[objectstack-fleet]

Requested by Elon · project thread

Fixes #25835

Wave anchor: #25807 (18.2.0 release test sweep). Docs only: one file, docs/qa/platform-checklist/areas/access-security.json.

What changed

All 65 lines of the card were re-read against main at b4199c96 before editing (the records measured 6679644a, pin b41ed7f68956; the pin is retired, #25745). 62 lines are applied, 3 are answered on the card instead (below). 24 items are revised, plus one more for the retired-pin text, 25 in all. Each revised item has its revision bumped once and one new history entry that cites the record(s) its lines came from (#25812, #25815, #25817, #25823) and says which lines did not hold. ⛔ No item status changed and no clause's assertion changed: almost every line was the ledger overclaiming what a pin asserts, or not naming the layer a pin reaches (RUNNER rule 6). So most edits are to automated.ref, which now says per clause what each pin asserts, at which layer, and which legs stay hand-driven.

item	lines	rev	the edit
crud-permission-matrix	6	7→8	knownGaps[1] and the ref: a plain member reads the org's whole sys_user directory (sys_user_org_members), not a self-scoped row. The ref no longer reads objectstack verify --rls as a pin. It no longer claims clauses 3 and 6 whole, and it says the zoo's out-of-subtree case asserts only a non-2xx. acceptance[6].verify says which 164 cells the pin judges.
walled-environment-metadata-operator-only	2	5→6	knownGaps[0]: the wall-* pins boot the CRM example, not the showcase, and their single leg is a manage_metadata holder, not the seeded admin.
activation-write-operator-gate	4	9→10	The ref no longer claims the full matrix. It names automation-toggle-deny-message.test.ts, automation-write-capability-gate.test.ts and packaged-activation-ledger-reach.dogfood.test.ts with their layers and personas, and names the unpinned re-hydration leg.
anonymous-deny-surfaces	3	3→4	The ref names three hand-driven legs: the /meta contrast is .not.toBe(401), there is no forms contrast, and there is no post-DELETE read-back.
anonymous-floor-v18-doors	4	3→4	The ref says per clause what the pins assert. EVERYTHING_ELSE never reads error.code, the share-link class accepts 401, the docs pin does not compare against the control path, and the 201 is pinned only over a protocol double.
deployment-tables-platform-only	2	2→3	authz-identity-objects-boot-refusal.test.ts left the ref (it pins something else). acceptance[1] and acceptance[2] are named live-run.
fls-mask-and-strip	2	5→6	STILL MANUAL now names the admin budget write and the name re-read.
grant-table-write-contract	2	6→7	The ref names the engine layer of the plugin-security pins, and the legs the HTTP window case does not assert.
me-permissions-aggregation-parity	3	3→4	current-user-endpoints-localization.test.ts joins the ref. STILL MANUAL names the admin half of /me/apps and the anonymous trio on a real stack.
meta-authoring-trail-and-audience-gates	2	2→3	The ref names the unit layer of the audience-gate pin, the doors it lacks, and the unit-only 304.
no-active-org-session-semantics	6	8→9	The ref quotes the group case as it reads now (refusal, #24784 / PR #24819). It no longer claims every clause, and it names three existing pins with their layers. After #25626, personas, fixtures.requires[1] and knownGaps[0] mint producer (2)'s member through create-user, and record producer (1) blocked(fixture).
org-admin-assignment-boundary	1	1→2	The ref says that per posture only admin_full_access is exercised.
owd-sharing-matrix	3	4→5	The ref names each unpinned model and leg, the cbp fallback set, and the synthetic fixture.
parent-and-organization-write-guards	1	5→6	The ref names the in-process layer, and says the #24840 PASS predates the layer rule.
platform-owner-email-anchor	2	8→9	The ref says ADMIN_STANDING_NON_TABLE_INPUTS is asserted by no test. The a0–a3 line confirmed the ledger.
public-form-withdrawal-layers	2	3→4	The ref says acceptance[0] does not score from pins alone, and names the layers of the a2–a5 pins.
record-access-explain	2	3→4	The ref says the zoo case calls explain() in-process under isSystem, and that no deny-side explain is pinned.
record-view-read-audit	2	3→4	negative[0] now says once per CAUSE (#18247). The ref says the exclusion pin probes other names and that no pin reads the install line.
rls-both-sides	2	7→8	The ref names the command, not a source file, as the proof, and says where the row-unchanged re-read is pinned.
security-catalog-activation-and-clone-doors	2	1→2	The ref says which refusal arms are HTTP-pinned and which are unit-only.
security-catalog-one-holder-and-boot-report	4	2→3	marketplace-install-local-catalog-name-collision.test.ts joins the ref. The ref names the registerApp layer, the in-process CLI, and the unasserted 50-name cap.
share-link-combined-gates	2	3→4	share-links-refusal-order.test.ts joins the ref. Both runtime pins are named in-process, so they score acceptance[0] only.
write-path-guards	4	6→7	The ref names what the bulk, readonlyWhen and static-readonly pins do not assert, and the fake-driver objectql pins.
capability-declaration-lifecycle	2	6→7	steps[7]: the located path is capabilities.N.scope (.2 when appended). The mixed line was answered, not applied.
share-link-landing-page	retired pin	4→5	knownGaps[2] no longer prescribes .objectui-sha. It names pnpm console:build into packages/console/dist (which pnpm build does not refresh) and ui/apps/console/src/pages/SharedRecordPage.tsx. History line cites #26035.

Answered on the card, not edited (with reasons in the card report):

• crud-permission-matrix, the pin header's "6 delegate × sys_* rows". The stale number is a comment in the test file, outside this card's one-file surface. The ledger already says 4.
• platform-owner-email-anchor a0–a3. The record confirms the ledger already records these as STILL MANUAL.
• capability-declaration-lifecycle mixed without a browser oracle. In this ledger mixed means more than one execution surface: 31 other active mixed items have no screenshot or dom oracle, and this item is driven over the API and the build / CLI.

Two lines held only in part on this tree, and the history says so. activation a0/n2: FLOW_ENABLEMENT_DENY_MESSAGE's sentence is asserted, by value, in automation-toggle-deny-message.test.ts. anonymous-floor a1: UNAUTHENTICATED is asserted on other faces of /notifications, /keys and /share-links, but not on the three GET faces the step lists.

No line described a product defect, so nothing was filed.

Verified

• Gate families derived by node scripts/pm/dispatch-gates.mjs --commands on head 9738ffad (one path vs merge base b4199c968):

  • node scripts/check-ci-filter-parity.mjs — exit 0
  • node scripts/check-closing-keyword-parity.mjs — exit 0
  • node scripts/check-closing-keyword-parity.mjs --self-test — exit 0
  • node scripts/check-comment-mask-corpus.mjs — exit 0
  • pnpm --filter @objectstack/lint run check:doc-formula-expressions — exit 0
  • pnpm check:cross-package-test-inputs — exit 0
  • pnpm check:doc-authoring — exit 0
  • pnpm check:driver-memory-census — exit 0
  • pnpm check:gitlink-declared — exit 0
  • pnpm check:nul-bytes — exit 0
  • pnpm check:platform-checklist — exit 0
  • pnpm check:refd-timer-probe — exit 0
  • pnpm check:watch-hint-literal — exit 0
  • check:doc-formula-expressions first exited 3 (PREREQUISITE NOT MET) in the fresh worktree; after pnpm --filter '@objectstack/lint...' build (lock VERDICT command-exit 0) it exits 0.
  • node scripts/pm/dispatch-gates.mjs --ran: 13 derived, 13 run, 0 NOT-MEASURED.

• node scripts/pm/check-governed-merges.mjs --test docs/qa/platform-checklist/areas/access-security.json: "NOT governed — ordinary queue landing applies". No contract review is triggered, and this is not Tier H.

• Diff: 1 file, 207 insertions and 57 deletions, so no split is needed. Edits were made as text replacements inside each item, so the file's own formatting is kept (a JSON re-serialise would have rewritten 22 one-line history rows).

Acceptance notes (found beside the lines, outside this card's surface)

• packages/qa/dogfood/test/showcase-crud-persona-matrix.dogfood.test.ts: the header comment still says "6 showcase_field_ops_delegate × sys_* rows", while its own assertion says 4. This is test-file text and needs no card. Carrier: none.
• no-active-org-session-semantics knownGaps[4] and [5] still read group posture: a member whose session has no active organization gets 500 ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED on a tenant-scoped create, where isolated answers 403 naming the missing organization #24784 as open, but it closed 2026-10-20 (PR fix(plugin-security): under group, a no-active-organization insert gets the ADR-0123 D2 403, not a 500 #24819). Their own text asks for a live walled group re-run before the line drops, so they are left for that run.
• After feat(plugin-auth): multi-org Create User joins the administrator's current organization #25626, identity-auth.workspace-org-switch personas[2] and RUNNER.md's "Walled personas come from the admin door" membershipCreated: false sentence are stale too (QA run · identity-auth.admin-lifecycle-operations (1/1) · 17f8217b · 2026-10-25 · 1 PASS / 0 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #25823). They belong to the identity-auth card and the RUNNER card (qa(checklist): RUNNER.md — 3 stale environment facts from the 18.2.0 release sweep (#25807) #25850).
• RUNNER.md's standing fact still calls automated.ref paths under objectui "objectui-repo-only", while ui/ is now in this repo. share-link-landing-page knownGaps[0] and its ref stay in step with RUNNER until qa(checklist): RUNNER.md — 3 stale environment facts from the 18.2.0 release sweep (#25807) #25850 changes it.

skip-changeset: docs only, nothing published.

---

Generated by Claude Code

[objectstack-fleet]

席位核对 — ACCEPT at 9738ffad

Seat review of #26101 for #25835 (devx seat #6023).

• One file, docs/qa/platform-checklist/areas/access-security.json, +207/−57. Not governed. Under the split threshold.
• Ledger rules, checked mechanically against main with JSON loaded on both sides. 25 items changed. Each one bumps revision by exactly one and appends exactly one history entry citing qa(checklist): access-security — 65 ledger edits from the 18.2.0 release sweep (#25807) #25835. No item's status changes, no item is removed, and nothing is marked covered without a run.
• 62 of 65 lines applied. The 3 lines left unapplied are answered on the card with their reason (report 6415633911), as the card's acceptance allows. No product defect turned up, so no card was needed.
• Retired-pin text: share-link-landing-page moves off the objectui pin, citing docs(devx): 32 files still prescribe the retired objectui pin scripts (objectui:build / objectui:refresh) — AGENTS.md and 3 skills among them #26035.
• skip-changeset. Contract review not triggered.

Landing: pr_ready + automerge_enable once every check on 9738ffad is green, under the maintainer's standing grant. Fixes #25835.

Card: #25835

---

Generated by Claude Code