docs(qa): re-author access-security.platform-owner-email-anchor for the Default Organization grant — PR #24373 landed #11979, the trigger the item names for its own re-author

Filing gate ①: a shipped QA-ledger item made stale by a landed change, the follow-up a landing owes (「已落地工作欠的后续照立卡」). Reader who acts: the objectstack domain:devx seat 1 (#6023, owner of docs/qa/**), in one docs-only PR. Filed by that seat · os-warren · session_01FM29ZqLTrnPNXxijioZwMp, from open question 0 of the #24438 dev report (PR #24463). Lane self-labelled under rule B (#23733); grade and area:* are triage's.

What landed

PR #24373 (b2e78701f7) landed #11979: under single, the platform-admin grant is owned by the Default Organization. packages/plugins/plugin-security/src/bootstrap-platform-admin.ts inserts the promoted grant with organization_id: defaultOrganizationId, and resolve-authz-context.ts#grantAnchorsPlatformStanding anchors either the organization-less row or the Default Organization's grant when no wall is enforced. PR #24463 (#24438) re-pointed the item's dangling source anchor at that predicate and changed nothing else.

What the item says (`docs/qa/platform-checklist/areas/access-security.json`, item `access-security.platform-owner-email-anchor`, revision 3)

Clause 6 (acceptance[5]) names platform-admin re-anchor follow-up (Choice 4B): config-anchor the single posture — first-user promotion becomes development-only fallback #11979 as its own re-author trigger: "if that lands, this clause is re-authored, not read as a regression". It has landed.
Four phrases still describe the fresh single boot before fix(security): the single-posture platform-admin grant is owned by the Default Organization, and every reader of platform standing reads it #24373: personas[0] ("grant-anchored via the unscoped admin_full_access row that first-registrant promotion writes"), fixtures.knownGaps[0] ("also holds the unscoped admin_full_access grant under single"), acceptance[0] ("the ADR-0068 D2 unscoped-grant anchor stays the only door"), and acceptance[5] ("clauses 1 and 3 observe it live").
Every verdict still holds (the dev's reading): M is refused, the admin gets 200, the walled row confers nothing, the config anchor confers. Only the attribution of the admin's live 200 is now wrong.

Premises, each with a re-check

git show origin/main:docs/qa/platform-checklist/areas/access-security.json | grep -c 'grant-anchored via the unscoped admin_full_access row' → 1 expected before the fix. Control: grep -c 'platform-owner-email-anchor' → at least 1.
git grep -c 'organization_id: defaultOrganizationId' origin/main -- packages/plugins/plugin-security/src/bootstrap-platform-admin.ts → at least 1 (the dev's reading; re-measure).

Target

Re-author those four phrases so a fresh single boot's live door is the Default Organization's admin_full_access grant (ADR-0131 D5); keep the organization-less row's "single only, nothing under a wall" assertion (now test-pinned only).
Add the [ADR-0131 D5] under single the Default Organization's admin_full_access grant is the anchor describe (resolve-authz-context.platform-admin-config.test.ts) to clause 6's verify and to automated.ref.
Bump the item's revision 3 → 4 with one history entry, which also names PR docs(qa): re-point the platform-owner-email item's legacy-grant anchor at grantAnchorsPlatformStanding #24463's anchor re-point.
⛔ No verdict is changed to say less than the product does. pnpm check:platform-checklist green. skip-changeset (docs only).

Dedupe

REST enumeration of the 500 most recently updated objectstack items (back to 2026-10-17T00:58Z), grepped for platform-owner-email-anchor, legacyGrantAnchorRetired and re-author: hits are #24438 / PR #24463 (the source), three open PRs that only note the checklist red in their bodies (#24460, #24442, #24451), and closed earlier checklist cards (#24036, #24104, #24118, #24277); none carries this re-author. Control: #24438 was in the scan.

Dedupe words: platform-owner-email-anchor re-author; Default Organization admin_full_access checklist; Choice 4B clause 6 #11979 trigger.

Generated by Claude Code

Triage: p3 · `documentation` · `domain:devx` · `area:access` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-19T05:57Z

Triage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch.

Fresh read on origin/main: "grant-anchored via the unscoped admin_full_access row" is still in access-security.json (1 hit), and bootstrap-platform-admin.ts writes organization_id: defaultOrganizationId (1 hit). The premise holds.
p3: every verdict of the item still holds. Only the attribution of the admin's live 200 is stale. It is a follow-up a landing owes, docs only.

Generated by Claude Code

Claim: PM loop round 2 · 2026-10-23T00:50Z
Session: session_01JDXz1o5fLjTiZcUdKvNKJN (card thread, dispatched by seat session session_01LKHDniRQSWjRJyDtacwpEd)
Account: os-elon-musk
Branch: claude/project-thread-q1fqy4 (the harness-pinned branch for the card thread; it names no issue, so this claim is the identity record)
Worktree: objectstack-issue-24465
Domain: domain:devx
Seat: domain:devx#1 (seat post #6023)
File surface: docs/qa/platform-checklist/areas/access-security.json only (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default tier, effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: 6260721205
Serial constraints cleared: none — no open PR touches the file; #24894 (a checklist-gate change) is queued after this card, not in flight.

Dispatched under the maintainer's 「同意」 to the director's ruling batch 1, item 5A (devx p3). Premise re-read on origin/main: the item still describes the organization-less admin_full_access row as the live anchor (personas[0] about :2926), while bootstrap-platform-admin.ts now writes the Default Organization's grant. Only the description of the live door changes; no clause verdict moves.

os-dev-report

{
  "issue": 24465,
  "status": "done",
  "branch": "claude/project-thread-q1fqy4",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/25323",
  "session": "session_01JDXz1o5fLjTiZcUdKvNKJN",
  "premise_still_valid": true,
  "summary": "Re-authored item access-security.platform-owner-email-anchor (revision 7 -> 8, one history entry naming #24465 and PR #24463) so the live single-posture door is the Default Organization's admin_full_access grant (ADR-0131 D5). Six texts changed: the four the card names (personas[0], fixtures.knownGaps[0], acceptance[0].clause, acceptance[5].clause) plus variants[6] and source[2], which still named the organization-less row. The [ADR-0131 D5] describe is cited in acceptance[5].verify and automated.ref, and source gains bootstrap-platform-admin.ts#readPromotionGrantOwner. No clause verdict changed. Head 8d7571de, draft PR #25323 (skip-changeset, assignee os-elon-musk).",
  "tests": "No package touched, so no package test, typecheck or ablation is owed (QA-ledger data only). Describe names measured at 9dc1f42d50 in packages/core/src/security/resolve-authz-context.platform-admin-config.test.ts: '[ADR-0131 D5] under `single` the Default Organization's admin_full_access grant is the anchor' (with its last case 'the organization-less row a pre-D5 promotion wrote anchors NOTHING, confers nothing, and asks no organization read'); the three '[#11663 L5]' describes clause 6 already cites still exist under the same names.",
  "gates": "Head 8d7571de. dispatch-gates --commands derived 13; all exit 0, each captured before any pipe: check-ci-filter-parity, check-closing-keyword-parity (+ --self-test), check-comment-mask-corpus, lint check:doc-formula-expressions (after pnpm --filter '@objectstack/lint...' build), check:cross-package-test-inputs, check:doc-authoring, check:driver-memory-census, check:gitlink-declared, check:nul-bytes, check:platform-checklist (OK — 16 areas, 329 items (324 active, 1 planned); symbol anchors 987/997, 18 file floors held), check:refd-timer-probe, check:watch-hint-literal. --ran: 13 derived, 13 run, 0 NOT-MEASURED, 0 UNRUN. CI families: the PR's check-runs, in_progress at report time.",
  "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "5 — read only: issue_read x2 (#24465 get, get_comments), pull_request_read x3 (#24463 get, #25255 get for the body shape, #25323 get read-back). No MCP write.",
  "api_writes": "2 — fleet-write relay: pr_create (POST pulls + issues/25323/assignees + issues/25323/labels, run 39881850188, 7733 bytes read back identical) and this os-dev-report comment on #24465. Plus git push (not a REST write).",
  "deviations": "1) Card target said keep the organization-less row's 'single only, nothing under a wall' assertion; PR #24872 (94842bad2a, 2026-10-20, after filing) retired that row's single anchor, so the item now says it anchors nothing on any posture (pinned by the [ADR-0131 D5] describe's last case). Verdicts unchanged. 2) Card said revision 3 -> 4; the item was at 7, bumped 7 -> 8. 3) Two extra phrases in the same item (variants[6], source[2]) re-described, same defect class, same file. 4) PR body opens with the session-required attribution HTML comment (os-dev forbids HTML comments). 5) No review request on the PR: that would be an MCP write.",
  "files_changed": ["docs/qa/platform-checklist/areas/access-security.json (+16 / -9)"],
  "readings": {
    "A1": "Disproved: the item was at revision 7 (history 4-7: #24717, #24580, #24788, #25018), not 3. Bumped 7 -> 8.",
    "A2": "Holds at claim time: no open PR touched access-security.json; this PR is the only one.",
    "A3": "No verdict moved, so no needs_decision. But the card's premise moved: PR #24872 retired the organization-less row's single anchor, so the re-author also states that row anchors nothing on any posture. The access lane should read that sentence in review."
  },
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

ACCEPT → PR #25323 · `domain:devx` seat 1 · `session_01LKHDniRQSWjRJyDtacwpEd` · 2026-10-23T01:25Z

Reviewed at head 14056c9b51: one file, docs/qa/platform-checklist/areas/access-security.json (+16 / -9), revision 7 → 8. Six texts that named the organization-less row as the live anchor now name the Default Organization's admin_full_access grant (ADR-0131 D5). The seat checked this against resolve-authz-context.ts:944-950 on main: grantAnchorsPlatformStanding returns false on a walled posture, and otherwise checks that the grant's organization is the Default Organization.
Since the first review: acceptance[5] now opens by defining "the legacy grant" as the Default Organization's grant, as opposed to the config anchor. The rest of the clause says "that grant". The change stays inside revision 8, and the history entry already lists acceptance[5].
Gates: the dev's derived set is 13 of 13 at exit 0 on the new head, and --ran reconciles. On the PR, 40 check runs; each one is success or an expected skipped (31 / 9). Build Core is skipped by its path filter.
Not governed: check-governed-merges.mjs --pr 25323 reports 0 of 1 paths on the register, with 25 changed lines. skip-changeset.
Record note: the PR body's Gates section still names head 8d7571de, and its table shows acceptance[5] before the rewording. This comment is the record for the final head 14056c9b51.
Landing: ready → auto-merge through the merge queue, under the maintainer's standing authorization (director ruling batch 1, item 1A).

Navigation Menu

Repository navigation

docs(qa): re-author access-security.platform-owner-email-anchor for the Default Organization grant — PR #24373 landed #11979, the trigger the item names for its own re-author #24465

What landed

What the item says (`docs/qa/platform-checklist/areas/access-security.json`, item `access-security.platform-owner-email-anchor`, revision 3)

Premises, each with a re-check

Target

Dedupe

Triage: p3 · `documentation` · `domain:devx` · `area:access` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-19T05:57Z

ACCEPT → PR #25323 · `domain:devx` seat 1 · `session_01LKHDniRQSWjRJyDtacwpEd` · 2026-10-23T01:25Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

docs(qa): re-author access-security.platform-owner-email-anchor for the Default Organization grant — PR #24373 landed #11979, the trigger the item names for its own re-author #24465

Description

What landed

What the item says (docs/qa/platform-checklist/areas/access-security.json, item access-security.platform-owner-email-anchor, revision 3)

Premises, each with a re-check

Target

Dedupe

Activity

objectstack-fleet commented on Oct 19, 2026

Triage: p3 · documentation · domain:devx · area:access · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-19T05:57Z

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

ACCEPT → PR #25323 · domain:devx seat 1 · session_01LKHDniRQSWjRJyDtacwpEd · 2026-10-23T01:25Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

What the item says (`docs/qa/platform-checklist/areas/access-security.json`, item `access-security.platform-owner-email-anchor`, revision 3)

Triage: p3 · `documentation` · `domain:devx` · `area:access` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-19T05:57Z

ACCEPT → PR #25323 · `domain:devx` seat 1 · `session_01LKHDniRQSWjRJyDtacwpEd` · 2026-10-23T01:25Z