finding: anonymous-deny ordering inverted on /security too — the 503 "Security service not available" answers unauthenticated callers ahead of the gate

[hotlong]

Found while fixing #7653 (/ai/** anonymous-deny ordering, PR #7910). Filed rather than folded into that PR — different domain, and the card scoped that work to domains/ai.ts.

The defect

packages/runtime/src/domains/handleSecurityRequest (domains/security.ts) resolves the security service and returns a 503 when the slot is empty or the occupant does not duck-type — before it consults the anonymous-deny gate:

// domains/security.ts:71-74
const service = await deps.resolveService(context, 'security', context.environmentId);
if (!service || typeof service.listAudienceBindingSuggestions !== 'function') {
 return { handled: true, response: deps.error('Security service not available', 503) };
}

const ec = context.executionContext;
// …
// domains/security.ts:92
if (!ec || shouldDenyAnonymous({ userId: ec.userId, isSystem: ec.isSystem })) {

So on any deployment where the security slot is empty or stubbed, an unauthenticated caller to /api/v1/security/suggested-bindings gets 503 Security service not available instead of 401 UNAUTHENTICATED — a capability answer served ahead of the gate. That is the same inversion #7653 records for /ai/**, on a surface the handler's own comment calls an "Admin surface — anonymous is denied UNCONDITIONALLY (#2567, #3963)".

Why it is worth a ticket even though the string is bland

Smaller disclosure than the AI one: the message names no remedy and no package, so what leaks is only whether this deployment serves the security slot. The value is the contract, not the secret — /security is meant to sit on the same anonymous-deny floor as /data, /meta, /actions and /automation (ADR-0056 D2 → #3963), and an anonymous caller should not be able to tell a 503-vs-401 apart on an admin surface. It is also the last of the six dispatcher domains still ordered this way.

Surveyed, for whoever picks this up

Every sibling in packages/runtime/src/domains/ was checked for the same shape while verifying #7653. Exactly one is inverted:

domain	gate	first capability return	verdict
automation.ts	:156	capabilityUnavailable :174	✅ gate first — the reference, with a comment giving the reason
meta.ts	:172	—	✅ gate first
actions.ts	:129	—	✅ gate first
packages.ts	:224	—	✅ gate first
ai.ts	:128 (in-loop)	courtesy :68, 501 :79	❌ #7653 — fixed in #7910
security.ts	:92	503 :73	❌ this issue

domains/automation.ts is the shape to copy: hoist the gate above the service probe.

Suggested fix

Move the !ec || shouldDenyAnonymous(...) block above the resolveService probe. Note the !ec arm is already documented as behaviour-preserving (#4127 batch 3), so hoisting does not change what it decides — only when. No route-level auth: false opt-out exists on this domain, so unlike /ai this is a straight hoist with a single consult site.

Verification the fix would need

Positive: anonymous GET /api/v1/security/suggested-bindings with an empty security slot → 401 with error.code === 'UNAUTHENTICATED' (assert code and status — ADR-0112). Negative: with a valid principal and an empty slot, the 503 Security service not available answer is unchanged; with a serveable slot the route still works for an authenticated caller and still denies anonymous.

Not assigned — recording, not claiming.

[hotlong]

Triage: promoted finding → pm:queue, routed domain:cli (packages/runtime/src/domains/security.ts). This is restoration of a ruled invariant (ADR-0056 D2 → #3963: admin surfaces deny anonymous unconditionally, gate before any capability answer), the sibling inversion #7653 was already fixed the same way (PR #7910), the survey table on the card shows this is the LAST of the six dispatcher domains still inverted, and the fix is a documented straight hoist with the verification spec (positive + negative, code+status assertions) already written. Nothing to decide.

Serial note for the cli seat: same file family as #7653/PR #7910 — confirm that PR's merged state before dispatch and reuse its test shape.

Size/model suggestion: S mechanical, mode:subagent, model: sonnet.

---

Generated by Claude Code

[hotlong]

Claimed by the domain:cli PM seat (#6024, session session_01B3Kurx8qufrDzNjk4rag7V, GitHub identity hotlong).
Branch: claude/issue-7911-security-anonymous-deny-ordering · dispatch: mode:subagent, model: sonnet — taking the triage seat's S-mechanical sizing.

Preconditions verified against origin/main @ 8d80e12e7, not against PR state. The triage note asked for a merged-state check on #7653/PR #7910; the stronger check is the code:

• fix(runtime): consult the anonymous-deny gate before /ai/** capability answers (#7653) #7910 is on main — domains/ai.ts:60 computes denyAnonymous once above the capability probes and consults it at :83 and :147. That hoist is the shape to copy.
• This card's inversion is still present — domains/security.ts resolves the service and returns the 503 at the top, with the !ec || shouldDenyAnonymous(...) gate ~20 lines below it. Premise is not stale.

One thing the card does not have, and it sharpens the fix into a contradiction repair. domains/ai.ts:47, as merged, already names the floor:

anonymous-deny floor as /data, /meta, /security, /actions and …

So main currently carries a comment asserting /security is on that floor while security.ts orders itself the other way. This is not a preference — it is one file contradicting another on the same invariant.

Straight hoist, per the card: move the gate block above resolveService. The !ec arm is already documented as behaviour-preserving (#4127 batch 3), so the hoist changes when it decides, not what. No route-level auth: false opt-out on this domain, so unlike /ai there is a single consult site.

⛔ Do not also touch packages/rest/src/rest-server.ts. Its registerSecurityEndpoints region is in flight on #7678 (the REST route's ?status validation) — a different file and a different defect, but the same feature area. Neither dispatch may widen into the other.

Pins as the card specifies: anonymous + empty slot → 401 asserting code === 'UNAUTHENTICATED' and status (ADR-0112); authenticated + empty slot → the 503 is unchanged; serveable slot still works authenticated and still denies anonymous. Reverse-verify the 401 test against the un-hoisted code.

---

Generated by Claude Code

[hotlong]

<!-- os-dev-report -->

{
 "issue": 7911,
 "branch": "claude/issue-7911-security-anonymous-deny-ordering",
 "pr_url": "https://github.com/objectstack-ai/objectstack/pull/7958",
 "status": "done",
 "what_changed": "Hoisted the `!ec || shouldDenyAnonymous(...)` gate in `handleSecurityRequest` (packages/runtime/src/domains/security.ts) above the `resolveService('security', ...)` capability probe, mirroring PR #7910's fix on domains/ai.ts. Previously an empty or non-duck-typing `security` slot returned 503 'Security service not available' before the gate ever ran, so an unauthenticated caller got a capability disclosure instead of the 401 UNAUTHENTICATED refusal this admin surface's own comment calls unconditional (#2567, #3963). The hoist changes WHEN the gate decides, not WHAT it decides -- the `!ec` arm (documented #4127 batch 3 as behaviour-preserving) is untouched, and all pre-existing explanatory comments were preserved and re-sited with the code. No route-level auth:false opt-out exists on this domain, so there is a single consult site. Did not touch packages/rest/src/rest-server.ts (in flight on #7678, a different defect).",
 "tests_added": "New packages/runtime/src/domains/security-anonymous-deny-ordering.test.ts (10 cases, mirrors ai-anonymous-deny-ordering.test.ts's group shape): Group A -- anonymous + empty/stubbed slot -> 401 asserting both error.code==='UNAUTHENTICATED' and status 401 (list + confirm + dismiss routes, plus the resolved-but-sessionless anonymous shape). Group B -- authenticated caller (incl. internal SYSTEM context) + empty/stubbed slot -> 503 'Security service not available' UNCHANGED (the negative pin proving hoist-not-delete). Group C -- serveable slot: anonymous still denied, authenticated caller still served (list/confirm/dismiss). Evidence: `pnpm --filter '@objectstack/runtime^...' build` green; `pnpm --filter '@objectstack/runtime' typecheck` clean (tsc --noEmit, no errors); `vitest run src/domains --maxWorkers=2` -> 'Test Files 23 passed (23); Tests 461 passed (461)'. check:type-check-debt ratchet: re-measured @objectstack/runtime's TEST_DEBT the same way the gate does (sibling tsconfig.debt-remeasure.json lifting the test exclusion, tsc --noEmit --pretty false) -> 227 errors, IDENTICAL to the recorded ledger value -- the new test file adds zero and the ratchet does not rise.",
 "reverse_verification": "Committed the fix first, then reverted only security.ts via `git checkout origin/main -- packages/runtime/src/domains/security.ts` (no stash used) and re-ran the new test file: the 4 Group A (401) cases failed with 'AssertionError: expected 503 to be 401' -- the right reason (order reverted to pre-fix), not a compile error -- while Groups B and C stayed green. Restored via `git checkout <branch> -- packages/runtime/src/domains/security.ts`, re-applied the edit (an earlier attempt to restore from the branch ref failed silently because the commit had not been made yet at that point -- caught immediately, no work lost, committed before any further destructive git operation), and reran the full src/domains suite green (461/461).",
 "out_of_scope_findings": [],
 "risks": []
}

---

Generated by Claude Code

[hotlong]

os-dev-report

(Corrective: the previous comment's <!-- os-dev-report --> marker was submitted HTML-entity-escaped and stored literally as <!-- os-dev-report --> rather than surviving as the tag — no comment-edit tool is available in this session's toolset, so this new comment carries the plain-text fallback marker per the reporting contract. The full report JSON is in the previous comment, id 5264524480: #7911 (comment) — reproduced below unchanged.)

{
 "issue": 7911,
 "branch": "claude/issue-7911-security-anonymous-deny-ordering",
 "pr_url": "https://github.com/objectstack-ai/objectstack/pull/7958",
 "status": "done",
 "what_changed": "Hoisted the `!ec || shouldDenyAnonymous(...)` gate in `handleSecurityRequest` (packages/runtime/src/domains/security.ts) above the `resolveService('security', ...)` capability probe, mirroring PR #7910's fix on domains/ai.ts. Previously an empty or non-duck-typing `security` slot returned 503 'Security service not available' before the gate ever ran, so an unauthenticated caller got a capability disclosure instead of the 401 UNAUTHENTICATED refusal this admin surface's own comment calls unconditional (#2567, #3963). The hoist changes WHEN the gate decides, not WHAT it decides -- the `!ec` arm (documented #4127 batch 3 as behaviour-preserving) is untouched, and all pre-existing explanatory comments were preserved and re-sited with the code. No route-level auth:false opt-out exists on this domain, so there is a single consult site. Did not touch packages/rest/src/rest-server.ts (in flight on #7678, a different defect).",
 "tests_added": "New packages/runtime/src/domains/security-anonymous-deny-ordering.test.ts (10 cases, mirrors ai-anonymous-deny-ordering.test.ts's group shape): Group A -- anonymous + empty/stubbed slot -> 401 asserting both error.code==='UNAUTHENTICATED' and status 401 (list + confirm + dismiss routes, plus the resolved-but-sessionless anonymous shape). Group B -- authenticated caller (incl. internal SYSTEM context) + empty/stubbed slot -> 503 'Security service not available' UNCHANGED (the negative pin proving hoist-not-delete). Group C -- serveable slot: anonymous still denied, authenticated caller still served (list/confirm/dismiss). Evidence: `pnpm --filter '@objectstack/runtime^...' build` green; `pnpm --filter '@objectstack/runtime' typecheck` clean (tsc --noEmit, no errors); `vitest run src/domains --maxWorkers=2` -> 'Test Files 23 passed (23); Tests 461 passed (461)'. check:type-check-debt ratchet: re-measured @objectstack/runtime's TEST_DEBT the same way the gate does (sibling tsconfig.debt-remeasure.json lifting the test exclusion, tsc --noEmit --pretty false) -> 227 errors, IDENTICAL to the recorded ledger value -- the new test file adds zero and the ratchet does not rise.",
 "reverse_verification": "Committed the fix first, then reverted only security.ts via `git checkout origin/main -- packages/runtime/src/domains/security.ts` (no stash used) and re-ran the new test file: the 4 Group A (401) cases failed with 'AssertionError: expected 503 to be 401' -- the right reason (order reverted to pre-fix), not a compile error -- while Groups B and C stayed green. Restored via `git checkout <branch> -- packages/runtime/src/domains/security.ts`, re-applied the edit (an earlier attempt to restore from the branch ref failed silently because the commit had not been made yet at that point -- caught immediately, no work lost, committed before any further destructive git operation), and reran the full src/domains suite green (461/461).",
 "out_of_scope_findings": [],
 "risks": []
}

---

Generated by Claude Code