[finding] spec liveness: PermissionSet.description reads live, but both readers its evidence names are retired (C3 stage 8 and 7a); re-verify under enforce-or-remove

Finding: after C3 stages 8 and 7a, the liveness ledger says PermissionSet.description is live. Both readers its evidence names are gone, and no runtime reader is known.

packages/spec/liveness/permission.json, the description row (status: live, verifiedAt: 2026-07-30), gives this evidence: "persisted to sys_permission_set.description (plugin-security sys-permission-set.object.ts …); read from the authored set by permission-set-projection.ts (description: ps.description ?? null) and diffed on re-seed".

sys-permission-set.object.ts retired at S8 (feat(plugin-security)!: retire the four security-catalog row objects (#15204 stage 8) #23222, 66949b7729).
permission-set-projection.ts is deleted by C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975's 7a (refactor(plugin-security)!: delete the permission-set projection, the seed-name lookup and the refusal sink (C3 stage 7a) #23368, approved, in the queue).
The C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975 8-post dev searched for a runtime reader of PermissionSet.description (report 6161864889) and found none: no row object, no projection, and the security catalog never reads it.
The citations are bare basenames, so check:liveness cannot see that they are stale: evidence.mts's PATH_RE scans only paths rooted at packages/….

Why it is not a prose fix: rewriting the evidence turns check:liveness red, because the cited file must name description. The status itself needs re-verifying under ADR-0049's enforce-or-remove. The candidates:

a real reader exists, such as Studio's permission-set editor or the metadata door's list view: cite it, and the row stays live;
or none does: dead, then enforce or remove.

Note the #4001 background in the row's note: the built-in sets author it, and the .strict() gate surfaced the gap.

Reach: the authoring surface of every permission set. Display-only metadata, so no authorization effect.

Filed by domain:engine seat 2 (session_01ADzJtzYTLUfgrRZHxkagkX), from #22975's 8-post report and 7a's delta review (6161351497, flag 2). It is carried out of #22975 by name. Triage grades and routes it; the ledger belongs to packages/spec.

Triage: first grade · `priority:p3` · `domain:spec` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-14T07:03Z

Read fresh, and checked on main 5656c5638a:

packages/spec/liveness/permission.json:17-22: description is live (verifiedAt: 2026-07-30), with evidence naming sys-permission-set.object.ts and permission-set-projection.ts;
sys-permission-set.object.ts is gone from plugin-security/src (S8, feat(plugin-security)!: retire the four security-catalog row objects (#15204 stage 8) #23222);
the projection's deletion is PR refactor(plugin-security)!: delete the permission-set projection, the seed-name lookup and the refusal sink (C3 stage 7a) #23368 (7a).

The finding holds.

priority:p3. The ledger misstates one authorable key's liveness. It is display-only metadata, with no authorization effect.
Lane domain:spec. The ledger and the enforce-or-remove call belong to packages/spec.
Scope as filed:
- Re-verify, and either cite a real reader (Studio's editor, the metadata door's list) and stay live, or mark it dead and run ADR-0049 (the spec-property-retirement playbook).
- ⛔ Not a prose-only evidence rewrite.
For the dev: the stale citations are bare basenames that evidence.mts's PATH_RE cannot see. If that blind spot is real, it is its own small finding. ⛔ Don't widen this card.

Regrade: p3 → p2 · `target:v18` added · its outcome may retire an authorable key · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-14T07:18Z

Why it moves: the maintainer directed, on 2026-10-14, that spec-lane queue cards which change the metadata protocol (what @objectstack/spec accepts or declares, or what a metadata door accepts) be raised. The bar triage now applies: a protocol change gets target:v18, so it lands in the 18 window and objectui, cloud and HotCRM mirror it once. A narrowing (breaking) one is p1, because missing 18 GA means waiting for 19. A widening (additive) one is at least p2.

Read fresh. On main b5b1bf7277, the ledger row (packages/spec/liveness/permission.json:17-20) still says live with the stale evidence.

Why it is in this class: if the re-verify finds no reader, the ADR-0049 outcome is to retire PermissionSet.description. That is a protocol narrowing, and it must ride 18.
So the verdict is owed before 18 GA, even though the key is display-only. If a real reader is cited instead, the row stays live and nothing ships beyond the ledger.

Regrade: p2 → p1 · metadata-protocol change, the objectui-dependency rule · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-14T07:46Z

Why it moves to p1: the maintainer added, on 2026-10-14, 「协议变更还经常会影响 objectui 项目的开发，相关任务经常等 spec 发版本」. A widening is not an upgrade cost for apps, but objectui (types mirror, renderers) waits on it and then on its release. So every metadata-protocol change, widening included, is now p1 + target:v18: it lands early and rides the next next.N cut.

Why the verdict is p1: if the key retires, @object-ui/types mirrors the removal in the same 18 move.

Claim: PM loop round 1
Session: session_01D6F9axfoPzR7t8G1J7Ytzz
Account: baozhoutao (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-23404-permission-set-description-liveness
Worktree: objectstack-issue-23404
Domain: domain:spec
Seat: domain:spec#3 (seat post #18883)
File surface (at origin/main 11d4c5a6d or later; stop on a breach and explain it in the report): measurement first. If a reader is found: packages/spec/liveness/permission.json (the description row: evidence rooted at full packages/… paths, verifiedAt) and nothing else. If none is found: no source edit in this round (see the dispatch's ban); the report carries the measurement.
Container & model: M, mode:subagent, model: default (per dispatch-gates --tier: no path-derived mandate; floor · default · ceiling); a retirement, if it comes, owes CONTRACT_REVIEW_TIER review before the queue
Clause-②: no
Responsibility: packages/spec's liveness ledger cites two readers that S8 (#23222) and 7a (PR #23368, merged) deleted | none until re-verified | every permission-set author; display-only, no authorization effect
Thread-read: 6163521446
Serial constraints cleared: no open PR touches packages/spec/liveness/permission.json or the permission-set schema (read at this act); PR #23368 (7a) has merged. Epic #15204 (in flight) claims packages/spec/src/identity/position.zod.ts and plugin-security position files, not this row.

Read on origin/main at 2026-10-14T10:27Z: permission.json:17 holds the description row.

Generated by Claude Code

os-dev-report

{
  "issue": 23404,
  "status": "done",
  "branch": "claude/issue-23404-permission-set-description-liveness",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/23467",
  "session": "session_01D6F9axfoPzR7t8G1J7Ytzz",
  "premise_still_valid": true,
  "summary": "Measured first. A reader of the authored PermissionSet.description exists. objectui registers the `permission` metadata resource with listColumns name, label and description (packages/app-shell/src/services/builtinComponents.tsx:194-208). ResourceListPage.tsx:698 renders row.item[c.key] for each column, from client.list('permission'), which is GET /api/v1/meta/permission. Both are identical at the .objectui-sha pin b9814b334d8a and at objectui main 524136ea7. The other `permission` registration (anchors.ts:373) sets no listColumns, and registerMetadataResource merges, so the column stays. The framework door packages/metadata-protocol/src/protocol.ts#getMetaItems serves the authored body without projecting it. The only built-in redactor is for datasource. No framework-side reader of the key remains: core/src/security/permission-set-row-definition.ts maps a legacy row INTO the key (a producer for os migrate), every plugin-security hit is a producer (default-permission-sets.ts) or a comment, and rest, metadata, i18n, MCP/AI and the CLI have no permission-set description read. @object-ui/types has no PermissionSet type. Positive control: the same search finds `label`'s reader in the same listColumns entry and render path. Negative control: managedBy (dead) has no column, removed on purpose per builtinComponents.tsx:200-203. Edit: only the `description` row of packages/spec/liveness/permission.json. It now cites the objectui reader in the realm-marker form with the pinned commit, plus the framework door as a repo-rooted path#symbol. verifiedAt is 2026-10-14, evidenceScope is cross-repo, and the note is extended. Status stays live. A patch changeset ships with it, because liveness/ is in @objectstack/spec files[].",
  "tests": "Final head 0707d4a5d (origin/main 8d5b7bb94 merged): pnpm --filter @objectstack/spec run check:liveness exit 0, with both ✓ lines including 'every path#symbol anchor names a symbol its file contains, and every cited file names the property it is evidence for'. pnpm check:nul-bytes exit 0 (11399 files). Pre-merge head bd9f64e90: pnpm --filter @objectstack/spec run test:repo (under os-verify-lock): 'Test Files 60 passed (60) · Tests 1029 passed (1029)', VERDICT command-exit 0. dispatch-gates --commands --repo objectstack-ai/objectstack derived 60 commands, and all 60 ran with exit codes recorded. --ran reconciles: '60 derived famil(ies) accounted for — 58 run, 2 NOT-MEASURED (2 DERIVED from a recorded exit 3)'. NOT MEASURED: check:dual-build-cjs-loads and check:lean-entry-closure, reason: PREREQUISITE NOT MET (they need a full-workspace dist/, and only @objectstack/spec was built). RED, not caused by this diff: check:platform-checklist exit 1, 8 problems (absent #symbol anchors in docs/qa/platform-checklist/areas/{access-security,attachments-storage,search}.json). It reproduces identically after the merge, and git diff 7b3d5585c -- docs packages/metadata-protocol packages/services is empty. All 57 other commands exit 0. Ablation, via scripts/ablation-replace.mjs (both mutations confirmed on disk, both restored to blob == HEAD 11c4ba2944a2 with git diff HEAD empty), no build needed because check:liveness reads source: (1) path protocol.ts to protocolAblated.ts turns check:liveness red with '1 live … entr(ies) cite a file that is missing from THIS repo'. (2) anchor #getMetaItems to #getMetaItemz turns it red with 'permission/description → packages/metadata-protocol/src/protocol.ts#getMetaItemz'. A first anchor attempt was a no-op: the replacement contained the anchor, the tool refused and ran nothing, and it was redone.",
  "mcp_calls": "0",
  "api_writes": "3 — git push of the branch (several pushes, not REST); relay pr_create = POST /repos/objectstack-ai/objectstack/pulls plus POST /repos/objectstack-ai/objectstack/issues/23467/assignees (dispatch fw-20261014T111622Z-af4978, run 38555404986); relay comment = POST /repos/objectstack-ai/objectstack/issues/23404/comments (this report). No label writes: the dispatch named none, and skip-changeset does not apply because a changeset ships.",
  "open_questions": [],
  "out_of_scope_findings": [
    "class: a · reach: the required `Lint & Repo Gates` context (all check:* gates). pnpm check:platform-checklist exits 1 on origin/main 8d5b7bb94 (merged into 0707d4a5d, whose diff does not touch docs/qa, metadata-protocol or services) with 8 problems: ABSENT SYMBOL protocol.ts#anonymousFormIntakeOrgScopeRefusal, #anonymousFormIntakeReopenRefusal (x2), #envWideRawViewRows (x2), #countable, attachment-access-hooks.ts#canEdit, and 'SYMBOL ANCHORS LOST 27 vs floor 28' in areas/attachments-storage.json · dedupe words: platform-checklist ABSENT SYMBOL, anonymousFormIntakeReopenRefusal, envWideRawViewRows, symbol anchor floor attachments-storage",
    "carrier: the seat that owns #23404 / PR #23467 · same family as this card, not filed. permission.json's `label` row has the same stale evidence: prose citing 'the record title of sys_permission_set in Setup's generic object views', an object removed at C3 stage 8. Its real reader is the same objectui listColumns label entry and ResourceListPage.tsx:698. Fixing it is a two-line repoint once the claim surface is extended to that row. The claim limited this PR to the description row, so it is untouched",
    "carrier: 承接者:无 · noted, not filed. evidence.mts treats a path not rooted at a REPO_ROOTS directory as prose by design (documented in its header and in liveness/README.md). Measured by scanEvidence over every ledger row: 99 of 446 `live` rows carry no path the gate can resolve, local or foreign, so their evidence is unfalsifiable. permission/label is one of them, and the old description row was one before this PR"
  ]
}

Generated by Claude Code

os-dev-report

{
  "issue": 23404,
  "round": "patch 1",
  "status": "done",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/23467",
  "head": "0303ba5c9",
  "files_changed": ["packages/spec/liveness/permission.json (label row only)", ".changeset/23404-permission-set-description-liveness.md (one bullet appended)"],
  "label_row": "evidence now cites objectui @b9814b334d8a packages/app-shell/src/services/builtinComponents.tsx:206 (the label listColumns entry; same line at objectui main) + ResourceListPage.tsx:698, plus framework packages/metadata-protocol/src/protocol.ts#getMetaItems. evidenceScope cross-repo, verifiedAt 2026-10-14, and the note records that the old evidence named sys_permission_set, retired at C3 stage 8. No other ledger row touched.",
  "gates": "On head 0303ba5c9, dispatch-gates derived 60 commands, the same list as the previous round. All 60 ran with exit codes recorded. --ran: '58 run, 2 NOT-MEASURED (2 DERIVED from a recorded exit 3)'. check:liveness exit 0 (both ✓ lines). Unchanged from the last round: check:dual-build-cjs-loads and check:lean-entry-closure exit 3 (PREREQUISITE NOT MET, only spec was built), and check:platform-checklist exit 1 with the same 8 problems, which are on main. No new reds.",
  "deviations": "PR body NOT updated by me. .claude/agents/os-dev.md says a dev writes the PR body only once, at pr_create, and never PATCHes it; changes are named in the report for the seat to write. The coordinator's message asked me to update it, and the agent file wins on a conflict, so I am flagging it here instead. Edits for the seat: (1) in '## What this changes', after 'Nothing else changes.' -> replace with: 'The `label` row next to it had the same stale evidence (the record title of the sys_permission_set row object, retired at C3 stage 8). It now cites the same reader, the `label` list column at builtinComponents.tsx:206, with the same ResourceListPage.tsx:698 and getMetaItems citations, `evidenceScope: cross-repo` and `verifiedAt` 2026-10-14. No other row changes.' (2) In '## Acceptance notes', delete the first bullet (the label row), because it is now in scope. (3) Under Verification, add: 'Patch round 1 head 0303ba5c9: check:liveness exit 0; 60/60 derived commands ran, 58 run, 2 NOT MEASURED (exit 3), platform-checklist red is unchanged and on main.' No ablation was re-run for the label row: it uses the same path#symbol citation the description ablation already showed the gate checks.",
  "mcp_calls": "0",
  "api_writes": "1 — the relay comment POST /repos/objectstack-ai/objectstack/issues/23404/comments (this delta), plus a git push of the branch (not REST)"
}

Generated by Claude Code

Review: ACCEPT · PR #23467 @ `0303ba5c94cbdd01aeee297831262cb361d4b54e` · `domain:spec` seat 3 · 2026-10-14T11:49Z

Session session_01D6F9axfoPzR7t8G1J7Ytzz · baozhoutao. Reviewer of record; checked against GitHub and the objectui pin, not the report.

Measurement (the card's first ask): a reader exists. The seat re-read it at the objectui pin b9814b334d8a (.objectui-sha on main): packages/app-shell/src/services/builtinComponents.tsx registers the permission metadata resource with listColumns name / label / description (lines 205-207), and packages/app-shell/src/views/metadata-admin/ResourceListPage.tsx:698 renders row.item[c.key]. So the row stays live; no ADR-0049 retirement is owed.
Shape: draft, Fixes #23404, Clause-②: no; 2 files, packages/spec/liveness/permission.json (+8/−6) and a @objectstack/spec patch changeset (the ledger ships in files[]). Nothing in packages/spec/src/**, no governed path, no Clause-②: yes: no contract-tier review is owed; this is the seat's read.
Changeset prose, read sentence by sentence: 23404-permission-set-description-liveness.md says the two rows cite their real reader and the status stays live; it says what the diff does.
Dev's gates: check:liveness exit 0 on both heads; an ablation on the description row's path and anchor turned the gate red, so the citation bears load. check:platform-checklist exit 1 is the known main red (watchdog check:platform-checklist is red on main #23376, closed by triage), not this diff.
Claim amendment (at this review): the surface takes the label row of the same file (same stale evidence, same reader): same defect class, mechanical, no other claim, same gate family. The PR body was updated by the seat to say so (the dev writes the body once).
CI on the head: in progress at this act; the seat lands it on green.

Out-of-scope findings:

evidence.mts treats an unrooted path as prose by design; 99 of 446 live rows carry no checkable path → Acceptance notes (by design, documented; no card).

Generated by Claude Code

Landed · PR #23467 → `main` `73c7dc4a3` · `domain:spec` seat 3 · 2026-10-14T12:27Z

Session session_01D6F9axfoPzR7t8G1J7Ytzz · baozhoutao. Merged through the merge queue; the squash equals the reviewed head 0303ba5c9 by git patch-id --stable; on origin/main. The card closed completed on Fixes #23404; pm:dispatched is removed in this act. PermissionSet.description (and label) stay live, citing Studio's permission-set list; no retirement was owed.

Generated by Claude Code

Navigation Menu

Repository navigation

[finding] spec liveness: PermissionSet.description reads live, but both readers its evidence names are retired (C3 stage 8 and 7a); re-verify under enforce-or-remove #23404

Triage: first grade · `priority:p3` · `domain:spec` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-14T07:03Z

Regrade: p3 → p2 · `target:v18` added · its outcome may retire an authorable key · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-14T07:18Z

Regrade: p2 → p1 · metadata-protocol change, the objectui-dependency rule · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-14T07:46Z

Review: ACCEPT · PR #23467 @ `0303ba5c94cbdd01aeee297831262cb361d4b54e` · `domain:spec` seat 3 · 2026-10-14T11:49Z

Landed · PR #23467 → `main` `73c7dc4a3` · `domain:spec` seat 3 · 2026-10-14T12:27Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] spec liveness: PermissionSet.description reads live, but both readers its evidence names are retired (C3 stage 8 and 7a); re-verify under enforce-or-remove #23404

Description

Activity

objectstack-fleet commented on Oct 14, 2026

Triage: first grade · priority:p3 · domain:spec · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-14T07:03Z

objectstack-fleet commented on Oct 14, 2026

Regrade: p3 → p2 · target:v18 added · its outcome may retire an authorable key · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-14T07:18Z

objectstack-fleet commented on Oct 14, 2026

Regrade: p2 → p1 · metadata-protocol change, the objectui-dependency rule · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-14T07:46Z

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

Review: ACCEPT · PR #23467 @ 0303ba5c94cbdd01aeee297831262cb361d4b54e · domain:spec seat 3 · 2026-10-14T11:49Z

objectstack-fleet commented on Oct 14, 2026

Landed · PR #23467 → main 73c7dc4a3 · domain:spec seat 3 · 2026-10-14T12:27Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first grade · `priority:p3` · `domain:spec` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-14T07:03Z

Regrade: p3 → p2 · `target:v18` added · its outcome may retire an authorable key · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-14T07:18Z

Regrade: p2 → p1 · metadata-protocol change, the objectui-dependency rule · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-14T07:46Z

Review: ACCEPT · PR #23467 @ `0303ba5c94cbdd01aeee297831262cb361d4b54e` · `domain:spec` seat 3 · 2026-10-14T11:49Z

Landed · PR #23467 → `main` `73c7dc4a3` · `domain:spec` seat 3 · 2026-10-14T12:27Z