Repository navigation
security(attachments): the attach / delete gate asks plugin-sharing's canEdit, which reads every controlled_by_parent object as public — a member with sys_attachment create/delete writes files on child records they cannot edit #22455
Description
Filing gate: ① product defect with reach measured. Class (a), security: a write past record-level authority. reach: REST POST /api/v1/data/sys_attachment and DELETE /api/v1/data/sys_attachment/:id, measured on @objectstack/* 17.7.0 by the dev of objectstack-ai/hotcrm#2029 (report 6078558197), session session_012zh91QzFgePbkmuHnugLN3, on a seeded objectstack dev box with the persona na.rep (sales_rep + na_sales_team) and sys_attachment create/delete granted for the measurement.
Who acts on it: the objectstack triage seat routes it; the fix sits at the seam between @objectstack/service-storage (attachment-access-hooks.ts) and @objectstack/plugin-sharing (sharing-service.ts). Filed by the repo:hotcrm seat. ⛔ Not a claim. hotcrm grants sys_attachment read only until this is fixed (PR objectstack-ai/hotcrm#2036), so a rep cannot attach the quote PDF the product promises (hotcrm AGENTS.md §2: wait, no workaround).
What happens
service-storage's attachment hooks gate an attach oncanEdit(parent), and a delete on uploader-or-canEdit(parent), asked of the sharing service (packages/services/service-storage/src/attachment-access-hooks.ts, thecanEditport at:70).plugin-sharing'seffectiveSharingModelmapscontrolled_by_parentto'public'(packages/plugins/plugin-sharing/src/sharing-service.ts:116onmain05c7c3fa3b). Its own doc comment says that public is "scoped separately by the security plugin's master-detail path, ADR-0055". The attachment gate never takes that path:checkEditabstains on a public model, socanEditanswerstruefor everycontrolled_by_parentrecord.
Measured (17.7.0)
With sys_attachment create and delete granted to sales_rep:
na.rep→POST sys_attachmenton acrm_quotethat answers them 404 → 201 (the file is attached).- On a
crm_contractwhose ownPATCHanswers them 403: attach → 201, andDELETEof the admin's executed-contract file → 200. - Control: an attach to a private
crm_accountthey cannot read → 403ATTACHMENT_PARENT_ACCESS. The gate works on a model it does not collapse.
In hotcrm, crm_contact, crm_quote and crm_contract are controlled_by_parent. Any app that grants members attachment upload, which the platform's attachments-access page recommends, lets every member plant files on, and delete others' files from, every child record of the org.
Likely the same, NOT measured: plugin-audit's sys_comment gate asks the same canEdit.
Acceptance
- The attach and delete gates resolve a
controlled_by_parentparent through its master: the same answerPATCHgives on the parent record. A caller who cannot edit the record (or cannot see it) is refused, withATTACHMENT_PARENT_ACCESSor the envelope the gate uses today. - Pins: an attach on a child whose master the caller cannot edit is refused, and a delete of another user's file on such a child is refused. Positive controls: the master's owner attaches; an uploader deletes their own file.
- The same check for
sys_commentif it shares the gate.
Related
sys_commenthas no record-level authorization: any org member reads and writes comments on records they cannot see #4630 and Decision needed: should thesys_commentparent gates run the parent's owner-match at the caller's real write DEPTH, or stay atown? #7144 (closed): comment parent gates. [attachments] v2 tracking: parent-visibility inheritance, authed downloads, remaining enforce-or-remove #2970 (closed): attachments v2 parent-visibility inheritance.getReadFilternever applies thecontrolled_by_parentderivation — the analytics read-scope path is missing the master half entirely #5815 (closed):getReadFiltermissing thecontrolled_by_parentderivation, the READ half of this same collapse.- The console's Attachments panel shows Upload and delete to a read-only grant; the upload then fails at the final attach (403) and leaves a committed
sys_filewith no attachment. Measured in the same run; separate (renderer), listed here for triage.
Duplicate check
gh search is refused in this container (GraphQL and REST search answer 403). So all objectstack issues were listed into a local index (/issues?state=all through #22292, plus every issue updated since 2026-10-08) and matched case-insensitively:
controlled_by_parent canEdit: 1, closed ([security] A by-id write is not gated by record visibility — a contributor mutates records they cannot read, when only select-scope RLS is authored #7665: by-id writes without select-scope RLS, not attachments).effectiveSharingModel: 3, closed (lint: a sharing rule declared on an object whose effective sharing model ispublicis statically detectable and unreported until boot #9698, plugin-sharing lowers__readScopeown/unit to anowner_idpredicate on federated objects, whereowner_idis a phantom column #7858,getReadFilternever applies thecontrolled_by_parentderivation — the analytics read-scope path is missing the master half entirely #5815).attachment parent canEdit: 5, closed (service-storage's attachment kit carries the same 5-fieldcallerContextprojection #7141 fixed for comments #7145, Decision needed: should thesys_commentparent gates run the parent's owner-match at the caller's real write DEPTH, or stay atown? #7144, security/explain 与写入路径对同一条记录给出相反答案：VAMA 持有者对无主 private 记录 explain 答 allowed:true，PATCH 回 403 #4647,sys_commenthas no record-level authorization: any org member reads and writes comments on records they cannot see #4630, [attachments] v2 tracking: parent-visibility inheritance, authed downloads, remaining enforce-or-remove #2970).ATTACHMENT_PARENT_ACCESS: 3, closed (QA runs and security/explain 与写入路径对同一条记录给出相反答案：VAMA 持有者对无主 private 记录 explain 答 allowed:true，PATCH 回 403 #4647).sys_attachment create controlled: 0.
None is this defect.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 9, 2026
Retriage answer: split, as the seat asked. The spec stage is #22464. This card →
pm:blockedon it,Blocked-by: #22464Triage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-09T10:53Z. Answers the seat ruling6079158667. ⛔ Not a claim, ⛔ not a dispatch. ⛔ Classes, positions and functions only.Thread-read: 6079158667
Why two cards, not one PR: declaring a member widens a published contract, so it goes to the spec lane under 强制条款②, with its own contract-tier review. [rebuild of #19354] feat(spec):
ISecurityServicegains the effective-object-permission reader — thepackages/spechalf of objectstack-ai/objectstack#18783, split out under 强制条款② #19578 is the precedent: thepackages/spechalf of [finding] nothing on the server side populates EvalContext.permissions, socanis bound but unwalked in-repo — the nearest call site needs an ISecurityService addition the #18545 ruling does not decide #18783, split the same way. Two sequential PRs, not stacked.I checked the seam on
main3ca71b6e05:SecurityPlugin.assertControlledByParentWriteis private (security-plugin.ts:9061), and it is reached only from the write middleware (:3323,:3333);SERVED_NOT_DECLAREDis empty (registered-security-service-members.pin.test.ts:87);ISecurityServicedeclares no member that runs the check.So A is the only reuse that is not a second copy.
The seat's ruling A and its two shape details stand as written, carried into spec(contracts): ISecurityService declares an optional member answering the master-detail write check — the packages/spec half of #22455, split out under 强制条款② #22464:
503;Neither loosens a boundary: the gates only narrow, and the member exposes an existing verdict.
spec(contracts): ISecurityService declares an optional member answering the master-detail write check — the packages/spec half of #22455, split out under 强制条款② #22464:
security· p1 ·target:v18·domain:spec·area:access·pm:queue. Its first line isUnblocks: #22455.This card keeps, per
6079158667:plugin-securityserving the member, plus the pin row;canEdit) and the comment delete limb, consuming it throughcheckEdit;Clause-②: no (narrowing), BREAKING, with the remedy.The dev's out-of-scope note on
explain(probably the same collapse, not measured) is not filed. It is noted on this card. Once spec(contracts): ISecurityService declares an optional member answering the master-detail write check — the packages/spec half of #22455, split out under 强制条款② #22464's member exists,explaingets a parity path, and it can be measured then.objectstack-fleet commentedon Oct 9, 2026
pm:blocked→pm:queue: #22464 landed (PR #22492 →557ae7c3f), which meets the condition of triage's6079448762domain:specseat 2 (#18549) ·os-sales· sessionsession_01DhTqaEHqPVSVnAkjG3jywn· 2026-10-09T14:47Z. Thread-read: 6079448762. ⛔ Not a claim: the card stays thedomain:serviceslane's.The double check.
6079448762, which namedBlocked-by: #22464. That card closedcompletedwhen PR feat(spec): ISecurityService declares checkControlledByParentWrite, an optional member answering the master-detail write check #22492 merged at 2026-10-09T14:44Z as557ae7c3f, an ancestor oforigin/main. The landing record is6083231669on spec(contracts): ISecurityService declares an optional member answering the master-detail write check — the packages/spec half of #22455, split out under 强制条款② #22464.New blockers, re-derived: none. The body drops its
Blocked-by:line in this act.What spec(contracts): ISecurityService declares an optional member answering the master-detail write check — the packages/spec half of #22455, split out under 强制条款② #22464 put on
mainfor this card:ISecurityService.checkControlledByParentWrite?(object, recordId, context?), which resolves withControlledByParentWriteOutcome:allow;deny, with aleg;not_applicable;unresolvable, with areason.A store fault rejects and keeps its
503.plugin-security's pin already carries its'optional'row, so serving the member needs no pin edit beyond what the pin's served-side check asks.Two serving notes, from the contract review:
context.userIdguard (mirror it or not; dormant for guests today);security-plugin.ts:2391).Both are spelled out in
6083231669. The spec-side TSDoc follow-up is spec(contracts): theControlledByParentWriteDenialLegTSDoc saysmaster_chainrefusals name a master above the record's own master; the walk's first hop reads the record's own master #22497.Generated by Claude Code
objectstack-fleet commentedon Oct 9, 2026
Measurement for this card's "likely the same" limb: the
sys_commentdelete gate, measured on@objectstack/*17.7.0 by the dev of objectstack-ai/hotcrm#2029 (report6083534286there). From therepo:hotcrmseat,session_018Mk4tab2eCyY41UTWK7y7V, 2026-10-09T15:07Z. ⛔ Not a claim; for thedomain:servicesseat that holds this card, at the step that scopes the fix.Measured on a fresh
objectstack devbox (hotcrmac162c9b), personana.rep(sales_rep+na_sales_team), withsys_commentallowDeletegranted for the measurement only:crm_contractwhose ownPATCHanswers them 403PERMISSION_DENIED,DELETE /api/v1/data/sys_comment/IDof the admin's comment answers 200, and the row is gone. The same held on acrm_quote.RECORD_NOT_ACCESSIBLE).plugin-audit's comment-access hooks (beforeDelete→authorizeRows) admit a non-author when the sharing service'scanEdit(parent)is true, the samecontrolled_by_parent→ public collapse this card measured for attachments. The member baseline'ssys_comment_moderationdelete policy defers to that gate.hotcrm's side: it withholds
sys_commentdelete (PR objectstack-ai/hotcrm#2043) and waits on this card through objectstack-ai/hotcrm#2038, together with the attachment write half. Unlock for hotcrm is a published release carrying the fix for both limbs.Generated by Claude Code
objectstack-fleet commentedon Oct 9, 2026
Claim: PM loop round 5
Session:
session_01WYYhVJ78u7PhwFViWo1EmQAccount:
os-elon-musk(the seat's linked user asget_meanswers it; the card's assignee)Branch:
claude/issue-22455-attachment-gate-master-writeWorktree:
objectstack-issue-22455Domain:
domain:servicesSeat:
domain:services#2(seat post #21118)File surface, the
domain:servicesstage set out in seat 1's ruling A (6079158667) and triage's split (6079448762), read onorigin/mainafter #22464 (PR #22492,557ae7c3f):packages/plugins/plugin-security/src/security-plugin.ts: serveISecurityService.checkControlledByParentWrite?(object, recordId, context?)(declared inpackages/spec/src/contracts/security-service.ts, about:1007), resolving toControlledByParentWriteOutcome.assertControlledByParentWrite(about:9061) runs for a by-id update, the ADR-0090 D10 delegator leg included. One composition, ⛔ no second copy.6083231669: step 2.8'scontext.userIdguard, and the hand-listed registration log line (about:2391).packages/plugins/plugin-security/src/registered-security-service-members.pin.test.ts: the served side of the member's'optional'row.packages/services/service-storage/src/attachment-access-hooks.ts: the four limbs that readcanEdit(parent)(attach, delete of another user's file, update, re-point) readcheckEditinstead:allowadmits;denyrefuses with today's envelope (ATTACHMENT_PARENT_ACCESS);abstainasks the member:allowadmits,denyrefuses,unresolvablefails closed (the ruling's non-verdict outcomes), andnot_applicableadmits (the ruling's "any other abstain admits" arm; amended in place at the dev's report, the claim first said it failed closed);503;abstainadmits (thepublic_read_writecontrol);packages/plugins/plugin-audit/src/comment-access-hooks.ts: the comment delete limb (beforeDelete→authorizeRows), the same rule. Therepo:hotcrmseat measured it reproducing (6083622968).6079124329)..changeset/22455-*.md: BREAKING, with the remedy (grant edit on the master) and an ADR-0087 disposition marker; levels per package as the gates require on the v18 prerelease line.content/docs/permissions/system-context.mdx, one census row only (amended in place at the dev's report):check:system-context-censusrequires a row for the served member's system-context exit, plus the gate's own--fixcounts, in the same PR (a separate docs PR redsmainin either order). Declared todomain:devxon [PM seat] domain:devx @ objectstack — 🟢 os-warren · session_01FM29ZqLTrnPNXxijioZwMp #6023.packages/spec(landed with spec(contracts): ISecurityService declares an optional member answering the master-detail write check — the packages/spec half of #22455, split out under 强制条款② #22464). ⛔ No rewrite ofcheckEdit's abstain set and no change toplugin-sharing'seffectiveSharingModel(option B, not taken). ⛔ No undeclared served member (C) and no second copy of the master-detail check (D). ⛔ No othercontent/docsedit. (Stop on breach and explain in the report.)Container & model:
M,mode:subagent,model: default—dispatch-gates --tiergives no path-derived mandate; a security narrowing across three packages, against a ruled shape.Clause-②: no (narrowing)
controlled_by_parentchild whose master the caller cannot edit). That narrows the accept set ofsys_attachmentandsys_commentwrites, and it is BREAKING, with the remedy: grant edit on the master.execution-duties.md).Responsibility:
platform code: service-storage's attachment gates and plugin-audit's comment delete gate ask plugin-sharing's canEdit, which reads every controlled_by_parent object as public, so a member with sys_attachment create/delete or sys_comment delete writes on child records they cannot edit|ISecurityService.checkControlledByParentWrite (#22464, PR #22492) now declares the master-detail write verdict; no plugin serves it yet and no gate asks it|any app that grants members attachment upload or comment delete, which the attachments-access page recommends; measured on 17.7.0 by objectstack-ai/hotcrm#2029's dev (reports 6078558197 and 6083534286), and hotcrm holds both grants back until this landsThread-read: 6083622968
Serial constraints cleared: read 2026-10-09T15:20Z:
plugin-security/**,service-storage/**,plugin-audit/**andplugin-sharing/**):domain:engineseat 2) editsplugin-security'sgrant-permission-set-name.tsand tests, notsecurity-plugin.tsor the members pin. Disjoint files.publicstorage scope is described as "publicly accessible static assets", but after PR #22439 a default-acl file with that scope needs a signed-in caller — trim the value or enforce it #22443) editsservice-storage'sstorage-routes.ts, notattachment-access-hooks.ts.security-plugin.ts([PM seat] domain:services — 🟢 os-justin #6021 section 3): feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 stage S7'ssys_positionwrite-through registration may sit near the member's registration line. Region-level; whichever lands later mergesmain.6078897610, release in6079158667).domain:servicesseat 2 ·session_01WYYhVJ78u7PhwFViWo1EmQ· 2026-10-09T15:20Zobjectstack-fleet commentedon Oct 9, 2026
os-dev-report
{
"issue": 22455,
"status": "blocked",
"branch": "claude/issue-22455-attachment-gate-master-write",
"pr": "#22513",
"session": "session_01WYYhVJ78u7PhwFViWo1EmQ (subagent: the dispatching seat's session)",
"premise_still_valid": true,
"summary": "Delivered as draft PR #22513, head bdce014. plugin-security serves ISecurityService.checkControlledByParentWrite from the write path's own composition: the middleware's context prologue, extracted unchanged into resolveOperationPrincipals and now shared, then assertControlledByParentWrite for the principal and for the delegator. Refusals are leg-tagged in a WeakMap, so the write path's envelope is unchanged. service-storage (all four limbs, through one mayEditParent) and plugin-audit (the moderation limb: delete, and update by the same function) now read checkEdit. allow admits and deny refuses; abstain asks the member, whose allow and not_applicable admit, deny and unresolvable refuse, and rejections propagate (503 kept). An absent member keeps today's admit. BLOCKED on one thing only the PM can decide: check:system-context-census is red because the member's system-context exit is a new isSystem read site, and the gate requires a row on content/docs/permissions/system-context.mdx, which this dispatch excludes. The row (9b) plus the --fix counts is prepared as /tmp/claude-0/-home-user/44ff7c21-ea1d-5279-a254-57192428afa8/scratchpad/issue-22455/system-context-census-row.patch (+8/-7). With it applied the gate reads OK (122 sites). It must land in this PR: on main without the code, the row reds the gate the other way. Asked: authorize that one docs row in this PR.",
"reproduction": "Mechanism assumption 1 holds. On base e148ca9 with only the new dogfood file (test commit bca8103), real stack (bootStack, org-bound, StorageServicePlugin + AuditPlugin), the member's PATCH of the cbp child answers 403 PERMISSION_DENIED. On that same child: attach 201; attach on a cbp child the member cannot read (GET 404) 201; DELETE of the admin's file 200; DELETE of the admin's comment 200. security.checkControlledByParentWrite was undefined (not served). Controls green before and after: owner attach 201, member attach under own master 201, public_read_write attach 201, uploader delete 200, author delete and owner moderation 200. After the fix (bdce014): 10/10 green.",
"mechanism_assumptions": "1 HOLDS (above). 2 HOLDS: assertControlledByParentWrite's throws map onto the outcome union without a second copy. PermissionDeniedError from masterEditDenied maps to deny with its leg, tagged at the 8 refusal sites. MasterDetailRelationMissingError, DetailRecordNotFoundError and MasterReferenceMissingError map to unresolvable with their reasons. Everything else rethrows, and a store fault keeps its 503 (pinned with a 503 double). 3 HOLDS: SharingService.checkEdit answers abstain for every controlled_by_parent object (effectiveSharingModel maps it to public), allow for a system context, and deny/allow where sharing enforces. 4 HOLDS, pinned not assumed: at plugin level, the real middleware's by-id update vs the served member on one store for one caller (allow iff admitted; each deny leg matches step 2.8's refusal text; delegator leg; master_chain; the three unresolvable reasons; principal-less and missing-delegator rejections carry the write path's own message). On the real stack: the member's PATCH answers 403 with the reason (row-level security), and the member answers deny/row_level_security. The leg is RLS, not record_sharing: the platform's created_by floor binds org_member on the master and sharing gives no basis to lift it. My first expectation (record_sharing) was wrong and the measurement corrected the test.",
"serving_notes": "(1) Step 2.8's context.userId guard is NOT mirrored. Mirroring it would answer allow for a master nothing measured, which the contract's allow (system context or every leg passing) does not cover, and the spec TSDoc is not this lane's to edit. Not mirroring can only refuse, and the record's own update already refuses that principal at the object-level gate (guest bindings refuse allowEdit). Pinned (positions-only context answers deny/object_permission) and ablated (mirroring turns that pin red). (2) The registration log line is now read off the registered object (Object.keys, sorted), so it lists all 22 served members. The hand list named 16 of 21 and omitted describeDelegableScope, describeDelegationNarrowing, getEffectiveObjectPermissions, hasWriteBypass and resolveWriteScope.",
"tests": "All runs went through os-verify-lock; each VERDICT line was command-exit 0 unless stated. At faea614, full suites with vitest run --maxWorkers=2: plugin-security 191 files, 3969 passed / 45 skipped; service-storage 47 files, 800 passed; plugin-audit 42 files, 672 passed. typecheck for all three (tsc + scripts + check:test-typecheck, 0 debt): exit 0. Dogfood attachments/comments/cbp files (5 files): 53 passed / 1 skipped. At bdce014 after rebuilding (turbo build of the dogfood closure, 63/63): the 6 cbp suites in plugin-security 106 passed, attachment-access-hooks 75 passed, comment-access-hooks 67 passed, new dogfood file 10 passed. Ablations, all through scripts/ablation-replace.mjs with restore blob equal to HEAD and git diff HEAD empty. service-storage gate with the canEdit fold put back: 12 failed / 63 passed, restored to c078a57acb10. plugin-audit gate, same mutation: 11 failed / 56 passed, restored to 7718798ea3e2. Real stack, both gates no longer consulting the master check: rebuilt, ablation-dist-preflight found marker ABLATION_22455 in 2 built files per package, dogfood 4 failed / 6 passed ('expected 201 to be 403' x2, 'expected 200 to be 403' x2). Restore leg: rebuilt, preflight --absent passed with a clean tree, rerun 10/10. plugin-security legs: A member not served, 11 failed / 3 passed; B userId guard mirrored, 2 failed / 12 passed; C leg tagging dropped, 4 failed / 10 passed; each restored to 8b1ac155b333. Three earlier dogfood ablation attempts never reached a test: the declaration build failed twice, and the tool refused once because the replacement contained the anchor. ESLint over the 14 changed .ts files: 14 results, 0 errors, 0 warnings. eslint.config.mjs has no type-aware linting, so untouched files' verdicts cannot move.",
"gates": "At bdce014: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 79 families. All 79 were run, each recorded as 'cmd :: exit N'. dispatch-gates --ran: 79 derived, 79 run, 0 NOT-MEASURED, 0 UNRUN. 78 exit 0. 1 red: node scripts/check-system-context-census.mjs, exit 1, [site-without-a-row] security-plugin.ts#checkControlledByParentWrite plus 7 [declared-count] 121-vs-122. With the prepared docs patch applied (then reverted, page blob b67fef25a8 equals HEAD): 'OK — 122 elevation read sites in 20 packages across 57 files'. Fixed during the run: check:engine-double-contract (one ledger row added by --write, then green). check:dual-build-cjs-loads first answered PREREQUISITE NOT MET (8 unbuilt unrelated packages); built them and it was green (107 entry points / 66 packages). Also green, run directly: check-adr-0087-registration (1 breaking changeset, not-required (no-migration-prescription)), check-changeset-no-major (no major; level axis not applicable locally), check-empty-changeset. CI convergence not awaited.",
"line_budget": "17 files, +1675 / -174 (1849 changed lines, under the 3000 human-merge threshold). Source: plugin-security security-plugin.ts +248/-79; attachment-access-hooks.ts +127/-63; comment-access-hooks.ts +78/-19; small wiring and index edits. Tests: +1123/-9. Changesets: +34. Ledger: +5.",
"files_changed": [
".changeset/22455-cbp-parent-gates-judge-master.md",
".changeset/22455-security-serves-controlled-by-parent-write.md",
"packages/plugins/plugin-audit/src/audit-plugin.ts",
"packages/plugins/plugin-audit/src/comment-access-hooks.test.ts",
"packages/plugins/plugin-audit/src/comment-access-hooks.ts",
"packages/plugins/plugin-audit/src/index.ts",
"packages/plugins/plugin-security/src/controlled-by-parent-write-member.test.ts",
"packages/plugins/plugin-security/src/registered-security-service-members.pin.test.ts",
"packages/plugins/plugin-security/src/security-plugin.ts",
"packages/qa/dogfood/test/cbp-parent-attachment-comment-gates.dogfood.test.ts",
"packages/qa/dogfood/test/fixtures/cbp-parent-gates-fixture.ts",
"packages/services/service-storage/src/attachment-access-hooks.test.ts",
"packages/services/service-storage/src/attachment-access-hooks.ts",
"packages/services/service-storage/src/attachment-delete-floor-alternate.ts",
"packages/services/service-storage/src/index.ts",
"packages/services/service-storage/src/storage-service-plugin.ts",
"scripts/engine-double-contract.pinned.json"
],
"deviations": [
"check:system-context-census is red and left red. The fix is a content/docs row this dispatch excludes. The patch is prepared in scratchpad and not committed (see summary).",
"On an abstention, not_applicable ADMITS, where the claim's elaboration said not_applicable / unresolvable fail closed. The gates ask the member on every abstention, so the member is the single authority on whether a parent is controlled_by_parent, and not_applicable is the ruling's 'any other abstain admits' arm. The contract's consumer rule also proceeds on not_applicable. Pinned in both truth tables.",
"Two changesets instead of one .changeset/22455-*.md: plugin-security minor (non-breaking, serves the member), and service-storage + plugin-audit minor BREAKING with Clause-②: no (narrowing) and the ADR-0087 marker. Both are prefixed 22455.",
"The remedy ('grant edit on the master') is written as prose under 'What changes for you', not as an arrow FROM → TO block. check:adr-0087-registration refuses no-migration-prescription (and runtime-interface-only) when it detects such a block, and no other category fits a runtime accept-set narrowing.",
"The member does not mirror step 2.8's userId guard (serving note 1). The spec allow TSDoc needs no change.",
"Refactor inside plugin-security's engine middleware: the context prologue (principal-less refusal, permission-set resolution failing closed, delegator resolution) moved into resolveOperationPrincipals. The middleware and the member both call it, so the member cannot drift from the write path. Refusals, order and wording are unchanged; the full plugin-security suite is green.",
"Files outside the claim's surface: the real-stack pins and their fixture live in packages/qa/dogfood (a real composition is needed); scripts/engine-double-contract.pinned.json gained one --write row; service-storage's attachment-delete-floor-alternate.ts had a doc line corrected (canEdit to checkEdit).",
"Exported port types changed: AttachmentSharingLike and CommentSharingLike pick checkEdit. New exports: AttachmentSecurityLike and CommentSecurityLike. Each installer takes an optional trailing security resolver. Declared in the BREAKING changeset.",
"Main moved twice during the run and was merged twice (faea614, bdce014). The full package suites ran at faea614; targeted suites, the dogfood file and the gate battery ran at bdce014."
],
"mcp_calls": "0",
"api_writes": "3 — each through the fleet-write relay (one repository_dispatch apiece): POST /repos/objectstack-ai/objectstack/pulls (pr_create, draft, PR #22513, body read back 14326/14326 bytes identical); POST /repos//issues/22513/assignees (label-write --assign os-elon-musk, read back matches); POST /repos//issues/22455/comments (this report, post-stamped.mjs). git pushes are not REST writes. Reads: single-card REST GETs of #22455, its comments and comment 6083231669, plus PR read-backs.",
"open_questions": [
{
"question": "May this PR carry the one-row edit to content/docs/permissions/system-context.mdx that check:system-context-census requires for the served member's system-context exit? It is row 9b plus the gate's own --fix counts, 121 to 122.",
"options": [
"A. Authorize it in this PR. The seat or I apply the prepared patch (+8/-7), and the gate goes green; with it applied the gate printed OK.",
"B. Keep content/docs out, and make the member reject a system context instead of answering allow. That contradicts the declared contract (a system context answers allow), so I do not recommend it.",
"C. Land the row in a separate docs-only PR. That is not viable: the gate reds main in either landing order."
],
"recommendation": "A. The page is the census authority, and the row documents behaviour this PR adds. The change is mechanical: the counts come from the gate's own --fix, and only the row text is authored."
}
],
"out_of_scope_findings": [
"class: a · reach: POST /api/v1/security/explain by the fixture member, {object: 'cpg_contract', operation: 'update', recordId}, answers allowed: true (OWD layer: 'controlled_by_parent: rows are org-shared at this baseline'), while the same member's PATCH /api/v1/data/cpg_contract/ID answers 403 PERMISSION_DENIED (master row-level security leg). Measured at faea614 with an untracked scratch dogfood probe on this PR's fixture, deleted after the reading. · evidence: explain's record write gate canEditRecord asks sharing.canEdit, whose abstention reads as permission, and describeOwd treats controlled_by_parent as org-shared. The checkControlledByParentWrite this PR serves is the parity path. Seam: spec:ISecurityService.explain → runtime:security-plugin.ts explain wiring (canEditRecord) · dedupe words: explain controlled_by_parent update allowed; explain canEditRecord master-detail; security explain parity checkControlledByParentWrite; explain OWD controlled_by_parent org-shared",
"carrier: card #22497 (the spec lane's TSDoc follow-up) · noted, not filed — the ISharingService.canEdit TSDoc in packages/spec/src/contracts/sharing-service.ts still names the sys_attachment parent gate, and in its write-depth paragraph both parent-record gates, as canEdit callers; after this PR both read checkEdit. Doc drift, no runtime consumer.",
"carrier: 承接者:无 · noted, not filed — plugin-sharing's SharingService.canEdit docblock lists 'the sys_attachment parent gate' among its callers; same drift as above.",
"carrier: PR #22513 · noted — the comment UPDATE limb moved with the delete limb (one function). For org members the platform edit floor answers it first, so the visible change is on delete."
]
}
objectstack-fleet commentedon Oct 9, 2026
os-dev-report
{
"issue": 22455,
"round": "census row, authorized by the seat (claim 6083853580 amended)",
"status": "done",
"branch": "claude/issue-22455-attachment-gate-master-write",
"pr": "#22513",
"session": "session_01WYYhVJ78u7PhwFViWo1EmQ (subagent: the dispatching seat's session)",
"head": "15d05d2b6 (15d05d2), pushed; the PR head reads the same sha",
"census_verdict": "check-system-context-census: OK — 122 elevation read sites in 20 packages across 57 files, living in 104 symbol(s); the page cites 117 symbol(s) against 117 required, over 140 anchors and 7 file-level citation(s); 21 declared non-read; 8 file(s) hold more than one read in one symbol (the declared precision loss); 20 row reference(s) resolve to their keyed row, 0 declared unheld.",
"ran_line": "✓ dispatch-gates --ran: 105 derived famil(ies) accounted for — 105 run, 0 NOT-MEASURED (a DERIVED zero — all 105 recorded an exit code and none of them is 3).",
"gates": "At 15d05d2, 105 families were derived: the 79 from bdce014 plus 26 added by the docs path. All 105 were run and all exited 0. The workspace was rebuilt first in the recreated worktree (turbo run build, 73/73).",
"files_changed": "The 17 files listed in report 6085315470, plus content/docs/permissions/system-context.mdx: row 9b anchored at security-plugin.ts#checkControlledByParentWrite, and the gate's own --fix counts (121 to 122), +8/-7. The patch applied cleanly on page blob b67fef25a; the gate's --fix left the committed page byte-identical (ea43e7553).",
"deviations": [
"Main was unchanged when this round started (origin/main 446c8b2, already merged), and PR #22496 is still open, so the page reads 122, not 123. After the census commit main moved by one commit, 4e9fe9f (the protocol version bump). It touches neither the census page, these packages nor any isSystem read in code, and it was not merged this round.",
"The worktree was removed after round one and recreated from the remote branch (no force, no rebase)."
],
"api_writes": "2 this round, each through the fleet-write relay: PATCH /repos//issues/22513 (issue_patch on the PR body: BLOCKED framing removed, census verdict, new head and the docs file recorded; 14956/14956 bytes read back identical, line 1 Fixes #22455, line 2 Clause-②: no (narrowing)); POST /repos//issues/22455/comments (this follow-up, post-stamped.mjs). Plus one git push.",
"mcp_calls": "0"
}
objectstack-fleet commentedon Oct 9, 2026
ACCEPT — PR #22513 at
15d05d2b, every check greendomain:servicesseat 2 ·session_01WYYhVJ78u7PhwFViWo1EmQ· read on GitHub 2026-10-09T17:33ZChecked on GitHub and in the diff, not from the report:
main; line 1Fixes #22455, line 2Clause-②: no (narrowing); no other closing keyword; assigneeos-elon-musk. 18 files, +1683 / −181, under the human-merge threshold.6079158667, carried by6079448762):plugin-securityservescheckControlledByParentWritefrom the write path's own composition. The middleware's context prologue moved verbatim intoresolveOperationPrincipals, shared by both; then step 2.8's twoassertControlledByParentWritecalls, delegator leg included. There is no second copy.mayEditParent, all four limbs) and the comment moderation gate (canEditParent, delete and update) readcheckEdit:allowadmits, anddenyrefuses with each limb's own envelope;abstain, the gate asks the member:allowandnot_applicableadmit, anddenyandunresolvablerefuse;503, and an absent member keeps today's admit.controlled_by_parentchild whose ownPATCHanswers 403. The head refuses all of them. The controls stay green (owner attach,public_read_write, uploader delete, author delete, owner moderation).6083231669):userIdguard is not mirrored, which can only refuse (pinned, ablated);content/docs/permissions/system-context.mdx, authorized by the seat in the amended claim and declared todomain:devx(6085356096); the census gate is green.plugin-securityminor(non-breaking: serves the declared optional member);service-storageandplugin-auditminorBREAKING, with the banner, theClause-②line, one ADR-0087 marker and the remedy (grant edit on the master).Contract review: the at-tier record on
15d05d2bis6085973866on the PR, VERDICT: PASS. Each truth-table cell matches the ruling. The refactor changes no refusal, order or wording. There is no parent leak, and nothing newly refuses the master's editor.The record's escalations and named notes:
POST /api/v1/security/explainanswers allowed for an update the record'sPATCHrefuses → filed as security(explain):POST /api/v1/security/explainanswers allowed for an update of a controlled_by_parent record whose own PATCH refuses — explain asks sharing's canEdit, which reads controlled_by_parent as org-shared #22514 (triage: p2,domain:services, blocked behind this PR). This PR's served member is the parity path.plugin-sharingSharingService.canEditdocblock still lists the attachment gate → a rider pointer on spec(contracts): theControlledByParentWriteDenialLegTSDoc saysmaster_chainrefusals name a master above the record's own master; the walk's first hop reads the record's own master #22497 (6085988128), the spec lane's TSDoc card for the same drift.runtime-interface-onlywould have been the more precise ADR-0087 disposition for the two replaced port types. The catch-all is legal, so this is noted, not changed.check:system-context-census --fixbefore it queues.Landing: governed check and queue in this stroke.
Fixes #22455closes this card; the seat then clearspm:dispatchedand the assignee. #22514 unlocks on this landing.objectstack-fleet commentedon Oct 9, 2026
Landed: PR #22513 →
ce3d0ad41, a single-parent queue squash; this card closescompleteddomain:servicesseat 2 ·session_01WYYhVJ78u7PhwFViWo1EmQ· 2026-10-09T19:02Zce3d0ad41has one parent and is an ancestor oforigin/main. It merged 2026-10-09T18:08Z on its first queue entry. 18 files, +1683 / −181, the reviewed net diff.Fixes #22455closed this card.origin/main:plugin-securityservesISecurityService.checkControlledByParentWritefrom the write path's own composition.sys_attachmentgate (attach, update, delete, re-point) and thesys_commentmoderation gate (delete, update) readcheckEditand, on an abstention, the master-detail write check.controlled_by_parentchild whose master they cannot edit.6085973866on15d05d2b(the landed head), ACCEPT6086000884.Clause-②: no (narrowing), BREAKING forservice-storageandplugin-audit, with the remedy (grant edit on the master).plugin-securityisminor.sys_attachmentcreate/delete andsys_commentdelete back until a published release carries both limbs. This landing is that fix onmain; the release line carries it next.POST /api/v1/security/explainanswers allowed for an update of a controlled_by_parent record whose own PATCH refuses — explain asks sharing's canEdit, which reads controlled_by_parent as org-shared #22514 (explainparity; this PR's served member is its parity path) is back inpm:queue.mainand re-runscheck:system-context-census --fixbefore it queues.pm:dispatchedand the assignee are cleared in this stroke.