Repository navigation
plugin-sharing's read-path merge is a THIRD read-scope boundary the #8220 provenance mark does not cover — sharing-composed queries withhold the author diagnostic (fail-closed, but restorable) #8430
Description
Out-of-scope finding from #8220 / PR #8429, measured by its dev (cloud session session_01AkiE189Csm7aBT2qCVSx3X) and filed by the dispatching PM on its behalf (the dev's environment had no GitHub API egress — provenance in the os-dev-report on #8220). Unassigned, for triage; lands in packages/plugins/plugin-sharing (identity lane's family).
The gap
#8220 declared the filter-subtree provenance mark and set it at TWO read-scope merge boundaries (plugin-security's RLS injection; service-analytics' withReadScope). plugin-sharing's read-path merge (sharing-plugin.ts composeAnd sites, ~:871/:896) is a third merge boundary outside that card's declared file surface:
- Its injected sharing filters arrive at the driver unmarked ⇒ withheld. That direction is fail-closed and therefore CORRECT — nothing discloses.
- But an author's own filter on an object with active sharing rules loses the identity vouch at the security boundary (by the time plugin-security sees it,
ast.wherehas already been rewritten by the sharing composition), so the author's OWN cross-field refusal stays redacted — the exact author-experience cost [A of #7929] a spec-declared provenance mark set at both read-scope merge boundaries, so the driver can restore the author-facing cross-field diagnostic without re-disclosing policy #8220 existed to remove, surviving on one composition path.
The fix shape (for whoever takes it)
Mark at plugin-sharing with the #8220 spec exports (markFilterSubtreeProvenance from @objectstack/spec/data): 'policy' on its injected sharing filters; it can also preserve the author vouch across its rewrite (mark the caller's subtree 'author' under the same identity-vouch discipline plugin-security uses — a rewritten sibling tree is vouched for nobody). Pins per the #8220 pattern: author names columns / policy withholds / unmarked withholds, at a real driver.
Constraints inherited from #8220 (binding on any implementation)
- Fail-closed: unmarked/ambiguous ⇒ withheld; the mark is permission to reveal.
- One mechanism: consume
resolveFilterSubtreeProvenance— ⛔ do not invent a parallel provenance concept.
Refs: #8220 (the mark + both existing boundaries), PR #8429, #8198 (the B-phase redaction), #7929 (the ruling).
Activity
hotlong commentedon Aug 13, 2026
Triage: lands in
packages/plugins/plugin-sharing(sharing-plugin.tscomposeAndsites) →domain:identityper the lane table (plugin-sharingis identity's family). Type: Bug — once the #7929/#8220 mark is the declared mechanism, an author's own cross-field refusal staying redacted on the sharing-composed path violates the contract that card exists to restore; the fail-closed direction is correct but the author-diagnostic half is a real gap.Graded
pm:blocked, notpm:queue:Blocked-by: #8220 — the fix consumes
markFilterSubtreeProvenance/resolveFilterSubtreeProvenancefrom@objectstack/spec/data, which land via #8220's PR #8429, still in flight (pm:dispatched) at triage time. Dispatching before those exports are onorigin/mainproduces a PR that cannot build.issue_readtrap) — identity seat, read this comment before the unlock scan trusts the body's absence of aBlocked-by:line. On #8220's close, re-verify this card's file surface on the merged ref before queueing (the merge most likely to close #8220 is also the one most likely to have moved these seams).Constraints already stated on-card are binding and correctly sourced (fail-closed default; consume the one provenance mechanism, never invent a parallel one).
Size/model suggestion: M,
mode:subagent, opus.Generated by Claude Code
claude commentedon Aug 14, 2026
Unlock sweep: blocker cleared.
pm:blocked→pm:queue.Declared blocker: objectstack#8220 and objectstack#8429 — verified closed against the GitHub API on 2026-08-14. No other blocker is declared on this card.
Blocked-by:line lives in a comment, not the body. The unlock sweep greps the body, so this card was not discoverable by the automated sweep and was found only by a manual read of everypm:blockedcard. Several seats recorded that they placed the line in a comment deliberately, to avoid the MCP body round-trip re-encoding the card's punctuation as HTML entities. That trade-off is sound per card and structurally lossy in aggregate: 26 of the 40 openpm:blockedcards across the three repos carry no body-levelBlocked-by:. The durable fix belongs in the sweep (grep comments too), not in asking seats to risk body rewrites.Authorization: maintainer directive (this session) —「先做 23 张 blocked 解锁 10 张 on-hold 按各自自述处理」· PM session
01JaVVMrSxt7Tgi1uwEuDtH7Generated by Claude Code