Skip to content

platform-objects: sys_session.revoke_reason's description is the field's published vocabulary and lacks admin_password_reset, the value PR #23440's forced-reset revocation writes #23477

Closed
#23518
Closed
platform-objects: sys_session.revoke_reason's description is the field's published vocabulary and lacks admin_password_reset, the value PR #23440's forced-reset revocation writes#23477
#23518
Assignees
baozhoutao
Labels
area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guardsbugSomething isn't workingdomain:specpriority:p1High: required for production / M2target:v18

Description

@objectstack-fleet
objectstack-fleet
bot
opened on Oct 14, 2026

Filing gate ①, class (b): a declared contract that a producer breaks. reach: is a named producer: packages/plugins/plugin-auth/src/forced-reset-revocation.ts (PR #23440, #23287) writes revoke_reason: 'admin_password_reset' on every live session a forced reset revokes, ON by default (the maintainer's letter A on #23287).

Filed by domain:spec seat 4 (#18917) · sunhaolin · session session_0121ooBYRmS8ziFXm9ai5YHm, from PR #23440's contract review (6167875771, ③ (b), escalated to this seat), checked on origin/main. ⛔ Not a claim. Lane, type and grade are triage's.

The contract

packages/platform-objects/src/identity/sys-session.object.ts, field revoke_reason: the in-code comment says "this description IS the published vocabulary — there is no Zod enum behind this column (it is free text), so this line is the only contract a consumer can read". The description lists idle_timeout, absolute_max, concurrent_cap, user_revoked, admin and organization_membership_ended. It does not list admin_password_reset.

Seam: platform-objects:sys_session.revoke_reason description → runtime:plugin-auth forced-reset-revocation.ts (FORCED_RESET_REVOKE_REASON) | consumer: none named

What done looks like

The description names admin_password_reset beside the other causes (an administrator's forced password reset revoked the session), and the four translation bundles regenerate (node scripts/check-i18n-bundles.mjs --write). This lands with or after PR #23440. The value does not exist on main until that PR lands.

Reader who acts: triage routes it. The fix is one description line in platform-objects plus its generated bundles.

Dedupe

MCP search_issues on this repo, closed included: sys_session revoke_reason vocabulary description admin_password_reset forced reset → 1 hit: #7732 (closed), the interactive revoke path tombstoning rather than deleting — a different defect on the same field. #15784 (closed) widened this vocabulary for organization_membership_ended; it is the precedent, not this.

Dedupe words: revoke_reason vocabulary admin_password_reset; sys_session revoke reason description forced reset; published vocabulary free text column.

Activity

  1. objectstack-fleet commented on Oct 14, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 14, 2026
    ContributorAuthor

    Triage: first grade · bug · priority:p1 + target:v18 · domain:spec · area:access · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-14T12:54Z

    Read fresh. PR #23440 merged, so main now writes revoke_reason: 'admin_password_reset', and the field's description (the published vocabulary: free text with no enum, per its own comment) does not list it.

  2. objectstack-fleet
    added
    area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guards
    bugSomething isn't working
    domain:spec
    pm:queue
    priority:p1High: required for production / M2
    target:v18
    pm:dispatched
    and removed
    pm:queue
    on Oct 14, 2026
  3. objectstack-fleet
    assigned
    baozhoutao
    on Oct 14, 2026

  4. objectstack-fleet commented on Oct 14, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 14, 2026
    ContributorAuthor

    Claim: PM loop round 1
    Session: session_01D6F9axfoPzR7t8G1J7Ytzz
    Account: baozhoutao (the seat's linked user as GET /user answers it; the card's assignee)
    Branch: claude/issue-23477-revoke-reason-vocabulary
    Worktree: objectstack-issue-23477
    Domain: domain:spec
    Seat: domain:spec#3 (seat post #18883)
    File surface (at origin/main f9b421716 or later; stop on a breach and explain it in the report): packages/platform-objects/src/identity/sys-session.object.ts (the revoke_reason description and its comment, ~192-201); the translation bundles node scripts/check-i18n-bundles.mjs --write regenerates for that field; a test that pins the description names FORCED_RESET_REVOKE_REASON if the package has a vocabulary pin; .changeset/23477-*.md.
    Container & model: S mechanical, mode:subagent, model: floor (per dispatch-gates --tier: no path-derived mandate; floor · default · ceiling); one description line plus regenerated bundles, judged by the i18n gates
    Clause-②: no
    Responsibility: packages/platform-objects' sys_session.revoke_reason description (the field's only published vocabulary) | the producer packages/plugins/plugin-auth/src/forced-reset-revocation.ts (FORCED_RESET_REVOKE_REASON = 'admin_password_reset', PR #23440, merged) already writes the value | any consumer reading the session's revoke reason
    Thread-read: 6168824114
    Serial constraints cleared: open PR #23469 regenerates packages/platform-objects/src/apps/translations/* (a different bundle folder from identity); open PR #23503 regenerates plugin-security bundles. Generated-file concurrency: the later lander re-runs the generator, never hand-merges.

    Read on origin/main f9b421716 at 2026-10-14T15:27Z: the description lists admin, organization_membership_ended, … (sys-session.object.ts:201) and not admin_password_reset; forced-reset-revocation.ts:46 writes it.

    Generated by Claude Code

  5. objectstack-fleet commented on Oct 14, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 14, 2026
    ContributorAuthor

    os-dev-report

    {
  "issue": 23477,
  "status": "done",
  "branch": "claude/issue-23477-revoke-reason-vocabulary",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/23518",
  "session": "session_01D6F9axfoPzR7t8G1J7Ytzz",
  "premise_still_valid": true,
  "summary": "sys_session.revoke_reason description now names admin_password_reset (after organization_membership_ended) with its cause in the in-code comment; en bundle regenerated, zh-CN/ja-JP/es-ES help strings hand-updated; added a plugin-auth test asserting the description contains FORCED_RESET_REVOKE_REASON (no prior pin existed; dependency direction forbids the test in platform-objects); patch changeset. Bundles live in apps/translations, not identity; #23469 touches the same folder so the later lander re-runs the generator.",
  "tests": "plugin-auth new test 1/1; platform-objects 70 files/1091 tests; both typechecks OK; spec test:repo 60 files/1029 tests; check-i18n-bundles --write exit 0 then check exit 0 (all in sync); dispatch-gates 66 derived, 66 run, all exit 0 except check:dual-build-cjs-loads exit 3 PREREQUISITE NOT MET (NOT MEASURED, unrelated dist missing). No accept/refuse change.",
  "mcp_calls": "0",
  "api_writes": "2 via fleet-write relay: pr_create (with assignees baozhoutao) and this comment; plus git push",
  "open_questions": [],
  "out_of_scope_findings": []
}

  6. objectstack-fleet commented on Oct 14, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 14, 2026
    ContributorAuthor

    Review: ACCEPT · PR #23518 @ c9d07c88c1a7ddc6cb960c594328d96b48c69bd5 · domain:spec seat 3 · 2026-10-14T16:39Z

    Session session_01D6F9axfoPzR7t8G1J7Ytzz · baozhoutao. Reviewer of record; checked against GitHub, not the report.

    • Shape: draft, Fixes #23477, Clause-②: no; +26/−5, 7 files; not governed. No packages/spec/src/**, no Clause-②: yes: no contract-tier review is owed; this is the seat's read.
    • The ask (triage 6168824114): sys_session.revoke_reason's description names admin_password_reset after organization_membership_ended, and the in-code comment gives its cause (an administrator's forced password reset, FORCED_RESET_REVOKE_REASON). The en bundle is regenerated by check-i18n-bundles --write; the zh-CN/ja-JP/es-ES help strings are translations, each gaining the one value, as revoke a session whose membership ended, so "Remove member" actually signs the person out — the courtesy half of #15409, ⛔ never the enforcement #15784 did; check-i18n-bundles passes after.
    • Pin: plugin-auth/src/forced-reset-revoke-reason-vocabulary.test.ts asserts the description contains FORCED_RESET_REVOKE_REASON (it lives in plugin-auth, the producer, because platform-objects cannot depend on it). A future value the producer adds without naming it fails there.
    • Changeset prose: 23477-revoke-reason-vocabulary.md, platform-objects patch, "Description text only"; it says what the diff does.
    • Claim amendment: the bundles live in packages/platform-objects/src/apps/translations/ (the claim guessed an identity folder). Open PR feat(metadata-core,metadata-protocol)!: the sys_metadata family declares no organization column; indexes re-keyed (ADR-0131 D6/D7, C7b S2) #23469 regenerates the same folder; the later lander re-runs the generator.
    • CI on the head: in progress at this act; the seat lands on green.

    Generated by Claude Code

  7. objectstack-fleet
    closed this as completedin #23518on Oct 14, 2026

  8. objectstack-fleet commented on Oct 14, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 14, 2026
    ContributorAuthor

    Landed · PR #23518 → main 3f0a30741 · domain:spec seat 3 · 2026-10-14T17:37Z

    Session session_01D6F9axfoPzR7t8G1J7Ytzz · baozhoutao. Merged through the merge queue; the squash equals the reviewed head c9d07c88c by git patch-id --stable; on origin/main. The card closed completed on Fixes #23477; pm:dispatched is removed in this act. sys_session.revoke_reason's description names admin_password_reset, pinned against FORCED_RESET_REVOKE_REASON in plugin-auth. Open PR #23469 regenerates the same translations folder; its lander re-runs check-i18n-bundles --write.

    Generated by Claude Code

  9. objectstack-fleet
    removed
    pm:dispatched
    on Oct 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guardsbugSomething isn't workingdomain:specpriority:p1High: required for production / M2target:v18

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions