[PM seat] domain:identity — 🔚 retired 2026-08-19, merged into domain:services (#6021)

[claude]

This seat is retired. 2026-08-19 lane consolidation (maintainer ruling quoted in SKILL.md's domain-lane table): the domain:identity lane (plugin-auth, plugin-security, plugin-sharing, plugin-audit) is merged into domain:services — seat post #6021 is the single authoritative registry for all of it from now on; job description at references/lanes/services.md.

The domain:identity label is retired from circulation only — existing cards keep it as archive and are read as domain:services candidates via the lane table; nobody mass-relabels.

At retirement this seat's live state (in-flight #3002/PR #9869 and the queue readings) was absorbed verbatim into #6021's body by the same session holding both seats (session_01PnJHU45vPJj5UQrxe946Bx), so nothing was orphaned. Pre-merge ledgers live in this body's revision history.

[baozhoutao]

移交存档(session_01JwwiU9bjhwy2SWj13ho8uv → 空缺待接管,2026-08-08 08:5xZ)

维护者指令:在飞做完即停,车道转交其他会话。已按纪律收官,无半状态:

• 在飞清零:最后一件 plugin-audit 的 5 个 hook 全部无 object 注册 ⇒ 引擎「按对象」需求门(#5284 单 id / #5038 批量)在 audit 启用时恒真 #5860→PR perf(plugin-audit): 审计跳过名单上到注册面,SKIP_OBJECTS 表不再买单前置行读 (#5860) #6614 已 MERGED(0f8d16a05),ACCEPT 评论与关单齐备;此前 同族第三处组装:share-link 路由把授权信封裁成 4 个字段后直接当 enforcement context 喂给 engine.find —— group 租户姿态下 Layer 0 墙恒判否 #6206→fix(plugin-sharing): share-link enforcement 吃完整授权信封,修复 group 姿态建链恒 403 (#6206) #6552、vama-write-path-convergence.test.ts 的 DELETE 用例喂的是引擎会拒绝的调用形状,安全侧前像门在这一半从未被执行 #6277→test(plugin-security): feed the VAMA DELETE half a call shape the engine accepts (#6277) #6502 均已落地关单。
• 无遗留认领:本会话所有 assign + 认领评论对应的单要么已合入关单、要么已按裁决转入 blocked 并写明机器行(Blocked-by:),下一任无需继承任何在飞认领。
• 定时器已停:本会话的巡检唤醒均为一次性且已到期,未再武装;不会有幽灵唤醒代表本席写入。
• 状态全部落在 GitHub:正文已刷新为完整交接快照(等 ISharingService 写判定补三态(放行/不表态/拒绝)—— #5492 裁决 B 案的 step1,二态 canEdit 已实测产出 fail-open #6428 的配对批次执行计划与其两条实测指引、待评估三张的相互关系、blocked 与决策箱、findings)。接管者按「从 labels 重建状态」即可直接开工,⛔ 无需读本会话历史。

正文的座位栏已置空并清 assignee,标题改 🔴;接管 = 编辑正文该栏 + 一条审计评论。

---

Generated by Claude Code

[os-zhuang]

Takeover audit — seat claimed from vacancy.

• GitHub: os-zhuang
• Session: session_01BM1tNf5U3nEbHKR4fo5qVQ
• Time: 2026-08-08 08:32Z
• Basis: predecessor's close-out comment (08:28Z) records zero in-flight and no inherited claims; seat body re-read immediately before this edit (residual-race discipline). Title / assignee / body updated in the same stroke.

Round-1 plan: verify #6428 state (gate for the #5492 + #5491 paired dispatch), evaluate #6352 / #6216 / #6551, sweep pm:blocked unlock conditions (#5893 → drivers #5702), rescan the lane queue for new cards.

---

Generated by Claude Code

[os-zhuang]

Cross-seat notice (post-hoc): domain:engine-core → domain:identity — PR #6697 (#5574/#5846 engine half) touches packages/plugins/plugin-auth/src/last-admin-guard.ts (+ its test).

From the engine-core seat (#6019), session session_01MwoubC3jL271FYt9rGXwxb. This seat post is currently ⏳ vacant; recording here for the next holder and any identity-side reviewer.

Why the touch could not stay out. The PR moves predicate (multi:true) before* hooks to per-row dispatch (maintainer ruling B on #5574). Under per-row dispatch, plugin-auth's last-administrator break-glass guard had a security regression: it resolved its target set as "scalar input.id if present, else the caller's predicate" — sound only while a predicate write's before phase carried no per-row id. Per-row, a multi ban of ALL administrators arrives as N individually-legitimate by-id bans (banning one admin of three leaves two), so the batch would pass with no refusal and lock the environment out. Shipping the dispatch change without the guard fix would have opened that hole on merge — the fix rides the same PR by necessity, not convenience.

The fix (one function): resolveTargetIds consults options.multi FIRST and uses the id only for genuine by-id writes (input.options stays the caller's bag during before* by contract D1/D2, multi included — preserved deliberately for exactly this kind of population-level guard). Dedicated changeset (last-admin-guard-per-row-dispatch.md); regression pinned in last-admin-guard.test.ts. The dev also reviewed the other six input.options.where readers (service-storage ×3, plugin-sharing, plugin-approvals, plugin-audit): all per-row permission/reconcile questions where the per-row view is exact or strictly better — plugin-auth was the only population-invariant guard.

Veto/objection path: comment here or on PR #6697; post-merge, a revert of the guard hunk alone would REOPEN the lockout hole, so any objection should propose an alternative guard shape rather than a bare revert.

---

Generated by Claude Code