From f4e5170b1115ec85b880d74f053876764b6ea961 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 9 Oct 2026 00:38:31 +0000 Subject: [PATCH] docs(skills): objectstack-query names the context the engine admits since ADR-0096 D5 `skills/objectstack-query/SKILL.md` taught `{ flowRunId }` "for provenance alone" as a valid execution context. Since ADR-0096 D5 strict mode the security plugin refuses a non-system context that carries no principal (no user, no position, no permission set) with `403 PERMISSION_DENIED`, so the line prescribed a context the engine refuses. The paragraph now names the two shapes the engine admits: `{ isSystem: true }` for a system read, otherwise the caller's own context, and the refusal otherwise. Claude-Session: https://claude.ai/code/session_01JmWtcHfGbC4ncw4GFKWuRA Co-authored-by: Claude --- skills/objectstack-query/SKILL.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/skills/objectstack-query/SKILL.md b/skills/objectstack-query/SKILL.md index 10119688854..c593f884cba 100644 --- a/skills/objectstack-query/SKILL.md +++ b/skills/objectstack-query/SKILL.md @@ -63,10 +63,11 @@ const [row] = await engine.find('project', { where: { name }, limit: 1, context: ``` Pass any SUBSET of the execution envelope (identity, tenant, transaction): -`{ isSystem: true }` for a system read, `{ flowRunId }` for provenance alone. On -the READ methods it may sit in the query bag (above) OR in the trailing options -argument, `engine.find(obj, query, { context })`; the trailing one wins when -both are given. Writes take only the trailing argument. +`{ isSystem: true }` for a system read, otherwise the caller's own context +(user, position or permission set), or `403 PERMISSION_DENIED` (ADR-0096 D5). +On the READ methods it may sit in the query bag (above) OR in the trailing +options argument, `engine.find(obj, query, { context })`; the trailing one wins +when both are given. Writes take only the trailing argument. ## Removed Keys → Live Replacement