Repository navigation
spec: the security-catalog migration entry and the D6 override gloss still say a permission set holds one name per deployment #33388
Description
domain:spec#1 · os-project-manager · session_01FEkQ5mswnWm181XgYcCUag
Follow-up of #32758 (PR #33384), its dev report 6882046858 open_questions 1 and 2. Seat ruling: option B for both, one card.
Since #31698 PR 2 (PR #32742) a permission-set name is held once per namespace, so two present-tense spec sentences are false for permission sets:
packages/spec/src/migrations/entries/semantic/18.security-catalog-environment-overlay-refused.ts,reason: "Positions, permission sets and capabilities hold one name per deployment". The entry's subject (an environment row and a package holder never share a name) still holds.
TO: reword the reason around that subject, e.g. "the environment catalog and a package never hold one name";id,surface,replacementunchanged. Prose only,@objectstack/specpatch.packages/spec/src/kernel/customization-package.ts:251-252, theadr_0146_d6_security_cataloggloss "D6: one name per deployment (permission sets, positions, capabilities)".
TO: "D6: the security catalog takes no override (permission sets, positions, capabilities)". Comment only.
Clause-②: no / Metadata-protocol: none. Waits for #33384 to merge (same subject; avoids two texts disagreeing mid-flight).
class: b · type: Docs · Grade: p3 · domain: spec
Activity
objectstack-fleet commentedon Nov 14, 2026
domain:spec#1 · os-project-manager · session_01FEkQ5mswnWm181XgYcCUag
Added from PR #33384 contract review (N4, N5) · 2026-11-14T18:26Z
content/docs/permissions/permission-sets.mdx: the one-holder list docs(spec): the permission set name describe and the permission sets page say one holder per namespace #33384 adds omits the environment, which meets every holder at both doors; add it.objectstack-fleet commentedon Nov 14, 2026
domain:spec#1 · os-project-manager · session_01FEkQ5mswnWm181XgYcCUag
Claim: PM loop round 1 · 2026-11-14T20:52Z
Session:
session_01FEkQ5mswnWm181XgYcCUag(seat); card threadsession_01FEkQ5prrsuzKUWCmEzwMEbis the devAccount:
os-project-managerBranch:
claude/project-thread-deqozc(the card thread's designated branch; the platform lets a thread push only that branch, so notclaude/issue-33388-*)Worktree:
objectstack-issue-33388Domain:
domain:specSeat:
domain:spec#1File surface:
packages/spec/src/migrations/entries/semantic/18.security-catalog-environment-overlay-refused.ts(reasononly),packages/spec/src/kernel/customization-package.ts(the D6 gloss comment),content/docs/permissions/permission-sets.mdx, a pin test only if the old sentence is pinned, root.changeset/(stop on breach; explain in the report)Container & model:
S,mode:thread,model: default tier(text only),effort: mediumClause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: 6882204943
Premise: holds at
origin/main2797f81d: the entry'sreason(~:27) andcustomization-package.ts:252still say permission sets hold one name per deployment, false since PR #32742; #33384 (merged 2026-11-14T20:51Z) fixed the describe and one docs bullet. Taken under 「p1 p2 处理完了，就可以处理 p3」 (2026-10-26; Ruling-ref). Order:/mnt/project-files/pm-orders/spec/order-33388.md(project share).Serial constraints cleared: #33384 merged; #33246 and #33153 in flight touch
packages/lintonly.objectstack-fleet commentedon Nov 14, 2026
domain:spec#1 · os-project-manager · session_01FEkQ5prrsuzKUWCmEzwMEb
os-dev-report
{
"issue": 33388,
"status": "done",
"branch": "claude/project-thread-deqozc",
"pr": "#33445",
"session": "session_01FEkQ5prrsuzKUWCmEzwMEb",
"premise_still_valid": true,
"summary": "Head ab08295 off origin/main 2797f81 (#33384 merged, d38ceba is an ancestor). Migration entry 18.security-catalog-environment-overlay-refused: reason now opens 'The environment catalog and a package never hold one name: a package registering a name the environment catalog already holds was already refused on a hot install.'; id, surface, replacement, acceptanceCriteria and the rest of reason byte-identical. customization-package.ts adr_0146_d6_security_catalog gloss: 'D6: the security catalog takes no override (permission sets, positions, capabilities)' (comment only). permission-sets.mdx: one-holder list adds 'the environment' (same list and order as the PermissionSetSchema.name describe), and 'a grant names its set by name (sys_user_permission_set.permission_set)' became 'by its package and name (sys_user_permission_set.permission_set_package and permission_set)'. Changeset .changeset/33388-security-catalog-entry-reason.md, @objectstack/spec patch, Clause-②: no / Metadata-protocol: none. No second copy in registry.ts.template; every projection (registry.ts, spec-changes.json, upgrade guide) is gitignored, so files_changed = 4.",
"files_changed": [
"packages/spec/src/migrations/entries/semantic/18.security-catalog-environment-overlay-refused.ts",
"packages/spec/src/kernel/customization-package.ts",
"content/docs/permissions/permission-sets.mdx",
".changeset/33388-security-catalog-entry-reason.md"
],
"line_budget": "+18 -7 across 4 files (3 edited, +8 -7; 1 new changeset, +10)",
"tests": "No behaviour change: no test added, no ablation. Neither old sentence is pinned (git grep 'one name per deployment' on origin/main: packages/spec/src hits only the two edited lines plus permission.zod.ts:1209, positions/capabilities, still true; test hits are other types' refusal sentences, comments, one test title). After turbo build of spec: regenerated (gitignored) packages/spec/src/migrations/registry.ts and dist/migrations/index.{js,mjs} carry the new sentence, old one absent. On ab08295: pnpm --filter @objectstack/spec typecheck exit 0; pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2 src/migrations src/kernel/customization-package: Test Files 6 passed (6), Tests 263 passed (263); lock VERDICT command-exit 0.",
"gates": "On ab08295, dispatch-gates --commands --repo objectstack-ai/objectstack derived 103; loop with timeout 900 each, exit captured before any pipe. 101 exit 0 in loop. check:skill-examples exit 3 in loop (client-react dist missing), then exit 0 after building client + client-react closures. check:dual-build-cjs-loads exit 3 PREREQUISITE NOT MET (needs every package dist) = NOT MEASURED, left to CI. --ran: '103 derived famil(ies) accounted for — 102 run, 1 NOT-MEASURED (1 DERIVED from a recorded exit 3)'. Extra: spec check:generated exit 1 only from check:test-typecheck 'tsc -p failed without diagnostics' under load; check:test-typecheck alone exit 0; other 13 artifacts up to date. check-nul-bytes exit 0. Record: /mnt/project-files/pm-orders/spec/33388-gates-ran.txt. PR check-runs: in_progress at report time.",
"dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
"mcp_calls": "0",
"api_writes": "2 relay writes + 1 git push: pr_create (fleet-write run 43642263342, PR #33445; labels none, assignees none), this os-dev-report comment via post-stamped.mjs on #33388",
"deviations": [
"PR body ends with the harness footer form (robot line + session URL) rather than os-dev.md's session-URL 'Generated by' footer; dev does not PATCH PR bodies, so the seat may rewrite it via issue_patch if it matters.",
"Human Minimum items 3 (pnpm lint) and 'Before Submitting' left unchecked in the PR body: pnpm lint is CI's run and was not run locally."
],
"open_questions": [],
"security_findings": "none",
"out_of_scope_findings": [
"class: a · reach: exception: release-text — packages/objectql/src/registry.ts:2818 (coldBootConflictMessage) and :2880 (SecurityCatalogNameConflictError hot-install text) still say 'Positions, permission sets and capabilities each hold one name per deployment: an assignment names a position or a permission set by its bare name'. The refusals still fire correctly for a permission set (environment item, co-owners of one namespace, platform holders), but since #32742 a grant carries permission_set_package, so the stated reason is false for permission sets in a shipped runtime message. Already listed in PR #33384's acceptance notes. dedupe words: SecurityCatalogNameConflictError, coldBootConflictMessage, 'one name per deployment', 'bare name', permission_set_package",
"carrier: none · ADR-0048 2026-10-08 addendum and ADR-0146 D6 text (:263, :472), test comments showcase-security.ts:32, showcase-d7-default-profile.dogfood.test.ts:65, protocol-boot-hydration-scoped.test.ts:217, served-override.test.ts:70 title, released packages/spec/CHANGELOG.md — decision records, comments and release-owned text, noted in PR Acceptance notes, not filed"
]
}
Generated by Claude Code
objectstack-fleet commentedon Nov 14, 2026
domain:spec#1 · os-project-manager · session_01FEkQ5mswnWm181XgYcCUag
ACCEPT → PR #33445 comment 6884707451 (ready + auto-merge, 2026-11-14T21:48Z).