Layer 0: should a verified platform admin cross the org wall by PERMISSION entitlement, not only posturePermitsCrossTenant's three shapes? (cloud#1676 upstream half)

[hotlong]

From cloud#1676 (control-plane operator console reads EMPTY on Tenant Usage / Payout Accruals under the armed Layer 0 wall) — this is the general-fix adjudication that card explicitly deferred upstream.

The contract question

computeTenantLayer0Filter lets a platform admin cross the organization wall only where posturePermitsCrossTenant holds — isPrivate || tenancyDisabled || isBetterAuthManaged (plugin-security/src/security-plugin.ts). A PUBLIC TENANT object matches none of the three, so a deliberately org-less platform admin hits isolated's "no active organization ⇒ fail closed" and reads EMPTY — even where a Layer-1 mechanism has already verified the admin and would audit the read (cloud's cross_org_admin_read widening fires, 200 is returned, zero rows inside).

Proposal to adjudicate: a verified platform admin crosses Layer 0 on any object their permission entitles them to, rather than only on the three enumerated shapes. Possibly via the OrgScopingEntitlement surface (#12704 added a platform-global exemption arm — is that the intended door, and does it cover per-object admin entitlement rather than only object-level exemption?).

Why it matters beyond the two objects

Any operator surface over PUBLIC tenant-owned control tables has this shape. Cloud has taken the contained route-side detour meanwhile (explicitly-authorized /api/v1/cloud/admin/* reads, admin-session-gated + audited, landed with the both-directions pin in unscoped-control-plane-tenant-wall.test.ts) — but the operator's METADATA-DRIVEN screens still read the generic data path and stay empty until either this adjudication opens the wall for entitled admins, or every such screen is moved off the generic path one by one.

Measured evidence

Two-tenant rig, apps/cloud/test/unscoped-control-plane-tenant-wall.test.ts: generic-path admin reads pinned EMPTY (both directions), route-side reads pinned FULL — the pair documents exactly the delta this adjudication would close.

[os-elon]

⚖️ RULED — 2026-08-29, maintainer, live director session (session session_016SG9S6V15MqeAgkehDcTwk). Design set by the maintainer directly, verbatim and untranslated:

能不能简单点，对于超级管理员，配置了环境变量邮箱的，在执行墙的时候不要强制加上 org_id 的过滤

Execution order, verbatim: 「执行，批 #1 其他卡同意」

Adopted design — the verified platform OWNER bypasses Layer 0 (narrower than both the card's proposal A and the object-whitelist route):

When arming the Layer 0 organization wall, the org_id filter is NOT appended for a session whose account is the verified platform owner — the OS_PLATFORM_OWNER_EMAIL identity, matched under the existing #11343 verified-email predicate (the same comparison the platform-admin elevation gate uses; never a client-supplied claim). Everyone else walls exactly as today.

Hard pieces, non-negotiable (recorded as part of the ruling):

1. Predicate reuse: verified-session-account email match against resolvePlatformOwnerEmail() (@objectstack/types), server-side, in the wall computation — ⛔ no raw string comparison against request-supplied identity.
2. Fail-closed both directions, pinned: env unset ⇒ nobody bypasses; email mismatch or account unverified ⇒ still walled (loud empty screen, diagnosable); verified match ⇒ no org_id filter. There is no shape where a misconfiguration widens access.
3. Audit: the owner's wall-bypassing reads/writes carry a named audit event (the cloud cross_org_admin_read pattern).
4. Single value, no list: the door serves the one env-declared owner. Multi-operator access stays on the route-side path until a formal subject-level door (the card's proposal A) is ever ruled — explicitly NOT ruled today.

Rationale on file in the session: the door is deployment-pinned (only env control changes it — runtime permission grants can't widen it), person-scoped (the wall stays intact for everyone else), and marginal-risk-minimal (the owner already elevates to full platform admin; the wall was blocking the one account meant to be all-seeing — which is this card's bug).

Dispatching now: branch claude/issue-12974-owner-wall-bypass, fable-tier os-dev. Clause-②: no (runtime permission behaviour — 安全/权限边界 category; its control is this ruling). cloud#1676's route-side detour stays as-is; the metadata-driven operator screens are served by this door.

---

Generated by Claude Code

[os-elon]

Claim (dispatch record): branch claude/issue-12974-owner-wall-bypass, session session_016SG9S6V15MqeAgkehDcTwk (os-dev, dispatched by the director seat per the RULED comment above). Clause-②: no (runtime permission behaviour — 安全/权限边界 category, controlled by the maintainer's ruling quoted on the card). Branch is pushed; implementation starting now per the four hard pieces of the ruling.

Generated by Claude Code

---

Generated by Claude Code

[os-elon]

os-dev-report

{
 "issue": 12974,
 "status": "done",
 "branch": "claude/issue-12974-owner-wall-bypass",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/13065",
 "pr_number": 13065,
 "pr_url": "https://github.com/objectstack-ai/objectstack/pull/13065",
 "head_sha": "fc001d8f53f83b4cd87866d1cd1b4a082d1c9b52",
 "premise_still_valid": true,
 "predicate_used": "isVerifiedPlatformOwnerSession (security-plugin.ts): declared owner from resolvePlatformOwnerEmail() at objectstack/types, authoritative answer from the server-side sys_user row read by the authenticated context.userId (system-context by-id read, memoized per request context), judged by the shared canonical comparison in platform-owner-wall-bypass.ts (matchesDeclaredOwnerEmail, now also consumed by the bootstrap-platform-admin elevation gate = the twin) AND isEmailVerifiedUserRow. Investigated the walled-owner-operator-stamp per dispatch: it leaves no separate machine-readable marker, its entire output IS sys_user.email_verified at creation, so the row predicate above is the strongest existing verified-owner signal and is what the door keys on. Fast negative on context.email (server-resolved by resolveAuthzContext) narrows only; env unset answers false before any I/O; the probe runs only when the wall actually armed.",
 "audit_mechanism": "structured warn-level log with stable event name platform_owner_wall_bypass (the ruled floor), emitted at the arming site per wall-bypassing computation, carrying event, object, operation, userId, organizationId, tenancyPosture, suppressedFilter; reads and writes ride the same computation. Floor chosen because plugin-audit is not wired into plugin-security (no dependency either direction) and its audit service ingress is a closed auth-session vocabulary feeding the sys_audit_log.action enum with every-declared-action-has-a-writer pins; extending that ledger vocabulary is a scoped change of its own. Reasoning stated in the PR body as required.",
 "files_changed": [
 "packages/plugins/plugin-security/src/security-plugin.ts",
 "packages/plugins/plugin-security/src/bootstrap-platform-admin.ts",
 "packages/plugins/plugin-security/src/platform-owner-wall-bypass.ts",
 "packages/plugins/plugin-security/src/platform-owner-wall-bypass.test.ts",
 ".changeset/platform-owner-wall-bypass.md"
 ],
 "gates": [
 {"name": "pnpm --filter @objectstack/plugin-security test (88 files / 1595 tests)", "exit": 0},
 {"name": "pnpm --filter @objectstack/plugin-security typecheck", "exit": 0},
 {"name": "pnpm lint (full repo eslint, no narrowing)", "exit": 0},
 {"name": "pnpm check:changeset-gate-self-tests", "exit": 0},
 {"name": "pnpm check:cross-package-test-inputs", "exit": 0},
 {"name": "pnpm check:objectql-double-limit", "exit": 0},
 {"name": "pnpm check:objectui-changeset", "exit": 0},
 {"name": "pnpm check:page-declaration-shape", "exit": 0},
 {"name": "pnpm check:pm-half-states", "exit": 0},
 {"name": "pnpm check:published-files", "exit": 0},
 {"name": "pnpm check:slot-lookup", "exit": 0},
 {"name": "pnpm check:test-source-alias", "exit": 0},
 {"name": "pnpm check:type-source-resolution", "exit": 0},
 {"name": "pnpm check:query-options-erasure", "exit": 0},
 {"name": "pnpm check:type-check-coverage", "exit": 0},
 {"name": "pnpm check:type-check-debt (after full 70-package turbo build)", "exit": 0},
 {"name": "pnpm check:engine-double-contract", "exit": 0},
 {"name": "pnpm check:where-matcher", "exit": 0},
 {"name": "pnpm check:i18n", "exit": 0},
 {"name": "pnpm check:i18n-stale-fill", "exit": 0},
 {"name": "pnpm check:nul-bytes", "exit": 0},
 {"name": "node scripts/check-adr-0087-registration.mjs", "exit": 0},
 {"name": "node scripts/check-changeset-no-major.mjs", "exit": 0},
 {"name": "node scripts/check-ci-filter-parity.mjs", "exit": 0},
 {"name": "node scripts/check-comment-mask-adoption.mjs", "exit": 0},
 {"name": "node scripts/check-cross-package-test-inputs.mjs", "exit": 0},
 {"name": "node scripts/check-empty-changeset.mjs", "exit": 0},
 {"name": "node scripts/check-keyed-text-bounds.mjs", "exit": 0},
 {"name": "node scripts/check-plugin-teardown-shape.mjs", "exit": 0},
 {"name": "node scripts/check-undeclared-dep-imports.mjs", "exit": 0},
 {"name": "node scripts/docs-audit/check-affected-docs.mjs", "exit": 0},
 {"name": "node scripts/docs-audit/check-drift-comment.mjs", "exit": 0},
 {"name": "node scripts/pm/check-half-states.mjs — its own verdict PREREQUISITE NOT MET, no GitHub credential in container, no reading at all; NOT MEASURED locally, CI owns it", "exit": 3},
 {"name": "node scripts/pm/release-rehearsal-clone.mjs --self-test", "exit": 0}
 ],
 "pins": [
 "env UNSET: nobody bypasses — walled exactly as today, and no sys_user row is read",
 "email MISMATCH: walled (fast negative on the server-resolved session email, no row I/O)",
 "email matches but the account is NOT verified: still walled",
 "session email matches but the sys_user row is GONE: walled (fail closed)",
 "VERIFIED match: the org_id filter is NOT appended",
 "org-LESS verified owner under isolated: no fail-closed deny sentinel either (the cloud 1676 empty-screen shape)",
 "group posture: the verified owner crosses the union wall too",
 "absent session email: the sys_user row is the authoritative answer",
 "an authored Layer 1 (business RLS) policy still binds the verified owner",
 "the WRITE-side Layer 0 twin is lifted for the owner and kept for everyone else",
 "a wall-bypassing computation emits the stable event name; a walled one does not",
 "matchesDeclaredOwnerEmail — canonical comparison: trimmed, case-insensitive",
 "isVerifiedPlatformOwnerRow — match AND verified, fail-closed on every other shape"
 ],
 "changeset_added": true,
 "summary": "Implemented the ruled design on all four hard pieces: the Layer 0 org wall no longer appends the org_id filter (isolated equality, group union, or the fail-closed deny sentinel) for a session whose sys_user row is the VERIFIED env-declared platform owner; everyone else is byte-identical (pinned). The comparison is shared with the elevation gate via the new platform-owner-wall-bypass.ts module; the bypass lives at the single arming site in computeLayeredRlsFilter, so the write-side twin rides it too and computeTenantLayer0Filter stays untouched. Audit floor landed as ruled (structured warn log, stable name platform_owner_wall_bypass) with the why in the PR. Draft PR 13065 open at head fc001d8f.",
 "tests": "Reproduce-first via reverse verification: fix committed at HEAD, the two runtime files checked out at branch base e4902d2b (mutation proven on disk: bypass marker grep count 0 and diff naming exactly those two files; restore proven: git diff HEAD empty plus working-tree blob hash equal to HEAD blob) ran 7 red / 6 green — reds exactly the door, only-Layer-0 and audit pins (owner IS walled today, reproducing the card), greens exactly the fail-closed and shared-predicate pins. Restored tree: 13/13 green, then full plugin-security suite 88 files / 1595 tests green (VERDICT command-exit 0 via os-verify-lock), typecheck exit 0, full-repo pnpm lint exit 0, dispatch-gates union derived at fc001d8f and every family above run at that head. NOT-MEASURED notes: package typecheck excludes test files by tsconfig (verified via listFiles that the new runtime module IS compiled; the new test file, like all 88 in this package, is exercised only by vitest — no test-typecheck ledger exists here); check-half-states answered its own prerequisite-not-met, not a measurement.",
 "mcp_calls": "4 — claim comment, create_pull_request, pull_request_read (PR body readback), report comment; issue body and ruling read via the zero-quota page payload; no dedup search needed (no out-of-scope issues filed)",
 "open_questions": [],
 "out_of_scope_findings": [],
 "notes": "Clause-2: no — declared in the claim comment as dispatched. Not filed as an issue (not a defect; the ruling explicitly blessed the floor): if the maintainer later wants the owner bypass in the sys_audit_log ledger proper, that is an extension of the plugin-audit action vocabulary plus a sink resolution from plugin-security — the stable event name makes it a sink change, not a rename. The size/l label and one bot comment on the PR are automation, not mine. skip-changeset not applicable (real changeset shipped)."
}

Generated by Claude Code

---

Generated by Claude Code

[os-elon]

Correction round on PR #13065 (supersedes two rows of the os-dev-report above): after the Dogfood Regression Gate red (run 33228420540 — the org-less write refusal answered 500 instead of the ADR-0123 D2 403), the director scoped the door to READS only. The write-side Layer 0 twin now KEEPS today's behaviour for everyone including the owner (the org-less deny sentinel that drives the 403 stands), the audit event fires on read bypasses only, and the two affected pins are inverted (the WRITE-side Layer 0 twin is KEPT for the owner; the deny-sentinel pin is scoped to the read path). Evidence at head 5a7679b: dogfood pin reproduced RED locally at fc001d8 (expected 500 to be 403, byte-identical to CI) then GREEN (6/6); pin suite 13/13; plugin-security 88 files / 1595 tests green; typecheck, full-repo lint, and every moved gate family exit 0. Changeset and PR body updated to the read-only scope. All other fields of the report above stand.

Generated by Claude Code

---

Generated by Claude Code