docs(acceptance): 17.0 GA acceptance for rc.2 — plan, full report, GA regression checklist - #676
Closed
yinlianghui wants to merge 11 commits into
Closed
docs(acceptance): 17.0 GA acceptance for rc.2 — plan, full report, GA regression checklist#676yinlianghui wants to merge 11 commits into
yinlianghui wants to merge 11 commits into
Conversation
…rent main Rebases the rc.0-era plan from upgrade/objectstack-17 onto the current tree: drops retired surfaces (AI agents #512, competitor #551), adds the activity model (#592/#670), refreshes the metadata census to the rc.2 numbers (17 objects / 26 actions / 24 flows / 5 dashboards / 10 reports), adds the profile permission matrix, four-locale i18n checks, the full-coverage flow pass, and the platform-blocker retest ledger with expected outcomes from the upstream fixes shipped in rc.1/rc.2. Refs #520 #521 #522 #524 #525 #526 #528 #508 #509 #510 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01URfByxcWd39Vv8u5z4F11g
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
github-actions
Bot
added
the
documentation
Baseline (pnpm verify, Playwright e2e 16/16, cold boot) plus the three read-only sweeps: 15/17 objects clean with zero application console errors, 5/5 dashboards and 10/10 reports resolving real data, and the four-locale i18n matrix. Confirms two rc.0-era blockers are lifted on rc.2 (#520 datetime window filters, #523 matrix report date granularity) and records the honest account of one hypothesis the probes disproved. Write-phase sections are marked as being filled in. Refs #520 #523 #494 #645 #661 #671 #680 #681 #682 #683 #684 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01URfByxcWd39Vv8u5z4F11g
…hases The write phases run serially in the orchestrating session; this documents the alternative delivery the maintainer asked for — five packages that can each be driven from a separate chat, with per-package record prefixes, a shared-server do-not-do list, and the physical-isolation fallback (own port + own DB file). Carries the environment facts this run had to discover: the auth endpoint is /api/v1/auth/sign-in/email (the obvious /auth/login returns 500), and the three entrypoints default to three different SQLite files, so a migrate plan aimed at the dev server's database needs an explicit --database-url. Refs #507 #508 #509 #510 #515 #520 #521 #522 #523 #524 #525 #526 #528 #548 #549 #671 #684 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01URfByxcWd39Vv8u5z4F11g
…cts it found REST-layer CRUD passes on all 17 objects with zero leftovers; the console New form for crm_lead is unusable because the renderer ignores visibleOn while enforcing required (#688). Also files the SQL-layer validation path (#689), the null nameField formula (#690), the 403-for-a-missing-parent shape (#691), the lookup redisplay (#692) and the mis-addressed cascade delete errors (#693). Two rc.0-era records are overturned and stated as such: there is no contract status board on main, and kanban drag IS automatable with the real mouse API. #525 does not reproduce — cross-tab values survive a failed submit. The honest-record section now carries the full arc of one hypothesis that was disproved and then reinstated on further evidence, since stopping at either intermediate step would have published a wrong conclusion. Refs #515 #520 #523 #525 #547 #671 #684 #688 #689 #690 #691 #692 #693 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01URfByxcWd39Vv8u5z4F11g
… regression checklist The sweep stopped early when the session budget ran out, so the report now says so plainly: five of eight planned sections executed, three (full actions, full flows, profile permission matrix) did not, and the six remaining blocker retests are listed as unverified rather than silently absent. Adds the GA minimal-regression checklist the run was asked for, marking each item as either verified-this-round or still-unverified so the next session can tell what it is confirming versus testing for the first time. Records the teardown honestly, including the leftover W2 test records and the two defects that blocked their deletion — one filed as #696, the other left unfiled because it plausibly duplicates #548 and was not isolated. Refs #494 #520 #521 #522 #523 #525 #548 #645 #661 #684 #688 #696 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01URfByxcWd39Vv8u5z4F11g
yinlianghui
changed the title
…ence The evidence lived only in the session scratchpad, which dies with the container — so a colleague picking this up on their own account would have inherited a report full of references to files they cannot open. The four executor records, the blocker-retest playbook and the profile expectation matrix are now in the repo (116KB of text); the ~200 screenshots are not, and evidence/README.md says so plainly rather than leaving dead references unexplained. HANDOFF.md is the entry point: what is done, what is not, the three commands to get running, the eight environment traps this run hit, and the one observation deliberately left unfiled because it may duplicate #548. Also replaces the four '(填充中)' placeholders in the result matrix with an explicit 未执行, so nothing unrun can be misread as in progress. Refs #520 #523 #548 #684 #688 #696 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01URfByxcWd39Vv8u5z4F11g
…ted on rc.2 Isolated-environment retest (own port, own DB file, nothing shared at risk): migrate now detects an occupied database at plan time, refuses apply before any DDL with a --force escape hatch, and demands --yes even when free — the rc.0 confirmation-less DDL behaviour is gone. On a fresh rc.2 database all five __search columns are live and plan reports in-sync, with a planted junk column proving the orphan detector still fires; the orphan condition this issue tracked only exists on rc.0-era databases. One residual recorded on the issue rather than filed: the occupied-DB refusal exits 0, which scripting would misread as success. Refs #526 #528 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01URfByxcWd39Vv8u5z4F11g
…rdicts The relaunched action executor covered all 26 actions: 25 pass with verified data artifacts, the one failure being mass_update_stage. Blocker retests are now 10/10 — nine lifted (including all three rc.0 upgrade blockers), #508 still reproducing on every invocation path though now honestly. All verdicts are commented on their issues with evidence. Also records the quantified #548 evidence (ctx.api inserts never stamp owner_id, making any record with a logged activity undeletable for everyone), files #698 (case autonumber lag + burn-on-failure), and retracts W1's silent-no-op finding after W2B could not reproduce it — the retraction and its reasoning live in the honest-record section. Refs #508 #509 #510 #520 #521 #522 #523 #524 #526 #528 #548 #673 #682 #684 #688 #696 #698 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01URfByxcWd39Vv8u5z4F11g
…ct, three new issues All 24 flows verified with run-store evidence (trigger.userId per run): screen flows re-confirmed, all nine record-change flows healthy on the user-session path, both approval flows through approve and reject with lock enforcement, all seven scheduled sweeps exercised via manual trigger with idempotency checks, and demo_bootstrap green under the #663 shape. The #684 verdict is the headline: user path healthy, system path fully broken, demonstrated in-window as an approval bypass — a 50K flow-created deal shipped approval_status=not_required with no request. Files #700 (automation create_record inserts owner_id/organization_id NULL — sweep-created records born admin-untouchable on real installs), #701 (record-change flows re-enter on their own write; the engine loop-breaker, not the authored condition, is what stops the loop) and #702 (re-seed × snapshot phantom forecast row). Refs #507 #548 #617 #663 #671 #684 #690 #696 #698 #700 #701 #702 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01URfByxcWd39Vv8u5z4F11g
…ections complete The 5-profile matrix (188 probes) is the run's heaviest result: the app's declared authorization posture is largely fiction at runtime. Five platform root causes — a member_default wildcard grant that voids the object gate on create/read/edit (#703), controlled_by_parent reads going org-wide and leaking line-item pricing (#704), modifyAllRecords and edit-shares granting no write (#705), a regressed campaign RLS widener (#706), and admin bypassing the export hard-gate (#707) — plus demo_bootstrap confiscating user records (#708) and matrix docs promising unfulfillable writes (#709). FLS, private-OWD read sets, is_private RLS, share reads and the four personas' export bits are the layers that match exactly. #548 is confirmed systematically: ownership splits across three columns and a complete hand-off is impossible. Finalizes the TL;DR (GA not recommended until the permission model, #688, the ownership/write family and #684 are fixed), adds §6d, the C2 permission gate to the GA checklist, and squares §8/§10 with what the later phases proved. All eight planned sections are now executed. Refs #547 #548 #620 #684 #688 #700 #703 #704 #705 #706 #707 #708 #709 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01URfByxcWd39Vv8u5z4F11g
yinlianghui
changed the title
…cuted Reframes HANDOFF.md from a mid-run baton-pass to a re-run/repair guide now that every section is done, and puts the one-line GA verdict up top: not recommended to ship until the permission model (#703/#704), lead-create UI (#688), the ownership/write family (#548/#700/#705) and #684 are fixed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01URfByxcWd39Vv8u5z4F11g
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Acceptance-testing deliverables for the 17.0 GA release, run on current
main(@objectstack/*17.0.0-rc.2 — the task targeted rc.1, butmainmoved to rc.2 in #663 before this run started, so every verdict is stated against rc.2).All eight planned sections executed. Automation baseline, object CRUD, 26 actions, 24 flows, 5 dashboards + 10 reports, four-locale i18n, the 5-profile permission matrix, and all ten platform-blocker retests.
Type of Change
Related Issues
Filed this run (23): #680 #681 #682 #683 #684 #688 #689 #690 #691 #692 #693 #696 #698 #700 #701 #702 #703 #704 #705 #706 #707 #708 #709
Retested / updated with rc.2 data (15): #494 #508 #509 #510 #521 #522 #524 #525 #526 #528 #548 #645 #661 #673 #682
Changes Made
docs/acceptance-17/test-plan.md— plan rebased onto currentmaindocs/acceptance-17/test-report.md— full results, evidence, honest record, and the GA minimal-regression checklistdocs/acceptance-17/parallel-task-packages.md— P1–P5 task packagesdocs/acceptance-17/HANDOFF.md+evidence/— handoff page and the run's text evidence (executor records, retest playbook, permission matrix).changeset/acceptance-17-rc2-test-plan.md— empty-frontmatter changeset (docs-only)No
src/changes — the mandate was test-don't-fix.Headline results
Green / lifted
pnpm verifyexit 0 (vitest 1280 passed), Playwright e2e 16/16Blocking for GA
member_default的*通配授权(C/R/E)并集合并进每个成员 —— 应用的 explicit-allow 对象门在建/读/改三轴上被整体架空,任何 profile 都能在任何对象上建记录 #703/[17.0-rc][疑似平台]controlled_by_parent的读取是全组织开放而非随父派生 —— service_agent 在 0 个可见商机下读到全部 74 条行项目(金额、单价、合计) #704 (p0, platform) — the permission model is default-open: amember_defaultwildcard grant voids the object gate on create/read/edit for every profile, andcontrolled_by_parentreads go org-wide (a service agent with 0 visible opportunities reads all 74 line-item prices)visibleOn,并强制其required—— crm_lead 在 UI 上完全无法创建 #688 (p0, console) —crm_leadcannot be created through the UI (renderer ignoresvisibleOnwhile enforcingrequired)ownerlookups vs the platform'sowner_id— reassigning Owner in the UI does not move record access #548 / [17.0-rc][疑似平台] 自动化引擎 create_record(系统扫)插入的行 owner_id/organization_id/created_by 全 NULL —— 出生即连 admin 都无法改删;demo_bootstrap 十分钟内会"自愈" owner_id,真实安装没有这根拐杖 #700 / [17.0-rc][疑似平台] 写扩权全部失灵:modifyAllRecords对行级写门无效,edit 级sys_record_share实际只给读 —— sales_manager 改不了任何非本人创建的记录 #705 / demo_bootstrap 的认领扫会把 owner 未显式设置的用户新建记录改判给第一个用户 —— rep 刚建的报价 10 分钟内被静默没收 #708 — the ownership/write model is broken: ownership splits across three columns and a complete hand-off is impossible; automation- and action-created rows are bornowner_id-NULL and undeletable even by admin;modifyAllRecordsand edit-shares grant no write;demo_bootstrapconfiscates user recordsrunAs: 'system'treatment the scheduled ones did — every system-driven write refuses their data ops (12 failed runs on one boot) #684 — record-change flows lackrunAs:'system', so system-driven writes fail; demonstrated in-window as an approval bypass ($150K flow-created deal shipped with no approval request)mass_update_stagehas no working invocation pathThe report's TL;DR states plainly that 17.0 GA should not ship a permission-bearing HotCRM until these are fixed and the §11 checklist re-passes.
Three rc.0-era records overturned and stated as such: #525 does not reproduce, there is no contract status board on
main, and kanban drag is automatable via the real mouse API. One W1 finding (silent screen-flow no-op) was retracted after W2B could not reproduce it.Testing
pnpm test— 1280 passed / 1 skipped)pnpm lint)pnpm build)Screenshots
Not applicable (docs-only). ~200 evidence screenshots live in the run's scratch directory; the committed
evidence/holds the text records.Checklist
src/modifications🤖 Generated with Claude Code
https://claude.ai/code/session_01URfByxcWd39Vv8u5z4F11g