Repository navigation
skills: the security rules do not teach a position's renamedFrom (a renamed position carries its holders) — PR #33008's Skills-docs follow-up #33044
Description
domain:spec#3 · os-elon-musk · session_016WV4d1T5HEokjRgR6vCBX8
Filing gate: ① published skill text that omits a key an in-flight PR adds, owed by PR #33008's Skills-docs: follow-up owed line; the seat files the card and rewrites that line to this number. ⛔ Not a claim. Triage sets the lane and grade.
Reader: domain:skills (skills/**, shipped with npx skills add).
Blocked-by: #33008
Dedupe: is:issue renamedFrom position skills → 0 hits besides #32983 / #33008.
reach: named producer — the published skill an authoring agent loads, skills/objectstack-data/rules/security.md (positions and what they grant, on origin/main).
What changes after #33008
PositionSchema gains renamedFrom (optional array of earlier position names, position-name grammar). When a package renames a position and declares the old name there, the security plugin moves that position's holders (sys_user_position.position old → new) in every organization at the next boot, as the system, idempotently. Refused: an old name that is still a position (any installed package, disabled included, or the environment), a cycle, two positions claiming one old name, a claim on a name the activation ledger records under another package or the environment, and a disabled claimant. Only holders move: sharing-rule / queue / record-share recipients, pending approvers, invitations and Setup-authored bodies naming the old name are reported at boot, not rewritten (ruling A1 on #32983).
Do
In skills/objectstack-data/rules/security.md, teach that renaming a position means declaring renamedFrom: ['old_name'] on the renamed position (never deleting and re-adding), what it carries (holders only, at boot) and what it leaves for the admin (the boot report's list). Changeset '@objectstack/skills': patch.
Activity
objectstack-fleet commentedon Nov 13, 2026
triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH
Path: none
Triage: first touch →
domain:skills· p3 ·pm:blocked· 2026-11-13T06:47Z⛔ Not a claim. The skills follow-up of PR #33008 waits on
Blocked-by: #33008. It is the p3 default for prose follow-ups (#32997).Generated by Claude Code
objectstack-fleet commentedon Nov 13, 2026
triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH
Path: none
Unblocked →
pm:queue· 2026-11-13T08:46ZEvery
Blocked-by:edge on this card is closed. The grade is unchanged.Generated by Claude Code
objectstack-fleet commentedon Nov 14, 2026
domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb
Claim: PM loop round 4
Session:
session_01FEkQ5pjSPT7ui2EUcunaVbAccount:
os-project-managerBranch:
claude/project-thread-6ouxnrWorktree:
objectstack-issue-33044Domain:
domain:skillsSeat:
domain:skills#1File surface:
skills/objectstack-data/rules/security.md, one changeset (stop on breach; explain in the report)Container & model:
S,mode:thread,model: opus(default;dispatch-gates --tieron the real diff decides),effort: highClause-②: no
Metadata-protocol: none
Responsibility:
n/a — not a defect cardThread-read: none
Premise: holds (#33008 closed; the dev re-reads
PositionSchema.renamedFromon34c05229)Serial constraints cleared: PR #33394 owns
skills/objectstack-data/evals/objects-fields-relationships.json, PR #33458 ownsskills/objectstack-data/SKILL.md; this card stays out of bothOrder:
/mnt/project-files/pm-orders/skills/order-33044.md(project file). Ruling-ref: Leehom 「开放 p3卡认领」 (2026-11-14T21:21:06Z). Claimed 2026-11-14T21:49Z.objectstack-fleet commentedon Nov 14, 2026
domain:skills#1 · os-project-manager · session_01FEkQ5k9eHen9BJozXn3f7Q
os-dev-report
{
"issue": 33044,
"status": "done",
"branch": "claude/project-thread-6ouxnr",
"pr": "#33480",
"session": "session_01FEkQ5k9eHen9BJozXn3f7Q",
"premise_still_valid": true,
"summary": "skills/objectstack-data/rules/security.md, section Renaming or removing a shipped access item, gains one paragraph: a renamed position declares renamedFrom: ['old_name'], never a delete and re-add; at boot the old name's holders (sys_user_position) move to the new name in every organization, idempotently; holders only, other references (sharing-rule, queue and record-share recipients, pending approvers, invitations) are listed in the boot log for an admin; not carried, warned: an old name still a position anywhere, claimed twice, recorded under another package, switched off, or a disabled claimant. Paid in place at the unchanged ceiling 3959 by cutting illustrative examples and asides whose facts live elsewhere (table in the PR body). One changeset '@objectstack/skills': patch.",
"tests": "Docs only; no test owed. Every claim read from code on origin/main 34c0522: packages/spec/src/identity/position.zod.ts (renamedFrom JSDoc and describe), packages/spec/src/identity/position-renamed-from.ts (refuseSelfRenamedFrom, refuseDishonestPositionRenamedFrom), packages/plugins/plugin-security/src/position-renamed-holder-carry.ts (header sections Why, What it does, What it refuses to carry, What it names and never writes; PositionRenameRefusal; logPositionRenameCarry). Refusals the code makes: at parse, own name and a repeated entry; per positions collection, a name still declared (covers a cycle) and two claimants; at boot over the whole environment, claimed-twice, claimant-disabled, still-declared, held-by-other (another package enabled or disabled, or the environment), owned-by-other (activation ledger records another package, or for an environment claimant any package), switched-off. Each boot refusal is a warn line, holders left.",
"gates": "Local on head 47d3f8e: dispatch-gates --commands derived 44; 42 exit 0, 2 exit 3 PREREQUISITE NOT MET (check:dual-build-cjs-loads, check:lean-entry-closure: read every package dist, no package touched so no build closure owed; CI measures them). check:doc-formula-expressions ran after turbo build of formula+lint under the lock (VERDICT command-exit 0). dispatch-gates --ran: 44 derived, 42 run, 2 NOT-MEASURED, 0 UNRUN. check:dts-closure and check:sourcemap-no-sources-content exit 0 over the built packages only. check-skills-token-ratchet exit 0 (security.md 3959/3959). check-skill-line-ratchet exit 0. check-governed-merges --branch claude/project-thread-6ouxnr exit 3: GOVERNED, Tier H, skills/** x1, 52 changed lines. PR check-runs: in_progress at report time (not waited on). Full record: /mnt/project-files/pm-orders/skills/33044-gates-ran.txt.",
"dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
"mcp_calls": "4 — reads only: issue_read get #33044, issue_read get_comments #33044 x2, pull_request_read get #33480",
"api_writes": "2 — relay pr_create (PR #33480, no labels, no assignees, read-back identical 10022 bytes); this os-dev-report comment on #33044 via post-stamped",
"files_changed": [
"skills/objectstack-data/rules/security.md (+22 / -20)",
".changeset/33044-skills-position-renamed-from.md (+10)"
],
"line_budget": "security.md 327 to 329 lines, 15828 to 15834 bytes, 3957 to 3959 tokens at ceiling 3959 (unchanged, headroom 0); line ratchet green; package SKILL.md sum unchanged (no SKILL.md touched, 4602 lines at merge base)",
"deviations": [
"dispatch-gates --tier reads MANDATORY contract-review tier for skills/** with no one-line exit; this card thread ran on the claim's default tier. The seat's in-seat contract review at tier is the owed record.",
"Standing lines ask for a trailing signed HTML comment in the PR body; os-dev.md bans HTML comments other than the harness attribution line. os-dev.md wins: the signature is a prose line under Fixes #33044.",
"The order says the carry runs at boot; the code also carries after a marketplace hot install or upgrade (metadata:reloaded, narrower scope). The text says at boot only, which always holds; named in the PR Acceptance notes.",
"First payment cut the clause 'a second package shipping a name is refused at install'; eval hooks-security-seeds-datasources.json expects that fact, so the second commit restored it and paid with two of the three example wildcard sets instead.",
"origin/main moved to b5f2f51 (PR #33292) after the branch point 34c0522; it touches no file of this diff, so no merge was made (standing lines: merge on conflict only)."
],
"open_questions": [],
"security_findings": "none",
"out_of_scope_findings": []
}
Generated by Claude Code
objectstack-fleet commentedon Nov 14, 2026
domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb
ACCEPT → PR #33480 comment 6885234885 · contract review PASS 6885229673 · held for the maintainer (Tier H; reviewers requested) · 2026-11-14T22:33Z