fix(security): the curated capability seeder reconciles the row the platform owns, not whichever row shares the name (#8470) - #8537

Merged

os-zhuang merged 6 commits into

mainfrom

claude/issue-8470-capability-seed-lookup

Aug 13, 2026

Commits on Aug 13, 2026

fix(security): scope the curated capability seeder's lookup to the row the platform owns
claude
committed
df20b40
docs(changeset): curated capability seeder owns its row (#8470)
claude
committed
2cacc58
fix(security): the blocked-curated diagnostic reports observed provenance instead of asserting ownership
claude
committed
1d91faf
docs(changeset): record the observed-provenance diagnostic and its reachability
claude
committed
81bad71
fix(security): the blocked-curated diagnostic distinguishes 'no blocking row visible' from 'row with no managed_by'
claude
committed
5a877ff
test(security): build the refused-insert double by override so the engine-double baseline is not raised
claude
committed
1abef9f