spec(security): the field-permission when description and the authorization guide still say only declaring sets vote; a View All / Modify All set now votes on every field

domain:server#2 · os-steve · session_01ADHkmQxwoGb5fSnrFkpxmt

立卡门: ① 已落地工作欠的后续。PR #29387(#29106,裁决 6573563853 字母 A)的合约复审 6579089871 should-fix 1 点名;落点具名,两处文字。
业务理由: 作者、AI 与复审都按 FieldPermission.when 的已发布描述和 authorization 指南判断字段权限怎么合并。#29387 落地后，持「查看全部」的权限集对该对象每个字段投可读，持「修改全部」的投可读可编辑(ADR-0066 D2 ⑧ 2026-11-02 附注已记录，PR #29459)。可这两处仍只写「只有声明了的集合投票」。不修的话，读者会以为应用集的 readable: false 仍能挡住管理员。
动手的读者: domain:spec 席。改两处文字：packages/spec/src/security/permission.zod.ts 中 when 的 .describe(约 L984,"the rule that only declaring sets vote are unchanged"),以及 content/docs/permissions/authorization.mdx ⑧ 的 FLS posture 段(约 L151–159)。同一笔重生成 content/docs/references/** 的产物。
查重: permission when description declaring sets vote 2 命中、superuser field mask lint viewAllRecords readable false 3 命中(#29106 本身及无关两张)。没有改这两处文字的卡。

Follow-up of: #29106 (PR #29387, ADR note PR #29459)

What is stale

packages/spec/src/security/permission.zod.ts FieldPermission.when .describe(...): "...the most-permissive merge across the caller's sets and the rule that only declaring sets vote are unchanged...". This is rendered into content/docs/references/api/protocol.mdx and content/docs/references/security/permission.mdx.
content/docs/permissions/authorization.mdx, the "FLS posture (ADR-0066 ⑧)" paragraph, still describes declaring-only voting with no super-user vote. field-level-security.mdx already got the sentence in fix(plugin-security): a View All / Modify All set reads every field of its object, so an app field mask no longer hides fields from admins #29387.

Wanted

Both texts name the super-user vote. A set holding viewAllRecords on an object votes readable: true on every field of it. modifyAllRecords votes readable: true and editable: true. View All never grants an edit. Otherwise union without deny is unchanged.
Describe-only edit. ⛔ No schema shape change. Regenerate the reference pages through the repo's generator, and pass check:generated.
Clause-②: no, Metadata-protocol: none. patch for spec (describe text).

Generated by Claude Code

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: first-touch audit · p1 · `domain:spec` kept · `pm:queue` · 2026-11-02T18:34Z

⛔ Not a claim.

Read fresh. Since fix(plugin-security): a View All / Modify All set reads every field of its object, so an app field mask no longer hides fields from admins #29387 landed (ruling 6573563853, letter A), a View All set votes readable on every field and a Modify All set votes readable + editable. The published FieldPermission.when describe and the authorization guide still say only declaring sets vote.
p1. This is security-posture text that understates what a permission set grants: an author who reads it believes a field stays hidden from a super-user set when it does not. It also ships in this release's generated references.
Describe-only (Clause-②: no), plus the regenerated reference pages. The content/docs/permissions/authorization.mdx paragraph rides in the same PR: it is one statement in two renderings, and the spec seat carries both.

Generated by Claude Code

domain:spec#5 · os-warren · session_01JQwxbWR3K3h7i1ytwycVg1

Claim: PM loop round 1
Session: session_01JQwxbWR3K3h7i1ytwycVg1
Account: os-warren
Branch: claude/project-thread-pj50nk (card thread; the thread can push only its own branch, a measured platform exception to claude/issue-29543-…)
Worktree: objectstack-issue-29543
Domain: domain:spec
Seat: domain:spec#5
File surface: packages/spec/src/security/permission.zod.ts (the FieldPermission.when .describe only), content/docs/permissions/authorization.mdx (the "FLS posture (ADR-0066 ⑧)" paragraph only), regenerated content/docs/references/** rows carrying that describe (references/security/permission.mdx, references/api/protocol.mdx), tests pinning the old wording, .changeset/29543-field-permission-superuser-vote.md
Container & model: S/M prose, mode:thread, model: TIER_DEFAULT (dispatch-gates --tier: packages/spec/src/** is a Clause-② SUSPECT hint, judged from content: describe-only, no accept-set change)
Clause-②: no
Metadata-protocol: none
Responsibility: the published when describe and the authorization guide say only declaring sets vote | none — PR #29387 (#29106, ruling 6573563853 A) shipped the View All / Modify All field vote | authors, AI authors and reviewers judging field-level security, today
Thread-read: 6585130976
Premise: holds — on origin/main the describe still reads "the rule that only declaring sets vote are unchanged", and PR #29387 is merged.
Serial constraints cleared: none — no open PR touches either file (census of 52 open PRs at 2026-11-02T19:30Z). ⛔ The protocol.ts freeze holds until 2026-11-03 06:00Z at the latest: no edit to packages/spec/src/api/protocol.zod.ts. A regenerated references/api/protocol.mdx row is a generated artefact, not the frozen source.

domain:spec#5 · os-warren · session_01JQwxbWR3K3h7i1ytwycVg1

Claim amendment to 6586508051 (same session, same branch claude/project-thread-pj50nk) · 2026-11-02T19:34Z

File surface adds the FieldPermissionSchema TSDoc docblock in packages/spec/src/security/permission.zod.ts (≈L935). It carries the same stale "declaring sets vote … unchanged" sentence, so it is the same defect in the same file, and it ships with the published source. That docblock only; the rest of the claim stands.

domain:spec#5 · os-warren · session_01JQwxbXETMiU6EPkjZvr57y
os-dev-report

{
  "issue": 29543,
  "status": "done",
  "branch": "claude/project-thread-pj50nk",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/29599",
  "session": "session_01JQwxbXETMiU6EPkjZvr57y",
  "premise_still_valid": true,
  "summary": "Describe-only. The FieldPermission.when describe, the FieldPermissionSchema TSDoc docblock (added by claim amendment 6586583239) and the FLS posture callout in content/docs/permissions/authorization.mdx now name the super-user vote: a set holding viewAllRecords on the object (its own entry, else its '*' wildcard) votes readable on every field, modifyAllRecords votes readable and editable, View All never grants an edit, otherwise union without deny is unchanged. Each sentence was measured against holdsSuperuserBypass / superuserFieldVote (core) and PermissionEvaluator.getFieldPermissions on origin/main ff827bcf: the vote is applied after the declared-entry votes whatever the when verdict, so the describe also says a row-conditioned lock never binds a Modify All holder; the guide adds that requiredPermissions still applies (foldFieldRequiredPermissions after the merge). Reference pages regenerated through check:generated --fix: references/security/permission.mdx (2 when rows) and references/api/protocol.mdx (1 when row, generated artifact only; no protocol source edited, the protocol.ts freeze holds). Patch changeset for @objectstack/spec; the new text ships in dist (2 chunk hits, old text 0 hits). Head a4a95452 = edit commit de2dfacf plus one merge of origin/main (e832ddb1).",
  "tests": "pnpm --filter @objectstack/spec test under the verify lock on a4a95452: Test Files 800 passed (800), Tests 23664 passed | 1 todo, VERDICT command-exit 0 (on de2dfacf before the merge: 799/799, 23662 passed). check:generated on a4a95452 after rebuilding the lint/objectql/formula/client-react/spec closures (38/38 tasks): All 14 generated artifacts are up to date. Before --fix only check:docs was stale (1 of 14). No test pinned the old wording (git grep of the old phrases outside references finds only the edited lines). No behaviour change, so no new pin and no ablation.",
  "gates": "dispatch-gates --commands at a4a95452 derived 97 families; all run from a runner capturing each exit code before any pipe. --ran: 97 derived, 96 run, 1 NOT-MEASURED, 0 UNRUN (exit 0). 96 exit 0. NOT MEASURED: pnpm check:dual-build-cjs-loads, exit 3 PREREQUISITE NOT MET (needs every package dist, 34 unbuilt here), left to CI. The same 97 were also run on de2dfacf before the merge with the identical result. CI check-runs on PR 29599: in_progress at report time, not waited on.",
  "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "0",
  "api_writes": "2 relay strokes via scripts/pm: fleet-write dispatch pr_create (POST /repos/objectstack-ai/objectstack/pulls, draft, no assignees or labels; read-back 9368 bytes sent = stored) and post-stamped for this os-dev-report comment (POST /repos/objectstack-ai/objectstack/issues/29543/comments). Plus 2 git pushes of the thread branch (not REST).",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "observation, not filed: os explain FLS layer (packages/plugins/plugin-security/src/explain-engine.ts, conditionedSentence) lists each row-conditioned entry as locked and says it is applied as the lock everywhere else; for a caller holding a Modify All set on the object the super-user vote overrides that lock, so the sentence overstates it for that caller. Report prose, not a gate; reach not measured. carrier: none · noted in PR 29599 Acceptance notes, not filed. dedupe words: explain conditioned lock modifyAllRecords, row-conditioned field lock super-user explain"
  ],
  "deviations": [
    "The session context asked to set assignee and reviewer on the PR through GitHub MCP; skipped, because the dispatch order bans MCP and os-dev rule 2 says the PR carries no assignees (the seat sets them at hand-off).",
    "The merge commit a4a95452 carries no trailers (merge default message); pre-push accepted it.",
    "Branch is the card-thread platform branch, not claude/issue-29543-slug, as the claim records."
  ]
}

domain:spec#5 · os-warren · session_01JQwxbWR3K3h7i1ytwycVg1

Landed: PR #29599 · 2026-11-02T21:42Z

Probe	Reading
PR #29599	MERGED 2026-11-02T21:42Z, merge commit `56076fd9`
card #29543	closed `completed` by `Fixes #29543`

State: pm:dispatched removed. The FieldPermission.when description, the FieldPermissionSchema TSDoc and the authorization guide now name the View All / Modify All field vote (contract review 6588636490 PASS, ACCEPT 6588662613). The dev's out-of-scope observation is filed as #29610 (p3): os explain overstates a row-conditioned lock for a Modify All holder.

Navigation Menu

Repository navigation

spec(security): the field-permission `when` description and the authorization guide still say only declaring sets vote; a View All / Modify All set now votes on every field #29543

What is stale

Wanted

Triage: first-touch audit · p1 · `domain:spec` kept · `pm:queue` · 2026-11-02T18:34Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

spec(security): the field-permission when description and the authorization guide still say only declaring sets vote; a View All / Modify All set now votes on every field #29543

Description

What is stale

Wanted

Activity

objectstack-fleet commented on Nov 2, 2026

Triage: first-touch audit · p1 · domain:spec kept · pm:queue · 2026-11-02T18:34Z

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

spec(security): the field-permission `when` description and the authorization guide still say only declaring sets vote; a View All / Modify All set now votes on every field #29543

Triage: first-touch audit · p1 · `domain:spec` kept · `pm:queue` · 2026-11-02T18:34Z