[PM seat] security — 🟢 os-bob #29740

security#1 · os-bob · session_012dn2AdqWnb3ndnEacKvJvF

⚠️ Seat stub. Job description: .claude/skills/pm-dispatch/references/lanes/security.md (⛔ not copied here). Never-public rules: .claude/skills/pm-dispatch/references/security-findings.md. This is security seat 1. This post carries no finding, path, object name or mechanism, by rule.

Current PM — 🟢 os-bob

• Holder: os-bob · session_012dn2AdqWnb3ndnEacKvJvF · seated 2026-11-07T14:35Z on the maintainer's summons (/pm-dispatch security in this session). Took the seat directly: the previous holder's clock-out brief (comment 6705659451) was the latest event on this post.
• Patrol: trig_01DK6igUYNeqnWm1nNqgKZGh (hourly, self-bound). Mailbox: pm:mailbox — security#1 · os-bob #31146 (subscribed). Harness current at af3451b08b (check-harness-current.mjs). Advisory access checked before seating: one relay advisory_read opened in this session (run 42382150236).
• Previous holder: os-tesla · session_01L9qibvynRbCtMndW8EHNGc · seated 2026-11-06T04:59Z, clocked out 2026-11-07T10:31Z; its hand-over below is carried as written.
• Concurrency: the os-tesla account's cap (3 dev threads project-wide, the maintainer's word 2026-11-07T04:51Z) was that account's; this holder runs the default batch:3.
• Takeover: /pm-dispatch 接手, then read this post first, then Resume-from: the clock-out hand-over below. Advisory text is read only through the relay advisory_read; this post carries no finding, path or mechanism.
• Ledger rule: one row per advisory, opaque id · session · state, ⛔ no detail. Claims on advisory fixes live here, never in session memory.

Ledger

Standing orders (inherited: the maintainer's, given in the previous holder's session session_01QSeKYn5CmmdShCJifm6WYj, verbatim):

• 「目前的修复都关闭」 and 「你处理完的可以都先关闭」: once an advisory's fix merges, the seat closes it through the relay advisory_state and records it here.
• 「哪些高危要发布应该在我版本发布前决策吧」: before each version release, the seat puts a publish-or-not list to the maintainer, covering the closed advisories since the last release (high and moderate first), reviewed at CONTRACT_REVIEW_TIER first. Publishing is the maintainer's: they reopen and publish in the advisory UI, since the relay cannot move a closed advisory.
• 「同意,batch 调到 5」: the previous holder ran at most 5 slots. The os-sales holder ran at most 4 per seat (its maintainer's word at 2026-11-05T21:32Z); this holder runs at most 5 (see Current PM).
• 「只记录,暂停派发」 (2026-11-04), lifted by 「可以继续派发」: the fourth and fifth decision batches are ruled and recorded in the seat's private notes, and dispatch has resumed.
• 「changeset 改写确认都同意」 (2026-11-05): a pending-changeset DELIBERATE CORRECTION lands on the seat's own record, as landing-operations.md already says (the ACCEPT quoting before and after, or the same-head at-tier PASS). The seat does not wait on the maintainer for it. Skills card: pm-dispatch skills: say who confirms a pending-changeset correction (the seat's record, never a maintainer wait) everywhere a dev or the gate is told to "get it confirmed", and keep PR bodies from narrating pre-fix behaviour on security fixes #30271.
• Maintainer rulings 2026-11-05T21:32Z (decision cards in this seat's thread): an API-key credential whose owner record no longer exists is refused at verification (in flight, PR fix(core)!: an API key authenticates only as an owner who exists #30783); on the 2.8 detail-write master re-read, both legs report a store fault as a fault and only a real permission verdict answers 403 (not dispatched). Security seat concurrency 4.

Clock-out hand-over (2026-11-07T10:31Z)

In flight: none. Release: session_01L9qibvynRbCtMndW8EHNGc · Resume-from: this section. Every PR this holder opened is merged, no branch carries unmerged work, and no dev session is running. The previous holder's hand-over (2026-11-06T03:52Z) is archived in this post's earlier body revisions.

Not dispatched (next orders, by priority; each needs a free project dev slot):

• GHSA-xh7r (medium on this seat's read-only trace; owner plugin-auth). The relay cannot write an advisory description, so the next holder re-runs the read-only impact trace before ordering the fix; the fix rule is in the ledger row.
• GHSA-vmfv, then GHSA-fwcx (low).
• The follow-ups line below.

For the maintainer (decision or contract), one at a time:

• GHSA-6pr9: a design-record ruling (ADR-0055).
• GHSA-8gmf: whether running an action that the metadata projection withholds is refused at the run doors (one rule for REST and MCP).
• Retiring the deprecated in-process hook handler route together with in-process action handlers, as one card.
• A whole-object describe refusal; the showcase question.
• GHSA-5654 (registration contract), GHSA-c62f (fix shape), GHSA-hjqw (explain half): unchanged from the earlier hand-over.
• Before the next release: the publish-or-not list of advisories closed since the last release (standing order).

Landed by the os-tesla holder (2026-11-06 → 2026-11-07): #30783 5d4f2aa6b5, #30702 adb2b89b8a, #30717 b58beb8281, #30879 1aeeafd9d3 (Fixes #30345), #31005 adab62aa55, #31031 eb96480dd6 (Fixes #29029, supersedes #30747), #31042 e1dac19257, #31046 13227b5761, #31063 cad764d3e2, #31061 5210acfbae (domain:server#2 told on #30818), #31065 8304b08570, #31072 d6b88f19f5 (member attachments from the browser panel), #31075 24bc259363, #31086 ad06144bca (a call-site census gate, Tier H, approved by the governed approver; three should-fixes from its review in the follow-ups), #31104 3299873e87 (GHSA-8gmf parts with no open question), #31105 0ba68b61b5 (scan budget for #31086's pin). Landing authority: the maintainer's card answer in this seat's thread (2026-11-06T14:08Z) gives standing approval for security PRs with an at-tier contract PASS, seat ACCEPT and green checks at Tier S; Tier H stays with os-zhuang.

Follow-ups owed (rule level, not dispatched): after #31104: the Skills-docs: line respelled into the template's closed set; the action owner read also taking the legacy key, or withholding an entry whose owner names no object definition; the action references door answering a withheld entry as the item read does; the run doors resolving an override param on its target object (a ruled order); after #31105: the cross-package input probe following a spawned root script's import closure; after #31086: name the shared comment mask in the core pin's declared inputs, state the census boundary in one header sentence and settle the .testkit. exemption, and give the Symbol.for finding its reason clause and a static-import remedy; the ApiKeyRefusalReason docblock wording after #30783; the synchronous tenancy-posture read's fault classification at the REST import and refresh doors, and the refresh refusal's subject row, after #30702; a non-array value at the allowed-IP config patch read closed, after #30717; a non-form revoke body passes the provider's answer through, after #30879; whether narrowing a consent's scope ends tokens already minted (decide advisory or card). After #31046: dotted filter keys in the roll-up check, and the View All caveat in one docs sentence. After #31063: the webhook headers gate's docblock, the verdict for a driver that omits a key, and one changeset sentence for a hook that writes the parent key back. After #31065: keep the hook-handler refusal sentence to the api it names, a beginTransaction() pin, and a card covering in-process action handlers together with retiring the deprecated in-process hook handler route. After #31072: the vouched-reference call-site census gate as its own PR (it adds a workflow step, so it goes to the maintainer), the upload's commit made conditional on the state it was judged in, the vouch mark stripped from a hook's options view too, and one answer for a missing row on the three upload doors. After #31075: the cause clause of the system-object refusal sentence, the docs and tool-description wording for the listing rule (connect-mcp, actions-as-tools, the list_actions description, the generated SKILL.md and its console mirror), a revision note on the AI QA checklist clause, one projection per object per listing, and the objectOverride label as its own card.

Hot-file serial queue

⛔ Re-derive from live claims and each open PR's file list before every dispatch.

• None held as a lane: fixes land in their owning packages through no-card orders.
• packages/plugins/plugin-security/src/delegated-admin-gate.ts: this seat's GHSA-fwcx order (claude/sec-subtree-org-bound), after fix(plugin-security): canReadObject, getReadFilter and security/explain answer the delegated business-unit read as the read door does #31142 merged.
• The skills-lane cards on lanes/security.md and security-findings.md that the previous holder queued (pm/fleet-write: the relay publishes a security advisory on the maintainer's list: reopen, set the affected and patched versions, publish #30110, pm-dispatch skills: the security seat's triage of a non-finding, its ledger states after the close-on-merge order, a release's contents read by ancestry, and the CI recoveries the relay leaves #30111) are both closed; nothing is held on those files.

Notes

• Write path: the relay (post-stamped.mjs, label-write.mjs, issue-create.mjs, fleet-write/dispatch.mjs). ⛔ No GitHub MCP writes. Advisory text is read only through the relay advisory_read.
• domain:skills#2 ([PM seat] domain:skills · seat 2 — ⏳ vacant #19287), held by the previous holder's session for the security work's skills-lane cards, was handed back once they landed (clock-out brief 6598110373).