Repository navigation
ADR-0138 E2: the closed list of doors recorded in the conformance matrix, denial by domain, and D2b's publish refusal (D2, D2b) #23225
Description
This card carries execution card E2 of ADR-0138, which is now Accepted (docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md). PR #23219 accepted it on the maintainer's approval (os-zhuang, review 5501651056), merged as 38a2d3c76, and closed #22146. The record's Execution plan orders: "The seat cuts these cards from the accepted record."
Filed by domain:spec seat 2 (#18549) · os-justin · session session_01BRQ9Mp1yH7R1az6MaUM18H, at #22146's landing. ⛔ Not a claim. Reader who acts: triage, to grade and route. The landing package decides the domain; the record's Consumers line names the packages. Then the owning seat.
The record's row, verbatim
| Card | Decisions | What lands | Pins | ADR-0087 disposition | Order |
|---|---|---|---|---|---|
| E2 — the closed list and denial by domain, and D2b | D2, D2b, D9's pointer | the six classes recorded in the conformance matrix; any face of a listed domain that still decides per face moved to the domain-level deny; D2b's publish refusal in both directions, with its prescription; the module doc of assemble-execution-context.ts cites this record |
a new route in a governed domain answers 401; each class's admission; D2b refused in both directions (an anonymous flow endpoint naming a system flow, and a flow set to system while an anonymous endpoint names it), each refusal carrying the prescription |
registered, one new semantic entry: the publish refusal narrows the accept set, and no conversion can choose a posture for the author |
after acceptance |
Where the record decides it
- D2 — The closed list of doors — Enforced by, quoted: "
shouldDenyAnonymousat each domain's entry, today; and the authorization conformance matrix (packages/qa/dogfood/test/authz-conformance.matrix.ts#AUTHZ_CONFORMANCE), whose rows already fail on a deleted deny call or an unclassified route. Card E2 records the six classes there. ⛔ No new gate script." - D2b — The anonymous door × elevated flow combination: a publish refusal — Enforced by, quoted: "the publish path, in both directions. The cross-item read sits where both items are readable at publish, beside the per-endpoint
packages/spec/src/api/endpoint-publish-gate.ts#policyGate, which reads one endpoint only. The refusal narrows the accept set, so card E2 registers one ADR-0087 semantic entry with it. Until E2 lands, ruling A on security(rest, runtime): an anonymous request at an app-declaredauthRequired: falseendpoint executes principal-less — execute it as the guest principal (ruled C), never principal-less, never system #22147 governs and today's combination stands, unchanged."
⛔ Nothing here re-decides the record. A measurement that departs from it is the claimant's finding to raise, never a choice to make silently. D3 item 6 says so for E1's row-scope pins.
Acceptance
Each pin in the row above lands with a negative control that fails when the behavior is removed. The changeset carries the row's ADR-0087 disposition.
Dedupe
MCP search_issues on this repo, closed included, run in the filing act: ADR-0138 execution card guest anchor bindings grants channel E1 E2 E3 E4 guest recipient sys_record_share → 6 hits. Of these, #22146 is the card these are cut from, and #21158 (closed) is D3's original finding. None is an execution card. retire sys_record_share guest recipient select option → 0 hits.
Generated by Claude Code
Activity