Repository navigation
checklist: re-point three approvals clauses that still expect 403 where a non-reader gets 404 REQUEST_NOT_FOUND (sibling half of #33060) #33275
Description
domain:devx#2 · sunhaolin · session_017xRBcRZn9wGkMSrznVX4JS
Filing gate: ① a checklist assertion defect: the item will fail a QA run while the product is right (#32997 rule 9).
This card carries the sibling half of #33060. #33060 keeps approvals.record-page-decisions acceptance[4], re-pointed by PR #33273.
Business reason: QA runs on the approvals area score these three clauses as FAIL against a product that is correct. The approvals door answers 404 REQUEST_NOT_FOUND to anyone who cannot read the request, so its existence never leaks. Each false FAIL costs a release sweep a re-judgement.
Reader: the domain:devx seat's next claim (a text-only re-point, the same shape as PR #33273).
Dedupe (open and closed): "request-page-reply-and-reader-visibility" → 20 hits; "quorum-m-of-n" REQUEST_NOT_FOUND → 10; "decision-action-matrix" REQUEST_NOT_FOUND → 10. The open hits are #33032, #33060 and #32908: the first two only quote these items, and the third is the sweep anchor. No card re-points them.
The three clauses
These readings come from source in PR #33273's Acceptance notes and were not driven live. The mechanism is ApprovalService.refuseUnreadableRequest in packages/plugins/plugin-approvals/src/approval-service.ts. Decide, recall, send back, resubmit, reassign, remind, request info and comment all ask it before the slate check. Participants (submitter, current approver, past actor) and the override actor can read the request. No showcase object declares enable.approvalsVisibleToReaders.
approvals.request-page-reply-and-reader-visibilityacceptance[1] (rev 5): stale. The org member, who is neither approver nor submitter, cannot read the request, so the comment POST answers 404REQUEST_NOT_FOUND, not 403FORBIDDEN.approvals.quorum-m-of-nsteps[4] (rev 9): half stale. Ada's repeat-actor 403 holds, because a past actor is a reader. "A user holding none of the routed positions is refused the same way" does not: that non-participant gets 404.approvals.decision-action-matrixacceptance[6] (rev 10): under-specified. "Recall attempted by a non-submitter is FORBIDDEN" holds for a reader such as a pending approver. A non-participant gets 404. Name the persona, or state both answers. negative[2] is not stale.
Fix shape: for each item, re-point the text, bump revision, add a history row, and keep pnpm check:platform-checklist green. Re-measure first on current main.
Activity
objectstack-fleet commentedon Nov 14, 2026
triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH
Path: none
Triage: audit of a pre-labeled card · p2 confirmed · 2026-11-14T15:46Z
⛔ Not a claim.
Area: none (
domain:devx)objectstack-fleet commentedon Nov 14, 2026
domain:devx#4 · os-project-manager · session_01FEkQ5ooRyyS95kdyC2dPEX
Claim: PM loop round 2 · 2026-11-14T16:43Z
Session:
session_01FEkQ5kHpQrXX5yTHRb5h4F(card thread, dev) · seatsession_01FEkQ5ooRyyS95kdyC2dPEXAccount:
os-project-managerBranch:
claude/project-thread-v8xyloWorktree:
objectstack-issue-33275Domain:
domain:devxSeat:
domain:devx#4File surface:
docs/qa/platform-checklist/areas/approvals.json(the three items the card names). ⛔ No product code, no other item or area file.Container & model: S,
mode:thread,model: default tier,effort: defaultClause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (checklist text lags a correct product)
Thread-read: 6880034004
Premise: holds: triage#1 audit 6880034004 confirms p2; the dev re-measures each clause on
origin/mainfromapproval-service.tsbefore any editSerial constraints cleared: devx#2's PR #33273 (same file) merged as
fdb76fb89d; sibling #32908 (this seat, parallel) is told to leave these three clauses aloneScope: the card's three clauses, one PR,
Fixes #33275,skip-changeset. Order:/mnt/project-files/pm-orders/devx/order-33275.md. Summons: the maintainer's 「在开一个 devx」「都处理 p1 p2 卡」 (this project, 2026-11-14T15:37Z).objectstack-fleet commentedon Nov 14, 2026
domain:devx#4 · os-project-manager · session_01FEkQ5kHpQrXX5yTHRb5h4F
os-dev-report
{
"issue": 33275,
"status": "done",
"branch": "claude/project-thread-v8xylo",
"pr": "#33327",
"session": "session_01FEkQ5kHpQrXX5yTHRb5h4F",
"premise_still_valid": true,
"summary": "Re-measured all three clauses from source on origin/main 87330e8 before editing: refuseUnreadableRequest (approval-service.ts L10154) answers a non-reader REQUEST_NOT_FOUND (404 via approvals-routes.ts handleApprovalError) before the slate/submitter check in comment (via loadPendingRow), decideNode and recall. All three were as the card said: request-page-reply-and-reader-visibility acceptance[1] stale (org member is no participant: 404), quorum-m-of-n steps[4] half stale (Ada as past actor reads the request: 403 holds; a no-position user: 404), decision-action-matrix acceptance[6] under-specified (reader non-submitter 403, non-reader 404, dev admin excluded since the override recalls a pending request by design). Each re-pointed in verify/evidence/step text only, revision 5→6, 9→10, 10→11, one history row each citing #33275; no clause sentence changed. negative[2] of decision-action-matrix confirmed not stale (status-agnostic) and left unchanged. Only docs/qa/platform-checklist/areas/approvals.json changed (+26/-8).",
"tests": "No test added or changed (checklist text only; os-dev.md: docs are not ablated). Behaviour already pinned at the service layer and cited: approval-service.test.ts L2104 (outsider comment REQUEST_NOT_FOUND), L2925 (stranger REQUEST_NOT_FOUND, override admin FORBIDDEN); recall-refusal-user-copy.test.ts L316 (pending approver u2 FORBIDDEN, stranger u7 REQUEST_NOT_FOUND). Control grep: approvalsVisibleToReaders in examples/ 0 hits (exit 1), in plugin-approvals/src hits (positive control).",
"gates": "head fd55e25: dispatch-gates --commands (16): check-adr-links 0, check-adr-links --self-test 0, check-closing-keyword-parity 0, its --self-test 0, check-comment-mask-corpus 0, plan-test-core-shards --self-test 0, lint check:doc-formula-expressions 0 (first run exit 3 PREREQUISITE NOT MET, rerun after building formula+lint under the lock: VERDICT command-exit 0), check:ci-filter-parity 0, check:cross-package-test-inputs 0, check:doc-authoring 0, check:driver-memory-census 0, check:gitlink-declared 0, check:nul-bytes 0, check:platform-checklist 0, check:refd-timer-probe 0, check:watch-hint-literal 0. --ran: 16 derived, 16 run, 0 NOT-MEASURED, exit 0. Scoped pnpm lint: n/a (no package touched). CI check-runs: in_progress at report time, the seat reads them.",
"dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
"mcp_calls": "0",
"api_writes": "2 — relay fleet-write pr_create (POST /repos/objectstack-ai/objectstack/dispatches, run 43618220717, PR #33327, labels skip-changeset, no assignees, read-back identical); post-stamped os-dev-report comment on #33275. Plus git push of the harness branch (not a REST write).",
"line_budget": "+26/-8, 1 file, under the 3000 human-merge threshold",
"files_changed": [
"docs/qa/platform-checklist/areas/approvals.json"
],
"deviations": "None against the order. Model tier per dispatch-gates --tier: no path-derived mandate (PM's call). skip-changeset confirmed: no package.json under docs/, root private, no workspace files[] names docs/qa.",
"open_questions": [],
"security_findings": "none",
"out_of_scope_findings": [
"none"
]
}
Generated by Claude Code
objectstack-fleet commentedon Nov 14, 2026
domain:devx#4 · os-project-manager · session_01FEkQ5ooRyyS95kdyC2dPEX
ACCEPT → PR #33327 comment 6881227235 · head
fd55e259· non-governed, no contract-review face · readied and auto-merge armed 2026-11-14T17:10Z.objectstack-fleet commentedon Nov 14, 2026
triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH
Path: none
Triage: H14 ·
+pm:blocking· 2026-11-14T17:50Z⛔ Not a claim; claim and state unchanged.
Open cards name this one in
Blocked-by:: #33332 (batch C of #32908, same file as PR #33327). A blocker in flight carriespm:blocking.objectstack-fleet commentedon Nov 14, 2026
domain:devx#4 · os-project-manager · session_01FEkQ5ooRyyS95kdyC2dPEX
Landed · #33275 · PR #33327 · 2026-11-14T18:07Z
fca5f89cce; this card closed by itsFixesline;pm:dispatchedandpm:blockingremoved in this stroke.approvals.json): the seat dispatches it now on this card's thread and branch.