docs(skills): the security rules teach a position rename through renamedFrom - #33480

domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 47d3f8e831b14af118bb63824bd9bf599513466a
Local-runs: none
Scope: skills/objectstack-data/rules/security.md + none

Read on origin/main (code outside the diff, read, never reviewed): packages/spec/src/identity/position.zod.ts (renamedFrom, its JSDoc and .describe), packages/spec/src/identity/position-renamed-from.ts (refuseSelfRenamedFrom, refuseDishonestPositionRenamedFrom, wired in packages/spec/src/stack.zod.ts), packages/plugins/plugin-security/src/position-renamed-holder-carry.ts (module doc, the judgement loop, carryHolders, REFERENCE_SOURCES, logPositionRenameCarry), packages/spec/src/shared/identifiers.zod.ts (SnakeCaseIdentifierSchema), packages/spec/src/security/explain.zod.ts, skills/objectstack-data/rules/field-types.md, and every eval under skills/**/evals that names security.md content.

Gates: the check-runs on this head read 0 failures at render time; Type Check, Lint, Build Core, Test Core (1/8, 2/8), Live E2E UI and one Check Changeset run were still in progress. Their conclusions are the gate verdicts; this record does not stand in for them.

① Derived judgments

• No accept-set or public-surface change: the diff is skill prose plus one changeset. No schema, no runtime, no published type moves. Right.
• The skill now teaches one key the spec already accepts on main: PositionSchema.renamedFrom, an optional array in the position-name grammar (SnakeCaseIdentifierSchema, lowercase snake_case, two characters or more). The taught spelling renamedFrom: ['old_name'] parses. Right.

② Semver level

• .changeset/33044-skills-position-renamed-from.md is '@objectstack/skills': patch; packages/skills/package.json is that package and ships skills/**. Prose correction to a published skill is a patch. Right.
• Clause-②: no on the PR body and the changeset: no published spec or schema surface is touched. Right.

③ Boundary flags

• Dev flag "at boot" vs hot install: answered in ④ finding 1, graded nit, accepted as is.
• Dev flag, the restored install-refusal clause: answered in ④ finding 6; the eval holds.
• Dev flag, the run on the claim's default tier: this record is the owed at-tier review.
• Dev flag, signature as a prose line instead of a trailing HTML comment: outside ④'s scope; no effect on the contract.
• Dev flag, origin/main moved past the merge base: git diff of the merge base to origin/main touches neither diff file (only references/data-hooks.md under skills/objectstack-data). No conflict.
• open_questions: none.

④ Design judgment

skills/objectstack-data/rules/security.md, the new Renaming a position paragraph, sentence by sentence against the code on main:

• Grammar: renamedFrom: ['old_name'] on the renamed position matches the schema and its .describe. Holds.
• "never delete and re-add (holders lose its sets)": the carry's § Why: a sys_user_position row names the position by bare name, so a deleted position leaves its holders granted nothing. Holds.
• "At boot ... move to the new name": kernel:bootstrapped run over every claim. Holds (see finding 1 on hot install).
• "in every organization": carryHolders reads sys_user_position filtered on the position column alone, as the system, so every organization moves, rows with no organization included. Holds.
• "idempotently": a carried name leaves no row on the old name, so the next run reads nothing to move. Holds.
• "Only holders: the boot log lists other references (sharing, queue and share recipients, pending approvers, invitations) for an admin": REFERENCE_SOURCES reads sys_sharing_rule, sys_queue_member and sys_record_share recipients, sys_approval_approver and pending sys_approval_request.pending_approvers, pending sys_invitation.positions (and activation-ledger rows), each logged at warn by logPositionRenameCarry, never written. Holds; see finding 4.
• "Not carried (warned)": the five items map to the six boot refusals: "still a position anywhere" = still-declared + held-by-other (a cycle is this case, as the schema JSDoc says); "claimed twice" = claimed-twice; "recorded under another package" = owned-by-other; "switched off" = switched-off; "a disabled claimant" = claimant-disabled. Each is a warn line and leaves the holders. Holds; see findings 2 and 3.

Findings:

1. nit (accepted deviation, no fix owed) — "At boot" alone. The code also runs on each metadata:reloaded after the boot (marketplace hot install or upgrade, per-item publish), judging only the scope the announcement names. "At boot" is never false: every claim is judged at boot, and a reload only carries some of them sooner. An author does nothing different either way, and the narrower reload scope (doors that announce no reload wait for the next boot) makes "at boot" the one promise that always holds. Not wrong enough to need a fix.
2. nit — "recorded under another package" leaves out one owned-by-other case: the ledger row carries the environment's sentinel (sys_metadata), so a package's claim on an old name the environment authored is refused too. This is a rare edge case and the boot warning names it. An optional fix on the prose face, at the same cost, is "recorded under another owner".
3. nit — "(warned)": within one package's positions collection, an old name it still declares (a cycle included) and two claimants are refused when the stack is parsed (refuseDishonestPositionRenamedFrom from stack.zod.ts), and so are the position's own name and a repeated entry (refuseSelfRenamedFrom). Those are errors, not warnings. The author gets a louder failure than the paragraph says, so nothing is lost. The boot warnings cover the cases across packages, as taught.
4. nit (card premise, no fix owed) — card skills: the security rules do not teach a position's renamedFrom (a renamed position carries its holders) — PR #33008's Skills-docs follow-up #33044's body says Setup-authored bodies naming the old name are reported at boot. The carry's module doc says the opposite: "Setup-authored bodies that name an old position are not read". The paragraph lists only what REFERENCE_SOURCES reads, which is right. It does not promise that the list is complete, but that is how it reads. A follow-up could add "Setup-authored metadata is not read" and "re-point your own package's references in source". Neither is owed by the card's Do, which asks only for the boot report's list.
5. nit (accepted) — the cut "(explaining another user needs manage_users)" drops one fact the skill taught. It is the explain door's own authorization, not an authoring rule. It still lives in packages/spec/src/security/explain.zod.ts (the manage_users requirement on another user's explain), which references/_index.md points to. No eval asserts it.
6. The cuts, judged one by one: no taught rule lost beyond finding 5. (ADR-0090 D12) is a citation. "(no read on the roster needed)" is still said by "as a system read". The com.acme.crm / hd_agent and hr / ops / auditor examples were illustrative; both rule sentences stay. The sys_secret ciphertext sentence is covered by the secret row in rules/field-types.md (encrypted at rest, masked, fail-closed, ADR-0100). The adapter aside and "the list renders empty" are diagnostic colour, and the null-organization_id denial stays. "an app-declared default profile, a customer-authored set" is covered by "any set with a wildcard read grant". The merged type: 'secret' heading keeps the presence-only query rule whole.
7. Evals hold. hooks-security-seeds-datasources.json case 19 (hd_agent outside the closure) asserts permissionSets: ['hd_agent'], dependencies: { and outside-closure. Its expected output says "a second package shipping the name is refused at install". The rule sentence, the outside-closure definition, "Fix: declare the dependency" and the restored install-refusal clause are all in the file at this head. Case 18 (queue outside-closure) cites text this diff does not touch. Cases 6 and 17 (membershipKeys) keep their facts. Case 16 (posture) keeps its facts. No other eval in skills/**/evals names text this diff changed. objects-fields-relationships.json case 15 teaches a field's renamedFrom, from another file.

No must-fix, no should-fix. Nits alone end the round.

Implemented-by: claude/project-thread-6ouxnr
Reviewed-by: session_01FEkQ5pjSPT7ui2EUcunaVb

VERDICT: PASS

_{Adopted by the seat 2026-11-14T22:31Z · isolated sub-agent at CONTRACT_REVIEW_TIER · Ruling-ref: Leehom card cmsg_01TenzsRopZj4jMbvjX8uz1XFhuiZmTH8VFgMmHRmpiGAb, option A, tapped 2026-11-14T15:37Z}

domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb

维护者速读

• 改了什么:objectstack-data 技能 rules/security.md 的“改名或删除已发布的权限项”一节新增一段：岗位改名要在新岗位上写 renamedFrom: ['old_name'],不要删了再建;启动时旧名的持有人(sys_user_position)在所有组织里幂等迁到新名;只迁持有人，共享规则、队列与记录共享接收人、待审批人、邀请等其他引用只在启动日志里列给管理员;旧名仍是岗位、被认领两次、记在别的包下、已关闭或认领方被停用时不迁，记警告。外加 patch changeset。
• 为什么改：规范早已支持 PositionSchema.renamedFrom,技能没教，AI 改岗位名会删了重建，持有人丢权限(卡 skills: the security rules do not teach a position's renamedFrom (a renamed position carries its holders) — PR #33008's Skills-docs follow-up #33044)。
• 风险与回滚：只改技能文字，不动 schema 与运行时;在原文件内删掉别处已有的例子和旁注腾出 token,上限 3959 未动。回滚即还原本 PR。
• 先看:skills/objectstack-data/rules/security.md 的 Renaming a position 段落。
• 两分钟验证:git diff origin/main -- skills/。
• 需要你做的：受管面 Tier H(skills/**),契约复审 PASS 评论 6885229673(Head-sha 47d3f8e831b14af118bb63824bd9bf599513466a)已在案，请批准或直接合并。
• 席位意见：可以合。复审逐句对照 position.zod.ts、position-renamed-from.ts 与 position-renamed-holder-carry.ts,语法、跨组织、幂等、拒绝条件、不迁清单均成立;只有措辞小问题。

席位核对

Verdict: ACCEPT, held for the maintainer · head 47d3f8e831b14af118bb63824bd9bf599513466a · card #33044 · report 6885028339 · contract review 6885229673 (PASS on this head, CONTRACT_REVIEW_TIER; Ruling-ref for the in-seat review: Leehom card cmsg_01TenzsRopZj4jMbvjX8uz1XFhuiZmTH8VFgMmHRmpiGAb option A).

• Shape: draft → main, Fixes #33044. skills/objectstack-data/rules/security.md (+22 / -20), one '@objectstack/skills': patch changeset. GOVERNED, Tier H (skills/**). Clause-②: no.
• Contract: renamedFrom: ['old_name'] parses under SnakeCaseIdentifierSchema; carryHolders reads sys_user_position by the position column alone, as the system, so every organization moves; a carried name leaves no row on the old name (idempotent); REFERENCE_SOURCES are each logged at warn by logPositionRenameCarry, never written. The five "not carried" cases cover the code's six boot refusals.
• Token payments: security.md 3957 → 3959 at ceiling 3959, no ceiling moved. Eval hooks-security-seeds-datasources.json case 19 still holds; cases 6, 16, 17, 18 unaffected.
• Gates: 44 derived, 42 exit 0, 2 NOT MEASURED (no package touched). Check-runs on the head all concluded, none failing.
• Accepted deviations (review nits): "at boot" also runs on a hot install for what that event names, never false; "recorded under another package" omits the environment owner (rare, the boot warning names it); single-package conflicts fail louder at parse than "(warned)" says; the cut "(explaining another user needs manage_users)" is an explain-endpoint authorization rule still in explain.zod.ts, not an authoring rule.
• Card premise note: the card said Setup-authored bodies are reported at boot; the code does not read them. The paragraph lists only what the code reads. A follow-up is not filed unless asked.
• Process: the thread ran at the default tier, met by this in-seat review.
• Landing: Tier H. The seat does not flip this PR ready or enqueue it. It needs the maintainer's merge, or an authorised APPROVED review after which the seat lands it.

domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb

Correction: contract-review tier

The contract-review record(s) 6885229673 on this PR say Served-tier: CONTRACT_REVIEW_TIER, and the seat adopted them as "isolated sub-agent at CONTRACT_REVIEW_TIER". That is wrong. The seat launched the reviewing sub-agent without the tier, so it ran at the seat's own default tier, not at CONTRACT_REVIEW_TIER. The seat found this on its own audit. The review was still isolated and adversarial, and its findings stand as an off-tier review. They are not the at-tier record AGENTS.md and the in-seat review ruling require.

The seat re-runs the review at CONTRACT_REVIEW_TIER on this PR's head and posts that record here. Until it does, this PR has no at-tier record.

domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 47d3f8e831b14af118bb63824bd9bf599513466a
Local-runs: none
Scope: skills/objectstack-data/rules/security.md + none

At-tier re-review of a merged head (merged as 8e63ed8777; skills/objectstack-data/rules/security.md on main is byte-identical to this head). The earlier record 6885229673 is not used as evidence; ③ says which of its findings this review confirms. A finding here becomes a follow-up card, not a fix on this PR.

Read, never reviewed (code outside the diff, at this head): packages/spec/src/identity/position.zod.ts (renamedFrom, its JSDoc and .describe), packages/plugins/plugin-security/src/position-renamed-holder-carry.ts (module doc, PositionRenameRefusal, REFERENCE_SOURCES, readLeftBehind, the tail of carryRenamedPositionHolders, REFUSAL_SENTENCE, logPositionRenameCarry), its wiring in security-plugin-start-hooks.ts, skills/objectstack-data/rules/field-types.md (the password and secret rows), skills/objectstack-data/evals/hooks-security-seeds-datasources.json (cases 18 and 19), packages/skills/package.json, .changeset/config.json, and a grep of skills/** for every phrase the diff cut.

Gates: every check-run on this head concluded success or skipped; none failed, none pending. That includes Lint and Repo Gates (the token ratchet, skill links, skill identifier liveness), the three Check Changeset runs, Type Check, Build Core, Test Core, and both Governed Surface Queue Guard runs.

① Derived judgments

• Accept-set: unchanged. The diff is one skill file and one changeset; no schema, runtime or published type moves. Right.
• Public surface: the published skill gains one taught key, PositionSchema.renamedFrom, which the spec on main already accepts (optional array of SnakeCaseIdentifierSchema). The taught spelling renamedFrom: ['old_name'] parses and matches the schema's own .describe example shape. Right.
• Token ceiling: not raised; no ratchet baseline file is in the diff, and the ratchet check-run is green. The paragraph is paid for by deletions in the same file. Right as a derived judgment; the deletions themselves are judged in ④.

② Semver level

• .changeset/33044-skills-position-renamed-from.md declares '@objectstack/skills': patch. packages/skills/package.json is that package and ships skills/**; it sits in the fixed group, where a patch is the smallest bump. Additive prose in a published skill, no behaviour change: patch is right.
• Clause-②: no on the PR body and in the changeset: no published spec or schema surface is touched, and no narrowing is declared or made. Right.

③ Boundary flags

Dev flags (report 6885028339, deviations):

• Ran on the claim's default tier although skills/** owes the contract-review tier: answered by this record, rendered at tier.
• Signature as a prose line, not a trailing HTML comment: no effect on the contract; outside ④.
• "At boot" although the carry also runs on metadata:reloaded: answered in ④ finding 1 (nit).
• The install-refusal clause first cut, then restored: answered in ④; the clause is in the file at this head and eval case 19 still finds its facts.
• origin/main moved past the merge base without a merge: moot, the PR merged clean and main carries the file unchanged.
• open_questions: none.

The earlier record 6885229673, finding by finding:

• Its 1 ("at boot" alone): confirmed, nit.
• Its 2 ("recorded under another package" omits the environment sentinel): confirmed, nit.
• Its 3 ("(warned)" although single-collection conflicts are parse errors): confirmed, nit.
• Its 4 (the card says Setup-authored bodies are reported; the code does not read them; the paragraph rightly lists only what the code reads): confirmed against the module doc ("Setup-authored bodies that name an old position are not read"). The card's sentence is wrong, the paragraph is not.
• Its 5 (the cut manage_users aside): confirmed as a nit, with one correction of its account in ④ finding 4.
• Its 6 (the cuts lose no taught rule): confirmed in substance, with one correction: the sys_secret sentence is NOT "covered" by rules/field-types.md. See ④ finding 5.
• Its 7 (evals hold): confirmed for cases 18 and 19, read here; no eval under skills/**/evals names any phrase this diff cut.
• It carried no should-fix, so none is owed a delta on this head.

④ Design judgment

skills/objectstack-data/rules/security.md. The card carries no eval prompt, so the scenario is the card's Do: an authoring agent that must rename a shipped position. Judged against the spec and the carry on main.

The new paragraph, sentence by sentence:

• "declare renamedFrom: ['old_name'] on the renamed position, never delete and re-add (holders lose its sets)": the schema field and grammar match; the carry's Why section says a holder row names the position by bare name, so a deleted name leaves its holders granted nothing. Holds.
• "At boot its holders (sys_user_position) move to the new name in every organization, idempotently": the run at kernel:bootstrapped judges every claim, writes only the position column as the system with no organization filter, and a carried name leaves no row to move at the next run. Holds.
• "Only holders: the boot log lists other references (sharing, queue and share recipients, pending approvers, invitations) for an admin": REFERENCE_SOURCES is sys_sharing_rule, sys_queue_member, sys_record_share, sys_approval_approver, pending sys_approval_request, pending sys_invitation and the activation ledger; each is logged at warn and never written. Holds. Attempt to break it: the list is read only for old names that were carried (carriedOlds), so a refused rename lists nothing. The sentence sits under the carry, so it does not promise otherwise.
• "Not carried (warned): an old name still a position anywhere, claimed twice, recorded under another package, switched off, or a disabled claimant": maps onto the six boot refusals (still-declared and held-by-other; claimed-twice; owned-by-other; switched-off; claimant-disabled), each a warn line that leaves the holders. Holds.
• Against the section it joins: the paragraph above says a rename "stops the old switch-off matching and the item arrives switched on". The switched-off refusal keeps that true and safe: the holders stay on the old, switched-off name and the new position arrives with none. No contradiction.

Findings:

1. nit (accepted deviation). "At boot" leaves out the reload run after a hot install or upgrade. Every claim is judged at boot, so the sentence is never false, and an author acts the same either way.
2. nit. "recorded under another package" leaves out the environment as recorded owner (sys_metadata sentinel). Rare, and the boot warning names it. "recorded under another owner" costs the same tokens.
3. nit. "(warned)" understates one case: inside one package's positions collection, a still-declared old name (a cycle included), a second claimant, the position's own name and a repeated entry are parse errors. The author gets a louder failure than taught; nothing is lost.
4. nit (cut). "(explaining another user needs manage_users)" is now taught nowhere in skills/**: a grep finds manage_users only in this file's platform-admin capability list. It is the explain door's own authorization, not an authoring rule, and no eval asserts it. The earlier record's line that references/_index.md points to it was not verified here and is not relied on.
5. nit (cut, and a correction to the PR body's account). "Ciphertext lives in sys_secret, only an opaque ref on the row" is gone from skills/** entirely; the base tree held sys_secret in this one place. rules/field-types.md keeps "encrypted-at-rest ... masked on read, fail-closed (ADR-0100)", which is the behaviour an author acts on, but not the storage shape. So the PR body's "where the fact still lives" row is true for encryption at rest only. No eval asserts the storage shape, and an author declares the field the same way. The merged heading keeps the presence-only query rule whole, and "Two more channels" now counts its two bold items correctly.
6. nit (new; follow-up candidate). The paragraph says what the platform does with stored references and nothing about the author's own source. A package that renames a position must also re-point its own metadata that names the old one (a shipped sharing rule's position recipient, an approval step's position:NAME slot, an RLS filter over positions). "The boot log lists other references ... for an admin" can be read as "nothing else for the author to do". A renaming agent normally renames usages, and the card's Do does not ask for this, so it is not owed here. Worth half a sentence if the paragraph is next touched, together with the card-premise point that Setup-authored bodies are not read.
7. nit (wording). "At boot its holders": "its" grammatically points at the renamed position, while the holders meant are the old name's. The rest of the sentence ("move to the new name") resolves it.

The other cuts, each read in place: (ADR-0090 D12) is a citation; "(no read on the roster needed)" is still said by "as a system read"; the com.acme.crm / hd_agent and hr / ops / auditor examples were illustrative and both rule sentences, "Fix: declare the dependency" and the install refusal stay; the adapter aside and "the list renders empty" are colour beside a denial that stays; the two dropped example wildcard sets are covered by "any set with a wildcard read grant". No taught rule is lost beyond findings 4 and 5.

No must-fix, no should-fix. Nits alone end the round; on a merged head they are accepted deviations or follow-up material (finding 6, with 2 and the Setup-bodies note, is the one worth a card).

Implemented-by: claude/project-thread-6ouxnr
Reviewed-by: session_01FEkQ5pjSPT7ui2EUcunaVb

VERDICT: PASS

_{Adopted by the seat 2026-11-15T00:34Z · isolated sub-agent at CONTRACT_REVIEW_TIER (served model verified by the seat) · Ruling-ref: Leehom card cmsg_01TenzsRopZj4jMbvjX8uz1XFhuiZmTH8VFgMmHRmpiGAb, option A, tapped 2026-11-14T15:37Z}