Repository navigation
plugin-security + runtime: the grant, clone and activation doors take a permission set's package and report a two-holder name with its candidates (ADR-0150 D3/D8; before #31698 PR-2) #32164
Description
domain:server#3 · os-support-ai · session_01WGufzeeBmtefMTT21doena
Filed verbatim by seat 3 from the epic seat's draft (epic:#31527#1, /mnt/project-files/epic-31527/31698-carriers.md), with the maintainer's approval on seat 3's decision card (option 「允许，3 号席位立卡」, 2026-11-10, this account's project thread). ⛔ Not a claim.
Ruling-ref: 6764938596 (epic, on #31698: ruling A agreed, the carrier rulings); seat 3 step-0 ruling on #31698.
④ coordination card: a child of the ADR-0150 epic #31527, a precondition of #31698 PR-2.
Epic: ADR-0150 (#31527). Blocks: #31698 (PR-2). Lane: domain:server (plugin-security, runtime). Reader: the server seat that claims it.
Found by #31698 PR-2 step 0 (seat 3, M1–M5). Readings: /mnt/project-files/server-orders/seat3/31698-step0.md.
The doors read a refusal as "no such set", and none can name a package
These doors pick nothing, so they fail closed. But with two holders, no door can grant, clone or switch off either set, and each reports the ambiguity as a miss. Red line 2 says ambiguity is reported.
| # | Door | Today (two holders, measured) | Do |
|---|---|---|---|
| M1 | grant-permission-set-name.ts (catalog.resolve): Setup's grant form and the data door |
400 reference_not_found, "There is no permission set named …" |
Report the D3 refusal with its candidates (the 409 shape). Accept permission_set_package and resolve by it |
| M2 | stored-permission-set-package-stamp.ts (the #31698 PR-1 seam) |
an insert replaces any package the writer sent, and stamps null for a two-holder name |
A writer that names a package keeps it when that package holds the name. A named package that does not hold it is refused, never re-stamped |
| M3 | permission-set-clone.ts (reader.resolve) |
404 RESOURCE_NOT_FOUND, "nothing to clone" |
409 with the candidates; take a source package |
| M4 | catalog-activation.ts (reader.resolve) |
404, "nothing to switch off"; no ledger row is written |
409 with the candidates; take a package and write that package's ledger row |
| M5 | sys-user-permission-set.object.ts unique index (user_id, permission_set, organization_id) |
one user cannot hold both holders' sets in one organization | see the index ruling below |
Index ruling (epic seat). The unique key gains permission_set_package and becomes (user_id, permission_set, permission_set_package, organization_id). This is additive under red line 3: rows that duplicate each other under the old key still duplicate under the new one.
- Null semantics on every driver. Two grants of one name with a null package, for one user in one organization, must stay refused. SQL drivers treat NULLs as distinct in a unique index, so normalize to a sentinel or use the driver's null-equal form. Mongo follows the driver-mongodb: an upgraded database keeps the old (metadata_type, name) activation-ledger unique beside the widened key, so the first second-package row is refused (#31682 follow-up) #31732 widened-unique precedent. Pin it per driver.
- Migration. It is re-runnable. Existing rows keep their values, and no row is rewritten with a guessed package.
Clause-②: the seat declares it. With one holder, every door answers as today. First-party census: 0 pairs.
Dedupe (open and closed, permission-set-clone package, sys_user_permission_set unique index package): the hits are older clone-door and grant-UI cards (#28563, #28573, #23430, #30208). None of them takes a package or reports a two-holder name.
Business reason: without this, after the narrowing, an administrator cannot grant, clone or switch off either of two same-named sets shipped by two packages.
Epic red-line review before landing.
Activity
objectstack-fleet commentedon Nov 10, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: confirmed · 2026-11-10T11:14Z
⛔ Not a claim.
domain:server, p1,pm:blocking. ADR-0150: the grant, clone and activation doors take a permission set's package. It blocks objectql: narrow the phase-1 one-holder refusal from environment to namespace for permission set (ADR-0150 child B, permission set family) #31698 PR-2 and is linked under design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527.Generated by Claude Code
objectstack-fleet commentedon Nov 10, 2026
domain:server#3 · os-support-ai · session_01WGufzeeBmtefMTT21doena
Claim: PM loop round 2 · #32164 (the grant, clone and activation doors take a permission set's package and report a two-holder name) · 2026-11-10T14:09Z
Session:
session_01WGufzeeBmtefMTT21doena(seat); dev = a new card thread, its session restated by amendmentAccount:
os-support-aiBranch:
claude/project-thread-PENDING(the card thread's harness-pinned branch, restated by amendment before its first push)Worktree: the card thread's checkout of
objectstack-ai/objectstackDomain:
domain:serverSeat:
domain:server#3File surface: plugin-security
grant-permission-set-name.ts,stored-permission-set-package-stamp.ts,objects/sys-user-permission-set.object.ts(unique index) and the index migration; runtimedomains/permission-set-clone.tsanddomains/catalog-activation.ts; tests per driver, dogfood pins, changeset. The UI files of the same names are read, not edited (a UI follow-up is filed if the doors gain a package field the UI must send). Stop on breach.Container & model:
M,mode:thread,model: TIER_DEFAULT,effort: xhigh(p1, epic reader, schema index)Clause-②: no — a widening, restated after step 0
Metadata-protocol: none (restated after step 0: the unique index change is a schema face, so
Metadata-protocol:may move)Responsibility: plugin-security and runtime (objectstack): M1–M4 doors read a D3 refusal as "no such set" and cannot name a package; M5 unique index
(user_id, permission_set, organization_id)blocks holding both holders' sets | the epic seat's index ruling on the card (null semantics per driver, re-runnable migration) | Setup's grant form, the data door, clone and catalog activation; step 0 measures each with two holders under a throwaway probe of the switchThread-read: none
Premise: holds as filed. Measured by #31698 PR-2 step 0 (
/mnt/project-files/server-orders/seat3/31698-step0.md, M1–M5). Step 0 re-measures onmainafter #32192.Serial constraints cleared: no open PR touches the five surface files (all 62 open PRs read). It relates to #32160 (seat 4, uninstall cleanup,
cleanup-package-permissions.ts) and #32162 (store and read by package): those are different files, and the same epic sequence, before #31698 PR-2. Domain and grade from the parent #31527.objectstack-fleet commentedon Nov 10, 2026
domain:server#3 · os-support-ai · session_01WGufzgBi8iNgKbhq9r7VDT
Step 0 readings · #32164 · 2026-11-10T14:29Z
⛔ Not a claim. This is the dev card thread for seat 3's claim 6769504547: branch
claude/project-thread-ekmc12, sessionsession_01WGufzgBi8iNgKbhq9r7VDT. Nothing is committed. The build waits on the seat's go.Tree:
objectstack-ai/objectstackorigin/maine40f2df2,turbo run build --filter='@objectstack/dogfood^...'(70/70). The probe and raw outputs are in/mnt/project-files/server-orders/seat3/32164-step0/.Verdict: the premise holds. M1–M5 reproduce on
e40f2df2. Four forks need a ruling before the build: (F1) where a door takes the package, (F2) structured candidates, (F3) M2 at one holder, (F4) the index route and the memory driver.How it was measured: the same throwaway probe of the switch as 31698-step0 (
probe-registry.patchonSchemaRegistry.securityCatalogHoldersOtherThan). It was proven live in objectqldist(ablation-dist-preflight, 4 files), then reverted:git checkout HEAD, objectql rebuilt,--absent(0 of 14 files),git status --porcelainempty. The boot is showcase on sqlite-wasm plus twoAppPluginpackages,com.qa.p32164.alpha(namespacealpha) andcom.qa.p32164.beta(namespacebeta), each holdingqa_probe_set. The CONTROL names areshowcase_auditor,showcase_opsandshowcase_executive, each with one holder,com.example.showcase. Run 2 (probe-32164-r2.json) gives the numbers below. Run 1 left rows behind after a delete that did nothing, so its M2/M5 rows collided; run 2 uses a fresh user per case.1. M1–M5 re-measured (two holders, each door's real entry)
e40f2df2POST /data/sys_user_permission_set { user_id, permission_set }, the body Setup'sAssignedUsersSectionsends400 VALIDATION_FAILED,fields[0].code: reference_not_found, "There is no permission set named 'qa_probe_set': choose one from the list."permission_set_package: com.qa.p32164.alpha{ user_id, permission_set: showcase_auditor }201, stampedcom.example.showcasepermission_set_package: com.qa.nonholder201, re-stampedcom.example.showcase: the writer's package is replaced without a wordpermission_set_package= alpha (a holder)nullnullshowcase_ops), a named non-holdercom.example.showcasecom.qa.nonholder, with no checkPOST /security/permission-sets/qa_probe_set/clone { name, label }404 RESOURCE_NOT_FOUND, "has no definition — there is nothing to clone"?package=com.qa.p32164.alphashowcase_auditor200,package: com.example.showcase.custom,noticeCode: PERMISSION_SET_CLONE_IN_CREATED_PACKAGEPOST /security/_activation/permission/qa_probe_set { enabled: false }404, "…nothing to switch off"; no ledger row{ enabled: false, package }400 VALIDATION_FAILED,unknown_fieldatpackage(the body is closed)?package=com.qa.p32164.alphashowcase_executive200, ledger row(permission, com.example.showcase, showcase_executive, active false)qa_probe_setbound to alpha in organization O; a second grant of the name in O (for beta's set)409 DUPLICATE_RECORD; the data door answers409 UNIQUE_VIOLATIONThe catalog read the doors take as a miss (in-process):
resolveReference('permission', 'qa_probe_set')answersrefused, reasonambiguous-in-environment, candidates as display strings (package "com.qa.p32164.alpha",package "com.qa.p32164.beta"). With{ packageId: alpha }it resolves alpha. With{ packageId: com.qa.nonholder }the stale-column arm reads the package as null, so two holders are refused; at one holder it would resolve that holder. So M2's "named non-holder" cannot be judged from the resolution status alone. The seam must compare the resolved entry'spackageIdwith the package the writer named.The physical index (sqlite-wasm,
sqlite_master):CREATE UNIQUE INDEX uniq_sys_user_permission_set_ac248331 on sys_user_permission_set (user_id, permission_set, organization_id). These are plain columns:unique: 'organization'adds nothing becauseorganization_idis already listed.2. NULL handling per driver, and the machinery for widening a unique
Measured live with raw SQL (
pg-probe.sqland.out,sqlite-probe.cjsand.out):(user_id, permission_set, permission_set_package, organization_id), two rows(u, s, NULL, o)(u, s, A, o), then(u, s, B, o), then(u, s, A, o)again… NULLS NOT DISTINCT(u, s, NULL, o)twice refused;(u, s, NULL, NULL)twice also refusedUNIQUE (user_id, permission_set, organization_id) WHERE permission_set_package IS NULL(u, s, NULL, NULL)twice admitted(u, s, A, o), then(u, s, B, o): B refused by the old keyCOALESCE(permission_set_package, ''),COALESCE(organization_id, '__global__')By code. NOT MEASURED live, because this container has no mongod, mysqld or MariaDB:
CONCATis NULL when any part is NULL, so it is NULL-distinct too.'organization'included, materializes the listed fields verbatim, with a partial filter that requires every key part non-null (driver-mongodb: fielduniqueis built as a sparse index, so two explicitnullvalues collide, unlike the NULL-distinct rule of driver-sql and driver-memory #29278). A document with any null key part is exempt.memory-unique-constraint.ts), and has no seam for a runtime-owned index.The machinery for widening:
schema-drift.ts·widenedUniqueReplacements(PR feat(core): key the activation ledger by (metadata_type, package_id, name) and bind package-less rows to their one holder #31727) and driver-mongodbmongodb-schema.ts·retireWidenedUniques(PR fix(drivers): retire the activation ledger's old two-part unique on upgraded MongoDB and MariaDB databases #31831, card driver-mongodb: an upgraded database keeps the old (metadata_type, name) activation-ledger unique beside the widened key, so the first second-package row is refused (#31682 follow-up) #31732) retire the narrower index as areplace_unique_index: create-before-drop, categorized safe. Both take only an unnamedunique: true/'global'declaration, and both skip'organization'. When a gained column is nullable, they retire the narrower index only once a partial UNIQUE on exactly the narrower columns stands (hasPartialUniqueGuard,hasNullScopedGuard). Until then the narrower index is KEPT.migrations/activation-ledger-packageless-index.ts. It runs atkernel:readywith one form per dialect: a partial index on SQLite and PostgreSQL, a functional key part on MySQL, an INVISIBLE generated__hashcolumn on MariaDB. It is idempotent, and on duplicates it refuses and lists them, keeping neither (probe query,os migrate duplicates). Its Mongo copy is driver-mongodbRUNTIME_OWNED_UNIQUES(partial filterpackage_id: null). driver-memory isno-driver, exempt by that precedent.So with the declaration as it stands (
'organization'), widening the key leaves the old(user_id, permission_set, organization_id)index in place on both drivers. On SQL the drift plan offers it as an orphandrop_index(DESTRUCTIVE, opt-in). On Mongo it is kept and refuses beta's grant (E11000, the old-key row above).3. UI callers that would send a package (a UI follow-up card;
ui/**not edited)ui/packages/app-shell/src/views/metadata-admin/AssignedUsersSection.tsx: ADD writes{ user_id, permission_set }(line 441). Its list reads grants by{ permission_set: name }(line 350), so one set's page lists both holders' grants.…/metadata-admin/permission-set-clone.ts:POST …/clonewith body{ name, label }. It would name the source package.…/metadata-admin/catalog-activation.ts:POST /security/_activation/:type/:name(line 138), and it readssys_metadata_activationkeyed by(metadata_type, name)(line 103). It would name the package in both.catalog-holders.ts(line 107), and the record form'spermission-refwidget (ui/packages/fields/src/widgets/RegistryRefField.tsx), which picks a set by name.4. Schema face or Metadata-protocol
sys_user_permission_setis a plugin-security platform object. Itsindexes[]is not authored metadata, andIndexSchemadoes not change. So the index change is a schema face (DDL on every deployed database, through the drift plan and the runtime guard), andMetadata-protocol: none. The door changes are wire changes, not metadata authoring. My Clause-② reading: no spec key, export or error code is added (RESOURCE_CONFLICTis registered). Every moved answer is a two-holder state that cannot occur until #31698 PR-2, except F3's input below, which the seat declares.5. Forks for the seat
F1. Where the doors take the package. The clone body's
packagealready means the LANDING package (readCloneBody,CLONE_BODY_KEYS = name, label, package). The activation body is closed ({ enabled? }).?package=PKGon both POST doors. It is the exact qualifier the D2 ruling kept for/meta(6724570466). It does not collide with the clone's landing key, it is one spelling across/metaand/security, and the Console already holds package ids. Each door then declares its closed query set (AGENTS route rule 5). Today both doors drop an unknown query without a word (the M3 and M4 rows)./security/permission-sets/:ns/:name/clone,/security/_activation/permission/:ns/:name). It is a new path shape and needs the router's literal rules at_activation's depth.sourcePackageon clone,packageon activation): two new spellings.In every option the grant (M1) takes the stored column
permission_set_package. By code, an insert keeps it: the engine's static-readonly insert strip leaves asys_object to its own guards. The object's own note says an update by a non-system caller strips it as readonly.F2. Structured candidates. (a) The data door flattens a thrown D3 refusal to
409 { error, code: RESOURCE_CONFLICT, object }with no candidates. Measured with aPackageScopedNameRefusedErrorthrown from abeforeInserthook: typesresolveThrownHttpErrorkeeps onlyissuesandfieldsindetails, and resterror-response.tsbuilds the flat body. (b) The catalog's refusal carries candidates only as display strings (describePackageScopedHolder, coresecurity-catalog.ts)./actionsand the activation door's declaration types answercandidates: [{ kind: 'package', packageId }].SecurityCatalogResolutionrefused arm gains a structuredholdersmember besidecandidates(additive). M3 and M4 answer409 RESOURCE_CONFLICTwithcandidatesin the activation door's existingrefusedNameAnswershape. M1 answers 409 with the sentence that names every candidate, and structured candidates on/datago to a sibling card (the/metagap of the same class is metadata-protocol: the /meta door's 409 RESOURCE_CONFLICT carries details.candidates, as /automation and /actions do (ADR-0150 D5) #32201). This widens the file surface by coresecurity-catalog.ts: one additive member, declared FROM → TO in the changeset./dataenvelope in this PR (typesthrown-http-error.tsand resterror-response.ts). That is a wire change for every/datarefusal path.registry.packageScopedHoldersOf, a second source beside the catalog. Not recommended.F3. M2 at one holder against CONTROL. For one input, the card's M2 ("a named package that does not hold it is refused, never re-stamped") contradicts "with one holder, every door answers as today": a writer that names a non-holder for a one-holder name. Today that write is re-stamped without a word (data door
201; system insert re-stamped). Census: no first-party writer sends the column on insert. Its only writers are the stamp seam, the boot backfill andos migrate stored-references bind, andbindjudges the holders itself.Also to rule: whether a system update that writes the column alone to a non-holder (the bind shape, kept today) is refused too. The reader already reads a stale column as null, so it confers nothing. Recommended: refuse it in the seam as well, since
bindalready judges holders and the backfill writes only holders. Before the holders are sealed, the seam keeps a named package unjudged, because a stale column reads as null.F4. The index route. The ruling allows a sentinel or the driver's null-equal form. The readings support two routes:
unique: 'global'over(user_id, permission_set, permission_set_package, organization_id). Today's materialized key is already the listed columns (measured above), so the respelling adds no organization part. It is also what the siblingsys_user_positiondeclares (fields: ['user_id', 'position', 'organization_id'], unique: 'global'). It lets both widening arms retire the old key create-before-drop.uniq_sys_user_permission_set_packagelesson(user_id, permission_set, organization_id) WHERE permission_set_package IS NULL, in one form per dialect as the ledger's (re-runnable; it refuses and lists duplicates and never rewrites a row), plus a driver-mongodbRUNTIME_OWNED_UNIQUESentry. The guard is what unlocks the old index's retirement.no-driverexemption). The ruling says "every driver", so the epic seat should confirm memory's exemption, or rule an engine-level check for drivers without a guard.schema-driftare unchanged, but the guard lives where the ledger's does (metadata-protocol migrations, or plugin-security with the same probe helpers), and the Mongo entry is a driver-mongodb edit. Both are beyond the claimed files.''for "no package"). One plain declared key would then enforce on all four drivers, memory included, with no guard. But every writer and reader of the column would move from null to''(the stamp, the backfill,bind,storedPermissionSetScope, the D10 report), and every existing NULL row would be rewritten. That conflicts with the column's documented "empty" meaning and with the ledger precedent's "never a sentinel" (ADR-0126 §4).Out of scope (class b, contract text against DDL). The object's comment and
grant-permission-set-name.ts's module note say the index refuses "a second platform-wide grant (organization NULL)". On the measured DDL it does not: the column is plain, PostgreSQL and SQLite admit two organization-NULL rows, and Mongo exempts null keys. On this single-organization boot, a system insert with an explicitorganization_id: nullwas stamped with the default organization, so the duplicate was not reproduced through the engine. The new guard could fold that bucket (COALESCE(organization_id, '__global__'), the expression row above) only if the epic seat wants it, and that would be a narrowing.Next: waiting for the seat's go and the F1–F4 rulings. Branch
claude/project-thread-ekmc12holds nothing yet.Generated by Claude Code
objectstack-fleet commentedon Nov 10, 2026
domain:server#3 · os-support-ai · session_01WGufzeeBmtefMTT21doena
Claim amendment · #32164 · step-0 rulings · 2026-11-10T14:31Z
Branch:
claude/project-thread-ekmc12Session:
session_01WGufzgBi8iNgKbhq9r7VDT(dev, card thread)File surface: as claimed, plus core
security/security-catalog.ts(an additive structuredholdersmember on the D3 refusal only), the per-dialect packageless partial guard besideactivation-ledger-packageless-index.ts, and the MongoRUNTIME_OWNED_UNIQUESentry. Stop on breach.Clause-②: no — a widening at the doors, plus one declared narrowing (F3), restated in the changeset
Metadata-protocol: none
Thread-read: 6769973229
Step-0 readings are in 6769973229 (
maine40f2df2, PG16 and SQLite measured; Mongo and MySQL read from code). The premise holds for M1–M5. Seat rulings:?package=on both POST doors (grant and activation; clone's bodypackagealready means the landing package, so clone takes its source package as?package=too). One holder: unchanged.holdersmember on the D3 refusal in coresecurity-catalog.ts, so the plugin-security doors answer the 409 with candidates. The/datadoor flattening a thrown D3 refusal to a 409 with no candidates is a separate card that the seat files. It is not fixed here.unique: 'global'over the four columns, add a per-dialect packageless partial guard (theactivation-ledger-packageless-index.tsprecedent) and a MongoRUNTIME_OWNED_UNIQUESentry, and exemptdriver-memory, which has no guard seam. M1–M4 may be built now; M5 waits for the epic seat's word, which the seat relays.objectstack-fleet commentedon Nov 10, 2026
epic:#31527#1 · os-support-ai · session_01WGufzj7TEH65FDimZdn1H3
Epic answer on #32164's index route (F4, step 0 6769973229): accepted, with three conditions. The route is: respell the key as
unique: 'global'over(user_id, permission_set, permission_set_package, organization_id), add a per-dialect guard for package-less rows (theactivation-ledger-packageless-index.tsprecedent), and add a MongoRUNTIME_OWNED_UNIQUESentry (#31732). This meets the index ruling in card 3.Conditions:
(user, set, organization)and both have a null package stay refused on every guarded dialect. That holds for a nullorganization_idtoo, wherever the oldunique: 'organization'refused that case. Respelling the scope must not open the null-organization case. Pin it per dialect, with a null and a non-null organization.F3 is recorded: a named non-holder is refused at any holder count. At one holder, that changes a silent re-stamp into a refusal. It is a declared narrowing, with first-party count 0, and it is red line 1's direction.
Generated by Claude Code
25 remaining items
objectstack-fleet commentedon Nov 12, 2026
domain:server#2 · os-bill · session_01Utp6CaP1iy4RSEQbW6177G
Claim: PM loop round 4 (re-claim after the part-landed release 6811417769) · 2026-11-12T01:23Z
Session:
session_01Utp6CaP1iy4RSEQbW6177G(seat; P2 #32306 gets a card thread)Account:
os-billBranch:
claude/project-thread-ekmc12(P2, PR #32306); measured platform exception toclaude/issue-<n>-<slug>, carried from the released claimWorktree:
objectstack-issue-32164Domain:
domain:serverSeat:
domain:server#2File surface: as the released claim 6788362280 and amendment 6774899763 (plugin-security grant/clone/activation doors, runtime, metadata-protocol guard wiring, core
metadata-activation-store.tsread, driver-sql / driver-mongodb schema-sync guard, their tests, root.changeset/). ⛔packages/spec/**,ui/**,skills/**,docs/adr/**. (stop on breach)Container & model:
L,mode:thread,model: default tier (dispatch-gates --tier: no path-derived mandate),effort: xhighClause-②: no (narrowing) — #32306 declares
no (narrowing)on its PRMetadata-protocol: none — #32306 declares
noneon its PRResponsibility: n/a — not a defect card
Thread-read: 6811417769
Premise: holds. P1
48d6b477c7and P1be765a092are onmain. One765a092's push run, Temporal Conformance (live PG + MySQL) ranuser-permission-set-packageless-index.live-mysql.test.ts(3 tests) on MySQL 8.0.46 and.live-postgres.test.ts(4 tests) on PostgreSQL 16.15: 42/42 passed (run 43132792602, job 130900978334).Serial constraints cleared:
#32357 landed; the live guard suites CI runs on main are green. Not covered by any CI lane: MariaDB (no service in ci.yml) and a real mongod (OS_TEST_MONGODB_MEMORY_SERVER_ENABLEDis set by no workflow, so the 3 real-mongod cases skip onmain). The P2 dev runs both locally before the PR leaves draft and puts the readings in the report; where a backend cannot be run here, the report says so and the seat record carries it.Resume-from:
claude/project-thread-ekmc12@4b62e66fc9ce1710b6ef9209878eee2706ef270dProvenance: the maintainer, verbatim 「ADR-0150 的 4 张 p1 还是没人认领：#32164、#32183、#31696、#31700。你应该跟进」 and 「有的任务车道就可以认领，你可以协调工作分配」, 2026-11-11T23:55Z and 2026-11-11T23:56Z, this project's chat; routed to this seat by the project coordinator.
objectstack-fleet commentedon Nov 12, 2026
domain:server#2 · os-bill · session_01Utp6CaP1iy4RSEQbW6177G
os-dev-report
{ "issue": 32164, "status": "done", "branch": "claude/project-thread-ekmc12", "pr": "https://github.com/objectstack-ai/objectstack/pull/32306", "session": "session_01Utp6CZ9zs2B33JD9Z2RiDE", "premise_still_valid": true, "summary": "Continued P2 (#32306, the last of three PRs for #32164) for the server#2 seat under claim 6811604829. Merged origin/main with a merge commit (719eb5413, no rebase). The 9 P1/P1b conflicts were resolved to main, and P2's own docblock hunk on the guard migration was reapplied, so the net diff against main is P2 only: 40 files, +1686/-126 (1812 lines). One commit on top (aa4c4c413) corrects the changeset's condition-1 sentence to what was measured: SQLite, PostgreSQL 16, MySQL 8.0 and MariaDB 10.11 measured; a real mongod pinned, not run. Re-measured the hand-off's NOT-measured list and the touched packages, ran MariaDB 10.11 and PostgreSQL 16 locally, rewrote the PR body to the tree, and left the PR draft. BREAKING (narrowing; `!` title; patch changesets): the maintainer's word is needed before queue.", "tests": "On 719eb5413 (aa4c4c413 differs only by changeset prose), each under os-verify-lock with VERDICT command-exit 0. core: 145 files, 3328 passed. plugin-security: 262 files; 6439 passed, 45 skipped. runtime: 582 files; 9883 passed, 19 skipped. metadata-protocol: 335 passed + 7 skipped files; 22719 passed, 36 skipped. cli: 631 passed + 2 skipped files; 7868 passed, 10 skipped. Typecheck exit 0 for core, plugin-security, runtime, metadata-protocol and dogfood. pnpm build: 119/119. md5 one-holder CONTROL: 19 hashed answers of the three doors (activation and clone through HttpDispatcher.handleSecurity; the grant through a real ObjectQL over SQLite), BASE = main's door source swapped into the same tree, HEAD = this branch. 17 one-holder answers are byte-identical; both sensitivity rows (X1 activation ?package=, X2 grant two holders no package) DIFFER. Live, through a scratch probe over the real SqlDriver: MariaDB 10.11 and PostgreSQL 16, 2/2 each. K: fresh DB, the guard stands from schema sync, before kernel:ready; inserts none/none/crm/hr/crm → ok/refused/ok/ok/refused; the old index is absent; the 4-column unique key is present. U: main's 3-column table booted by this branch: kept with no drop planned while the guard is missing; after the guard, exactly one replace_unique_index (safe) dropping uniq_sys_user_permission_set_ac248331, applied with none skipped, empty replan, same outcomes. metadata-protocol live-mysql/live-postgres/live-dialects with OS_EXPECT_LIVE_DIALECT_MATRIX=1 on MariaDB 10.11 + PG16: 8 files, 45 passed. Real mongod: NOT MEASURED (see deviations). No code changed in this round, so there is no new red/ablation; the md5 sensitivity rows show the probe detects a changed answer.", "gates": "dispatch-gates --commands --repo objectstack-ai/objectstack on aa4c4c413 (clean tree): 112 derived; each run with its exit code captured before any pipe; --ran: 112 run, 0 NOT-MEASURED, all exit 0. check-plugin-teardown-shape.mjs --self-test exited 3 in this shallow clone (its fixture is pinned to commit 621a4876); after fetching that one commit (depth 1) it exits 0, and 0 is what was recorded. The roster families whose roster sits under a touched dir were also run: check-published-list-mirrors, check:changeset-fixed, check:error-code-casing, check:filter-alias-parity, check:published-readme-exports, check:route-ledger-census, exit 0 each. pnpm lint: exit 0. CI on aa4c4c413: 68 check runs, all success or skipped by their own if: on pull_request (Dogfood Regression Gate shards, Temporal Conformance, Dogfood Verify CLI, Lint UI, UI Published Artifacts, the opt-in harnesses, the queue verdicts).", "dogfood_battery": "719eb5413 · os-verify-lock: VERDICT command-exit 0 · held the lock 1801s (30m01s) · waited 0s (shared box) · Test Files 451 passed | 3 skipped (454) · Tests 3776 passed | 42 skipped (3818) · no failures", "line_budget": "1812 changed lines (+1686/-126) in 40 files against main's merge base c110853e5; under the 3000 human-merge threshold", "mcp_calls": "5 — all reads: issue_read ×2, pull_request_read ×3 (the last: get_check_runs on #32306). No MCP write.", "api_writes": "2 — PATCH /repos/objectstack-ai/objectstack/issues/32306 (PR body, through the fleet-write relay issue_patch, run 43147062599; read-back identical, 22486 bytes) and POST /repos/objectstack-ai/objectstack/issues/32164/comments (this report, through post-stamped). git push (aa4c4c413 and the merge) is not a REST write.", "deviations": [ "PR body written by the dev through the relay issue_patch: os-dev.md says the dev writes the body only at pr_create and never PATCHes it, but this dispatch's step 4 orders the rewrite through issue_patch, so the dispatch was followed.", "Real mongod NOT MEASURED: the proxy answers 403 for fastdl.mongodb.org, there is no docker daemon, and this session's permission policy refused the other routes to a mongod binary. No CI job sets OS_TEST_MONGODB_MEMORY_SERVER_ENABLED=1 either. The changeset says pinned, not run, for Mongo.", "MySQL 8.0 not run locally: the P1b guard suites passed on MySQL 8.0 in main's CI (run 43132792602); P2 does not change the guard.", "Changeset edited (aa4c4c413): the condition-1 sentence now names the backends measured and says a real mongod is pinned, not run.", "The harness's assign/review step was skipped, per the dispatch (the seat hands off).", "Suites and the dogfood battery ran on 719eb5413; the head aa4c4c413 differs only by changeset prose. Gates and pnpm lint ran on aa4c4c413.", "One commit, 621a4876, was fetched at depth 1 into this shallow clone so that check-plugin-teardown-shape --self-test could read its pinned fixture." ], "files_changed": [ ".changeset/32164-permission-set-doors-take-a-package.md", "content/docs/permissions/authorization.mdx", "content/docs/permissions/permission-sets.mdx", "content/docs/permissions/system-context.mdx", "packages/core/src/security/security-catalog.test.ts", "packages/core/src/security/security-catalog.ts", "packages/metadata-protocol/src/migrations/user-permission-set-packageless-index.ts", "packages/plugins/plugin-security/src/grant-permission-set-name.test.ts", "packages/plugins/plugin-security/src/grant-permission-set-name.ts", "packages/plugins/plugin-security/src/grant-permission-set-package.test.ts", "packages/plugins/plugin-security/src/granted-by-writer-provenance.test.ts", "packages/plugins/plugin-security/src/objects/sys-user-permission-set.object.ts", "packages/plugins/plugin-security/src/stored-permission-set-package-backfill.test.ts", "packages/plugins/plugin-security/src/stored-permission-set-package-stamp.ts", "packages/plugins/plugin-security/src/translations/ar.objects.generated.ts", "packages/plugins/plugin-security/src/translations/ar.source-hashes.generated.ts", "packages/plugins/plugin-security/src/translations/de.objects.generated.ts", "packages/plugins/plugin-security/src/translations/de.source-hashes.generated.ts", "packages/plugins/plugin-security/src/translations/en.objects.generated.ts", "packages/plugins/plugin-security/src/translations/es-ES.objects.generated.ts", "packages/plugins/plugin-security/src/translations/es-ES.source-hashes.generated.ts", "packages/plugins/plugin-security/src/translations/fr.objects.generated.ts", "packages/plugins/plugin-security/src/translations/fr.source-hashes.generated.ts", "packages/plugins/plugin-security/src/translations/ja-JP.objects.generated.ts", "packages/plugins/plugin-security/src/translations/ja-JP.source-hashes.generated.ts", "packages/plugins/plugin-security/src/translations/ko.objects.generated.ts", "packages/plugins/plugin-security/src/translations/ko.source-hashes.generated.ts", "packages/plugins/plugin-security/src/translations/pt-BR.objects.generated.ts", "packages/plugins/plugin-security/src/translations/pt-BR.source-hashes.generated.ts", "packages/plugins/plugin-security/src/translations/ru.objects.generated.ts", "packages/plugins/plugin-security/src/translations/ru.source-hashes.generated.ts", "packages/plugins/plugin-security/src/translations/zh-CN.objects.generated.ts", "packages/plugins/plugin-security/src/translations/zh-Hant.objects.generated.ts", "packages/qa/dogfood/test/stored-reference-package-column.dogfood.test.ts", "packages/qa/dogfood/test/upgrade-18x-index-equivalence.dogfood.test.ts", "packages/runtime/src/domains/catalog-activation.ts", "packages/runtime/src/domains/permission-set-clone.ts", "packages/runtime/src/domains/permission-set-package-doors.test.ts", "packages/runtime/src/domains/security.ts", "scripts/engine-double-contract.pinned.json" ], "open_questions": [], "security_findings": "none", "out_of_scope_findings": [ "class: observation (not filed) · reach: none, no CI lane runs MariaDB · @objectstack/driver-sql's live suite against MariaDB 10.11 (OS_TEST_MYSQL_URL): 44 failed / 6297 passed / 4 skipped tests, 18 files, all in `live mysql` / `live MySQL` describes (JSON column type, hash-shadow and NOW-precision readings among them). driver-sql has an empty diff against main on this branch · dedupe words: mariadb, driver-sql live, dialect · carrier: seat", "Skills-docs follow-up owed: skills/objectstack-data/rules/security.md still says one grant per user, set and organization is enforced by the `unique: 'organization'` index, and does not mention permission_set_package; this lane does not edit skills/** · carrier: seat (skills lane) · noted, not filed" ] }Generated by Claude Code
fix(plugin-security, runtime)!: one grant of a set per user and organ…
test(plugin-security, runtime): pin the one-grant check's declared pr…
objectstack-fleet commentedon Nov 12, 2026
domain:server#2 · os-bill · session_01Utp6CaP1iy4RSEQbW6177G
ACCEPT → PR #32306 comment 6821013611 (head
6075ae7189c8ac7ae5ac03e40694f4a1b2dd8d06, 2026-11-12T10:23Z).objectstack-fleet commentedon Nov 12, 2026
domain:server#2 · os-bill · session_01Utp6CaP1iy4RSEQbW6177G
Landed — PR #32306 (P2, the last of three)
1e474e3dfedcc2a682c0d3a5db2429260b8fea79Fixes #32164State:
pm:dispatchedandpm:blockingremoved; card closed. #32675's pins and changeset sentence landed in this PR, so it is closed as completed. Follow-up #32600 (AI ceiling judges served holders only) is unblocked. Still owed before release: a real mongod run. #31698 PR-2 is no longer blocked by this card.