ADR-0055: record the 2026-11-14 amendment, writeRequiresMasterRead (read on the master is enough to write, by opt-in)

domain:spec#1 · os-project-manager · session_01FEkQ5mswnWm181XgYcCUag

Carrier of #33250 (PR #33369, Clause-②: yes (widening), contract review PASS 6881744779). Filed before ACCEPT under the review checklist's owed-card rule.

Stale on main once #33369 merges: docs/adr/0055-master-detail-controlled-by-parent.md

:172 "Option 2 … was not chosen: it opens the write to everyone the detail's own grants admit" and :188 "Option 2's door — the detail's own grants deciding the write for everyone — stays closed."
:6 / :69 amendment banners name only ownerMayEdit.
:247 "Emptying one asks edit on the stored master through the §3 walk" (on an opted-in detail it asks read).

TO: an amendment section "Amendment (2026-11-14, #33250): read on the master is enough to write, by opt-in" and banners at :6 and :69, recording:

the ruling: Leehom 2026-11-14, A+ 「开关打开后,能读主记录的人按子对象自己的授权新增、修改、删除,默认不变。」 (ruling record 6880588685 on controlled_by_parent: per-object opt-in so read on the master is enough to insert and update the detail under the detail's own grants (ownerMayEdit covers owner update only; HotCRM Order to Cash blocked) #33250), which lifts the :172 / :188 "Option 2 not chosen" line for opted-in objects only;
the key sharing.controlledByParent.writeRequiresMasterRead, its two parse refusals (off a controlled_by_parent detail; beside ownerMayEdit: true), the reader controlledByParentWriteRequiresMasterRead;
the gate: per hop, READ on the master when that hop's detail opted in, ending the walk there; a non-opted hop asks EDIT as before. Covers insert, by-id and predicate update/delete, re-point, emptying an optional master, and the lifecycle verbs (transfer, restore, purge, verb-blind);
the two seat calls the contract review named for the veto window (record 6881744779 ① items 5 and 6): a non-opted detail under an opted master is writable by a reader of the top master (the master's own update grant and policies still run on its hop); lifecycle verbs ask read on an opted detail;
delegation (ADR-0090 D10): agent and delegator must each read the master;
by-id update/delete by a non-reader answers 404 RECORD_NOT_FOUND (read door first, readRowById swallows engine failures into null, so a store outage is indistinguishable from an absent row at every gate that probes with it #7505), insert and re-point 403.

Source of truth for the shipped behaviour: PR #33369's diff and its body's "Acceptance notes". Tier H (docs/adr/**): the PR needs the maintainer's approval.

class: b · type: Docs · Grade: p2 (a published ADR states the opposite of shipped behaviour) · domain: skills (governed path)

domain:spec#1 · os-project-manager · session_01FEkQ5mswnWm181XgYcCUag

Added for the amendment and skill text, from contract review 6881744779 (N1, N3) · 2026-11-14T18:11Z

N1: do not write that a non-declaring object is answered "byte for byte as before". The precise invariant: a write's answer moves only if its own object, or a controlled_by_parent master on its chain, declares the key.
N3: a delegated by-id update or delete keeps both platform ownership floors (ADR-0090 D10 exclusion, as before), and a predicate write keeps the floor too. Say in plain words that "admitted when both can read the master" is subject to those floors.

domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb

Claim: PM loop round 3
Session: session_01FEkQ5pjSPT7ui2EUcunaVb
Account: os-project-manager
Branch: claude/project-thread-mllmvl
Worktree: objectstack-issue-33373
Domain: domain:skills
Seat: domain:skills#1
File surface: docs/adr/0055-master-detail-controlled-by-parent.md (plus an ADR index line only if a gate requires it); skip-changeset (stop on breach; explain in the report)
Container & model: M, mode:thread, model: opus (default; dispatch-gates --tier on the real diff decides), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: none
Premise: holds (PR #33369 merged; docs/adr/0055-master-detail-controlled-by-parent.md:172 and :188 still say Option 2 was not chosen on fc283d6d)
Serial constraints cleared: #33374 (same round) edits skills/** only, disjoint; the stated rule is kept identical between the two
Order: /mnt/project-files/pm-orders/skills/order-33373.md (project file). Ruling-ref: Leehom 2026-11-14 A+ 「开关打开后,能读主记录的人按子对象自己的授权新增、修改、删除,默认不变。」 (record 6880588685 on #33250). Claimed 2026-11-14T20:08Z.

domain:skills#1 · os-project-manager · session_01FEkQ5mjPb2TvhBS1yQezQF

os-dev-report
{
"issue": 33373,
"status": "done",
"branch": "claude/project-thread-mllmvl",
"pr": "#33425",
"session": "session_01FEkQ5mjPb2TvhBS1yQezQF",
"premise_still_valid": true,
"summary": "ADR-0055 records the 2026-11-14 amendment for writeRequiresMasterRead (ruling A+ 6880588685, quoted verbatim). In place: a new status-block Amended line, a warning note at the end of the :6 ownerMayEdit banner, a third warning line under the section 3 rule (:69), warning paragraphs after the 2026-10-26 'Option 2 not chosen' (:172) and 'Option 2 door stays closed' (:188) lines lifting them for opted-in objects only (original text kept), and a warning line under the :247 set/empty-master sentence. New end section: key, reader, two parse refusals, the one swap point in the chain walk, every write shape, what decides afterwards with the ownership floors in plain words (N3), on-behalf-of, 404/403 answers and served-member legs, the null-master row, the lint stand-down, the two seat calls for the veto window (review 6881744779 items 5 and 6), the precise invariant instead of byte-for-byte wording (N1), fail-closed boundaries, proof, unchanged.",
"tests": "Docs only; no test owed. Every claim was read from code on origin/main b462444 (contains PR #33369 as df9fe94): object.zod.ts (key, reader, refuseControlledByParentWriteRequiresMasterReadMisplaced), security-plugin-cbp-relation.ts, security-plugin-cbp-write-gate.ts (assertControlledByParentChainEditable read branch with break, assertMasterRowReadable, readUnlessRefused, stored null-master branch nullMasterRowWritable then askBodyNamedMaster), security-plugin-authz-middleware.ts step 2.7 (masterGateCoversThisWrite = !delegatorSets, callerCannotReadAddressedRow) and step 2.8 (verb list insert/update/delete/transfer/restore/purge, delegator pass), platform-ownership-policies.ts (OWNERSHIP_FLOOR_PREDICATE, masterGateCoversOperation), explain-engine.ts (chainAsksMasterRead), validate-security-posture.ts (masterReadSuffices), and the [#33250] describes of controlled-by-parent-owner-may-edit.test.ts. Table in the PR body Acceptance notes.",
"gates": "Local on head 5647b9f: dispatch-gates --commands derived 21; all 21 exit 0 (exit captured before any pipe; check:doc-formula-expressions after turbo build of formula+lint under the lock, VERDICT command-exit 0). dispatch-gates --ran: 21 derived, 21 run, 0 NOT-MEASURED. check-governed-merges --branch: exit 3 GOVERNED, tier H, docs/adr ×1, 53 lines. dispatch-gates --tier: MANDATORY contract-review tier. Control-byte self-scan of the ADR: no hit. CI check-runs: in_progress at report time; the seat reads them.",
"dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
"mcp_calls": "0 — no MCP GitHub calls",
"api_writes": "2 — relay pr_create (PR #33425, label skip-changeset, read-back identical 8204 bytes); this os-dev-report comment on #33373 via post-stamped",
"files_changed": [
"docs/adr/0055-master-detail-controlled-by-parent.md (+52 / -1)"
],
"line_budget": "53 changed lines, one file; no skills/** touched, no ratchet in play; no ADR index line (check:adr-index green)",
"deviations": [
"dispatch-gates --tier reads MANDATORY contract-review tier for docs/adr/** with no one-line exit; this card thread ran on the claim's default tier. The seat's in-seat contract review at tier is the owed record.",
"Standing lines ask for a trailing signed HTML comment in the PR body; os-dev.md bans HTML comments other than the harness attribution line. os-dev.md wins: the signature is a prose line under Fixes #33373.",
"Origin/main moved past the order's fc283d6 to b462444 before the branch was cut; both contain PR #33369 (df9fe94). The :172 and :188 lines were confirmed at those numbers on b462444."
],
"open_questions": [],
"security_findings": "none",
"out_of_scope_findings": [
"carrier: seat · contract review N2 (gate comments still say a body that empties or names a master asks EDIT) and N4 (emptying an optional master and the lifecycle verbs unpinned under the opt-in) are code follow-ups the review already named; noted in the ADR Proof paragraph, not filed"
]
}

Generated by Claude Code

domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb

ACCEPT → PR #33425 comment 6883826079 · contract review PASS 6883816828 · held for the maintainer (Tier H; reviewers requested) · 2026-11-14T20:36Z

Navigation Menu

Repository navigation

ADR-0055: record the 2026-11-14 amendment, writeRequiresMasterRead (read on the master is enough to write, by opt-in) #33373

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

ADR-0055: record the 2026-11-14 amendment, writeRequiresMasterRead (read on the master is enough to write, by opt-in) #33373

Description

Activity

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions