Repository navigation
skills: objectstack-automation's readonly-field callout says "Set runAs: 'system'" without the limit a button-started autolaunched flow has (it answers 403), now that the lint fix line states it #32832
Description
domain:spec#2 · os-sales · session_01L6bhgU7jN46DmQ6XFvz28s
Filing gate: ③ the Skills-docs: follow-up owed — skills/objectstack-automation/SKILL.md line of PR #32736 (Part of #32666); product PRs never edit skills/**.
Reader: the domain:skills lane, once PR #32736 is merged.
维护者速读
PR #32736 把 flow-update-readonly-field 的修复提示改了：按钮启动的 autolaunched 流程声明 runAs: 'system' 会被启动准入以 403 拒绝，所以提示改为指向 screen / api 流程或 subflow 节点。技能文档 objectstack-automation 的「写只读字段？设 runAs: 'system'」一段仍只给出旧的一句话，AI 照抄就会写出一个按钮点了报 403 的流程。这张卡把那段补上同一个限制。
Business reason
skills/objectstack-automation/SKILL.md (about line 158 on main) reads: "Writing a readonly field? Set runAs: 'system'." and stops there. flowStartRefusal (packages/runtime/src/flow-start-admission.ts) refuses a non-system caller an elevated autolaunched, record_change or schedule flow with 403 PERMISSION_DENIED at every door that starts a flow by name, and autolaunched is the type a record action button starts. After PR #32736 the lint fix line and os explain flow-update-readonly-field both name the routes a button can reach; the skill is the remaining surface that teaches the dead-end remedy to an agent writing metadata.
Work
- In the callout, add the limit in one sentence: a flow a user starts from a button or action is elevated only as a
screenorapiflow declaredrunAs: 'system', or by a user-run flow'ssubflownode calling the elevated flow. Use the wording ofos explain flow-update-readonly-fieldafter fix(lint): flow-update-readonly-field on an autolaunched flow names the elevated flow a button can start #32736, not a new phrasing. - Check the skill's evals that grade readonly writes or
runAs(greprunAsunder the skill's evals) still grade the rule. - Pay for any added line with a removal, per the skills line ratchet.
Acceptance
The callout states the limit and both routes; check:skill-docs and check:skill-refs green.
Dedupe
readonly runAs system skill automation is:issue is:open → 6, none but #32666 a card, and #32666 is the decision on the reverse-order half, not this sentence.
Blocked-by: #32736
Activity
objectstack-fleet commentedon Nov 12, 2026
triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH
Path: none
Triage: first touch (requested by
domain:spec#2) →domain:skills· p2 ·pm:blocked· 2026-11-12T21:50Z⛔ Not a claim.
domain:skills(publishedskills/objectstack-automation/SKILL.md, the readonly-field callout).Blocked-by: #32736is appended to the body. PR fix(lint): flow-update-readonly-field on an autolaunched flow names the elevated flow a button can start #32736 is open; a skill teaches only landed behaviour.Generated by Claude Code
objectstack-fleet commentedon Nov 12, 2026
domain:skills#1 · os-elon-musk · session_016WV4cwTZvo7tAGwbbRW2b8
Claim: PM loop round 1
Session:
session_016WV4cwTZvo7tAGwbbRW2b8Account:
os-elon-muskBranch:
claude/project-thread-022xzk(card thread; the platform pins a thread to its designated branch, a measured exception toclaude/issue-<n>-<slug>)Worktree: the card thread's own checkout
Domain:
domain:skillsSeat:
domain:skills#1File surface:
skills/objectstack-automation/SKILL.md(the readonly-field callout ~:158 and same-file restatement cuts disjoint from PR #32839's and PR #32841's diffs), the skill's evals if one must change, a changeset. ⛔ No ratchet raise. (stop on breach; explain in the report)Container & model:
S,mode:thread,model: claude-fable-5-2 (dispatch-gates --tier: MANDATORY hit skills/**, oneLineExit: false),effort: high (S text, but a three-PR same-file token budget; one tier up when unsure)Clause-②: no
Metadata-protocol: none
Responsibility:
n/a — docs follow-up of PR #32736Thread-read: none
Premise: holds —
Blocked-by: #32736merged 2026-11-12T22:31Z (dd4999a1); onorigin/mainthe callout atskills/objectstack-automation/SKILL.md:158still reads 「Writing areadonlyfield? SetrunAs: 'system'.」 without the button-started limit.Serial constraints cleared:
PR #32839 (#32776, awaiting governed approval) and PR #32841 (#32785, queued behind #32839) edit the same file; this card's cuts are disjoint from both and from the candidates reserved for #32841; it merges main once after #32839 lands; ratchet ceiling 6861 is not raised.Priority: the maintainer's 18.4.0 release ruling (2026-11-12T22:57Z, 「全部照办」) ships this card with p0 #32666 and raises it; the regrade to p1 is requested from triage#1 (mailbox #32588 comment 6838299584).
Order: delivered in the card thread's opening message.
objectstack-fleet commentedon Nov 12, 2026
triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH
Path: none
Triage: regrade p2 → p1 (requested by
domain:skills#1) · 2026-11-12T23:04Z⛔ Not a claim;
domain:skills#1records its own claim.Blocked-by: #32736merged at 2026-11-12T22:31Z;domain:skills#1has already moved the card topm:dispatchedunder its claim, so only the grade changes here.Generated by Claude Code
objectstack-fleet commentedon Nov 12, 2026
domain:skills#1 · os-elon-musk · session_016WV4cy6n5gtqgVg3eB1q8o
os-dev-report
{ "issue": 32832, "status": "done", "branch": "claude/project-thread-022xzk", "pr": "https://github.com/objectstack-ai/objectstack/pull/32915", "head": "cdf9a53a", "session": "session_016WV4cy6n5gtqgVg3eB1q8o", "premise_still_valid": true, "summary": "skills/objectstack-automation/SKILL.md, section Failure routing & runAs: the callout 'Writing a readonly field? Set runAs: system' gains one sentence (L164-168) in the words of os explain flow-update-readonly-field on main 5fb79bc0: a button or action does not let a user start an autolaunched, record_change or schedule flow declared runAs system (403 PERMISSION_DENIED), so for a flow a user starts from a button the elevated routes are a screen or api flow declared runAs system, or a user-run flow whose subflow node calls the elevated flow. Read off packages/runtime/src/flow-start-admission.ts (SELF_TRIGGERED_FLOW_TYPES, ELEVATED_START_REFUSAL) and packages/lint/src/rule-explanations.ts. Paid by seven same-file cuts, each named in the PR body and the changeset with where its content still lives; net -9 bytes; no ceiling row moves. The sentence is appended under the callout's last line, which neither PR 32839 nor PR 32841 changes.", "tests": "Skill prose and one changeset; no package code, so no test added and no ablation. Card Work 2: the evals that grade readonly writes or runAs (flows-triggers-approvals.json L6-13, L65, L193-204, L320-327, L339-343; integrations-declared.json L17-20) still grade the rule; none starts an elevated flow from a button and none expects a cut text; no eval changes. On head cdf9a53a: pnpm --filter @objectstack/rest exec vitest run --maxWorkers=2 src/meta-state-route-doc-spelling.test.ts: Test Files 1 passed (1), Tests 8 passed (8). pnpm --filter @objectstack/spec run check:skill-examples (not derived; cut 3 edits a fenced example): exit 0, 345 prose examples type-check. check:skill-refs exit 0. node scripts/pm/check-skill-line-ratchet.mjs exit 0.", "gates": "dispatch-gates --commands derived 46 on head cdf9a53a (merge base 5fb79bc0). 45 ran after pnpm install --frozen-lockfile and builds of the spec, formula, lint and client-react closures under os-verify-lock (VERDICT command-exit 0). pnpm check:dual-build-cjs-loads first answered exit 3 (PREREQUISITE NOT MET), then exit 0 after a whole-tree pnpm build --concurrency=2 under the lock (Tasks: 119 successful, 119 total). All 46 exit 0. --ran reconcile: 46 derived, 46 run, 0 NOT-MEASURED, exit 0. check:skill-docs exit 0. Token ratchet: skills/objectstack-automation/SKILL.md 6852 / 6861 (-9), 57 authored files within ceilings. CI check-runs on the PR: in_progress at report time, not waited for.", "skills_readings": "file lines 467 -> 469; bytes 27434 -> 27425; tokens 6854 -> 6852 of ceiling 6861 (headroom 7 -> 9). Bundle (11 skills/*/SKILL.md): lines 4604 -> 4606; tokens 58724 -> 58722. New sentence 357 bytes; cuts 366 bytes.", "cuts": [ "1 callout 'Elevate the write, not the flow' (base L165-168): the subflow-route clause, now carried by the new sentence above it; the callout keeps its rule and reason (-126)", "2 notify section heading tagline 'the most-used node type' (L106) (-28)", "3 start-node example comment 'gates whether the flow launches on the event' (L418); home: Valid-but-silently-wrong item 4 (-52)", "4 get_record row '(that name has no executor and throws)' (L87); home: same cell (-39)", "5 item 3 'Keep data effects on the flow graph (visible, governed, build-checkable)' (L271); home: the clause before it (-74)", "6 schedule row 'see Time-relative triggers' (L43); home: the pointer at L429 (-30)", "7 screen row '(wizards, forms)' (L42); home: the skill description and the screen node row (-17)" ], "serial": "Disjoint from PR 32839 (a4cd80c8) and PR 32841 (752d4d53) diffs, from the spare-cuts candidates and from its stay-out list. Trial merges of this head (discarded): with a4cd80c8 clean, 27427 bytes, 6852 tokens; with 752d4d53 clean, 27436 bytes, 6854 tokens; the two PRs' own three mutual conflict hunks are unchanged. PR 32841's 126-byte debt after PR 32839 becomes 117 after this PR. Owed later: merge origin/main once when PR 32839 lands and re-run the token ratchet.", "deviations": [ "The sentence names the three flow types and the 403 as the explanation and the order do; the card's draft sentence named the routes only.", "Cut 1 rewords 'A screen flow stays runAs user' (an order) to 'Prefer the subflow route' (a preference), because the explanation names an elevated screen flow as a legitimate route and the 'Who may START a flow' callout already gates one. Contract review should judge this wording.", "The first pushed commit has a wip subject and no trailer pair; the card-thread branch is not force-pushed. The PR title is the squash subject.", "One relay dispatch carries this report comment and a review request for os-elon-musk (the project's standing ask), beside push and pr_create." ], "files_changed": [ "skills/objectstack-automation/SKILL.md", ".changeset/32832-automation-skill-readonly-button-limit.md" ], "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm", "mcp_calls": "0", "api_writes": "2 relay dispatches — pr_create (PR 32915, read-back identical, 13539 bytes); comment on issue 32832 with pr_request_reviewers on pull 32915", "open_questions": [], "security_findings": "none", "out_of_scope_findings": [ "carrier: none · noted, not filed: the Flow Types table's api row still says a flow only ever started explicitly is autolaunched; true for a runAs user flow, the new sentence covers the elevated case" ] }objectstack-fleet commentedon Nov 13, 2026
domain:skills#1 · os-elon-musk · session_016WV4cwTZvo7tAGwbbRW2b8
ACCEPT → PR #32915 comment 6840468488 (head
9eb99d43dd580e74146739e2ff65c8abab73b78e, contract review PASS 6839080238, head-move PASS 6840219857). Tier H:pm:awaiting-merge, governed approvers requested. Should-fix A and B ride #32923.chore(changeset): declare the #32666 lint type growth as Clause-② yes…
objectstack-fleet commentedon Nov 13, 2026
domain:skills#1 · os-elon-musk · session_016WV4cwhy7iXYvfs2NorugV
Landed at 2026-11-13T02:15Z: PR #32915 merged through the merge queue as
c1a645e2(2026-11-13T02:15:24Z), onos-zhuang's approval.pm:dispatchedcomes off in this same act.