ci: expand adr-anchors to the full authz/security ADR set — 8 → 15 (#4575 follow-up)

[os-zhuang]

The bounded sweep promised in #4575's reviewer notes. The seed anchors covered only #3723's blast radius; the real question was always which other accepted decisions are one "reasonable improvement" away from being reverted. This audits ADR-0057 / 0066 / 0068 / 0090 / 0091 / 0095 / 0105 and registers the answers.

Selection discipline

Same bar as the seed, applied file by file: anchor it only if a competent engineer reading the file alone could "fix" the code and be reverting a decision. Every candidate was read, not pattern-matched; several plausible ones were left out (e.g. rls-compiler.ts — its invariants are enforced by the authz-matrix gate, and its ADR citations are descriptive, not load-bearing).

The seven additions, each with its reversal story

File	ADR	The tempting "fix" that would be a reversal
core/security/posture-ladder.ts	0095 D3	"Just read the role — it's right there." That is the #2836 dual-track class, closed by construction only so long as posture derives from capability grants.
core/security/grant-validity.ts	0091	"Move expiry to a cleanup job." Banned by ADR-0049: correctness lives at resolution time, and unparseable bounds fail closed.
plugin-security/tenant-layer.ts	0095 D1	"Deduplicate Layer 0 into the RLS compiler." The whole point is that they share no compiler, no merge step and no bypass bit — merged, a business-RLS change can weaken tenant isolation.
plugin-security/auto-org-admin-grant.ts	0105	"Why two admin sets? Grant plain organization_admin everywhere." Under a wall-less posture that makes every org owner an environment-wide superuser (the F2 finding) — hence organization_admin_no_bypass.
plugin-security/invitation-placement.ts	0105 D8	"Skip the issuance dry-run; acceptance re-checks anyway." It doesn't — acceptance runs under system context. Skipping issuance is an escalation hole.
spec/identity/position.zod.ts	0090 D3	"Positions need hierarchy — add parent." Literally the mistake ADR-0057 D5 retired (the old sys_role.parent walk queried a column that never existed).
plugin-security/permission-evaluator.ts	0066 D2 + 0057 D1	"Add an admin fast-path / stored flag." The superuser bypass derives solely from the wildcard grant; that derivation is isTenantAdmin().

Plus one extension: the existing resolve-authz-context.ts anchor gains ADR-0068 — platform_admin is derived from an unscoped admin_full_access grant, no trusted stored boolean. The "add an is_admin column" refactor is the single most classic reversal in this family.

Verification

• Zero code changes — every one of the seven files already cited its governing ADRs, which is itself a useful audit result: the citation discipline held everywhere except the one cluster sys_member.role app-role channel reverses ADR-0057 D4 ("never as the authority for RBAC") — pin to the built-ins before the next RC; placement is the governed channel #3723 hit.
• pnpm check:adr-anchors → OK (15 anchored file(s)).
• Negative-tested: stripping ADR-0091 from grant-validity.ts fails with the invariant printed.
• Changeset has empty frontmatter — releases nothing.

🤖 Generated with Claude Code

https://claude.ai/code/session_0186LhwkUBupmLJUUAMda5hU

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 2, 2026 9:30am