Merge remote-tracking branch 'origin/main' into claude/issue-24410-formula-related-field-refusal

Author: claude

.changeset/24335-file-hydration-no-denial.md

@@ -0,0 +1,17 @@
+---
+'@objectstack/objectql': patch
+---
+
+fix(objectql): a record read that hydrates a file field no longer makes a `sys_file` access attempt for a reader without `sys_file` read
+
+The engine expands a stored file id by reading `sys_file`, and it issued that read as the caller. A member who may read the record but not `sys_file` (the platform default) was refused it, and the security layer logged `[Security] Access denied: operation 'find' on object 'sys_file'` at WARN on every by-id and list read by that member, although the body served was right. Those lines buried the real denials in the operator's log.
+
+The engine now asks the security service's `canReadObject('sys_file')` first, the same object-level read gate the security middleware applies, and serves a refused caller the field-owned answer without the read. Nothing else changes:
+
+- The served body is byte-identical, by id and by list, for a reader with and without `sys_file` read. A file owned by the record still hydrates, and every other id still reads `{ id, metadataRefused: true }`.
+- A direct `GET /api/v1/data/sys_file/:id` by the same reader still answers `403 PERMISSION_DENIED` and still logs its denial.
+- With no security service, or one that offers no `canReadObject`, the engine reads as the caller, as before.
+
+The ask is one cached permission check per read, not per row.
+
+Clause-②: no (no accept set or public surface moves: the served bodies and every refusal are unchanged; owes the seat's review of record at `TIER_DEFAULT` before the queue)

.changeset/24343-8b0c-activity-never-null.md

@@ -0,0 +1,11 @@
+---
+"@objectstack/plugin-audit": patch
+"@objectstack/cli": patch
+---
+
+fix: an activity row is written only when an organization is derivable, never with a NULL organization, and the v18 ownership ceremony deletes the existing NULL activity rows it cannot attribute (ADR-0131 D9)
+
+Clause-②: no
+
+- **`@objectstack/plugin-audit`.** The audit writer's activity mirror (`sys_activity`) takes its organization from the record, then from the acting session, then from the `tenancy` service's Default Organization under `single`. When none of them names one, the mirror now writes no activity row at all. Before, it wrote a row with `organization_id` NULL. Under a wall that row was readable by no organization member. The change is still recorded: the compliance ledger row (`sys_audit_log`) is written as before, with its `tenant_id` attribution. Under `single` the Default Organization is always derivable, so nothing changes there. A record that names its organization keeps its activity row, with that organization.
+- **`@objectstack/cli`.** `os migrate organization-ownership` still attributes a NULL `sys_activity` row when its record carries an organization. On a walled database (any posture but `single`), the mirror-deletion step now deletes the NULL rows no anchor attributes, such as activity about a sign-up's `sys_user`. Before, those rows were reported as unattributable and held certification. They are 14-day telemetry that the mirror no longer writes, and `sys_audit_log` keeps each change. The plan counts them as the departure `underivable-activity`, and warns before the first write that `--apply` deletes them. The apply report lists the count as the table's `deleted`. Under `single` the Default Organization takes these rows, as before, and nothing is deleted.

.changeset/24405-mcp-connect-agent-subtitle.md

@@ -0,0 +1,10 @@
+---
+'@objectstack/mcp': patch
+---
+
+Clause-②: no (copy only: no accept set or public surface moves; owes the seat's review of record at `TIER_DEFAULT` before the queue)
+
+fix(mcp): the Connect-an-Agent page subtitle says "this system"
+
+- **What changed.** The Connect-an-Agent page header now reads "Give any MCP-capable AI client governed access to this system — every call runs under the caller's own permissions and row-level security." Inside the running system, user-facing copy names the system the caller is in as "this system".
+- **Unchanged.** The page's name, layout, components and navigation entries, and every MCP route and payload.

.changeset/24405-platform-objects-this-system.md

@@ -0,0 +1,11 @@
+---
+'@objectstack/platform-objects': patch
+---
+
+Clause-②: no (copy only: no accept set or public surface moves; owes the seat's review of record at `TIER_DEFAULT` before the queue)
+
+fix(platform-objects): SSO provider, OAuth application and Connect-an-Agent copy says "this system"
+
+- **What changed.** Inside the running system, user-facing copy names the system the user is in as "this system". The `sys_sso_provider` object description ("External SSO identity providers (OIDC / SAML) this system federates login to"), the `clientId` help text of its Register SSO Provider action ("OAuth client ID issued by the IdP for this system."), and the OAuth applications grid's empty state ("Register an application to let its clients sign users in with this system.") now say so. The `en` copy of the Connect-an-Agent page subtitle follows the page's new text.
+- **Translations.** The zh-CN, ja-JP and es-ES values of the same strings are re-translated, and the recorded source hash of the Connect-an-Agent subtitle moves to the new English text in all three, so those locales keep serving their translation rather than falling back to English.
+- **Unchanged.** Every object, field, action and page name, and all behaviour.

packages/cli/src/utils/organization-ownership-apply.ts

@@ -28,6 +28,7 @@ import {
   predicateSql,
   PRIMARY_DATABASE,
   Sql,
+  underivableDepartureOf,
   type AttributionSink,
   type MetadataConflict,
   type MetadataKeyRow,
@@ -117,7 +118,11 @@ import type { DeclaredSharingRuleSkip } from '@objectstack/plugin-sharing';
  *     C3 stage 9): every grant naming a mirror row is renamed to the rule's
  *     NAME, which the registry must resolve, and only then is the mirror
  *     deleted ({@link runDeclaredRuleMirrorDeletion}). It runs again on a
- *     checkpointed run while a mirror stands.
+ *     checkpointed run while a mirror stands. Before them, a fate-3 table's
+ *     `underivableDeparture` (`sys_activity`, ruling record 6257510973 item
+ *     3): the NULL rows no anchor attributes once attribution is done are
+ *     deleted — never under `single`, where the Default Organization takes
+ *     them ({@link runUnderivableDeletion}).
  *  4h. `history-renumber` — seat answer Q2 A: `sys_metadata_history`'s
  *     `event_seq` and every `(type, name, version)` unique environment-wide
  *     before the column goes. Every lineage still tagged to an organization
@@ -184,7 +189,7 @@ import type { DeclaredSharingRuleSkip } from '@objectstack/plugin-sharing';
  *
  * ## What it never does
  *
- * ⛔ Delete a row outside fate 2. ⛔ Give an unattributable row an owner:
+ * ⛔ Delete a row outside fate 2 and a declared `underivableDeparture`. ⛔ Give an unattributable row an owner:
  * owners come only from the plan's anchors and, under `single`, the Default
  * Organization. ⛔ Create any organization but the Default Organization, and
  * that one only under `single` on a database that holds none. ⛔ Run at boot:
@@ -2526,6 +2531,11 @@ async function runMirrorDeletion(run: Run): Promise<StepReport> {
     const kept = Math.max(0, table.rows!.total - (run.deleted.get(table.object) ?? 0));
     if (kept > 0) notes.push(`${table.object}: ${kept} row(s) are not mirrors (a named category or their non-seeded provenance claims them) and stay.`);
   }
+  const underivable = await runUnderivableDeletion(run);
+  total += underivable.deleted;
+  if (underivable.blockers.length) {
+    return { step: 'mirror-deletion', status: 'blocked', summary: { deleted: total }, blockers: underivable.blockers, notes };
+  }
   const declared = await runDeclaredRuleMirrorDeletion(run);
   if (declared.status !== 'done') return { ...declared, summary: { ...declared.summary, deleted: total }, notes: [...notes, ...declared.notes] };
   return {
@@ -2537,6 +2547,65 @@ async function runMirrorDeletion(run: Run): Promise<StepReport> {
   };
 }
 
+// ── Step 4, continued: the rows no anchor attributes (ruling record 6257510973 item 3) ─
+
+/**
+ * The NULL rows of a fate-3 table that declares an `underivableDeparture`
+ * (`sys_activity`: activity is never a NULL row, and the existing ones are
+ * deleted): once attribution has written every owner it derives, every row
+ * still NULL is one of them. Read from a fresh plan, so the delete takes
+ * exactly what that plan classifies: a table on which it still derives an
+ * owner, or reports a row, blocks with nothing deleted. Never under `single`
+ * ({@link underivableDepartureOf}).
+ */
+/** Whether the plan this run started from counts a row an `underivableDeparture` deletes. */
+function underivableRowsDue(run: Run): boolean {
+  return run.plan.tables.some((t) => {
+    const entry = mirrorEntry(run, t.object);
+    const id = entry ? underivableDepartureOf(entry, run.opts.posture)?.id : undefined;
+    return id !== undefined && t.departures.some((d) => d.id === id && d.rows > 0);
+  });
+}
+
+async function runUnderivableDeletion(run: Run): Promise<{ deleted: number; blockers: string[] }> {
+  const declares = (object: string): string | undefined => {
+    const entry = mirrorEntry(run, object);
+    return entry ? underivableDepartureOf(entry, run.opts.posture)?.id : undefined;
+  };
+  if (!run.plan.tables.some((t) => t.physical === 'present' && declares(t.object))) return { deleted: 0, blockers: [] };
+  const plan = await planFor(run);
+  let deleted = 0;
+  const blockers: string[] = [];
+  for (const table of plan.tables) {
+    const id = declares(table.object);
+    const leaving = id ? table.departures.find((d) => d.id === id) : undefined;
+    if (!leaving || leaving.rows === 0 || table.physical !== 'present') continue;
+    const deriving = Number(table.fateCounts.rowsToAttribute ?? 0);
+    if (deriving > 0 || table.unattributable.length > 0 || leaving.rows !== table.rows!.organizationNull) {
+      blockers.push(
+        `${table.object}: ${leaving.rows} row(s) no anchor attributes are due for deletion, but the table still holds ` +
+          `${table.rows!.organizationNull} NULL row(s) (${deriving} an anchor attributes, ${table.unattributable.length} ` +
+          'reported), so nothing was deleted. Re-run --apply: the attribution step runs again first.',
+      );
+      continue;
+    }
+    for (const physical of table.tables) {
+      const { sql } = databaseFor(run, physical);
+      const where = `${sql.q(ORG, physical)} IS NULL`;
+      const count = (): Promise<number> => sql.count(physical, `SELECT COUNT(*) AS n FROM ${sql.q(physical, physical)} WHERE ${where}`);
+      const before = await count();
+      if (before === 0) continue;
+      await execute(run, physical, `DELETE FROM ${sql.q(physical, physical)} WHERE ${where}`, []);
+      const left = await count();
+      if (left !== 0) throw new Error(`The delete on ${physical} left ${left} organization-less row(s) behind; nothing past this table was deleted.`);
+      run.deleted.set(table.object, (run.deleted.get(table.object) ?? 0) + before);
+      deleted += before;
+      run.opts.onProgress?.(`mirror deletion: ${before} organization-less row(s) of ${physical} no anchor attributes`);
+    }
+  }
+  return { deleted, blockers };
+}
+
 // ── Step 4, continued: the declared sharing-rule mirrors (ADR-0131 C3 stage 9) ─
 
 const SHARING_RULES = 'sys_sharing_rule';
@@ -3097,6 +3166,23 @@ export async function applyOrganizationOwnership(opts: ApplyOptions): Promise<Or
     // checkpointed run while one stands: a database whose ceremony completed on
     // a release whose boot still seeded them carries them (advisory then), and
     // the step that deletes them is this release's.
+    // So are the rows no anchor attributes, while one stands: a row written
+    // NULL since the run that finished the step is one too.
+    if (done && step === 'mirror-deletion' && underivableRowsDue(run)) {
+      const again = await runUnderivableDeletion(run);
+      const report: StepReport = again.blockers.length
+        ? { step, status: 'blocked', summary: { deleted: again.deleted }, blockers: again.blockers, notes: [] }
+        : { step, status: 'done', summary: { deleted: again.deleted }, blockers: [], notes: [] };
+      steps.push(report);
+      if (report.status !== 'done') {
+        stopped = true;
+        continue;
+      }
+      checkpoint.completed[step] = { at: now().toISOString(), summary: report.summary };
+      await opts.ledger.write(checkpoint, { complete: false, blocking: 0, advisory: 0 });
+      run.columns.clear();
+      if (!(await declaredRuleMirrorsDue(run))) continue;
+    }
     if (done && step === 'mirror-deletion' && (await declaredRuleMirrorsDue(run))) {
       const again = await runDeclaredRuleMirrorDeletion(run);
       steps.push(again);