[marchtian]

Requested by 田騏 · project thread

Closes #77 (v0.6 U1).

What changed

• test/portal-platform.test.ts (new, 24 cases): boots the app on 18.1.0 together with a probe module (portal positions srm_vendor_probe_*, a portal permission set written as 04 §3.4 prescribes, a parent-read-only control set, a delegated-admin set, another app's isDefault set, and five one-node flows that write identity rows). Portal users enter through the real path: an admin invites them with role external, they sign up, accept the invitation, sign in again. U2/U3 can reuse the fixtures; the probe positions, permission sets and portal_position are replaced by the real metadata in U2.
• 07 §6.2 results for V1–V5 with the reproduction pointer; 07 §6.3 registers PF17 (objectstack#25251 ruling B); risk rows R1/R2/R4 and the roadmap line updated; test listed in §3.1.
• 04 §3.3 environment prerequisite (membership policy invite-only), operator of portal opening is an organization admin, "开通门户" flow is runAs: 'user', revocation after elimination/blacklist is a notification to the org admin; 04 §3.6 V1 result; 02 §4.x invitation sentence pointed at V3 (was mistakenly V5).

Results (07 §6.2)

	Result
V1 directory	✅ external sees only itself in sys_user, sys_member, by-id reads, list-members, get-full-organization, list-invitations. Requires invite-only: under auto a sign-up is bound as a plain member and reads the whole directory until it accepts (pinned by a control test).
V2 assignment from a flow	⚠️ runAs: 'system' refused (#25251). runAs: 'user' writes sys_user_position and sys_user_permission_set when started by an org owner/admin; refused for a category manager (ADR-0090 D12). A delegated adminScope cannot place an external member (needs a business-unit anchor; externals are not placed in BUs).
V3 invitation from a flow	❌ refused for system (#25251) and for user, even an org admin (ADR-0092: sys_invitation written only by the auth endpoints). invite-member itself is org-admin only (403 for a category manager). Fallback: admin invites on the members page.
V4 controlled_by_parent writes	✅ with parent edit + RLS + FLS: add/edit own supplier's certificates (incl. employee-entered ones, and by a colleague), not another supplier's, no move, no status/verified, no delete. Parent read-only ⇒ child insert/update refused, so parent edit is required. A read-only parent field in a payload refuses the whole write (403), not dropped. Bank account insert needs srm_view_bank_account_no.
V5 other apps' isDefault	✅ reaches every employee, no external member (externals hold external_default, not member_default).

No new platform issue: both non-passing items are the explicit #25251 ruling (identity writes not from elevated automation; invitations via organization endpoints) and the #25233 design (externals not in business units). Registered as PF17.

Verification

pnpm validate, pnpm lint, pnpm typecheck, pnpm i18n:check, pnpm test (24 files passed, 1 skipped as before; 275 tests), pnpm build all pass locally.

---

Generated by Claude Code