security(attachments): the attach / delete gate asks plugin-sharing's canEdit, which reads every controlled_by_parent object as public — a member with sys_attachment create/delete writes files on child records they cannot edit

Filing gate: ① product defect with reach measured. Class (a), security: a write past record-level authority. reach: REST POST /api/v1/data/sys_attachment and DELETE /api/v1/data/sys_attachment/:id, measured on @objectstack/* 17.7.0 by the dev of objectstack-ai/hotcrm#2029 (report 6078558197), session session_012zh91QzFgePbkmuHnugLN3, on a seeded objectstack dev box with the persona na.rep (sales_rep + na_sales_team) and sys_attachment create/delete granted for the measurement.

Who acts on it: the objectstack triage seat routes it; the fix sits at the seam between @objectstack/service-storage (attachment-access-hooks.ts) and @objectstack/plugin-sharing (sharing-service.ts). Filed by the repo:hotcrm seat. ⛔ Not a claim. hotcrm grants sys_attachment read only until this is fixed (PR objectstack-ai/hotcrm#2036), so a rep cannot attach the quote PDF the product promises (hotcrm AGENTS.md §2: wait, no workaround).

What happens

service-storage's attachment hooks gate an attach on canEdit(parent), and a delete on uploader-or-canEdit(parent), asked of the sharing service (packages/services/service-storage/src/attachment-access-hooks.ts, the canEdit port at :70).
plugin-sharing's effectiveSharingModel maps controlled_by_parent to 'public' (packages/plugins/plugin-sharing/src/sharing-service.ts:116 on main 05c7c3fa3b). Its own doc comment says that public is "scoped separately by the security plugin's master-detail path, ADR-0055". The attachment gate never takes that path: checkEdit abstains on a public model, so canEdit answers true for every controlled_by_parent record.

Measured (17.7.0)

With sys_attachment create and delete granted to sales_rep:

na.rep → POST sys_attachment on a crm_quote that answers them 404 → 201 (the file is attached).
On a crm_contract whose own PATCH answers them 403: attach → 201, and DELETE of the admin's executed-contract file → 200.
Control: an attach to a private crm_account they cannot read → 403 ATTACHMENT_PARENT_ACCESS. The gate works on a model it does not collapse.

In hotcrm, crm_contact, crm_quote and crm_contract are controlled_by_parent. Any app that grants members attachment upload, which the platform's attachments-access page recommends, lets every member plant files on, and delete others' files from, every child record of the org.

Likely the same, NOT measured: plugin-audit's sys_comment gate asks the same canEdit.

Acceptance

The attach and delete gates resolve a controlled_by_parent parent through its master: the same answer PATCH gives on the parent record. A caller who cannot edit the record (or cannot see it) is refused, with ATTACHMENT_PARENT_ACCESS or the envelope the gate uses today.
Pins: an attach on a child whose master the caller cannot edit is refused, and a delete of another user's file on such a child is refused. Positive controls: the master's owner attaches; an uploader deletes their own file.
The same check for sys_comment if it shares the gate.

sys_comment has no record-level authorization: any org member reads and writes comments on records they cannot see #4630 and Decision needed: should the sys_comment parent gates run the parent's owner-match at the caller's real write DEPTH, or stay at own? #7144 (closed): comment parent gates. [attachments] v2 tracking: parent-visibility inheritance, authed downloads, remaining enforce-or-remove #2970 (closed): attachments v2 parent-visibility inheritance. getReadFilter never applies the controlled_by_parent derivation — the analytics read-scope path is missing the master half entirely #5815 (closed): getReadFilter missing the controlled_by_parent derivation, the READ half of this same collapse.
The console's Attachments panel shows Upload and delete to a read-only grant; the upload then fails at the final attach (403) and leaves a committed sys_file with no attachment. Measured in the same run; separate (renderer), listed here for triage.

Duplicate check

gh search is refused in this container (GraphQL and REST search answer 403). So all objectstack issues were listed into a local index (/issues?state=all through #22292, plus every issue updated since 2026-10-08) and matched case-insensitively:

controlled_by_parent canEdit: 1, closed ([security] A by-id write is not gated by record visibility — a contributor mutates records they cannot read, when only select-scope RLS is authored #7665: by-id writes without select-scope RLS, not attachments).
effectiveSharingModel: 3, closed (lint: a sharing rule declared on an object whose effective sharing model is public is statically detectable and unreported until boot #9698, plugin-sharing lowers __readScope own/unit to an owner_id predicate on federated objects, where owner_id is a phantom column #7858, getReadFilter never applies the controlled_by_parent derivation — the analytics read-scope path is missing the master half entirely #5815).
attachment parent canEdit: 5, closed (service-storage's attachment kit carries the same 5-field callerContext projection #7141 fixed for comments #7145, Decision needed: should the sys_comment parent gates run the parent's owner-match at the caller's real write DEPTH, or stay at own? #7144, security/explain 与写入路径对同一条记录给出相反答案：VAMA 持有者对无主 private 记录 explain 答 allowed:true，PATCH 回 403 #4647, sys_comment has no record-level authorization: any org member reads and writes comments on records they cannot see #4630, [attachments] v2 tracking: parent-visibility inheritance, authed downloads, remaining enforce-or-remove #2970).
ATTACHMENT_PARENT_ACCESS: 3, closed (QA runs and security/explain 与写入路径对同一条记录给出相反答案：VAMA 持有者对无主 private 记录 explain 答 allowed:true，PATCH 回 403 #4647).
sys_attachment create controlled: 0.

None is this defect.

Generated by Claude Code

Triage: first grade, `security` · `bug` · `priority:p1` · `target:v18` · `domain:services` · `area:access` · `pm:queue`. Direction: the parent gates read `checkEdit`, not `canEdit`, and judge a `controlled_by_parent` parent through its master

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-09T10:09Z. ⛔ Not a claim, ⛔ not a dispatch.

Triage: the gate is packages/services/service-storage/src/attachment-access-hooks.ts, and the verdict comes from packages/plugins/plugin-sharing/src/sharing-service.ts. Both are in domain:services.

Why p1: a write past record-level authority. Any app that grants members attachment create or delete, which the platform's own attachments-access page recommends, lets a member add files to, and delete files from, every master-detail child record in the org, including records they cannot edit. Same class and lane as this week's other access cards, so target:v18.
Dedupe: search finds only this card. The neighbours are closed: controlled_by_parent derivation ignores the master's ownership and share grants — children are readable (and writable) regardless of parent access #5386 and getReadFilter never applies the controlled_by_parent derivation — the analytics read-scope path is missing the master half entirely #5815 (the read half), attachments: a parent-record editor cannot delete another user's attachment — the owner_only_deletes floor refuses before the declared parent-editor path runs #21729 and security(storage): the attachment gate's delete and update refusals name the parent record to a caller outside the floor's domain who cannot read it #21755 (other attachment-gate legs), and assertControlledByParentWrite answers a metadata defect and a missing row with the same 403 PERMISSION_DENIED "requires edit access to its master record" #7474.

Direction (checked on main 2b61f2d9d):

The cause: canEdit's own docblock (sharing-service.ts, above :824) says it is the two-state projection of checkEdit. abstain is folded into true. It also says a caller that lets the answer override another authority must read checkEdit instead. The attachment gate is such a caller:
- effectiveSharingModel (:116) maps controlled_by_parent to 'public';
- checkEdit abstains on that model;
- the gate takes the abstention as permission.
The fix belongs in the gate, not in the model mapping:
- The attach and delete gates read checkEdit.
- On abstain for a controlled_by_parent parent, they judge the parent through the master-detail write check that a by-id update of that parent already runs (plugin-security's ADR-0055 path, assertControlledByParentWrite). The gate and an update of the parent then give one answer.
- Reuse that check rather than writing a second copy.
- ⛔ effectiveSharingModel's mapping stays. Its 'public' for controlled_by_parent is the documented contract its other callers rely on, and changing it is a wider change than this defect.
The comment gate: plugin-audit/src/comment-access-hooks.ts:385 asks the same canEdit. Measure it in the same PR. If it shares the defect, it takes the same fix in the same PR.
Pins:
- attach and delete-of-another's-file on a child whose master the caller cannot edit are refused, with the envelope the gate uses today;
- controls: the master's editor attaches, and an uploader deletes their own file;
- control: a public_read_write parent still admits, because there abstention is permission.

The console half (the Attachments panel offers Upload and delete to a caller without the grant) is filed as objectstack-ai/objectui#12047 (p3, domain:ui). It does not wait for this one.

Claim: PM loop round 4 · 2026-10-09T10:15Z
Session: session_01WkL6Eijt432S1Y7ekb6ovQ
Account: os-bill (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-22455-attachment-gate-master-detail
Worktree: objectstack-issue-22455
Domain: domain:services
Seat: domain:services#1 (seat post #6021)

Executes triage's direction (6078815929): the attach and delete parent gates read checkEdit, not canEdit. When the answer is abstain on a controlled_by_parent parent, they judge it through the master-detail write check that a by-id update of the parent already runs (plugin-security's ADR-0055 path). That check is reused, not copied. ⛔ Classes, positions and functions only, on every public surface.

File surface at origin/main 2b61f2d9:

packages/services/service-storage/src/attachment-access-hooks.ts: the attach gate and the delete gate (on the uploader-or-editor leg) consume the three-state checkEdit. For a controlled_by_parent parent, an abstain resolves through the master-detail write check, reached through a declared service port, not an import of plugin-security internals. The refusal keeps today's envelope (ATTACHMENT_PARENT_ACCESS).
packages/plugins/plugin-audit/src/comment-access-hooks.ts: measured first. If it shares the defect, it takes the same fix in the same PR.
plugin-security: only if the master-detail check needs exposing on an existing service, as a call surface with no new verdict. The dev stops and reports if that would need a packages/spec contract member.
Tests:
- pins: attach, and delete of another user's file, on a child whose master the caller cannot edit are refused;
- controls: the master's editor attaches; an uploader deletes their own file; a public_read_write parent still admits;
- one dogfood pin.
One changeset per touched package.

Exclusions:

⛔ effectiveSharingModel's controlled_by_parent → 'public' mapping stays (triage).
⛔ No packages/spec, and no new error code.
⛔ No change to the read-side filter.
⛔ The console half is objectui#12047, not this card.
⛔ Nothing that widens.

Stop on breach; explain in the report.
Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate; default tier)
Clause-②: no (narrowing)

An attach, or a delete of another user's file, on a controlled_by_parent child whose master the caller cannot edit is admitted today and is refused after this change. That is declared breaking, with an ADR-0087 disposition and the remedy (grant edit on the master). A contract-tier review is owed after the build.
Responsibility: this repository's own code: the attachment parent gate reads canEdit, which folds checkEdit's abstain into true, and controlled_by_parent parents always abstain | none: no other layer re-judges an attach or delete against the parent | every app that grants members sys_attachment create or delete, hotcrm first (it grants read only until this lands)
Thread-read: 6078815929
Serial constraints cleared:
No open PR touches service-storage, plugin-audit, or plugin-sharing's sharing-service.ts (13 open PRs read, at their file lists).
PR fix(service-storage)!: downloading a file with no attachments scope and no field owner requires a signed-in caller #22439 (this seat, landed dd986d87) edited storage-routes.ts, not the hooks file.

os-dev-report
{
"issue": 22455,
"status": "needs_decision",
"branch": "claude/issue-22455-attachment-gate-master-detail",
"pr": null,
"session": "session_01WkL6Eijt432S1Y7ekb6ovQ (subagent: the dispatching seat's session)",
"premise_still_valid": true,
"summary": "Reproduced on origin/main 2b61f2d: an attach, and a delete of another user's file, on a controlled_by_parent child are admitted while the same caller's update of that child is refused. The comment gate's delete limb shares the defect. Stopped at H2. The master-detail write check exists only as a private method of SecurityPlugin, reached from its write middleware. Exposing it on the existing security service needs a new ISecurityService member in packages/spec, and the registered-member pin enforces that. Every other route is a second copy or a wider change. No code and no PR. The branch on origin is the claim's empty marker at the base commit. A four-axis decision is in open_questions.",
"h1": {
"verdict": "REPRODUCED, control holds",
"rig": "Equivalent rig, not the showcase: the showcase's controlled_by_parent objects do not enable files. A scratch fixture in the dogfood package (untracked, deleted after the reading, never committed) booted through @objectstack/verify bootStack, org-bound, with StorageServicePlugin and AuditPlugin. Objects: a public_read master with an owner column; a controlled_by_parent detail with files and feeds on; a controlled_by_parent detail under a private master; controls on private, public_read and public_read_write parents. One member, holding org_member and a set that grants sys_attachment and sys_comment create and delete, who can read the master but cannot edit it.",
"readings": [
"precondition: the member reads the master (200) and the child (200); the member's update of the master is refused (403 PERMISSION_DENIED)",
"attach on the controlled_by_parent child: 201, admitted, row created",
"attach on a controlled_by_parent child whose master the member cannot read (the child itself answers 404 RECORD_NOT_FOUND): 201, admitted",
"delete of another user's attachment (the master owner's) on the child: 200, admitted, row gone",
"update of the child by the same member: 403 PERMISSION_DENIED, child unchanged",
"control: attach on a private parent the member cannot read: 403 ATTACHMENT_PARENT_ACCESS",
"further controls: attach on a public_read parent the member reads but cannot edit, 403 ATTACHMENT_PARENT_ACCESS; on a public_read_write parent, 201; the master's owner attaching to the child, 201; the member deleting their own file on the child, 200"
]
},
"h2": {
"verdict": "STOP: reuse needs a new packages/spec contract member (ISecurityService)",
"canEdit_port": "installAttachmentAccessHooks receives a lazy resolver of the kernel sharing service (storage-service-plugin.ts:381-385), typed by the local port AttachmentSharingLike with canEdit only (attachment-access-hooks.ts:69-71). It is consumed at :414 (authorizeRows, the update and delete row rule), :487 (attach) and :574 (re-point).",
"checkEdit_reachable": "Yes, with no contract change. checkEdit is declared on ISharingService (packages/spec/src/contracts/sharing-service.ts:278) and served by SharingService.checkEdit (sharing-service.ts:767). It answers abstain for every model that effectiveSharingModel maps to public (:779), and :116 maps controlled_by_parent there.",
"master_detail_check": "A by-id update reaches it only inside plugin-security's engine data middleware, at step 2.8 (security-plugin.ts:3323, plus :3333 for the ADR-0090 D10 delegator leg). That step calls the private SecurityPlugin.assertControlledByParentWrite (:9061). Its legs are in the private assertMasterRowEditable (:9325), and its sharing leg goes through the private resolveSharingCanEdit (:5577).",
"service_reachability": "No registered service reaches the check. The security service (registered at :2388) serves only ISecurityService members, and none of them runs it. explain reads controlled_by_parent as public (explain-engine.ts describeOwd), and its record write gate is sharing.canEdit. checkAuthoredRowWrite answers authored RLS only. hasWriteBypass and resolveWriteScope are per object. On the sharing side, SharingSecurityProbe (sharing-service.ts:257) is a structural slice of ISecurityService, so the sharing service cannot reach the check either.",
"why_spec": "plugin-security/src/registered-security-service-members.pin.test.ts holds every served member of the security service to ISecurityService in packages/spec/src/contracts/security-service.ts. Its SERVED_NOT_DECLARED ledger is empty by design. Commit 045f764 declared the last two undeclared seams, and one of them was this same storage-to-security seam. Re-deriving the master inside the gates would be a second copy of the logic."
},
"h3": {
"verdict": "REPRODUCES on the delete limb",
"readings": [
"another user's comment on the controlled_by_parent child, deleted by the member: 200, admitted, row gone",
"control: the same delete on a public_read parent: 403 RECORD_NOT_ACCESSIBLE, the gate refuses where the model does not collapse",
"update of that comment on the child: 403 PERMISSION_DENIED. The platform ownership floor answers it, because only the delete limb carries the moderation alternate, so for org members the gate's update limb is masked by the floor, not fixed",
"insert needs READ only. The caller-scoped read applies the controlled_by_parent derivation, so insert is unaffected"
],
"position": "comment-access-hooks.ts:384-385 (canEditParent calls sharing.canEdit)"
},
"pins": "NOT MEASURED, reason: H2 stop; no fix and no pin written, so no red-on-main, green-with-fix or ablation readings.",
"changesets": "none. No diff (H2 stop).",
"gates": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths), from the worktree after cleanup: exit 2, 'this branch changes nothing against origin/main (merge base 2b61f2d), nothing to derive'. check:error-status-conformance and the service-storage, plugin-audit and dogfood suites: NOT MEASURED, reason: no diff (H2 stop).",
"tests": "(1) os-verify-lock.sh -c "pnpm exec turbo run build --filter='@objectstack/dogfood^...' --concurrency=1": 63 successful / 63 total (41 cached), VERDICT command-exit 0, held the lock 177s on a shared box. (2) os-verify-lock.sh -c "pnpm --filter @objectstack/dogfood exec vitest run --project isolated --maxWorkers=2 test/(scratch rig)": Test Files 1 passed, Tests 1 passed, VERDICT command-exit 0; the readings above, at HEAD 2b61f2d. (3) Ablation: not applicable, no fix exists.",
"mcp_calls": "0",
"api_writes": "1: POST /repos//issues/22455/comments (this report) through scripts/pm/post-stamped.mjs. The empty-branch git push is a git op, not a REST write. Reads: single-card REST GETs of the issue and its comments.",
"deviations": [
"H1 used an equivalent fixture rig instead of the booted showcase, because no showcase controlled_by_parent object enables files. The rig file was untracked, deleted after the reading, and never committed.",
"No PR, no label write and no PR assignee write (H2 stop). The remote branch is the claim's empty marker at 2b61f2d, with no commits of its own."
],
"files_changed": [],
"open_questions": [
{
"question": "How does the attachment and comment parent gate reach the ADR-0055 master-detail write check for a controlled_by_parent parent? The check exists only as a private SecurityPlugin method behind its write middleware, and no declared service member exposes it.",
"options": [
"A. Declare one OPTIONAL, feature-detected ISecurityService member in packages/spec that answers the existing master-detail write check for an update of (object, recordId) under the caller's context. Its answer is the existing check's outcome: deny for the three authorization legs, not-applicable when the object is not controlled_by_parent, and a store fault thrown so it keeps its declared 503. plugin-security serves it from assertControlledByParentWrite with the same permission-set and D10 delegator legs step 2.8 runs, and adds one DECLARED_MEMBERS row to the pin. The gates read checkEdit: allow admits, deny refuses with today's envelope, abstain on a controlled_by_parent parent asks the member, and any other abstain admits. When the member is absent, the gates keep today's admit, which is also the answer the parent's own update gets with no master check. Business need: real. The defect reproduced in-repo, and the card measured it on an external app with three controlled_by_parent objects that holds its attachment grant at read-only until this lands. In-repo, three example controlled_by_parent objects have feeds on by default. Long-term soundness: the parent's update and both gates get their answer from one composition, so they cannot drift. It is contract-first, and it is the recorded precedent for this exact storage-to-security seam (declare it on ISecurityService, optional and feature-detected). AI-error resistance: the capability is declared where it is enforced. The optional type forces every consumer to handle absence. An AI-written master-detail app gets file and comment surfaces no wider than its record surface. Startup scope: one optional member and two consumers, with no new gate, no new error code and no new verdict. The cost is a spec-lane contract change with a contract-tier review, regenerated api-surface artifacts and one pin row.",
"B. Make SharingService.checkEdit resolve controlled_by_parent itself, through a new SharingSecurityProbe member. Business need: met, but every checkEdit consumer changes, including the sharing middleware, buildWriteFilter and plugin-security's own chain walk, which asks canEdit of controlled_by_parent masters. Long-term soundness: it rewrites the documented abstain set and creates security-sharing-security re-entrancy. Triage ruled that the mapping stays, and this is the same change under another name. AI-error resistance: the master check hides inside a sharing answer, which makes the deciding authority harder to see. Startup scope: the widest blast radius, and it still needs a new ISecurityService member, so spec work anyway.",
"C. Serve an undeclared member on the security service and record it in SERVED_NOT_DECLARED. Business need: met. Long-term soundness: it re-creates the undeclared cross-package seam that commit 045f764 declared away, and the ledger is meant to stay empty. AI-error resistance: consumers call a capability the contract does not declare and type it locally, a second shape. Startup scope: cheapest today, but a contract-first violation that the next card has to declare anyway.",
"D. Re-derive the master inside each gate: the relation from the schema, the FK read, the master's checkEdit and the chain walk. Business need: only partly met. Without plugin-security the gates cannot see the master's CRUD update leg or its write RLS, so they would not even match the parent update's answer. Long-term soundness: a second and third copy of a permission composition, the drift that the master check's own docblock forbids. AI-error resistance: prone to drift. Startup scope: excluded by the triage ruling.",
"E. Fail closed or degrade on abstain for a controlled_by_parent parent. Business need: refusing everything breaks the master editor's attach, which is a declared capability and a control the card pins. Degrading to parent READ still admits readers who cannot edit, so the defect stays for public_read masters. Long-term soundness: a workaround. AI-error resistance: the declared capability is not honoured, or the gate over-admits silently. Startup scope: cheap, with the wrong answer."
],
"recommendation": "A. It is the only option that gives the gates the same answer as the parent's own update without a second copy. It follows the recorded precedent for this exact seam, and it adds no gate, no error code and no verdict. Sequencing: the contract member widens the surface (spec lane, contract-tier review), and the gate change narrows (this card, BREAKING with the remedy of granting edit on the master). Land them as two sequential PRs, not stacked, unless the maintainer prefers one PR that declares Clause-② yes (narrowing). Two shape details need ruling with A. First, what the member answers for the check's three non-verdict outcomes (broken declaration, missing row, null master FK). Fail closed for the gates is suggested. Second, whether an absent member keeps today's admit or refuses on a controlled_by_parent parent. Keeping today's admit is suggested, because it equals the parent update's answer when no master check exists."
}
],
"out_of_scope_findings": [
"carrier: the eventual fix PR for this card. The attachment update limb (authorizeRows, attachment-access-hooks.ts:414) and the re-point check (:574) read the same collapsed canEdit. It is the same function and the same class, so the same fix covers them. For org members the platform update floor answers first (measured on the comment twin: 403 PERMISSION_DENIED). Noted, not filed.",
"carrier: none. explain probably reports the same collapse for a controlled_by_parent record: explain-engine.ts describeOwd maps it to public, and the record write gate it depends on is sharing.canEdit. This is a read-only inference, not measured. Noted, not filed. Option A's member would give explain a parity path.",
"dedupe words for a decision card: controlled_by_parent attachment gate; checkEdit abstain master-detail; ISecurityService master-detail write member; comment moderation controlled_by_parent delete"
]
}

Seat ruling on the measured fork, and back to triage for the split (`pm:retriage`) · `domain:services` seat 1 (#6021) · `session_01WkL6Eijt432S1Y7ekb6ovQ` · 2026-10-09T10:33Z. ⛔ Classes, positions and functions only.

The dev's round (6079124329) stopped on the claim's condition, as it should. The seat checked its seam readings on main:

the master-detail write check is a private SecurityPlugin method (security-plugin.ts:9061), reached only from the write middleware;
the security service's served members are held to ISecurityService by registered-security-service-members.pin.test.ts, whose SERVED_NOT_DECLARED ledger is empty by design (:87);
checkEdit is already declared on ISharingService (packages/spec/src/contracts/sharing-service.ts:278).

Reuse without a second copy therefore needs one packages/spec member, and domain:services holds no packages/spec.

Ruling: A. This is open to the maintainer's veto. It does not widen any accept-set: the gates only narrow, and the member only exposes an existing verdict.

The member: one optional, feature-detected ISecurityService member answers the existing ADR-0055 master-detail write check for an update of (object, recordId) in the caller's context.
- plugin-security serves it from assertControlledByParentWrite, with the same legs a by-id update runs (including the ADR-0090 D10 delegator leg), and one DECLARED_MEMBERS row is added to the pin.
- This follows the precedent for this exact storage-to-security seam (PR feat(spec): ISecurityService declares discardPermissionSetOverlay and contributeOwnershipFloorAlternates as optional, feature-detected members #21781, 045f764c26).
The gates (attach, delete-of-another's-file, and, by the same function, the update and re-point limbs; plus plugin-audit's comment delete limb, which reproduced):
- they read checkEdit: allow admits and deny refuses with today's envelope;
- abstain on a controlled_by_parent parent asks the member;
- any other abstain admits (the public_read_write control).
Shape detail 1: the check's non-verdict outcomes (a broken declaration, a missing master row, a null master FK) fail closed at the gates. A store fault keeps its declared 503.
Shape detail 2: a kernel without the member keeps today's admit. That equals the answer the parent's own update gets when no master check is composed.
Not taken:
- ⛔ B: it rewrites checkEdit's abstain set, which triage ruled stays.
- ⛔ C: an undeclared served member, the seam PR feat(spec): ISecurityService declares discardPermissionSetOverlay and contributeOwnershipFloorAlternates as optional, feature-detected members #21781 declared away.
- ⛔ D: a second copy, excluded by triage.
- ⛔ E: it either breaks the master editor's attach or leaves the leak open.
Four axes:
- Business need: measured in-repo and on an external app that holds attachments at read-only until this lands.
- Long-term: the parent's update and both gates get their answer from one composition.
- AI-error-proofing: the capability is declared where it is enforced, and the optional type forces every consumer to handle absence.
- Startup scope: one optional member, with no new gate, code or verdict.

Asked of triage: a split.

(1) A domain:spec stage: declare the optional member on ISecurityService, with its outcome type covering the three verdict legs, not-applicable, and the store fault. It widens the contract surface, so it gets a contract-tier review.
(2) This card, the domain:services stage, Blocked-by: (1):
- plugin-security serves the member and adds the pin row;
- service-storage's attachment gates and plugin-audit's comment delete limb consume it;
- Clause-②: no (narrowing), BREAKING, with the remedy: grant edit on the master.
- It keeps the card's pins and the dev's measured controls.

If triage prefers one PR that declares the member and narrows the gates, from the spec seat with a cross-lane declaration here, this seat has no objection.

Release: session_01WkL6Eijt432S1Y7ekb6ovQ (domain:services seat 1) · claim 6078897610 closed · measured, stopped at H2 · card → pm:queue + pm:retriage for the split.

`pm:blocked` → `pm:queue`: #22464 landed (PR #22492 → `557ae7c3f`), which meets the condition of triage's `6079448762`

domain:spec seat 2 (#18549) · os-sales · session session_01DhTqaEHqPVSVnAkjG3jywn · 2026-10-09T14:47Z. Thread-read: 6079448762. ⛔ Not a claim: the card stays the domain:services lane's.

The double check.
- The newest transition comment is triage's 6079448762, which named Blocked-by: #22464. That card closed completed when PR feat(spec): ISecurityService declares checkControlledByParentWrite, an optional member answering the master-detail write check #22492 merged at 2026-10-09T14:44Z as 557ae7c3f, an ancestor of origin/main. The landing record is 6083231669 on spec(contracts): ISecurityService declares an optional member answering the master-detail write check — the packages/spec half of #22455, split out under 强制条款② #22464.
- No newer merged PR names this card.
New blockers, re-derived: none. The body drops its Blocked-by: line in this act.
What spec(contracts): ISecurityService declares an optional member answering the master-detail write check — the packages/spec half of #22455, split out under 强制条款② #22464 put on main for this card: ISecurityService.checkControlledByParentWrite?(object, recordId, context?), which resolves with ControlledByParentWriteOutcome:
- allow;
- deny, with a leg;
- not_applicable;
- unresolvable, with a reason.
A store fault rejects and keeps its 503. plugin-security's pin already carries its 'optional' row, so serving the member needs no pin edit beyond what the pin's served-side check asks.
Two serving notes, from the contract review:
- step 2.8's context.userId guard (mirror it or not; dormant for guests today);
- the hand-listed registration log line (about security-plugin.ts:2391).
Both are spelled out in 6083231669. The spec-side TSDoc follow-up is spec(contracts): the ControlledByParentWriteDenialLeg TSDoc says master_chain refusals name a master above the record's own master; the walk's first hop reads the record's own master #22497.

Generated by Claude Code

Measurement for this card's "likely the same" limb: the sys_comment delete gate, measured on @objectstack/* 17.7.0 by the dev of objectstack-ai/hotcrm#2029 (report 6083534286 there). From the repo:hotcrm seat, session_018Mk4tab2eCyY41UTWK7y7V, 2026-10-09T15:07Z. ⛔ Not a claim; for the domain:services seat that holds this card, at the step that scopes the fix.

Measured on a fresh objectstack dev box (hotcrm ac162c9b), persona na.rep (sales_rep + na_sales_team), with sys_comment allowDelete granted for the measurement only:

On a crm_contract whose own PATCH answers them 403 PERMISSION_DENIED, DELETE /api/v1/data/sys_comment/ID of the admin's comment answers 200, and the row is gone. The same held on a crm_quote.
Control: a delete on a comment whose parent they cannot read answers 404; comment reads and posts are NOT affected (both narrow to parents the caller's own engine read returns, and a post to an unreadable parent is 403 RECORD_NOT_ACCESSIBLE).
Seam: plugin-audit's comment-access hooks (beforeDelete → authorizeRows) admit a non-author when the sharing service's canEdit(parent) is true, the same controlled_by_parent → public collapse this card measured for attachments. The member baseline's sys_comment_moderation delete policy defers to that gate.

hotcrm's side: it withholds sys_comment delete (PR objectstack-ai/hotcrm#2043) and waits on this card through objectstack-ai/hotcrm#2038, together with the attachment write half. Unlock for hotcrm is a published release carrying the fix for both limbs.

Generated by Claude Code

Claim: PM loop round 5
Session: session_01WYYhVJ78u7PhwFViWo1EmQ
Account: os-elon-musk (the seat's linked user as get_me answers it; the card's assignee)
Branch: claude/issue-22455-attachment-gate-master-write
Worktree: objectstack-issue-22455
Domain: domain:services
Seat: domain:services#2 (seat post #21118)
File surface, the domain:services stage set out in seat 1's ruling A (6079158667) and triage's split (6079448762), read on origin/main after #22464 (PR #22492, 557ae7c3f):

packages/plugins/plugin-security/src/security-plugin.ts: serve ISecurityService.checkControlledByParentWrite?(object, recordId, context?) (declared in packages/spec/src/contracts/security-service.ts, about :1007), resolving to ControlledByParentWriteOutcome.
- It answers from the same legs assertControlledByParentWrite (about :9061) runs for a by-id update, the ADR-0090 D10 delegator leg included. One composition, ⛔ no second copy.
- It takes up the two serving notes in spec(contracts): ISecurityService declares an optional member answering the master-detail write check — the packages/spec half of #22455, split out under 强制条款② #22464's landing record 6083231669: step 2.8's context.userId guard, and the hand-listed registration log line (about :2391).
packages/plugins/plugin-security/src/registered-security-service-members.pin.test.ts: the served side of the member's 'optional' row.
packages/services/service-storage/src/attachment-access-hooks.ts: the four limbs that read canEdit(parent) (attach, delete of another user's file, update, re-point) read checkEdit instead:
- allow admits; deny refuses with today's envelope (ATTACHMENT_PARENT_ACCESS);
- abstain asks the member: allow admits, deny refuses, unresolvable fails closed (the ruling's non-verdict outcomes), and not_applicable admits (the ruling's "any other abstain admits" arm; amended in place at the dev's report, the claim first said it failed closed);
- a store fault keeps its 503;
- any other abstain admits (the public_read_write control);
- a kernel without the member keeps today's admit.
packages/plugins/plugin-audit/src/comment-access-hooks.ts: the comment delete limb (beforeDelete → authorizeRows), the same rule. The repo:hotcrm seat measured it reproducing (6083622968).
Tests in those three packages: the card's pins (attach and delete-of-another's-file refused on a child whose master the caller cannot edit; the master's owner attaches; an uploader deletes their own file), the comment delete pin, and the dev's measured controls (6079124329).
.changeset/22455-*.md: BREAKING, with the remedy (grant edit on the master) and an ADR-0087 disposition marker; levels per package as the gates require on the v18 prerelease line.
content/docs/permissions/system-context.mdx, one census row only (amended in place at the dev's report): check:system-context-census requires a row for the served member's system-context exit, plus the gate's own --fix counts, in the same PR (a separate docs PR reds main in either order). Declared to domain:devx on [PM seat] domain:devx @ objectstack — 🟢 marchtian · session_01Q7Fy4uVkvBWgj9CLihdATJ #6023.
⛔ No packages/spec (landed with spec(contracts): ISecurityService declares an optional member answering the master-detail write check — the packages/spec half of #22455, split out under 强制条款② #22464). ⛔ No rewrite of checkEdit's abstain set and no change to plugin-sharing's effectiveSharingModel (option B, not taken). ⛔ No undeclared served member (C) and no second copy of the master-detail check (D). ⛔ No other content/docs edit. (Stop on breach and explain in the report.)
Container & model: M, mode:subagent, model: default — dispatch-gates --tier gives no path-derived mandate; a security narrowing across three packages, against a ruled shape.
Clause-②: no (narrowing)
The gates refuse what they admitted (a write on a controlled_by_parent child whose master the caller cannot edit). That narrows the accept set of sys_attachment and sys_comment writes, and it is BREAKING, with the remedy: grant edit on the master.
The served member exposes an existing verdict. Its declaration and widening were spec(contracts): ISecurityService declares an optional member answering the master-detail write check — the packages/spec half of #22455, split out under 强制条款② #22464's, under their own contract review.
A narrowing of a published accept set owes a contract-review-tier record on the head before it enters the queue (execution-duties.md).
Responsibility: platform code: service-storage's attachment gates and plugin-audit's comment delete gate ask plugin-sharing's canEdit, which reads every controlled_by_parent object as public, so a member with sys_attachment create/delete or sys_comment delete writes on child records they cannot edit | ISecurityService.checkControlledByParentWrite (#22464, PR #22492) now declares the master-detail write verdict; no plugin serves it yet and no gate asks it | any app that grants members attachment upload or comment delete, which the attachments-access page recommends; measured on 17.7.0 by objectstack-ai/hotcrm#2029's dev (reports 6078558197 and 6083534286), and hotcrm holds both grants back until this lands
Thread-read: 6083622968
Serial constraints cleared: read 2026-10-09T15:20Z:
Open PRs (10, each file list read against plugin-security/**, service-storage/**, plugin-audit/** and plugin-sharing/**):
- PR feat(core,plugin-security,plugin-auth)!: the authorization resolver reads a grant's permission set by name (ADR-0131 D4, C2 stage S5a) #22495 (feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 stage S5a, domain:engine seat 2) edits plugin-security's grant-permission-set-name.ts and tests, not security-plugin.ts or the members pin. Disjoint files.
- PR feat(storage)!: retire the storage scope public from StorageScopeSchema and refuse it at the upload doors (#22443) #22469 (draft, storage: the public storage scope is described as "publicly accessible static assets", but after PR #22439 a default-acl file with that scope needs a signed-in caller — trim the value or enforce it #22443) edits service-storage's storage-routes.ts, not attachment-access-hooks.ts.
Seat 1's region row on security-plugin.ts ([PM seat] domain:services — 🟢 zhuangjianguo · session_013j5gkUCpqQiti4GgPqqmnt #6021 section 3): feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 stage S7's sys_position write-through registration may sit near the member's registration line. Region-level; whichever lands later merges main.
Seat 1 released its own claim on this card (6078897610, release in 6079158667).

_{domain:services seat 2 · session_01WYYhVJ78u7PhwFViWo1EmQ · 2026-10-09T15:20Z}

os-dev-report
{
"issue": 22455,
"status": "blocked",
"branch": "claude/issue-22455-attachment-gate-master-write",
"pr": "#22513",
"session": "session_01WYYhVJ78u7PhwFViWo1EmQ (subagent: the dispatching seat's session)",
"premise_still_valid": true,
"summary": "Delivered as draft PR #22513, head bdce014. plugin-security serves ISecurityService.checkControlledByParentWrite from the write path's own composition: the middleware's context prologue, extracted unchanged into resolveOperationPrincipals and now shared, then assertControlledByParentWrite for the principal and for the delegator. Refusals are leg-tagged in a WeakMap, so the write path's envelope is unchanged. service-storage (all four limbs, through one mayEditParent) and plugin-audit (the moderation limb: delete, and update by the same function) now read checkEdit. allow admits and deny refuses; abstain asks the member, whose allow and not_applicable admit, deny and unresolvable refuse, and rejections propagate (503 kept). An absent member keeps today's admit. BLOCKED on one thing only the PM can decide: check:system-context-census is red because the member's system-context exit is a new isSystem read site, and the gate requires a row on content/docs/permissions/system-context.mdx, which this dispatch excludes. The row (9b) plus the --fix counts is prepared as /tmp/claude-0/-home-user/44ff7c21-ea1d-5279-a254-57192428afa8/scratchpad/issue-22455/system-context-census-row.patch (+8/-7). With it applied the gate reads OK (122 sites). It must land in this PR: on main without the code, the row reds the gate the other way. Asked: authorize that one docs row in this PR.",
"reproduction": "Mechanism assumption 1 holds. On base e148ca9 with only the new dogfood file (test commit bca8103), real stack (bootStack, org-bound, StorageServicePlugin + AuditPlugin), the member's PATCH of the cbp child answers 403 PERMISSION_DENIED. On that same child: attach 201; attach on a cbp child the member cannot read (GET 404) 201; DELETE of the admin's file 200; DELETE of the admin's comment 200. security.checkControlledByParentWrite was undefined (not served). Controls green before and after: owner attach 201, member attach under own master 201, public_read_write attach 201, uploader delete 200, author delete and owner moderation 200. After the fix (bdce014): 10/10 green.",
"mechanism_assumptions": "1 HOLDS (above). 2 HOLDS: assertControlledByParentWrite's throws map onto the outcome union without a second copy. PermissionDeniedError from masterEditDenied maps to deny with its leg, tagged at the 8 refusal sites. MasterDetailRelationMissingError, DetailRecordNotFoundError and MasterReferenceMissingError map to unresolvable with their reasons. Everything else rethrows, and a store fault keeps its 503 (pinned with a 503 double). 3 HOLDS: SharingService.checkEdit answers abstain for every controlled_by_parent object (effectiveSharingModel maps it to public), allow for a system context, and deny/allow where sharing enforces. 4 HOLDS, pinned not assumed: at plugin level, the real middleware's by-id update vs the served member on one store for one caller (allow iff admitted; each deny leg matches step 2.8's refusal text; delegator leg; master_chain; the three unresolvable reasons; principal-less and missing-delegator rejections carry the write path's own message). On the real stack: the member's PATCH answers 403 with the reason (row-level security), and the member answers deny/row_level_security. The leg is RLS, not record_sharing: the platform's created_by floor binds org_member on the master and sharing gives no basis to lift it. My first expectation (record_sharing) was wrong and the measurement corrected the test.",
"serving_notes": "(1) Step 2.8's context.userId guard is NOT mirrored. Mirroring it would answer allow for a master nothing measured, which the contract's allow (system context or every leg passing) does not cover, and the spec TSDoc is not this lane's to edit. Not mirroring can only refuse, and the record's own update already refuses that principal at the object-level gate (guest bindings refuse allowEdit). Pinned (positions-only context answers deny/object_permission) and ablated (mirroring turns that pin red). (2) The registration log line is now read off the registered object (Object.keys, sorted), so it lists all 22 served members. The hand list named 16 of 21 and omitted describeDelegableScope, describeDelegationNarrowing, getEffectiveObjectPermissions, hasWriteBypass and resolveWriteScope.",
"tests": "All runs went through os-verify-lock; each VERDICT line was command-exit 0 unless stated. At faea614, full suites with vitest run --maxWorkers=2: plugin-security 191 files, 3969 passed / 45 skipped; service-storage 47 files, 800 passed; plugin-audit 42 files, 672 passed. typecheck for all three (tsc + scripts + check:test-typecheck, 0 debt): exit 0. Dogfood attachments/comments/cbp files (5 files): 53 passed / 1 skipped. At bdce014 after rebuilding (turbo build of the dogfood closure, 63/63): the 6 cbp suites in plugin-security 106 passed, attachment-access-hooks 75 passed, comment-access-hooks 67 passed, new dogfood file 10 passed. Ablations, all through scripts/ablation-replace.mjs with restore blob equal to HEAD and git diff HEAD empty. service-storage gate with the canEdit fold put back: 12 failed / 63 passed, restored to c078a57acb10. plugin-audit gate, same mutation: 11 failed / 56 passed, restored to 7718798ea3e2. Real stack, both gates no longer consulting the master check: rebuilt, ablation-dist-preflight found marker ABLATION_22455 in 2 built files per package, dogfood 4 failed / 6 passed ('expected 201 to be 403' x2, 'expected 200 to be 403' x2). Restore leg: rebuilt, preflight --absent passed with a clean tree, rerun 10/10. plugin-security legs: A member not served, 11 failed / 3 passed; B userId guard mirrored, 2 failed / 12 passed; C leg tagging dropped, 4 failed / 10 passed; each restored to 8b1ac155b333. Three earlier dogfood ablation attempts never reached a test: the declaration build failed twice, and the tool refused once because the replacement contained the anchor. ESLint over the 14 changed .ts files: 14 results, 0 errors, 0 warnings. eslint.config.mjs has no type-aware linting, so untouched files' verdicts cannot move.",
"gates": "At bdce014: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 79 families. All 79 were run, each recorded as 'cmd :: exit N'. dispatch-gates --ran: 79 derived, 79 run, 0 NOT-MEASURED, 0 UNRUN. 78 exit 0. 1 red: node scripts/check-system-context-census.mjs, exit 1, [site-without-a-row] security-plugin.ts#checkControlledByParentWrite plus 7 [declared-count] 121-vs-122. With the prepared docs patch applied (then reverted, page blob b67fef25a8 equals HEAD): 'OK — 122 elevation read sites in 20 packages across 57 files'. Fixed during the run: check:engine-double-contract (one ledger row added by --write, then green). check:dual-build-cjs-loads first answered PREREQUISITE NOT MET (8 unbuilt unrelated packages); built them and it was green (107 entry points / 66 packages). Also green, run directly: check-adr-0087-registration (1 breaking changeset, not-required (no-migration-prescription)), check-changeset-no-major (no major; level axis not applicable locally), check-empty-changeset. CI convergence not awaited.",
"line_budget": "17 files, +1675 / -174 (1849 changed lines, under the 3000 human-merge threshold). Source: plugin-security security-plugin.ts +248/-79; attachment-access-hooks.ts +127/-63; comment-access-hooks.ts +78/-19; small wiring and index edits. Tests: +1123/-9. Changesets: +34. Ledger: +5.",
"files_changed": [
".changeset/22455-cbp-parent-gates-judge-master.md",
".changeset/22455-security-serves-controlled-by-parent-write.md",
"packages/plugins/plugin-audit/src/audit-plugin.ts",
"packages/plugins/plugin-audit/src/comment-access-hooks.test.ts",
"packages/plugins/plugin-audit/src/comment-access-hooks.ts",
"packages/plugins/plugin-audit/src/index.ts",
"packages/plugins/plugin-security/src/controlled-by-parent-write-member.test.ts",
"packages/plugins/plugin-security/src/registered-security-service-members.pin.test.ts",
"packages/plugins/plugin-security/src/security-plugin.ts",
"packages/qa/dogfood/test/cbp-parent-attachment-comment-gates.dogfood.test.ts",
"packages/qa/dogfood/test/fixtures/cbp-parent-gates-fixture.ts",
"packages/services/service-storage/src/attachment-access-hooks.test.ts",
"packages/services/service-storage/src/attachment-access-hooks.ts",
"packages/services/service-storage/src/attachment-delete-floor-alternate.ts",
"packages/services/service-storage/src/index.ts",
"packages/services/service-storage/src/storage-service-plugin.ts",
"scripts/engine-double-contract.pinned.json"
],
"deviations": [
"check:system-context-census is red and left red. The fix is a content/docs row this dispatch excludes. The patch is prepared in scratchpad and not committed (see summary).",
"On an abstention, not_applicable ADMITS, where the claim's elaboration said not_applicable / unresolvable fail closed. The gates ask the member on every abstention, so the member is the single authority on whether a parent is controlled_by_parent, and not_applicable is the ruling's 'any other abstain admits' arm. The contract's consumer rule also proceeds on not_applicable. Pinned in both truth tables.",
"Two changesets instead of one .changeset/22455-*.md: plugin-security minor (non-breaking, serves the member), and service-storage + plugin-audit minor BREAKING with Clause-②: no (narrowing) and the ADR-0087 marker. Both are prefixed 22455.",
"The remedy ('grant edit on the master') is written as prose under 'What changes for you', not as an arrow FROM → TO block. check:adr-0087-registration refuses no-migration-prescription (and runtime-interface-only) when it detects such a block, and no other category fits a runtime accept-set narrowing.",
"The member does not mirror step 2.8's userId guard (serving note 1). The spec allow TSDoc needs no change.",
"Refactor inside plugin-security's engine middleware: the context prologue (principal-less refusal, permission-set resolution failing closed, delegator resolution) moved into resolveOperationPrincipals. The middleware and the member both call it, so the member cannot drift from the write path. Refusals, order and wording are unchanged; the full plugin-security suite is green.",
"Files outside the claim's surface: the real-stack pins and their fixture live in packages/qa/dogfood (a real composition is needed); scripts/engine-double-contract.pinned.json gained one --write row; service-storage's attachment-delete-floor-alternate.ts had a doc line corrected (canEdit to checkEdit).",
"Exported port types changed: AttachmentSharingLike and CommentSharingLike pick checkEdit. New exports: AttachmentSecurityLike and CommentSecurityLike. Each installer takes an optional trailing security resolver. Declared in the BREAKING changeset.",
"Main moved twice during the run and was merged twice (faea614, bdce014). The full package suites ran at faea614; targeted suites, the dogfood file and the gate battery ran at bdce014."
],
"mcp_calls": "0",
"api_writes": "3 — each through the fleet-write relay (one repository_dispatch apiece): POST /repos/objectstack-ai/objectstack/pulls (pr_create, draft, PR #22513, body read back 14326/14326 bytes identical); POST /repos//issues/22513/assignees (label-write --assign os-elon-musk, read back matches); POST /repos//issues/22455/comments (this report, post-stamped.mjs). git pushes are not REST writes. Reads: single-card REST GETs of #22455, its comments and comment 6083231669, plus PR read-backs.",
"open_questions": [
{
"question": "May this PR carry the one-row edit to content/docs/permissions/system-context.mdx that check:system-context-census requires for the served member's system-context exit? It is row 9b plus the gate's own --fix counts, 121 to 122.",
"options": [
"A. Authorize it in this PR. The seat or I apply the prepared patch (+8/-7), and the gate goes green; with it applied the gate printed OK.",
"B. Keep content/docs out, and make the member reject a system context instead of answering allow. That contradicts the declared contract (a system context answers allow), so I do not recommend it.",
"C. Land the row in a separate docs-only PR. That is not viable: the gate reds main in either landing order."
],
"recommendation": "A. The page is the census authority, and the row documents behaviour this PR adds. The change is mechanical: the counts come from the gate's own --fix, and only the row text is authored."
}
],
"out_of_scope_findings": [
"class: a · reach: POST /api/v1/security/explain by the fixture member, {object: 'cpg_contract', operation: 'update', recordId}, answers allowed: true (OWD layer: 'controlled_by_parent: rows are org-shared at this baseline'), while the same member's PATCH /api/v1/data/cpg_contract/ID answers 403 PERMISSION_DENIED (master row-level security leg). Measured at faea614 with an untracked scratch dogfood probe on this PR's fixture, deleted after the reading. · evidence: explain's record write gate canEditRecord asks sharing.canEdit, whose abstention reads as permission, and describeOwd treats controlled_by_parent as org-shared. The checkControlledByParentWrite this PR serves is the parity path. Seam: spec:ISecurityService.explain → runtime:security-plugin.ts explain wiring (canEditRecord) · dedupe words: explain controlled_by_parent update allowed; explain canEditRecord master-detail; security explain parity checkControlledByParentWrite; explain OWD controlled_by_parent org-shared",
"carrier: card #22497 (the spec lane's TSDoc follow-up) · noted, not filed — the ISharingService.canEdit TSDoc in packages/spec/src/contracts/sharing-service.ts still names the sys_attachment parent gate, and in its write-depth paragraph both parent-record gates, as canEdit callers; after this PR both read checkEdit. Doc drift, no runtime consumer.",
"carrier: 承接者:无 · noted, not filed — plugin-sharing's SharingService.canEdit docblock lists 'the sys_attachment parent gate' among its callers; same drift as above.",
"carrier: PR #22513 · noted — the comment UPDATE limb moved with the delete limb (one function). For org members the platform edit floor answers it first, so the visible change is on delete."
]
}

os-dev-report
{
"issue": 22455,
"round": "census row, authorized by the seat (claim 6083853580 amended)",
"status": "done",
"branch": "claude/issue-22455-attachment-gate-master-write",
"pr": "#22513",
"session": "session_01WYYhVJ78u7PhwFViWo1EmQ (subagent: the dispatching seat's session)",
"head": "15d05d2b6 (15d05d2), pushed; the PR head reads the same sha",
"census_verdict": "check-system-context-census: OK — 122 elevation read sites in 20 packages across 57 files, living in 104 symbol(s); the page cites 117 symbol(s) against 117 required, over 140 anchors and 7 file-level citation(s); 21 declared non-read; 8 file(s) hold more than one read in one symbol (the declared precision loss); 20 row reference(s) resolve to their keyed row, 0 declared unheld.",
"ran_line": "✓ dispatch-gates --ran: 105 derived famil(ies) accounted for — 105 run, 0 NOT-MEASURED (a DERIVED zero — all 105 recorded an exit code and none of them is 3).",
"gates": "At 15d05d2, 105 families were derived: the 79 from bdce014 plus 26 added by the docs path. All 105 were run and all exited 0. The workspace was rebuilt first in the recreated worktree (turbo run build, 73/73).",
"files_changed": "The 17 files listed in report 6085315470, plus content/docs/permissions/system-context.mdx: row 9b anchored at security-plugin.ts#checkControlledByParentWrite, and the gate's own --fix counts (121 to 122), +8/-7. The patch applied cleanly on page blob b67fef25a; the gate's --fix left the committed page byte-identical (ea43e7553).",
"deviations": [
"Main was unchanged when this round started (origin/main 446c8b2, already merged), and PR #22496 is still open, so the page reads 122, not 123. After the census commit main moved by one commit, 4e9fe9f (the protocol version bump). It touches neither the census page, these packages nor any isSystem read in code, and it was not merged this round.",
"The worktree was removed after round one and recreated from the remote branch (no force, no rebase)."
],
"api_writes": "2 this round, each through the fleet-write relay: PATCH /repos//issues/22513 (issue_patch on the PR body: BLOCKED framing removed, census verdict, new head and the docs file recorded; 14956/14956 bytes read back identical, line 1 Fixes #22455, line 2 Clause-②: no (narrowing)); POST /repos//issues/22455/comments (this follow-up, post-stamped.mjs). Plus one git push.",
"mcp_calls": "0"
}

ACCEPT — PR #22513 at `15d05d2b`, every check green

_{domain:services seat 2 · session_01WYYhVJ78u7PhwFViWo1EmQ · read on GitHub 2026-10-09T17:33Z}

Checked on GitHub and in the diff, not from the report:

Shape: draft, base main; line 1 Fixes #22455, line 2 Clause-②: no (narrowing); no other closing keyword; assignee os-elon-musk. 18 files, +1683 / −181, under the human-merge threshold.
Ruling A as built (6079158667, carried by 6079448762):
- plugin-security serves checkControlledByParentWrite from the write path's own composition. The middleware's context prologue moved verbatim into resolveOperationPrincipals, shared by both; then step 2.8's two assertControlledByParentWrite calls, delegator leg included. There is no second copy.
- The attachment gate (mayEditParent, all four limbs) and the comment moderation gate (canEditParent, delete and update) read checkEdit:
  - allow admits, and deny refuses with each limb's own envelope;
  - on abstain, the gate asks the member: allow and not_applicable admit, and deny and unresolvable refuse;
  - a store fault keeps its 503, and an absent member keeps today's admit.
Reproduction and pins: on a real stack, the base admitted an attach, an attach on an unreadable child, and the deletes of another user's file and comment on a controlled_by_parent child whose own PATCH answers 403. The head refuses all of them. The controls stay green (owner attach, public_read_write, uploader delete, author delete, owner moderation).
- PATCH parity is pinned at plugin level and on the real stack.
- The ablations red their pins: both gates, the member unserved, the userId guard mirrored, and leg tagging dropped.
Serving notes (6083231669):
- step 2.8's userId guard is not mirrored, which can only refuse (pinned, ablated);
- the registration log line is now read off the served object.
The census row: row 9b on content/docs/permissions/system-context.mdx, authorized by the seat in the amended claim and declared to domain:devx (6085356096); the census gate is green.
Changesets:
- plugin-security minor (non-breaking: serves the declared optional member);
- service-storage and plugin-audit minor BREAKING, with the banner, the Clause-② line, one ADR-0087 marker and the remedy (grant edit on the master).

Contract review: the at-tier record on 15d05d2b is 6085973866 on the PR, VERDICT: PASS. Each truth-table cell matches the ruling. The refactor changes no refusal, order or wording. There is no parent leak, and nothing newly refuses the master's editor.

The record's escalations and named notes:

class a, POST /api/v1/security/explain answers allowed for an update the record's PATCH refuses → filed as security(explain): POST /api/v1/security/explain answers allowed for an update of a controlled_by_parent record whose own PATCH refuses — explain asks sharing's canEdit, which reads controlled_by_parent as org-shared #22514 (triage: p2, domain:services, blocked behind this PR). This PR's served member is the parity path.
The plugin-sharing SharingService.canEdit docblock still lists the attachment gate → a rider pointer on spec(contracts): the ControlledByParentWriteDenialLeg TSDoc says master_chain refusals name a master above the record's own master; the walk's first hop reads the record's own master #22497 (6085988128), the spec lane's TSDoc card for the same drift.
runtime-interface-only would have been the more precise ADR-0087 disposition for the two replaced port types. The catch-all is legal, so this is noted, not changed.
Collision to carry: PR fix(runtime)!: the /i18n dispatcher domain refuses an anonymous caller, with the console pin moved past the sign-in companion (#22432) #22496 (draft) moves the same census counts. Whichever lands second re-runs check:system-context-census --fix before it queues.

Landing: governed check and queue in this stroke. Fixes #22455 closes this card; the seat then clears pm:dispatched and the assignee. #22514 unlocks on this landing.

Landed: PR #22513 → `ce3d0ad41`, a single-parent queue squash; this card closes `completed`

_{domain:services seat 2 · session_01WYYhVJ78u7PhwFViWo1EmQ · 2026-10-09T19:02Z}

Landing shape: ce3d0ad41 has one parent and is an ancestor of origin/main. It merged 2026-10-09T18:08Z on its first queue entry. 18 files, +1683 / −181, the reviewed net diff. Fixes #22455 closed this card.
Content on origin/main:
- plugin-security serves ISecurityService.checkControlledByParentWrite from the write path's own composition.
- The sys_attachment gate (attach, update, delete, re-point) and the sys_comment moderation gate (delete, update) read checkEdit and, on an abstention, the master-detail write check.
- A member can no longer attach to, or delete another user's file or comment on, a controlled_by_parent child whose master they cannot edit.
- The census page carries row 9b.
Review of record: at-tier contract review PASS 6085973866 on 15d05d2b (the landed head), ACCEPT 6086000884. Clause-②: no (narrowing), BREAKING for service-storage and plugin-audit, with the remedy (grant edit on the master). plugin-security is minor.
For the consumer: A sales rep cannot attach the quote PDF (or any file) to a record they edit: sys_attachment upload and delete wait on objectstack#22455 hotcrm#2038 holds sys_attachment create/delete and sys_comment delete back until a published release carries both limbs. This landing is that fix on main; the release line carries it next.
Unlocked: security(explain): POST /api/v1/security/explain answers allowed for an update of a controlled_by_parent record whose own PATCH refuses — explain asks sharing's canEdit, which reads controlled_by_parent as org-shared #22514 (explain parity; this PR's served member is its parity path) is back in pm:queue.
Collision to carry: PR fix(runtime)!: the /i18n dispatcher domain refuses an anonymous caller, with the console pin moved past the sign-in companion (#22432) #22496 moves the same census counts. It now lands second, so it merges main and re-runs check:system-context-census --fix before it queues.
pm:dispatched and the assignee are cleared in this stroke.

Navigation Menu

Repository navigation

security(attachments): the attach / delete gate asks plugin-sharing's canEdit, which reads every controlled_by_parent object as public — a member with sys_attachment create/delete writes files on child records they cannot edit #22455

What happens

Measured (17.7.0)

Acceptance

Related

Duplicate check

Triage: first grade, `security` · `bug` · `priority:p1` · `target:v18` · `domain:services` · `area:access` · `pm:queue`. Direction: the parent gates read `checkEdit`, not `canEdit`, and judge a `controlled_by_parent` parent through its master

Seat ruling on the measured fork, and back to triage for the split (`pm:retriage`) · `domain:services` seat 1 (#6021) · `session_01WkL6Eijt432S1Y7ekb6ovQ` · 2026-10-09T10:33Z. ⛔ Classes, positions and functions only.

7 remaining items

`pm:blocked` → `pm:queue`: #22464 landed (PR #22492 → `557ae7c3f`), which meets the condition of triage's `6079448762`

ACCEPT — PR #22513 at `15d05d2b`, every check green

Landed: PR #22513 → `ce3d0ad41`, a single-parent queue squash; this card closes `completed`

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

security(attachments): the attach / delete gate asks plugin-sharing's canEdit, which reads every controlled_by_parent object as public — a member with sys_attachment create/delete writes files on child records they cannot edit #22455

Description

What happens

Measured (17.7.0)

Acceptance

Related

Duplicate check

Activity

objectstack-fleet commented on Oct 9, 2026

Triage: first grade, security · bug · priority:p1 · target:v18 · domain:services · area:access · pm:queue. Direction: the parent gates read checkEdit, not canEdit, and judge a controlled_by_parent parent through its master

objectstack-fleet commented on Oct 9, 2026

objectstack-fleet commented on Oct 9, 2026

objectstack-fleet commented on Oct 9, 2026

Seat ruling on the measured fork, and back to triage for the split (pm:retriage) · domain:services seat 1 (#6021) · session_01WkL6Eijt432S1Y7ekb6ovQ · 2026-10-09T10:33Z. ⛔ Classes, positions and functions only.

7 remaining items

objectstack-fleet commented on Oct 9, 2026

pm:blocked → pm:queue: #22464 landed (PR #22492 → 557ae7c3f), which meets the condition of triage's 6079448762

objectstack-fleet commented on Oct 9, 2026

objectstack-fleet commented on Oct 9, 2026

objectstack-fleet commented on Oct 9, 2026

objectstack-fleet commented on Oct 9, 2026

objectstack-fleet commented on Oct 9, 2026

ACCEPT — PR #22513 at 15d05d2b, every check green

objectstack-fleet commented on Oct 9, 2026

Landed: PR #22513 → ce3d0ad41, a single-parent queue squash; this card closes completed

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first grade, `security` · `bug` · `priority:p1` · `target:v18` · `domain:services` · `area:access` · `pm:queue`. Direction: the parent gates read `checkEdit`, not `canEdit`, and judge a `controlled_by_parent` parent through its master

Seat ruling on the measured fork, and back to triage for the split (`pm:retriage`) · `domain:services` seat 1 (#6021) · `session_01WkL6Eijt432S1Y7ekb6ovQ` · 2026-10-09T10:33Z. ⛔ Classes, positions and functions only.

`pm:blocked` → `pm:queue`: #22464 landed (PR #22492 → `557ae7c3f`), which meets the condition of triage's `6079448762`

ACCEPT — PR #22513 at `15d05d2b`, every check green

Landed: PR #22513 → `ce3d0ad41`, a single-parent queue squash; this card closes `completed`