The removal half of L5 of the accepted #11663 platform-admin re-anchor design, filed at L4's landing exactly as #11975 and the design prescribe (design document = #11663 comment 5394453215, §5 step 6 and §6 row L5: "the dual read is deleted, one minor after step 4. Card filed at step 4's landing, not later"; maintainer acceptance = #11663 comment 5404675670, 2026-08-25, verbatim 「接受你的建议，继续」). Filed by the L4 dev at PR #13514's creation, per the L4 card's own definition of done. #11975 remains open and carries the window's discipline; this card is the window's EXIT.
Blocked-by: #11975
Timing constraint (the minor boundary): lands one minor after the release that carries L4 (PR #13514, @objectstack/plugin-security walled bootstrap stops minting the grant row + deprecation pointer live). The exit PR's body must name the minor boundary it honours (#11975's acceptance criterion).
Content — delete the legacy path, as its own reviewed change (never a rider on another leg):
Acceptance criterion: on a walled rig, a seeded legacy org-less admin_full_access grant confers NOTHING (posture resolves without PLATFORM_ADMIN unless the config anchor matches); the exit is a reviewed change on origin/main whose PR body names the minor boundary; single-posture first-user standing is unchanged unless #11979 landed first.
Generated by Claude Code
The removal half of L5 of the accepted #11663 platform-admin re-anchor design, filed at L4's landing exactly as #11975 and the design prescribe (design document = #11663 comment 5394453215, §5 step 6 and §6 row L5: "the dual read is deleted, one minor after step 4. Card filed at step 4's landing, not later"; maintainer acceptance = #11663 comment 5404675670, 2026-08-25, verbatim 「接受你的建议，继续」). Filed by the L4 dev at PR #13514's creation, per the L4 card's own definition of done. #11975 remains open and carries the window's discipline; this card is the window's EXIT.
Blocked-by: #11975
Timing constraint (the minor boundary): lands one minor after the release that carries L4 (PR #13514,
@objectstack/plugin-securitywalled bootstrap stops minting the grant row + deprecation pointer live). The exit PR's body must name the minor boundary it honours (#11975's acceptance criterion).Content — delete the legacy path, as its own reviewed change (never a rider on another leg):
packages/core/src/security/resolve-authz-context.ts§6b: the legacy arm that flipshasPlatformAdminGrantfrom an unscoped, in-windowadmin_full_accessUSER grant row stops conferringPLATFORM_ADMIN— after this card, only the §6b-config anchor confers it (walled AND single postures per whatever state platform-admin re-anchor follow-up (Choice 4B): config-anchor thesingleposture — first-user promotion becomes development-only fallback #11979 / Choice 4B is in at that time; if 4B has not landed, thesingleposture's row-derived standing must be carved out explicitly, not deleted with the window).reportLegacyPlatformAdminGrantand its boot-side detection inplugin-security/bootstrap-platform-admin.tsretire with the read they warn about (the pointer's job is done when the row confers nothing).last-admin-guard(re-priced by L3 platform-admin re-anchor L3 (plugin-auth): re-point ensure-default-organization; re-price last-admin-guard as its own reviewed step #11973), explain provenance, the standing surface — none may silently change answer forsingle-posture rigs.Acceptance criterion: on a walled rig, a seeded legacy org-less
admin_full_accessgrant confers NOTHING (posture resolves withoutPLATFORM_ADMINunless the config anchor matches); the exit is a reviewed change onorigin/mainwhose PR body names the minor boundary;single-posture first-user standing is unchanged unless #11979 landed first.Generated by Claude Code