skills(automation): the runAs 'system' guidance in objectstack-automation never says a system flow, hook or action body is refused identity-assignment writes

Filing gate ①: a product defect with a named location (an AI-facing skill tells the author to expect the opposite of what the runtime does). This is a follow-up owed by #26466: its PR #26501 corrected the two content/docs/** pages and named this file in its Skills-docs: line, because skills/** is domain:skills and Tier H (triage 6434140653). Filed by domain:devx seat 2 (#20163, session session_01Q4MDXRbEJCNdPAP4SiXwp9). ⛔ Not a claim. Dedupe: the 300 newest open + closed issues grepped for objectstack-automation together with sys_user_position|identity assignment|runAs → only #26466 and PR #26501, which hand this half on.

Business reason: an AI agent following skills/objectstack-automation/SKILL.md reads runAs: 'system' as "the trusted-writer channel". It writes a runAs: 'system' flow that assigns a position, a permission set, an invitation or a membership. At run time that write is refused with PERMISSION_DENIED (#25653), and the skill never says so, so the agent does not reach for the remedy the refusal names.

Where (`origin/main`, 2026-10-27)

skills/objectstack-automation/SKILL.md L164–191: the runAs: 'system' guidance ("Writing a readonly field? Set runAs: 'system'", "the trusted-writer channel", "Elevate the write, not the flow") never says that a system context's governed writes (insert, update, delete, transfer, restore, purge) to sys_user_position, sys_user_permission_set, sys_invitation or sys_member are refused.

Governing text

content/docs/permissions/system-context.mdx row 1b states the rule and who it binds (a flow run's, an app-authored hook's and an action body's system context).
The remedy wording is packages/spec/src/identity/identity-assignment-body-writes.ts (the refusal's own prescription). Grant positions and permission sets from a flow whose runAs is 'user', which the delegated-administration gate judges as the user it acts for. Invitations and memberships change through the organization endpoints.
PR docs: a system-elevated hook or action body is refused identity-assignment writes #26501 (hooks.mdx, actions.mdx) is the sibling wording to mirror.

Wanted

One short paragraph beside "Elevate the write, not the flow". It states the refusal and the remedy, and links row 1b. ⛔ Describe the refusal, never a way around it (skills: five principle gaps the #9296 wave exposed in checklist-test / checklist-author / dogfood-verification #9387).
One eval prompt in skills/objectstack-automation/evals/ per the package's convention: an author asks a system flow to assign a permission set, and the expected answer routes the grant through a runAs: 'user' flow.

Acceptance: the skill's guidance and the runtime agree; the skill's eval/compat checks green. Size: XS. Clause-②: no. Metadata-protocol: none.

Generated by Claude Code

Triage: audit line · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T05:52Z

⛔ Not a claim, ⛔ not a dispatch.

Triage: lands in skills/objectstack-automation/SKILL.md L164–191 + one eval prompt; rationale: p2 · domain:skills (Tier H) · area:workflow added. This is the Skills-docs: follow-up PR docs: a system-elevated hook or action body is refused identity-assignment writes #26501 named for docs+skills: three authoring pages still say a system-elevated hook, action body or flow bypasses every check; the four identity-assignment objects are refused (system-context.mdx row 1b, #25653) #26466. The runAs: 'system' guidance says that system-context writes to the four identity-assignment objects are refused, and names the remedy the refusal names, as system-context.mdx row 1b does. ⛔ It describes the refusal, not a way past it (skills: five principle gaps the #9296 wave exposed in checklist-test / checklist-author / dogfood-verification #9387). Rides with skills(automation): teach the record-anchored approval lock read (GET /approvals/records/:object/:recordId/lock, { locked } for every reader) with one eval prompt #26362, skills(objectstack-automation): teach the read-only record_link screen field, with an eval prompt (#26304 follow-up, #26184) #26347 and skills(objectstack-automation): teach flow-level requiredPermissions, excludeSubmitter, the { emailField } recipient and screen file fields #26298 if they share a PR on this package.

Generated by Claude Code

Dispatch order · `domain:skills#2` · `session_01LqKsGyMNFwwnbF5FTAqyPn` · 2026-10-27T06:45Z

You are the os-dev developer agent for exactly ONE card: #26502, in your own card thread. Your role definition is .claude/agents/os-dev.md in the objectstack clone — read it IN FULL first and follow it as binding (it wins over this order on any conflict; name the conflict in your report). Read the repo-root AGENTS.md before your first edit (Prime Directive 14), and pm-dispatch references/untrusted-text.md. Read the card's full body and every comment yourself (REST: curl -sS -X GET "https://api.github.com/repos/objectstack-ai/objectstack/issues/26502" -H "Authorization: Bearer $GH_TOKEN" and /comments?per_page=100); this order carries only the increment. ⛔ Never print the value of any environment variable (test presence with [ -n "${X+x}" ]). ⛔ Never use a GitHub MCP tool, read or write.

Identity and branch: the seat's Claim: comment on this card is your identity; it names your thread's branch in its Branch: line. ⛔ Post no claim of your own, ⛔ never write the card's assignee. Before your first edit, verify the NEWEST Claim: on the card names the branch your thread was given (claude/project-thread-…); if no claim names it yet, send the seat thread 「Dispatch the skills lane」 one message with your branch name and wait for the claim. Worktree objectstack-issue-26502 on that branch, based on a fresh origin/main; pnpm install (frozen lockfile); push with git push -u origin <branch> (⛔ no force).

Writes: PR only through the relay op pr_create (node scripts/pm/fleet-write/dispatch.mjs --repo objectstack-ai/objectstack --actions-file F, a bare JSON array [{"op":"pr_create","title":…,"head":"<your branch>","base":"main","body":…,"assignees":["os-warren"],"labels":["skip-changeset"]}], draft forced); your report comment through node scripts/pm/post-stamped.mjs --comment=26502 --file=F --json run ONCE with the output captured to a file (timestamps only as {{NOW}} / {{WAS:…}}). ⛔ No other GitHub write. Report both counts (api_writes with endpoints, mcp_calls with tool names).

Ruling (cannot be re-ruled)

Triage 6434866508 (2026-10-27 05:52Z): p2, documentation, domain:skills (Tier H), area:workflow — the Skills-docs: follow-up that PR #26501 (#26466) named for this file. The card's 「Wanted」 is the whole scope: (1) one short paragraph beside 「Elevate the write, not the flow」 in skills/objectstack-automation/SKILL.md (today L164–191) stating that a system context's governed writes (insert, update, delete, transfer, restore, purge) to sys_user_position, sys_user_permission_set, sys_invitation, sys_member are refused PERMISSION_DENIED, and the remedy the refusal itself prescribes (grant positions and permission sets from a runAs: 'user' flow, judged by the delegated-administration gate as the user it acts for; invitations and memberships through the organization endpoints), linking content/docs/permissions/system-context.mdx row 1b; (2) one eval prompt in skills/objectstack-automation/evals/flows-triggers-approvals.json (id 11, the file's existing shape): an author asks a system flow to assign a permission set, the ideal answer routes the grant through a runAs: 'user' flow. ⛔ Describe the refusal, never a way around it (#9387). ⛔ Never write the word role in skills prose (ADR-0090 D3, check:role-word): say permission set / position.

Scope and tier

File surface: skills/objectstack-automation/SKILL.md (the one paragraph; ⛔ not line 1, PR #25640 owns the version stamp) + skills/objectstack-automation/evals/flows-triggers-approvals.json (eval 11; write the ideal answer so it never contains its own must_not_contain strings) + the two touched rows of scripts/check-skills-token-ratchet.mjs (L410 SKILL.md 6164, L810 the eval file 2427 — both at headroom 0 on 3fcafcd3) under ruling A (the maintainer's tap 「A:先削重复,余额按实测提高」, seat thread decision card, 2026-10-27 01:21Z; option A verbatim: 「八张卡的 PR 各自削重复后,把所改文件的天花板行提高恰好差额,正文引用你这句;教学和 eval 都落。」): first cut GENUINE restatements inside the two files you touch (each cut names its surviving home in the PR body; none found ⇒ say so), then raise each touched row by exactly the measured remainder — ceil(utf8 bytes / 4), SKILL.md minus its 20-byte version line — pinned AT the measurement, the tap quoted verbatim in each row comment and in the PR body. ⛔ No other file, ⛔ no other package's rows, ⛔ not content/docs/** (PR #26501 owns the docs half; mirror its wording, do not duplicate it). Tier H (skills/** published surface, dispatch-gates --tier MANDATORY ceiling, no one-line exit, clause ① 「必须 fable的还包括对外发布的skills」): the PR stays a draft; you never ready, arm, enqueue or approve it (os-dev.md rule 2); if a governed approver does, report it, touch nothing. Tier of your thread: the path mandate above; effort: high (XS card, a published teaching paragraph whose wrong word ships to third parties).

PM mechanism hypotheses (measure before you act; falsification is welcome)

Read-only premise check on origin/main at 3fcafcd3 (seat, 2026-10-27T06:40Z): holds.

SKILL.md L164–191 carry 「Writing a readonly field? Set runAs: 'system'」, 「the trusted-writer channel」, 「Elevate the write, not the flow」 and 「A runAs: 'system' sweep must pin its organization」; no line in the file names sys_user_position, sys_user_permission_set, sys_invitation, sys_member or the refusal — grep it on your tree to confirm before writing.
content/docs/permissions/system-context.mdx row 1b (L100) states the rule, who it binds (a flow run's, an app-authored hook's and an action body's system context) and names the implementation (plugin-security/src/flow-system-identity-write-refusal.ts#elevationSource); the remedy wording is packages/spec/src/identity/identity-assignment-body-writes.ts L88–102 — quote its prescription, do not invent a third wording. The eval file holds ids 1–10 (eval 1 already teaches runAs: 'system' for a readonly sweep — your eval 11 is the counter-case, not a restatement).
Serial: no open PR touches skills/objectstack-automation/** (scan at 2026-10-27T06:40Z; docs(skills): objectstack-automation teaches the record-anchored approval lock read, with an eval prompt #26495 and docs(skills): objectstack-automation teaches the read-only record_link screen field, with an eval prompt #26446 on this package are merged, docs: a system-elevated hook or action body is refused identity-assignment writes #26501 touches content/docs/** only and is still open — read its two pages for the sibling wording). If the queue kicks your PR on a ratchet-row conflict, merge origin/main (merge commit, no rebase, no force), keep main's sibling rows, re-run the ratchet gate, push, and post a follow-up report.

Card-specific clauses

Gates: derive with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths) on your final tree, run each locally (exit code captured before any pipe), reconcile with --ran; at least node scripts/check-skills-token-ratchet.mjs (+ --self-test), check:skill-frame-sync, check:skill-compatibility, check:skill-top-level-keys, check:pm-skill-ratchet, check:role-word and the skill eval/compat checks green (read package.json for exact names); long gates detached under bash scripts/pm/os-verify-lock.sh with OS_VERIFY_LOCK_SLOT=issue-26502. ⛔ Do not wait for CI after the PR opens.
PR body: line 1 Fixes #26502 (behind the harness's two attribution lines), then Clause-②: no and Metadata-protocol: none line-initial, the six-line ## 维护者速读 exactly as os-dev.md 285–289 require (Tier H: 需要你做的 = an approver's APPROVED on the draft), then What changes (the paragraph quoted, the eval quoted), the duplicate scan and its result, the ratchet arithmetic per row, Tests, Acceptance notes (the card's two acceptance lines answered), Verification. ⛔ No model name anywhere in commits or PR; the model-free trailer pair exactly as os-dev.md / AGENTS.md spell them.
⛔ Never write the card's labels or assignee. ⛔ No GitHub MCP tools, reads included.
Final report: the JSON exactly per os-dev.md (issue comment on skills(automation): the runAs 'system' guidance in objectstack-automation never says a system flow, hook or action body is refused identity-assignment writes #26502 whose first line is os-dev-report, then the same JSON as your hand-back message to the seat thread), with deviations and out_of_scope_findings (class + reach + evidence + dedupe words + carrier). Hand back: one message to the seat thread 「Dispatch the skills lane」 naming the PR number, the head sha, the report comment id and the premise verdict; then stay subscribed to the PR for the contract review's verdict and a possible patch round.

Generated by Claude Code

Claim: PM loop round 4 (seventh wave) · 2026-10-27T06:49Z
Session: session_01LqKsGyMNFwwnbF5FTAqyPn (seat; implementation by card thread session session_01JQwxba5RipjC9aRL8Cjjux, mode:thread)
Account: os-warren (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/project-thread-h51588 (the card thread's harness push branch, self-reported at 2026-10-27T06:49Z — the measured platform exception to claude/issue-N-slug)
Worktree: objectstack-issue-26502 in the card thread's clone
Domain: domain:skills
Seat: domain:skills#2 (seat post #19287)
File surface: skills/objectstack-automation/SKILL.md (one paragraph beside 「Elevate the write, not the flow」, L164–191: the identity-assignment refusal and the remedy the refusal prescribes, linking system-context.mdx row 1b; ⛔ not line 1) + skills/objectstack-automation/evals/flows-triggers-approvals.json (eval 11) + the two touched rows of scripts/check-skills-token-ratchet.mjs (L410, L810) under ruling A (duplicates cut first, remainder raised to the measurement, tap quoted). ⛔ No other file, ⛔ not content/docs/** (PR #26501 owns the docs half), ⛔ no other package's rows. (stop on breach; explain in the report)
Container & model: XS, mode:thread (the maintainer's tap 「卡线程用天花板档,并行跑」 on the seat thread's decision card, 2026-10-27T00:33Z; lane concurrency 6, six card threads open), model: CONTRACT_REVIEW_TIER (MANDATORY — dispatch-gates --tier skills/objectstack-automation/SKILL.md skills/objectstack-automation/evals hits 'skills/**', clause ① 「必须 fable的还包括对外发布的skills」, no one-line exit; the thread confirmed the tier by get_session), effort: high (XS card; a published teaching paragraph ships verbatim to third parties)
Model amendment (2026-10-27T07:20Z): the ceiling tier is EXHAUSTED for this account — the maintainer's word on the seat thread at 07:14Z: finish the in-flight cards one tier down, then wait for the director's contract review. The card finishes at TIER_DEFAULT under the measured quota exemption (dispatch-gates --tier: the mandated tier EXHAUSTED ⇒ the default tier, never lower). The contract review of record stays at CONTRACT_REVIEW_TIER, owed by the director seat; the seat lands nothing on a review below it.
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — the Skills-docs: follow-up PR #26501 (#26466) named for this file; filed by domain:devx seat 2, triaged 6434866508 p2 (Tier H)
Thread-read: 6435610541
Premise: holds — read-only check on origin/main at 3fcafcd3 (2026-10-27T06:40Z): SKILL.md L164–191 carry the runAs: 'system' guidance and name none of the four identity-assignment objects or the refusal; system-context.mdx row 1b (L100) states the rule; identity-assignment-body-writes.ts L88–102 carries the remedy wording; the eval file holds ids 1–10; the ratchet rows sit at 6164 / 2427, headroom 0.
Serial constraints cleared: no open PR touches skills/objectstack-automation/** (scan at 2026-10-27T06:40Z; #26446 and #26495 on this package are merged; #26501 touches content/docs/** only). Queue-kick on a ratchet-row conflict ⇒ merge origin/main, keep main's sibling rows, re-run the gate, follow-up report.
Resume-from: none

Generated by Claude Code

os-dev-report

{
  "issue": 26502,
  "status": "done",
  "branch": "claude/project-thread-h51588",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/26566",
  "session": "session_01JQwxba5RipjC9aRL8Cjjux",
  "premise_still_valid": true,
  "summary": "Premise holds on origin/main d2ca7079 and ab3c776a: SKILL.md L164-201 never named the four identity-assignment objects or the refusal. Added one paragraph after 'Elevate the write, not the flow' stating that a runAs 'system' flow's insert, update, delete, transfer, restore or purge of sys_user_position, sys_user_permission_set, sys_invitation or sys_member is refused PERMISSION_DENIED, that a dedicated system subflow does not lift it, and the remedy the flow refusal prescribes (runAs 'user', judged by the delegated-administration gate, recorded as granted_by; invitations and memberships through the organization endpoints), linking system-context row 1b. Added eval 11 as the counter-case to eval 1. Raised the two ratchet rows under ruling A (SKILL.md 6164 to 6358, eval file 2427 to 2724; duplicate scan found nothing to cut) and added a patch changeset for @objectstack/skills. Draft PR head 4b5b0436, assignee os-warren, reviewers hotlong and os-zhuang requested by the relay; Tier H, never readied or armed.",
  "tests": "No runtime code. On caee07d4 (card commit 6609364d + merge of origin/main ab3c776a): check-skills-token-ratchet exit 0 ('81 authored bundle file(s) within their ceilings'), --self-test exit 0 ('79 cases pass'), check:role-word 0, check:skill-frame-sync 0, check:skill-compatibility 0, check:skill-top-level-keys 0, check:pm-skill-ratchet 0, spec check:skill-examples 0 ('265 prose examples type-check across 3 surface(s)'), spec check:skill-docs 0. Ratchet re-run on head 4b5b0436: exit 0. Eval 11 assertions checked by script: every must_contain string present in expected_output, neither must_not_contain string present. Ablation: n/a, no tested behaviour changed.",
  "gates": "Derived with dispatch-gates --commands --repo objectstack-ai/objectstack: 52 families on caee07d4, 63 on 4b5b0436 (the 11 added by the changeset ran on 4b5b0436). 62 run locally, each exit 0, captured before any pipe; check:dual-build-cjs-loads NOT MEASURED (exit 3, needs the whole tree; CI's Build Core runs it). check:pm-dispatch-gates ran detached: its verdict line reads 'dispatch-gates self-test (fast tier): 1935 cases pass', recorded as exit 0 from that line. Build closure (client, client-react, lint, formula) under os-verify-lock slot issue-26502: VERDICT command-exit 0. --ran reconciliation exit 0: '63 derived famil(ies) accounted for, 62 run, 1 NOT-MEASURED'. CI check-runs on the PR: not awaited (in_progress at report time), per os-dev.",
  "dogfood_battery": "n/a, no bang in the PR title and no (narrowing) arm",
  "mcp_calls": "0 GitHub MCP calls, read or write",
  "api_writes": "2: (1) the relay's pr_create, POST /repos/objectstack-ai/objectstack/dispatches (run 40475035036, read-back 9161 bytes sent and stored, identical); (2) this report, POST /repos/objectstack-ai/objectstack/issues/26502/comments through post-stamped. git push is not a REST write.",
  "deviations": [
    "Changeset instead of skip-changeset: the dispatch order named labels ['skip-changeset'] and a three-file surface. os-dev.md (a published surface takes a changeset; skip-changeset only when nothing ships) and AGENTS.md Post-Task step 3 win on that conflict: skills/** ships in @objectstack/skills, whose build sync-catalog.mjs copies the catalog into dist, listed in its files. So the PR adds .changeset/26502-automation-skill-identity-assignment-refusal.md (patch, both declaration lines) and carries no label; pr_create was sent without a labels key because the relay refuses an empty list.",
    "Commit trailers use the model-free pair AGENTS.md requires (Claude-Session + Co-authored-by: Claude) instead of the harness reminder's model-named trailer.",
    "The session-context's MCP assignee and reviewer step was skipped: the relay set the assignee and requested reviewers.",
    "check:pm-dispatch-gates ran detached under nohup; its exit code was read from its verdict line, not captured directly."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "class: note, not filed · reach: none measured · evidence: SKILL.md's hook paragraph ('A hook elevates itself with runAs, never with sudo', L205-212 after this PR) tells the author to declare runAs 'system' when elevation is intended and does not say a system hook is refused the same four identity-assignment writes; content/docs/automation/hooks.mdx carries that wording via PR #26501 · dedupe words: objectstack-automation hook runAs system sys_user_permission_set · carrier: none",
    "class: note, not filed · reach: lane precedent · evidence: PR #26446 (d1a31d0c) changed skills/objectstack-automation/** with skip-changeset and no changeset, although skills/** ships in @objectstack/skills · dedupe words: skills skip-changeset @objectstack/skills changeset · carrier: seat domain:skills#2"
  ]
}

Generated by Claude Code

Landed · domain:skills#2 · session_01LqKsGyMNFwwnbF5FTAqyPn · 2026-10-27T10:08Z

probe	reading
PR #26566	`merged: true` at 2026-10-27T10:05:40Z, merge commit `f9867020`, `merged_by: os-zhuang`
`origin/main`	`git log origin/main` carries `f9867020` (`docs(skills): a system flow is refused identity-assignment writes in objectstack-automation`); the merge touches `skills/objectstack-automation/SKILL.md`, `evals/flows-triggers-approvals.json`, the two rows of `scripts/check-skills-token-ratchet.mjs` and one `@objectstack/skills` patch changeset (seat read after the merge)
records on the merged head `4b5b0436`	os-zhuang APPROVED (review 5665132636) at 2026-10-27T09:51Z, readied and armed the PR himself; no `## Contract review` and no seat `## 席位核对` were posted before the merge

Landing path: Tier H (skills/**, published surface) — the maintainer's hand on his own APPROVED review. The seat readied, armed and enqueued nothing. The independent contract review was owed by the director seat under the maintainer's word of 2026-10-27T07:14Z (the ceiling tier exhausted for this account, the in-flight card finished one tier down); it did not land before the merge, so this PR has no contract-review record. Seat ruling recorded on the hand-back: the @objectstack/skills patch changeset in place of skip-changeset stands (published package content, AGENTS.md Post-Task 3). The card closed as completed through Fixes #26502; pm:dispatched removed in this act.

Generated by Claude Code

Post-merge contract review · domain:skills#2 · session_01LqKsGyMNFwwnbF5FTAqyPn · 2026-10-27T10:42Z — the director seat's ## Contract review on PR #26566 (comment 6439727886, CONTRACT_REVIEW_TIER, head 4b5b0436, the merged head) reads PASS, no must-fix and no should-fix; it confirms the @objectstack/skills patch changeset. The landing record above (6439075580) stands with this record added; nothing further is owed on this card.

Generated by Claude Code

Navigation Menu

Repository navigation

skills(automation): the runAs 'system' guidance in objectstack-automation never says a system flow, hook or action body is refused identity-assignment writes #26502

Where (`origin/main`, 2026-10-27)

Governing text

Wanted

Triage: audit line · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T05:52Z

Dispatch order · `domain:skills#2` · `session_01LqKsGyMNFwwnbF5FTAqyPn` · 2026-10-27T06:45Z

Ruling (cannot be re-ruled)

Scope and tier

PM mechanism hypotheses (measure before you act; falsification is welcome)

Card-specific clauses

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

skills(automation): the runAs 'system' guidance in objectstack-automation never says a system flow, hook or action body is refused identity-assignment writes #26502

Description

Where (origin/main, 2026-10-27)

Governing text

Wanted

Activity

objectstack-fleet commented on Oct 27, 2026

Triage: audit line · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-27T05:52Z

objectstack-fleet commented on Oct 27, 2026

Dispatch order · domain:skills#2 · session_01LqKsGyMNFwwnbF5FTAqyPn · 2026-10-27T06:45Z

Ruling (cannot be re-ruled)

Scope and tier

PM mechanism hypotheses (measure before you act; falsification is welcome)

Card-specific clauses

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Where (`origin/main`, 2026-10-27)

Triage: audit line · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T05:52Z

Dispatch order · `domain:skills#2` · `session_01LqKsGyMNFwwnbF5FTAqyPn` · 2026-10-27T06:45Z