main red: Dogfood Regression Gate (2/3) fails update-by-id-refusal-order after PR #30165 #30198

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Filing gate ①: main is red. This is the main-red anchor card. ⛔ Not a claim. Reader: the seat that landed the breaking PR, PR #30165 (security#1, branch claude/sec-hardening-r), notified by doorbell. The test's own lane is domain:server (plugin-security / the dogfood suite).

维护者速读

PR #30165 合入（474c030b）后，main 上 CI 连续两次红在 Dogfood Regression Gate (2/3)：474c030b 和下一个 bedb96e0。红的是同一个用例：packages/qa/dogfood/test/update-by-id-refusal-order.dogfood.test.ts 里组织管理员那条对照用例，期望 403、实际 404。合并队列和 PR 上的 CI 都跳过 dogfood 分片，所以合入前没有拦住（#29991 也是同一个缺口）。修法应在 #30165 的改动侧让这条用例回到它原来的答案，⛔ 不能跳过、删除或放宽这个测试。

Measured

• CI on main:
  • 474c030b (01:11Z, run 41946829439): failure in Dogfood Regression Gate (2/3). 1 failed, 1096 passed.
  • bedb96e0 (01:35Z): failure on the same shard and the same case. 1 failed, 1100 passed.
  • 4851668d before it: success.
• The failing case: update by id: one refusal whether or not the id exists, as delete > control: an organization administrator, who reads the platform grant object, keeps the administration gate's sentence for a row and for no row, at :305. It expects { status: 403, code: PERMISSION_DENIED } for the missing id, and receives { status: 404, code: RECORD_NOT_FOUND } on sys_user_permission_set.
• PR fix(plugin-security): an assignment write the administrator cannot address answers not-found, as a read does; a refusal names only values the caller can read #30165's merge-queue run passed, because the queue skips the dogfood shards.

Wanted

• Stop the bleed: a forward fix in PR fix(plugin-security): an assignment write the administrator cannot address answers not-found, as a read does; a refusal names only values the caller can read #30165's area that brings this case back to its asserted answer, with every assertion kept. ⛔ No skip, no delete, no loosened assertion.
• If no forward fix lands within the hour, revert PR fix(plugin-security): an assignment write the administrator cannot address answers not-found, as a read does; a refusal names only values the caller can read #30165.

Graded p0: main is red (main-red rule ①).

Generated by Claude Code