fix(security/sharing/rest/app-showcase): #2926 复测缺陷 + #2909 两存储审计#2983

Merged

os-zhuang merged 10 commits into

mainfrom

claude/app-showcase-permissions-defects-1h2ed4

Jul 15, 2026

Commits on Jul 15, 2026

fix(plugin-security): protect platform/package-stamped sys_position rows (#2926 ①)
claude
committed
fix(rest): pass through explicit 4xx status+code in mapDataError (#2926 ⑦)
claude
committed
feat(metadata-protocol): reject unknown $-prefixed query params with 400 (#2926 ⑩)
claude
committed
feat(plugin-sharing): backfill rule grants at boot (#2926 ③)
claude
committed
feat(plugin-sharing): sys_sharing_rule provenance + seed-not-clobber (#2909 P0/T1)
claude
committed
test(plugin-security): lock bootstrap-declared-positions seed semantics (#2909 T2)
claude
committed
fix(plugin-security): stop clobbering admin-edited capability scope (#2909 T3)
claude
committed
docs(adr): resolve 0094 addendum audit items; record sharing-rule seed-not-clobber tradeoff (#2909 T4)
claude
committed
feat(app-showcase): bind persona positions on kernel:listening + announcements; document isDefault dual-track (#2926 ②⑤)
claude
committed
fix(plugin-sharing): defer rule backfill to kernel:listening so seed rows materialize (#2926 ③)
claude
committed