feat(objectql,metadata,runtime)!: refuse a package whose position, permission set or capability name is already held by an installed package, the environment catalog or a built-in (ruling Q4 = A on #15196; narrows ADR-0048 §3.4)

[objectstack-fleet]

Filing gate: ③ a task the maintainer assigned directly. On #15196 the maintainer answered 「15196 Q3 A Q4 A」 (ruling record 6050490870, written by the director seat). The record's execution line says: "the seat files the install-time refusal as its own card (with the ADR-0048 §3.4 narrowing note, Tier H, the maintainer's approval) and S1's same-name test locks 'refuse'". This is that card.

• Filed by: domain:services seat 2 (seat post [PM seat] domain:services · seat 2 — ⏳ vacant #21118), session_01WMQprn46CND82KmY8sZWBu, for triage.
• ⛔ Not graded or routed here, and ⛔ not a claim.
• ⛔ Classes, positions and functions only.

Who acts on it:

• triage routes and grades it;
• the claiming seat dispatches it;
• the domain:services seat 2 reads it for feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196's sequence (see "Sequencing" below).

The rule, as ruled

Q4 (6039049826) → A:

The three security catalog types (positions, permission sets, capabilities) each hold one namespace per deployment. Installing or registering a package whose position, permission set or capability bears a name an installed package, the environment catalog or a built-in already holds is refused, the error naming both holders. ADR-0048 §3.4's retirement of the cross-package throw is narrowed to leave these three types out: an assignment carries a bare name with no package context, so for the security catalog a shared name is a real ambiguity, not the disambiguable one §3.4 describes for UI metadata.

Not taken:

• B: assignments carrying package + name.
• C: resolution by registration order.

Where today's behaviour is (read on origin/main)

• ADR-0048 §3.4 (docs/adr/0048-cross-package-metadata-collision.md near :244) retired the per-item cross-package throw. Two packages coexist on one bare name, and prefer-local resolution (getItem(type, name, currentPackageId?)) picks between them.
  • A by-name security read has no current package, so a shared name resolves by registration order or by whichever package stored an override.
  • This is the census reading on feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 (6038897018): a list-then-first-wins reader keeps the first item per name.
• The doors a package's positions, permission sets and capabilities register through:
  • AppPlugin's security-metadata registrar (packages/runtime/src/app-plugin.ts near :1007, metadata.registerInMemory over positions / permissions / capabilities);
  • the artifact door (packages/metadata/src/plugin.ts, ARTIFACT_FIELD_TO_TYPE near :122, its loop near :1162);
  • package install in SchemaRegistry (packages/objectql/src/registry.ts). The ADR-0048 Phase 1 namespace gate already lives there: NamespaceConflictError near :1501, which answers 422 with an ADR-0112 envelope. It is the nearest sibling for the new refusal's shape.
• Built-in holders:
  • the platform permission sets that plugin-security puts on its manifest as permissions (security-plugin.ts near :1448);
  • the six built-in identity positions and audience anchors, which feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 stage S2 (in flight) declares as position metadata from the same plugin;
  • the curated platform capabilities.
• The current pin: S1's shared-name pin (P1.2, PR feat(core): one by-name read of the security catalog (ADR-0131 C2, stage S1) #22091) pins today's answer (the registry's precedence for a name two packages ship). It lives in packages/objectql/src/protocol-boot-hydration-scoped.test.ts. S1's unit file packages/core/src/security/security-catalog.test.ts (near :16) points to it under a file name that does not exist (security-catalog-shared-name.test.ts). Correct that pointer in the same change.

What to build (direction; the claiming seat's order is the spec)

1. The refusal at every door above, for the three types only. It names both holders (incoming package, and the installed package, environment catalog or built-in that holds the name). It carries an ADR-0112 envelope (code + status), so the wire answers a 4xx, not 500. Same-package re-registration (idempotent reload) stays allowed, as ADR-0048 §3.4 keeps it.
2. The ADR-0048 §3.4 narrowing, as a dated note. This is Tier H: it needs the maintainer's approval.
3. S1's P1.2 flips from pinning today's answer to pinning the refusal, with its ablation.

Measure first

• Every door a package's item of these types can arrive through: boot, hot install, POST /api/v1/packages, the artifact door. Name any door beyond the three above.
• Every in-repo package and example, for a name this rule would now refuse. The ruling's chat reading was that app-crm and app-showcase do not collide today. A collision would now fail a boot, so it must be found before the refusal ships.
• What the ruling does not cover: an environment-catalog save over a package-held name (ADR-0005 overlay precedence). Report what happens today; ⛔ do not change it without a ruling.
• OS_METADATA_COLLISION=warn downgrades the namespace gate. The ruling says "refused" and names no downgrade, so by default it does not apply here. If the build finds a reason it should, that is an open_question on this card, not a choice.

Sequencing (the domain:services seat 2's call for #15196)

• feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196's S8 switches the catalog readers to the registry. It lands after this card, so that no reader's answer depends on registration order once it reads from the registry.
• The stages before S8 (S2, S4b, S5, S7) do not wait on it.

Dedupe: MCP search_issues, repo-scoped.

• 「refuse installing a package whose permission set, position or capability name another package already holds」 returns 5 results, all closed. [finding] A package's whole declared permission set is dropped on a set-name collision with no diagnostic and no build gate — the comment says "refuse loudly", the code warns through a doubly-optional logger #17516 (a package's declared set dropped on a set-name collision with no diagnostic) is the nearest: a different defect, already closed.
• 「cross-package metadata collision same name security catalog ADR-0048」 returns 62 results; the open ones are finding(metadata-protocol): a second package-less draft save of a package-owned item is refused 409 METADATA_CONFLICT with no If-Match — the save door's head read and the repository's draft package inheritance read different rows #22128, feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196, feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206, refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204 and Epic: packaged-metadata customization (ADR-0126) — flows first, v17 line #12150, and none of them is this. That feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 itself comes back is the positive control.

Dedupe words: security catalog shared name refusal · permission set name collision install · ADR-0048 3.4 narrowing

---

Generated by Claude Code

[objectstack-fleet]

Path: access — one name, one holder, in the security catalog | 缺项 | P1

Triage: first grade, enhancement · priority:p1 · domain:engine · target:v18 · area:access · pm:queue. The ruled install-time refusal (Q4 = A on #15196), as filed

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-08T02:55Z. ⛔ Not a claim, ⛔ not a dispatch.

Triage: lands in the install doors the card names: packages/objectql/src/registry.ts, where the sibling gate NamespaceConflictError and NAMESPACE_CONFLICT live (:1492–:1528 on main), the metadata artifact door in packages/metadata, and AppPlugin's registrar in packages/runtime ⇒ domain:engine; rationale: package registration and the namespace gate are the engine lane's. It refuses an install; it does not change a metadata shape. The packages/runtime door is declared cross-lane on claim.

• Why p1: it is a maintainer-assigned task from the ruling record 6050490870, on the ADR-0131 / feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 v18 line, and feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196's S8 lands after it.
• Direction: as filed. The claiming seat's order is the spec.
  • the refusal at every door, for the three catalog types only, naming both holders;
  • an ADR-0112 4xx envelope, reusing the namespace gate's shape;
  • same-package reload still allowed;
  • S1's P1.2 pin flips to the refusal, with its ablation, and the stale pointer in security-catalog.test.ts is corrected.
• The ADR-0048 §3.4 narrowing note is Tier H. It lands on the maintainer's approval, in its own draft if the code PR cannot carry it.
• Measure first (as filed): every door, and every in-repo package and example name the rule would now refuse. A collision found there is fixed, or reported, before the refusal ships.
• ⛔ Not in this card:
  • an environment-catalog save over a package-held name is reported only (the ruling does not cover it);
  • OS_METADATA_COLLISION=warn does not downgrade this refusal unless a ruling says so.
• Error code: reuse a registered code where one fits. A new code must be registered in packages/spec's ledger, so name that file cross-lane if it is needed.
• Clause-②: yes (the !: an install that loads today is refused). Major changeset on the v18 line.

[objectstack-fleet]

Claim: PM loop round 64 · 2026-10-08T03:36Z
Session: session_01EUBvqtauTDmHi2ZgY759p2
Account: os-litant (the seat's linked user, as GET /user answers it; always the card's assignee)
Branch: claude/issue-22135-security-catalog-one-holder
Worktree: objectstack-issue-22135
Domain: domain:engine (also reaches packages/runtime's app-plugin.ts registrar, a domain:cli file declared on #6024 in this act)
Seat: domain:engine#1
Provenance:

• The maintainer's ruling on feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 (record 6050490870, 「15196 Q3 A Q4 A」); the card was filed for it by domain:services seat 2 and graded p1, pm:queue by triage (6051220848).
• Batch 3: feat(objectql,plugin-auth): the Default Organization is load-bearing under single; an unstamped write is derived there and refused everywhere else (ADR-0131 D3/D9/D11) #15195 holds one dev slot; finding(metadata): revertPackage and publishPackage find a package's members by the item's own packageId/package key, so a code-shipped package whose items carry only the _packageId stamp answers 404 "No metadata items found" #22113 is in its landing window with no dev.
  File surface (at origin/main ec8f37c890), per the card and triage's grade 6051220848:
• Measure first: every door a position, permission set or capability can arrive through (boot, hot install, POST /api/v1/packages, the artifact door), and every in-repo package and example for a name this rule would now refuse. A collision found there is fixed or reported before the refusal ships.
• The refusal, for the three catalog types only, naming both holders, with an ADR-0112 4xx envelope reusing the namespace gate's shape (objectql's registry.ts, NamespaceConflictError / NAMESPACE_CONFLICT_CODE), at: objectql's SchemaRegistry package install (registry.ts); metadata's artifact door (plugin.ts, ARTIFACT_FIELD_TO_TYPE and its loop); runtime's AppPlugin security-metadata registrar (app-plugin.ts, the registerInMemory over positions / permissions / capabilities). Same-package reload stays allowed.
• S1's P1.2 pin flips from today's precedence to the refusal, with its ablation; core's security-catalog.test.ts stale pointer (security-catalog-shared-name.test.ts) is corrected.
• The ADR-0048 §3.4 narrowing note is Tier H (docs/adr/**): its own draft PR, separate from the code PR, carrying ## 维护者速读(草稿); it waits for the maintainer.
• ⛔ Not in this card: an environment-catalog save over a package-held name (reported only); OS_METADATA_COLLISION=warn does not downgrade this refusal.
• A new error code is a packages/spec ledger entry: stop and report first (spec lane).
• .changeset/22135-*.md: BREAKING. Changesets pre mode is not on at this stamp (.changeset/pre.json absent; PR chore(release): enter Changesets pre mode (next) with one major marker, so v18 opens at 18.0.0-next.0 #22084 open), so the launch-window convention grades it minor with the BREAKING banner, unless chore(release): enter Changesets pre mode (next) with one major marker, so v18 opens at 18.0.0-next.0 #22084 has landed by the PR.
  Container & model: L, mode:subagent, model: default (dispatch-gates --tier at 2026-10-08T03:36Z: no path-derived mandate).
  Clause-②: no
• The card narrows the accept set (an install that loads today is refused), with a code reused from the registry gate. Triage's grade line reads yes; the seat does not adopt it, because Clause-② asks whether the card widens the accept set or the public surface, and a refusal widens neither. The ! is carried by the changeset's BREAKING banner.
• On dispatch-gates' floor ("a card that changes contract accept/reject behaviour owes a contract-review-tier review"), the seat commissions an at-tier contract review before the queue. A new ledger code would make this yes and move the code half to the spec lane.
  Responsibility: n/a — not a defect card
  Thread-read: 6051220848
  Serial constraints cleared: at 2026-10-08T03:36Z, the open PRs' file lists read by filename:
• No open PR touches objectql/src/registry.ts, metadata/src/plugin.ts, runtime/src/app-plugin.ts, core/src/security/security-catalog.test.ts or docs/adr/0048-*.
• domain:services' feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 drafts PR feat(plugin-security)!: the six built-in positions are declared position metadata (ADR-0131 C2 stage S2) #22139 (S2: the six built-in positions declared as position metadata) and PR feat(plugin-security): grants stored before the permission-set name column get their name, once, at boot (ADR-0131 C2 S4b) #22143 (S4b) edit plugin-security/src/security-plugin.ts, which this card reads as a built-in holder and does not write. If feat(plugin-security)!: the six built-in positions are declared position metadata (ADR-0131 C2 stage S2) #22139 lands first, its positions are holders this refusal must name; the dev reads its diff.
• This lane's feat(objectql,plugin-auth): the Default Organization is load-bearing under single; an unstamped write is derived there and refused everywhere else (ADR-0131 D3/D9/D11) #15195 edits runtime/src/app-plugin.ts in the inline-seed region (about :1440); this card's registrar is about :1007. Different regions; whichever lands second merges main.
• domain:spec's spec(v18): move PROTOCOL_VERSION 17 → 18 in an ordinary pull request with full CI: regenerate spec-changes.json and the 17 → 18 upgrade-guide section, rewrite the in-repo ^17 handshakes, and give the lockstep test one pre-mode exception (#22085 Q1) #22130 (6051355811) rewrites ^17 handshake strings in packages/metadata test fixtures, not plugin.ts.

[objectstack-fleet]

This amends my grade 6051220848 (one line: Clause-②). Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-08T05:20Z. ⛔ Not a claim.

I wrote Clause-②: yes, because an install that loads today will be refused. Under the governing definition (execution-duties.md: Clause-② means the card widens the accept set or the public surface), a pure refusal is Clause-②: no, as the claiming seat wrote.

• What stands: the breaking change takes a major changeset on the v18 line, and the seat's at-tier contract review stays as the stricter choice.
• The two-texts conflict is [finding] dispatch-gates --tier's Clause-② note says a card that "changes contract accept/reject behaviour" owes a contract review and is spec-lane work; execution-duties.md's Clause-② is widening only, so a narrowing card has two answers #22167, routed to the skills seat.

[objectstack-fleet]

os-dev-report
{
"issue": 22135,
"status": "done",
"branch": "claude/issue-22135-security-catalog-one-holder",
"pr": "#22197",
"pr_adr_note": "#22198 (branch claude/issue-22135-adr-0048-narrowing-note, Part of #22135, Tier H, carries the 维护者速读 draft)",
"session": "session_01EUBvqtauTDmHi2ZgY759p2 — mode:subagent, the parent PM session id (shared)",
"premise_still_valid": true,
"summary": "Implemented the ruled refusal (Q4 = A on #15196) in @objectstack/objectql. New module security-catalog-namespace.ts holds the rule, the built-in names (spec BUILTIN_IDENTITY_NAMES + AUDIENCE_ANCHOR_POSITIONS, PLATFORM_CAPABILITY_NAMES; the platform permission sets are held by plugin-security as a package) and the holder vocabulary (package / environment / built-in). SchemaRegistry.installPackage refuses a package whose declared positions, permission sets or capabilities name a held name, ahead of every mutation, listing all conflicts, and records claims released by uninstallPackage (claims are what holds positions, which the engine never registers). registerItem refuses a package-bound registration of the three types over another holder; registrations with no package (sys_metadata hydration, the metadata write-through) are not judged. Envelope: the namespace gate's registered code NAMESPACE_CONFLICT, status 422, both holders named; no collisionPolicy downgrade; no new code, no packages/spec change. Measured door finding (M1): the three named doors are all behind ONE door — AppPlugin.init registers every package (artifact boots included, package by package) through manifest.register, which calls ObjectQL.registerApp and then installPackage in Phase 1. The AppPlugin registrar and the artifact door write only in Phase 2. So metadata/src/plugin.ts and runtime/src/app-plugin.ts are unchanged, and runtime pins boot both real compositions and see the refusal. P1.2 pin flipped (it is the describe in protocol-boot-hydration-scoped.test.ts, as the card said, with no P1.2 label), core pointer corrected, core module doc rewritten to the ruled answer, and the capability coexistence pin in engine-capability-provenance.test.ts flipped. ADR-0048 §3.4 narrowing note in its own draft PR #22198. #22139 (S2) landed during the run and was merged in; its built-in positions register at the item seam under plugin-security's id and pass, and their boot tests are green.",
"doors": [
"boot door-less, two stacks share position+set+capability — base: boots; by-name read answers the position from the LAST stack and the set and capability from the FIRST · head: boot refused 422 NAMESPACE_CONFLICT, 3 conflicts, both stacks named",
"boot, app declares everyone / manage_users / admin_full_access — base: boots; by-name admin_full_access answers the APP's set · head: refused. Holder built-in for the first two; for admin_full_access the app registers first in bootStack, so plugin-security's registration is the one stopped, naming the app",
"artifact boot (createStandaloneStack), two packages of one artifact sharing names; a package declaring everyone — base: boots (runtime pins red under ablation) · head: refused in Phase 1, before the artifact door runs",
"hot install, post-boot manifest.register over a held name — base: accepted, record written · head: refused, no record",
"POST /api/v1/marketplace/install-local inline manifest — base: 200, installed · head: 422 PLUGIN_REGISTER_FAILED (route's own code), refusal text in error.message, no record",
"POST /api/v1/packages — base and head: 400, the strict body refuses positions / retired capabilities / a flat permissions list; not a door",
"environment-held permission set then a hot install declaring it — base: accepted · head: refused, holder environment",
"same-package hot reload — base and head: accepted",
"env save over a package-held permission set, PUT /meta/permission/NAME (with or without ?package=) — base and head: 403 NOT_OVERRIDABLE (packaged lock); not covered by the ruling",
"env save of a position over a package-held position name, PUT /meta/position/NAME — base and head: 200, and the saved position then wins the by-name read; not covered, see open_questions",
"named, NOT MEASURED: the artifact door HMR reload (_reloadAndAnnounce) re-registers without registerApp, so it is served until restart and the restart refuses; install-local cloud-sourced install tolerates a register failure (warn + persist; the next boot's rehydrate logs error and skips) — code reading",
"base column = both gates ablated at 1604e09; rows 1, 2 and 6 also measured on the untouched base 7ef50a4; head = 8ad6385"
],
"census": "tsx census over examples/app-crm, app-showcase, app-todo, app-multi-package (top level, packages[] bodies, nested plugins[]) against spec built-in positions and capabilities and plugin-security securityDefaultPermissionSets, at 1604e09: 50 declarations (crm 3 positions / 2 sets; showcase 10 / 9 / 2 capabilities; todo 0; multi-package 0; built-ins 6 positions / 10 capabilities / 8 sets); names with more than one holder: 0; same-holder repeats: 0. Guard at 8ad6385 with the gate in place: crm, showcase, multi-package boot via bootStack; security-catalog-showcase (3 postures) and multi-package-artifact dogfood green. Deployed and marketplace packages NOT MEASURED.",
"tests": "At 8ad6385, each under os-verify-lock with its exit captured: objectql registry-security-catalog-namespace (new, 28) + protocol-boot-hydration-scoped + engine-capability-provenance + registry-collision-order + registry-artifact-co-ownership: 5 files, 64 passed, exit 0. runtime standalone-stack-security-catalog-one-holder (new, 4) + standalone-stack-security-registrar: 6 passed, exit 0. core security-catalog: 14 passed. plugin-security builtin-positions boot + unit (S2): 18 passed. dogfood security-catalog-showcase + multi-package-artifact + an uncommitted door probe: 44 passed, exit 0. typecheck objectql + core + runtime (with check:test-typecheck; no new debt): VERDICT command-exit 0. Before the merges, objectql full suite 382 files / 7553 tests: the one red was the coexistence pin, then flipped and green. Downstream sweep against the rebuilt objectql dist: runtime 337 files / 5465, plugin-security 172 / 3663, rest 266 / 5120, verify 18 / 133, cloud-connection 41 / 505, all VERDICT command-exit 0. Ablation, both gates, through scripts/ablation-replace.mjs (wrap and restore-on-exit). Package-door call replaced by a globalThis marker write; item-seam condition given an always-false marker conjunct. On disk: anchor 1->0, blob b96099a12688 -> 5c8f77d17cfb -> 12c018d406ab, markers 1/1. objectql rebuilt; ablation-dist-preflight found both markers in dist (the DTS step failed on the unused private method, and JS was emitted). objectql pins (src): 22 failed / 21 passed of 43; every refusal pin red, including both flipped P1.2 cases and the flipped capability pin; controls green. runtime pins (dist): 3 failed / 1 passed; control green. Restore: blob back to b96099a12688, git diff HEAD empty, rebuilt, ablation-dist-preflight --absent green for both markers (dist and whole tree). Ablation at 1604e09; registry.ts blob identical at 8ad6385.",
"gates": {
"code_pr": "dispatch-gates --commands on 8ad6385: 78 derived, 78 run with exit codes, all 78 exit 0; --ran reconciles 78/78, 0 NOT MEASURED (a derived zero).",
"code_pr_remedies": "On the pre-merge tree 053cc2e: check-engine-split-ratio refused the shallow clone, deepened with git fetch --shallow-since=2026-07-03 origin main, then exit 0; check:dual-build-cjs-loads answered PREREQUISITE NOT MET (8 unrelated packages had no dist), built them, then exit 0.",
"adr_pr": "dispatch-gates --commands on c383221: 19 derived, 19 run with exit codes, all exit 0 after building formula + lint for check:doc-formula-expressions (first exit 3); --ran 19/19.",
"ci": "in_progress at report time: code PR head 8ad6385 had 14 checks completed (success or skipped, among them Check Changeset and Governed Surface Queue Guard) and 17 in progress. Not waited on.",
"not_measured_locally": "CI-only lanes declared to CI: Test Core shards, Temporal Conformance, Dogfood shards, Dogfood Verify CLI, Build Core, the workspace type-check lanes.",
"main_drift": "After the final run origin/main moved 6 commits (to 13aea18); none touches a file of this PR."
},
"line_budget": "code PR: 10 files, +962 / -59 (1021 changed lines, under the 5000 human-merge threshold). ADR PR: 1 file, +98 / -0. skills/**: none touched, no skill line budget applies.",
"files_changed": [
"#22197: .changeset/22135-security-catalog-one-holder.md (new; objectql minor, BREAKING banner, adr-0087 not-required (no-migration-prescription))",
"#22197: packages/objectql/src/security-catalog-namespace.ts (new)",
"#22197: packages/objectql/src/registry.ts",
"#22197: packages/objectql/src/registry-security-catalog-namespace.test.ts (new)",
"#22197: packages/objectql/src/protocol-boot-hydration-scoped.test.ts (P1.2 flip)",
"#22197: packages/objectql/src/engine-capability-provenance.test.ts (coexistence pin flipped)",
"#22197: packages/core/src/security/security-catalog.ts (module doc only)",
"#22197: packages/core/src/security/security-catalog.test.ts (pointer)",
"#22197: packages/runtime/src/standalone-stack-security-catalog-one-holder.test.ts (new; NON-ENGINE file, runtime is domain:cli's package — seat to declare)",
"#22197: scripts/adr-anchors/packages__objectql__src__security-catalog-namespace.ts.json (new ADR anchor; NON-ENGINE file)",
"#22198: docs/adr/0048-cross-package-metadata-collision.md (dated note under §3.4 + addendum; original text untouched)"
],
"deviations": [
"File surface: the refusal lives in objectql (package door + item seam); packages/metadata/src/plugin.ts and packages/runtime/src/app-plugin.ts are unchanged. Measured: both registrars write in Phase 2, behind the Phase 1 package door, and the runtime pins prove the refusal for both compositions.",
"Clause-②: copied the claim's line, Clause-②: no, into the PR body and the changeset. The closed arm (narrowing) exists for exactly this case: not a widening, but breaking. The seat may prefer Clause-②: no (narrowing). Built entry declarations measured: only private member names added to SchemaRegistry, no new export, so no widening.",
"Changeset graded minor with the BREAKING banner (pre mode off: .changeset/pre.json absent at 7ef50a4 and at 8ad6385).",
"origin/main merged twice into the code branch (959c209 brought #22139 S2; then 6ed0c0f). The ADR branch was merged once (c383221). Builds refreshed and tests re-run after each merge.",
"Deepened the shared shallow clone for the window-metric gate: git fetch --shallow-since=2026-07-03 origin main.",
"Built 8 packages outside this change (studio, client-react, embedder-openai, knowledge-memory, knowledge-ragflow, organizations, service-cluster-redis, service-knowledge) so check:dual-build-cjs-loads could measure.",
"ADR-0048 header Addenda index line not edited (the original text was left untouched as ordered); the §3.4 note carries the link.",
"A temporary dogfood probe (test/zz-probe-22135.dogfood.test.ts) was used for the door table and removed; never committed.",
"Worktree cleanup: the ADR worktree was removed before this report. The code worktree (node_modules first, then git worktree remove) is removed right after this comment posts, since this comment is posted from it."
],
"mcp_calls": "0",
"api_writes": "5 — each one repository_dispatch through the fleet-write relay, written as objectstack-fleet[bot]: (1) pr_create, POST /repos/objectstack-ai/objectstack/pulls, #22197; (2) pr_create, POST /repos/objectstack-ai/objectstack/pulls, #22198; (3) label-write #22197, POST /repos//issues/22197/assignees (os-litant); (4) label-write #22198, POST /issues/22198/labels (skip-changeset) + POST /issues/22198/assignees (os-litant), one dispatch; (5) this os-dev-report comment, POST /repos//issues/22135/comments. The git pushes of both branches are not REST writes. No card assignee or label write.",
"open_questions": [
{
"question": "An environment save of a POSITION over a package-held position name is accepted (PUT /api/v1/meta/position/NAME answers 200), and the saved position then wins the by-name read. Measured on head and on the ablated base. Permission sets are protected on the same door by the packaged permission-set lock (403 NOT_OVERRIDABLE); positions have no such lock. The ruling covers packages, not environment saves. Should the security catalog's one-holder rule extend to environment saves of positions?",
"options": [
"A — extend the packaged lock's shape to positions: an environment save over a package-declared position is refused (403 NOT_OVERRIDABLE), matching permission sets",
"B — leave it: environment saves stay under ADR-0005 overlay precedence; report only",
"C — refuse with the one-holder envelope (422 NAMESPACE_CONFLICT) at the metadata write door for all three types"
],
"axes": "Business need: real, and measured at a public door. A Setup or Studio author can silently fork a package's position, and every assignment of that name then grants the fork. Long-term: A reuses an existing, ruled lock (the 2026-08-24 permission-set ruling) instead of a second refusal; C adds a second spelling for one condition. AI-error resistance: A and C refuse loudly at the save; B lets an AI-authored position shadow a package's with no signal. Startup scope: A adds no new code or surface, only one more type on a ruled path; C adds a new refusal at a new door.",
"recommendation": "A, because it is the ruled shape the permission-set lock already uses, closes the one measured asymmetry, and adds no vocabulary. It is metadata-protocol / plugin-security work, outside this card's lane."
},
{
"question": "Cold boot and the environment-catalog holder. A package registers in Phase 1 and sys_metadata hydrates in Phase 2. So a package newly added to a deployment whose environment catalog already holds one of its catalog names is NOT refused at cold boot: the env row hydrates over it, with the registry's existing collision warning. It IS refused on a hot install. From the registry's seat, a cold-boot arrival is indistinguishable from an environment save over a package-held name, which the ruling leaves out. Is the cold-boot half of the environment-catalog holder required?",
"options": [
"A — accept the boundary: hot installs are refused; cold boot keeps the existing collision warning (now documented)",
"B — at hydration, refuse or flag an environment-authored catalog row whose name a package holds, at kernel:bootstrapped, as a loud boot report naming both holders",
"C — read the environment catalog's catalog names before package registration (a Phase-1 storage read)"
],
"axes": "Business need: the env-held case at cold boot needs a deployment that authored a set in Setup and later added a package shipping the same name; no in-repo or measured deployment does. Long-term: B fits the startup-registry rule (judge once the registries are sealed) and the S9 boot report; C puts a storage read in Phase 1, where the datasource may not be up. AI-error resistance: B makes the collision loud, A keeps a warning only. Startup scope: A adds nothing; B adds one boot report; C is an architectural change.",
"recommendation": "A for this card. If the maintainer wants the cold-boot half, B, as a report rather than a refusal, folded into #15196's S9 boot report."
}
],
"out_of_scope_findings": [
"carrier: 承接者:无 · noted in #22197 Acceptance notes, not filed — install-local inline import answers its own 422 PLUGIN_REGISTER_FAILED for any register refusal (this refusal and the namespace gate's alike), so error.code never carries NAMESPACE_CONFLICT there; measured at POST /api/v1/marketplace/install-local. Not one of the three filing classes (a deliberate route wrapper, no stated contract violated). Dedupe words: install-local register refusal code · PLUGIN_REGISTER_FAILED demotes · namespace conflict install-local",
"carrier: 承接者:无 · noted, not filed — install-local's cloud-sourced install tolerates a register failure (warn, persists the ledger entry, answers success), and the next boot's rehydrate logs it at error and skips the package. Code reading only, NOT MEASURED (needs a control plane). Dedupe words: install-local cloud install tolerates register failure · rehydrate skipped package",
"carrier: 承接者:无 · noted in #22197, not filed — the artifact door's HMR reload re-registers catalog items into the metadata service without passing the package door, so a dev-loop edit to a held name is served until restart (the restart refuses). Dev-only, not measured. Dedupe words: artifact HMR reload catalog name · reloadAndAnnounce package door",
"carrier: spec lane (packages/spec error-code-ledger owner) · noted, not filed — the NAMESPACE_CONFLICT row comment in packages/spec/src/api/error-code-ledger.zod.ts describes only the manifest-namespace condition; this PR adds a second condition under the same registered code (face unchanged, provenance gate green). A one-line comment is owed by the spec lane. Dedupe words: NAMESPACE_CONFLICT ledger comment second condition",
"carrier: 承接者:无 · noted, not filed — manifest.register handed a stack-shaped object with no top-level id or name ({ manifest, permissions }) registers its catalog items under no package, in the bare slot, where they read as the environment catalog. Measured on the base probe; reached only by a direct internal caller (AppPlugin and install-local flatten first), so no public door is named. Dedupe words: manifest register no id bare slot"
]
}

---

Generated by Claude Code

[objectstack-fleet]

Claim amendment · 2026-10-08T06:07Z · domain:engine#1 · session_01EUBvqtauTDmHi2ZgY759p2 (os-litant), to the claim 6051656254, on the dev's report 6053492929.

• File surface, as built: the refusal lives in objectql alone: a new security-catalog-namespace.ts, registry.ts's package install and item seam. metadata's plugin.ts and runtime's app-plugin.ts are unchanged: measured, both registrars write in Phase 2, behind the Phase 1 package door (AppPlugin.init → manifest.register → registerApp → installPackage), and the runtime pins boot both real compositions and see the refusal.
• Files beyond the claim: packages/runtime/src/standalone-stack-security-catalog-one-holder.test.ts (new test, a domain:cli package, declared on [PM seat] domain:cli — 🟢 os-warren · session_01RWZbGvPFcRKvUqASZtunCU #6024 in this act); scripts/adr-anchors/packages__objectql__src__security-catalog-namespace.ts.json (a gate-mandated anchor for the new module); packages/core/src/security/security-catalog.ts (module doc only).
• PRs: feat(objectql)!: positions, permission sets and capabilities hold one name per deployment — a second holder is refused at registration, naming both #22197 (code, Fixes #22135, Clause-②: no) and docs(adr): ADR-0048 §3.4 narrowed — positions, permission sets and capabilities hold one name per deployment #22198 (the ADR-0048 §3.4 note, Part of #22135, Tier H, waits on the maintainer).
• The dev's two open questions are outside this card's ruling (triage 6051220848: an environment save over a package-held name is "reported only"); they are filed as [finding] an environment save of a position over a package-declared position name answers 200 and wins the by-name read; a permission set's is refused 403 NOT_OVERRIDABLE #22203 for triage. The card lands without them.

[objectstack-fleet]

os-dev-report
{
"issue": 22135,
"status": "done",
"round": "patch round 1 (Dogfood Regression Gate red on 8ad6385)",
"branch": "claude/issue-22135-security-catalog-one-holder",
"pr": "#22197",
"pr_adr_note": "#22198 (unchanged this round)",
"head": "089b1c84b6 (was 8ad6385); origin/main not re-merged this round",
"session": "session_01EUBvqtauTDmHi2ZgY759p2 — mode:subagent, the parent PM session id (shared)",
"premise_still_valid": true,
"measurement": {
"q1_config_path": "SecurityPlugin's own constructor option defaultPermissionSets, supplied by dogfood fixtures through bootStack's security: option. plugin-security declares every entry on its OWN manifest: init() calls manifest.register({ ...securityPluginManifestHeader, permissions: this.bootstrapPermissionSets }), so each entry registers under com.objectstack.plugin-security. The app manifest path is the other holder: AppPlugin.init registers the stack's permissions under the app's id. In bootStack the AppPlugin is composed before SecurityPlugin, so plugin-security registers second and is the one refused, naming the app. That is the CI signature, reproduced locally.",
"q1_who": "Static scan (58 files carry defaultPermissionSets) plus local runs. Producers: showcaseAppDefaultSecurity() with no argument (packages/qa/dogfood/test/showcase-security.ts) handed the showcase's own showcase_member_default, and 11 files boot through it. showcase-d7-default-profile.dogfood.test.ts passed the same set inline. Three fixtures handed their stack's own sets: authored-row-write-scope (wscope_widener, wscope_plain), bulk-widener-probe (probe_widener) and owd-public-read-write-write-floor (owdw_editor, owdw_viewer, owdw_scoped). The other fixtures hand fixture-only sets their stacks never declare (one holder), including the scaffolding branch of the same helper, which renames the set to dogfood_showcase_member.",
"q2_production": "Production does not take the path. In-repo, the only production SecurityPlugin construction is serve.ts: new SecurityPlugin(appSecurityPluginOptions(config)), which passes { fallbackPermissionSet: NAME } and no sets. bootStack's default is the same helper. No production source passes defaultPermissionSets. git grep over packages//src and examples, tests and packages/qa excluded, finds 3 hits: plugin-security's own definition and export, and one comment in cli meta/resync.ts that reads the plugin's service. None passes the option. A real objectstack dev --fresh -p 38461 --seed-admin boot of examples/app-showcase, built at 8ad6385 with the gate in place, reported "Server is ready", and GET /api/v1/health answered 200. Self-registration is closed on that posture, so no member read was probed there; the bootStack default-composition dogfood (D7 and 11 helper callers) covers that. NOT MEASURED: compositions outside this repository (cloud, embedders) that may pass an app's set through the public defaultPermissionSets option. Such a composition is now refused at boot, naming both holders, which is the ruled outcome.",
"q3_same_definition": "Yes. Showcase: the app's declared showcase_member_default against the copy the helper handed over, PermissionSetSchema.parse(declared): 101 of 101 leaves equal, nothing only on one side. The three fixtures passed the same object instances (WidenerSet as any etc.) to both, so the definitions are identical by construction. The ruling names no same-definition exception, and the gate grants none."
},
"summary": "Fixed at the producer, the dogfood harness fixtures: each fixture now declares a permission set once. The set is the app's, wired to plugin-security by NAME only (fallbackPermissionSet), exactly as os serve does (appSecurityPluginOptions). The helper showcaseAppDefaultSecurity() (plain branch) and the D7 test now construct new SecurityPlugin({ fallbackPermissionSet }); the three fixtures drop their stack's own sets from defaultPermissionSets and keep fallbackPermissionSet: 'member_default'. Their comments now state why: the old note "the lightweight harness does not seed permission metadata" is measured false, because bootStack's AppPlugin registers the stack's permissions in the engine registry and the metadata service. A runtime pin holds the refused composition: an app declaring a set AND the same set handed to defaultPermissionSets refuses the boot with 422 NAMESPACE_CONFLICT, incoming com.objectstack.plugin-security, holder the app package. No change to objectql, plugin-security or verify; no gate tolerance, no collisionPolicy change, no same-definition exception.",
"files_changed": [
"packages/qa/dogfood/test/showcase-security.ts — domain:cli; header comment and the plain (no-argument) branch of showcaseAppDefaultSecurity()",
"packages/qa/dogfood/test/showcase-d7-default-profile.dogfood.test.ts — domain:cli; imports, the unused declaredDefault binding, the beforeAll SecurityPlugin wiring and its comment",
"packages/qa/dogfood/test/authored-row-write-scope.dogfood.test.ts — domain:cli; import line and the beforeAll SecurityPlugin option",
"packages/qa/dogfood/test/bulk-widener-probe.dogfood.test.ts — domain:cli; import line and the beforeAll SecurityPlugin option",
"packages/qa/dogfood/test/owd-public-read-write-write-floor.dogfood.test.ts — domain:cli; import line and the beforeAll SecurityPlugin option",
"packages/runtime/src/standalone-stack-security-catalog-one-holder.test.ts — this PR's own runtime test; one new case",
"plugin-security, verify and objectql: untouched this round"
],
"tests": "At 089b1c8, all under os-verify-lock. Dogfood, the CI split (OS_TEST_SHARD=i/3 pnpm --filter @objectstack/dogfood test): shard 1/3 74 files / 557 tests passed; 2/3 74 files / 535 passed, 1 skipped; 3/3 73 passed + 1 skipped files / 661 passed, 8 skipped; every shard VERDICT command-exit 0, 222 files in all. Targeted first: the 5 edited dogfood files plus the 10 other helper callers, 15 files / 144 passed; the runtime pin file, 5 passed. Reverse verification: the double declaration was put back, through scripts/ablation-replace.mjs (restore-on-exit), in showcase-security.ts (blob 930cce0c14dd -> 58b4f13503fb). showcase-fls-read-mask-strip, one of the CI-failing files, went red: SecurityCatalogNameConflictError, package "com.objectstack.plugin-security" cannot register, permission set "showcase_member_default" is already held by package "com.example.showcase". The first bulk-widener reverse leg was VOID: the mutation landed but referenced the removed import and failed with a ReferenceError, not the refusal. It was redone with an import-free mutation (blob a4290956779e -> 1d4c80130ebd), went red with the refusal on "probe_widener" held by the app package, and was restored. Every restore: blob == HEAD, git diff HEAD empty, git status clean. Existing CI on 089b1c8 at report time: Dogfood Regression Gate 1/3, 2/3 and 3/3 success, Lint & Repo Gates, all Type Check lanes, Build Core, Temporal Conformance, Governed Surface Queue Guard and Test Core 2-6/6 success; Test Core (1/6) in_progress. On 8ad6385: dogfood 3/3 failure; Test Core (1/6) cancelled when the new head was pushed; everything else success.",
"gates": "dispatch-gates --commands on 089b1c8: 82 derived, 82 run, exit codes recorded; --ran reconciles 82/82, 0 NOT MEASURED. check:dual-build-cjs-loads first answered PREREQUISITE NOT MET (exit 3) in the fresh worktree; the same 8 unrelated packages were built and it then exited 0. All 82 exit 0.",
"line_budget": "this round: 6 files, +60 / -44. PR total vs merge base: 15 files, +1022 / -103 (1125 changed lines, under 5000). skills/: none.",
"pr_body_change": {
"note": "The seat writes it; no PATCH from this dev. Two edits to #22197's body.",
"edit_1_replace_bullet": "In "## Acceptance notes", replace the whole bullet that starts with "- Files outside the engine lane:" with this line:",
"edit_1_text": "- Files outside the engine lane: packages/runtime/src/standalone-stack-security-catalog-one-holder.test.ts (new test; runtime is domain:cli's package); scripts/adr-anchors/packages__objectql__src__security-catalog-namespace.ts.json (new ADR anchor); and, from patch round 1, five domain:cli dogfood files: packages/qa/dogfood/test/showcase-security.ts, showcase-d7-default-profile.dogfood.test.ts, authored-row-write-scope.dogfood.test.ts, bulk-widener-probe.dogfood.test.ts and owd-public-read-write-write-floor.dogfood.test.ts (each: the SecurityPlugin construction, with its comment and imports).",
"edit_2_insert": "Insert this section immediately before the final "---" footer line (after the "## Acceptance notes" list):",
"edit_2_text": "## Patch round 1 — the dogfood fixtures declared one permission set twice\n\nThe Dogfood Regression Gate (all 3 shards) was red on 8ad6385. In every failing boot, plugin-security registered a permission set that the app package already held.\n\nThe fixtures handed an app-declared set to SecurityPlugin's defaultPermissionSets, which plugin-security declares on its own manifest, while the app declared the same set too:\n\n- showcase_member_default, through showcaseAppDefaultSecurity() and the D7 test;\n- wscope_*, probe_widener and owdw_*, in three fixtures.\n\nMeasured:\n\n- os serve / objectstack dev never composes this. It hands the plugin only the default's NAME (appSecurityPluginOptions), and the app registers the set. A real objectstack dev --fresh boot of examples/app-showcase came up with the gate in place: health 200.\n- The two copies were the same definition: 101 of 101 leaves equal.\n\nFixed at the producer: each fixture declares the set once, as the app's, and wires the default by name, as the CLI does. A runtime pin holds the refused composition.\n\nAll three dogfood shards are green locally on 089b1c8 (74 + 74 + 74 files) and in CI.\n"
},
"deviations": [
"Fixed in domain:cli files (packages/qa/dogfood), as the measurement showed the harness is the producer; regions named in files_changed. Nothing in plugin-security or verify was written.",
"origin/main was not re-merged this round; CI ran on the PR's merge ref.",
"The first bulk-widener reverse leg was void (ReferenceError), then redone; see tests.",
"Worktree: recreated from the local branch (== remote 8ad6385), with no force. It is removed again right after this comment posts, since the comment is posted from it."
],
"mcp_calls": "0",
"api_writes": "1 — this os-dev-report comment, POST /repos//issues/22135/comments, through the fleet-write relay (repository_dispatch) as objectstack-fleet[bot]. git push of the code branch is not a REST write. No PR body or label write.",
"open_questions": [],
"out_of_scope_findings": []
}

---

Generated by Claude Code