docs(audits): recheck the parsed-but-unenforced security props cluster (#1878)#3503
Merged
Merged
Conversation
#1878) The 2026-06 audit flagged a cluster of security-shaped props as "parsed-but-unenforced / false compliance." Re-verified against current code: the gap was closed the correct way — PolicySchema was deleted (#2387) and its capabilities rebuilt as enforced auth settings (ADR-0069); allowTransfer, apiEnabled/apiMethods, flow runAs, ADR-0057 scope and criteria-type SharingRules are enforced; agent visibility and role.parent were pruned (positions are flat, ADR-0090). - Add 2026-07-security-props-liveness-recheck.md: per-property status with file:line evidence + the genuine remaining loose ends (prune AuditRetentionPolicySchema; enforce-or-prune SharingRule owner/group/guest recipients; per-org IP allow-list #2571; two ledger/comment drift fixes). - Annotate the two stale 2026-06 security docs (README section 1 + security-identity audit) as rechecked/superseded. Docs-only; empty changeset (releases nothing). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
17 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Triage follow-up under umbrella #1878. Re-verifies the security cluster the 2026-06 liveness audit flagged as "parsed-but-unenforced / false compliance" — the most serious finding of that audit — against current code (three independent read-only passes).
Finding: the cluster is largely closed
The gap was closed the correct way. Of the eight flagged items:
allowTransfer(安全:owner_id(属主锚点)客户端可写、服务端无守卫 → 非属主可伪造/转移记录属主 #3004), ObjectapiEnabled/apiMethods(both REST surfaces, feat(rest): enforce object enable.apiEnabled / apiMethods (ADR-0049 #1889) #1937 + 跟踪:UI 操作按钮与 apiMethods 白名单一致性契约落地(#3026 设计定稿) #3391), FlowrunAs(data ops), ADR-0057 hierarchy scope + criteria-type SharingRules.PolicySchemawas deleted in v11.0 (feat(spec)!: remove dead PolicySchema / definePolicy + stack policies (#1882, 11.0) #2387, ADR-0049 enforce-or-remove) and rebuilt as enforced settings; agentvisibility/tenantIdremoved ([P2][security] Enforce agentvisibility(organization/private) — context now has tenant (ADR-0095); needs owner/org anchor on the agent #1901/[11.0][A2] Remove dead author-facing metadata properties (ADR-0049 enforce-or-remove) #2377);role.parentnever existed (positions are flat, ADR-0090).allowRestore/allowPurgebits pre-mapped + fail-closed (ops M2-pending); agentaccess/permissionsenforced in the closedservice-airuntime.Full per-property table with
file:lineevidence is in the new doc.Changes (docs-only)
docs/audits/2026-07-security-props-liveness-recheck.md— the recheck + the genuine remaining loose ends.README.md§1 +2026-06-security-identity-property-liveness.md) — the "PolicySchema 100% dead / false compliance" framing is now factually wrong and was actively misleading.Genuine remaining loose ends (recorded, not fixed here — each deserves its own verified PR)
AuditRetentionPolicySchema(system/audit.zod.ts) — real parsed-only dead schema; retention lives on thelifecyclesurface.owner-type rules +group/guestrecipients (criteria-type already enforces; the rest silently no-op).allowed_ip_ranges) — ADR-0069 D5 #2571).authz-conformance.matrix.tsstill marksflow-run-asremoved (it's live); the agentaccessschema comment claims in-repo enforcement (it's in the untrackedservice-ai/dist).Refs #1878.
🤖 Generated with Claude Code