write-path-guards n1: objectql pins use a recording/fake driver (real engine) and other objects, not showcase lead_score

From #25817 — release-18.2.0-manual-set, 29 items, at 6679644a, pin b41ed7f68956

• access-security.capability-declaration-lifecycle: step 8 expects capabilities.0.scope, but the index is the entry's position (.2 when appended).
• access-security.capability-declaration-lifecycle: The surface is mixed, yet no clause has a browser oracle.

From #25823 — addendum, identity-auth.admin-lifecycle-operations at 17f8217b, after #25626

• access-security.no-active-org-session-semantics rev 8: its member-less operator create-user producer is stale after feat(plugin-auth): multi-org Create User joins the administrator's current organization #25626 — the operator must create and set-active an organization first.

Acceptance

• Every line above is either applied (item revised, revision bumped, history cites the record) or answered on this card with the reason it was not.
• pnpm check:platform-checklist is green.
• The PR links this card and [sweep] v18.2.0 release test sweep #25807.

Generated by Claude Code