service-storage's attachment kit carries the same 5-field `callerContext` projection #7141 fixed for comments

[os-zhuang]

Out-of-scope observation from implementing #7141 (PR #7143), filed rather than fixed — that card is bounded to packages/plugins/plugin-audit.

Fact

packages/services/service-storage/src/attachment-access-hooks.ts:70 —
callerContext() rebuilds the identical five-field projection of the caller's
execution envelope:

function callerContext(ctx: any): Record<string, unknown> {
  const exec = ctx?.input?.options?.context;
  if (exec && typeof exec === 'object') {
    return {
      userId: exec.userId,
      tenantId: exec.tenantId,
      positions: exec.positions,
      permissions: exec.permissions,
      isSystem: exec.isSystem,
    };
  }
  ...
}

The result is handed to sharing.canEdit(parentObject, parentId, …) from two
sites (the beforeInsert parent gate and the multi-row authorizeRows loop).
This is the kit comment-access-hooks.ts was derived from, so the defect is the
same one, one package over:

• onBehalfOf is dropped, so ISecurityService.hasWriteBypass — documented
  to fail CLOSED on a delegated context, implemented by reading exactly
  context?.onBehalfOf?.userId (plugin-security/src/security-plugin.ts:704-707)
  — cannot fire on the attachment path either. The field is populated on a live
  path (runtime/src/security/resolve-execution-context.ts:191, OAuth agent
  principals on /mcp).
• principalKind is dropped, so resolvePermissionSetsForContext
  (security-plugin.ts:3024-3034) resolves an ADR-0090 D10 agent principal as
  a human and appends the deployment's additive baseline to the agent's
  scope-derived ceiling.
• systemPermissions, accessible_org_ids, posture, audience and
  rlsMembership go with them.

The middleware-key stripping half of the projection is correct and must
survive any fix here too — plugin-security mutates the operation context in
place (sc.__readScope = …, security-plugin.ts:1159), so the arriving context
carries the depth resolved for sys_attachment while the gate asks about the
parent record's object.

Suggested shape

The same one #7141 landed: forward the envelope minus the operation-private keys,
dropped by the __ prefix (which also covers __expandRead, the marker that
waives the object-level CRUD check, and __referentialFieldClear). See PR #7143
for the fix and its reverse-verification evidence, including the measurement that
the /mcp agent ceiling sets cannot themselves carry modifyAllRecords — so the
dropped bypass guard is latent rather than exploitable with the built-in
permission sets, while the dropped ceiling rule widens unconditionally.

Dedup

Searched open issues for attachment-access-hooks, sys_attachment + sharing,
and the onBehalfOf family: only the #7070 group (#7135, #7136) and #7141, none
of which covers service-storage.

[claude]

Triage: pm:queue + domain:services.

• Classification: concrete defect with a named landing site and a proven fix shape — service-storage's callerContext() rebuilds the identical five-field envelope projection that plugin-audit's callerContext rebuilds a 5-field subset of the execution envelope, dropping onBehalfOf before the sharing gates that are documented to fail closed on it #7141 / PR fix(plugin-audit): forward the caller's execution envelope to the sys_comment sharing gates (#7141) #7143 just fixed for the comment kit, dropping onBehalfOf (kills the fail-closed hasWriteBypass guard) and principalKind (resolves an ADR-0090 D10 agent principal as a human, appending the additive baseline to the agent's ceiling). Suggested shape (forward envelope minus __-prefixed operation-private keys) is already reverse-verified in PR fix(plugin-audit): forward the caller's execution envelope to the sys_comment sharing gates (#7141) #7143. Dispatchable as-is.
• Routing: domain:services — the fix lands in packages/services/service-storage/src/attachment-access-hooks.ts (anchoring rule: label follows the landing package; plugin-audit's callerContext rebuilds a 5-field subset of the execution envelope, dropping onBehalfOf before the sharing gates that are documented to fail closed on it #7141 was domain:identity only because its fix landed in plugin-audit).
• Premise check at origin/main @ 3e8e669 — which IS the fix(plugin-audit): forward the caller's execution envelope to the sys_comment sharing gates (#7141) #7143 merge commit, so this is checked against the post-fix tree: the five-field projection is verbatim live at attachment-access-hooks.ts (callerContext, lines ~70-83), canEdit gate call sites present in the same file; fix(plugin-audit): forward the caller's execution envelope to the sys_comment sharing gates (#7141) #7143 did not touch service-storage, exactly as this card states.
• Dedup: repo-scoped sweep over open issues/PRs for attachment-access-hooks / sys_attachment / callerContext: only [engine][设计卡] 多态弱引用挂靠表的平台级删除级联 —— sys_record_share/attachment/comment 一族的统一清理机制 #5180 (delete-cascade design card, on hold) mentions sys_attachment, different problem; finding: consumer half of #6523 — three plugin implementations still annotate SharingExecutionContext, so (context as any).posture is still needed to read a field the contract now declares #7070 family and plugin-audit's callerContext rebuilds a 5-field subset of the execution envelope, dropping onBehalfOf before the sharing gates that are documented to fail closed on it #7141 do not cover service-storage; no open PR touches the file. Clean — filer's own dedup confirmed.
• target:v17: not applied, same grading as plugin-audit's callerContext rebuilds a 5-field subset of the execution envelope, dropping onBehalfOf before the sharing gates that are documented to fail closed on it #7141 last round — the dropped bypass guard is latent with built-in permission sets (measured in PR fix(plugin-audit): forward the caller's execution envelope to the sys_comment sharing gates (#7141) #7143: /mcp agent ceiling sets cannot carry modifyAllRecords); the ceiling-rule widening is real but exploit depth unestablished. Re-grade trigger: if a deployment-supplied agent permission set carrying record-level write bypass is demonstrated on the attachment path, this becomes a leak-class blocker.
• Not blocked: the fix keeps own-depth gate behaviour byte-for-byte, so it does not wait on the Decision needed: should the sys_comment parent gates run the parent's owner-match at the caller's real write DEPTH, or stay at own? #7144 depth decision; note the relation in the PR instead.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-help]

Claim: PM loop round 2 (spec-surface seat, cross-lane under maintainer directive)
Session: session_016R9de1FqP7NvwKvqXi92Gh
Branch: claude/issue-7145-attachment-caller-context
Worktree: objectstack-issue-7145
Domain: domain:services
File surface: packages/services/service-storage/src/attachment-access-hooks.ts + its tests, .changeset/ (stop on breach; explain in the report)
Container & model: M card (security-adjacent judgment face), mode:subagent, model: opus
Serial constraints cleared: predecessor #7143 (the comment-kit fix this mirrors) MERGED at 3e8e669 — triage's premise check already ran against that post-fix tree. #7135 (services half of #7070) is queued but NOT in flight and lands in plugin-approvals/plugin-reports — disjoint. No open PR touches this file (triage dedup, 2026-08-09T22:21Z).

Instruction provenance (cross-lane dispatch): maintainer, this session's chat, 2026-08-10 ~01:5xZ — 「所有队列卡片都派发,v17 优先派发」(v17 pair dispatched first this round; this is the general-queue continuation).

---

Generated by Claude Code

[os-help]

Claim: PM loop round 1 (domain:services seat #6021)
Session: session_015fkdTyGmMD5s8ZtEifvuGy
Branch: claude/issue-7145-attachment-callercontext
Worktree: objectstack-issue-7145
Domain: domain:services
File surface: packages/services/service-storage/src/attachment-access-hooks.ts + attachment-access-hooks.test.ts ONLY (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus
Serial constraints cleared: same-package sibling #7102 is dispatched in this same round under the maintainer's explicit dispatch-all instruction — regions are disjoint by declaration (#7102 owns file-reference-lifecycle.ts + its test; this card owns the attachment hooks pair). Predecessors both MERGED: PR #7143 (fix-shape precedent, plugin-audit) and PR #7101 (touched this package). Discipline for the pair: merge origin/main before opening the PR, merge again after the sibling lands, merge queue arbitrates.

---

Generated by Claude Code