`describeHighPrivilegeBits`'s doc comment still cites `member_default` as the "plain wildcard baseline" example, which it no longer is

[os-zhuang]

Observation-class finding, filed from the #5492/#5491 paired PR (#6684). Nothing a user hits today — prose only, no behaviour change, no gate red.

What

packages/spec/src/security/high-privilege.ts, in the JSDoc of describeHighPrivilegeBits:

A plain '*' wildcard grant is NOT high-privilege by itself (D5 permits a read/create/edit-own baseline to cover all objects — the platform's own member_default is exactly that shape); the wildcard ban is the GUEST tier's stricter rule (D9 "explicit objects only")

After #5491 (PR #6684) member_default ships no '*' entry at all — the platform baseline narrowed to explicit-allow by maintainer ruling (2026-08-07). So the sentence's worked example no longer describes the set it names.

What is NOT wrong

The rule is unaffected and the code is correct. describeHighPrivilegeBits never reads member_default; it evaluates whatever set it is handed, and "a plain wildcard is not high-privilege by itself" remains the right ADR-0090 D5 predicate — viewer_readonly still ships exactly that shape and is still legitimately anchor-bindable. Only the illustration went stale.

Worth noting the parenthetical's original purpose survives too: it exists to record why the former blanket wildcard rejection was wrong (#2753 — it made the default baseline unbindable to everyone and forced it through the fallback channel D5 rejected). That history is still true and still worth keeping; it just needs an example that still exists.

Suggested fix

One-line prose edit swapping the example (viewer_readonly is the obvious replacement — plain '*', read-only, still shipped), and optionally a clause noting that member_default no longer carries a wildcard as of #5491 so the next reader is not sent looking for one.

Why filed rather than fixed

packages/spec was a hard ⛔ on PR #6684's dispatched file surface (the ADR-0111/#6428 contract had just landed there via PR #6564 and the lane was serialized). Not fixed in that PR by instruction, not by oversight.

Found while re-verifying #5491's premise against origin/main; no pm:queue — this is a finding for the triage round to grade.

[os-zhuang]

Findings-round routing repair: domain:spec-surface added. Routing only — finding grade unchanged, no ownership taken.

• Landing anchor verified on origin/main @ cfeb9a0: packages/spec/src/security/high-privilege.ts:35 — the describeHighPrivilegeBits JSDoc still cites member_default as the plain-wildcard baseline example, which PR fix(plugin-security): enforce both declared write-wideners; the platform baseline becomes explicit-allow (#5492, #5491) #6684 (member_default's * wildcard object grant (C/R/E) union-merges into every org member — app-side explicit-allow object gates are erased on three axes #5491, maintainer ruling 2026-08-07) made stale.
• Routing rationale: one-line JSDoc example swap in packages/spec source with zero behavior change — describe/JSDoc text face, acceptance set untouched: textbook domain:spec-surface, and a natural member of that lane's sweep-first batches (description-face-drift criterion). The body's suggested replacement example (viewer_readonly) keeps the Builtin member_default carries anchor-forbidden bits — every boot logs 'refusing to bind fallback set to everyone' (platform baseline violates its own D5 tier) #2753 history intact.
• Dedup: filed from PR fix(plugin-security): enforce both declared write-wideners; the platform baseline becomes explicit-allow (#5492, #5491) #6684 alongside modifyAllRecords still does not widen a by-id write on an object with NO owner field (sharing abstains, the platform created_by floor holds) #6698 — sibling provenance, disjoint text; no other open card touches this JSDoc. Clean.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-zhuang]

Findings-triage round (#4949 discipline): promoted — finding → pm:queue, domain:spec-surface kept.

• Stale-premise check (origin/main @ 3172831): holds — packages/spec/src/security/high-privilege.ts:35 still cites member_default as the plain-wildcard baseline example, and after member_default's * wildcard object grant (C/R/E) union-merges into every org member — app-side explicit-allow object gates are erased on three axes #5491 / PR fix(plugin-security): enforce both declared write-wideners; the platform baseline becomes explicit-allow (#5492, #5491) #6684 member_default ships no '*' entry, so the worked example names a set that no longer has that shape.
• Why promote: textbook description-face drift — one-line JSDoc example swap (viewer_readonly still ships plain '*' read-only and is the body's proposed replacement), zero behavior change, fix fully specified. This is exactly the spec-surface lane's sweep-first class; promoting makes it batchable with modifyAllRecords still does not widen a by-id write on an object with NO owner field (sharing abstains, the platform created_by floor holds) #6698's A-half and any adjacent describe-drift members in one sweep card if the lane so packages them.
• Constraint worth keeping from the body: the parenthetical's Builtin member_default carries anchor-forbidden bits — every boot logs 'refusing to bind fallback set to everyone' (platform baseline violates its own D5 tier) #2753 history (why blanket wildcard rejection was wrong) stays — only the illustration changes.
• Dedup: sibling modifyAllRecords still does not widen a by-id write on an object with NO owner field (sharing abstains, the platform created_by floor holds) #6698 (same PR fix(plugin-security): enforce both declared write-wideners; the platform baseline becomes explicit-allow (#5492, #5491) #6684 provenance, different file and sentence); no other open card touches this JSDoc; no in-flight PR on high-privilege.ts. Clean.
• Release board: no target:* — internal JSDoc illustration.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code