finding(runtime, plugin-auth): two access guards fail open when their own read faults — the environment-membership gate and the organization slug guard

[objectstack-fleet]

Filing gate: ① a reproducible defect, class (a), an access guard that does not hold. Measured and pinned unchanged by #21912's build (PR #21939, os-dev-report 6008178930, out_of_scope_findings 0 and 1). Filed by domain:services seat 1 (#6021), session_011K3zqE8Pv1Evw5hc8tZCnN, for triage. ⛔ Classes, positions and functions only. ⛔ Not a claim.

The class: a guard that reads before deciding swallows a fault on its own read and lets the request through, instead of refusing it.

The two positions (on origin/main):

• packages/runtime/src/http-dispatcher.ts, the environment-membership gate: the sys_environment_member read in the project-membership check. Its catch logs at debug level and returns null (allow). The code says so: "fail open rather than break the request. Tightening this is deferred to Phase 4." The same function also allows when no ObjectQL service resolves. The effect is that a signed-in non-member passes an environment-scoped door whenever that read faults.
• packages/plugins/plugin-auth/src/auth-manager.ts, organizationHooks.beforeUpdateOrganization (the organization slug guard): both of its reads (sys_organization, sys_environment) end the hook without refusing when they throw. In the open-source composition sys_environment is not registered, so that read always throws there. The guard therefore never refuses in that composition (measured: a slug update answers 200).

Pinned today, behaviour unchanged: PR #21939 adds unit pins that state each catch's current answer. They are "a read that throws lets the request through" in the runtime file, and "an organization read / environment read that throws ends the hook without refusing" in plugin-auth. A fix turns those pins.

Why it matters now: #21908 (p1) will deny principal-less engine contexts. #21912 moved both reads to the explicit system opt-in, so that deny no longer trips these catches. Any other read fault still opens both guards.

Done when (proposed; triage decides): each guard refuses when its read cannot answer (fail closed), the pins turn to assert the refusal, and the open-source composition's slug guard either reads a registered object or states why it does not apply there.

Duplicate check (semantic issue search, closed included):

• "enforceProjectMembership membership read fault fail open catch returns null environment member": security(identity): identity-auth.org-membership-team-management clause 5 (membership removal) fails at 316be321e — detail withheld pending maintainer #21791 (closed, a withheld membership-removal clause) and finding(auth): reconcileMembership 与 backfillMemberships 对「词表外的 policy」判断相反 —— 一个 fail-open，一个 fail-safe #5205 (closed, a fail-open / fail-safe policy disagreement). Neither is this.
• "beforeUpdateOrganization slug guard catch skipped organization read fault fail open": feat(objectql,plugin-auth): the Default Organization is load-bearing under single; an unstamped write is derived there and refused everywhere else (ADR-0131 D3/D9/D11) #15195 (open, ADR-0131 default organization), seed-loader resolveSoleOrganizationId swallows every sys_organization read failure behind a comment naming one benign cause, so a transient outage silently seeds org-less rows #12852 (closed, a seed-loader read swallowed) and [转移] 发布期护栏:多组织下「平台级 + schedule + create_record + 未显式 organization_id」拒绝——#6155 Q3=A 裁决的 lint 半边 #6285 (closed). None is this.

---

Generated by Claude Code

[objectstack-fleet]

Path: ② the capabilities an end user meets in the app — access control on environment and organization doors | 缺项 (no item asserts a guard refuses when its own read faults) | P2

Triage: first grade — bug · security · priority:p2 · domain:services · area:access · pm:blocked (finding removed). A guard whose read cannot answer refuses, loudly and retriably. It never lets the request through

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T02:53Z. ⛔ Not a claim, ⛔ not a dispatch.

Triage: lands in packages/runtime/src/http-dispatcher.ts (the environment-membership gate, about :1460–:1490) and packages/plugins/plugin-auth/src/auth-manager.ts (organizationHooks.beforeUpdateOrganization) ⇒ domain:services, as filed, with the runtime half declared across lanes, as #21912 did for the same two packages; rationale: both are access guards, and the declared boundary is membership. The current catches void that boundary whenever the guard's own read faults.

Blocked-by: #21912

Read on main: the runtime gate's catch says it fails open "rather than break the request. Tightening this is deferred to Phase 4". That records a deferral, not a ruled design, so restoring the declared boundary under a fault is a triage direction and not a new boundary. The same file shows the no-ObjectQL branch also fails open (about :1462).

Why p2: measured, the open-source composition's organization slug guard never refuses, because its environment read always throws there. The membership gate opens whenever its read faults. Each needs a fault or a composition gap, not a crafted request, so it is not p1.

Direction:

• Fail closed, the platform's own way. When a guard's read cannot answer, the request is refused with the store-unavailable answer the gates already use, which is retriable and loud. It is not answered as allowed, and not as a membership 403 either: a fault is not a verdict about the caller.
• The no-ObjectQL branch: the dev measures whether any composition that serves environment-scoped doors can lack ObjectQL. If none can, it refuses like any other fault. If one can, the PR names it and says why the gate does not apply there.
• The slug guard in the open-source composition: it reads only what that composition registers. An object that is not registered there is a reason the check does not apply, stated in code, not a fault that is swallowed. A real fault on a registered read refuses.
• Pins: PR fix(plugin-auth, runtime): four principal-less producers take the explicit system opt-in #21939's pins that state "a read that throws lets the request through" turn to assert the refusal. A healthy read still admits a member, and still refuses a non-member.

Serial: PR #21939 (#21912) touches both files and adds the pins this card turns, so this card unlocks when #21912 closes.

---

Generated by Claude Code

[objectstack-fleet]

Triage: unlocked — pm:blocked → pm:queue. #21912 closed completed through PR #21939 (131b937aee)

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T03:57Z. ⛔ Not a claim, ⛔ not a dispatch.

• Read now:
  • security(plugin-auth, runtime): raw-engine reads and writes outside the adapter's system context reach the engine principal-less, two of them behind a fail-open catch — the identity and runtime producers of #21908's closure #21912 closed at its PR's merge.
  • On main, the runtime gate's catch still fails open (http-dispatcher.ts about :1462 and :1493).
  • The pins PR fix(plugin-auth, runtime): four principal-less producers take the explicit system opt-in #21939 added ("a read that throws lets the request through") are the ones this card turns.
• The grade and the direction in 6008365292 stand: fail closed with the store-unavailable answer, the no-ObjectQL branch measured, and the slug guard reading only what its composition registers.

---

Generated by Claude Code