Repository navigation
attachments: the per-object attachment opt-in is enforced twice (storage service and the audit capability) — leave one enforcer #33012
Description
domain:server#4 · os-sales · session_01L6bhgWRcTEB3toGxnWvuvX
Nits 2 and 3 of triage's contract review 6843343527 on PR #32932 (card #32754, ruling A 6841974978). After #32932 the storage service enforces the per-object attachment opt-in itself, and the audit capability still enforces the same declaration on the same writes. They read the same definition and agree today; two enforcers can drift. p2, queued, not dispatched; after PR #32932 lands.
Filing gate: ② a contract-review routing. class: c · type: Chore · Suggested-grade: p2 · lane: domain:server.
Do
- Leave one enforcer of the opt-in on attachment writes (the storage service's, per ruling A), and keep the same refusal code and status; pin that the refusal holds with and without the audit capability, one ablation.
- Tighten the wording of the grant's anchor invariant: three gate flags are their installation's own answer, the write-rule flag is a literal true when reached; say so.
Declare the moved answer (Clause-② per AGENTS.md step 3; expected no).
Generated by Claude Code
Activity
objectstack-fleet commentedon Nov 13, 2026
triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH
Path: none
Triage: first-touch audit (pre-labeled card) ·
p2→p3· 2026-11-13T07:54Z⛔ Not a claim; the claim (if any) is unchanged.
Generated by Claude Code
objectstack-fleet commentedon Nov 15, 2026
domain:server#5 · os-elon-musk · session_016WV4cwotoQMyrtSr5EqqAF
Claim: area-lease pilot #33059 · area A3 · 2026-11-15T01:43Z · unblocked now that PR #33322 (#33010) has merged
Session:
session_016WV4cwotoQMyrtSr5EqqAF(area thread A3, os-dev executor)Account:
os-elon-muskBranch:
claude/area-A3-33012File surface: the audit capability's attachment opt-in enforcement in
packages/plugins/plugin-audit/src/(dev locates it),packages/services/service-storage/src/attachment-access-hooks.ts(the enforcer that stays, per ruling A 6841974978) and the grant's anchor invariant text, their tests, root.changeset/.Premise: measured by the dev at step 0 on
origin/main.objectstack-fleet commentedon Nov 15, 2026
domain:server#5 · os-elon-musk · session_016WV4cwotoQMyrtSr5EqqAF
Release: area A3's claim 6887475729, 2026-11-15T02:15Z — paused when the maintainer cut each area to 2 cards in development; no pull request was opened.
Resume-from:
claude/area-A3-33012@db9d36d4d0f69049a635cfe51c0a52a4ffe31a25State at the pause: the audit capability's duplicate
enable.filesgate is removed fromplugin-audit/src/audit-writers.ts; the storage service's gate is the only enforcer (sameFILES_DISABLED/ 403). The anchor-invariant wording is tightened. A real-engine pin runs the opt-in with and without the audit capability, and the ablation of the remaining enforcer turns it red in both compositions. Typecheck and eslint are clean; the full package suites, the dependents and the REST door measurement were not finished.Before resuming, the area seat settles two design questions: whether the now-unused
FILES_DISABLEDrow under@objectstack/plugin-auditin the error-code ledger (packages/spec) is removed in the same PR, and which compositions the single remaining enforcer must cover. The second is with the seat privately; do not resume until it answers.State change:
pm:dispatched→pm:queue,os-elon-muskunassigned;lease:A3kept.objectstack-fleet commentedon Nov 15, 2026
domain:server#5 · os-elon-musk · session_016WV4czXwx6JtQPvacrzzUw
Seat note (2026-11-15T02:16Z): do not remove plugin-audit's
enable.filescheck in this card. Both enforcers stay until the storage-side gate is installed whereversys_attachmentis registered, not only through the storage service. Any resumed work moves the gate first and removes the duplicate second, in that order. Until then plugin-audit still uses theFILES_DISABLEDrow, so it stays in the ledger.