platform gap: a plain member is offered "Invite User" (and other org-admin affordances) that the server then refuses with 403 — an action's visibility cannot be gated on the membership grade

[objectstack-fleet]

Ruled: 5993018584 · letter A · 2026-10-05T10:54Z

QA-source: #21784 · identity-auth.invitation-scope-gates · acceptance[4]

Clause A5 of identity-auth.invitation-scope-gates and clause A7 of identity-auth.org-membership-team-management fail in the 17.7 pre-release run #21784 (subject 316be321e, console pin 2e818d0b51ec) on one root. It fails closed (the server refuses), so it is a UI-courtesy defect. An independent verifier (RUNNER rule 7) confirmed it: low severity. Predates 17.6.0. The closed #8092 was the same symptom on the workspace members page; it is back on the organization surfaces.

Reproduction

1. Boot the showcase. Admin invites a user with role member; the user signs up and signs in.
2. As that member, open the organization's member list in the console.

• Expected: no "Invite User" affordance for a grade that cannot invite (the clause: the UI offers only what the server will accept).
• Actual: "Invite User" is offered; submitting it answers 403 from the server.

Mechanism

• The invite_user action is gated only on the organization feature (requiresFeature), not on the caller's membership grade.
• The verifier found the platform has no way to express that gate today: membership grades are not exposed through the capability channel an action's visibility can read (ADR-0108), so this is a platform gap, not a one-line fix in the action. Re-read by the director seat (ruling 5993018584): the grade IS in an action's visible scope today, as current_user.positions; what is missing is a declarative gate. The capability channel stays grade-free (ADR-0108).

Done when

An action's visibility can depend on the caller's membership grade through a declared key lowered from one reach table (or the grade is projected into the capability channel) (ruled out: ADR-0108), invite_user and the other org-admin affordances use it, and a dogfood test checks a plain member sees none of them.

---

Generated by Claude Code

[objectstack-fleet]

Path: sign-in and identity — organizations and admin user operations | identity-auth.invitation-scope-gates | P2

Triage: first grade — bug · priority:p3 · domain:services · area:identity · needs-user-decision. How an action's visibility reads "may manage members" is a contract shape, and ADR-0108 rules out one of the card's two routes

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-05T03:02Z. ⛔ Not a claim, ⛔ not a dispatch.

Triage: lands in the org-admin actions' visibility (invite_user and its siblings, gated today only on requiresFeature) ⇒ domain:services; rationale: the server door is right, and the button has no declarative way to ask the same question.

• Why a decision, not a queue card. The card's second route, projecting the membership grade into the capability channel, is the one ADR-0108 forbids by name ("Membership Grade Is Not a Capability Channel"). The other route needs a new input to action visibility. That is a contract-shape proposal (triage-duties.md, needs-user-decision).
• Why p3. It fails closed: the server refuses with 403, so this is UI courtesy. The verifier graded it low. The closed console: workspace members page offers Invite / Remove member to the member role; only the server 403 stops it #8092 fixed the same symptom on the workspace members page.

维护者速读

普通成员在组织页面上能看到"邀请用户"等管理员按钮，点了才被服务端拒绝（403）。服务端是对的，问题只在界面多给了按钮。要定的是：按钮靠什么判断"这个人能不能管理成员"。

• A：让按钮和服务端共用同一个"能否管理成员"的判断，写成声明式条件。这需要给动作可见性新增一个输入。⛔ 不把成员身份塞进能力通道（ADR-0108 禁止）。
• B：只在控制台的组织页面按当前成员身份隐藏按钮，和 console: workspace members page offers Invite / Remove member to the member role; only the server 403 stops it #8092 在工作区页的做法一样，协议不动。
• C：不改。服务端已经拒绝，多一个按钮只是体验问题。

推荐 A（只看①选 A；②③④ 是否翻转：否）。置信缺口：我没有实测 ADR-0090 D12 的"管理能力"今天能否被动作可见性读到。

四棱（os-decision-facets）

• ① 长远：A 让门和按钮用同一个判断，B 是逐页特例，长期会越积越多。
• ② 拉动：每个普通成员打开组织页都会看到，但服务端已经拒绝，伤害小。
• ③ 防 AI 犯错：A 是声明式的，AI 写的应用也能用；B 只有手写的控制台页面有。
• ④ 不扩散：A 新增一个可见性输入，是永久义务；B 不新增协议，但会新增页面里的特例。

Prior rulings read: ADR-0108 (membership grade is not a capability channel) → 1; ADR-0090 D12 (administration as a scoped capability); thread: #8092 (closed)

---

Generated by Claude Code

[objectstack-fleet]

Ruling: batch #276 item 1 · letter A · maintainer 「276 同意」 2026-10-05T10:53Z

Director seat, summon #33, session_011SekRJwTRqXSmsP6xTSci4 (GitHub os-tesla; written as objectstack-fleet[bot] via the relay). Batch #276 was presented in chat with the four options below; the maintainer answered 「276 同意」, which takes the recommendation, A. Freshness gate: the body (last edited 2026-10-05T03:03Z) and the one comment (triage 5987363609) were re-read before this record; nothing newer exists.

The ruling

A — a declared membership-grade gate on actions, lowered from one table the server door also reads. Not A′ (hand-written visible predicates over current_user.positions on each action: twelve copies of one list, free strings an AI misspells silently), not B (hiding on the console page as objectui#4475 did: a page-local special case that leaves the metadata-driven related lists and every generated app page as they are), not C.

Settled in the same stroke, so no second decision card is needed:

• The table. One registry in @objectstack/spec, beside the closed name list in packages/spec/src/identity/membership-role.ts: which membership grades reach which better-auth organization endpoint (today: owner/admin/delegated_admin → invite-member; owner/admin → member update and removal, invitation cancel/resend, team management as better-auth's statements say; owner → ownership transfer). The dev reads the grades off better-auth's own defaultRoles statements plus the delegated_admin registration (packages/plugins/plugin-auth/src/auth-manager.ts:3027-3057), and pins the table equal to them by a test in plugin-auth (or builds the AC from the table — the dev chooses, the test is mandatory either way). Names are the spec's, not the dev's: the reach table is a fourth fact beside ADR-0108 D4's three and is not merged into any of them.
• The sugar. A new optional key on action declarations (the dev names it in the family of requiresFeature), enum-checked against the table's endpoint names, lowered at parse time into a visible CEL predicate over current_user.positions using the projected names (org_owner / org_admin / delegated_admin, eval-user.zod.ts:58-62), AND-composed with any existing visible, stripped from the parsed output — the exact mechanism of lowerRequiresFeature (packages/spec/src/kernel/public-auth-features.ts:317-357), including its loud parse error on visible: false and on a non-CEL visible. Clause-②: yes → a minor changeset on @objectstack/spec.
• The declarations. Every action in packages/platform-objects/src/identity that today carries requiresFeature: 'organization' (12 at origin/main 088428fb4: sys_member ×5, sys_invitation ×3, sys_user ×1, sys_team / sys_team_member ×3) takes the key whose endpoint it targets; one that targets no grade-gated endpoint takes none. transfer_ownership keeps its record predicate; the sugar composes onto it.
• The proof. A dogfood test: a plain member sees none of the org-admin affordances on the organization's member list, invitations list and team pages; an admin sees them; a delegated_admin sees invite only. QA clauses A5 of identity-auth.invitation-scope-gates and A7 of identity-auth.org-membership-team-management are re-run against the change.
• Execution parameters. This card continues (no new card): needs-user-decision → pm:queue; lane domain:services → domain:spec (the protocol slice lives in packages/spec; one PR may touch plugin-auth for the equality test and platform-objects for the declarations); priority:p3 stays; at-tier review on the path leg. The card closes when the PR lands.

Premises the dev verifies before writing (third-tier ruling: a premise that fails is reported as fork on this card — do not force A, do not fall back to A′ silently)

1. A signed-in plain member's current_user.positions in the console carries org_member, and an admin's carries org_admin / org_owner, from the session payload (expressionUser.ts:177-182 in objectui reads user.positions; the server-side normalization is ADR-0068 D2). Re-check: boot the showcase, sign in as the member from the card's reproduction, read the session face.
2. The surface the QA clause fails on is a metadata-driven action surface (the related-list toolbar / row actions that honour visible, packages/plugin-detail/src/RelatedList.tsx:420-445 in objectui), so a visible lowering reaches it. Re-check: reproduce the clause and name the component.
3. better-auth's organization AC statements for owner / admin / member are readable from the library's exports at the pinned version (defaultRoles, memberAc.statements), so the equality test can be written. Re-check: git grep -n "defaultRoles" origin/main -- packages/plugins/plugin-auth/src/auth-manager.ts.

Readings behind it (each taken this summon at origin/main 088428fb4, or marked)

• packages/spec/src/ui/action.zod.ts:427-433: visible is a CEL predicate over current_user / data / features; :824-837 the action-level visible / disabled envelope.
• packages/spec/src/kernel/public-auth-features.ts:317-357: lowerRequiresFeature — the sugar precedent and its lowering rules.
• packages/spec/src/identity/eval-user.zod.ts:13-14, 58-62: the grade projection into current_user.positions; membership-role.ts:50-90: the closed vocabulary and delegated_admin as reach without authority.
• packages/plugins/plugin-auth/src/auth-manager.ts:3027-3057: the server door — better-auth defaults plus delegated_admin with invitation: ['create']; invitation-role-cap.ts:81-111: orgRoleGrade / isOrgAdminGrade (authority, not reach — untouched by this ruling).
• packages/platform-objects/src/identity/sys-member.object.ts:91-230, sys-invitation.object.ts, sys-user.object.ts, sys-team*.object.ts: the 12 requiresFeature: 'organization' actions.
• objectui packages/core/src/evaluator/subjectPermissions.ts:1-60: current_user.can(object, verb) answers from /auth/me/permissions — the capability channel, which ADR-0108 keeps the grade out of; this ruling does not put it there.
• ADR-0108 D1 (a grade decides what a principal may reach), D4 (three facts, not merged); ADR-0068 D2; ADR-0066 D4 (one gate, two surfaces; for type: 'api' actions the server half is the endpoint's own door); ADR-0133 (the organization capability is the only gate today; "open" means not edition-gated, which this ruling keeps). None is superseded; no ADR text changes.
• Prior rulings read: requiresFeature, capability channel, membership grade, invite_user, org-admin, manage members, action visibility → 2 hits (ADR-0068 D2, ADR-0095 D3); thread: none; objectui#4475 (2026-08-12, delegated ruling: "the server's better-auth role model is the truth") is the B precedent and is not reopened.
• Not verified this summon: premises 1–3 above (the dev's first act), and the exact set of team endpoints better-auth grade-gates.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1 (this card, per the director seat's ruling A 5993018584, maintainer 「276 同意」) · 2026-10-05T11:48Z
Session: session_01T9u38rswFp5Rw8DswRUReJ
Account: os-project-manager (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-21795-membership-grade-action-gate
Worktree: objectstack-issue-21795
Domain: domain:spec
Seat: domain:spec#1 (seat post #6017)
File surface (at origin/main 9f9510f25e; stop on breach and explain in the report):

• The ruling's three premises are verified first (5993018584 §Premises). If one fails, report fork on this card. ⛔ Do not force A, and do not fall back to A′.

• The reach table: one registry in packages/spec/src/identity/, beside the closed name list in membership-role.ts. It says which membership grade reaches which better-auth organization endpoint. It is a fourth fact beside ADR-0108 D4's three, not merged into any of them. Its exports and the regenerated api-surface / export-origins rows go with it.

• The sugar: one new optional key on action declarations in packages/spec/src/ui/action.zod.ts, named in the family of requiresFeature. It is:

  • enum-checked against the table's endpoint names;
  • lowered at parse time into a visible CEL predicate over current_user.positions, using the projected names (org_owner / org_admin / delegated_admin, eval-user.zod.ts);
  • AND-composed with any existing visible, and stripped from the parsed output;
  • modelled exactly on lowerRequiresFeature (packages/spec/src/kernel/public-auth-features.ts), including the loud parse error on visible: false and on a non-CEL visible.

  Its tests go with it. So do the liveness ledger row, the generated reference docs, and whatever the metadata-form reconciliation gate owes for a new key, decided as the requiresFeature precedent decides it.

• packages/platform-objects/src/identity/*.object.ts (domain:engine): every action that carries requiresFeature: 'organization' takes the key for the endpoint it targets. An action that targets no grade-gated endpoint takes none. transfer_ownership keeps its record predicate, and the sugar composes onto it.

  • The ruling counted 12 at 088428fb4. The seat reads 14 object sites at this base: sys-member 5, sys-invitation 3, sys-team 3, sys-team-member 2, sys-user 1. Re-count, and report each site's endpoint.
  • Any platform-objects pin or catalog the declarations move goes with them. Declared on seat post [PM seat] domain:engine — 🟢 os-project-manager · session_017ErfyP2Rx7XWHJA27QjyUi #6367 in this act.

• packages/plugins/plugin-auth (domain:services): ONE new test file that pins the table equal to better-auth's defaultRoles statements plus the delegated_admin registration (auth-manager.ts:3027-3057).

  • ⛔ Test only: no auth-manager.ts edit. PR fix(plugin-auth): settle membership under the auto policy at user creation (ADR-0093 D7) #21813 (security(identity): identity-auth.org-membership-team-management clause 5 (membership removal) fails at 316be321e — detail withheld pending maintainer #21791) holds that file. So the ruling's "or build the AC from the table" option is not taken here.
  • Declared on seat post [PM seat] domain:services — ⏳ vacant (signed off 2026-10-06 by session_011K3zqE8Pv1Evw5hc8tZCnN) #6021 in this act.

• The proof: one dogfood test under packages/qa/dogfood/test/. It shows a plain member sees none of the org-admin affordances on the organization's member list, invitations list and team pages; an admin sees them; and a delegated_admin sees invite only. packages/qa/ is in no lane charter, and it is declared here.

• Changesets: @objectstack/spec minor (Clause-②: yes (widening)), plus a patch for @objectstack/platform-objects if its dist moves.

• No new id: no new test title, test string or runtime string carries a tracker id.

• ⛔ No objectui file, no capability-channel change (ADR-0108), no ADR text, no content/docs/releases/.
  Container & model: M, mode:subagent, model: opus; the at-tier contract review follows delivery (path leg and Clause-②: yes).
  Clause-②: yes (widening)
  Thread-read: 5993018584
  Serial constraints cleared: of the 7 open PRs, only fix(plugin-auth): settle membership under the auto policy at user creation (ADR-0093 D7) #21813 touches a nearby file (plugin-auth/src/auth-manager.ts), and this claim does not write it. None touches action.zod.ts, public-auth-features.ts, membership-role.ts, liveness/action.json or platform-objects/src/identity/ (scan at this stamp).