`member_default`'s removed wildcard is still live fact in a PUBLISHED customer skill and in `plugin-security/README.md` — the two sites outside #6964's named file face

[os-zhuang]

Found while implementing #6964 (PR #7149), by sweeping the same two expired premises across their whole consumption radius rather than only the packages that card named. Filed unassigned and unlabeled — deliberately not pre-graded, for the same reason #6964's filer declined to pre-grade: one of these two is ordinary prose drift and the other is published customer-facing security guidance, and that difference is triage's call, not the filer's.

The two premises (identical to #6964)

• (a) member_default has a '*' object grant — removed by member_default's * wildcard object grant (C/R/E) union-merges into every org member — app-side explicit-allow object gates are erased on three axes #5491 (PR fix(plugin-security): enforce both declared write-wideners; the platform baseline becomes explicit-allow (#5492, #5491) #6684).
• (b) member_default ships a wildcard tenant_isolation RLS policy — retired by ADR-0095 D1 in favour of the Layer 0 tenant wall (plugin-security/tenant-layer.ts).

Both re-measured on origin/main @ 3e8e669c0 against the real imported defaultPermissionSets: member_default.objects['*'] is undefined, and its rowLevelSecurity carries no tenant_isolation entry — only owner_only_writes / owner_only_deletes (update/delete) and the *_self per-object carve-outs.

#6964 named platform-objects, qa/dogfood and content/docs/permissions/index.mdx, and its dispatch drew that file face explicitly. These two sites are outside it and were not fixed by PR #7149.

1. skills/objectstack-data/SKILL.md — a PUBLISHED customer skill, both premises

This is the sharper of the two: not an internal comment but shipped guidance, and it does not merely mention the wildcard — it builds a recommendation on it.

:764 asserts premise (b) as current:

• The default member_default ships a wildcard tenant_isolation RLS (organization_id == current_user.organization_id). Any row whose organization_id is null or absent (common for adapter-written rows that never get the tenant stamp) is denied — the list renders empty.

:781 asserts premise (a), inside a warning callout:

⚠️ Don't use either flag alone. tenancy.enabled:false by itself drops the wildcard RLS, and member_default's '*': allowRead then leaks every row to all authenticated users.

The recommended recipe itself (tenancy: { enabled: false } + requiredPermissions) is still correct, so this is not a wrong instruction — but every reason given for it has expired, and one of them names a leak that cannot happen. A reader who checks the stated hazard finds it absent and may drop half the recipe. The viewAllRecords sentence at :768 is also now imprecise in the same region: under ADR-0095 W2 the superuser bit alone no longer crosses the tenant wall at all — that takes a true PLATFORM_ADMIN (superuser bit and a platform-exclusive capability), which is a stricter rule than "posture-gated".

Note this file is a skills/ artifact, so it is in scope for the skill-frame gates; any fix should re-run check:skill-frame-sync / check:doc-authoring.

2. packages/plugins/plugin-security/README.md:51 — premise (b)

• Service present → keeps the wildcard tenant_isolation RLS policy (organization_id = current_user.organization_id) shipped with the default member_default / viewer_readonly permission sets.
• Service absent → strips those wildcard policies so single-tenant deployments aren't filtered to zero rows.

The described mechanism is the pre-ADR-0095 one. Tenant scope is now Layer 0, and it is inert under the single posture by construction (computeTenantLayer0Filter returns null when postureEnforcesWall is false) rather than by the org-scoping probe stripping policies. This is the plugin's own README describing its own retired behaviour.

Worth checking in the same pass whether viewer_readonly still ships such a policy — the sentence names it alongside member_default, and #6964 only ever measured member_default.

Verified correct — explicitly NOT part of this finding

These matched the same grep and were checked individually:

• content/docs/permissions/access-recipes.mdx:65 — already says "tenant isolation is now the Layer 0 tenant wall in tenant-layer.ts, ADR-0095 D1". Correct.
• packages/cli/src/commands/serve-verify-security-parity.contract.test.ts:18 — "It stayed invisible until member_default's * wildcard object grant (C/R/E) union-merges into every org member — app-side explicit-allow object gates are erased on three axes #5491 removed member_default's '*' wildcard". Correctly historical.
• packages/plugins/plugin-approvals/src/lifecycle-hooks.ts:423 — "member_default's wildcard created_by == current_user.id RLS" is a grep false positive: "wildcard" there means the policy's object: '*', and owner_only_writes / owner_only_deletes still ship exactly that. Do not "fix" it.
• CHANGELOG.md files, content/docs/releases/, and the two pending .changeset/*.md entries — correctly frozen or correctly descriptive.
• packages/plugins/plugin-security/audience-anchor-set-claims.pin.test.ts — the test(plugin-security): stop naming member_default as the plain-wildcard shape, and pin the relation (#6842) #6958 pin, correct; its watchedSurfaces() deliberately watches only two surfaces. Whether it should grow more is the open scoping question member_default's removed wildcard is still named as live fact in platform-objects, qa/dogfood and the permissions doc — the #6842 family, four packages further out #6964 already raised and triage has not ruled on.

Why it stayed silent

Same reason #6842 and #6964 give, and the reason this keeps recurring: nothing mechanically relates "prose names set X as having shape Y" to what defaultPermissionSets actually ships. The #6958 pin closes that loop for two named surfaces only. If triage ever does want the pin to grow a repo-wide surface, these two files are the concrete argument for it — this is now the third filing in the same family.

Related: #6964 / PR #7149 (this issue's origin), #6842 / PR #6958, #6696 / PR #6846, #5491 / PR #6684 (cause (a)), ADR-0095 D1 (cause (b)), #6628 (the pin idiom).

[os-zhuang]

Triage: pm:queue + domain:identity + target:v17.

• Classification: concrete defect — published prose asserting expired security facts, with exact line anchors and the filer's own re-measurement against the imported defaultPermissionSets. Both premises re-verified on origin/main @ 3e8e669: skills/objectstack-data/SKILL.md still asserts the wildcard tenant_isolation RLS as current fact and warns about a member_default '*': allowRead leak that cannot happen (the callout block is live), and packages/plugins/plugin-security/README.md:51 still describes the pre-ADR-0095 probe-and-strip mechanism as the plugin's own behaviour.
• Routing: cross-domain file face (skills/** ⇒ devx territory, plugin-security/README.md ⇒ identity), split cost exceeds benefit for two prose edits sharing one premise set — routed domain:identity per the family precedent (member_default's removed wildcard is still named as live fact in platform-objects, qa/dogfood and the permissions doc — the #6842 family, four packages further out #6964, same premises, mixed file face, identity lane) so the family stays in one lane; treat as the rule-4 cross-domain exception: claim comment should declare the full two-file face, and the SKILL.md edit must re-run check:skill-frame-sync / check:doc-authoring as the body notes.
• target:v17: sibling member_default's removed wildcard is still named as live fact in platform-objects, qa/dogfood and the permissions doc — the #6842 family, four packages further out #6964 carries it, and the four-class check lands the same way here — this is the sharper surface of the same defect (a PUBLISHED customer skill whose security guidance builds a recommendation on a hazard that no longer exists; class ②/④: shipped guidance mis-describes the security model). Obligation follows the work per the split rule.
• Not blocked: member_default's removed wildcard is still named as live fact in platform-objects, qa/dogfood and the permissions doc — the #6842 family, four packages further out #6964 / PR fix(qa,platform-objects,docs): re-premise member_default's removed wildcard and replace two vacuous D7 denial cases (#6964) #7149 is in flight but its dispatched file face (platform-objects, qa/dogfood, permissions doc) is disjoint from these two files by construction — no Blocked-by: needed; the implementer should still base on the post-fix(qa,platform-objects,docs): re-premise member_default's removed wildcard and replace two vacuous D7 denial cases (#6964) #7149 ref to pick up any shared-prose conventions it lands.
• Dedup: repo-scoped search (member_default wildcard) — exactly member_default's removed wildcard is still named as live fact in platform-objects, qa/dogfood and the permissions doc — the #6842 family, four packages further out #6964 + this card; the filer's own checked-and-excluded list (approvals false positive, historical test comments, changesets) is thorough and stands.
• Open sub-question carried, not ruled: whether viewer_readonly still ships a tenant_isolation policy (README names it alongside member_default; member_default's removed wildcard is still named as live fact in platform-objects, qa/dogfood and the permissions doc — the #6842 family, four packages further out #6964 only measured member_default) — the implementer should measure it in the same pass and file separately if it opens a third surface.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-zhuang]

Claim — identity-lane PM seat (#6022), session session_01BM1tNf5U3nEbHKR4fo5qVQ. Dispatching to an os-dev subagent now.

• Branch: claude/issue-7151-published-prose-expired-premises
• Worktree: ../objectstack-issue-7151 (dedicated per-task worktree; never the shared checkout)
• Domain / board: domain:identity + target:v17 — labels untouched (single-producer rule; graded and routed by triage 01:22Z, which recorded the cross-domain split rationale)
• Status: pm:queue → pm:dispatched. Thread re-read before claiming: one comment, the triage grading; no dev claim, no competing session ID.
• Priority: target:v17 and in this lane, so it goes first under the maintainer's standing instruction.

Serial constraints cleared: the sibling #6964 → PR #7149 is already enqueued (added_to_merge_queue 01:27:34Z) and its file face is disjoint from this one — #7149 covers platform-objects, qa/dogfood and content/docs/permissions/index.mdx; this card covers skills/objectstack-data/SKILL.md and packages/plugins/plugin-security/README.md, which #7149 explicitly did not touch. No overlap, no wait needed.

Carried to the claimant:

• The two premises are identical to member_default's removed wildcard is still named as live fact in platform-objects, qa/dogfood and the permissions doc — the #6842 family, four packages further out #6964's and must stay separated: (a) member_default has a '*' object grant — removed by member_default's * wildcard object grant (C/R/E) union-merges into every org member — app-side explicit-allow object gates are erased on three axes #5491 / PR fix(plugin-security): enforce both declared write-wideners; the platform baseline becomes explicit-allow (#5492, #5491) #6684; (b) member_default ships a wildcard tenant_isolation RLS — retired by ADR-0095 D1 in favour of the Layer 0 tenant wall. Both were re-measured by the filer against the real imported defaultPermissionSets; re-measure again at your own branch point.
• skills/objectstack-data/SKILL.md is the sharper site and needs the most care: it is published customer guidance, and it does not merely mention the wildcard — it builds a ⚠️ recommendation on a leak that cannot happen. Removing the false premise without removing whatever the recommendation legitimately protects is the actual work.
• packages/plugins/plugin-security/README.md:51 describes the pre-ADR-0095 probe-and-strip mechanism as the plugin's own current behaviour.
• The filer also flagged, unverified, that viewer_readonly may be worth checking in the same pass for whether it still carries that policy. Measure it; report the reading either way.

⛔ Boundaries: nothing under content/docs/releases/; do not "correct" CHANGELOG.md files or releases/ history rows — they are correctly frozen historical records. Do not redo #6964/PR #7149's file face.

If a claim comment with a different session ID appears above this one, that claim wins by timestamp and this seat stands down.

---

Generated by Claude Code