[PM seat] security — 🟢 os-tesla #29740

security#1 · os-tesla · session_01L9qibvynRbCtMndW8EHNGc

⚠️ Seat stub. Job description: .claude/skills/pm-dispatch/references/lanes/security.md (⛔ not copied here). Never-public rules: .claude/skills/pm-dispatch/references/security-findings.md. This is security seat 1. This post carries no finding, path, object name or mechanism, by rule.

Current PM — 🟢 os-tesla

• Holder: os-tesla · session_01L9qibvynRbCtMndW8EHNGc · seated 2026-11-06T04:59Z on the maintainer's summons in the os-tesla project (「现在开一个 security 车道」, 2026-11-06T04:52Z). The previous holder's clock-out brief (session_01L6bhgVfjk2i8T2D4RmxsKg, body revision of 2026-11-06T03:54Z) was the latest event on this post, so the seat was taken directly.
• Advisory access: one relay advisory_read opened in this session before seating (run 42165450033); nothing printed.
• Patrol: trig_01XPmzCAKGGtK6WQYTmcCaRt · 58 * * * * (hourly, self-bound).
• Mailbox: PR pm:mailbox — security#1 · os-tesla #30818 (subscribed).
• Concurrency: at most 5 card threads or subagents for this seat (this account's maintainer word, 2026-10-30, latest for this account).
• Takeover: /pm-dispatch 接手, then read this post first. Advisory text is read only through the relay advisory_read; this post carries no finding, path or mechanism.
• Ledger rule: one row per advisory, opaque id · session · state, ⛔ no detail. Claims on advisory fixes live here, never in session memory.

Previous holder's clock-out (archived in the body revision of 2026-11-06T03:54Z): os-sales · session_01L6bhgVfjk2i8T2D4RmxsKg, seated 2026-11-05T10:45Z, clocked out 2026-11-06T03:52Z; mailbox #30424 closed; patrol deleted. Its in-flight PRs #30702, #30717 and #30783 are taken by this holder (Resume-from: the hand-over section below).

Ledger

Standing orders (inherited: the maintainer's, given in the previous holder's session session_01QSeKYn5CmmdShCJifm6WYj, verbatim):

• 「目前的修复都关闭」 and 「你处理完的可以都先关闭」: once an advisory's fix merges, the seat closes it through the relay advisory_state and records it here.
• 「哪些高危要发布应该在我版本发布前决策吧」: before each version release, the seat puts a publish-or-not list to the maintainer, covering the closed advisories since the last release (high and moderate first), reviewed at CONTRACT_REVIEW_TIER first. Publishing is the maintainer's: they reopen and publish in the advisory UI, since the relay cannot move a closed advisory.
• 「同意,batch 调到 5」: the previous holder ran at most 5 slots. The os-sales holder ran at most 4 per seat (its maintainer's word at 2026-11-05T21:32Z); this holder runs at most 5 (see Current PM).
• 「只记录,暂停派发」 (2026-11-04), lifted by 「可以继续派发」: the fourth and fifth decision batches are ruled and recorded in the seat's private notes, and dispatch has resumed.
• 「changeset 改写确认都同意」 (2026-11-05): a pending-changeset DELIBERATE CORRECTION lands on the seat's own record, as landing-operations.md already says (the ACCEPT quoting before and after, or the same-head at-tier PASS). The seat does not wait on the maintainer for it. Skills card: pm-dispatch skills: say who confirms a pending-changeset correction (the seat's record, never a maintainer wait) everywhere a dev or the gate is told to "get it confirmed", and keep PR bodies from narrating pre-fix behaviour on security fixes #30271.
• Maintainer rulings 2026-11-05T21:32Z (decision cards in this seat's thread): an API-key credential whose owner record no longer exists is refused at verification (in flight, PR fix(core)!: an API key authenticates only as an owner who exists #30783); on the 2.8 detail-write master re-read, both legs report a store fault as a fault and only a real permission verdict answers 403 (not dispatched). Security seat concurrency 4.

Clock-out hand-over (2026-11-06T03:52Z), taken by os-tesla

In flight, released to the next security holder (Release: session_01L6bhgVfjk2i8T2D4RmxsKg · Resume-from: this section). Every PR is draft, base main, no closing keyword, opened by the relay; each dev's work is committed and pushed; the in-seat dev sessions ended with this session.

• fix(rest,runtime)!: the import doors and the catalog refresh read the walled-catalog verdict the metadata save door reads #30702 (GHSA-c9q6) head 7b06b726ac. Rule: under the walled tenancy postures, importing a remote table as an object and refreshing a datasource's external catalog are catalog writes reserved to the platform operator, at REST and MCP. A third door was folded in after the first head. Owed: ablations of the shared refusal, outage arm and the new wiring; package tests and typecheck at head; dispatch-gates --commands/--ran; full dogfood battery pinned to the head; a new PR body naming the third door (the current body and title describe the first head); then a full at-tier review, ACCEPT, landing, advisory close.
• fix(plugin-auth)!: an allowed IP range that names no range is refused at save and never matches at the gate #30717 (GHSA-cxjx) head 4b2c6130c0. Rule: an allowed IP range entry is an address or an address with a decimal prefix within its family, saved only as text; anything else is refused at save and matches no address at the gate. Full at-tier review at ad6e705bc7 FAIL (6672830867, one test assertion, fixed); a value-type rule in the same family was folded in. Body refreshed at clock-out (states what is NOT MEASURED). Owed: gates 91-95 then --ran; full battery at head; a same-tier hop delta review of the merge plus the value-type rule; ACCEPT, landing, advisory close.
• fix(core)!: an API key authenticates only as an owner who exists #30783 (maintainer ruling above, API-key half) head d6d9728906, CI 57 success / 0 failure at that read. Owed: full battery at head; typecheck of the consumer packages after the last main merge; the body's battery block; a full at-tier review (Clause-②: yes (narrowing) per its changeset), ACCEPT, landing.

Holds this seat placed on other lanes' PRs: none now. #30747 was handed to this seat by the maintainer, carried on as #31031 with the fix for its low row, and closed with a pointer; #31031 merged eb96480dd6.

Not dispatched (next orders, by priority):

• The two other low rows from the GHSA-4gjj read, then GHSA-5wqc.
• The 2.8 detail-write ruling above.
• The sibling grant path under the GHSA-883m row.
• Follow-ups on fix(runtime,plugin-auth)!: a banned user's OAuth access tokens and refresh grants are refused while the ban holds #30360's review shoulds (a branded 503 on one OAuth endpoint with a pin, a pairwise pin).
• Two residuals recorded privately from fix(runtime)!: an action that dispatches to a handler another declared action owns also answers with that owner's permission and activation gates #30788, one from fix(rest,runtime)!: the import doors and the catalog refresh read the walled-catalog verdict the metadata save door reads #30702 (none blocking).
• plugin-auth: an MCP JWT access token cannot be revoked — /oauth2/revoke answers 400 and delete-consent ends nothing, against IAuthService.verifyMcpAccessToken's 'falsy when revoked' (objectstack-ai/cloud#3606 ruling A) #30345 (p1, public card) and skills cards pm-dispatch skills: say who confirms a pending-changeset correction (the seat's record, never a maintainer wait) everywhere a dev or the gate is told to "get it confirmed", and keep PR bodies from narrating pre-fix behaviour on security fixes #30271, pm-dispatch SKILL.md: the seat invariant still names MCP rerun_failed_jobs as the one allowed MCP write, while a re-run leaves only through the relay #30159.

For the maintainer (decision or contract):

• GHSA-5654 (received): the fix extends a registration contract, so it needs the maintainer's contract first.
• GHSA-c62f (received): fix shape after review.
• GHSA-hjqw: the explain half awaits a ruling.
• Spec-layer parity for the self-registration audience schema (from fix(plugin-security, plugin-auth)!: a person-to-permission-set assignment refuses an agent ceiling set at every write door, and so does the self-registration permission set #30578); an ADR-0090 D12 amendment (Tier H).
• The previous holder's maintainer list below still stands where not marked merged.
• Before the next release: the publish-or-not list of advisories closed since the last release (standing order).

Earlier holder's hand-over (2026-11-05T07:48Z), status then: #30287, #30307, #30360 merged; its maintainer items (batch 7, the high advisory's three items, the controlled-by-parent master read, the old PR-body revisions on #30180 and #30219, the change-email notice id) remain with the maintainer; #30345 and skills cards as above.

Landed by this holder: #30783 5d4f2aa6b5, #30702 adb2b89b8a, #30717 b58beb8281, #30879 1aeeafd9d3 (Fixes #30345), #31005 adab62aa55, #31031 eb96480dd6 (Fixes #29029, supersedes #30747), #31042 e1dac19257, #31046 13227b5761, #31063 cad764d3e2, #31061 5210acfbae (domain:server#2 told on #30818), #31065 8304b08570, #31072 d6b88f19f5 (member attachments from the browser panel), #31075 24bc259363. Landing authority: the maintainer's card answer in this seat's thread (2026-11-06T14:08Z) gives standing approval for security PRs with an at-tier contract PASS, seat ACCEPT and green checks at Tier S; Tier H stays with os-zhuang.

Follow-ups owed by this holder (rule level, not dispatched): the ApiKeyRefusalReason docblock wording after #30783; the synchronous tenancy-posture read's fault classification at the REST import and refresh doors, and the refresh refusal's subject row, after #30702; a non-array value at the allowed-IP config patch read closed, after #30717; a non-form revoke body passes the provider's answer through, after #30879; whether narrowing a consent's scope ends tokens already minted (decide advisory or card). After #31046: dotted filter keys in the roll-up check, and the View All caveat in one docs sentence. After #31063: the webhook headers gate's docblock, the verdict for a driver that omits a key, and one changeset sentence for a hook that writes the parent key back. After #31065: keep the hook-handler refusal sentence to the api it names, a beginTransaction() pin, and a card covering in-process action handlers together with retiring the deprecated in-process hook handler route. After #31072: the vouched-reference call-site census gate as its own PR (it adds a workflow step, so it goes to the maintainer), the upload's commit made conditional on the state it was judged in, the vouch mark stripped from a hook's options view too, and one answer for a missing row on the three upload doors. After #31075: the cause clause of the system-object refusal sentence, the docs and tool-description wording for the listing rule (connect-mcp, actions-as-tools, the list_actions description, the generated SKILL.md and its console mirror), a revision note on the AI QA checklist clause, one projection per object per listing, and the objectOverride label as its own card.

Hot-file serial queue

⛔ Re-derive from live claims and each open PR's file list before every dispatch.

• None held as a lane: fixes land in their owning packages through no-card orders.
• The skills-lane cards on lanes/security.md and security-findings.md that the previous holder queued (pm/fleet-write: the relay publishes a security advisory on the maintainer's list: reopen, set the affected and patched versions, publish #30110, pm-dispatch skills: the security seat's triage of a non-finding, its ledger states after the close-on-merge order, a release's contents read by ancestry, and the CI recoveries the relay leaves #30111) are both closed; nothing is held on those files.

Notes

• Write path: the relay (post-stamped.mjs, label-write.mjs, issue-create.mjs, fleet-write/dispatch.mjs). ⛔ No GitHub MCP writes. Advisory text is read only through the relay advisory_read.
• domain:skills#2 ([PM seat] domain:skills · seat 2 — ⏳ vacant #19287), held by the previous holder's session for the security work's skills-lane cards, was handed back once they landed (clock-out brief 6598110373).