runtime,metadata-protocol: the catalog activation door refuses the audience anchors; their sealed refusal names no switch

Claude-Session: https://claude.ai/code/session_015LutkhFn8wzgD5J86PtpYN
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/15204-s2c-catalog-activation-door.md

@@ -12,6 +12,6 @@ The authorization resolver reads whether a position or a permission set is switc
 - **Body:** `{ enabled?: boolean }`. `enabled` defaults to `true`. Unknown keys and a non-boolean `enabled` are refused `400 VALIDATION_FAILED`, the same body reader `POST /actions/_activation/:object/:action` uses.
 - **Effect:** one `sys_metadata_activation` row through the engine, carrying the definition's package. Re-enabling updates that row. Switching a position off stops every grant through it for every holder in the deployment. Switching a permission set off stops it granting by every path. No definition and no catalog row is written.
 - **Authority:** the same as the flow and action activation doors. The caller needs `manage_metadata`. Under a `group` or `isolated` tenancy posture the caller must also be the platform operator (ADR-0126 §5). Refusals are `403 PERMISSION_DENIED`, and nothing is written.
-- **Refusals:** a name that does not resolve in the security catalog is `404`. No catalog bound, or a catalog that cannot be read, is `503 SERVICE_UNAVAILABLE`. A composition without the ledger object is `501`. Switching `admin_full_access` off is refused `403 PERMISSION_DENIED` by the last-admin guard's ledger hook.
+- **Refusals:** the audience anchors `position/everyone` and `position/guest` are refused `400` in either direction, before anything is read or written, because one row would switch the authenticated or anonymous baseline off for every principal. A name that does not resolve in the security catalog is `404`. No catalog bound, or a catalog that cannot be read, is `503 SERVICE_UNAVAILABLE`. A composition without the ledger object is `501`. Switching `admin_full_access` off is refused `403 PERMISSION_DENIED` by the last-admin guard's ledger hook.
 
 The route is not in the JS SDK. Its caller is the Setup console's Deactivate on the position and permission-set pages, which calls the platform API directly.

.changeset/15204-s2c-position-regime-row.md

@@ -8,4 +8,4 @@ Saving over a position a managed package ships is still refused `403 NOT_OVERRID
 
 > Switch it off (POST /api/v1/security/_activation/position/:name, body {enabled: false}; operator-only where one install serves several organizations).
 
-The refused writes, the error code and the status are unchanged. A position has no clone door, so none is named. Removing a position's overlay is still not refused (a position merges its overlay at read).
+The audience anchors `everyone` and `guest` keep the generic sentence, because the activation route refuses them. The refused writes, the error code and the status are unchanged. A position has no clone door, so none is named. Removing a position's overlay is still not refused (a position merges its overlay at read).

content/docs/concepts/metadata-lifecycle.mdx

@@ -139,9 +139,9 @@ See [ADR-0005](https://github.com/objectstack-ai/objectstack/blob/main/docs/adr/
 | `flow` | Clone it under a new name (`POST /api/v1/automation/:name/clone`, body `{name, label}`), or switch it off (`POST /api/v1/automation/:name/toggle`, body `{enabled: false}`). A flow that holds a credential (an inbound hook's `secret`, an `http` node's `signingSecret`) is not cloned in one step: the clone door refuses it with `409`, because a copy would share the secret, and the copy is authored as a new flow with its own. |
 | `action` | Switch it off (`POST /api/v1/actions/_activation/:object/:action`, body `{enabled: false}`; `:object` is `global` for an object-less action). No clone is offered. |
 | `permission` | Clone it under a new name: the "Clone" action on the permission set, or `POST /api/v1/data/sys_permission_set` with a new name. |
-| `position` | Switch it off (`POST /api/v1/security/_activation/position/:name`, body `{enabled: false}`). No clone is offered. |
+| `position` | Switch it off (`POST /api/v1/security/_activation/position/:name`, body `{enabled: false}`). No clone is offered. The audience anchors `everyone` and `guest` are not switchable, so their refusal names no switch. |
 
-A permission set also has a switch, outside the refusal: `POST /api/v1/security/_activation/permission/:name`, body `{enabled: false}`, switches it off for the deployment. The refusal does not name it yet.
+A permission set also has a switch, outside the refusal: `POST /api/v1/security/_activation/permission/:name`, body `{enabled: false}`, switches it off for the deployment. The refusal does not name it.
 
 The switches are operator-only where one install serves several organizations. The refusal names the same path whichever layer answers it: `403 NOT_OVERRIDABLE` for a write that names no base, and `403 ITEM_LOCKED` for one that names the read-only package. Which writes are refused, and with which code, is unchanged.
 

content/docs/permissions/authorization.mdx

@@ -416,7 +416,9 @@ grant off, `true` back on). The caller needs `manage_metadata`; under a `group`
 or `isolated` tenancy posture the caller must also be the platform operator,
 because the row reaches every organization (ADR-0126 §5). The name must resolve
 in the security catalog, or the route answers `404`. It is the same authority
-as the flow and action activation switches.
+as the flow and action activation switches. The two audience anchors,
+`everyone` and `guest`, are refused with `400` in either direction: one row
+would switch the authenticated or anonymous baseline off for every principal.
 
 - A deactivated **permission set** contributes nothing: not its name, not its
   `system_permissions`, not its `tab_permissions`. As with an expired grant, a

packages/metadata-protocol/src/packaged-base-regime.ts

@@ -62,7 +62,8 @@
  *    security catalog's activation door. ⛔ No clone: a position has no clone
  *    door. Without this row a packaged position's refusal read the generic
  *    managed seal ("edit the source artifact and redeploy") and never named the
- *    switch that exists.
+ *    switch that exists. The two audience anchors (`everyone`, `guest`) are
+ *    the row's `notFor`: the door refuses them, so they keep the generic seal.
  *
  * Every switch route is gated by the ONE §5 write-authority gate
  * (`packages/runtime/src/domains/activation-gate.ts`), so each carries the same
@@ -138,6 +139,7 @@
  */
 
 import { PLURAL_TO_SINGULAR } from '@objectstack/spec/shared';
+import { AUDIENCE_ANCHOR_POSITIONS } from '@objectstack/spec/identity';
 
 /**
  * An ADR-0126 customization regime a packaged-base refusal speaks for — only the
@@ -162,7 +164,17 @@ export type PackagedBaseRegimeCRoutes =
  * type's sanctioned routes, or an origin-gated type's owning source.
  */
 export type PackagedBaseRegimeRow =
-    | { readonly regime: 'C'; readonly routes: PackagedBaseRegimeCRoutes }
+    | {
+        readonly regime: 'C';
+        readonly routes: PackagedBaseRegimeCRoutes;
+        /**
+         * Names the row does NOT speak for, each with why. A name listed here
+         * reads the generic managed seal ({@link managedItemSealedSentence}'s
+         * own sentence) instead of the row's routes, because those routes refuse
+         * it — a refusal must never name a path that refuses the caller too.
+         */
+        readonly notFor?: Readonly<Record<string, string>>;
+    }
     | {
         readonly regime: 'origin-gated';
         /** The type's noun, opening the sentence the way the type's own admin door opens it. */
@@ -211,6 +223,13 @@ export const PACKAGED_BASE_REGIME: Readonly<Record<string, PackagedBaseRegimeRow
             switchOff: 'POST /api/v1/security/_activation/position/:name, body {enabled: false}; '
                 + 'operator-only where one install serves several organizations',
         },
+        // The activation door refuses the two audience anchors (ADR-0090 D5/D9),
+        // so their refusal must not name it: switching one off would remove the
+        // authenticated or anonymous baseline of every principal in one write.
+        notFor: Object.fromEntries(AUDIENCE_ANCHOR_POSITIONS.map((anchor) => [
+            anchor,
+            'an audience anchor: the activation door refuses it, so the switch is not its remedy',
+        ])),
     },
     datasource: {
         regime: 'origin-gated',
@@ -332,6 +351,9 @@ export function packagedBaseRegimeSentence(
     const singular = PLURAL_TO_SINGULAR[type] ?? type;
     const row = packagedBaseRegimeRow(singular);
     if (row === undefined) return undefined;
+    if (row.regime === 'C' && row.notFor !== undefined && Object.prototype.hasOwnProperty.call(row.notFor, name)) {
+        return undefined;
+    }
     const lock = row.regime === 'origin-gated'
         ? `${row.noun} '${name}' is code-defined and cannot be `
             + (operation === 'delete' ? 'removed' : 'edited') + ' at runtime: it is read-only. '

packages/metadata-protocol/src/protocol.packaged-base-refusal.test.ts

@@ -45,7 +45,11 @@ const ARTIFACTS = new Map<string, Map<string, unknown>>([
     ['page', new Map([['pkg_page', shipped('pkg_page')]])],
     ['action', new Map([['pkg_action', shipped('pkg_action')]])],
     ['permission', new Map([['pkg_perm', shipped('pkg_perm')]])],
-    ['position', new Map([['pkg_position', shipped('pkg_position')]])],
+    ['position', new Map([
+        ['pkg_position', shipped('pkg_position')],
+        ['everyone', shipped('everyone')],
+        ['guest', shipped('guest')],
+    ])],
 ]);
 
 function protocolOn(environmentId: string | undefined): ObjectStackProtocolImplementation {
@@ -402,6 +406,21 @@ describe('packagedBaseRefusal — each Regime C type names its OWN sanctioned pa
         expect(refusalOnHostConfig('permission', 'pkg_perm', 'delete')).toBeNull();
     });
 
+    it('`position` — an audience anchor keeps the generic managed seal: the switch refuses it, so it is not named', () => {
+        // The activation door refuses `everyone` and `guest` (the row's `notFor`).
+        for (const anchor of ['everyone', 'guest']) {
+            const r = refusal('position', anchor, 'save');
+            expect(shape(r), anchor).toEqual({ code: 'NOT_OVERRIDABLE', status: 403 });
+            expect(r.message, anchor).toBe(
+                `Metadata item 'position/${anchor}' is provided by a managed package and is sealed against in-place edits: `
+                + 'its type takes no environment overlay (allowOrgOverride=false), and OS_METADATA_WRITABLE does not open '
+                + 'a managed item. Edit the source artifact and redeploy. '
+                + 'See docs/adr/0131-total-organization-ownership-no-null-organization-id.md.',
+            );
+            expect(r.message, anchor).not.toContain('_activation');
+        }
+    });
+
     it('`position` removal is the same #6960 carve-out — its row adds no refusal where there was none', () => {
         // `position` merges its overlay at read (`supportsOverlay: true`), like `permission`.
         expect(refusal('position', 'pkg_position', 'delete')).toBeNull();

packages/runtime/src/domains/catalog-activation-door.test.ts

@@ -31,7 +31,13 @@ const SET = 'sales_access';
 const DIRECT_SET = 'report_reader';
 
 const CATALOG: TestSecurityCatalog = {
-    positions: [{ name: POSITION, permissionSets: [SET], _packageId: 'crm' }],
+    positions: [
+        { name: POSITION, permissionSets: [SET], _packageId: 'crm' },
+        // The audience anchors are DECLARED here so a refusal of them cannot be
+        // a 404 in disguise: the lookup would find them.
+        { name: 'everyone', permissionSets: [] },
+        { name: 'guest', permissionSets: [] },
+    ],
     permissions: [
         { name: SET, systemPermissions: ['cap_sales'] },
         { name: DIRECT_SET, systemPermissions: ['cap_reports'] },
@@ -273,6 +279,41 @@ describe('the catalog activation door — contract', () => {
         expect(h.writes).toEqual([]);
     });
 
+    for (const anchor of ['everyone', 'guest']) {
+        for (const enabled of [false, true]) {
+            it(`refuses the audience anchor \`${anchor}\` with enabled: ${enabled} — 400, nothing written`, async () => {
+                const h = boot('single');
+
+                const res = await flip(h, TENANT_ADMIN(), `/_activation/position/${anchor}`, { enabled });
+
+                expect(statusOf(res)).toBe(400);
+                expect(messageOf(res)).toContain(`'${anchor}' is an audience anchor`);
+                expect(messageOf(res)).toContain('not switchable through this door');
+                expect(h.writes).toEqual([]);
+                expect(h.tables[LEDGER]).toEqual([]);
+            });
+        }
+
+        it(`the authority gates still answer first for \`${anchor}\` — a walled tenant admin gets 403, not the anchor 400`, async () => {
+            const h = boot('isolated');
+
+            const res = await flip(h, TENANT_ADMIN(), `/_activation/position/${anchor}`);
+
+            expect(statusOf(res)).toBe(403);
+            expect(codeOf(res)).toBe('PERMISSION_DENIED');
+            expect(h.writes).toEqual([]);
+        });
+    }
+
+    it('an anchor NAME under `permission` is not an anchor — it is looked up like any set (404 here)', async () => {
+        const h = boot('single');
+
+        const res = await flip(h, TENANT_ADMIN(), '/_activation/permission/everyone');
+
+        expect(statusOf(res)).toBe(404);
+        expect(h.writes).toEqual([]);
+    });
+
     it('refuses a one-letter-off body key rather than inverting it into "enable"', async () => {
         const h = boot('single');
 

packages/runtime/src/domains/catalog-activation.ts

@@ -44,6 +44,7 @@
  * `single`, the platform operator under a wall). ⛔ No new authority.
  */
 
+import { AUDIENCE_ANCHOR_POSITIONS, GUEST_POSITION } from '@objectstack/spec/identity';
 import {
     METADATA_ACTIVATION_TABLE,
     ObjectStoreMetadataActivationStore,
@@ -118,7 +119,8 @@ function ledgerUnregistered(ql: any): boolean {
  *     names the subject the PATH asked for; a path whose type is not a catalog
  *     type is refused with the position wording, which says nothing a refused
  *     caller could not read off the route ledger.
- *  2. **Shape**: `['_activation', type, name]`, `type` a catalog type.
+ *  2. **Shape**: `['_activation', type, name]`, `type` a catalog type, and
+ *     not an audience anchor (`everyone` / `guest`), which this door refuses.
  *  3. **Body**: {@link readActivationBody}.
  *  4. **Declaration**, through the catalog reader the security plugin binds to
  *     the engine — the one `resolveUserAuthzGrants` reads, so this door and
@@ -158,6 +160,26 @@ export async function handleCatalogActivationWrite(
     const type: CatalogActivationType = requestedType;
     const name = parts[2];
 
+    // ── 2b. the audience anchors ────────────────────────────────────────────
+    // [ADR-0090 D5/D9] `everyone` is the authenticated baseline every signed-in
+    // member holds implicitly, and `guest` the anonymous one. One row here
+    // would switch either off for every principal in the deployment at once.
+    // Stage 1 kept the anchors sealed against every caller-reachable write, and
+    // this door keeps that: refused in either direction, before the body is
+    // read and before any lookup or write, with the same 400 as a type that has
+    // no switch — a well-formed target this door does not switch.
+    if (type === 'position' && (AUDIENCE_ANCHOR_POSITIONS as readonly string[]).includes(name)) {
+        return {
+            handled: true,
+            response: deps.error(
+                `Position '${name}' is an audience anchor: it carries the ${name === GUEST_POSITION ? 'anonymous' : 'authenticated'} ` +
+                `baseline of every principal in the deployment, so it is not switchable through this door (ADR-0090 D5/D9). ` +
+                `Change what it grants through the permission sets bound to it instead.`,
+                400,
+            ),
+        };
+    }
+
     // ── 3. body ─────────────────────────────────────────────────────────────
     const bodyReading = readActivationBody(deps, body);
     if (bodyReading.refusal) return bodyReading.refusal;

packages/runtime/src/route-ledger.ts

@@ -353,7 +353,7 @@ export const ROUTE_LEDGER: readonly RouteLedgerEntry[] = [
       + 'the action door. The same two authority tiers as `POST /automation/:name/toggle` and `POST /actions/_activation/:object/:action`: '
       + '`manage_metadata`, then the ADR-0126 §5 posture rule requiring the platform operator in `group`/`isolated` — one shared '
       + 'implementation in `domains/activation-gate.ts`. The name must resolve in the security catalog the resolver reads (404 '
-      + 'otherwise, 503 when no catalog is bound); switching `admin_full_access` off is refused 403 by the last-admin guard\'s '
+      + 'otherwise, 503 when no catalog is bound), and the audience anchors `everyone` / `guest` are refused 400 in either direction; switching `admin_full_access` off is refused 403 by the last-admin guard\'s '
       + 'ledger hook. The ONE `/security` route the dispatcher mounts on the wire (`registerSecurityActivationRoutes`); the rest '
       + 'of `/security` is the REST server\'s. NOT JS-SDK surface, for the action door\'s reason: its caller is the Setup console '
       + '(Deactivate on the position and permission-set pages), which calls the platform API directly; adding a client method '