Repository navigation
skills: teach sharing.controlledByParent.writeRequiresMasterRead in the controlled_by_parent authoring guidance #33374
Description
domain:spec#1 · os-project-manager · session_01FEkQ5mswnWm181XgYcCUag
Skills-docs follow-up of #33250 (PR #33369, Metadata-protocol: added, body line Skills-docs: follow-up owed — skills/** (the controlled_by_parent authoring guidance)). Filed before ACCEPT under the review checklist's owed-card rule.
Gap: the shipped skills teach the master-edit rule and ownerMayEdit only. Files that name controlled_by_parent on main: skills/objectstack-data/SKILL.md, skills/objectstack-data/rules/relationships.md, skills/objectstack-data/references/lint-rules.md, skills/objectstack-data/evals/objects-fields-relationships.json, skills/objectstack-ui/rules/record-page.md.
TO: where the skills say a detail write needs edit on the master, add: a controlled_by_parent detail may declare sharing.controlledByParent.writeRequiresMasterRead: true; then anyone who can READ the master writes (insert, update, delete) under the detail's own object permission, RLS and FLS. Not with ownerMayEdit: true (refused; the new key already admits the owner), and only on a controlled_by_parent object (refused elsewhere). Default unchanged. Note the lint arm security-controlled-by-parent-owner-policy-without-opt-in stays silent on a detail that declares the key. Add one eval prompt if the skill's eval set covers the master-edit rule.
Depends on #33369 merging (the key must parse on main before a skill teaches it; check:skill-examples). Tier H (skills/**): the PR needs the maintainer's approval.
class: b · type: Docs · Grade: p2 · domain: skills
Activity
objectstack-fleet commentedon Nov 14, 2026
domain:spec#1 · os-project-manager · session_01FEkQ5mswnWm181XgYcCUag
Added for the amendment and skill text, from contract review 6881744779 (N1, N3) · 2026-11-14T18:12Z
controlled_by_parentmaster on its chain, declares the key.objectstack-fleet commentedon Nov 14, 2026
domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb
Claim: PM loop round 3
Session:
session_01FEkQ5pjSPT7ui2EUcunaVbAccount:
os-project-managerBranch:
claude/project-thread-jqd53nWorktree:
objectstack-issue-33374Domain:
domain:skillsSeat:
domain:skills#1File surface:
skills/objectstack-data/SKILL.md,skills/objectstack-data/rules/relationships.md,skills/objectstack-data/references/lint-rules.md,skills/objectstack-data/evals/objects-fields-relationships.json,skills/objectstack-ui/rules/record-page.md(only where a sentence is made false or incomplete), one changeset (stop on breach; explain in the report)Container & model:
M,mode:thread,model: opus(default;dispatch-gates --tieron the real diff decides),effort: highClause-②: no
Metadata-protocol: none
Responsibility:
n/a — not a defect cardThread-read: none
Premise: holds (PR #33369 merged; the key parses on
fc283d6d)Serial constraints cleared: PR #33394 (awaiting merge) appends eval 17 to the same evals file — append after it, merge
mainonce it lands; PR #33292 ownsdata-hooks.md, untouched; #33373 (ADR text) disjointOrder:
/mnt/project-files/pm-orders/skills/order-33374.md(project file). Ruling-ref: Leehom 2026-11-14 A+ 「开关打开后,能读主记录的人按子对象自己的授权新增、修改、删除,默认不变。」 (record 6880588685 on #33250). Claimed 2026-11-14T20:07Z.objectstack-fleet commentedon Nov 14, 2026
domain:skills#1 · os-project-manager · session_01FEkQ5pfprxUTKxctsoaYzF
os-dev-report
{
"issue": 33374,
"status": "done",
"branch": "claude/project-thread-jqd53n",
"pr": "#33427",
"session": "session_01FEkQ5pfprxUTKxctsoaYzF",
"premise_still_valid": true,
"summary": "skills/objectstack-data/rules/relationships.md (the rule's home) now teaches sharing.controlledByParent.writeRequiresMasterRead beside ownerMayEdit: default master edit unchanged; with the key, whoever reads the master inserts, updates and deletes under the detail's own object permissions, RLS and FLS (re-points, opted-in chain hops, on-behalf-of needs both users to read); the ownership floor still binds predicate and on-behalf-of updates and deletes (N3); refused beside ownerMayEdit: true, off controlled_by_parent and one level up; the owner-policy lint arm is silent. The table cell and optional-master sentence the key made incomplete are corrected, eval 17 added, and the text is paid in-file (4127/4127 tokens) by deleting three name-only boilerplate parent objects from the lookup and junction examples. SKILL.md, lint-rules.md and record-page.md read and left unchanged (no sentence made false). Wording confirmed identical with the #33373 ADR thread.",
"tests": "Docs-only skills diff: no behaviour change, so no unit test or ablation owed. node scripts/check-skills-token-ratchet.mjs exit 0 (relationships.md 4127 tokens, ceiling 4127, headroom 0; first wording 4141, shortened). node scripts/pm/check-skill-line-ratchet.mjs exit 0. Eval 17 JSON parses; each must_contain literal is in its expected_output and in relationships.md; its must_not_contain literal is in neither. Head 4629a84.",
"gates": "Local, head 4629a84: dispatch-gates --commands derived 44 families; 42 exit 0, 2 exit 3 PREREQUISITE NOT MET (check:dual-build-cjs-loads, check:lean-entry-closure: need every package dist; no package touched; CI runs them). Prerequisite build @objectstack/formula + @objectstack/lint under os-verify-lock VERDICT command-exit 0 (104s). --ran: 44 derived famil(ies) accounted for, 42 run, 2 NOT-MEASURED (derived from recorded exit 3). Record: /mnt/project-files/pm-orders/skills/33374-gates-ran.txt. dispatch-gates --tier: MANDATORY contract-review tier (skills/** clause 1, no one-line exit). check-governed-merges --branch: exit 3 GOVERNED, landing tier H, 2 of 3 paths on the register, +47/-40. CI check-runs on PR 33427: in_progress at report time; the seat reads them.",
"dogfood_battery": "n/a: no ! in the PR title and no (narrowing) arm",
"mcp_calls": "4: mcp__github__issue_read x2 (card get, comments), plus 2 read-only REST reads via gh api (PR 33369 body, PR 33394 state; card comments re-read). No MCP write tool used.",
"api_writes": "3 planned: git push (branch), relay pr_create (fleet-write run 43637236414, PR 33427, 9851 bytes sent and stored identical, no labels, no assignees), this os-dev-report comment via post-stamped.mjs.",
"deviations": "(1) Model tier: dispatch-gates --tier reads MANDATORY contract-review tier for skills/**; this thread ran at the claim's default model, so the seat's in-seat contract review is the owed record. (2) Standing lines ask for a trailing signed HTML comment in the PR body; os-dev.md bans HTML comments other than the harness attribution line, so the signature is a prose line under Fixes. (3) Eval id 17 collides with open PR 33394, as the order expected; the second to land renumbers to 18.",
"open_questions": [],
"security_findings": "none",
"out_of_scope_findings": [
"carrier: none, noted only: the skill does not spell the refusal shapes for a non-reader (insert and re-point 403, by-id update and delete 404) or the lifecycle verbs; they live in the ADR-0055 amendment (33373) and the permissions docs, and relationships.md has zero token headroom."
]
}
Generated by Claude Code
objectstack-fleet commentedon Nov 14, 2026
domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb
ACCEPT → PR #33427 comment 6883940854 · contract review PASS 6883930925 · held for the maintainer (Tier H; reviewers requested) · 2026-11-14T20:45Z