Tentatively marking this as a train blocker, in case it’s a MediaWiki bug – we wouldn’t want something like this to hit production. It might just as well be a Beta config issue, though.

Database says I’m a bureaucrat:

MariaDB [enwiki]> SELECT ug_group FROM user_groups WHERE ug_user = (SELECT user_id FROM user WHERE user_name = 'Lucas Werkmeister (WMDE)');
+------------+
| ug_group   |
+------------+
| bureaucrat |
| confirmed  |
| sysop      |
+------------+
3 rows in set (0.00 sec)

PHP also agrees:

lucaswerkmeister-wmde@deployment-deploy01:~$ mwscript eval.php enwiki <<< 'var_export( User::newFromName( "Lucas Werkmeister (WMDE)" )->getGroups() )'
array (
  0 => 'bureaucrat',
  1 => 'confirmed',
  2 => 'sysop',
)

But Special:UserRights/Lucas Werkmeister (WMDE) doesn’t show the group:

Member of: Confirmed users, Administrators
Implicit member of: Autoconfirmed users

I am seeing the group from my end.

Now I’m seeing it as well… maybe the outdated permissions were cached somewhere and now that cache expired?

What's the current status of this? Is this still a train blocker?

I’d say that’s up to the train… manager? person? Anyways, up to you :)

The worst-case scenario is that this is a real MediaWiki core bug that affects not just Beta but also production, and it’s effective not just when someone gains rights, but also when someone loses them, allowing a user to continue exercising their rights for up to a few hours.

On the other hand, if it only makes a difference when someone gains rights but not when someone loses them, it’s more of an annoyance; and it might not affect production at all, but be due to some incorrectly set-up cache in Beta.

(I also haven’t had an opportunity to try if this still happens since Friday.)

I'm gonna make the call that this isn't serious enough to block the train _yet_ at least not without further evidence that it's affecting production. So I think we will cautiously move forward with the train while monitoring this for further fallout/production impact.

This issue affects production as well, but it's not new in this week's release – I found a duplicate report from 23 January: T243490.

Untagging as per above not an issue with the cluster

Maybe the same issue as T234743: User rights validation is sometimes malfunctioning (with FlaggedRevs only?) (depending on which server you hit the group might or might not exist)? Although bureaucrat is a core group and I don't think we remove it anywhere...