From f2844f72dc1f3caf0f2912a97fae702cd1500d2e Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Wed, 21 Oct 2026 03:45:26 -0700 Subject: [PATCH 1/2] docs(ax): joinPolicy 'open' did not make an unlisted pod joinable (entry 81) Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_015eTFc9yqm2vKZiUyvLuBT4 --- docs/development/agent-experience-audit.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/development/agent-experience-audit.md b/docs/development/agent-experience-audit.md index 2eafbb20c3..6577e28d84 100644 --- a/docs/development/agent-experience-audit.md +++ b/docs/development/agent-experience-audit.md @@ -4175,3 +4175,13 @@ Gates that never appear in metadata decided several more, including the client a **Repair:** a catalogue verdict now requires a second, independent pass that tries to refute it. That pass answers from vendor docs or measurement what the read token actually *reaches*: tools with side effects, proxies to third parties, token forwarding, plan or allowlist gates. The first pass's metadata is the starting point, not the verdict. **Lesson:** a scope's name is the vendor's label for a permission set, and the permission set is what the bar is about. Measure what the credential can reach, and refute your own first reading before a capture or an account is spent on it. + +## 81. `joinPolicy: 'open'` did not make an unlisted pod joinable (2026-10-21, connector-ops) + +*Origin: a sweep of pods holding fleet seats. 21 non-DM pods carried `joinPolicy: 'open'` with `publicRead: false` and `communityListed: false`, and connector-ops reported them as joinable by any signed-in user who had the pod id. Another session began closing them through the owner's account on that premise.* + +The claim came from the field's name and the schema default (`models/Pod.ts`, `joinPolicy` defaults to `'open'`). The enforcing code says otherwise. `joinPod` (`controllers/podController.ts`) refuses a non-member, non-admin unless `isDirectlyJoinable(pod)` holds, and that function (`services/podListing.ts`) is `isCommunityListed(pod) && joinPolicy !== 'invite-only'`. Listing requires `publicRead === true` and `communityListed === true`. The agent self-install route gates the same way (`routes/agentsRuntime.ts`, whose comment names this exact case). So `joinPolicy` decides anything only for a public, listed pod. On every pod in the sweep, `'open'` was inert, and none was ever joinable. + +**Repair:** none in code; the gate was right. The report was withdrawn before more pods were changed, and invite-only stays harmless on the three that had already been closed. + +**Lesson:** a field that names a permission is not the check that enforces it. Before reporting that someone *can* do something, find the function that refuses it (search for the refusal code, here `join_refused`) and read its condition. If you can't name that line, say the field suggests it and that it's unverified, and don't hand anyone a list to act on. From 5b20f1c36c48d19ee5c981955b6e02ee742809df Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Wed, 21 Oct 2026 03:45:43 -0700 Subject: [PATCH 2/2] docs(ax): entry 81 states how many pods were actually changed Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_015eTFc9yqm2vKZiUyvLuBT4 --- docs/development/agent-experience-audit.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/development/agent-experience-audit.md b/docs/development/agent-experience-audit.md index 6577e28d84..11e4ea8cef 100644 --- a/docs/development/agent-experience-audit.md +++ b/docs/development/agent-experience-audit.md @@ -4182,6 +4182,6 @@ Gates that never appear in metadata decided several more, including the client a The claim came from the field's name and the schema default (`models/Pod.ts`, `joinPolicy` defaults to `'open'`). The enforcing code says otherwise. `joinPod` (`controllers/podController.ts`) refuses a non-member, non-admin unless `isDirectlyJoinable(pod)` holds, and that function (`services/podListing.ts`) is `isCommunityListed(pod) && joinPolicy !== 'invite-only'`. Listing requires `publicRead === true` and `communityListed === true`. The agent self-install route gates the same way (`routes/agentsRuntime.ts`, whose comment names this exact case). So `joinPolicy` decides anything only for a public, listed pod. On every pod in the sweep, `'open'` was inert, and none was ever joinable. -**Repair:** none in code; the gate was right. The report was withdrawn before more pods were changed, and invite-only stays harmless on the three that had already been closed. +**Repair:** none in code; the gate was right. The report was withdrawn after one owner's pod had been switched to invite-only, alongside the one connector-ops created that day. Invite-only is harmless on both, so neither was reverted. **Lesson:** a field that names a permission is not the check that enforces it. Before reporting that someone *can* do something, find the function that refuses it (search for the refusal code, here `join_refused`) and read its condition. If you can't name that line, say the field suggests it and that it's unverified, and don't hand anyone a list to act on.