docs(skills, spec): every published package declares one anchor-safe isDefault permission set (#25930)

<!-- claude-projects-attribution: {"github_login":"os-project-manager"}
-->
_Requested by **Leehom** · [project
thread](https://claude.ai/code/project/chan_01TenzsRopZj4jMbvjX8uz1X?thread=cmsg_01TenzsRopZj4jMbvjX8uz1XFfzvMqgJHhisBXrtmgA5T9)_
Fixes #25773

Clause-②: no
Metadata-protocol: none

## Summary

Consequence (ii) of maintainer ruling record 6341690661: the published
skill and the marketplace reference now state that every published
package declares exactly one anchor-safe `isDefault: true` permission
set. Text only. No lint rule, schema key or runtime path changes, and no
new gate (the ruling orders the text; a gate needs the maintainer's own
word).

## What changed

1. `skills/objectstack-data/rules/security.md`, the `isDefault: true`
bullet under the RBAC section. It keeps the semantics (the `everyone`
baseline, ADR-0090 D5) and adds the requirement as a check an author can
run: exactly one such set, anchor-safe, meaning
`describeAnchorForbiddenBits(set, 'everyone')` from
`@objectstack/spec/security` returns `null`. It names the two refusals
that already exist (lint rule `security-anchor-high-privilege`, and the
binding), says what happens with none (invited members get nothing until
an admin assigns a set to each), and says that no gate counts the sets.
The old "lint and boot refuse a platform capability or undeclared name"
clause is folded in: it is exactly what the anchor-safe predicate
refuses in `systemPermissions`, so the bullet now says the set's
`systemPermissions` may name only app capabilities declared under
`capabilities:`.
2. Marketplace docs. The source is the Marketplace Protocol module doc
block at the top of `packages/spec/src/marketplace/marketplace.zod.ts`,
which `build-docs.ts` renders as
`content/docs/references/marketplace/marketplace.mdx` (AUTO-GEN, not
hand-edited). That block already carries the "Developer Publishing Flow"
a publisher reads, so the new section sits right after it. The exact
source sentence added: "Exactly one anchor-safe default permission set
(ADR-0090 D5): `isDefault: true`, and `describeAnchorForbiddenBits(set,
'everyone')` from `@objectstack/spec/security` returns `null`." The
section then gives the reason and the enforcement facts. Regenerated
with `pnpm --filter @objectstack/spec gen:docs`; the only regenerated
diff is the new 9-line "What a published package declares" section in
`marketplace.mdx` (commit f1340f3).
3. `.changeset/25773-published-package-default-permission-set.md`:
`patch` for `@objectstack/skills` (ships `skills/**`) and
`@objectstack/spec` (ships `src/**/*.zod.ts`, so the edited doc block is
published text).

## Where the predicate and the refusals live (read at `cb0a2fcf`)

- Predicate: `describeAnchorForbiddenBits` in
`packages/spec/src/security/high-privilege.ts`, exported from
`@objectstack/spec/security`. For `everyone` it is
`describeHighPrivilegeBits` with the stack's declared capabilities as
context: no platform or undeclared `systemPermissions`, no
`viewAllRecords` / `modifyAllRecords`, no `allowDelete` /
`allowTransfer` / `allowExport` on any object.
- Author-time refusal: `packages/lint/src/validate-security-posture.ts`,
rule `SECURITY_ANCHOR_HIGH_PRIVILEGE` = `security-anchor-high-privilege`
(error), run on every `isDefault: true` set.
- Bind-time refusal: `confirmAudienceBindingSuggestion` in
`packages/plugins/plugin-security/src/suggested-audience-bindings.ts`
runs the same predicate; at boot `everyoneBaseline` in
`security-plugin.ts` withholds a high-privilege set from `everyone`.
- Presence and count: nothing enforces them.
`appDefaultPermissionSetName`
(`plugin-security/src/app-default-permission-set.ts`) takes the first
`isDefault` set and returns `undefined` when there is none, with no
diagnostic. The text says "no gate counts them" for that reason.

## Token ratchet (`skills/**`)

| Reading | Before (`cb0a2fcf`) | After (`f1340f32`) |
|:--|--:|--:|
| `rules/security.md` tokens (ceiling 2563, not raised) | 2563 | 2561 |
| `rules/security.md` lines | 220 | 220 |
| `skills/objectstack-data/**` lines | 3806 | 3806 |
| all `skills/*/SKILL.md` lines (untouched) | 4383 | 4383 |
| bundle total tokens (`check-skills-token-ratchet`; before = after + 2,
only this file moved) | 155469 | 155467 |

The new text (+66 tokens on the bullet as first drafted) is paid by
deleting content in the same file, with no re-wrap counted as savings:
the `stack.zod.ts` path aside on the `permissionSets:` bullet; the
parenthetical after the `rls.zod.ts` source line; the parenthetical
after the `field.zod.ts` source line; ADR-0105 §"Today's two postures"
from the multi-tenancy reference (ADR-0093 and the tenancy-modes URL
stay); "plugin-security's FieldMasker enforces it. The real channels
are:" shortened to "(FieldMasker). Two more channels:"; and the
capability clause folded into the anchor-safe sentence as described
above.

## Gates (head `f1340f32`)

Derived with `node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack`: 113 commands. All 113 run with exit codes
captured before any pipe: 113 exit 0. Six first answered exit 3
(PREREQUISITE NOT MET: `check:doc-formula-expressions`,
`check:doc-security-posture`, `check:skill-examples`,
`check:docs-transcript-drift`, `check:dual-build-cjs-loads`,
`check:lean-entry-closure`) and answered exit 0 after a full `pnpm turbo
run build` under the verify lock. `dispatch-gates --ran`: "113 derived
famil(ies) accounted for — 113 run, 0 NOT-MEASURED". Also `pnpm --filter
@objectstack/spec build` exit 0, `pnpm --filter @objectstack/spec
typecheck` exit 0, `check:generated` exit 0 after `gen:docs`. No tests
changed and no tested behaviour changed, so there is no ablation. CI
families (Test Core, Build Core, Build Docs, type-check lanes) are left
to this PR's check-runs.

## 维护者速读（草稿）

- **改了什么**：对外发布的技能文档 `security.md` 和 marketplace
参考文档里，写明"每个发布包必须声明且只声明一个锚安全的默认权限集（`isDefault:
true`）"，并给出作者可自查的判据（`describeAnchorForbiddenBits(set, 'everyone')` 返回
`null`）。只改文字，不加门禁、不改代码行为。
- **为什么改**：落实裁决 6341690661 的第 (ii)
项：默认访问只通过一个机制到达组织邀请的成员；包里没有这样的权限集，新成员就什么都看不到，直到管理员逐人分配。原文只讲了含义，没讲要求。
- **风险与代价（含回滚）**：技能文件 token 不增（2563 → 2561），用删掉同文件三处源码路径旁注、一处 ADR
章节引用和一句话来抵账。回滚即还原这两个文件并重生成文档页。
- **席位意见**：
- **你要做的**：这是 Tier H（`skills/**`），需要你批准后由席位落地。

## Acceptance notes

- No gate refuses a package that declares no `isDefault` set or more
than one; the app-level reader `appDefaultPermissionSetName` silently
takes the first. Whether a gate should enforce this at publish time is
left for the maintainer's word, per the card's boundary.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_014LdiGPrydHj5PHTzYQUvoW

---
_Generated by [Claude
Code](https://claude.ai/code/session_014LdiGPrydHj5PHTzYQUvoW)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/25773-published-package-default-permission-set.md

@@ -0,0 +1,11 @@
+---
+'@objectstack/skills': patch
+'@objectstack/spec': patch
+---
+
+docs(skills, spec): state that every published package declares exactly one anchor-safe `isDefault: true` permission set
+
+Clause-②: no
+Metadata-protocol: none
+
+`objectstack-data/rules/security.md` said what `isDefault: true` means (the `everyone` baseline, ADR-0090 D5) but not that a published package must declare one. Its `isDefault` bullet now states the requirement as a check an author can run: exactly one such set, anchor-safe, meaning `describeAnchorForbiddenBits(set, 'everyone')` from `@objectstack/spec/security` returns `null`; otherwise lint rule `security-anchor-high-privilege` and the binding refuse it. It also says what happens without one (invited members get nothing until an admin assigns a set to each) and that no gate counts the sets. The Marketplace Protocol header in `marketplace.zod.ts`, which the generated marketplace reference page renders, gains a matching "What a published package declares" section. No lint rule or schema changes. To stay within the skill file's token ceiling, three source-path asides, a section reference and one sentence are trimmed in the same file.

content/docs/references/marketplace/marketplace.mdx

@@ -31,6 +31,15 @@ platform, and customers who install plugins.
 6. Publish   → Approved listing goes live on marketplace
 ```
 
+### What a published package declares
+Exactly one anchor-safe default permission set (ADR-0090 D5): `isDefault: true`,
+and `describeAnchorForbiddenBits(set, 'everyone')` from `@objectstack/spec/security`
+returns `null`. That set is the one mechanism by which default access reaches the
+members an organization invites; a package that declares none reaches no invited
+member until an admin assigns a set to each person. Lint rule
+`security-anchor-high-privilege` refuses an `isDefault` set that is not anchor-safe;
+no gate refuses a package that declares none, or more than one.
+
 ### Platform Management Flow
 ```
 1. Receive   → Accept submissions from verified publishers

packages/spec/src/marketplace/marketplace.zod.ts

@@ -28,7 +28,16 @@ import { CONSUMER_INSTALLABLE_TYPES } from '../kernel/plugin.zod';
  * 5. Review    → Platform conducts automated + manual review
  * 6. Publish   → Approved listing goes live on marketplace
  * ```
- * 
+ *
+ * ## What a published package declares
+ * Exactly one anchor-safe default permission set (ADR-0090 D5): `isDefault: true`,
+ * and `describeAnchorForbiddenBits(set, 'everyone')` from `@objectstack/spec/security`
+ * returns `null`. That set is the one mechanism by which default access reaches the
+ * members an organization invites; a package that declares none reaches no invited
+ * member until an admin assigns a set to each person. Lint rule
+ * `security-anchor-high-privilege` refuses an `isDefault` set that is not anchor-safe;
+ * no gate refuses a package that declares none, or more than one.
+ *
  * ## Platform Management Flow
  * ```
  * 1. Receive   → Accept submissions from verified publishers

skills/objectstack-data/rules/security.md

@@ -21,15 +21,18 @@ export const salesUser = definePermissionSet({
 ```
 
 - `permissionSets:` is **refused at load** with an `Unrecognized key(s) on this
-  stack definition` error naming the key; `ObjectStackDefinitionSchema`
-  (`node_modules/@objectstack/spec/src/stack.zod.ts`) enumerates the keys.
+  stack definition` error naming the key; `ObjectStackDefinitionSchema` enumerates
+  the keys.
 - Bits: `allowCreate` / `allowRead` / `allowEdit` / `allowDelete`, plus
   `allowTransfer` (ownership change), `viewAllRecords` / `modifyAllRecords`
   (super-user, bypass sharing).
 - Source: `node_modules/@objectstack/spec/src/security/permission.zod.ts`
-- **`isDefault: true` = the `everyone` baseline (ADR-0090 D5).** It may carry app
-  capabilities declared under `capabilities:` (`defineCapability`) and granted via
-  `systemPermissions`; lint and boot refuse a platform capability or undeclared name there.
+- **`isDefault: true` = the `everyone` baseline (ADR-0090 D5).** A published package
+  declares **exactly one**, anchor-safe: `describeAnchorForbiddenBits(set, 'everyone')`
+  (`@objectstack/spec/security`) returns `null`, else lint
+  (`security-anchor-high-privilege`) and the binding refuse it. With none, invited
+  members get nothing until an admin assigns each; no gate counts them. Its
+  `systemPermissions` may name only app capabilities declared under `capabilities:`.
 - `enable.apiMethods` also restricts the HTTP surface.
 
 ## Assigning a permission set to a user
@@ -108,16 +111,14 @@ bridge (warns). The compiler resolves these
 | `current_user.positions` | the caller's positions (for `IN`; ADR-0090 D3) |
 | `current_user.KEY` | the set an object's `membershipKeys.KEY` declares (for `IN`) |
 
-- Source: `node_modules/@objectstack/spec/src/security/rls.zod.ts` (policy
-  shape, predicate grammar, `check` composition).
+- Source: `node_modules/@objectstack/spec/src/security/rls.zod.ts`.
 - Prefer the built-in `member_default` owner scoping (`owner_only_writes` /
   `owner_only_deletes`) and the object's `sharingModel` (ADR-0056 D1) over
   hand-written policies for the common cases.
 
 ## Sensitive fields — `secret` type + `requiredPermissions`
 
-`maskingRule` is **live** (plugin-security's FieldMasker enforces it). The real
-channels are:
+`maskingRule` is **live** (FieldMasker). Two more channels:
 
 **Encrypted-at-rest values — `type: 'secret'` (ADR-0100).** For reversible
 machine credentials (DB passwords, API keys, tokens): the engine encrypts the
@@ -147,16 +148,15 @@ fields: {
 ```
 
 - Source: `node_modules/@objectstack/spec/src/data/field.zod.ts`
-  (`secret` field type, `requiredPermissions`)
 
 ## Multi-tenancy
 
 Organization count is a **deployment posture** fact, never object metadata.
 `single` (default) = one logical tenant: the bootstrapped Default Organization
 only, a second refused (`403`); sub-units are business units. Tenants as
 `sys_organization` rows need a walled posture (`group`/`isolated`; open core,
-ADR-0132) — ⛔ never `single` + your own RLS. See ADR-0093, ADR-0105 §"Today's
-two postures", https://objectstack.ai/docs/deployment/tenancy-modes.
+ADR-0132) — ⛔ never `single` + your own RLS. See ADR-0093,
+https://objectstack.ai/docs/deployment/tenancy-modes.
 
 Within a posture, `tenancy` on the object is the row-level knob (stamped on
 write, enforced on read); **strict**, two keys: