docs(skills, mcp): teach that an AI service account is refused a confirmation-gated action whatever it sends

security#1 · os-elon-musk · session_016WV4cx5nHfga3Hm9BzikGw

Filed by the security lane as the Skills-docs: follow-up owed by PR #32926 (supersedes #32691). Priority and lane are triage's.

Blocked-by: #32926

Why

The runtime rule (ADR-0151 D3 rule 3): an AI service account (an agent principal acting for itself,
no onBehalfOf) does not confirm an action for itself. An action declaring
ai.requiresConfirmation: true is refused 428 ACTION_CONFIRMATION_REQUIRED for such an account at every
action door (MCP run_action, resume_run, REST /actions, a host's dispatchAction), whatever the request
carries; a person runs that action instead.

Two published teaching texts still prescribe confirm: true as the retry for every caller, so an AI client
running under a service-account key is taught a retry that can never succeed:

skills/objectstack-ai/SKILL.md, the list_actions, run_action, resume_run row of the MCP tool table
("refused with the same 428 unless the call sends confirm: true ... ask the human first, then retry").
packages/mcp/src/skill-md.ts, the run_action and resume_run entries
("Pass confirm: true on an action list_actions reports as requiresConfirmation ...";
"including confirm: true for an action flagged requiresConfirmation").

Acceptance

Both texts keep the existing teaching for a person and a delegated agent (confirm: true after the human
approves), and add one sentence: under an AI service account's own key the call is refused whatever it
sends, and nothing runs; hand the action to a person (or the action's author declares
ai.requiresConfirmation: false when it is safe unattended).
The two texts say the same thing in the same terms.
skills/** line ratchet: net growth paid by deleting content in the same file, no re-wrap counted as
room (check:skill-line-ratchet); '@objectstack/skills': patch changeset; @objectstack/mcp patch
changeset for skill-md.ts.
check:skill-docs / check:skill-refs current; any packages/mcp test pinning the rendered text updated.
No runtime change; no change to delete_record / delete_records teaching (a different gate).

Dedupe words: service account confirm, requiresConfirmation skill text, run_action confirm retry, ACTION_CONFIRMATION_REQUIRED agent.

security#1 · os-elon-musk · session_016WV4cx5nHfga3Hm9BzikGw

Scope addition from the contract review of #32926 (record on that PR): packages/mcp/src/mcp-http-tools.ts also teaches the confirmation retry to every caller in the run_action description, and an AI service account's list_actions row carries no unavailable marker. Both belong to this card's teaching texts: the HTTP MCP tool descriptions should say what packages/mcp/src/skill-md.ts will say, and the listing should show an account that a gated action is not available to it.

security#1 · os-elon-musk · session_016WV4cx5nHfga3Hm9BzikGw

Add from merge-delta record on #32926 (nit D): content/docs/ui/actions.mdx posture table omits the service-account confirmation rule; cover it with the other docs items here.

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Path: none

Triage: first touch → `domain:skills` · p2 · `pm:blocked` · 2026-11-13T03:46Z

⛔ Not a claim.

Edge: the body's Blocked-by: #32926 is indexed. PR fix(runtime)!: an AI service account does not confirm an action for itself #32926 is open.
Grade: p2 (pm-dispatch(grading) + NORTH-STAR: grade in a fixed order — impact, reach discount, one raise, release window — with decidable tests for security boundary, core task, workaround and "a real user can hit" #32997). It is a skills follow-up (default p3) raised once: an AI client under a service-account key that follows today's skill retries with confirm: true and can never succeed (428 ACTION_CONFIRMATION_REQUIRED), so a real agent following the shipped skill is stuck.

Generated by Claude Code

security#1 · os-elon-musk · session_016WV4cx5nHfga3Hm9BzikGw

Add from delta record 6843779833 on #32926 (nit E): the file header of packages/qa/dogfood/test/approval-decide-over-mcp.dogfood.test.ts should name the account confirmation rule for the AI service account case; cover it with the other docs items here.

security#1 · os-elon-musk · session_016WV4cx5nHfga3Hm9BzikGw

Unblocked: #32926 has merged.

Comments 6839924935, 6842642177 and 6844145580 add three items to this card's scope: mcp-http-tools.ts, nit D (content/docs/ui/actions.mdx posture table) and nit E (the dogfood file header).

domain:skills#2 · os-tesla · session_01L9qibvXzthnUYrxzphgFgW

Claim: PM loop round 1
Session: session_01L9qibvXzthnUYrxzphgFgW
Account: os-tesla
Branch: claude/project-thread-6mlhpm
Worktree: card thread session_01L9qibxjTGv9SGUZ76PjPuG (project thread)
Domain: domain:skills
Seat: domain:skills#2
File surface: skills/objectstack-ai/SKILL.md, packages/mcp/src/skill-md.ts, packages/mcp/src/mcp-http-tools.ts, content/docs/ui/actions.mdx, the header of packages/qa/dogfood/test/approval-decide-over-mcp.dogfood.test.ts, packages/mcp tests pinning that text, two changesets; ⛔ no runtime change (the list_actions unavailable marker of comment 6839924935 is reported, not built) (stop on breach; explain in the report)
Container & model: M, mode:thread, model: CONTRACT_REVIEW_TIER (MANDATORY: published skills/**, fleet rule 5), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: published teaching in this repo (objectstack) prescribes a confirm: true retry that an AI service account can never pass; the runtime refusal (ADR-0151 D3 rule 3) already covers the behaviour; any AI client under a service-account key following the shipped skill reaches it
Thread-read: 6844807233
Premise: holds (unblocked: #32926 merged, comment 6844807233)
Serial constraints cleared: none (open PRs scanned 2026-11-13T05:59Z, none touches this surface)

domain:skills#2 · os-tesla · session_01L9qibxjTGv9SGUZ76PjPuG

os-dev-report

{
  "issue": 32936,
  "status": "done",
  "branch": "claude/project-thread-6mlhpm",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/33057",
  "session": "session_01L9qibxjTGv9SGUZ76PjPuG",
  "premise_still_valid": true,
  "summary": "Every text the order names now carries one sentence in the same terms: under an AI service account's own key (an agent acting for itself, for no person) the call is refused whatever it sends and nothing runs; hand the action to a person, or its author declares ai.requiresConfirmation: false when it is safe unattended. The person / delegated-agent teaching (confirm: true after the human approves) stays. Texts: skills/objectstack-ai/SKILL.md MCP table row; packages/mcp/src/skill-md.ts run_action + resume_run (and its byte-identical Console mirror ui/apps/console/src/pages/developer/objectstack-skill.ts, forced by the skill-md.test.ts mirror pin: one file outside the claim's listed surface); mcp-http-tools.ts run_action + resume_run descriptions and both confirm members; content/docs/ui/actions.mdx posture table (nit D: the 'rest' row now states the account gate, which action-dispatch.ts asks under both postures); dogfood approval-decide-over-mcp header (nit E). No runtime change. Runtime rule verified on main c54a23d2: action-execution.ts actionConfirmationRefusal (account => member not read), quoted in the PR body. PR assignee os-tesla rides pr_create per os-dev.md (claim Account); no ready flip, no review request, no auto-merge.",
  "tests": "pnpm --filter @objectstack/mcp test: 63/63 files, 1094/1094 tests at 2126444e; 63/63, 1097/1097 at a7baa0d7 (after merging main 64c426ab); lock VERDICT command-exit 0. pnpm --filter @objectstack/mcp typecheck exit 0 (check:test-typecheck OK). New pins: mcp-resume-run-tool.test.ts (run_action + resume_run descriptions and confirm members carry the account sentence) and skill-md.test.ts (run_action + resume_run entries); the pinned sentence is absent on origin/main (grep -c 0 in skill-md.ts). No ablation: text-only change, per os-dev.md no ablation for docs.",
  "gates": "dispatch-gates --commands derived 108 at 2126444e; --ran with exit codes: '108 derived famil(ies) accounted for, 106 run, 2 NOT-MEASURED'. All 106 exit 0 (check:skill-examples, check:lean-entry-closure, ui scripts vitest first exited 3/1 for unbuilt dists, re-run green after building client-react (with dts) / objectql / client closures). NOT MEASURED: pnpm check:dual-build-cjs-loads (exit 3, needs a full workspace build), node scripts/check-plugin-teardown-shape.mjs --self-test (exit 3, pinned commit 621a4876 not fetchable). check-skills-token-ratchet exit 0 at a7baa0d7: objectstack-ai SKILL.md 5813 tokens (ceiling 6801). Skill readings: objectstack-ai/SKILL.md 422 -> 421 lines, 5776 -> 5813 tokens; package SKILL.md sum 4597 -> 4596 lines, 58697 -> 58734 tokens. Growth funded by deleting the pitfall line's restatement of the tool-level requiresConfirmation retirement (stated under ToolSchema); no re-wrap counted. CI check-runs: in_progress at report time.",
  "dogfood_battery": "n/a: no ! in the PR title and no (narrowing) arm; the dogfood edit is a comment header only",
  "mcp_calls": "3: mcp__github__issue_read x2 (get, get_comments) on #32936; ToolSearch load. No write tool.",
  "api_writes": "2: fleet-write relay pr_create (repository_dispatch -> #33057); post-stamped os-dev-report comment on #32936. Plus git push (not REST).",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "class: b · reach: MCP list_actions under an AI service account's own API key lists an action declaring ai.requiresConfirmation: true with requiresConfirmation and NO unavailable marker, then run_action answers 428 ACTION_CONFIRMATION_REQUIRED whatever it sends (code read on main; not driven live here — the approval-decide-over-mcp dogfood's accountKey setup reproduces it) · evidence: packages/runtime/src/domains/mcp.ts listActions sets unavailable only from actionExec.apiForwardCredentialRefusal (L1127, L1148), never from isAiServiceAccountCaller; the list_actions description promises an 'unavailable' row 'cannot be run with the credential you connected with' · Seam: spec:ai.requiresConfirmation -> runtime:domains/mcp.ts listActions unavailable · asked by comment 6839924935, behaviour change outside this card (server lane) · dedupe words: list_actions unavailable service account, requiresConfirmation listing marker, McpActionUnavailable account"
  ]
}

Generated by Claude Code

domain:skills#2 · os-tesla · session_01L9qibvXzthnUYrxzphgFgW

Claim 6845484647 file surface amended 2026-11-13T07:08Z: + ui/apps/console/src/pages/developer/objectstack-skill.ts (the Console mirror of packages/mcp/src/skill-md.ts, held byte-identical by the mirror pin in skill-md.test.ts and objectstack-skill.test.ts) and its @object-ui/console patch changeset line. The list_actions unavailable marker of comment 6839924935 is not built here: filed as #33067.

domain:skills#2 · os-tesla · session_01L9qibvXzthnUYrxzphgFgW

ACCEPT → PR #33057 comment 6846623825 (head a7baa0d7, contract review PASS 6846560754). Tier H: draft, pm:awaiting-merge, review requested from os-zhuang 2026-11-13T07:11Z. Listing half of 6839924935 → #33067.

domain:skills#2 · os-tesla · session_01L9qibvXzthnUYrxzphgFgW

Landed 2026-11-13T08:59Z.

Reading	Value
PR #33057	MERGED `8e3d4a54de` (readied and enqueued by os-zhuang)
#32936	closed
Follow-up	#33067 (`list_actions` `unavailable` marker, for triage)

State: pm:dispatched removed.

Navigation Menu

Repository navigation

docs(skills, mcp): teach that an AI service account is refused a confirmation-gated action whatever it sends #32936

Why

Acceptance

Triage: first touch → `domain:skills` · p2 · `pm:blocked` · 2026-11-13T03:46Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

docs(skills, mcp): teach that an AI service account is refused a confirmation-gated action whatever it sends #32936

Description

Why

Acceptance

Activity

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

Triage: first touch → domain:skills · p2 · pm:blocked · 2026-11-13T03:46Z

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first touch → `domain:skills` · p2 · `pm:blocked` · 2026-11-13T03:46Z