feat(core,plugin-security,plugin-auth)!: the authorization resolver reads a grant's permission set by name (ADR-0131 D4, C2 stage S5a) by objectstack-fleet[bot] · Pull Request #22495 · objectstack-ai/objectstack

test(plugin-security): record the resolver's grant-equivalence goldens per principal on the base

claude

committed

61765bf

feat(core): the authorization resolver reads a user grant's permission set by name

claude

committed

88d509b

fix(plugin-security,plugin-auth): a grant's name never crosses organizations; the guard reads the anchor the resolver reads

claude

committed

3349564

test(plugin-security): resolver by-name pins on a real engine, the write-time organization rule, the upgrade boot; changeset

claude

committed

c5f5028

test(plugin-auth): moving the admin_full_access row into an organization is a standing write

claude

committed

8b909c3

test(plugin-security): explain and resolver fixtures name their grants as the platform writers do

claude

committed

e537ee6

test(plugin-auth): fixtures name their grants as the platform writers do; the memory doubles read an absent column as NULL

claude

committed

7a508d2

test(rest,runtime,plugin-hono-server): grant fixtures carry their set's name; doubles answer the by-name read

claude

committed

069b843

test(cloud-connection,plugin-sharing,plugin-approvals,services): grant fixtures carry their set's name; doubles answer the by-name read

claude

committed

4222058

test(plugin-security): the upgrade-boot pin asserts the listening leg before the stored name

claude

committed

e970fb7

Merge remote-tracking branch 'origin/main' into claude/issue-15196-s5a-resolver-grant-name

claude

committed

2e2d3be

Navigation Menu

Repository navigation

feat(core,plugin-security,plugin-auth)!: the authorization resolver reads a grant's permission set by name (ADR-0131 D4, C2 stage S5a) - #22495

feat(core,plugin-security,plugin-auth)!: the authorization resolver reads a grant's permission set by name (ADR-0131 D4, C2 stage S5a)#22495
objectstack-fleet[bot] merged 11 commits into
mainfrom
claude/issue-15196-s5a-resolver-grant-name

Commits on Oct 9, 2026

test(plugin-security): record the resolver's grant-equivalence goldens per principal on the base

feat(core): the authorization resolver reads a user grant's permission set by name

fix(plugin-security,plugin-auth): a grant's name never crosses organizations; the guard reads the anchor the resolver reads

test(plugin-security): resolver by-name pins on a real engine, the write-time organization rule, the upgrade boot; changeset

test(plugin-auth): moving the admin_full_access row into an organization is a standing write

test(plugin-security): explain and resolver fixtures name their grants as the platform writers do

test(plugin-auth): fixtures name their grants as the platform writers do; the memory doubles read an absent column as NULL

test(rest,runtime,plugin-hono-server): grant fixtures carry their set's name; doubles answer the by-name read

test(cloud-connection,plugin-sharing,plugin-approvals,services): grant fixtures carry their set's name; doubles answer the by-name read

test(plugin-security): the upgrade-boot pin asserts the listening leg before the stored name

Merge remote-tracking branch 'origin/main' into claude/issue-15196-s5a-resolver-grant-name