Repository navigation
checklist: re-point 36 stale items in access-security, api-backend, approvals (v18.4.0 sweep close-out, batch C of #32908) #33332
Description
domain:devx#4 · os-project-manager · session_01FEkQ5ooRyyS95kdyC2dPEX
Filing gate: ① checklist assertion defects (#32997 rule 9): each item below will score FAIL or mislead a QA run while the product is right, or names a fixture recipe that no longer works.
Parent: #32908, the v18.4.0 sweep anchor. Its §1 close-out was measured in one pass on origin/main 87330e89 (report 6881013689 on #32908): 269 parked lines, 171 of them owe an item-text re-point over 159 items. That is too large for one PR, so the seat splits it by area file into five batches with no shared file. This card is batch C.
Blocked-by: #33275
This batch starts after #33275 lands: it re-points three other clauses in areas/approvals.json.
Business reason: every stale clause costs the next release sweep a false FAIL and a re-judgement, and a stale fixture recipe costs a run its setup time.
Reader: the domain:devx seat 4 (claim follows), then QA runs reading these areas.
Dedupe: the rows below are the parked lines of #32908 that are still stale on 87330e89. PR #33273 (merged) and #33275 (in flight) re-point other items and are excluded. No other open card re-points these items.
One parked line of this file family is held for a maintainer ruling and is NOT in this batch: the api-backend.error-envelope-ledger INVALID_FILTER face (the #32908 dev report's open question).
Fix shape
For each row: re-measure on current main first (area files move under product PRs); re-point the text to the product, bump revision, add a history row citing this card and the source record. A row the re-measure finds already right is left alone and said so in the PR. pnpm check:platform-checklist green. Files: docs/qa/platform-checklist/areas/access-security.json, docs/qa/platform-checklist/areas/api-backend.json, docs/qa/platform-checklist/areas/approvals.json only.
Rows (from the #32908 close-out ledger; evidence read at 87330e89, not driven live)
| # | line | source record · comment | disposition | evidence |
|---|---|---|---|---|
| 5 | access-security.ai-service-account-agent-ceiling acceptance[0],[3] steps: clause 1 reads session-only GET /auth/me/permissions with a key; re-point to admin POST /security/explain; use an owner-private object (showcase_task is public-read) |
#32940 (body §1) · #33025 · 6844741021 | re-point owed → split batch C | r1, last history 2026-11-10 #32019; stale "me/permissions" present |
| 15 | approvals.account-app-entry acceptance[3],[4],[6]: request opens under the record-owning app since #32850 (objectHostAppSegment), not the component route's appId; Language picker offers 简体中文 zh-Hans, not 中文（中国） zh-CN |
#32953 (body §1) · #33087 · 6850382730 | re-point owed → split batch C | r9, last history 2026-11-08 —; stale "zh-CN" present |
| 22 | approvals.account-app-entry landing: a non-admin persona with a single app lands in that app after sign-in, not on /home |
#32953 (body §1) | re-point owed → split batch C | r9, last history 2026-11-08 —; item unchanged since the record |
| 24 | access-security.walled-environment-metadata-operator-only knownGaps[0]: knownGaps[0] still says no example app declares the multi-org runtime (the showcase does); fixture: the operator's POST /packages id must be reverse-domain |
#32953 (body §1) | re-point owed → split batch C | r8, last history 2026-11-01 #28545; stale "no example app" present |
| 25 | access-security.no-active-org-session-semantics steps[8], acceptance[4]: steps[8] has a member create showcase_account/project, refused by CRUD 403 first (mistakable for the org refusal); showcase_task now requires project; name showcase_task(+project) or showcase_private_note; re-sign-in restores an active org, clear per session; acceptance[4]: sys_audit_log rows live in the telemetry DB |
#32953 (body §1) · #33025 · 6844741021 · #33087 · 6850382730 · #33092 · 6850793622 | re-point owed → split batch C | r10, last history 2026-11-10 #32111; stale "showcase_account" present, missing "telemetry" (gap stands) |
| 31 | access-security.permission-set-package-resolution steps[3]: once qa_b depends on qa_a its same-named items are refused 403 NOT_OVERRIDABLE (ADR-0146 D2): shared fixture must rename them; name an object no stock member set grants |
#32940 (body §1) · #33094 · 6852480973 | re-point owed → split batch C | r2, last history 2026-11-10 #32330; missing "NOT_OVERRIDABLE" (gap stands) |
| 33 | api-backend.automation-namespace-address 405 Allow; steps[2]: 405 Allow is 'GET, HEAD'; a {} body answers 400 FLOW_FAILED (Unknown variable: tasks): send {params:{tasks:[]}} |
#32940 (body §1) · #33081 · 6850173588 | re-point owed → split batch C | r3, last history 2026-11-10 #32330; missing "tasks" (gap stands) |
| 35 | access-security.credential-use-audit-row -: address and UA are row columns, not metadata keys |
#32940 (body §1) | re-point owed → split batch C | r1, last history 2026-11-10 #32019; item unchanged since the record |
| 36 | api-backend.client-sdk-namespace-address automated.ref count: the pin holds 83 tests (item says 79) |
#32940 (body §1) | re-point owed → split batch C | r3, last history 2026-11-10 #32330; stale "79" present |
| 56 | api-backend.api-methods-verb-gate acceptance[1], negative[1]: restore/purge derive from delete since ADR-0148/#30237: ['get','delete'] answers allowed get,delete,restore,purge |
#33025 · 6844741021 · #33081 · 6850173588 · #33092 · 6850793622 | re-point owed → split batch C | r4, last history 2026-10-31 #27392; stale "restore" present |
| 57 | api-backend.retired-def-refusal rev 2 / steps[3]: manifest.loading tombstone removed (ADR-0087 addendum, #25767 D2=A); registry 249 entries (53@17, 196@18), not 224 |
#33025 · 6844741021 · #33081 · 6850173588 | re-point owed → split batch C | r4, last history 2026-10-20 #24824; stale "manifest.loading" present |
| 58 | api-backend.aggregate-contract-matrix steps[5]/acceptance[3]: since #32279 the array_agg/string_agg prescription sits in fields[].hint, not message |
#33025 · 6844741021 · #33081 · 6850173588 | re-point owed → split batch C | r8, last history 2026-11-10 #32168; stale "string_agg" present |
| 69 | access-security.activation-write-operator-gate steps[4]: steps[4] says ledger reads are open, but a member gets 403 on sys_metadata_activation |
#33025 · 6844741021 | re-point owed → split batch C | r12, last history 2026-10-27 #26571; stale "sys_metadata_activation" present |
| 75 | approvals.status-mirror-field acceptance[2b]; negative[2]: N2 'running at all off the user-less mirror is a FAIL' stricter than design: say 'its data operation landing'; SLA recipe needs a wall-clock shim (not driven in R2-TOUCH) |
#33025 · 6844741021 · #33081 · 6850173588 | re-point owed → split batch C | r6, last history 2026-10-31 #27409; stale "running" present |
| 98 | access-security.share-link-landing-page route: route on a CLI-served boot is /_console/s/:token (bare /s/ answers ENDPOINT_NOT_FOUND) |
#33048 · 6846028996 | re-point owed → split batch C | r6, last history 2026-10-27 #26626; stale "/s/:token" present |
| 100 | access-security.security-catalog-one-holder-and-boot-report steps[3]; acceptance[4]: data API refuses planting the A4 grant (SQL on a stopped server); A4 INFO line needs --log-level info; '<=50 names' is <=50 grant ids per org |
#33048 · 6846028996 · #33094 · 6852480973 | re-point owed → split batch C | r4, last history 2026-10-27 #26571; stale "50" present |
| 102 | approvals.request-page-reply-and-reader-visibility acceptance[2]; steps[3]: A2's 404 leg reachable with a runtime grant (PUT permission + sys_user_permission_set): drop blocked(fixture); S3 scratch object needs sharingModel |
#33048 · 6846028996 · #33094 · 6852480973 | re-point owed → split batch C | r5, last history 2026-10-31 #27409; stale "blocked(fixture)" present |
| 132 | access-security.capability-declaration-lifecycle fixtures.requires: clone lands in com.example.showcase.custom, not package-less |
#33048 · 6846028996 · #33094 · 6852480973 | re-point owed → split batch C | r7, last history 2026-10-26 #25835; stale "no package" present |
| 134 | approvals.quorum-m-of-n fixtures.requires (4): the 6000 line needs merchant, category and status in {submitted,approved,rejected}; a 0-total submitted report opens nothing |
#33048 · 6846028996 | re-point owed → split batch C | r9, last history 2026-10-31 #27441; stale "6000" present |
| 136 | approvals.inbox-metadata-actions acceptance[1],[3]: 'Override Recall' only once the admin's slot on EXP-2001 is spent (say so as for EXP-DEMO); A3 network literal is the action door /api/v1/actions/sys_approval_request/approval_* |
#33048 · 6846028996 · #33088 · 6850413952 · #33093 · 6850899929 | re-point owed → split batch C | r8, last history 2026-10-31 #27441; stale "Override Recall" present |
| 138 | approvals.decision-action-matrix acceptance[7]; fixtures: A7 tally half vacuous on first_response (decision_progress null); Data Platform refuses budget 200000 (120% rule) |
#33048 · 6846028996 · #33094 · 6852480973 | re-point owed → split batch C | r10, last history 2026-10-27 #26621; stale "byte-identical" present |
| 156 | api-backend.route-ledger-live-parity title, fixtures, steps, acceptance[3]: 16 *route-ledger.ts files, not ELEVEN; REST_ROUTE_LEDGER 20 families (recycle-bin, user-work); A3 'answers (possibly a permission refusal)'; POST /data/:object/actions/:name is a routing 404 |
#33058 · 6846283471 · #33081 · 6850173588 · #33092 · 6850793622 | re-point owed → split batch C | r4, last history 2026-10-16 #24036; stale "ELEVEN" present |
| 157 | approvals.notification-deep-link steps[3]/acceptance[3]: route lands under the app owning the request's record (com.objectstack.setup / com.example.showcase), not com.objectstack.account |
#33058 · 6846283471 · #33094 · 6852480973 | re-point owed → split batch C | r9, last history 2026-10-28 #27134; stale "com.objectstack.account" present |
| 158 | approvals.ooo-delegation-reroute negative[3]: B forging a row answers 403 PERMISSION_DENIED (Ada has no create permission on sys_approval_delegation) |
#33058 · 6846283471 | re-point owed → split batch C | r7, last history 2026-10-20 #25003; stale "FORBIDDEN" present |
| 159 | approvals.record-page-decisions steps[2],[5],[6],[9]; acceptance[1],[2]: bar posts the action door /api/v1/actions/sys_approval_request/approval_*; first-load approvals arrive in POST /data/.../page; S9 budget trips the 120% rule |
#33058 · 6846283471 · #33093 · 6850899929 · #33094 · 6852480973 | re-point owed → split batch C | r6, last history 2026-11-14 #33060; stale "approvals/requests/:id" present |
| 161 | approvals.sla-escalation steps[1],[2]: approvals dedupe per record and runtime flows cannot be toggled: one trigger object per variant; branch evidenced by request status; SLA needs a wall-clock shim |
#33058 · 6846283471 · #33081 · 6850173588 | re-point owed → split batch C | r4, last history 2026-10-20 #25003; item unchanged since the record |
| 180 | access-security.public-form-withdrawal-layers steps[2]-[4]; negative[2]: package-less PUT answers 403 NOT_OVERRIDABLE (ADR-0146 D11): re-point at the customization-pair recipe |
#33081 · 6850173588 | re-point owed → split batch C | r5, last history 2026-10-27 #26571; stale "package-less" present |
| 181 | access-security.security-catalog-activation-and-clone-doors acceptance[4]: A4 names not-held-by-qualifier; wire carries RESOURCE_CONFLICT + sentence + details.candidates |
#33081 · 6850173588 | re-point owed → split batch C | r4, last history 2026-11-12 #32164; stale "not-held-by-qualifier" present |
| 187 | api-backend.action-activation-door-contract acceptance[1]: 4-segment path reaches the dispatcher (404 ROUTE_NOT_FOUND) through the ADR-0150 D5 addressed mount |
#33081 · 6850173588 | re-point owed → split batch C | r7, last history 2026-10-27 #26572; item unchanged since the record |
| 188 | api-backend.rest-crud-config-contract acceptance[2]: stock showcase has no apiEnabled:false object; the OBJECT_API_DISABLED body comes from the HTTP pin's fixture |
#33081 · 6850173588 | re-point owed → split batch C | r6, last history 2026-10-27 #26572; stale "apiEnabled" present |
| 189 | approvals.decision-only-via-service fixtures: admin holds both signoff positions on stock, so one approve finalizes the dual signoff |
#33081 · 6850173588 | re-point owed → split batch C | r5, last history 2026-10-28 #25807; item unchanged since the record |
| 195 | api-backend.package-rest-lifecycle acceptance[0]; negative[2]: sys_packages is (id, version)-keyed: name the list door as oracle |
#33081 · 6850173588 | re-point owed → split batch C | r4, last history 2026-10-20 #25003; stale "exactly ONE row" present |
| 197 | access-security.record-view-read-audit negative[0]: CLI auto-registration half is live-only and N0 is out of scope by the item's own word: the item can never PASS while it stays a clause |
#33081 · 6850173588 | re-point owed → split batch C | r7, last history 2026-11-01 #28345; item unchanged since the record |
| 199 | access-security.suggested-binding-loop fixtures: pending loop needs an installed package with an isDefault set (com.qa.decl recipe); N1 walled half needs walled-boot; N0 reachable only by the registry-seam pin |
#33081 · 6850173588 | re-point owed → split batch C | r3, last history 2026-10-11 #15204; stale "isDefault" present |
| 200 | access-security.agent-ceiling-set-assignment-refusal knownGaps: knownGaps worry did not happen: os build accepted a position with mcp_agent_data_read and install went through |
#33081 · 6850173588 | re-point owed → split batch C | r1, last history 2026-11-10 #32019; item unchanged since the record |
| 201 | access-security.share-link-capability-tokens fixtures: liaison minter recipe: admin POST sys_user_position {usr_showcase_phone_demo, showcase_client_liaison}; private-note control needs a note created first |
#33081 · 6850173588 | re-point owed → split batch C | r7, last history 2026-10-16 #24036; stale "liaison" present |
| 211 | access-security.walled-environment-metadata-operator-only personas; knownGaps[1]: org owner auto-holds organization_admin (auto-org-admin-grant); install-local leg scored from pins |
#33087 · 6850382730 | re-point owed → split batch C | r8, last history 2026-11-01 #28545; missing "organization_admin" (gap stands) |
| 261 | access-security.readonly-package-locks-studio acceptance[0]: Form tab stays editable on a read-only base by design (edits the .custom pair) |
#33094 · 6852480973 | re-point owed → split batch C | r5, last history 2026-10-16 #24036; item unchanged since the record |
Activity
objectstack-fleet commentedon Nov 14, 2026
domain:devx#4 · os-project-manager · session_01FEkQ5ooRyyS95kdyC2dPEX
Claim: PM loop round 4 · 2026-11-14T18:07Z
Session:
session_01FEkQ5kHpQrXX5yTHRb5h4F(card thread, dev; the #33275 thread, its PR #33327 merged) · seatsession_01FEkQ5ooRyyS95kdyC2dPEXAccount:
os-project-managerBranch:
claude/project-thread-v8xyloWorktree:
objectstack-issue-33332Domain:
domain:devxSeat:
domain:devx#4File surface: under
docs/qa/platform-checklist/areas/:access-security.json,api-backend.json,approvals.json. ⛔ No other area file (siblings #33328 #33329 #33330 #33331 each own theirs), no product code, no RUNNER.md, noscripts/qa/**.Container & model: M,
mode:thread,model: default tier,effort: defaultClause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (checklist text lags a correct product)
Thread-read: 6881013689
Premise: holds: the rows are #32908's ledger readings at
87330e89(report 6881013689) plus ledger row 85'sapi-backendhalf routed from #33331; the dev re-measures each on currentmainbefore editing. Theapi-backend.error-envelope-ledgerINVALID_FILTER face stays out (held for a maintainer ruling).Serial constraints cleared: #33275's PR #33327 (three other clauses of
approvals.json) merged asfca5f89cce; the branch restarts from currentmainScope: one PR,
Fixes #33332,skip-changeset, a per-row disposition table. Order:/mnt/project-files/pm-orders/devx/order-33332.md. Summons: the maintainer's 「在开一个 devx」「都处理 p1 p2 卡」 (this project, 2026-11-14T15:37Z).objectstack-fleet commentedon Nov 14, 2026
domain:devx#4 · os-project-manager · session_01FEkQ5kHpQrXX5yTHRb5h4F
os-dev-report
{
"issue": 33332,
"status": "done",
"branch": "claude/project-thread-v8xylo",
"pr": "#33400",
"session": "session_01FEkQ5kHpQrXX5yTHRb5h4F",
"premise_still_valid": true,
"summary": "All 39 rows (38 batch C ledger rows plus row 85's api-backend half, routed from #33331) were re-measured from source on origin/main fca5f89 and re-pointed: 36 items across access-security (16), api-backend (9) and approvals (11), one revision bump and one history row each citing #33332, the QA record and the base. No row was wholly already right (row 211's knownGaps half was), none needs a live drive, none needs a ruling. Three places where main had moved past the QA record are recorded in the PR: row 102 (member_default now grants read on sys_approval_request since #32442, so the 404 leg needs no runtime grant), row 134 (the expense line needs only merchant and amount besides the report) and row 195 (the suggested restart clause is new coverage, left for a coverage pass). Two negatives now read the design: status-mirror-field negative[2] and ooo-delegation-reroute negative[3]. The error-envelope-ledger INVALID_FILTER face is untouched.",
"tests": "No test added or changed (checklist text only; docs are not ablated). pnpm check:platform-checklist exit 0: 16 areas, 427 items; symbol anchors 1638/1648 resolved, 10 on the named residual. Every edited item parses and was checked to carry revision = old + 1 and exactly one new history row with ref #33332.",
"gates": "head b4df2ea, base fca5f89: dispatch-gates --commands (16): check-adr-links.mjs 0, check-adr-links.mjs --self-test 0, check-closing-keyword-parity.mjs 0, check-closing-keyword-parity.mjs --self-test 0, check-comment-mask-corpus.mjs 0, ci/plan-test-core-shards.mjs --self-test 0, --filter @objectstack/lint run check:doc-formula-expressions 0, check:ci-filter-parity 0, check:cross-package-test-inputs 0, check:doc-authoring 0, check:driver-memory-census 0, check:gitlink-declared 0, check:nul-bytes 0, check:platform-checklist 0, check:refd-timer-probe 0, check:watch-hint-literal 0. check:doc-formula-expressions needed @objectstack/lint built first (pnpm --filter "@objectstack/lint..." build, exit 0). --ran: 16 derived, 16 run, 0 NOT-MEASURED, exit 0. --tier: no path-derived mandate. Scoped pnpm lint: n/a (no package touched). CI check-runs: the seat reads them on PR #33400.",
"dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
"mcp_calls": "0",
"api_writes": "2 — relay fleet-write pr_create (POST /repos/objectstack-ai/objectstack/dispatches, run 43627737645, PR #33400, labels skip-changeset, no assignees, read-back identical 16282 bytes); post-stamped os-dev-report comment on #33332. Plus git push of the harness branch (not a REST write).",
"line_budget": "+316/-135, 3 files, under the 3000 human-merge threshold",
"files_changed": [
"docs/qa/platform-checklist/areas/access-security.json",
"docs/qa/platform-checklist/areas/api-backend.json",
"docs/qa/platform-checklist/areas/approvals.json"
],
"deviations": "Branch restart: the order said restart claude/project-thread-v8xylo from origin/main; force-push is reserved for claude/issue-* branches (AGENTS.md section 3), so origin/main was merged into the branch instead (merge b0d2643, empty diff against fca5f89 before the edit commit). The remote branch had been deleted after #33327 merged, so the push created it anew. Otherwise none against the order. Model tier per dispatch-gates --tier: no path-derived mandate (PM's call).",
"open_questions": [],
"security_findings": "none",
"out_of_scope_findings": [
"none"
]
}
Generated by Claude Code
objectstack-fleet commentedon Nov 14, 2026
domain:devx#4 · os-project-manager · session_01FEkQ5ooRyyS95kdyC2dPEX
ACCEPT → PR #33400 comment 6882561621 (2026-11-14T18:54Z); auto-merge armed. Landing record follows the merge.