Uninstalling a package after a kernel reboot leaves its permission set's sys_permission_set row behind (managed_by admin, package_id null) #23299

Activity

1. objectstack-fleet

   added

   bugSomething isn't workingSomething isn't working

   priority:p2Medium: important, M3Medium: important, M3

   finding

   on Oct 13, 2026
2. objectstack-fleet commented on Oct 13, 2026

   

   objectstack-fleetbot

   on Oct 13, 2026

   ContributorAuthor

   More actions

   Triage: first grade, bug · priority:p3 · domain:engine · area:access, into pm:queue (finding removed). Re-measure on main after S8 first: the ghost sys_permission_set row may already be gone with its writer

   Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-13T15:56Z. ⛔ Not a claim, ⛔ not a dispatch.

   • Measured before S8: the card was measured at 01a3421f42. S8 of refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204 (PR feat(plugin-security)!: retire the four security-catalog row objects (#15204 stage 8) #23222, 66949b7729, on main since 2026-10-13T14:44Z) unregisters sys_permission_set and unwires the permission-set projection that wrote the row. The table and its rows stay for C7b's ceremony (C7b build-ahead: os migrate organization-ownership --apply and E5's pure row→definition mappers in core (drafts from main; the --apply PR lands after #15204 stage 8) #22937). C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975 (domain:engine, in flight) deletes the projection's module.
   • Why p3: nothing is granted (the card's own measurement), and its writer and its served surface are both gone on main.
   • Lane: domain:engine, the S8 family's.
   • Direction:
     • First act: the card's sequence on main at or after 66949b7729 (build, reboot, uninstall). If no sys_permission_set row is written, and none is served in Setup or by any door, close it completed by S8 with that measurement. A leftover row from before S8 belongs to C7b's ceremony.
     • If a row is still written or served, fix it where measured, with a pin that holds across a reboot.
3. objectstack-fleet

   added

   area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guardsPermissions that actually hold — RLS/FLS, sharing model, write-path guards

   domain:engine

   pm:queue

   priority:p3

   and removed

   finding

   priority:p2Medium: important, M3Medium: important, M3

   on Oct 13, 2026
4. objectstack-fleet commented on Oct 15, 2026

   

   objectstack-fleetbot

   on Oct 15, 2026

   ContributorAuthor

   More actions

   Closed as completed by S8: on main, nothing defines, writes or serves sys_permission_set · domain:engine seat 2 · session_01ADzJtzYTLUfgrRZHxkagkX · 2026-10-15T11:57Z

   Triage's direction (6149627345): "If no sys_permission_set row is written, and none is served in Setup or by any door, close it completed by S8 with that measurement." The seat read that condition off main 57994c311f. This is a source reading, not a run of the build, reboot and uninstall sequence. The run was skipped under the maintainer's budget note, because every path the sequence could take is gone.

   • S8 is on main. 66949b7729 (refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204 stage 8, PR feat(plugin-security)!: retire the four security-catalog row objects (#15204 stage 8) #23222) retired the four security-catalog row objects. C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975 then deleted the permission-set projection's module.
     • Re-check: git merge-base --is-ancestor 66949b7729 origin/main
   • No package defines or writes the object any more. Every non-test reference outside the v18 ceremony is a comment or a fixture:
     • comments in core/src/security/*, metadata-core/src/meta-write-capability.ts, metadata-protocol/src/{protocol,packaged-base-regime}.ts and lint/src/authoring-rules.ts;
     • a fixture in cloud-connection.
     • The only code that names the table is os migrate organization-ownership (packages/cli/src/utils/organization-ownership-{apply,inventory,plan}.ts), which migrates and drops the legacy rows.
     • Re-check: git grep -n -E "sys_permission_set\b" origin/main -- 'packages/**/src/**' | grep -v -E "\.test\.|/test/|sys_permission_set_"
   • So no door can write or serve such a row. An object no package registers is not served by the data door or by Setup, and the projection that wrote the row after a reboot no longer exists.
   • Rows left from before S8 belong to C7b's ceremony, as triage said. That ceremony is on main (feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211 closed), and its plan covers this table (organization-ownership-apply.ts SETS).

   Reopening is free. If a sys_permission_set row is ever seen written or served on a kernel at or after 66949b7729, reopen this card with that measurement.

   ---

   Generated by Claude Code
5. objectstack-fleet

   closed this as completedon Oct 15, 2026
6. objectstack-fleet

   removed

   pm:queue

   on Oct 15, 2026