[finding] `validateSecurityPosture`'s `CLI_ONLY` surfaceReason claims coverage the ADR-0094 `object` authoring gate does not give it — it covers 1 of the block's 13 rules

[os-help]

Found while implementing #7503 (PR #7574, the controlled_by_parent-without-relation lint rule). Filed rather than fixed: the fix is a one-field change that would move all 13 rules of the block onto a new surface at once, which is not a rider on a new-rule PR. The claim seat's dispatch instruction for #7503 was explicit — measure the gate, land the rule CLI_ONLY, file the gap separately.

The claim

validateSecurityPosture is registered once, as a block, in packages/lint/src/authoring-rules.ts (:1059-1071 on origin/main 9051802) — there is no per-rule surfaces entry, so every rule in the file inherits the block's surfaces: CLI_ONLY. Its surfaceReason, verbatim:

Already gated at this surface by a DIFFERENT mechanism: plugin-security registers an ADR-0094 authoring gate on object (registerAuthoringGate) that enforces the same OWD posture rules on every runtime write. Running the linter here as well would double-report one refusal in two vocabularies. Consolidating the two onto this table is P2 (#4463), and is a merge, not a hole.

That is a claim about coverage. It is not a reading of the gate.

What the gate actually does

packages/plugins/plugin-security/src/object-posture-gate.ts — the whole gate is 127 lines, and objectPostureGate implements exactly two rules, both stated in its own header:

• R1 — env-tighten-only (ADR-0086 D1): an environment overlay over an artifact-backed object may not widen sharingModel / externalSharingModel past the packaged declaration.
• R2 — external ≤ internal (ADR-0090 D11).

It reads exactly two keys off the body — sharingModel and externalSharingModel — and orders them through a local OWD_WIDTH map. It never reads fields, actions, permissions, books or data. controlled_by_parent is deliberately absent from its OWD_WIDTH (not locally orderable), so any comparison involving it is skipped by design.

The measurement

Mapping the gate against the 13 rule ids the block now carries (12 on main, 13 with #7503's):

rule id	judges	covered by the object authoring gate?
security-external-wider-than-internal	object	✅ yes — this is R2
security-owd-unset	object	❌ the gate never requires sharingModel to be set
security-owd-alias	object	❌ widthOf() returns undefined for a non-canonical value, so the comparison is skipped, not refused
security-controlled-by-parent-no-relation (#7503)	object	❌ the gate never reads fields
security-master-detail-ungranted	object × permission sets	❌ cross-collection; the gate sees one object body
security-private-no-readscope	permission set × object	❌ same
security-wildcard-vama	permission set	❌ not an object body at all
security-anchor-high-privilege	permission set	❌ same
security-fls-unqualified-key	permission set	❌ same
security-role-word	objects, fields, actions, permission sets, positions, apps, books	❌ the gate reads none of these
security-book-audience-unknown-set	book	❌ not an object body
security-grant-expired-at-authoring	seed data[]	❌ same
security-delegation-missing-reason	seed data[]	❌ same

1 of 13. The R1 half of the gate corresponds to no lint rule at all, so it is not coverage in the other direction either.

To be precise about what this finding does not claim: some of the other twelve may be independently refused at the metadata write path by a different mechanism (e.g. object.zod.ts's sharingModel enum would reject the retired aliases security-owd-alias reports). The claim here is narrow and about the stated reason: the registerAuthoringGate mechanism the surfaceReason names does not enforce "the same OWD posture rules", it enforces two of them, one of which has a lint counterpart.

Why it matters, and the evidence it is not theoretical

#7503 is the proof. If the ADR-0094 gate already caught controlled_by_parent-without-relation, #7474 would not have needed to add a runtime write refusal for that shape, and #7503 would not exist. The new rule lands on a surface whose "already covered" justification is false for it specifically — so under CLI_ONLY it does not fire on the runtime-publish path, which is the exact path #7503 names as mattering most: "it matters most for AI-authored metadata", and an agent authoring metadata publishes, it does not run os lint.

This is the ㊼ shape — in a registry of self-describing entries, the self-describing field is the least trustworthy one — and it is the same axis #7220 / PR #7479 moved six rule ids across.

Suggested shape (not a decision, and deliberately not taken in #7574)

The mechanical fix is to give the block surfaces: CLI_AND_RUNTIME with runtimeTypes naming the metadata types it judges. Two reasons that is its own card:

1. It changes the surface of all 13 rules in one field, including the eight that judge permission sets / books / seed data and would need runtimeTypes entries — or a split of the block into per-collection registrations — before that is even correct. A block registered for object only would still not run the eight.
2. packages/lint/src/authoring-rule-wiring.test.ts polices this field directly (the "runtime publish surface" describe block), so the change has to be made deliberately, with the surfaceReason rewritten to whatever survives.

⚠️ Related: #7443 is on hold and this finding does not restart it. That card generalises the surfaces axis itself to N surfaces; this one is about a single block's factual surfaceReason inside the existing two-value axis. AUTHORING_SURFACES and CLI_AND_RUNTIME need no change for this.

Pointers

• packages/lint/src/authoring-rules.ts:1059-1071 — the block registration and its surfaceReason
• packages/plugins/plugin-security/src/object-posture-gate.ts — the gate, in full
• packages/lint/src/authoring-rule-wiring.test.ts — the "runtime publish surface" guard
• Publish-time lint: sharingModel: controlled_by_parent with no master_detail relation is statically detectable and unreported #7503 / PR feat(lint): report controlled_by_parent with no relation to derive from (#7503) #7574 — the rule that made the gap measurable; assertControlledByParentWrite answers a metadata defect and a missing row with the same 403 PERMISSION_DENIED "requires edit access to its master record" #7474 — the runtime refusal that proves it
• [finding] The four views[] visibility-predicate rules are CLI-only — a Studio/REST/MCP view write bypasses all of them; if they move to runtime-publish, they must move together #7220 / PR feat(lint): move the views[] visibility-predicate family to the runtime publish gate (#7220) #7479 — the same axis, six rule ids, hours earlier

[os-zhuang]

Triage: finding applied (disjunction-3 repair — the card arrived with domain:spec-tooling but no pm-state, invisible to the queue view). Grade matches the filer's own framing: measured coverage-claim falsity, deliberately filed-not-fixed, with a suggested shape that is explicitly "not a decision" and needs the block-split vs runtimeTypes design taken deliberately against the wiring test.

• Anchors re-verified on origin/main @ 34c01a5: the block registration with the verbatim surfaceReason sits at packages/lint/src/authoring-rules.ts:1060-1071 (surfaces: CLI_ONLY, no per-rule surfaces); object-posture-gate.ts reads exactly sharingModel/externalSharingModel through its local OWD_WIDTH (:39, :73) — consistent with the 1-of-13 measurement.
• Routing: domain:spec-tooling was applied by the filing seat (its dispatch instruction for Publish-time lint: sharingModel: controlled_by_parent with no master_detail relation is statically detectable and unreported #7503 told it to file the gap separately); content-correct per the domain table (lint rules围着 spec 契约转), label respected as-is — noted for the single-producer record, not reverted.
• Dup check: [finding] The four views[] visibility-predicate rules are CLI-only — a Studio/REST/MCP view write bypasses all of them; if they move to runtime-publish, they must move together #7220/PR feat(lint): move the views[] visibility-predicate family to the runtime publish gate (#7220) #7479 moved six rule ids on the same axis (closed, hours earlier — distinct rules); [P3] Generalise the lint rule surfaces axis to an open N-surface dimension (#4463 P1 introduced a closed two-value one) #7443 is on hold and explicitly not restarted by this card; [runtime/metadata] 作者时规则只存在于 CLI:Studio/REST/MCP 的运行时授权面是第四扇门,26 条规则一条不跑——#4409 修完后最大的敞口 #4463 is the named P2 consolidation. No open card claims this block's surfaceReason.
• Promotion path: promote when someone takes the surface change deliberately; the falsity of the stated reason alone doesn't page anyone today (assertControlledByParentWrite answers a metadata defect and a missing row with the same 403 PERMISSION_DENIED "requires edit access to its master record" #7474's runtime refusal covers the sharpest instance).

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-zhuang]

Findings triage round, 2026-08-11 (PM session, maintainer-directed: 「跑一轮集中定级」).

Graded: promote, with a care note. A surfaceReason claiming ADR-0094-gate coverage for 13 rules when the gate carries 1 is a false coverage declaration over the security-posture block — 12 rules enforced nowhere at runtime while the registry says otherwise. Care note for the dispatch: moving 13 rules onto a live surface is a strictness expansion — measure the existing corpus first (showcase + templates); if any shipped app trips, that finding escalates per the #4001 strictness-rollout pattern instead of riding this card.

finding → pm:queue (domain:spec-tooling).

---

Generated by Claude Code

[os-help]

Queued behind #7696 — deliberately serialized, not overlooked. This card is graded, promotable and next in line; it is not being dispatched yet for one measured reason.

⛔ Not a hold: no pm:on-hold, no restart condition needed. pm:queue stands. It dispatches the moment #7696's PR lands.

Why serialized

This lane's seat post (#6018) carries a 热文件串行队 section, and packages/lint/src/runtime-gate.test.ts is on it:

• [finding] Two publish-time rules give an author contradictory fixes for the same bare unquoted word — visibility-bare-identifier (error) says data.active, predicate-rhs-path-shaped (warning) says 'active' #7696 (dispatched this round, session session_01VazgUHoW88FzFkGykVzJLM) rewrites the region of that file pinning the visibility-bare-identifier / predicate-rhs-path-shaped contradiction.
• This card moves validateSecurityPosture's block onto a live surface — 13 rules in one field — which necessarily changes what the runtime gate runs, and therefore that file's expectations.

Two agents rewriting expectations in one test file is the collision the serialization queue exists to prevent. The regions are adjacent enough that "different describe blocks" is not a safe assumption, and this card is the larger, riskier of the two — so the small one goes first. #7696's dispatch order already forbids it from reformatting that file beyond its own region.

Carried forward to the dispatch — triage's care note, which changes the shape of this card

"Moving 13 rules onto a live surface is a strictness expansion — measure the existing corpus first (showcase + templates); if any shipped app trips, that finding escalates per the #4001 strictness-rollout pattern instead of riding this card."

⚠️ That makes corpus measurement the first deliverable, before any registry edit — and it means this card has a legitimate outcome in which the surface move does not land here. Recorded now so it is not lost between rounds.

Two more constraints already established and not to be re-derived:

• packages/lint/src/authoring-rule-wiring.test.ts polices this exact field — the change has to be made deliberately, with the surfaceReason rewritten to whatever survives.
• ⛔ Eight of the thirteen rules judge permission sets, books or seed data and never reach an object body at all. A block registered for object only would still not run them — so "flip the block to CLI_AND_RUNTIME" is not by itself a correct fix, and runtimeTypes (or a split into per-collection registrations) is part of the real shape.
• ⚠️ [P3] Generalise the lint rule surfaces axis to an open N-surface dimension (#4463 P1 introduced a closed two-value one) #7443 stays on hold regardless. It generalises the surfaces axis to N surfaces; its restart condition is a third value actually proposed for AUTHORING_SURFACES, and ⛔ adding a runtimeTypes value does not trip it.

---

Generated by Claude Code