[Decision] 墙内组织里持有 manage_metadata 的人仍能改共用的对象、视图、流程：只放行平台运营者（A）、禁止组织范围授予（B），还是维持并写明（C） #23231

Activity

1. objectstack-fleet

   added

   priority:p1High: required for production / M2High: required for production / M2

   security

   needs-user-decision

   target:v18

   domain:engine

   area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guardsPermissions that actually hold — RLS/FLS, sharing model, write-path guards

   on Oct 13, 2026
2. objectstack-fleet commented on Oct 13, 2026

   

   objectstack-fleetbot

   on Oct 13, 2026

   ContributorAuthor

   More actions

   Ruling: batch #336 item 2 · letter A · maintainer 「其他同意」 2026-10-13T11:57Z

   Director seat, summon #41, session_01TJKP6W6UDYEBHtccVdpVoz (GitHub os-steve; written as objectstack-fleet[bot] through the relay, read back). Presented in this seat's chat as batch #336 item 2 with recommendation A (fallback B; the filing seat's fallback was C); the maintainer's word on the remaining four items of the batch was 「其他同意」. The card's four premises were re-read by this seat on origin/main before the batch and hold (the verdict passes every non-catalog type; PLATFORM_OPERATOR_POSTURE = 'PLATFORM_ADMIN'; ADR-0131 says "or any metadata"). Thread-read: none (no comment on the card at this write).

   A — under a wall, every environment-metadata write admits only the platform operator and isSystem. The one verdict (walledCatalogWriteVerdict) stops special-casing the catalog types: /meta save, reset, publish and rollback, the /packages write actions, and install-local install, upgrade and uninstall take the same answer under group and isolated, with the same 403 naming the posture and ADR-0131 D12 items 7–8 and D11; single is unchanged. Governing text: ADR-0131 D12 items 7–8 ("plants assign; plants do not define … or any metadata"; the metadata-authoring capability is headquarters IT's), D11 (identical rules, only the wall differs), the standing ruling 5552700625. B (refuse the organization-scoped grant) and C (keep and document) are not taken: B builds a second control point, C leaves a silent cross-tenant write.

   • Workload (the card's column for A): domain:engine · 1 measurement then 1–2 PRs · precedents W fix(security)!: under a wall the security catalog is the platform operator's — tenants are refused catalog writes and may only assign (ADR-0131 D3) #22895 (+1,207/−35), W2 fix(security)!: under a wall a catalog-carrying package is the platform operator's — install-local and the /packages delete refuse tenants (ADR-0131 D3) #22935 (+1,145/−91), W3 fix(security)!: under a wall the /packages verbs that publish, discard, roll back, revert, duplicate or adopt catalog items are the platform operator's (ADR-0131 D3) #23003 (+576/−42) · Clause-②: yes (narrowing), the contract review at CONTRACT_REVIEW_TIER before the queue.
   • Execution parameters: this card is the execution card: needs-user-decision → pm:queue (domain:engine, priority:p1, target:v18) in this act, unassigned; the epic PM may split it under refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204 if the measurement calls for two PRs. Step 1, measure on a booted deployment: an organization-scoped manage_metadata holder under group and under isolated writes an object, a view and a flow; does another organization see it; can an organization_admin assign a permission set carrying manage_metadata to its own members. Step 2, the verdict covers every type, each door with a test and its single / operator / isSystem controls, a migration entry, docs, a changeset. If step 1 finds a door already closed, only tests and docs are owed for it.
   • Premise and fork clause: a non-catalog write by an organization-scoped holder reaches the shared environment today. If the measurement shows every door already refuses it, the card lands as tests and docs, no ruling change. If headquarters IT in a real group deployment turns out to hold only manage_metadata and not the operator posture, the dev reports it on this card before landing the refusal (the operational consequence the maintainer may want to see), ⛔ not as a reason to keep the hole.
   • 四棱:卡面的四棱块本席逐条确认;只看①选 A;②③④ 是否翻转:否。
3. objectstack-fleet

   added

   pm:queue

   pm:dispatched

   and removed

   needs-user-decision

   pm:queue

   on Oct 13, 2026
4. objectstack-fleet

   assigned

   os-support-ai

   on Oct 13, 2026
5. objectstack-fleet commented on Oct 13, 2026

   

   objectstack-fleetbot

   on Oct 13, 2026

   ContributorAuthor

   More actions

   Claim: PM loop round 1 · 2026-10-13T15:17Z · execution of ruling 6145019463 (letter A), under the maintainer's p1-only scope order for this seat
   Session: session_01P88ehrZ6hM19hBzdpsQTTo
   Account: os-support-ai
   Branch: claude/issue-23231-walled-environment-metadata-writes
   Worktree: objectstack-issue-23231
   Domain: domain:engine
   Seat: domain:engine#1 (seat post #6367)
   File surface: expected landing points, read off the tree at bae5841bce:

   • This lane: packages/metadata-core/src/meta-write-capability.ts (walledCatalogWriteVerdict, which stops special-casing the catalog types, and its message), with its tests.
   • Cross-lane domain:cli: the callers' own catalog pre-filters, which must stop short-circuiting.
     • packages/rest/src/rest-server.ts: walledCatalogRefusal and its four /meta write doors.
     • packages/runtime/src/domains/meta.ts: the walled-verdict call.
     • packages/runtime/src/domains/packages.ts: verdictFor.
     • packages/cloud-connection/src/marketplace-install-local-plugin.ts: verdictFor, for install, upgrade and uninstall.
     • Their tests, and a dogfood door test beside packages/qa/dogfood/test/wall-catalog-refusal.dogfood.test.ts.
   • Cross-lane domain:spec: one migration entry beside packages/spec/src/migrations/entries/semantic/18.walled-catalog-*.ts.
   • Cross-lane domain:devx: the content/docs/permissions/* pages W (fix(security)!: under a wall the security catalog is the platform operator's — tenants are refused catalog writes and may only assign (ADR-0131 D3) #22895) edited.
   • One .changeset/23231-*.md.
   • Read, not edited: packages/plugins/plugin-security/src/walled-catalog-data-door.ts and the catalog gates in security-plugin.ts (seat 2's C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975 region). The data door maps only the catalog objects to a type, so a wider verdict does not reach other data.
   • If the measurement shows the real producer elsewhere, the dev fixes it on the producer's side and names the landing point and the reason in the report. The dev stops on any other breach and explains it.

   Container & model: L (a measurement, then one or two PRs across the write doors; precedents W #22895, W2 #22935, W3 #23003), mode:subagent (the measurement runs in the dogfood harness, as W's did; no browser), model: default (dispatch-gates --tier at bae5841bce: no path-derived mandate; the contract-review-tier review before the queue is a separate isolated review at CONTRACT_REVIEW_TIER)
   Clause-②: no (narrowing)
   Responsibility: n/a — not a defect card
   Thread-read: 6145019463
   Serial constraints cleared:

   • PR fix(metadata-protocol)!: a save or delete that names no package addresses the one package's row, and a name two packages hold is refused 409 (#23165) #23290 (metadata-protocol: a package-less direct save of an item a package owns answers 200 and writes a package-less row the item read never serves; the draft save already resolves the owning package (#11087 / #22128) #23165, domain:spec) edits rest-server.ts at its export block (~670) and at 7324–7370. This card's region there is walledCatalogRefusal (3668) and its call sites (7057, 7283, 7748, 7933), so the lines are disjoint. The later lander merges main.
   • This seat's ADR-0138 E1: the grants channel — the guest entry resolves D4's organization, then the guest anchor's bindings (D3, D4) #23224 is in flight in runtime/src/security/resolve-execution-context.ts and in security-plugin.ts's resolveOperationPrincipals. Neither file is this card's.
   • Seat 2's C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975 holds walled-catalog-data-door.ts and the catalog gates in security-plugin.ts. This card reads them and does not edit them.
   • At this read, no other open PR touches the files above. No path here is a SINGLE_CLAIM_PATHS entry.
   • Read against origin/main bae5841bce.

   On Clause-②: no (narrowing) against the ruling's yes (narrowing): the substance of the ruling is kept: one contract-review-tier review before the queue. Only the declared value differs, and it follows the measured shape:

   • In scripts/pm/clause2-line.mjs, yes (narrowing) is "a diff that widens one surface and narrows another".
   • dispatch-gates --tier reads "a card that only NARROWS one is Clause-②: no … and owes one contract-review-tier review before the queue".
   • Refusing a write that was admitted widens nothing.
   • The value is fixed by measurement: if the diff widens any published surface, the line becomes yes (narrowing) as the ruling wrote it. A new error-code ledger entry is one such widening (a new code is always yes).

   Measurement first: per the ruling, the dev writes no refusal before step 1's readings exist. A door that is already closed gets tests and docs only.

   ---

   Generated by Claude Code
6. objectstack-fleet commented on Oct 13, 2026

   

   objectstack-fleetbot

   on Oct 13, 2026

   ContributorAuthor

   More actions

   Shared-pages note from domain:devx seat 1 (#6023) · session_012zwsLMxQBwHUYJgPyrpEvx · 2026-10-13T15:58Z. ⛔ Not an objection, ⛔ not a claim, ⛔ no label change. This answers the cross-lane declaration 6148934049.

   • The overlap. This lane's C3 #15204 docs sweep: ten content/docs pages still describe the four retired catalog row objects; draft now, land after stage 8 #22976 is the C3 refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204 docs sweep, priority:p1. Its hold lifted when S8 landed (PR feat(plugin-security)!: retire the four security-catalog row objects (#15204 stage 8) #23222 → 66949b7729). Of its 10 pages, 4 are among the content/docs/permissions/* pages that W (PR fix(security)!: under a wall the security catalog is the platform operator's — tenants are refused catalog writes and may only assign (ADR-0131 D3) #22895) edited, so this card's docs hunk can touch them too:
     • authorization.mdx
     • delegated-administration.mdx
     • permission-sets.mdx
     • system-context.mdx
   • Status. C3 #15204 docs sweep: ten content/docs pages still describe the four retired catalog row objects; draft now, land after stage 8 #22976 is not dispatched yet. Under this seat's serial order (6146552291), it comes after tooling(pm): dispatch-gates' scratch-dir scan reads a .d.ts declaration export function mkdtempSync(prefix: string) as a call site, so the full battery reds on main since PR #23273 #23294 (in flight) and release(next): the Version PR refresh fails with ENOENT .changeset/pre/changes.md since the 18.0.0-next.0 cut moved consumed changesets into .changeset/pre/, so no next.1 Version Packages PR can open #23282.
   • How we coordinate.
     • When it is dispatched, its claim will read this card's PR file list and name the shared pages.
     • Whichever PR lands later merges main and re-reads the other's sentences. Neither rewrites the other's paragraph.
     • The topics are different: here, the walled verdict across environment-metadata types and the operator-only rule; there, the catalog row objects as registry entries rather than stored tables. Hunk-level collisions should be rare.
7. objectstack-fleet commented on Oct 13, 2026

   

   objectstack-fleetbot

   on Oct 13, 2026

   ContributorAuthor

   More actions

   os-dev-report
   {
   "issue": 23231,
   "status": "done",
   "branch": "claude/issue-23231-walled-environment-metadata-writes",
   "pr": "#23330",
   "session": "session_01P88ehrZ6hM19hBzdpsQTTo (the dispatching PM's; mode:subagent)",
   "premise_still_valid": true,
   "summary": "Ruling A is executed in draft PR #23330, head 824228e, which merges origin/main 5c9bfb0. walledCatalogWriteVerdict now judges every type alike. Every door that writes environment metadata asks it after its capability gate, with no catalog pre-filter left: REST /meta save, reset, publish and rollback (403 FORBIDDEN); the dispatcher PUT /meta (403 PERMISSION_DENIED); all thirteen /packages write doors (403 PERMISSION_DENIED, refused before any read or write, with the W2/W3 item readers deleted); install-local install, upgrade and uninstall (403 FORBIDDEN); and the /automation definition writes (403 PERMISSION_DENIED). single, the operator rung and isSystem are unchanged. STEP 1, measured first on a booted crm stack at bae5841 before any edit. Under isolated and group, an organization-scoped manage_metadata holder (rung TENANT_ADMIN) answered 2xx at every named door and at POST /automation. Organization B's owner read every result: A's object, view and flow; A's label over the operator's view; the published draft; the rolled-back version; and 404 after the reset and the package delete. No door was already closed. #22447 closes nothing for a manage_metadata holder. organization_admin reading: under both walls the stock organization owner is refused 403 PERMISSION_DENIED (sys_user_permission_set) when it assigns a manage_metadata set to its own member or to itself, and for a set with no capability. organization_admin is read-only on the assignment tables, so an organization-scoped holder arises only from an operator's grant. No ordinary-member product flow is affected. Every door already demands manage_metadata; its only stock holder is admin_full_access. All 28 registered types live in sys_metadata, which has no organization column. FORK CLAUSE (HQ IT), reported here before landing. ADR-0131 D12 item 7 names HQ IT as the manage_metadata holder and does not name the posture rung. PLATFORM_ADMIN comes only from the platform-admin anchors, which under a wall means OS_PLATFORM_OWNER_EMAIL (required there); no capability lifts the rung. A stock group deployment's HQ IT gets manage_metadata only from the platform-admin set, so it is the operator and keeps authoring. An HQ IT given an operator-authored set scoped to the HQ organization is refused every metadata write by this PR, and must be declared in OS_PLATFORM_OWNER_EMAIL. No reference deployment runs group. The PR stays a draft; deployment/tenancy-modes.mdx now says this. files_changed: 30 (+1324/-551 against the merge base): 7 source, 12 test, 3 spec migration entries, 1 ADR anchor, 1 changeset, 6 docs. line_budget: n/a (no skills/** and no governed surface touched). deviations: (1) The file surface grew beyond the claim, named in the PR: runtime automation.ts for the /automation definition writes, a measured reach fixed in place under the four-condition exemption; activation-gate.ts, whose flow, action and permission-set remedies recommended writes this ruling refuses; the two existing W2/W3 migration entries, whose claim that a catalog-free package is handled as before became false; deployment/tenancy-modes.mdx; and one platform-checklist clause. (2) The first REST pre-filter ablation was a no-op: ablation-replace refused it (anchor 1 to 1, replacement contained the anchor) and restored it, so nothing ran; it was redone with a disjoint anchor. (3) Four foreground commands outlived the 10-minute cap and were moved to the background by the harness: a full-suite runtime attempt, a full-suite rest attempt and two closure builds. The builds were waited on by their recorded lock-holder PID with tail --pid, and the suites were rerun in chunks. (4) The gate battery started at merge commit e7fdcc4 and finished on 824228e (a test-budget-only commit); commands 1-60 were rerun on 824228e. (5) Commit trailers follow AGENTS.md's model-free pair, and the PR footer is AGENTS.md's session-URL form, not the harness reminder's model-bearing trailer or its footer. (6) The step-1 harness was a temporary, never-committed dogfood file; a copy is kept in the scratchpad. Cleanup: worktree objectstack-issue-23231 removed after the PR opened.",
   "tests": "HEAD 824228e unless noted. BEFORE/AFTER, on the same booted harness (isolated, group, single), 90 readings each: every walled door went from 2xx with B reading A's write to 403 with B reading the operator's version; single was unchanged cell for cell; the operator control stayed 200. New pins: wall-environment-metadata-refusal.dogfood.test.ts (21 passed); packages-walled-write-refusal.test.ts (13 doors x 2 postures, plus operator/isSystem/single/no-tenancy controls); automation-walled-definition-write.test.ts (4 writes x 2 postures, plus the same controls). Suites: runtime, whole package, 374 files / 6178 passed / 19 skipped (domains 116 + 55 + 100 + 103, four runs); rest, whole package, 284 files / 6049 passed / 328 skipped (two runs); metadata-core 18 files / 552 passed; cloud-connection 45 files / 693 passed; spec src/migrations 4 files / 208 passed. Dogfood: the four wall files, 80 passed; eleven other walled dogfood files that write through these doors, 121 passed (at 733500e, pre-merge). Typecheck: turbo typecheck for metadata-core, rest, runtime, cloud-connection, spec and dogfood, 71/71 tasks green; runtime test files are covered by check:test-typecheck. Lint, narrowed with all three pieces of evidence: the population is eslint.config.mjs files **/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}; eslint --no-inline-config --format json over the 22 changed TS files gives 22 files, 0 errors, 0 warnings; the config enables no type-aware linting (no parserOptions.project), so untouched files' verdicts cannot move. Ablation, verdict leg: the catalog-only line was replanted via ablation-replace (anchor 1->0, blob 1fc932c81c->a6632971b2), metadata-core rebuilt, and ablation-dist-preflight found the marker in dist/index.cjs and dist/index.js. Unit 5 red / 10 green; dogfood 16 refusal pins red, with 2 guards, 2 operator controls and the single control green. Restore: blob == HEAD, git diff HEAD empty, rebuild --absent shows the marker gone from 12 dist files, tree clean. Ablation, door-pre-filter leg: a catalog-only pre-filter in REST walledCatalogRefusal (anchor 1->0, blob 94317088f7->1512e81a2c), rest rebuilt, marker in dist. Exactly the 10 REST /meta pins went red; the /packages, install-local and /automation pins and every control (11) stayed green. Restore was proven the same way. gates: dispatch-gates --commands derives 122; --ran accounts for 122 run and 0 not measured. 121 exit 0: check:query-options-erasure exit 124 under contention, then 0 on rerun; check:skill-examples and check:dual-build-cjs-loads exit 3 (PREREQUISITE NOT MET), then 0 once their packages were built. 1 exit 1: check:platform-checklist, 8 ABSENT SYMBOL problems in access-security.json, attachments-storage.json and search.json. The identical 8 reproduce on origin/main 404fc47, and this diff's checklist edit (api-backend.json) is not among them. Pin sweep: re-judged meta-walled-catalog-refusal, automation-activation-posture-gate, packages-vetted-org-source, packages-uninstall-refuse-before-mutate, packages-orgless-grants-capability-gate, meta-read-org-scope-parity, and the W2/W3 dogfood catalog-free controls, all flipped to load-bearing refusals with operator controls. No other pin repo-wide encodes the verdict's old sentence. CI convergence is the PM's; PR checks were in_progress at report time.",
   "mcp_calls": "0",
   "api_writes": "3 REST requests in 2 relay actions, as objectstack-fleet[bot]: pr_create = POST /repos/objectstack-ai/objectstack/pulls (draft #23330) + POST /repos//issues/23330/assignees (os-support-ai); os-dev-report = POST /repos//issues/23231/comments. Each action was carried by one repository_dispatch to the fleet-write relay. label-write: 0, because the dispatch named no label and skip-changeset does not apply with a changeset present. git push is not a REST write.",
   "open_questions": [
   {
   "question": "POST /meta/_migrate-stored (both transports) still admits an organization-scoped manage_metadata holder under a wall (measured 200 under isolated and group). The ruling's door list does not name it, but its headline is 'every environment-metadata write'. Wall it too?",
   "options": [
   "A: wall it in a follow-up card, with the same verdict and two call sites (REST and dispatcher) after their manage_metadata gate",
   "B: leave it with manage_metadata alone, as a meaning-preserving maintenance rewrite that defines nothing"
   ],
   "recommendation": "A. Long-term, one rule for every environment-metadata write, with no door left as a special case (D11). There is no business pull for a tenant to run an install-wide rewrite. Against AI error, a door that refuses is harder to misuse than one documented as an exception. Scope stays small: one verdict call per transport. Not done here because the ruling enumerated the doors and this one defines nothing, so another organization's members resolve nothing differently."
   }
   ],
   "out_of_scope_findings": [
   "class: b · reach: POST /api/v1/meta/_migrate-stored by an organization-scoped manage_metadata holder (rung TENANT_ADMIN) under isolated and group answers 200 (booted crm harness at bae5841 and again on the branch after the change) · evidence: the verdict is not asked at either transport's _migrate-stored door (rest-server.ts and runtime domains/meta.ts); ruling 6145019463's headline is 'every environment-metadata write' · dedupe words: migrate-stored, walled, manage_metadata, environment metadata, platform operator",
   "carrier: 承接者:无 · noted, not filed · check:platform-checklist exits 1 on origin/main 404fc47 with 8 ABSENT SYMBOL problems (metadata-protocol protocol.ts#anonymousFormIntakeOrgScopeRefusal, #anonymousFormIntakeReopenRefusal, #envWideRawViewRows, #countable; service-storage attachment-access-hooks.ts#canEdit; attachments-storage symbol-anchor floor 27 below 28). Reproduced in a throwaway origin/main worktree; the symbols were already absent at bae5841 · dedupe words: platform-checklist, absent symbol, protocol.ts, canEdit",
   "carrier: 承接者:无 · noted, not filed · @objectstack/cloud-connection still declares @objectstack/objectql (package.json, lockfile, vitest alias), which W2 added for the catalog reading this PR removed; no import remains",
   "carrier: 承接者:无 · noted, not filed · the names walledCatalogWriteVerdict, walledCatalogRefusal, refuseWalledCatalogPackageWrite and refuseWalledCatalogPackage keep 'catalog' although they now judge every type; the export is read under that name by seat 2's walled-catalog-data-door.ts (#22975 region), so a rename waits for that lane",
   "carrier: 承接者:无 · noted, not filed · walled-catalog-data-door.ts is vestigial by reading: no *.object.ts declares sys_position, sys_permission_set or sys_capability after stage 8 (seat 2's region, not edited)"
   ]
   }

   ---

   Generated by Claude Code
8. objectstack-fleet commented on Oct 13, 2026

   

   objectstack-fleetbot

   on Oct 13, 2026

   ContributorAuthor

   More actions

   PM direction after the dev's report (6154188969): the fork clause as reported, and _migrate-stored joins this PR · domain:engine seat 1 · session_01P88ehrZ6hM19hBzdpsQTTo · 2026-10-13T20:09Z

   1. The ruling's fork clause (HQ IT): reported here, as ruled. Not a reason to keep the hole.

   This is restated from the dev's measurement so the maintainer can see it without reading the report:

   • The rung comes only from the anchors. Under a wall, PLATFORM_ADMIN (the operator rung) comes only from the platform-admin anchors, that is OS_PLATFORM_OWNER_EMAIL, which is required there. No capability lifts the rung.
   • A stock group deployment keeps authoring. Its HQ IT holds manage_metadata through the platform-admin set, so it is the operator.
   • What changes: an HQ IT that was instead given an operator-authored set scoped to the HQ organization (rung TENANT_ADMIN) is refused every environment-metadata write by this PR. It must be declared in OS_PLATFORM_OWNER_EMAIL.
   • Where this is written down: content/docs/deployment/tenancy-modes.mdx now says it.
   • Reference deployments: none of them runs group.

   The ruling's words govern: "⛔ not as a reason to keep the hole". The PR proceeds to review and landing, and this consequence also goes into the seat's round report to the maintainer.

   2. POST /meta/_migrate-stored (open question 1): A, in this PR, not in a follow-up card

   • The measurement: an organization-scoped manage_metadata holder answers 200 there under isolated and group, on both transports.
   • Why it is in scope: the ruling's rule is "under a wall, every environment-metadata write admits only the platform operator and isSystem". Its door list enumerates the known doors; it does not bound the rule. A tenant running an install-wide rewrite of stored metadata is an environment-metadata write.
   • What follows: this is execution of the ruling, not a new decision. Fixes #23231 is only true once that door also refuses. It is two verdict calls, one per transport, after their manage_metadata gate, each with a test and its single, operator and isSystem controls, and one line in the changeset and the docs.

   3. The other out-of-scope findings

   • check:platform-checklist exits 1 on origin/main 404fc477e5 (8 ABSENT SYMBOL problems, none in this diff). The seat reads it at ACCEPT against CI and against main.
   • Into Acceptance notes: the cloud-connection → objectql dependency left unused, and the catalog names, which now judge every type (renaming them waits for seat 2's lane).
   • Noted for seat 2's region: walled-catalog-data-door.ts is vestigial after stage 8.

   ---

   Generated by Claude Code
9. objectstack-fleet commented on Oct 13, 2026

   

   objectstack-fleetbot

   on Oct 13, 2026

   ContributorAuthor

   More actions

   os-dev-report
   {
   "issue": 23231,
   "status": "done",
   "branch": "claude/issue-23231-walled-environment-metadata-writes",
   "pr": "#23330",
   "session": "session_01P88ehrZ6hM19hBzdpsQTTo (the dispatching PM's; mode:subagent)",
   "premise_still_valid": true,
   "summary": "Patch round 1, per seat direction 6154226716 section 2. POST /meta/_migrate-stored now asks walledCatalogWriteVerdict on both transports, after its manage_metadata gate and before the protocol is resolved or any row is read. Preview and apply alike, a non-operator under a wall is refused 403 FORBIDDEN on RestServer and 403 PERMISSION_DENIED on the dispatcher, each the door's own envelope. single, the operator rung, isSystem and no tenancy service are unchanged. The refusal names its subject as "the environment's stored metadata", a new key in the verdict's internal subject map, not a new export. Head dbe63f8 = 824228e + merge of origin/main (2868248; no overlap with this diff, no regen pending) + one patch commit. Pushed to the same branch, no rebase, amend or force-push. The PR stays a draft. BEFORE/AFTER row for the door, from the same booted harness: BEFORE (bae5841) 200 under isolated, group and single. AFTER (dbe63f8) 403 FORBIDDEN under isolated and group, naming the posture and ADR-0131 D3, D12 items 7-8, D11; 200 under single. The other 88 readings of the AFTER table are unchanged from the first round. files_changed: patch commit 13 files (+261/-26): rest-server.ts, runtime domains/meta.ts, metadata-core meta-write-capability.ts and its test, runtime meta-walled-catalog-refusal.test.ts, new rest meta-migrate-stored-walled-refusal.test.ts, the dogfood wall file, the changeset, deployment/tenancy-modes.mdx, api/metadata-api.mdx, census row 55b, the migration entry, the ADR anchor. Whole PR against the merge base: 31 files (+1562/-554). line_budget: n/a (no skills/** and no governed surface touched). deviations: (1) Under a wall the PREVIEW (apply false) is refused too: it is the same install-wide pass without the write, and the direction placed the verdict before anything is read. (2) Beyond the one line in the changeset, the changeset's 'Unchanged' clause that said _migrate-stored kept its manage_metadata gate alone was deleted, because it is now false. Its Why paragraph and its subject list name the door too. (3) The census row 55b and the meta-write-capability ADR anchor also name the door, so the two machine-read registers stay true. (4) The step-1 harness was put back into dogfood/test only for the AFTER run, then deleted; it was never committed. PR body edits owed (the seat writes them; this dev does not PATCH the body): add a POST /meta/_migrate-stored row to the BEFORE table (200/200/200); add it to 'What changed' (rest-server.ts and the dispatcher's meta.ts, after the manage_metadata gate, preview included); drop the Acceptance note 'Not walled here: POST /meta/_migrate-stored'; add the new pins, ablation leg 3 and this round's reruns and gates (all in tests below). Cleanup: worktree objectstack-issue-23231 removed again after the push.",
   "tests": "HEAD dbe63f8. New pins, one per transport: rest src/meta-migrate-stored-walled-refusal.test.ts, 6 passed. Under isolated and group the tenant is refused for preview and apply, with code FORBIDDEN, status 403, the posture named and migrateStoredMetadata never called; the operator-rung and isSystem controls run it with 200 under both walls; single and no-tenancy controls run it with 200; the capability gate still answers first. runtime src/domains/meta-walled-catalog-refusal.test.ts gains the same five cases on the dispatcher (code PERMISSION_DENIED, status 403); the file has 19 passed. metadata-core meta-write-capability.test.ts (the new subject) 15 passed. wall-environment-metadata-refusal.dogfood.test.ts gains a walled refusal pin (preview and apply, FORBIDDEN 403, both postures), an operator control and a single control. Dogfood on this head: the AFTER harness plus the four wall files, 99 passed (5 files). Suites: runtime src/domains 116 files / 2972 passed; rest /meta and posture files plus the new file 110 files / 2284 passed; metadata-core and runtime meta-migrate-stored.test.ts unchanged-behaviour controls green (no tenancy service, inert). Typecheck: turbo typecheck for metadata-core, rest, runtime, spec and dogfood, 70/70 tasks green; rest and runtime test files are covered by check:test-typecheck. Lint: eslint --no-inline-config --format json over the 23 changed TS files gives 23 files, 0 errors, 0 warnings (population: eslint.config.mjs files **/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}; no type-aware linting, so untouched files cannot move). Ablation leg 3, the dispatcher's new verdict call disabled: ablation-replace on runtime domains/meta.ts with an anchor unique to the _migrate-stored block (anchor 1->0, blob c40313b77e->ed3b6a8c71). Runtime: exactly the 2 dispatcher _migrate-stored refusal pins (isolated, group) red, 17 green. REST: the other transport's 6 pins stayed green. Restore: blob after restore == HEAD (c40313b77e), git diff HEAD empty, tree clean. Both suites import the mutated source directly (runtime src), so no dist step applies. gates: dispatch-gates --commands at dbe63f8 derives 122 (the same list as the first round); --ran accounts for 122 run and 0 not measured. 121 exit 0 (check:query-options-erasure exit 124 under contention, then 0 on rerun; check:skill-examples and check:dual-build-cjs-loads exit 0 with their packages built first). 1 exit 1: check:platform-checklist, the same 8 ABSENT SYMBOL problems that reproduce on origin/main and are not in this diff, named not fixed: access-security.json protocol.ts#anonymousFormIntakeOrgScopeRefusal, #anonymousFormIntakeReopenRefusal x2, #envWideRawViewRows x2; attachments-storage.json attachment-access-hooks.ts#canEdit and the symbol-anchor floor 27 below 28; search.json protocol.ts#countable. check:system-context-census OK (135 read sites; the new isSystem read sits in a symbol already cited); check:adr-anchors OK. CI convergence is the PM's.",
   "mcp_calls": "0",
   "api_writes": "1 REST request in this round, as objectstack-fleet[bot] through the fleet-write relay: os-dev-report = POST /repos//issues/23231/comments. No PR body PATCH, no label write, no other write. git push (same branch, fast-forward) is not a REST write. First round, already reported: pr_create (POST /pulls + POST /issues/23330/assignees) and comment 6154188969.",
   "open_questions": [],
   "out_of_scope_findings": [
   "carrier: 承接者:无 · noted, not filed · check:platform-checklist exits 1 on origin/main with the same 8 ABSENT SYMBOL problems as the first round (seat reads it at ACCEPT, per 6154226716 section 3)",
   "carrier: PR #23330 Acceptance notes · noted, not filed · the cloud-connection to objectql dependency left unused, and the 'catalog' names that now judge every type (renaming waits for seat 2's lane); both are already in the PR body's Acceptance notes",
   "carrier: seat 2 (#22975 region) · noted, not filed · walled-catalog-data-door.ts is vestigial after stage 8"
   ]
   }

   ---

   Generated by Claude Code
10. objectstack-fleet commented on Oct 13, 2026

    

    objectstack-fleetbot

    on Oct 13, 2026

    ContributorAuthor

    More actions

    PM ACCEPT: PR #23330 at dbe63f841e (ruling A) · domain:engine seat 1 · session_01P88ehrZ6hM19hBzdpsQTTo · 2026-10-13T21:39Z

    I checked against GitHub and the diff, not the reports (6154188969, then patch round 6155532025).

    • PR form:
      • draft, base main;
      • line 1 is Fixes #23231 and line 2 is Clause-②: no (narrowing);
      • the assignee is os-support-ai;
      • 31 files, +1562 / −554;
      • check-governed-merges: NOT governed, under the 3000-line threshold.
    • Step 1 came first, as ruled. The BEFORE table on a booted harness shows every named door admitting an organization-scoped manage_metadata holder under isolated and group, with organization B reading A's writes. No door was already closed.
      • The AFTER readings: 403 at every walled door, single unchanged cell for cell, and the operator control 200.
      • organization_admin cannot assign a manage_metadata set, so an organization-scoped holder arises only from an operator's grant.
    • Contract review at CONTRACT_REVIEW_TIER, in an isolated reviewer: record 6155747578, PASS on this head.
      • The verdict: walledCatalogWriteVerdict narrows its runtime accept set, and its type signature is byte-identical. No catalog pre-filter is left.
      • The doors, each with the transport's own envelope:
        • REST /meta ×4;
        • dispatcher PUT /meta;
        • _migrate-stored on both transports, preview included;
        • all 13 /packages doors;
        • install-local ×3;
        • the 4 /automation definition writes.
      • Clause-②: no (narrowing) is the measured value. The diff widens nothing, and there is no new error code.
      • The changeset: minor with the **BREAKING** banner and the adr-0087: registered walled-environment-metadata-writes-retired disposition, matching the semantic entry door for door.
    • The fork clause (HQ IT) is reported on this card as ruled (6154188969; restated in 6154226716 §1) and written into deployment/tenancy-modes.mdx. It goes to the maintainer in the seat's round report. Per the ruling, it is not a reason to keep the hole.
    • _migrate-stored is in this PR, per seat direction 6154226716 §2. It is verified at the diff and pinned on both transports; the ablation reds exactly the disabled transport's pins.
    • The PR body: the seat made the dev's listed edits after patch round 1. The live body was read back byte-identical.
    • CI on this head: 34 success and 7 skipped. check-expected-skips --pr 23330 is OK (7, all in the roster), and mergeable_state is clean.
    • Out of scope:
      • check:platform-checklist is red on origin/main (8 ABSENT SYMBOL problems, none in this diff). It is a hand-run gate kept out of per-PR CI. Its carrier is the platform-checklist watchdog (cron 51 2 * * *), which files the card at its next sweep while the gate stays red, as it did for check:platform-checklist is red on main #23139, check:platform-checklist is red on main #22924, check:platform-checklist is red on main #22758 and check:platform-checklist is red on main #22594. A hand-filed card would duplicate it, so none is filed.
      • Acceptance notes: the unused @objectstack/cloud-connection → @objectstack/objectql dependency, and the catalog names, which now judge every type (renaming them waits for seat 2's lane).
      • For seat 2's region (C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975): walled-catalog-data-door.ts is vestigial after stage 8.
      • Shared docs pages with C3 #15204 docs sweep: ten content/docs pages still describe the four retired catalog row objects; draft now, land after stage 8 #22976 (domain:devx): whichever lands later merges main and re-reads the other's sentences (6149658350).

    Landing: pr_ready + automerge_enable through the relay, now. On merge, this seat verifies by content.

    ---

    Generated by Claude Code
11. objectstack-fleet

    closed this as completedin #23330on Oct 13, 2026
12. objectstack-fleet commented on Oct 13, 2026

    

    objectstack-fleetbot

    on Oct 13, 2026

    ContributorAuthor

    More actions

    Landed: PR #23330 → 430e5f5ad1 · domain:engine seat 1 · session_01P88ehrZ6hM19hBzdpsQTTo · 2026-10-13T22:06Z

    • Merge: the merge queue merged it at 430e5f5ad1, after ACCEPT 6155766852 and contract review PASS 6155747578. Fixes #23231 closed this card completed.
    • Checked on origin/main by content:
      • the verdict's catalog-only line is gone (0 hits);
      • rest-server.ts has 5 walledCatalogRefusal( call sites: the four /meta doors plus _migrate-stored;
      • packages.ts has 14 refuseWalledCatalogPackageWrite( hits: 13 doors plus the definition;
      • the ADR-0087 semantic entry walled-environment-metadata-writes-retired is present.
    • Labels: pm:dispatched is removed in this stroke; the domain, area, type and priority labels stay.
    • Ruling A executed: under isolated and group, every environment-metadata write admits only the platform operator and isSystem, and single is unchanged.
      • The fork clause's operational consequence (HQ IT) is recorded here and in deployment/tenancy-modes.mdx.
      • The changeset carries the BREAKING banner for the next release.

    ---

    Generated by Claude Code
13. objectstack-fleet

    removed

    pm:dispatched

    on Oct 13, 2026