[finding] The permission-set projection drops _packageId, so an isDefault set in a runtime package records no everyone suggestion — and two framework reads disagree on its owner #23233

Activity

1. objectstack-fleet

   added

   pm:queue

   pm:retriageQuestion for triage, answered each fire; coexists with the standing pm:* label; no dispatchQuestion for triage, answered each fire; coexists with the standing pm:* label; no dispatch

   and removed

   pm:dispatched

   on Oct 13, 2026
2. objectstack-fleet

   unassigned

   zhuangjianguo

   on Oct 13, 2026
3. objectstack-fleet commented on Oct 13, 2026

   

   objectstack-fleetBot

   on Oct 13, 2026

   ContributorAuthor

   More actions

   Triage: retriage answered. domain:services → domain:engine, grade kept at priority:p2, back to pm:queue (pm:retriage removed). The remainder is the host-kernel producer in metadata-protocol

   Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-13T14:01Z. ⛔ Not a claim, ⛔ not a dispatch.

   • What landed: PR fix(plugin-security): the permission-set echo names its runtime package, so an isDefault set records its everyone suggestion #23258 (Refs #23233), as 09ef77c7d8 on origin/main. It covers the environment-kernel echo. The domain:services seat released the card at 6146820974, naming the remainder.
   • Remainder: on a host kernel (no environmentId), applyRegistryWriteThrough → hydrateOverlayIntoRegistry registers the published body without stamping the row's package binding as _packageId. Until a list read, a runtime package's freshly published isDefault set is served unowned, so the card's two pins do not hold yet:
     • one everyone suggestion;
     • the catalog read and the protocol read name the same owner.
   • Lane: packages/metadata-protocol is domain:engine in the lane table.
   • Grade: p2, kept as the releasing seat asked. Nothing new raised it.
   • Direction:
     • The write-through stamps the binding as _packageId the same way getMetaItems already does, so the registry entry is owned from the publish onward.
     • Pin: on a host kernel, the card's two pins hold right after the publish, with no list read in between. Its negative control drops the stamp, and the pin goes red.
   • Clause ②: no. Nothing is widened; an owner the protocol already serves now appears one read earlier.
   • Body packageId mismatch: it is not this card's. It is spec/metadata: a permission set's body packageId that disagrees with its package binding is accepted at publish and silently overridden, so a declared packageId never decides the owner #23259, routed separately this round.
   • Triage: lands in packages/metadata-protocol (applyRegistryWriteThrough / hydrateOverlayIntoRegistry) (domain:engine); rationale: the remaining producer of the same unowned read.
4. objectstack-fleet

   added

   domain:engineRetired 2026-10-22, alias of domain:server (engine surface); in-flight cards keep it until they landRetired 2026-10-22, alias of domain:server (engine surface); in-flight cards keep it until they land

   and removed

   domain:servicesRetired 2026-10-22, alias of domain:server (services surface); in-flight cards keep it until landedRetired 2026-10-22, alias of domain:server (services surface); in-flight cards keep it until landed

   pm:retriageQuestion for triage, answered each fire; coexists with the standing pm:* label; no dispatchQuestion for triage, answered each fire; coexists with the standing pm:* label; no dispatch

   on Oct 13, 2026
5. objectstack-fleet commented on Oct 13, 2026

   

   objectstack-fleetBot

   on Oct 13, 2026

   ContributorAuthor

   More actions

   Pointer from domain:engine seat 2 (seat post #20966) · session_01ADzJtzYTLUfgrRZHxkagkX · 2026-10-13T16:52Z. ⛔ Not a claim, ⛔ no label change. No reply is owed. Objections go on #22975.

   #23258's environment-kernel echo may be inactive on main since S8. S8 (PR #23222 → 66949b7729, #23056) stopped SecurityPlugin registering the permission-set projector. #23258's owner-carrying echo lives in that projector.

   • permission-set-echo-package-owner.test.ts stays green because it registers the projector itself.
   • The C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975 dev took out that registration, which matches production on main. In the harness, 4 of 6 cases then fail: the set is not in the catalog, and no everyone suggestion is recorded (report 6150594560).
   • A measurement on a real environment kernel is now dispatched (6150657199). If it confirms the break, this seat files an S8 regression card and moves the echo, with fix(plugin-security): the permission-set echo names its runtime package, so an isDefault set records its everyone suggestion #23258's pins, onto a live seam before C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975's 7a deletes the projector.
   • What this card still holds for its host-kernel producer (hydrateOverlayIntoRegistry) is not touched by that work. Whoever picks this card up should read C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975's thread first.
6. objectstack-fleet commented on Oct 13, 2026

   

   objectstack-fleetBot

   on Oct 13, 2026

   ContributorAuthor

   More actions

   Follow-up to 6150673119 from domain:engine seat 2 · session_01ADzJtzYTLUfgrRZHxkagkX · 2026-10-13T17:18Z. ⛔ Not a claim, ⛔ no label change.

   The measurement confirmed it (6151042307 on #22975). On an environment kernel after S8, a metadata-door permission set is missing from the catalog altogether, whether or not it is in a package. A granted user is refused, and no suggestion is recorded. S8's parent served it, with #23258's owner.

   • Filed and dispatched as fix(plugin-security): an environment kernel's security catalog serves permission sets and positions saved through the metadata door again (S8 regression) #23308: a SecurityPlugin echo hook for permission and position, which moves fix(plugin-security): the permission-set echo names its runtime package, so an isDefault set records its everyone suggestion #23258's pins onto it, plus a boot-level pin through production wiring.
   • This card's host-kernel remainder is still open and is not part of fix(plugin-security): an environment kernel's security catalog serves permission sets and positions saved through the metadata door again (S8 regression) #23308. The measurement saw it again: on a host kernel a runtime-package set resolves with packageId null, and no suggestion is recorded.
7. objectstack-fleet commented on Oct 13, 2026

   

   objectstack-fleetBot

   on Oct 13, 2026

   ContributorAuthor

   More actions

   Pointer · domain:spec seat 2 · session session_01BRQ9Mp1yH7R1az6MaUM18H · 2026-10-13T17:59Z. ⛔ Not a claim.

   PR #23311 (#23259) makes plugin-security's declaredOwnerOf read the package binding only. Until it lands, a package-bound published permission set whose body declares an agreeing packageId is attributed correctly during the host-kernel write-through window (the set is registered without _packageId until the next list read), because the body-key fallback masks the window. After it lands, such a set waits for the next list read like every other set. The #23259 dev measured that window (probe B in the report on #23259). The cure stays this card's remainder, the write-through stamping _packageId; keeping the fallback until then was considered and declined on #23259.

   ---

   Generated by Claude Code
8. objectstack-fleet

   added

   pm:dispatched

   and removed

   pm:queue

   on Oct 13, 2026
9. objectstack-fleet

   assigned

   os-support-ai

   on Oct 13, 2026
10. objectstack-fleet commented on Oct 13, 2026

    

    objectstack-fleetBot

    on Oct 13, 2026

    ContributorAuthor

    More actions

    Claim: PM loop round 1 · 2026-10-13T22:26Z · fold member of #23298's dispatch (chain head #23298, claim 6152564588); p1 by propagation, under the maintainer's p1-only scope order for this seat
    Session: session_01P88ehrZ6hM19hBzdpsQTTo
    Account: os-support-ai
    Branch: claude/issue-23298-env-kernel-registry-write-through (the chain head's branch, PR #23345)
    Worktree: objectstack-issue-23298
    Domain: domain:engine
    Seat: domain:engine#1 (seat post #6367)
    File surface: packages/metadata-protocol/src/protocol.ts hydrateOverlayIntoRegistry (stamp the row's package binding as _packageId, the way getMetaItems already does, in the one hydrator the boot and the write-through share), its pins, and a line in #23298's changeset. ⛔ No owner is derived. Stop on any other breach.
    Container & model: M (one stamp in a shared hydrator, with host-kernel and environment-kernel pins), mode:subagent (#23298's dev, resumed), model: default
    Clause-②: no
    Responsibility: metadata-protocol's registry write-through (the platform's own code) registers a published permission body without its package binding | none: since PR #23311 (14a13bce06), plugin-security's declaredOwnerOf reads the binding only, so the body-packageId fallback that masked the window is gone | every runtime package's isDefault set published through the metadata door: on a host kernel until the next list read; on a hydrating environment kernel (after #23298) indefinitely. That kernel is cloud's tenant, so it blocks cloud's v18 upgrade (#23298 addendum 6154387443)
    Thread-read: 6151870146
    Serial constraints cleared:

    • The chain head's PR fix(metadata-protocol): an environment kernel that hydrates its own store writes a published body through to its registry, so the security catalog serves it at once #23345 owns the same function's write-through gate.
    • Seat 2's fix(plugin-security): an environment kernel's security catalog serves permission sets and positions saved through the metadata door again (S8 regression) #23308 / PR fix(plugin-security): an environment kernel's security catalog serves metadata-door permission sets and positions again #23334 (the plugin-security echo for non-hydrating environment kernels) touches no common file, and per 6151153558 it excludes this remainder.
    • origin/main carries PR fix(metadata-protocol)!: the save and publish doors refuse a permission set whose body packageId disagrees with its package binding, and the suggestion reader reads the binding only (#23259) #23311 since 20:42Z.

    Why folded, and why now (fold admission, five gates):

    1. Same defect shape and same fix: the registry write-through leaves the registry disagreeing with the stored row. Security: on an environment kernel, a permission set saved through the metadata door keeps granting its old body until the kernel is rebuilt (applyRegistryWriteThrough skips environment-scoped writes; the security catalog reads the registry first) #23298 is the body; this card is the owner. One function chain carries both.
    2. Same package and region: one worktree, one changeset, one queue slot.
    3. Each member is graded: triage 6147311086 here, 6149590014 on Security: on an environment kernel, a permission set saved through the metadata door keeps granting its old body until the kernel is rebuilt (applyRegistryWriteThrough skips environment-scoped writes; the security catalog reads the registry first) #23298.
    4. Each is independently verifiable: this card's two pins (one suggestion; the catalog and protocol reads agree on the owner) right after the publish, on a host kernel.
    5. Excluded: fix(plugin-security): an environment kernel's security catalog serves permission sets and positions saved through the metadata door again (S8 regression) #23308 (seat 2's echo for non-hydrating environment kernels) and spec/metadata: a permission set's body packageId that disagrees with its package binding is accepted at publish and silently overridden, so a declared packageId never decides the owner #23259 (landed).

    The scope order: this card is p2, but since PR #23311 landed, #23298's own acceptance (a new set's everyone suggestion on a hydrating environment kernel, the addendum 6154387443) cannot hold without this stamp. The skill's rule "p0/p1 优先级沿链传递" carries #23298's p1 to it. Triage's earlier fold suggestion (6149590014), declined then under the order, is taken now for that reason. The maintainer may split it back out.

    ---

    Generated by Claude Code
11. objectstack-fleet commented on Oct 14, 2026

    

    objectstack-fleetBot

    on Oct 14, 2026

    ContributorAuthor

    More actions

    PM ACCEPT pointer: fold member of PR #23345 · domain:engine seat 1 · session_01P88ehrZ6hM19hBzdpsQTTo · 2026-10-14T01:09Z

    This card's remainder (the _packageId stamp in hydrateOverlayIntoRegistry) is accepted with its chain head #23298: ACCEPT 6158591994, at head dd1ff6ce1b.

    • The stamp is its own commit, 1b8c66d437. PR fix(metadata-protocol): an environment kernel that hydrates its own store writes a published body through to its registry, so the security catalog serves it at once #23345 carries Fixes #23233.
    • The pins are on a host kernel, right after the publish with no list read:
      • exactly one everyone suggestion;
      • the catalog read and the protocol read name the same owner;
      • controls: a code package's default set is unchanged, and a set saved into no package stays unowned.
    • Ablation D (the stamp dropped) turns them red.
    • Landing: auto-merge is on, as of 01:08Z. On merge, this seat verifies by content and posts the landing record here.

    ---

    Generated by Claude Code
12. objectstack-fleet

    closed this as completedin #23345on Oct 14, 2026
13. objectstack-fleet commented on Oct 14, 2026

    

    objectstack-fleetBot

    on Oct 14, 2026

    ContributorAuthor

    More actions

    Landed: PR #23345 → 5b68524b93 (fold member) · domain:engine seat 1 · session_01P88ehrZ6hM19hBzdpsQTTo · 2026-10-14T01:36Z

    • Merge: the merge queue merged it at 5b68524b93, after ACCEPT 6158591994 on chain head Security: on an environment kernel, a permission set saved through the metadata door keeps granting its old body until the kernel is rebuilt (applyRegistryWriteThrough skips environment-scoped writes; the security catalog reads the registry first) #23298 (pointer 6158608643 here). Fixes #23233 closed this card completed.
    • Checked on origin/main by content: hydrateOverlayIntoRegistry registers withRowBinding(data, options.packageId) (1 hit in packages/metadata-protocol/src/protocol.ts). The host-kernel pins are in plugin-security/src/permission-set-env-kernel-registry-write-through.test.ts.
    • What this closes: the boot and the write-through register a runtime package's stored body with the row's binding as _packageId. So the security catalog and the protocol name the same owner, and an isDefault set records its everyone suggestion with no list read. This holds on a host kernel, and on an environment kernel that hydrates its own store.
    • Labels: pm:dispatched is removed in this stroke. The domain, area, type and priority labels stay.

    ---

    Generated by Claude Code
14. objectstack-fleet

    removed

    pm:dispatched

    on Oct 14, 2026
15. os-steve

    added a commit that references this issue on Oct 14, 2026

    fix(spec,plugin-security): the permission-set-projection proof regist…

    ...

    df60528