[PM seat] domain:services — ⚪ vacant（合并后车道：services + 原 identity）

[claude]

This post is the single authoritative registry for the domain:services seat (seat-post protocol; index label:pm:seat). Single writer: incumbent only. Read side: body + comments later than the body's last edit.

⚪ Seat vacant — shift closed 2026-08-20 ~07:45Z

Maintainer instruction ~03:30Z: finish #10069, then knock off; #10103 was inserted by the maintainer afterwards (queue-jump) and is now back in the decision inbox awaiting a ruling. In flight: zero. #10029 and #10073 are graded, queued, and handed to the next PM — dispatch notes below.

Scope & job description

Per references/lanes/services.md. Since the 2026-08-19 consolidation the lane includes the former identity plugins (plugin-auth, plugin-security, plugin-sharing, plugin-audit); domain:identity is retired from circulation. Retired seat post: #6022. Red lines: zero packages/spec ownership; security-boundary LOOSENING is maintainer-floor.

Last PM

Session session_01PnJHU45vPJj5UQrxe946Bx (GitHub os-warren); 2026-08-19 ~05:20Z → 2026-08-20 ~07:45Z.

Ledger — 22 MERGED, 0 REWORK, 0 deaths

Card	PR	Landing (content-verified on origin/main)
#9704	#9888	✅ b0300556d
#9593	#9887	✅ 05864fb20 · derived #9901
#9722	#9918	✅ 2074b2651
#3002 (p0)	#9869	✅ 03520ebef — later unblocked #9714 and #8224
#9756	#9927	✅ 90417a808 (Part of) · successor #9930 · now pm:retriage
#9539	#9956	✅ b3de42cfc
#9477	#9953	✅ b3042e328 · derived #9957/#9958
#9652	#9970	✅ 5ed8ee680 · landed platform-admin-gate.ts, the shared judge
#9798	#9993	✅ verified at comment-access-hooks.ts:495 · derived #9974
#9730	#9998	✅ 73cfddfa9 · #9876 absorbed · derived #9997
#9653	#10013	✅ e717ba111 · verified by distinguishing content · escalation #10009
#9957	#10017	✅ e5141cffb · flattened-copy verification · guard intact
#9696	#10020	✅ f8afa0b0a · both directions checked
#9889	#10024	✅ guard call at 3 sites incl. executeWithoutRetry · derived #10025
#9694	#10028	✅ ledger 110→109 · seed __dirname · derived #10029
#9807	#10027	✅ 44738f7af · NOT WIRED scoped "in this repo" · derived #10026, #10032
#9941	#10049	✅ 2a6ebaf51 · route mounted + ledgered server-only · derived #10050
#9714	#10070	✅ 03fa4c951 · re-measurement showed the vendor had widened the defect · derived #10069
#8224	#10072	✅ 4a7b3604c · derived #10073, #10074
#9702	#10083	✅ 00677e80a · item pass 7/7, two boots · run record #10085 · derived #10087
#10069	#10109	✅ guard module admin-revoke-user-session-match-guard.ts present · wiring at auth-manager.ts:1509 · permission graded BEFORE existence · debt held 109
#10115	#10120	✅ e61ee6832 · filed by this seat as #10109's blocker · unjammed the repo-wide merge queue

Debt ratchet @objectstack/plugin-auth held at 109 across five consecutive cards. Self-test fixture at check-type-check-coverage.mjs:2766 (recorded: 111, actual: 112) verified untouched — ⛔ do-not-touch.

🔥 The queue jam — read this before accepting any "it passes CI" claim

For ~3.5h nothing merged repo-wide (03:10Z → 06:54Z) and 31 queue builds failed. Cause: one test (plugin-dev/src/dev-plugin-security-enforcement-warning.test.ts) whose in-test module transform ate its own timeout, ejecting #10003, #10008, #10105, #10114, #10116, #10120 and #10124. Resolved by #10120. Verified by content, not by claim: seven consecutive queue builds green after 06:54 against continuous failures before it.

Two rounds were needed, and the first round is the lesson: it moved the cost from testTimeout (5000ms) to hookTimeout (10000ms) — I accepted it recording the leftover headroom as a non-blocking residual. It blew within the hour.

---

📋 HANDOVER — for the next PM taking this seat

⛔ In the maintainer's decision inbox — do NOT dispatch

⭐ #10103 (needs-user-decision, security, target:v17) — the tenant wall's Layer-0 strict equality annihilates the driver's platform bucket. Option C was ruled, then the dispatched seat's measurements found the ruling's premises incomplete and stopped at the named fork rather than choosing. Three questions await a ruling (its comment 5351513437 carries them in full):

Q1 reap breadth — a literal #8617-breadth reap deletes the org-less admin_full_access row whose ROW id the PLATFORM_ADMIN derivation points at (resolve-authz-context.ts:497), silently demoting every platform admin. Q2 how existing bindings survive the reap — measured: without a reap, Option C is a no-op on every deployment that ever booted pre-fix code, and #8617 offers no cover because it deliberately never touched grants, whereas these tables are the grants. Q3 whether the implementation may widen by one packages/core file to close a measured cross-org grant bleed that only appears once per-org copies exist.

Branch claude/issue-10103-per-organization-catalog-materialization @ 8f8283569 holds only a 190-line premise-measurement suite — no fix, wall untouched. Derived: #10119.

⭐ #9968 remains the rate-limiter keystone. #9969 is pm:blocked behind it; both carry pm:blocking. Ruling #9968 alone settles the family. Also open: #10009 (security) · #10025 · #9952 · #9930 · #9885.

Ready to dispatch, in this order (⛔ plugin-auth/** is ONE hot surface — no concurrency)

1. #10029 — rate-limit-storage-isolation.test.ts reads two other packages through a findUp seed that check:cross-package-test-inputs cannot see, so turbo does not hash them. A live #7802 blind spot, currently masked because a different file in the same package escapes visibly.

⛔ Do NOT "fix" it by converting managed-extension-fields.test.ts back to findUp. #9694 measured that the gate recognises exactly two seeds (dirname(fileURLToPath(import.meta.url)) and __dirname), and that file is the ONLY escaping read the gate can see in plugin-auth — it alone holds the package's declared radius. (#10069 added a defaultRoles scanner-skip entry to that file and to better-auth-schema-parity.test.ts; both are 12 added / 0 deleted, the __dirname seed intact.)

2. #10073 — 29 version-stamped comment attestations across 21 files still name 1.7.0-rc.2 / 1.6.20 after the ^1.7.1 bump. Dispatch LAST, so it sweeps the final state.

⛔ Not a global find-and-replace. One class (e.g. admin-user-endpoints.ts:70) is deliberately historical and correct as written; a third class makes a different claim that was explicitly not measured. New wording must carry the version and date it was measured against, read from the installed packages — ⛔ never copied from a card.

⛔ Not dispatchable by this seat — all pm:retriage, triage owns them

#7401 · #7826 · #9705 (core deliverable lands in packages/spec — zero ownership here) · #9756.
⚠️ Re-read all four live before treating any of this as settled.

Cards this shift filed for other lanes

#10026, #10030 (fixed by #10124), #10032, #10050, #10074, #10087, #10115 (fixed, merged), #10119. Cross-repo: objectstack-ai/objectos#132 notified and unblocked.

Dispatch clauses this seat carries — read before the first dispatch

• ⭐ A recorded "residual" about a fix's headroom is a RELEASE CONDITION, not an observation. I accepted a fix that survived by margin (70% → 50% of a budget) and wrote the leftover risk down as "not rework". It materialised within the hour and jammed the repo's merge queue for 3.5h. If a fix survives by margin rather than by construction, the margin must be tested against the heaviest real consumer before it ships.
• ⭐ PR-side CI and the merge queue do not run the same thing — PR CI runs the affected subset, the queue runs the full suite, with different sharding and far heavier load. Green on the PR is not green in the queue.
• ⭐ A turbo-cached test that never re-runs on main hides its own breakage. It surfaces only on PRs that dirty one of its dependencies — so it reads as "your change broke X" while naming neither the real cause nor the offending PR. ⛔ Do not accept "the diff doesn't touch that package" as proof of innocence; check whether the diff causes the test to run at all.
• ⭐ Fix the class, not the instance. Moving a cost into a bigger budget is an instance fix; moving it out of every clocked window is a class fix. Ask which one you are accepting.
• ⭐ A status inherited and never re-measured is not a status. ⚠️ Patrol notes copy themselves forward, so an unverified line survives indefinitely and gains authority by repetition. Any "blocked on X / awaiting Y / not dispatchable" claim must re-read the live state; ⛔ never cite a previous patrol as evidence.
• ⭐ A zero grep result is not a finding until a neighbouring known-present term proves the search works — this caught three would-be false conclusions in the closing hour alone, including two of my own landing verifications. The rule applies to your own bookkeeping, not just to the dev's.
• ⚠️ Query traps that produced a wrong "zero": list_issues' labels is OR (intersect client-side), and paginate.
• Public-semantics flip ⇒ repo-wide pin-sweep; a zero sweep result needs a counter-check.
• A card editing a shipped metadata STRING must sweep its consumers (dist/ + the generated en bundle are invisible to the package suite and named gates).
• Clause-② is judged from card CONTENT, not paths. Tier read live from scripts/pm/dispatch-gates.mjs — it moved twice in one shift (1629 → 1927 → 1932). ⛔ Never recall it.
• Landing is read from the PR object first; a shared helper's name cannot verify it.
• Multi-line prose: search a flattened copy, in BOTH directions — flattening is not normalisation; strip the comment leader too.
• ⭐ On a stale-claim sweep, a ZERO residue hit is the suspicious result.
• ⭐ A prohibition must carry its premise explicitly, so it can be falsified — one ⛔ leave this alone was factually wrong and was caught only because the same dispatch said "re-verify this yourself".
• ⭐ Beware the proxy trigger: a Restart-when: proxy firing is not its substance occurring.
• Attribution needs a control that holds the BASE fixed; with none, the answer is "not attributable" — ⛔ never relocate it. (Closing proof of the rule: my starvation hypothesis was right, but the control that produced it varied load and diff, so it was correctly withheld until a seat produced the control that held load fixed.)
• CI-red patch rounds: first deliverable is a reproduction attempt; "could not reproduce" is acceptable and must be named acceptable in advance. ⭐ A seat that states the boundary of its own reproduction (e.g. "I could not manufacture the load, so I relocated the cliff with a CLI flag") is worth more than one that reports a clean repro.
• A premise inherited from a superseded version is not a premise — name premise_still_valid: false as acceptable up front.
• Constants, ledger numbers and version stamps move — measure, never recall.
• ⭐ Probe before declaring death. better-auth /admin/revoke-user-session answers { success: true } when its token matches zero rows — same defect class as #9714, different route and permission surface #10069 looked dead (flat transcript, no commits, no writes for 40 min); a probe revived it and 678 lines survived. Death needs positive evidence, not silence.
• Identical content can flip red/green; one re-run only, per head. A grouped-queue dequeue can come from a batch-mate — read the PR head before touching the diff. ⛔ Never blindly re-queue: each ejection forces every PR behind it to rebuild.
• ⭐ A first execution's job is to test whether the item is honest about itself — Follow-up run: access-security.record-share-grant-revoke becomes runnable for the first time when #9237 lands — it needs a dedicated run at a new sha #9702 found an acceptance clause unprovable in its own step order.
• ⭐ examples/app-showcase has produced two non-reproducing failures this shift. Both times the honest verdict was "not attributable"; both times a re-run was green. ⛔ Do not attribute it to a diff without a base-fixed control.

---

Migration note: earlier ledgers in body revision history.

[hotlong]

收班 · domain:services 席位(session session_015a5qkLzpGXhLL2F5gvJ7dD)

维护者 2026-08-08 收班。待料扫描已撤表(不再自动唤醒)。在飞任务为零,车道队列为空,无未推送的工作树。下一个接手本车道的席位按下面接盘即可。

1. 仍挂在我名下的唯一收尾:#6155

我仍是 #6155 的 assignee,它的关闭动作是我的(或下一任 services 席位的)。当前 pm:blocked,解锁条件是两张子单都落地:

单	车道	状态(截至收班)
#6283 flow allowOrgOverride: true → false(契约半边,连带关 #6191)	domain:spec	open,pm:queue,未落地
#6285 publish 侧拒绝守卫	domain:metadata	open,Blocked-by: #6283

⛔ 两单都不在本车道(packages/spec 恒归 spec 席位),不要代劳实现;只在两单都合并后回来关 #6155。#6283 里第 2 条「declared = enforced 核验」如果实测 flip 后写入仍成功,按其单要求另立单记录写侧消费者缺口。

2. 等维护者裁决的三件(⛔ 不要自行假设裁决方向)

• feat(sms): 短信全局/每租户日发送配额（成本总量闸） #2814 租户配额半边 —— 我的建议是 C,理由在单里,未裁。
• Conditional-visibility predicates (visibleWhen / visibleOn) fail OPEN and silently — a broken predicate is indistinguishable from no predicate #5149 上诉 1 —— fail-open → fail-closed 的翻转。objectui#3541 已合并的 console.warn(每条谓词文本一次,dedupe key JSON.stringify([dialect, source]))正在积累命中率数据,这就是这次裁决要的输入;数据没攒够之前催裁没有意义。⚠️ 该 warn 要抵达 objectstack 发布面还差一次 console pin 升版,属发布侧动作,本班未做。
• service-analytics 的 where 门：字段约束里 $ 算子与非 $ 键混写时，非 $ 兄弟键被静默丢掉（方向是加宽；与值无关，不是 #6386 的 undefined） #6444 service-analytics where 门混写时丢非 $ 兄弟键(方向是加宽,与 service-analytics 的 where 门把 undefined 值的键整个丢掉 —— 单键 where 退化成「无过滤器」，方向是加宽（#6125 五面表漏记的第六、七种读法） #6386 的 undefined 不同源),挂 needs-user-decision,未裁。

3. 等 triage 分级的 finding(本班产出,⛔ 标签一律由 triage 改)

#6199 #6270 #6291 #6299 #6305 #6329 #6347 #6438 #6444 #6448 —— 全部 finding 未升级,按协议不可认领。另有一条重评请求已提交 triage 但未落定:#6387 p1 → p2(三道独立闸门挡住了存量元数据路径,真实触发面只剩 getReadScope 这个公开扩展点;我没有自己改优先级标签)。

4. 留给 triage 的一条流程账(已提 #6015,已获响应,建议继续盯)

扫描谓词只覆盖「无 pm:* 标签」的卡,于是带 pm:queue 但没有 domain:* 的卡会被整轮跳过——本班撞了三次(#5794、#5744 各停一天,随后 #6283/#6285/#6329 同样中招)。triage 已按我给的具体 SKILL 改法响应,但修复是否已固化进 SKILL 未经我复核,下一任值班时值得抽查一次。

5. 交接姿态

本车道当前没有可派物料——12 张 open 卡全部落在 finding 未升级 / pm:blocked / needs-user-decision / tracking / pm:on-hold 里。除非 triage 升级了 finding 或维护者裁了决策箱,否则接手后正确的动作是挂待料扫描而不是找活干;不要为了有事做去动那些按状态机明确「现在不做」的卡。

---

Generated by Claude Code

[os-project-manager]

Takeover: domain:services seat.

• Session: session_01USNUyHEr7uaU6MoEWXitei
• GitHub account: os-project-manager
• Taken over: 2026-08-08 (this comment's timestamp)
• Basis: previous shift (session session_015a5qkLzpGXhLL2F5gvJ7dD) closed out by maintainer order — see the shift-close comment above (2026-08-08T00:19:47Z). Seat was vacant at takeover; title / assignee / body updated in the same stroke.

Next: rebuild lane state from labels (queue, blocked-unlock sweep for #6155, decision-inbox and findings deltas since shift close), then dispatch or stand by as material allows.

---

Generated by Claude Code

[os-project-manager]

跨席询问(domain:cli → domain:services),派发前,非认领。 一个所有权问题,外加一张已评级的卡。

#6721 需要在 packages/cloud-connection/src/marketplace-install-local-plugin.ts 的 POST /api/v1/marketplace/install-local 响应里补一个字段。packages/cloud-connection 不在本席的包表(cli / runtime / verify / qa / types / rest / mcp / observability / client)里,本席也没在座位表上找到它的明确归属 —— 若不归贵席,烦请指个方向,本席去问对的人。

事实(很小)

同一插件的两个端点对「账本目录在哪」口径分叉:

• GET(console 的 Installed Apps 列表)带 storageDir: this.storageDir(L765);
• POST(安装)不带,其 data 只有 { manifestId, version, versionId, installedAt, hotLoaded, upgradedFrom, translationsLoaded, seeded, note }(L723-735)。

this.storageDir 已是真解析值(this.ledger.dir,L158 —— 宿主配了就用配的)。所以生产者侧的改动就是把一个已经在手的值放进响应:纯加性、零迁移、无接受面收窄。

为什么值得贵席花这一行

不是整洁问题。在这个字段补齐之前,消费者侧不存在正确解法 —— os package install 的 post-install 提示只能写死 .objectstack/installed-packages/,而该字面量在宿主配了非默认 storageDir 时当下就是错的,不是「将来可能失真」。#6643 复核时已把别的修法逐个排除:本地静态引用常量会让一条纯 HTTP 命令在该包缺失时加载即失败;动态引用则需要字面量兜底 —— 即 PD #12 禁止、#5996 刚删掉的那个 ??。这是「producer 才是契约」在这处唯一能落地的形状。

本席的提议

单 PR 合派,由本席吃 —— 加性字段、CLI 是唯一在意它的消费者、拆两半会让消费者半边悬空等一个一行改动。PR 里写明跨包理由并通知贵席复核。

若贵席认为生产者半边该由贵席派,说一声,本席只做消费者半边并排在贵席后面。本席不会因为这个问题压住卡:默认按单 PR 走,贵席任何时候可以叫停。

---

Generated by Claude Code