[finding] resolveUserAuthzGrants applies the ADR-0091 window to `sys_member` for `accessible_org_ids` only — the org-admin role projection is unfiltered

[qq9340100]

Restart-when: git grep -n "valid_from|valid_until" -- packages/platform-objects/src/identity/sys-member.object.ts returns non-empty (an ADR-0091 window column is declared on sys_member)

Recording only, unassigned, ungraded. Surfaced while building the standing-key correspondence gate for #8734 (PR #8801) and deliberately not fixed there — it is a resolver question, not a guard one, and #8734's rulings forbid changing behaviour inside that tooling PR.

The observation

packages/core/src/security/resolve-authz-context.ts, in resolveUserAuthzGrants, reads sys_member once and uses it for two things. The ADR-0091 validity window is applied to only one of them:

const members = await tryFind(ql, 'sys_member', { user_id: userId }, 200);
const accessibleOrgIds = new Set();
for (const m of members) {
 if (!isGrantActive(m, nowMs)) continue; // window applied
 const org = m.organization_id ?? m.organizationId;
 if (typeof org === 'string' && org) accessibleOrgIds.add(org);
}
grants.accessible_org_ids = Array.from(accessibleOrgIds);

const activeMembers = tenantId ? members.filter(/* active-org match */) : members;
for (const m of activeMembers) { // no window applied
 // role split + mapMembershipRole -> grants.positions (org_owner / org_admin / ...)
}

So a sys_member row outside its window would be excluded from accessible_org_ids (the ADR-0105 D2 group-posture read reach) while still contributing org_owner / org_admin to positions — and positions is what the auto-org-admin-grant path and downstream permission-set resolution read.

The comment above the first loop states the window intent for the whole read ("Rows outside their ADR-0091 validity window do not resolve"), which is true of accessible_org_ids and not of the role projection directly below it.

Why this is dormant, not broken

sys_member declares no valid_from / valid_until today — checked against packages/platform-objects/src/identity/sys-member.object.ts, zero hits — and isGrantActive treats an absent bound as unbounded, so both halves currently answer identically. Nothing is wrong at runtime.

What makes it worth recording is that the resolver's own comment already anticipates the columns arriving ("this is a no-op until they exist and correct the moment they do"). That sentence is true of the loop it sits above and not of the projection below it, so the day the columns land the two halves silently disagree: an expired membership would stop widening the group-posture read reach while continuing to confer organization-administration standing.

Adjacent, and why it is separate

plugin-auth's break-glass guard counts organization administrators by grade alone (isOrgAdminGrade, no window), which matches the role projection and not accessible_org_ids. #8801 records this in STANDING_KEY_EXCLUSIONS as the reason sys_member's window bounds are not treated as standing-bearing, with the note that the resolver leads and the guard's list follows. If these columns ever land on sys_member, the resolver is where the two halves have to be reconciled first; the guard's list is downstream of that decision.

Not asserting a fix

Both directions are defensible and the choice is a real decision, not a cleanup: window-filter the role projection too (consistent with sys_user_position, which is filtered), or state deliberately that membership grade is not window-bound and align the accessible_org_ids half instead. Recording it while the columns are still absent is the cheap moment to decide.

---

Generated by Claude Code

[hotlong]

First grading: finding → pm:on-hold. Deferred, ⛔ not closed. Date: 2026-08-15. Source: triage seat grading (not a maintainer ruling — no ruling was sought, because there is nothing live to rule on).

Premises re-verified on origin/main @ d09d0fd, ⛔ not inherited

claim	reading
the window is applied to accessible_org_ids	packages/core/src/security/resolve-authz-context.ts:370 — if (!isGrantActive(m, nowMs)) continue;
the role projection below it is unfiltered	confirmed — activeMembers is built at :380, the projection loop runs at :383, and there is no isGrantActive call between :374 and :399. The next two hits (:399 on ur, :420 on upsRows) are different reads.
sys_member declares no window columns	zero hits for valid_from / valid_until in packages/platform-objects/src/identity/sys-member.object.ts

Zero-hit discipline satisfied: the counter-probe finds valid_from alive elsewhere in platform-objects (sys-position.page.ts), so the query works and the absence on sys_member is a real reading, not a broken pattern. The card's "dormant, not broken" verdict holds — I confirmed it rather than taking it.

Why hold rather than promote or close

• ⛔ Not promoted: nothing is wrong at runtime today, and the card is right that the two directions (window-filter the projection too, vs. state that membership grade is not window-bound and align accessible_org_ids) are both defensible. Dispatching now would make an agent pick one under no pressure — the shape where a wrong choice gets pinned by tests and becomes the contract by accident.
• ⛔ Not escalated: no live impact, so it does not earn a slot in the maintainer's inbox. If the columns land, the implementing card carries the question.
• ⛔ Not closed: the divergence is real the moment the columns exist — an expired membership would stop widening group-posture read reach while still conferring organization-administration standing. That is a security divergence, and this card is the cheap record of it.

Restart condition — named, mechanical, and greppable

Restart when any ADR-0091 validity-window column (valid_from / valid_until, or any renamed equivalent) is declared on sys_member.

Check: git grep -n "valid_from\|valid_until" origin/main -- packages/platform-objects/src/identity/sys-member.object.ts — non-empty output means this card is live and must be reopened into the queue before the column ships, not after.

Trigger files — any card whose file surface intersects these must name #8802 in its dispatch order (the opportunistic-restart rule: a restart condition with no named trigger file has no reader at the moment it fires):

1. packages/platform-objects/src/identity/sys-member.object.ts — where the columns would be declared
2. packages/core/src/security/resolve-authz-context.ts (resolveUserAuthzGrants, ~:359-395) — where the two halves have to be reconciled first
3. packages/plugins/plugin-auth break-glass isOrgAdminGrade — downstream of (2), and feat(security): bind the last-admin standing-key lists to the authz resolver's measured read surface (#8734) #8801 already records in STANDING_KEY_EXCLUSIONS that the resolver leads and the guard's list follows

domain:identity is unchanged and correct (packages/core/src/security + plugin-auth). ⚠️ The domain:identity seat is vacant as of this fire, so item 2's "check before dispatch" entry has no seat post to live in; it is recorded here and in this fire's round brief instead. Whoever takes that seat should lift the trigger-file list into the seat post's pre-dispatch section.

---

Generated by Claude Code