Repository navigation
finding(security): every write to a controlled_by_parent detail TWO levels below its root master answers 403 "master … not editable" for a principal who edits that master — a regression against 17.7.0, measured on hotcrm's crm_quote_line_item #23093
Description
Ruled: 6134050293 · letter A · 2026-10-12T22:48Z
Filing gate ①, class (a): a reproducible defect, measured at a public door. It is a regression against the released engine.
reach: HTTP on this tree, and a named producer. The producer is hotcrm's crm_quote_line_item → crm_quote → crm_account. hotcrm's pinned 17.7.0 engine admits all 15 writes that this tree refuses.
Filed by domain:cli seat 2 (#22648) · os-steve · session session_01VoSxBQujKLZKPwK2u5ehQ6. It comes from #15953 slice 4's dev (os-dev-report 6131548194, out-of-scope finding 1). That slice's new family, @objectstack/verify's parent-derived write reach (PR #23091), found it. ⛔ Not a claim. Lane and grade are triage's.
Reader who acts: triage grades it. The named seam is packages/plugins/plugin-security/src/security-plugin.ts#assertMasterRowEditable, which reads as domain:services. This seat does not land there.
Dedupe: semantic issue search scoped to this repository, all states.
controlled_by_parent chain two-level master detail write refused assertMasterRowEditable PERMISSION_DENIED master not editable row-level security: 17 hits, all closed. None is a two-level write refusal. The nearest are console: a permitted editor gets no Edit / Delete on controlled_by_parent records — the record header hides them although security/explain answers allowed and the PATCH returns 200 (HotCRM sales manager on contracts and quotes, 17.7.0) #22721 (the console hiding Edit oncontrolled_by_parentrecords, 17.7.0, single-level), security(explain):explaindelete on a controlled_by_parent record reports the ownership floor, not the master check the data door runs — the master's editor is refused beside a DELETE 200 #22530, security(explain):POST /api/v1/security/explainanswers allowed for an update of a controlled_by_parent record whose own PATCH refuses — explain asks sharing's canEdit, which reads controlled_by_parent as org-shared #22514 and security(explain): explain'sreadverdict for a row the caller cannot read disagrees with the read door, and differs from its answer for an id no row carries (a controlled_by_parent detail under an unreadable master, measured) #22792 (explaindisagreeing with the door), andassertControlledByParentWriteanswers a metadata defect and a missing row with the same403 PERMISSION_DENIED"requires edit access to its master record" #7474 (the envelope's wording).nested master-detail grandchild write 403 regression quote line item: 4 hits, all closed, none this subject.- CONTROL: the first query reaches the
controlled_by_parentfamily (console: a permitted editor gets no Edit / Delete on controlled_by_parent records — the record header hides them although security/explain answers allowed and the PATCH returns 200 (HotCRM sales manager on contracts and quotes, 17.7.0) #22721, security(explain):explaindelete on a controlled_by_parent record reports the ownership floor, not the master check the data door runs — the master's editor is refused beside a DELETE 200 #22530, spec(contracts): theControlledByParentWriteDenialLegTSDoc saysmaster_chainrefusals name a master above the record's own master; the walk's first hop reads the record's own master #22497), so the search covers this seam.
Measured at the door (this tree, 275ad4229a and 8b4a5802f0)
The fixture app is account (private) ← quote (controlled_by_parent) ← quote_line (controlled_by_parent). One signed-in principal holds:
account {read, edit, modifyAllRecords};quote {read, create, edit};quote_line {read, create, edit, delete}.
The answers:
PATCH /api/v1/data/pwr_quote/IDwith an empty body answers200.PATCH /api/v1/data/pwr_quote_line/IDanswers403 PERMISSION_DENIED:[Security] Access denied: update on 'pwr_quote_line' requires edit access to its master record (master 'pwr_quote' not editable by this user (row-level security)).- Delete and insert answer the same.
- The same holds for a principal who owns the whole chain, and with
modifyAllRecordson both masters.
Against the published engine (hotcrm, read-only clone at 1d7148bf)
- Run A, hotcrm's own pinned
@objectstack/verify17.7.0 over its own artifact: all 15 writes tocrm_quote_line_itembysales_managerandsales_repare admitted, consistently with their admittedcrm_quoteedits. - Runs B and C, this tree's engine over the same artifact: all of them are refused. That is 31 contradicted writes across the personas.
- On this tree, single-level details (
crm_contract,crm_quote,crm_opportunity_line_item,crm_contact) agree with ADR-0055 §3.
The contract
ADR-0055 §3: "editing/deleting/creating a detail requires edit access to its master". The 2026-09-07 amendment: the write gate "walks the chain hop by hop … until it reaches a master that governs its own rows", and "a detail whose whole chain is reachable stays readable and writable".
Here the middle master (quote) is itself controlled_by_parent, and the caller edits it (200). The hop still answers "not editable (row-level security)".
Where it seems to break (a lead, not a diagnosis)
The dev read assertMasterRowEditable: the hop's computeRlsFilter(master, 'update') plus ql.findOne under the caller's context answers no row for a controlled_by_parent middle master. It also notes that the @objectstack/plugin-security 17.3.0 chain walk (#11082, PR #11183) is what the amendment describes. When this regressed is NOT MEASURED.
Points for the dev
- Bisect first. Measure on the released 17.7.0 engine against this tree, using the fixture shape above. PR feat(verify): the parent-derived write reach family, runnable as os verify --parent-write-reach (#15953 slice 4) #23091's pinned test
finds today's engine refusing a two-level detail whose master the persona edits(packages/verify/src/parent-write-reach.test.ts) is a ready reproduction. - Fix the hop, so that a
controlled_by_parentmaster's editability is its own write gate's answer, which composes the chain. ⛔ Do not open the gate. The cycle guard and the depth bound keep denying. - Pins:
- a two-level detail is writable exactly when its middle master is editable by the caller;
- CONTROL: a single-level detail is unchanged;
- CONTROL: a caller who cannot edit the middle master is still refused.
- When this lands, PR feat(verify): the parent-derived write reach family, runnable as os verify --parent-write-reach (#15953 slice 4) #23091's pinned expectation flips from
contradictedtoproven. That PR's README andcli.mdxsay so.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 12, 2026
Seat verdict: premise falsified → decision box ·
needs-user-decision+pm:retriagedomain:servicesseat 2 ·session_01FzQy26KznSa5j2gnf3AzsE· 2026-10-12T21:54Z, under claim6132814355. The dev's report is6133252394(needs_decision,premise_still_valid: false, no PR, branch pushed empty).Release:
session_01FzQy26KznSa5j2gnf3AzsE· premise falsified (no 17.7.0 regression), and the remaining question widens a permission boundary · to the maintainer's decision box (needs-user-decision) and to triage for a re-grade (pm:retriage). The assignee is cleared in the same act; the next holder claims afresh.To triage (
pm:retriage): the p1 /target:v18grade rests on "a regression against 17.7.0". Measured by the dev and checked by this seat on source, the released 17.7.0 engine refuses the same writes for an organization member. Only the 17.7.0@objectstack/verifyharness ran organization-less personas. Please re-grade priority and the release board from that reading. The decision below is independent of the grade.决策分析(四维)
一句话问题: 一个组织成员能编辑某张报价单(直接改报价单返回 200),却改不了这张报价单下的任何明细行(全部 403),除非报价单是他本人创建的。要不要让"能编辑上层记录"在两层主从链上也意味着"能编辑下面的明细"?
背景
crm_quote_line_item → crm_quote → crm_account是两层controlled_by_parent链。卡上记录了 31 次被拒的写入。4e4e88142)和main(6662e3f59)上用同一夹具、同一 persona 测了 2×2 矩阵,两边答案相同:org_member的成员,写别人创建的报价单下的明细 → 403;org_member内的 persona → 两边都放行。autoDefaultOrganization钉成了 false,persona 没有组织。34dba5ae1(feat(plugin-auth,objectql,metadata-protocol,runtime)!: undersinglethe Default Organization exists before the seeds and the listener; an unowned seed row or system write is derived there or refused (ADR-0131 C1) #22186)去掉了这个钉子。引擎没有回归,是测量仪器变了。main的assertControlledByParentWrite/assertMasterRowEditable区段,除拒绝原因的leg标签外逻辑相同(另有 5 行注释差异);harness.ts第 571 行确为autoDefaultOrganization: !!opts.orgContext。机制(括号内为技术补充): 在中间层主记录(本身也是
controlled_by_parent的报价单)这一跳,写入检查仍套用平台的"只有创建者能改"底线(owner_only_writes,作用于org_member)。但直接改这张报价单时,这条底线已被 2026-08-15 的维护者裁决撤掉(6feac910b#8869:主记录闸是controlled_by_parent明细的唯一行写权威;498f4e884#8920:leg 1 在共享放行时撤掉平台所有权底线)。同一个人、同一行、同一个"编辑"动作,得到两个答案。Governing text
assertMasterRowEditable— on every hop until it reaches a master that governs its own rows";以及 "a detail whose whole chain is reachable stays readable and writable"。security-plugin.tsassertMasterRowEditable的 docblock(17.7.0 与main相同)写明当时的取舍:"masterGateCoversThisWriteis deliberately NOT set … A master that is itself a detail keeps its floor exactly as it does today"。协议声明 / 是否改协议: 不改
packages/spec。选项 A 只改运行时一行加 docblock;选项 B 要给 ADR-0055 加一行(Tier H,受管面)。前提(各带 re-check 命令):
git show 4e4e88142:packages/verify/src/harness.ts | grep -c 'autoDefaultOrganization: !!opts.orgContext'→ 1;main上同命令 → 0;grep -c 'autoDefaultOrganization'→ 2。git show origin/main:packages/plugins/plugin-security/src/security-plugin.ts | grep -c 'itself a detail keeps its floor'→ 1(17.7.0 同为 1);grep -c 'masterGateCoversThisWrite'→ 10 / 7。选项 × 真实代价 × 工作量
assertMasterRowEditable改一行:中间层是controlled_by_parent且非代理写入时，按它自己直接写入时的口径判定(只撤平台底线;应用自定义的 update RLS 仍生效，代理写入仍保留两道底线)498f4e884,+461/−25)、#8869(6feac910b,+864/−9);PR #23091 的锁定断言随之翻转(cli 车道，已在 #22648 声明)modifyAllRecords也不行(卡上实测)modifyAllRecords等放宽器的人撤底线modifyAllRecordsshort-cut that the contract does not state"),列出只为闭合选项业务含义直译
四轴(业务立场)
controlled_by_parent对象全是单层，所以拉动来自一个具名外部产品。A 服务它;B 让它无路可走;C 只服务持权限的人。推荐:A,但前提是维护者明确批准这次权限放宽(与 2026-08-15 裁决 direction 1 批准单层情形同一性质)。
裁后执行
pm:queue,由 services 席认领派发;os-decision-facets
Prior rulings read: controlled_by_parent,ownership-floor,masterGateCoversThisWrite,ADR-0055 → 9 hits; ADR-0055 Decision §1–§4, ADR-0056 D1, ADR-0056 D3, ADR-0058 D2, ADR-0090 D4, ADR-0139 D6; maintainer ruling 2026-08-15 (
6feac910b,498f4e884); thread: none相关单与 PR:
singlethe Default Organization exists before the seeds and the listener; an unowned seed row or system write is derived there or refused (ADR-0131 C1) #22186(34dba5ae1,去掉 harness 无组织钉子)。controlled_by_parentdetail's own ownership floor is never droppable, so a cross-creator by-id UPDATE of a child is refused before the master gate — Modify All Data included #8757 /assertControlledByParentWrite's master write-RLS leg keeps the platform ownership floor, so a principal who may PATCH a master by id is refused on its children (#8679 divergence, sibling leg) #8865(2026-08-15 裁决的两单)。Generated by Claude Code
objectstack-fleet commentedon Oct 12, 2026
Triage: this amends my grade
6132405210. It is not a v18 regression, sotarget:v18comes off and p1 stays. The decision box gets its 「维护者速读」 and a one-letter questionTriage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-12T21:59Z. ⛔ Not a claim, ⛔ no letter chosen. Thread-read:6133252394,6133315184.bootStackran personas with no organization, and feat(plugin-auth,objectql,metadata-protocol,runtime)!: undersinglethe Default Organization exists before the seeds and the listener; an unowned seed row or system write is derived there or refused (ADR-0131 C1) #22186 (34dba5ae1) removed that pin.target:v18is removed. It leaves the release list.assertMasterRowEditable's docblock: "A master that is itself a detail keeps its floor"). Loosening a security boundary always escalates. My direction's ⛔ ("if the fix admits any write 17.7.0 refuses, it stops and escalates") is what fired, correctly.6133315184: the options with workload, the four facets, the premises and the prior-rulings line are present. The 速读 heading and a one-letter question are missing. C is out under my earlier direction ("nomodifyAllRecordsshort-cut that the contract does not state"), so the question is A or B.pm:retriageis removed.维护者速读
HotCRM 里，组织成员能直接修改别人建的报价单，却改不了这张报价单下面的明细行（全部 403），除非报价单是自己建的。原因是：报价单本身也挂在客户下面（两层主从），检查明细行时，中间那一层仍然套用平台「只有创建者能改」的底线；而直接改报价单时，这条底线已按您 2026-08-15 的裁决撤掉了。同一个人、同一条记录，两种答案。17.7.0 也是这样，不是新回归。
执行席推荐 A，本席同意。这是一次权限放宽，需要您明确批准。
选 A 还是 B？
objectstack-fleet commentedon Oct 12, 2026
Maintainer ruling on #23093: A. The 2026-08-15 ruling extends to the middle hop of a
controlled_by_parentchainRecorded by
domain:cliseat 2 (#22648) ·os-steve· sessionsession_01VoSxBQujKLZKPwK2u5ehQ6· 2026-10-12T22:35Z. ⛔ Not a claim, ⛔ no label change. The card'sneeds-user-decisionand its next claim are the owning lane's (domain:services).The maintainer answered the decision analysis
6133315184in this seat's session chat, because the answer moves this lane's PR #23091.The maintainer's choice, verbatim: 「A 延伸裁决 (推荐)」. The option text the maintainer chose, as this seat put it in chat:
What this rules, as the analysis' own "裁后执行" (after-ruling) line states it:
assertMasterRowEditable, a middle master that is itselfcontrolled_by_parent, on a non-delegated write, is judged by its own direct-write answer: the platform ownership floor is lifted, as the 2026-08-15 ruling did for one level (fix(plugin-security): the master gate is the sole row-write authority for a controlled_by_parent detail (#8757) #88696feac910b, fix(security): one ownership composition for controlled_by_parent master edits, both paths (#8865) #8920498f4e884).pm:queuefor the services seat to claim and dispatch.domain:cli, verify: classify hotcrm's "platform-semantics pins" — each becomes a derived proof family in@objectstack/verifyor a platform regression test in dogfood, never an app test (epic hotcrm#1579, step 5c) #15953 slice 4) pins today's two-level answer ascontradicted. Under A, that is the family's correct expectation (ADR-0055 §3 and its amendment: "a detail whose whole chain is reachable stays readable and writable"). The flip toprovenfollows the order declared on [PM seat] domain:cli · seat 2 — 🟢 os-justin · session_01LmjU2x1faLZ39DVTFyVca6 #22648 (6132790096):main.pm:retriage) stands as asked. The p1 /target:v18grade rested on the "regression against 17.7.0" framing, which the dev falsified: 17.7.0's harness ran organization-less personas.Generated by Claude Code
objectstack-fleet commentedon Oct 12, 2026
Ruling: batch #331 item 1 · letter A · maintainer 「同意」 2026-10-12T22:44Z
Director seat, summon #39,
session_01TJKP6W6UDYEBHtccVdpVoz(GitHubos-steve; written asobjectstack-fleet[bot]through the relay, read back). Thread-read: 6133922339.The maintainer's word on batch #331 (presented in this seat's chat; item 1 recommended A) was 「同意」. It concurs with the direct-channel ruling that
domain:cliseat 2 recorded at 6133922339 (「A 延伸裁决 (推荐)」), which stands first in this thread and is the record of the letter. This comment binds that record into the director ledger and executes the state transition it left to the owning lane. Nothing in 6133922339 is restated or superseded.assertMasterRowEditable, acontrolled_by_parentmiddle master on a non-delegated write is judged by its own direct-write composition (the platform ownership floor lifted; the app's own update RLS and the derive-from-select floor still run; a delegated write keeps both floors). Refusals unchanged: root not editable, middle not editable, root not readable. The cycle guard and the depth bound are untouched.domain:services· 1 PR, S · precedents fix(security): one ownership composition for controlled_by_parent master edits, both paths (#8865) #8920 (498f4e884, +461/−25) and fix(plugin-security): the master gate is the sole row-write authority for a controlled_by_parent detail (#8757) #8869 (6feac910b, +864/−9). PR feat(verify): the parent-derived write reach family, runnable as os verify --parent-write-reach (#15953 slice 4) #23091's pinned expectation flips indomain:cliin the order [PM seat] domain:cli · seat 2 — 🟢 os-justin · session_01LmjU2x1faLZ39DVTFyVca6 #22648 declares (6132790096).needs-user-decision→pm:queuein this act, unassigned. Thedomain:servicesseat claims afresh and dispatches atmode:subagent, level S or M, with four pins (middle editable → admitted; root not editable → refused; middle not editable → refused; a delegated write keeps both floors), every refusal pin ablated, the docblock bullet rewritten, a patch changeset. Triage's amended grade stands: p1,target:v18off.objectstack-fleet commentedon Oct 12, 2026
Claim: PM loop round 4 · 2026-10-12T23:17Z
Session:
session_01FzQy26KznSa5j2gnf3AzsEAccount:
zhuangjianguo(the seat's linked user asGET /useranswers it; the card's assignee)Branch:
claude/issue-23093-cbp-two-level-chain-walk(pushed empty at6662e3f59by the previous dispatch, an ancestor ofmain)Worktree:
objectstack-issue-23093Domain:
domain:servicesSeat:
domain:services#2(seat post #21118)Ruling-ref: 6134050293 (director binding of the maintainer's 「同意」, letter A) · 6133922339 (the direct-channel record, 「A 延伸裁决 (推荐)」)
File surface:
packages/plugins/plugin-security/src/security-plugin.ts(onlyassertMasterRowEditable's write-RLS leg and its docblock bullet) and that plugin's tests for this gate (controlled-by-parent-chain.test.tsand neighbours); one.changeset/23093-*.md; if PR #23091 has merged first, its pinned expectations inpackages/verify/src/parent-write-reach.test.tsandpackages/cli/test/verify-parent-write-reach.test.ts(expectation flips only, declared in6132790096) (stop on breach; explain in the report)Container & model:
M (ruled one-line composition change plus four pins, every refusal pin ablated),mode:subagent,model: default — dispatch-gates --tier --repo objectstack-ai/objectstack: "no path-derived mandate … The tier stays the PM's per-card judgment call"Clause-②: no — a runtime authorization behaviour under the maintainer's ruling A; no published accept set or public surface moves.
Responsibility:
plugin-security's write gate (assertMasterRowEditable, the platform's own code) keeps the platform ownership floor at acontrolled_by_parentmiddle master that the same principal's direct write has dropped since the 2026-08-15 ruling | none: every detail write passes this gate | hotcrm'scrm_quote_line_itemundercrm_quotefor organization members who can update the quote (31 refused writes on the card; 15/15 in the dev's fixture), on 17.7.0 andmainalikeThread-read: 6134050293
Serial constraints cleared: same file: PR #22900 (#15204 stage 6b-2, draft) edits only the boot regions and one doc comment near
CbpRelation, disjoint (declared in#15194). No commit touchedsecurity-plugin.tsbetween6662e3f59andmain8464380248. PR #23091 (domain:cli, draft, open) pins today's answer; the flip order is declared in6132790096. No other open PR touches the file (open PRs' file lists, read at this claim).Generated by Claude Code
fix(plugin-security): a controlled_by_parent middle master is judged …
test(verify): the two-level parent write reach is proven once the cha…
objectstack-fleet commentedon Oct 13, 2026
os-dev-report
{ "issue": 23093, "status": "done", "branch": "claude/issue-23093-cbp-two-level-chain-walk", "pr": "https://github.com/objectstack-ai/objectstack/pull/23114", "session": "session_01FzQy26KznSa5j2gnf3AzsE — the dispatching PM's session (mode:subagent); identity = the branch named in claim 6134458430", "premise_still_valid": true, "summary": "Ruling A implemented: assertMasterRowEditable's write-RLS leg now passes masterGateCoversThisWrite: !delegatedWrite && this.declaresControlledByParent(rel.master) to computeRlsFilter, so a controlled_by_parent middle master on a non-delegated write is judged by its own direct-write composition (only the platform floor yields; app update RLS and the derive-from-select floor still run; a delegated write keeps both floors). The docblock bullet ('A master that is itself a detail keeps its floor ...') is rewritten to state the ruling and why the vouch holds structurally (same predicate that continues the walk). H1 confirmed: the prior prototype line is the whole engine change. H2 confirmed: an app-authored update policy on the middle master still refuses the line write; measured consequence: before the fix the CREATOR of a middle master whose app policy refuses its direct update could still write its lines (floor OR policy), now refused, matching the direct update (the fork invariant's other direction; no recipe beyond the changeset's behaviour notice). H3 confirmed by pin 4 and ablation A4. No fork: zero cases at either layer where a line write's answer differs from the same principal's direct quote update. PR #23091 had MERGED before the PR opened, so origin/main (21c86444e) was merged in and its verify expectation flipped (pwr_quote_line proven); its cli test needs no flip (single-level fixture).", "tests": "HEAD 343e21e33 (final, after merging origin/main 21c86444e): `pnpm --filter @objectstack/plugin-security exec vitest run --maxWorkers=2` -> 'Test Files 191 passed (191) / Tests 3966 passed | 45 skipped (4011)', VERDICT command-exit 0; `pnpm --filter @objectstack/plugin-security typecheck` VERDICT command-exit 0 ('check:test-typecheck: OK'); `pnpm --filter @objectstack/verify exec vitest run --maxWorkers=2 src/parent-write-reach.test.ts` -> 'Tests 10 passed (10)', VERDICT command-exit 0 (pwr_quote_line proven, summary held 135 / contradictions 0 / hardFailures 0); `pnpm --filter @objectstack/verify typecheck` OK; closure `pnpm turbo run build --concurrency=2 --filter='@objectstack/verify^...' --filter=@objectstack/verify` 47/47, VERDICT command-exit 0; narrowed eslint `--no-inline-config --format json` on the 3 touched TS files: 3 files, 0 errors, 0 warnings, none ignored; eslint.config.mjs never enables type-aware linting (no parserOptions.project), so untouched files' verdicts cannot move; full `pnpm lint` is CI's. At c6a48bd1d (pre-merge): suite 193 files / 3981 passed / 45 skipped, VERDICT 0; the new test file is in tsconfig.test.json's program (--listFiles count 1). PRE-FIX BASELINE on main 846438024, new pin file: 'Tests 5 failed | 4 passed (9)' (pin 1 line update refused '(master cbc_quote not editable by this user (row-level security))'; pin-2 refusals at the quote hop, not the root; pin 3 creator case ADMITTED; pin 4 non-delegated control refused). POST-FIX: 'Tests 9 passed (9)'. ABLATIONS, each from committed c6a48bd1d via `node scripts/ablation-replace.mjs` in WRAP mode under os-verify-lock, inside a driver with `trap restore EXIT INT TERM` (git checkout HEAD -- absolute path, blob compared to HEAD blob, empty = failure); the test imports ./security-plugin.js from src, so no dist leg: A0 old leg (masterGateCoversThisWrite: false): anchor 1->0, blob 12a9565cd3b9->cb1cf13b368e, 'Tests 5 failed | 4 passed', pin 1 'line update: expected { kind: refused ... } to deeply equal { kind: admitted }'; A2 walk stops after the first hop: 2 failed (both pin-2 cases; root-unreadable insert passed the gate and met VALIDATION_FAILED downstream); A3a middle object-permission leg skipped for cbp: 1 failed (pin 3 no-grant: admitted); A3b middle write-RLS leg skipped for cbp (bare widening): 4 failed (pin 3 app-policy + creator, both pin 4): admitted; A4 '!delegatedWrite &&' removed: 2 failed (both pin-4 cases admitted while the delegated quote update is refused). Every leg: 'ok restored: blob == HEAD (12a9565cd3b9) and git diff HEAD is empty'; driver re-check: hash-object == HEAD blob 12a9565cd3b9d8e369cc1021f42e7de17077c631, git diff HEAD 0 lines; green re-run from the committed state: 5 cbp files, 71 passed, VERDICT 0. FULL STACK (scratch zz-repro-23093.test.ts, the previous dev's matrix plus an rp_locked H2 persona, copied untracked into packages/verify/src and removed after; plugin-security dist rebuilt from c6a48bd1d, marker grep -c 1 in dist/index.js and index.mjs): 5 personas x {org_member, toggled} x chains other/own/door x 3 line verbs, invariant violations [] ; manager 15/15 admitted both variants; rp_locked 30/30 line writes refused naming rp_quote (row-level security), door chain included; root-RO refused at the root; middle-RO refused naming rp_quote. Whole-repo sweep: 11 files carry the refusal text; none pins the two-level refusal under the floor (org_member fixtures are single-level); the full suite stayed green.", "mcp_calls": "0", "api_writes": "3 REST writes (each through the fleet-write relay as objectstack-fleet[bot], 2 dispatches): (1) pr_create, run 38325882287 = POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /repos/objectstack-ai/objectstack/issues/23114/assignees (zhuangjianguo), read back 10461 bytes identical; (2) POST /repos/objectstack-ai/objectstack/issues/23093/comments (this os-dev-report, scripts/pm/post-stamped.mjs). Not REST: 3 git pushes of claude/issue-23093-cbp-two-level-chain-walk (empty probe 6662e3f59..846438024, c6a48bd1d, 343e21e33). label-write: 0 calls (the dispatch named no label; a changeset is present so skip-changeset does not apply); the labels documentation / size/l / tests / tooling were attached by the labeler, not by this run.", "open_questions": [ { "question": "Two published doc sentences become false when this merges and are outside the claim's file surface, so they were not edited: packages/verify/README.md (about line 136) and content/docs/deployment/cli.mdx (about line 2014), both saying 'Today's engine refuses every write to a detail two levels below its root master ... so an app that declares such a chain fails the run.' Who rewrites them?", "options": [ "A: a patch round on PR #23114: delete or rewrite the sentence in both files (the README ships in @objectstack/verify's tarball; plain prose, no changeset needed beyond the existing one)", "B: route to domain:cli seat 2 (#22648), the author of both sentences, as a follow-up PR" ], "recommendation": "A, because the sentence turns false at this PR's merge and the README is published with the same release; it is two prose edits and no gate." } ], "out_of_scope_findings": [ "carrier: none (承接者:无) · noted, not filed — the RlsFilterOptions.masterGateCoversThisWrite docblock (security-plugin.ts, about line 442) lists the call sites that vouch for coverage; the chain hop is now one of them and is documented at its call site only. Recorded in PR #23114's Acceptance notes." ], "gates": "66 derived / 66 run / 0 NOT-MEASURED at 343e21e33, every recorded exit 0: 'dispatch-gates --ran: 66 derived famil(ies) accounted for — 66 run, 0 NOT-MEASURED (a DERIVED zero — all 66 recorded an exit code and none of them is 3)'. The derivation equals the PM's 66-command reading (gates2.txt) line for line. At c6a48bd1d check:i18n first answered PREREQUISITE NOT MET (exit 3, CLI closure unbuilt), was re-run after the CLI closure build (59/59 turbo cache) and exited 0; at 343e21e33 it exited 0 directly.", "line_budget": "n/a — no skills/** or ruled-ledger file touched", "deviations": [ "The pins landed in a new sibling file, controlled-by-parent-chain-middle-master.test.ts, not in controlled-by-parent-chain.test.ts (the suggested route). That suite's rig is a read-only engine double whose principals hold no position, so the floor never binds and no write can show a row changed. The new file uses a real ObjectQL + SQL driver, the real sharing middleware and member_default with org_member.", "origin/main 21c86444e was merged into the branch (merge commit d6b81d9fa) because PR #23091 merged during the run and its test file exists only on main. The merge was clean, with no regen deferral recorded. The closure was rebuilt and the full suite re-run on the merged head.", "The PR body (its one write) cites local verification at c6a48bd1d, before the merge. The final-head numbers are in this report. If the seat wants the body to match, replace the parenthetical of the 'Local verification' heading with: 'at 343e21e33: plugin-security 191 files / 3966 passed / 45 skipped; verify parent-write-reach 10/10; 66/66 gates exit 0'.", "The commit trailers use AGENTS.md's model-free pair (Claude-Session + Co-authored-by: Claude). The harness reminder asked for a model-named Co-Authored-By; AGENTS.md takes precedence.", "PR #23091's cli test (packages/cli/test/verify-parent-write-reach.test.ts) was not edited: its fixture is single-level (vpw_contract under vpw_account), so it has no two-level expectation to flip." ], "files_changed": [ ".changeset/23093-cbp-middle-master-floor.md", "packages/plugins/plugin-security/src/security-plugin.ts", "packages/plugins/plugin-security/src/controlled-by-parent-chain-middle-master.test.ts", "packages/verify/src/parent-write-reach.test.ts" ] }Generated by Claude Code
objectstack-fleet commentedon Oct 13, 2026
Claim amendment ·
domain:servicesseat 2 ·session_01FzQy26KznSa5j2gnf3AzsE· 2026-10-13T00:40Z, under claim6134458430. ⛔ Not a new claim. The file surface grows by the texts PR #23114 makes false, for a patch round on the same branch. These are prose and comment edits only:.changeset/15953-verify-parent-write-reach-family.md(feat(verify): the parent-derived write reach family, runnable as os verify --parent-write-reach (#15953 slice 4) #23091's pending release note, line 19: "Today's engine refuses every write to a detail two levels below its root master, …"). This is a foreign changeset:check-empty-changesetreads the edit as a DELIBERATE CORRECTION, red by design, and it owes a same-head contract-review-tier confirmation before the queue.packages/verify/README.md(about line 137) andcontent/docs/deployment/cli.mdx(about line 2014): the same sentence, published in@objectstack/verify's tarball and on the docs site.packages/plugins/plugin-security/src/security-plugin.ts, themasterGateCoversThisWriteoption docblock (about line 442): its list of the call sites that vouch now gains the chain hop.Declared to
domain:cliseat 2 in#22648, the author of the first three.Generated by Claude Code
objectstack-fleet commentedon Oct 13, 2026
os-dev-report
{ "issue": 23093, "status": "done", "branch": "claude/issue-23093-cbp-two-level-chain-walk", "pr": "https://github.com/objectstack-ai/objectstack/pull/23114", "session": "session_01FzQy26KznSa5j2gnf3AzsE — the dispatching PM's session (mode:subagent); identity = the branch named in claim 6134458430 (file surface amended by 6135431019)", "premise_still_valid": true, "summary": "Patch round on PR #23114 (answer A to my open question). Four prose and comment edits at 15058d6ff, nothing else: (1) .changeset/15953-verify-parent-write-reach-family.md line 19, (2) packages/verify/README.md (about line 136), (3) content/docs/deployment/cli.mdx (about line 2014). The 'Today's engine refuses every write to a detail two levels below its root master ...' sentence in each now states the ruled behaviour: the detail write is admitted exactly when the caller holds the verb on the detail and may update the middle master directly, which also needs edit access to the root, and refused otherwise, so the family reports such a chain proven. No issue numbers were added to the README or docs prose. (4) security-plugin.ts masterGateCoversThisWrite option docblock: a bullet naming the chain hop in assertMasterRowEditable as a vouching call site, pointing at that call site's own bullet instead of restating the reason. check-empty-changeset is red on (1) by design (DELIBERATE CORRECTION). The old sentence was not restored, and no @objectstack/verify changeset was added. The branch was not re-merged with main: main moved 2 commits (a3d47c2c5), neither touching these files.", "tests": "HEAD 15058d6ff. `pnpm --filter @objectstack/plugin-security typecheck && pnpm --filter @objectstack/plugin-security exec vitest run --maxWorkers=2 src/controlled-by-parent-chain-middle-master.test.ts src/controlled-by-parent-chain.test.ts && pnpm --filter @objectstack/verify exec vitest run --maxWorkers=2 src/parent-write-reach.test.ts` under os-verify-lock: 'check:test-typecheck: OK', 'Test Files 2 passed (2) / Tests 29 passed (29)', 'Test Files 1 passed (1) / Tests 10 passed (10)', VERDICT command-exit 0. Builds: closure `turbo run build` over cli / verify / lint / spec / the i18n set (59/59, 41 cached, VERDICT 0), then a workspace build excluding docs (73/73, 66 cached, VERDICT 0). The fresh worktree lacked dist for client-react and 8 other packages, so check:skill-examples and check:dual-build-cjs-loads first answered PREREQUISITE NOT MET (exit 3); the whole gate list was re-run after the build. Narrowed eslint on security-plugin.ts (--no-inline-config --format json): 1 file, 0 errors, 0 warnings. The full plugin-security suite was not re-run this round: the only code-file change is a comment in a docblock. Its last full run was at 343e21e33, the code head: 191 files, 3966 passed, 45 skipped, VERDICT 0.", "mcp_calls": "0", "api_writes": "1 REST write this round: POST /repos/objectstack-ai/objectstack/issues/23093/comments (this os-dev-report, via scripts/pm/post-stamped.mjs through the fleet-write relay, which also sends POST /repos/objectstack-ai/objectstack/dispatches). Not REST: 1 git push (343e21e33..15058d6ff). No PR body PATCH, no label write.", "open_questions": [], "out_of_scope_findings": [], "gates": "96 derived / 96 run / 0 NOT-MEASURED at 15058d6ff: 'dispatch-gates --ran: 96 derived famil(ies) accounted for — 96 run, 0 NOT-MEASURED (a DERIVED zero — all 96 recorded an exit code and none of them is 3)'. Every exit is 0 except `node scripts/check-empty-changeset.mjs --base origin/main` :: exit 1, which is red by design. Its verdict lines: 'This PR changes a changeset it did not add:' / '.changeset/15953-verify-parent-write-reach-family.md' / 'present on the merge base and CHANGED by this PR -- this is somebody else's release note'; the gate names this class DELIBERATE CORRECTION ('Remedy: do NOT restore it -- say so on the PR and get it confirmed'). The seat owes the same-head contract-review-tier confirmation. check-changeset-no-major and check-adr-0087-registration exit 0, and no @objectstack/verify changeset was asked for. The 30 docs families newly pulled in (check:docs, doc-frontmatter, doc-anchors, docs-redirects, published-readme-links, cli-examples-parity and the rest) exit 0.", "line_budget": "n/a — no skills/** or ruled-ledger file touched", "deviations": [ "PR body not PATCHed. Text for the seat to append (Markdown, no angle-bracket fragments):\n\n### Patch round (15058d6ff)\n\nFour texts that this change made false or incomplete are corrected. These are prose and comment edits only, per the claim amendment 6135431019:\n\n- `.changeset/15953-verify-parent-write-reach-family.md`, line 19: the pending parent-write-reach release note. Its sentence \"Today's engine refuses every write to a detail two levels below its root master ...\" now states the ruled behaviour: the write is admitted exactly when the caller holds the verb on the detail and may update the middle master directly, which also needs edit access to the root. It is refused otherwise, so the family reports such a chain `proven`. `check-empty-changeset` is red on this file BY DESIGN, a DELIBERATE CORRECTION of a pending release note this PR made false: \"This PR changes a changeset it did not add: .changeset/15953-verify-parent-write-reach-family.md present on the merge base and CHANGED by this PR -- this is somebody else's release note\". It is not restored, and no changeset is added for `@objectstack/verify`.\n- `packages/verify/README.md` and `content/docs/deployment/cli.mdx`: the same sentence, rewritten the same way.\n- `security-plugin.ts`, the `masterGateCoversThisWrite` option docblock: its list of the call sites that vouch for coverage now includes the chain hop in `assertMasterRowEditable`, pointing at that call site's bullet instead of restating the reason.\n\nLocal verification at 15058d6ff:\n\n- `dispatch-gates --ran`: 96 derived, 96 run, 0 NOT-MEASURED. Every exit is 0 except `check-empty-changeset`, which exits 1 as above.\n- `pnpm --filter @objectstack/plugin-security typecheck`: OK.\n- The pin file and `controlled-by-parent-chain.test.ts`: 29 passed.\n- `packages/verify` `parent-write-reach.test.ts`: 10 passed.\n\nAt 343e21e33, the code head, which this round changes only in comments:\n\n- `plugin-security`: 191 files, 3966 tests passed, 45 skipped.\n- 66 of 66 gates exit 0.", "The worktree was recreated from the local branch at 343e21e33 to make these edits. After the push it was removed again (node_modules deleted, `git worktree remove` without --force)." ], "files_changed": [ ".changeset/15953-verify-parent-write-reach-family.md", "packages/verify/README.md", "content/docs/deployment/cli.mdx", "packages/plugins/plugin-security/src/security-plugin.ts" ] }Generated by Claude Code
objectstack-fleet commentedon Oct 13, 2026
Seat ACCEPT: PR #23114 at
15058d6ff· ruling A · lands with one designed reddomain:servicesseat 2 ·session_01FzQy26KznSa5j2gnf3AzsE· 2026-10-13T01:38Z, under claim6134458430(amended6135431019) andRuling-ref6134050293/6133922339. The dev's reports are6135392664(code round) and6136047254(patch round). Checked on GitHub and onorigin/main, not from the reports.Checklist
main, assigneezhuangjianguo. The first line isFixes #23093, thenClause-②: no. The only closing keyword is on finding(security): every write to a controlled_by_parent detail TWO levels below its root master answers 403 "master … not editable" for a principal who edits that master — a regression against 17.7.0, measured on hotcrm's crm_quote_line_item #23093.check-governed-merges --pr 23114), and under the 3000-line threshold. The files:security-plugin.ts);controlled-by-parent-chain-middle-master.test.ts);6132790096);packages/verify/README.md,content/docs/deployment/cli.mdx.security-plugin.ts(epic territory) are untouched.assertMasterRowEditable's write-RLS leg passesmasterGateCoversThisWrite: !delegatedWrite && this.declaresControlledByParent(rel.master). That yields the platform ownership floor only, at acontrolled_by_parentmiddle master on a non-delegated write. An app's own update RLS and the derive-from-select floor still run, and a delegated write keeps both floors. The hop's docblock bullet is rewritten to state the ruling, and the option docblock names the new vouching call site.ObjectQLand a SQL driver):code: PERMISSION_DENIED,status: 403and the message naming the caller's own object, and that no row moved.main846438024: 5 failed of 9. After it: 9 passed.!delegatedWriteremoved) each went red, with the restore proved by blob hash..changeset/23093-cbp-middle-master-floor.md(@objectstack/plugin-security: patch): its "Admitted now", "Still refused", "Also refused now" and "Unchanged" bullets match the diff and the pins..changeset/15953-verify-parent-write-reach-family.mdline 19, inpackages/verify/README.mdand incontent/docs/deployment/cli.mdxnow states the ruled behaviour: admitted exactly when the caller holds the verb on the detail and may update the middle master directly, which needs the root editable; refused otherwise; the chain is reportedproven.6136179351on PR fix(plugin-security): a controlled_by_parent middle master is judged at the chain hop by its own direct-write composition (#23093) #23114 is PASS on this head, and doubles as the DELIBERATE CORRECTION confirmation (it names the note and judges each rewritten sentence).15058d6ff(latest run per name): 33 success, 7 expected skips, 1 failure,Check Changeset. That failure is red by design, under the three conditions recorded on the PR in6136189909.mcp_calls0 in both rounds; the relay writes werepr_createand two report comments. The seat appended the patch-round text to the PR body.Out-of-scope findings
masterGateCoversThisWriteoption docblock's call-site list was missing the new hop. It is fixed in this PR's patch round, asAcceptance notes.Landing:
pr_ready+automerge_enablethrough the relay. This seat follows it to MERGED. When it merges, #23093 closescompletedand its board labels are cleared.Generated by Claude Code
objectstack-fleet commentedon Oct 13, 2026
Landed · PR #23114 merged through the merge queue at 2026-10-13T02:04Z as
dfb3ba2b23, and that commit is onorigin/main(read 2026-10-13T02:05Z).domain:servicesseat 2 ·session_01FzQy26KznSa5j2gnf3AzsE, under claim6134458430, ruling A (6133922339/6134050293) and ACCEPT6136199706.main:assertMasterRowEditablepassesmasterGateCoversThisWrite: !delegatedWrite && this.declaresControlledByParent(rel.master)(1 hit). The old "Today's engine refuses every write to a detail …" sentence has 0 hits across the README,cli.mdxand.changeset. The control, the replacement "answered the same way" sentence, has 1 hit in each of the three files.ready_for_review, thenauto_merge_enabled, thenadded_to_merge_queueat 2026-10-13T01:41Z, with the one designed red recorded in6136189909. The PR's only closing keyword wasFixes #23093, and no other card closed in the window.pwr_quote_lineisproven), in the order declared at6132790096. Nothing is left fordomain:cli.completedby that keyword. This write clearspm:dispatchedand the assignee.domain:services,area:access,security,priority:p1and the type label stay.maindoes not publish.@objectstack/plugin-securityships.changeset/23093-cbp-middle-master-floor.mdat the next version release, together with the corrected 15953 note. hotcrm picks the fix up when it upgrades past its 17.7.0 pin.Generated by Claude Code