finding: ExecutionContext 在 dispatcher / REST / share-link 三处独立组装 —— 收敛为单一共享装配函数前,先裁决匿名面分歧

[qq9340100]

事实(均可对照代码与 PR 实读)

ExecutionContext 目前在 三处 各自手工组装,字段集合靠人肉对齐:

1. dispatcher 面(/mcp 通道):完整组装,含 principalKind(human/agent 可达,acceptOAuthAccessToken 是 agent 唯一入口),匿名请求产出 guest ctx。
2. REST 面(packages/rest/src/rest-server.ts computeExecCtx):两处手写的 ExecutionContext 组装已漂移:REST 传输不带 principalKind / onBehalfOf,而 explain / security 会读它 #6071 / PR fix(rest): REST 面的执行上下文补齐 ADR-0090 D9/D10 的 principal 分类 (#6071) #6205 刚补齐 principalKind: 'human'(该 PR 的 rest-server.ts 行内注释记录了 agent/guest 在此面不可达的完整证据链,是本单的 provenance 起点)。匿名请求 返回 undefined(无 ctx,上游 401)。
3. plugin-sharing / share-link 面:第三处独立组装,已发现掉字段实害——accessible_org_ids 缺失导致 group 姿态 fail-closed 403(已单独立案 同族第三处组装:share-link 路由把授权信封裁成 4 个字段后直接当 enforcement context 喂给 engine.find —— group 租户姿态下 Layer 0 墙恒判否 #6206)。

为什么立此单

#6071 正文的「建议方向」提出把组装收敛为单一共享函数,但该文本随 #6071 关闭而沉没;#6071 的 dev 明确不擅自开重复单、请 PM 裁量,故由 cli 车道 PM 以 finding 立案存档。三处手工组装已经产生过两类真实缺陷:字段漂移(#6071 的 principalKind 缺失)与字段丢失(#6206 的 accessible_org_ids),收敛是消除此类缺陷的结构性解。

设计前提(收敛前必须先裁决,这是真正的 blocker)

匿名面分歧:dispatcher 对匿名产出 guest ctx,REST 对匿名产出 undefined(fail 到 401)。一个共享装配函数必须先回答「匿名到底是 guest ctx 还是无 ctx」——这不是实现细节,而是授权语义裁决(牵动 explain-engine.ts guest⇒EXTERNAL 等执法消费者)。在裁决之前直接抽共享函数,只会把分歧固化进签名或塞进布尔开关。

建议路径

1. 先出一页匿名语义裁决(guest ctx vs no-ctx,或显式双模式并写明各自消费者);
2. 裁决后抽单一装配函数,三面接入,字段集合由类型收紧(新增字段漏接直接编译红);
3. 同族第三处组装:share-link 路由把授权信封裁成 4 个字段后直接当 enforcement context 喂给 engine.find —— group 租户姿态下 Layer 0 墙恒判否 #6206 的修复可先行(实害止血),但实现时向本单的收敛方向靠拢。

关联

• 两处手写的 ExecutionContext 组装已漂移:REST 传输不带 principalKind / onBehalfOf,而 explain / security 会读它 #6071 / PR fix(rest): REST 面的执行上下文补齐 ADR-0090 D9/D10 的 principal 分类 (#6071) #6205(REST 面 principalKind 补齐 + 不可达性证据)
• 同族第三处组装:share-link 路由把授权信封裁成 4 个字段后直接当 enforcement context 喂给 engine.find —— group 租户姿态下 Layer 0 墙恒判否 #6206(share-link 面掉字段实害)

Finding 立案,未指派、未标域——由 triage 席分诊。

[os-project-manager]

Findings sweep (maintainer-authorized one-off, 2026-08-07 — registered on #6015): promoted to the queue, with the blocking question resolved by scoping rather than escalation: converge the three assembly sites onto one shared function next to resolveAuthzContext, with the anonymous-request policy passed as a per-face parameter preserving each face's current behavior (dispatcher guest ctx / REST undefined→401) — zero product-semantics change, so no ruling needed. Today's #6206 ruling (full envelope to enforcement) is the third site's target state and this card is its structural prevention. finding → pm:queue + domain:identity.

---

Generated by Claude Code

[os-zhuang]

Decision card (identity seat PM, session_01BM1tNf5U3nEbHKR4fo5qVQ, 2026-08-08; needs-user-decision applied with this comment, card leaves the dispatch queue until ruled).

Background — premises refreshed today, not inherited from the filing

The face inventory has moved since this card was filed, which is why the card waited for it:

• The two consumption-truncation faces are FIXED and seam-pinned: plugin-sharing's route face by 同族第三处组装:share-link 路由把授权信封裁成 4 个字段后直接当 enforcement context 喂给 engine.find —— group 租户姿态下 Layer 0 墙恒判否 #6206 → PR fix(plugin-sharing): share-link enforcement 吃完整授权信封,修复 group 姿态建链恒 403 (#6206) #6552, and the dispatcher /share-links face by dispatcher 面的 /share-links 把已解析完整的 ExecutionContext 重新裁成两个字段再喂给 enforcement —— 与 #6206 同一条 enforcement 路径的另一张脸 #6551 → PR fix(runtime): dispatcher 面 /share-links 整体透传 ExecutionContext 给 enforcement (#6551) #6647 (merged 09:13Z today; whole-envelope passthrough, 4-red/4-green reverse verification, a seam-parity pin that names dropped keys).
• What remains is exactly this card's subject: the assembly sites are still independent implementations (dispatcher resolve-execution-context.ts; REST computeExecCtx; the share-link surfaces now passthrough rather than assemble), and the anonymous face genuinely diverges — verified on origin/main today:
  • dispatcher: a sessionless request becomes a first-class guest principal — principalKind: 'guest', positions: ['guest'] ("holding the built-in guest position implicitly and exclusively", resolve-execution-context.ts:172-221), and enforcement consumers read it (explain-engine.ts:104: guest ⇒ EXTERNAL posture);
  • REST: anonymous ⇒ no ctx → 401 (computeExecCtx returns undefined; 两处手写的 ExecutionContext 组装已漂移:REST 传输不带 principalKind / onBehalfOf,而 explain / security 会读它 #6071/PR fix(rest): REST 面的执行上下文补齐 ADR-0090 D9/D10 的 principal 分类 (#6071) #6205 recorded the unreachability evidence).

Both behaviors have live consumers today. Neither can be deleted without breaking a real surface. The defect class this duplication keeps producing is measured, not hypothetical: #6071 (principalKind drift) and #6206/#6551 (dropped fields, real 403s) all came from hand-maintained copies.

The concrete question

When the assembly converges into one shared function, what is the contract for an anonymous request?

Options

• A. One assembler, explicit dual mode, fail-closed default (recommended). A single shared assembly module with two named entries: the default resolver returns ExecutionContext | undefined (no session → undefined, surface answers 401 — REST's current behavior, byte-for-byte), and an explicit guest entry producing today's dispatcher guest envelope, which a surface adopts only when its product semantics serve anonymous principals (the built-in guest position is the declared vocabulary for "what anonymous may do"). Field set closed by type so a new ExecutionContext field lands in every face at compile time — the 两处手写的 ExecutionContext 组装已漂移:REST 传输不带 principalKind / onBehalfOf,而 explain / security 会读它 #6071 drift class becomes unrepresentable. Neither surface changes runtime behavior; what changes is that the divergence becomes named API instead of drift.
• B. Unify on guest-ctx everywhere. REST's anonymous would start flowing into authz as a guest principal (401 → authz-shaped denials). Changes REST's public auth contract with no measured pull, and makes anonymous-serving the default posture of any new surface — the fail-open direction for AI-authored routes.
• C. Unify on no-ctx everywhere. Deletes the guest principal — breaks the dispatcher's anonymous surface, the guest position machinery, and explain's EXTERNAL posture. A product regression unless nothing real serves anonymous, which the code says is false.

Three axes

• 实际业务需求: both postures are load-bearing today (guest → dispatcher surface + explain posture; 401 → every REST client's auth contract). A saves both; B and C each break one side without measured demand.
• 项目长远合理性: one implementation, divergence encoded as two named entries — the same "one contract, one implementation" line this lane enforced in fix(plugin-security): enforce both declared write-wideners; the platform baseline becomes explicit-allow (#5492, #5491) #6684 (provenance) and finding: explain-engine buildContextForUser 手工镜像 resolveAuthzContext 的授权聚合,两者无任何 parity 断言,只靠注释保持一致 #6352 (explain aggregation, where the second copy turned out to be already lying). Keeping two assemblers is the shape that already failed three times.
• 防 AI 写代码犯错: A's default is fail-closed (no session → 401 unless a surface explicitly opts into guest); the type-closed field set turns dropped-key bugs into compile errors. B is structurally fail-open for new surfaces; C removes a declared vocabulary.

Sequencing note (after ruling)

Implementation is cross-lane by nature (runtime + rest = domain:cli; sharing surfaces = identity) — contract-first split at triage per multi-repo rule 2; this card stays the decision anchor. Related: #6071, #6206/#6552, #6551/#6647, #6352.

---

Generated by Claude Code