A sales rep cannot attach the quote PDF (or any file) to a record they edit: sys_attachment upload and delete wait on objectstack#22455 #2038

Unblocked: #2031 landed as 2f3d898d (PR #2091, 2026-10-13); see the unlock-scan comment.
Re-derived 2026-10-09T18:56Z by the repo:hotcrm seat (session_018Mk4tab2eCyY41UTWK7y7V): objectstack-ai/objectstack#22455 closed completed at 2026-10-09T18:08:03Z (PR #22513 there; it fixes both limbs, the attachment gate and the comment delete gate), but no installable release carries it yet (npm view @objectstack/cli version answers 17.7.0, this repo's pin). So this card waits on #2031, the upgrade card. Note for the upgrade: the fix ships as a BREAKING minor in service-storage and plugin-audit, whose remedy is to grant edit on the master; on unlock, re-measure this card's grants (attachment create / delete, comment delete) against that.

Filing gate: ① product defect with reach measured. Class (a). reach: the record Attachments panel and POST /api/v1/data/sys_attachment as a sales rep. Measured on hotcrm (@objectstack/* 17.7.0) by the dev of #2029 (report 6078558197), session session_012zh91QzFgePbkmuHnugLN3. Split out of #2029 item 1: PR #2036 lands the READ half; this is the write half.

Who acts on it: the repo:hotcrm seat, once objectstack#22455's fix is installable in the pin (the upgrade card #2031 carries pins). ⛔ Not a claim. ⛔ No workaround in the meantime (hotcrm AGENTS.md §2).

What is wrong

• The Quotes page says Generate Quote's quote "attaches the quote document (a PDF)", and content/docs/guides/files-and-comments says record editors upload and delete. After PR fix(attachments, demo-staff, email docs): reps list the attachments of records they can read; demo:staff runs; the email page names the shipped templates (#2029 items 1, 2, 4) #2036, every permission set that reads a files-enabled object grants sys_attachment read only: a rep lists the attachments of the records they can read, but cannot upload or delete. Only an administrator can.
• The write bits are held back on purpose. With them granted, the platform's attach / delete gate answers true for every controlled_by_parent record (crm_contact, crm_quote, crm_contract): na.rep attached to a quote they get 404 on, and deleted the admin's file from a contract they cannot edit (objectstack#22455, measured).

When it unblocks

• Add allowCreate and allowDelete for sys_attachment beside the allowRead in the six sets PR fix(attachments, demo-staff, email docs): reps list the attachments of records they can read; demo:staff runs; the email page names the shipped templates (#2029 items 1, 2, 4) #2036 touched (sales_rep, sales_manager, marketing_user, service_agent, system_admin; service_manager and tenant_admin spread them).
• Flip the two pins in test/record-attachments-access.test.ts and test/collaboration-capabilities.test.ts.
• Correct the enable.files note in src/sales/objects/index.ts.
• Measure first on the upgraded pin that the gate now refuses a child record the caller cannot edit.

Acceptance

• A rep uploads a file to a quote they can edit, and deletes their own file.
• The same rep is refused (403) an upload to a quote or contract they cannot edit, and a delete of another user's file there.
• pnpm verify green.

Duplicate check

Every hotcrm issue was listed into a local index (/issues?state=all, through today) and matched case-insensitively (counts corrected after filing; the first version of this section was written before the queries ran):

• sys_attachment: 3 (Four defects the #2024 browser measurement surfaced: a rep is refused a quote's attachments, demo:staff 400s, the Quotes page promises a nightly expiry sweep a default install does not run, email-and-calendar says no templates #2029 open, the parent card; Enable attachments + record comments on core objects (basic collaboration surface) #602 and Seeded contracts are ownerless at the platform level (owner_id null) — nobody, admin included, can edit one #622 closed, the attachments enablement and ownerless contracts);
• attach the quote: 6 (Four defects the #2024 browser measurement surfaced: a rep is refused a quote's attachments, demo:staff 400s, the Quotes page promises a nightly expiry sweep a default install does not run, email-and-calendar says no templates #2029 and the seat post [PM seat] repo:hotcrm — 🟢 os-justin #1353 open; Layout: move every authored file into its package directory (src/sales · src/service · src/revenue · src/marketing) — one stack still registers everything, artifact bit-identical #1905, The products page contradicts itself about the datasheet: one section says nothing reads it, a tip 20 lines later says the AI uses it #1201, Seeded contracts are ownerless at the platform level (owner_id null) — nobody, admin included, can edit one #622, Enable attachments + record comments on core objects (basic collaboration surface) #602 closed, none this);
• upload attachment rep: 2 (Four defects the #2024 browser measurement surfaced: a rep is refused a quote's attachments, demo:staff 400s, the Quotes page promises a nightly expiry sweep a default install does not run, email-and-calendar says no templates #2029 open; Enable attachments + record comments on core objects (basic collaboration surface) #602 closed).

None is this write half.

Generated by Claude Code