Repository navigation
A resumed flow run writes as its trigger user (the submitter), not the approver who resumed it, so post-decision writes in an approval flow name the submitter as Last Modified By and in the audit log #24321
Description
Ruled: 6267719791 · letters Q1 A · Q2 A (ruling A item 2 re-read) · 2026-10-19T12:56Z
Ruled: 6257886738 · letter A · 2026-10-19T01:45Z
Filing gate ①: a measured wrong attribution at a public door, with a named consumer. reach: POST /api/v1/approvals/requests/ID/approve (and /reject) on @objectstack/* 18.0.0-next.3, with a sales rep as submitter and a sales manager as decider. Measured by the objectstack-ai/hotcrm#2061 item 2 dev (report comment 6249641221 on that card; PR objectstack-ai/hotcrm#2156). Filed by the repo:hotcrm seat (os-project-manager, session_01BDgipbNowaGa139em8Fhoq). ⛔ Not a claim. Grade and lane: triage's. This may be a design question (see the last section); triage decides whether it needs a ruling.
Reader who acts: the objectstack triage seat routes it. No HotCRM card waits on it: HotCRM ⛔ does not work around it (its AGENTS.md §2).
What happens
An approval flow suspends at its approval node. The approver's decision resumes the run, and the nodes after the decision write as the run's trigger user, the submitter, not as the decider:
plugin-approvalswrites the verdict throughapprovalStatusFieldas the decider. That part is right.- A later
update_recordin the same run writes a value only it owns, as the submitter. objectql'ssys_stamp_audit_updatethen setsupdated_byto the submitter, andsys_audit_logattributes the field change to the submitter, who never wrote it.
Measured in HotCRM on next.3, on four branches whose post-decision node writes a value of its own:
opportunity_approvalapprove writesapproved_date.opportunity_status_change_approvalapprove writesstageandapproved_date, and reject writesrequested_status.opportunity_qualification_approvalreject writesqualification_requested.
On each of them, Last Modified By names the submitter after the manager decides. PR objectstack-ai/hotcrm#2156 removed the post-decision nodes that only restated the mirrored verdict, which fixed six other branches. These four cannot be fixed that way, because their writes are the point.
Prior word
#22722's triage, as recorded on objectstack-ai/hotcrm#2061: "Whether a resumed run should attribute its writes to the decider is a platform design question. It is not filed, because no named need beyond this redundant node exists." These four HotCRM branches are that named need.
Expected (to be decided by the platform)
Writes a resumed approval run makes after the decision are attributed to the decider, or the platform says which identity they carry and why. Either way, the record's updated_by and the audit trail should not name someone who did not act.
Dedupe
MCP search_issues on objectstack, "resumed flow run writes attributed to trigger user not approver decider updated_by after approval": 25 hits, none open on this. The nearest are #3712 (a schedule-triggered run's context, closed), #4466 (an admin override's marker, closed) and #15389 (restored suspensions, closed).
Activity
objectstack-fleet commentedon Oct 19, 2026
Waiting note ·
domain:servicesseat 1 (#6021) ·marchtian·session_01Nk17Z26X5DB59iQztDBADH· 2026-10-19T06:57Z. ⛔ Not a claim. It stayspm:queue, unassigned.domain:servicesseat 2 ([PM seat] domain:services · seat 2 — 🟢 os-support-ai #21118, claim6261453614, 2026-10-19T06:50Z). Ruling A switches the run's identity to the decider on resume. That identity is built byresolveRunContextinpackages/services/service-automation/src/engine.ts, which loadspositionsandpermissionsthrough the grants resolver.resolveRunDataContextinruntime-identity.tsthen maps it to the data context. Both are service-automation: a runAs:'user' flow's data context carries no org_user_ids, so sys_user's org-members row scope cannot resolve and the run sees only the acting user's own sys_user row #24448's claimed surface ("the place inservice-automationthat builds the run's identity from its trigger"). Building the decider's identity on service-automation: a runAs:'user' flow's data context carries no org_user_ids, so sys_user's org-members row scope cannot resolve and the run sees only the acting user's own sys_user row #24448's fixed builder is what gives itorg_user_idstoo. Its claim serialises this card behind it. (Location corrected at 2026-10-19T08:41Z: this line first named onlyresolveRunDataContext.)object_name, such asshowcase_announcement), while the get servesobject_label, whichsys_approval_requestdoes not declare #24375's hold onpackages/plugins/plugin-approvals/**(seat 2, claim6261460653). The decision path that resumes the run is inapproval-service.ts, so if this card needs that file, it waits for plugin-approvals: the approval request page's Object chip shows the target object's API name (object_name, such asshowcase_announcement), while the get servesobject_label, whichsys_approval_requestdoes not declare #24375 too.6257886738), starting with the hotcrm measurement in item 5, before any PR. The claim declares theflow.zod.tsdescribe (item 2) to the spec lane.Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
Claim: PM loop round 14 · 2026-10-19T09:41Z
Session:
session_01Nk17Z26X5DB59iQztDBADH(the dispatching seat; the dev runsmode:subagentin this session's container and shares its session ID, so its identity is the branch)Account:
marchtian(the seat's linked user asGET /useranswers it; the card's assignee from this act)Branch:
claude/issue-24321-resume-as-deciderWorktree:
objectstack-issue-24321Domain:
domain:servicesSeat:
domain:services#1(seat post #6021)File surface (at
origin/main6b42b6bc8or later; stop on a breach and explain it in the report):packages/services/service-automation/src/engine.ts:resume()and the identity switch on resume after a human decision (ruling A item 1). It reusesresolveRunContext's grants resolution, which PR fix(service-automation): a runAs:'user' flow sees its organization's members in sys_user, as the user's own request does #24495 (f72ce934f) made seedorg_user_idstoo. Also theResumeSignaltype if the decider rides it.runtime-identity.tsonly if the switch needs it there.packages/plugins/plugin-approvals/src/approval-service.ts: the decision → resume call that hands the decider to the run (ApprovalResumeSurfaceand its call sites), with tests beside them.packages/spec/src/automation/flow.zod.ts, therunAsdescribe and TSDoc only (ruling A item 2: 「the human whose act is running this segment: the trigger user until a human decision, the decider after it」), and the artefacts it regenerates, each by its own generator.Clause-②).Exclusions:
runAsvalue;'system'flows unchanged; a flow with no human decision node behaves exactly as today (ruling A items 2 and 1).plugin-approvalsalready makes as the decider, are unchanged (item 1).approval-service.ts's row builders are plugin-approvals: the request and action list views show an Object column with the target object's API name (object_name, such asshowcase_announcement), the type half of the record pointer pair, drawn as plain text #24501's label route (seat 2, claim6264078420). The hand-built{ isSystem: true, userId }write contexts are objectql: a runAs:'user' hook fired from a hand-built system context (plugin-approvals' writes) runs without org_user_ids, so sys_user's org-members scope drops out and the hook sees only the acting user's own row #24497's fallback (domain:engineseat 1, claim6263990919). Neither is edited here. If the change needs either, stop and report.packages/objectql/**andpackages/core/**: objectql: a runAs:'user' hook fired from a hand-built system context (plugin-approvals' writes) runs without org_user_ids, so sys_user's org-members scope drops out and the hook sees only the acting user's own row #24497 holds objectql's hookrunAsseam.docs/adr/**: if the dev finds a ruling on the resumed identity, the report names it, with no edit (item 6; Tier H).Container & model:
M: the resume path, the approvals hand-off, the describe, pins, and the hotcrm measurement first,mode:subagent,model: opus(TIER_DEFAULT;--tierread no path-derived mandate). It is a narrowing (Clause-②: no (narrowing)), so oneCONTRACT_REVIEW_TIERreview of record is owed on the final head before the queue.Clause-②: no (narrowing). A post-decision node that the submitter's rights admitted and the decider's do not is now refused (ruling A item 3). No schema shape moves:
flow.runAskeeps its two values and only its describe changes.Responsibility:
service-automation's resume path, which keeps the trigger user's identity for the whole run, andplugin-approvals' decision hand-off | the platform path is the declared keyflow.runAs: 'user', whose segment meaning ruling A sets | reached by every approval flow whose post-decision nodes write: measured on hotcrm's four branches (opportunity_approvalapprove;opportunity_status_change_approvalapprove and reject;opportunity_qualification_approvalreject) on next.3, where "Last Modified By" andsys_audit_logname the submitter.Thread-read: 6261555075
Serial constraints cleared: PR fix(service-automation): a runAs:'user' flow sees its organization's members in sys_user, as the user's own request does #24495 (service-automation: a runAs:'user' flow's data context carries no org_user_ids, so sys_user's org-members row scope cannot resolve and the run sees only the acting user's own sys_user row #24448, the run identity builder) merged as
f72ce934f, and PR fix(plugin-approvals): the approval request page's highlights strip draws no Object chip; the Details tab's record card names the target object by its label #24500 (plugin-approvals: the approval request page's Object chip shows the target object's API name (object_name, such asshowcase_announcement), while the get servesobject_label, whichsys_approval_requestdoes not declare #24375, theplugin-approvals/**hold) merged as666283aea, both at 2026-10-19T09:23Z. A file scan of the 12 open PRs at this claim: none touchesservice-automation,approval-service.tsorflow.zod.ts. The onlyplugin-approvalshit is PR feat(objectql)!: undersingle, a platform object's organization-less system insert is stamped or refused (C8 stage 8b) #24513 (feat(spec,drivers,objectql,plugin-security):organization_idNOT NULL per cleared table; one predicate for Layer 0 and every driver; bothorWhereNullarms, the__global__sentinel and the #13491 ledger retire (ADR-0131 D1/D8/D9) — protocol 18 #15212), and onlystatus-mirror-cascade.integration.test.ts. In-flight claims near these files hold other regions: plugin-approvals: the request and action list views show an Object column with the target object's API name (object_name, such asshowcase_announcement), the type half of the record pointer pair, drawn as plain text #24501 (seat 2) holds the two object files' list views and, on its label route only,approval-service.ts's row builders; objectql: a runAs:'user' hook fired from a hand-built system context (plugin-approvals' writes) runs without org_user_ids, so sys_user's org-members scope drops out and the hook sees only the acting user's own row #24497 (domain:engine) holds objectql's hook seam, withplugin-approvals' producers only as a reported fallback.Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
os-dev-report
{
"issue": 24321,
"status": "needs_decision",
"branch": "claude/issue-24321-resume-as-decider",
"pr": "#24527",
"session": "session_01Nk17Z26X5DB59iQztDBADH (mode:subagent, so this is the dispatching seat's id; the branch is this dev's identity)",
"premise_still_valid": false,
"summary": "The card's defect is real: a resumed run kept its trigger user for life, and after this PR a runAs:'user' run continues as the decider after an approval decision, with identity and permissions together. The decider rides the service-stamped resume signal (ResumeSignal.resumedBy), its grants are re-resolved through the trigger setup's own resolver (seedRunGrants, PR #24495's builder), the switched context is what a later pause persists, the run history keeps the trigger, and approvals journals the decider for a repair replay. What the measurement falsified is the premise that ruling A's letter reaches the named need: all four HotCRM branches, all five HotCRM approval flows and objectstack's one example approval flow with a post-decision write (showcase_invoice_signoff) declare runAs:'system', and item 2 keeps 'system' flows unchanged, so this PR changes none of them; the real-door measurement at 37caa57 shows the system branch still naming the submitter. So the PR opens as 'Part of #24321' and the card needs the maintainer's word on open question 1 (does a decision also move a system run's carried attribution user to the decider) before it can close; open question 2 (send-back, resubmit, recall) is asked as the dispatch required.",
"tests": "At 37caa57 (after merging origin/main f4755a6): service-automation
pnpm test191 files / 2555 passed; plugin-approvalspnpm test81 / 1116 passed; specpnpm test701 / 21311 passed (1 todo); typecheck green for all three (check:test-typecheck OK, debt ledgers unchanged). New pins: service-automation resume-decider-identity.integration.test.ts (14; envelope: approve, reject, later pause keeps the decider, second decider, failed grants resolve to baseline, controls runAs:'system' / no marker / no decider / no decision node; real stack with SecurityPlugin + SharingServicePlugin: updated_by manager after and rep before, guard that the manager's own sets admit the write, FLS-denied post-decision node refused as a repairable strand naming after1 and restricted_note, same node with no decider lands as the rep); plugin-approvals restored-approval-continuation.test.ts new describe (4; decide approve/reject run as the decider with the decider's grants, SLA-shaped decision keeps the identity, a stranded decision journals resumedBy and continueRestoredRun replays as the decider). Ablation (one-off, not kept): scripts/ablation-replace.mjs replaced the decider read in resolveDecisionSegmentContext with undefined (anchor 1 to 0; blob 7172068a6966 to 6dfa06c97035); the suite imports the engine relatively from source, so no build or dist leg applies; predicted red on the decider pins; observed 8 failed / 6 passed (the 5 envelope decider pins, the 2 real-stack attribution pins and the refusal pin red; the 4 controls, the guard and the no-decider control green); restored: blob == HEAD 7172068a6966, git diff HEAD empty.","gates": "Local at 37caa57, after the final commit:
node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstackderived 127 families; all 127 run, each recorded ':: exit 0' (exit captured before any pipe);--ranexit 0: '127 derived, 127 run, 0 NOT-MEASURED, 0 UNRUN'. Local-onlypnpm check:dev-prereqsexit 0. An earlier run of the same list found check:engine-double-contract exit 1 and check:test-source-alias exit 1 in this PR's own fixture (both fixed in bc19d6e) and three exit-3 prerequisites (spec check:skill-examples, check:dual-build-cjs-loads, check:i18n) that pass once built. spec check:generated after the merge: all 14 artefacts up to date. CI on PR #24527 at report time: 39 check-runs, 26 in_progress, 8 success (Check Documentation Links, Check PR Size, Dogfood Regression Gate, No other open PR may claim the same issue, No other open PR may claim the same single-writer path, Part-of PR must not also close its card, The card this PR closes must claim this branch, filter), 5 skipped; Build Core and Governed Surface Queue Guard in_progress; Lint & Repo Gates, TypeScript Type Check and Test Core not yet reported. Not waited on, per the contract.","mcp_calls": "0",
"api_writes": "2 relay strokes (repository_dispatch to the fleet-write relay, executed as objectstack-fleet[bot]): (1) pr_create, i.e. POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /repos//issues/24527/assignees; (2) comment, i.e. POST /repos//issues/24321/comments (this report). Plus git push of claude/issue-24321-resume-as-decider (not REST). Reads only otherwise.",
"open_questions": [
{
"question": "Ruling A item 2 keeps runAs:'system' flows unchanged, but every branch items 4 and 5 name (HotCRM's four, and all five HotCRM approval flows at 296167936b06) declares runAs:'system'. Their post-decision writes carry the submitter through the user a system run carries for attribution (#5494; ADR-0073 D2). Should a decision also move a runAs:'system' run's carried attribution user to the decider, with elevation unchanged? This does not reopen A: it resolves item 2's last clause against items 4 and 5 on the measured population.",
"options": [
"A: yes, attribution only. After a decision, a system run's nodes carry { isSystem: true, userId: DECIDER }, the shape the approvals verdict mirror already writes with; no grants are resolved and elevation is unchanged. This fixes HotCRM's four branches (items 4-5's named need) and showcase_invoice_signoff, keeps ADR-0073 D2, and keeps the attribution parity that AutomationContext.flowName's TSDoc declares (this PR had to qualify it). Cost: a system flow's post-decision updated_by, sys_audit_log user and ctx.user in hooks fired by those writes become the decider; HotCRM's opportunity hook guards key on ctx.user?.id being present, which stays true. Work: S, about 5 lines in resolveDecisionSegmentContext, the system control pin flips to an attribution pin, one sentence in the describe, changeset updated.",
"B: no, the letter as this PR implements it. System runs keep their trigger user after a decision. HotCRM's four branches name the submitter for good, because they cannot move to runAs:'user' (each writes a readonly: true column only a platform write lands), so this card never meets its named need. Work: none beyond this PR."
],
"recommendation": "A, on the four axes. (1) Actual business need, measured: every approval flow with a post-decision write is runAs:'system' (HotCRM 5/5; objectstack's showcase_invoice_signoff), while the user-posture half has no measured consumer with a post-decision write (showcase_budget_approval writes nothing after its decisions); B ships the ruled semantics with zero pull and leaves the named need unmet. (2) Long-term soundness: ADR-0073 D2 makes runAs an authorization posture that leaves attribution alone; A keeps one actor per segment under both postures, while B makes the posture decide attribution after a decision, against that record. (3) Preventing AI authoring mistakes: under B, the remedy item 3 prescribes for an approval that must write beyond the approver (declare runAs:'system') silently brings the submitter attribution back, a trap nothing in the metadata shows; A gives one rule: after a decision the decider is the actor, and runAs says only with whose rights. (4) Startup scope: neither adds a declared surface; A extends the ruled change to the second posture's attribution only. Item 2's text decides between them, so this is the maintainer's call; the dev did not implement A."
},
{
"question": "Does item 1's 'approval decision (approve or reject)' also reach the other human resumes: send-back (revise, and the revision-limit auto-reject it can become), resubmit and recall?",
"options": [
"A: no, the letter as this PR implements it. Only decide (approve/reject) hands a decider. A send-back keeps the run's identity; a recall continues as whoever the run last switched to (after a tier-1 approval by the manager, a rep's recall at tier 2 runs the reject branch as the manager). Work: none.",
"B: yes, every human resume carries its actor. sendBack and its auto-reject hand the approver, resubmit the submitter and recall the recaller (actingUserId(context) at four call sites in approval-service.ts), plus pins. Work: S."
],
"recommendation": "A for now, on the four axes. (1) Business need: no measured flow has a data node on those paths (HotCRM's approval flows declare no revise edge; showcase_budget_approval's revise edge leads straight into its revise window). (2) Long-term soundness: B is the coherent end state of 'the human whose act is running this segment' and is cheap to add when a flow pulls for it. (3) AI mistakes: A's corner (a recall continuing as an earlier decider) bites only a runAs:'user' multi-tier flow with a data node after the recall, and none exists. (4) Startup scope: A expands nothing. B is recorded as the follow-up shape."
}
],
"out_of_scope_findings": [
"carrier: none · noted, not filed: a strand journalled before this release carries no resumedBy, so its repair replay continues as the trigger user; a run paused before the release and decided after it does switch (PR Acceptance notes).",
"carrier: none · noted, not filed: a subflow-hosted approval switches the child run only; the parent declares no decision node and keeps its own context, per item 1's last sentence (PR Acceptance notes)."
],
"files_changed": [
".changeset/24321-resume-as-decider.md",
"content/docs/references/api/automation-api.mdx",
"content/docs/references/automation/flow.mdx",
"packages/plugins/plugin-approvals/src/approval-service.ts",
"packages/plugins/plugin-approvals/src/restored-approval-continuation.test.ts",
"packages/services/service-automation/package.json",
"packages/services/service-automation/src/engine.ts",
"packages/services/service-automation/src/resume-decider-identity.integration.test.ts",
"packages/services/service-automation/src/runtime-identity.ts",
"packages/services/service-automation/vitest.config.ts",
"packages/spec/src/automation/flow.zod.ts",
"packages/spec/src/contracts/automation-service.ts",
"pnpm-lock.yaml"
],
"line_budget": {
"additions": 847,
"deletions": 36,
"files": 13,
"against": "merge-base f4755a6"
},
"deviations": [
"PR body opens 'Part of #24321', not 'Fixes #24321': the card must not close while open question 1 decides whether its named need is met. If question 1 resolves B, the seat can switch the line to Fixes.",
"Published-surface widening beside the declared narrowing: ResumeSignal.resumedBy (@objectstack/spec/contracts), the resumedBy field on ApprovalResumeSurface's resume signal and on StrandedContinuationSignal (@objectstack/plugin-approvals), each a new optional member on a published interface. Clause-② kept as claimed, 'no (narrowing)', for the seat's re-grade.",
"Spec-lane surface beyond 'the flow.zod.ts describe only': packages/spec/src/contracts/automation-service.ts (ResumeSignal.resumedBy, plus the TSDoc of AutomationContext.userId and of the parity sentence under AutomationContext.flowName). The claim anticipated 'the ResumeSignal type if the decider rides it' under engine.ts, but the type lives in spec.",
"New devDependency @objectstack/plugin-sharing for service-automation (package.json plus 3 pnpm-lock.yaml lines) and a vitest source alias for it: a private object's write verdict belongs to record sharing, so the realistic fixture needs it. Neither file is in the claim's list.",
"The approvals pins went into the existing restored-approval-continuation.test.ts, on its already-pinned engine double, rather than a new file, so the engine-double ledger is untouched.",
"origin/main (11 commits, to f4755a6) was merged before the PR opened, per AGENTS.md section 10. Re-run at the merge head 37caa57: both packages' suites and typechecks, spec build + check:generated + typecheck + test, the real-door measurement and the full derived gate union.",
"The real-door measurement ran as a throwaway vitest file in packages/verify (outside the claim's surface), deleted after each run and never committed; the tree carries no trace.",
"Commit trailers use AGENTS.md's model-free pair (Claude-Session + Co-authored-by: Claude), not the harness reminder's model-named trailer; AGENTS.md takes precedence and the pre-push hook refuses a model id.",
"runtime-identity.ts is touched (SeededRunContext.triggerUserId, runTriggerUserId), within the claim's 'only if the switch needs it there': the switch needs the trigger kept apart from the segment's userId."
],
"spec_lane_files": [
"packages/spec/src/automation/flow.zod.ts (runAs describe and comment: ruling A item 2's sentence)",
"packages/spec/src/contracts/automation-service.ts (ResumeSignal.resumedBy; TSDoc of AutomationContext.userId and of the parity sentence under AutomationContext.flowName)",
"content/docs/references/automation/flow.mdx (regenerated by
pnpm --filter @objectstack/spec check:generated --fix, i.e. gen:docs)","content/docs/references/api/automation-api.mdx (regenerated, same run)"
],
"measurement": {
"hotcrm": {
"tree": "objectstack-ai/hotcrm 296167936b06 (pins @objectstack/* 18.0.0-next.3), read only",
"grants": "manager: sales_manager crm_opportunity { allowEdit, viewAllRecords, modifyAllRecords } (sales-manager.profile.ts:22), select row policy opportunity_private_owner_only (:117-:127, is_private == false || owner_id == current_user.id); rep: sales_rep crm_opportunity { allowEdit, readScope: own } (sales-rep.profile.ts:52); neither set has a field entry for any column below",
"table": [
"opportunity_approval approve | mark_approved | approval_status, approved_date | manager no: both readonly: true (opportunity.object.ts:485, :498) | rep no, same",
"opportunity_status_change_approval approve | apply_status | stage, status_change_approval_status, approved_date | manager: stage yes; the other two no, readonly: true (:549, :498) | rep: stage yes on own deals; the other two no",
"opportunity_status_change_approval reject | clear_request | status_change_approval_status, requested_status | manager: requested_status yes; verdict no, readonly: true (:549) | rep: requested_status yes on own; verdict no",
"opportunity_qualification_approval reject | clear_request | qualification_approval_status, qualification_requested | manager: qualification_requested yes; verdict no, readonly: true (:215) | rep: qualification_requested yes on own; verdict no"
],
"why_no": "objectql strips a static readonly column from every non-system UPDATE (packages/objectql/src/engine.ts:15548, if (!opCtx.context?.isSystem)); no permission set can grant it",
"runAs": "all four flows declare runAs: 'system' (opportunity-approval.flow.ts:57, opportunity-status-change-approval.flow.ts:70, opportunity-qualification-approval.flow.ts:72), as do account-approval (:75) and lead-conversion-approval (:66); under item 2 this PR changes none of them"
},
"attribution_after_change": "objectstack 37caa57, @objectstack/verify bootStack (requires automation, triggers, approvals, audit, sharing), private deal object, rep creates through POST /api/v1/data/OBJECT, manager decides through POST /api/v1/approvals/requests/ID/approve or reject, position-routed approval node, post-decision update_record. runAs user approve: updated_by rep then manager; sys_audit_log create by rep, update {approved_note} by manager; run completed; door 200. runAs user reject: updated_by rep then manager; update {requested_status} by manager; run completed; door 200. Control runAs system approve: updated_by stays rep; update {approved_note} by rep (what HotCRM's branches still read after this PR). Pre-decision flow node keeps the submitter: service-automation real-stack pin (submit node, updated_by rep).",
"refusal_when_right_missing": "Same harness, the manager's set marks restricted_note non-editable and the post-decision node writes it: nothing lands (updated_by stays rep, no update audit row); the run is recorded failed at post_approve with "Node 'post_approve' failed: update_record(OBJECT) failed: [Security] Field write denied: not permitted to edit [restricted_note] on 'OBJECT'"; the decision door answers 500 RESUME_FAILED with repairable: true, its message naming the request, the run, the node and the denial. Pinned in service-automation: status stranded, error naming after1 and restricted_note; the same node resumed with no decider lands as the rep."
},
"elevation_pull": [
"opportunity_approval approve / mark_approved: approval_status and approved_date are readonly: true, which only an elevated write lands; no permission set can grant it",
"opportunity_status_change_approval approve / apply_status: status_change_approval_status and approved_date are readonly: true (stage itself is within the manager's rights)",
"opportunity_status_change_approval reject / clear_request: status_change_approval_status is readonly: true (requested_status is within the manager's rights)",
"opportunity_qualification_approval reject / clear_request: qualification_approval_status is readonly: true (qualification_requested is within the manager's rights)",
"All four already declare runAs: 'system'. A finer, per-node elevation would let the ordinary fields go through the manager's own rights while the declared verdict and stamp columns land as platform writes."
]
}
Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
需裁:审批之后,system 流程的"最后修改人"写谁 ·
pm:dispatched→needs-user-decision·domain:services一号席 (#6021) ·marchtian·session_01Nk17Z26X5DB59iQztDBADH· 2026-10-19T12:28Z⛔ 这不是重开裁决 A。实测证伪了 A 的一个前提:A 的字面够不到它点名要修的 hotcrm 四个分支。所以按规程回决策箱,只裁 A 第 2 条与第 4、5 条在实测人群上的冲突。
一句话问题: 经理审批通过以后,hotcrm 商机上的"最后修改人"和审计日志仍记成提交的销售。原因是这四个分支,以及 hotcrm 全部 5 个审批流程,声明的都是
runAs: 'system',而裁决 A 第 2 条写明 "system 流程不变"。背景
6257886738)已按字面实现,在 PR feat(automation)!: an approval decision resumes a flow as the person who decided #24527 里(Part of #24321,draft,head37caa57a7,+847 −36)。runAs: 'user'的流程在审批决定之后,改以审批人的身份和权限继续运行。dev 报告6267118015里有真实接口的实测:批准和驳回之后,updated_by与审计行都从销售变成经理。runAs: 'system'的对照组仍记成销售。hotcrm 那四个分支看到的正是这个结果。Governing text
'system'flows are unchanged"。updated_byandsys_audit_logname the decider for the post-decision writes"。docs/adr/0073-automation-execution-identity.md:112):"runAsdeclares authorization posture, not identity",并且 "Attribution is always concrete"。flow.runAs仍是两个值。两个选项都只涉及 system 流程的署名。前提(每条带复查命令)
runAs: 'system'。复查:hotcrmcc0608c上grep -n "runAs:" src/sales/flows/*approval*.flow.ts,5/5 为'system'(opportunity-approval.flow.ts:57、opportunity-status-change-approval.flow.ts:70、opportunity-qualification-approval.flow.ts:72、account-approval.flow.ts:75、lead-conversion-approval.flow.ts:66)。runAs: 'user':每个分支都写一个readonly: true的审批状态列,而 objectql 会对每个非 system 的更新剥掉只读列。复查:objectstack5b14b7f3a上git grep -n "if (!opCtx.context?.isSystem)" -- packages/objectql/src/engine.ts,:15588。{ isSystem: true, userId: 审批人 }写入,也就是"system 权限,署名审批人"。复查:git grep -n "SYSTEM_CTX, userId" -- packages/plugins/plugin-approvals/src/approval-service.ts,:3188。showcase_invoice_signoff也是 system。runAs: 'user'那一半目前没有实测到有审批后写入的使用方。问题 1(主问题):审批决定之后,system 流程携带的署名用户是否也换成审批人(权限不变)?
{ isSystem: true, userId: 审批人 }运行,不解析权限、不改提权showcase_invoice_signoff的"最后修改人"、审计日志、写入触发的钩子里的ctx.user都变成经理resolveDecisionSegmentContext约 5 行,system 对照测试改成署名测试,说明文字加一句,changeset 更新;可并入 PR #24527推荐 A。
runAs定为"权限姿态,不是身份"。A 让两种姿态都满足"一段运行一个行为人":决定之后行为人就是审批人,runAs只说用谁的权限。B 让姿态反过来决定署名,与 D2 相背。两年后的形态参照 Salesforce:system 模式的字段更新,署名是审批人。runAs: 'system'")去做,署名会悄悄退回提交人,元数据上看不出来。A 只有一条规则,没有这个暗坑。ctx.user会变成审批人。hotcrm 商机钩子的守卫只判断ctx.user?.id是否存在,实测仍成立;别的应用钩子是否依赖ctx.user等于提交人,我看不到。问题 2(附带,一次裁清):打回、重新提交、撤回这三种人为恢复,是否也带上动作人?
runAs: 'user'、多级、撤回后还有数据节点的流程里才会出现,目前一个都没有。os-decision-facets
自检:只看①选 A;②③④ 是否翻转:否。
Prior rulings read: "system flow attribution user carried after approval decision decider updated_by runAs system" → 20 hits (none rules on a system run's attribution after a decision; nearest #24519 and #24497, the hand-built contexts, which are a different question); ADR-0073 D2; thread: 6257886738, 6257832932.
裁后执行
Fixes #24321,然后复核、落地,本卡随合并关闭。no (narrowing)重定为yes (narrowing):它给已发布的接口加了可选字段ResumeSignal.resumedBy(@objectstack/spec/contracts)和plugin-approvals的两个信号字段。contracts/**的改动在入队前向 spec 席申报。CONTRACT_REVIEW_TIER契约复核。Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
席位意见(增量 3 · 回箱问题:system 流程决定后的署名)· director seat (summon #43 continuation 5,
session_01QJC7i981TSs9L1CGJK59Ax), read as batch #372 item 1, 2026-10-19T12:41ZOn the
domain:servicesseat's return (6267218798): ruling A (6257886738) was built literally in PR #24527, and the measurement showed its item 2 (「'system'flows are unchanged」) leaves the hotcrm branches that items 4–5 name exactly as they were, because every approval flow with a post-decision write isrunAs: 'system'. Question 1: does a system flow's attribution user also become the decider after the decision (privileges unchanged)? Question 2: do send-back, resubmit and withdraw carry their actor too? The maintainer's words in this session's chat: 「开始决裁」. Under the maintainer's rule of this act (#24444) this delta recommends one option per question. This is a reading of ruling A on its measured population, not a reopening of it.Premises re-run in this act — objectstack
origin/main5b14b7f3, hotcrmorigin/maincc0608c0:runAsdeclares authorization posture, not identity」; attribution is always concrete. Holds.runAs: 'system'(account-approval.flow.ts:75,lead-conversion-approval.flow.ts:66,opportunity-approval.flow.ts:57,opportunity-qualification-approval.flow.ts:72,opportunity-status-change-approval.flow.ts:70), and they cannot become'user': each writes areadonly: trueapproval-state column, and objectql strips readonly columns from every non-system update (engine.ts:15588,if (!opCtx.context?.isSystem)). Holds.{ ...SYSTEM_CTX, userId: actorId }(plugin-approvals/src/approval-service.ts:3188). Holds — question 1's A is the shape the platform already uses one step earlier.37caa57a7, +847/−36) carries ruling A as written; its Clause-② re-grade (optional fields on a published contract) is the seat's procedural step. Holds.Facets: ① question 1 A — D2 separates posture from identity, so after the decision the actor is the decider under both postures and
runAsonly says whose privileges run; ruling A's item 2 was written before the population was measured, and its items 4–5 (the decider named on post-decision writes; hotcrm's four branches) are its purpose; B lets the posture decide the attribution, against D2, and leaves the named requirement unmet forever · ② every approval flow with a post-decision write is system (hotcrm 5/5, the showcase 1/1); the'user'half of ruling A has no measured consumer yet · ③ under B an author who follows item 3's own prescription (declare'system'when the approver cannot write the column) silently loses the attribution, invisible in metadata; A is one rule · ④ about five lines inresolveDecisionSegmentContext, the control test becomes an attribution test, folded into PR #24527. Question 2 A — no flow has a data node after send-back, resubmit or withdraw today; the one edge case (a user-posture, multi-level flow withdrawn after a first approval) does not exist; the four call sites carry their actor when a flow needs it.Recommend question 1 A · question 2 A. 口径: ruling A's item 2 reads, from this ruling on, 「
'system'flows keep system privileges; after the decision their attribution user is the decider」; items 4–5 are then met for hotcrm's branches andshowcase_invoice_signoff; PR #24527 takes the patch round and closes this card withFixes #24321; Clause-② re-graded as the seat states,contracts/**declared to the spec seat, contract review before the queue. Not taken: question 1 B (the named requirement unmet; a silent attribution hole behind item 3's prescription), question 2 B (tests for paths no flow uses).os-decision-facets
runAs只说用谁的权限;B 让姿态决定署名,与 D2 相背。问题 2 选 A —— 没有流程在那三条路径上有数据节点。自检:只看①选 A · A;②③④ 是否翻转:否。
objectstack-fleet commentedon Oct 19, 2026
Ruling: batch #372 item 1 · letters Q1 A · Q2 A (ruling A item 2 re-read on its measured population) · maintainer 「同意」 2026-10-19T12:55Z
Director seat, summon #43 continuation 5,
session_01QJC7i981TSs9L1CGJK59Ax, on thedomain:servicesseat's return question (6267218798; the director's delta 3 6267456613 recommended A · A) (opening marker #12708, comment 6247058702). The maintainer's words in this session's chat: 「同意」. Ruling A (6257886738) stands; this ruling reads its item 2 on the population the measurement found.What the ruling binds:
runAs: 'system'flow keeps system privileges and its attribution user becomes the decider: its post-decision nodes run as{ isSystem: true, userId: <decider> }, no permission resolution, no change to elevation — the shape the approval mirror already uses (approval-service.ts:3188). Ruling A's item 2 now reads 「'system'flows keep system privileges; after the decision their attribution user is the decider」; items 4–5 (the decider onupdated_byandsys_audit_log; hotcrm's four branches) are thereby met, andshowcase_invoice_signoffwith them.resolveDecisionSegmentContext, the system control test becomes an attribution test, one sentence in the docs, the changeset), its first line becomesFixes #24321, Clause-② is re-gradedyes (narrowing)for the optionalResumeSignal.resumedByand the two signal fields,contracts/**is declared to the spec seat, the PR stays a draft throughCONTRACT_REVIEW_TIER.Not taken: question 1 B (the named requirement unmet; a silent attribution hole behind item 3's prescription), question 2 B (tests for paths no flow uses).
Workload of the letters: one patch round on PR #24527.
Execution: the
domain:servicesseat (session_01Nk17Z26X5DB59iQztDBADH) runs the patch round; this card returns topm:dispatchedand closes with the merge.objectstack-fleet commentedon Oct 19, 2026
os-dev-report
{
"issue": 24321,
"status": "done",
"round": "patch round 1 (ruling 6267719791: Q1 A, Q2 A)",
"branch": "claude/issue-24321-resume-as-decider",
"pr": "#24527",
"head": "c17394ee557a1bf653988500254d3ba6a61e544b",
"merge_commits": [
"ac88da249 (origin/main 5b14b7f)",
"c17394ee5 (origin/main 04669a4, brings #24518 objectql hook peers)"
],
"session": "session_01Nk17Z26X5DB59iQztDBADH (mode:subagent, so this is the dispatching seat's id; the branch is this dev's identity)",
"premise_still_valid": true,
"summary": "Ruling 6267719791 Q1 A is in code: after an approval decision a runAs:'system' run keeps its elevation and its nodes run as { isSystem: true, userId: DECIDER }, with no grant resolved and the trigger user's forwarded grants removed, so updated_by, sys_audit_log and ctx.user in the hooks those writes fire name the decider. The decider is still honoured only beside RESUME_AUTHORITY_SERVICE, and a system run resumed with no decider keeps the user it carried. Q2 A needed no code (only approve and reject carry the decider). The runAs describe, the ResumeSignal / AutomationContext TSDoc and the approvals hand-off TSDoc now say so, the reference docs were regenerated by check:generated --fix, and the changeset is re-graded Clause-②: yes (narrowing). The real-door measurement on HotCRM's shape (runAs:'system', readonly approval_status / approved_date) now names the manager on updated_by and the audit row, with the readonly columns landing. The replacement PR body is at /tmp/claude-0/-home-user/c403cb8a-8460-5b17-9923-2cf4d6079655/scratchpad/issue-24321/pr-body-r1.md for the seat to write (first line Fixes #24321).",
"tests": "At c17394e: service-automation
pnpm test192 files / 2567 passed; plugin-approvalspnpm test81 / 1118 passed; specpnpm test701 / 21311 passed (1 todo); typecheck green for all three (check:test-typecheck OK, debt ledgers unchanged). resume-decider-identity.integration.test.ts: 21 pins (1.32 s of test time). New this round: envelope runAs:'system' approve and reject carry { isSystem: true, userId: usr_mgr, positions: [], permissions: [] } with no grant resolved and the forwarded grants removed; history keeps the trigger. Real stack, now with AuditPlugin: a guard that the readonly verdict column is stripped from the manager's own request; runAs:'system' approve and reject land verdict under unchanged elevation, with updated_by and the sys_audit_log row naming the manager; a system run with no decider keeps the rep; the runAs:'user' pins also assert the audit rows. The old system control became these attribution pins. restored-approval-continuation.test.ts: +2 pins (runAs:'system' approve/reject through the real ApprovalService and approval node: { userId: u1, permissions: [], isSystem: true }), 15 in the file.","ablation": "Round 1, the system half: scripts/ablation-replace.mjs replaced 'if (context?.userId === decider) return context;' with an early return that also fires for runAs 'system' (anchor 1 to 0; blob 019ddb6c6fd5 to 0a62cc66e57a). The suite imports the engine relatively from source, so no build or dist leg applies. Predicted red on exactly the four system attribution pins; observed 4 failed / 17 passed (envelope system approve and reject, real-stack system approve and reject; the system no-decider controls and the history pin green). Restored: blob == HEAD 019ddb6c6fd5, git diff HEAD empty. Round 0's reading stands: 8 failed / 6 passed, restored.",
"gates": "Local at c17394e, after the final commit:
node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstackderived 127 families; all 127 run, each ':: exit 0' (exit captured before any pipe);--ranexit 0: '127 derived, 127 run, 0 NOT-MEASURED, 0 UNRUN'. Local-only check:dev-prereqs exit 0. Changeset gates on the new text: check-adr-0087-registration --base origin/main exit 0 (not-required (no-migration-prescription), read as BREAKING+bang+clause-② narrowing); check-changeset-no-major and check-empty-changeset exit 0. spec check:generated --fix regenerated the one stale artefact (check:docs) and re-checked it green. CI on the new head is the seat's to read.","mcp_calls": "0",
"api_writes": "1 relay stroke this round: comment, i.e. POST /repos//issues/24321/comments (this report). Plus git push of the branch (not REST). The PR body is NOT written by this dev; the replacement is at /tmp/claude-0/-home-user/c403cb8a-8460-5b17-9923-2cf4d6079655/scratchpad/issue-24321/pr-body-r1.md (15047 bytes) for the seat, and the PR title should drop
runAs: 'user'to match the changeset: 'feat(automation)!: an approval decision resumes a flow as the person who decided'.","open_questions": [],
"out_of_scope_findings": [
"carrier: none · noted, not filed: a strand journalled before this release carries no resumedBy, so its repair replay continues as the trigger user (PR Acceptance notes).",
"carrier: none · noted, not filed: a subflow-hosted approval switches the child run only, per ruling A item 1's last sentence (PR Acceptance notes)."
],
"files_changed": [
".changeset/24321-resume-as-decider.md",
"content/docs/references/api/automation-api.mdx",
"content/docs/references/automation/flow.mdx",
"packages/plugins/plugin-approvals/src/approval-service.ts",
"packages/plugins/plugin-approvals/src/restored-approval-continuation.test.ts",
"packages/services/service-automation/package.json",
"packages/services/service-automation/src/engine.ts",
"packages/services/service-automation/src/resume-decider-identity.integration.test.ts",
"packages/services/service-automation/src/runtime-identity.ts",
"packages/services/service-automation/vitest.config.ts",
"packages/spec/src/automation/flow.zod.ts",
"packages/spec/src/contracts/automation-service.ts",
"pnpm-lock.yaml"
],
"line_budget": {
"additions": 994,
"deletions": 42,
"files": 13,
"against": "merge-base 04669a4",
"this_round_own_change": {
"additions": 198,
"deletions": 57
}
},
"deviations": [
"New devDependency @objectstack/plugin-audit for service-automation (package.json, 3 pnpm-lock.yaml lines, an anchored vitest source alias) so the permanent system pin reads the real sys_audit_log row rather than only updated_by. The round-0 devDependency @objectstack/plugin-sharing stands.",
"The system switch also removes the trigger user's forwarded positions, permission sets and peers from the system context, so
current_userin the segment is the decider and not the decider's id over the submitter's grants. No grant is resolved and elevation is unchanged, as ruled.","Beyond the asked engine pins, plugin-approvals' restored-approval-continuation.test.ts gained two runAs:'system' hand-off pins through the real ApprovalService and approval node.",
"TSDoc corrected where the change made it false, inside the claimed files: runtime-identity.ts (RunIdentityContext.userId and resolveRunDataContext's system arm) and approval-service.ts (ApprovalResumeSurface resumedBy).",
"Two merge commits this round, both through scripts/pm/os-regen-merge.sh (no rebase, amend or force-push): ac88da2 and c17394e. Main moved neither generated doc, so the script kept the branch's bytes and nothing needed regenerating from the merges.",
"The first start of this round's gate union was stopped (my own recorded PIDs) and re-run from scratch, because a comment-only flow.zod.ts edit had left packages/spec/dist stale and the re-created worktree lacked 21 package builds. Spec was rebuilt, the 21 were built, then the full union ran clean.",
"The changeset title now reads 'feat(automation)!: an approval decision resumes a flow as the person who decided', covering both postures; the PR title on GitHub still carries
runAs: 'user'and is the seat's to change.","The real-door measurement ran again as a throwaway vitest file in packages/verify, deleted after each run and never committed.",
"Commit trailers use AGENTS.md's model-free pair, not the harness reminder's model-named trailer."
],
"spec_lane_files": [
"packages/spec/src/automation/flow.zod.ts (runAs describe and comment: ruling A item 2, and item 2's new reading for 'system': system flows keep system privileges; after the decision their attribution user is the decider)",
"packages/spec/src/contracts/automation-service.ts (ResumeSignal.resumedBy and its TSDoc covering both postures; the TSDoc of AutomationContext.userId; the parity sentence under AutomationContext.flowName, now saying the acting user moves to the decider on both postures)",
"content/docs/references/automation/flow.mdx (regenerated by
pnpm --filter @objectstack/spec check:generated --fix, i.e. gen:docs)","content/docs/references/api/automation-api.mdx (regenerated, same run)"
],
"measurement": {
"harness": "objectstack c17394e, @objectstack/verify bootStack (requires automation, triggers, approvals, audit, sharing), private deal object with HotCRM's readonly approval_status and approved_date columns, rep creates through POST /api/v1/data/OBJECT, manager decides through POST /api/v1/approvals/requests/ID/approve or reject, position-routed approval node, post-decision update_record. Throwaway file, deleted.",
"system_approve": "updated_by rep then MANAGER; approval_status 'approved' and approved_date landed (elevation unchanged); sys_audit_log update {approval_status, approved_date} by MANAGER; run completed; door 200",
"system_reject": "updated_by rep then MANAGER; approval_status 'rejected' landed; sys_audit_log update {requested_status, approval_status} by MANAGER; run completed; door 200",
"user_approve": "updated_by rep then MANAGER; sys_audit_log update {approved_note} by MANAGER; completed; 200",
"user_reject": "updated_by rep then MANAGER; sys_audit_log update {requested_status} by MANAGER; completed; 200",
"user_refusal": "the manager's set marks restricted_note non-editable: nothing lands, updated_by stays rep, no update audit row; run failed at post_approve with "[Security] Field write denied: not permitted to edit [restricted_note] on 'OBJECT'"; door 500 RESUME_FAILED, repairable: true, naming the request, the run, the node and the denial",
"hotcrm_table": "unchanged from round 0 (objectstack-ai/hotcrm 296167936b06): all four post-decision nodes write a readonly column the manager cannot hold, so all four need elevation, and they declare runAs:'system'; under Q1 A they now keep that elevation and are attributed to the manager"
},
"elevation_pull": [
"opportunity_approval approve / mark_approved: approval_status and approved_date are readonly: true, which only an elevated write lands",
"opportunity_status_change_approval approve / apply_status: status_change_approval_status and approved_date are readonly: true (stage is within the manager's rights)",
"opportunity_status_change_approval reject / clear_request: status_change_approval_status is readonly: true (requested_status is within the manager's rights)",
"opportunity_qualification_approval reject / clear_request: qualification_approval_status is readonly: true (qualification_requested is within the manager's rights)",
"All four declare runAs:'system' and, under Q1 A, are now attributed to the decider. The pull is for a finer, per-node elevation that would let the ordinary fields go through the manager's own rights."
],
"pr_body_replacement": "/tmp/claude-0/-home-user/c403cb8a-8460-5b17-9923-2cf4d6079655/scratchpad/issue-24321/pr-body-r1.md"
}
Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
Elevation pull, recorded under ruling A item 3 ·
domain:servicesseat 1 (#6021) ·marchtian·session_01Nk17Z26X5DB59iQztDBADH· 2026-10-19T14:28Z. ⛔ Not a card, not a claim. Item 3 says: "if hotcrm's measurement shows a branch needs that, it is recorded on this card as the pull for a finer elevation later".The measurement, from the dev's reports
6267118015and6269555250, on hotcrm296167936b06(cc0608cre-read by the seat):readonly: truecolumn. objectql strips that column from every non-system update (packages/objectql/src/engine.ts,if (!opCtx.context?.isSystem)), so no permission set can grant it:opportunity_approvalapprove /mark_approved:approval_statusandapproved_date;opportunity_status_change_approvalapprove /apply_status:status_change_approval_statusandapproved_date(stageis within the manager's rights);opportunity_status_change_approvalreject /clear_request:status_change_approval_status(requested_statusis within the manager's rights);opportunity_qualification_approvalreject /clear_request:qualification_approval_status(qualification_requestedis within the manager's rights).runAs: 'system'. Under ruling6267719791Q1 A (PR feat(automation)!: an approval decision resumes a flow as the person who decided #24527), they keep that elevation, and their writes are now attributed to the manager.Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
os-dev-report
{
"issue": 24321,
"status": "done",
"round": "patch round 2 (contract review 6270059532 FAIL on one docs finding; rework 6270117310)",
"branch": "claude/issue-24321-resume-as-decider",
"pr": "#24527",
"head": "e5150923a095f4f77dcbc60486d1594fd2541a63",
"commits_this_round": [
"be9efd1c5 docs(automation): the flows guide states the decider's segment identity",
"e5150923a merge of origin/main 2667e24 (os-regen-merge.sh)"
],
"session": "session_01Nk17Z26X5DB59iQztDBADH (mode:subagent, so this is the dispatching seat's id; the branch is this dev's identity)",
"premise_still_valid": true,
"summary": "The review's one finding is fixed, and this round changes no code. In content/docs/automation/flows.mdx, the runAs row (:76) now mirrors the describe: 'system' is elevated and bypasses RLS, and after an approval decision its attribution user is the decider; 'user' is the default, RLS-respecting, the trigger user until a human decision and the decider after it, with the decider's permissions. The row's last sentence is unchanged. 'Who may resume' (:1090-:1091) now reads: the identity stored on the run, the user who started it or, after an approval decision, the decider. The trigger.userId caller gate after it is unchanged, and content/docs/ui/actions.mdx is untouched. The decider pin file's header (:44) now names restored-approval-continuation.test.ts. origin/main was merged through os-regen-merge.sh. The replacement PR body for the seat is at /tmp/claude-0/-home-user/c403cb8a-8460-5b17-9923-2cf4d6079655/scratchpad/issue-24321/pr-body-r2.md.",
"tests": "At e515092: resume-decider-identity.integration.test.ts 21/21 passed (its change this round is the header comment only). Full package suites were not re-run this round; this is a declared narrowing, because the round changes no code and main's six incoming commits (#24521, #24520, #24552, #24555, #24526, #24532) touch no package this PR changes. Last full readings, at c17394e: service-automation 192 / 2567, plugin-approvals 81 / 1118, spec 701 / 21311 (1 todo), typecheck green for all three. CI's Test Core runs them on the new head.",
"gates": "Local at e515092, after the final commit: the whole workspace was rebuilt first (
pnpm -r --filter './packages/**' buildunder the lock, command-exit 0; check:dev-prereqs exit 0).node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstackderived 127 families on the final diff; all 127 run, each ':: exit 0' (exit captured before any pipe);--ranexit 0: '127 derived, 127 run, 0 NOT-MEASURED, 0 UNRUN'. check-adr-0087-registration --base origin/main exit 0 after main's pre-mode exit (.changeset/pre.json). CI on the new head is the seat's to read.","mcp_calls": "0",
"api_writes": "1 relay stroke this round: comment, i.e. POST /repos//issues/24321/comments (this report). Plus git push of the branch (not REST). The PR body is NOT written by this dev; the replacement (16507 bytes) adds one round-2 line before 'Spec-lane files' and one acceptance note on the flows guide.",
"open_questions": [],
"out_of_scope_findings": [],
"files_changed_this_round": [
"content/docs/automation/flows.mdx (two sentences, the surface the rework extends: the runAs row at :76, and 'Who may resume' at :1090-:1091)",
"packages/services/service-automation/src/resume-decider-identity.integration.test.ts (header comment at :44)"
],
"line_budget": {
"this_round": {
"additions": 4,
"deletions": 4,
"files": 2
},
"pr_total_files": 14
},
"deviations": [
"Full package suites were not re-run this round. The round is docs and a comment only, main's incoming commits touch none of this PR's packages, and the decider pin file was re-run 21/21 at the new head. Last full readings are at c17394e.",
"The re-created worktree had no builds, so the whole workspace was built once under the lock (8m23s held) before the gate union, so that every dist-reading family measured fresh output."
],
"spec_lane_files": [
"unchanged this round; as round 1: packages/spec/src/automation/flow.zod.ts, packages/spec/src/contracts/automation-service.ts, content/docs/references/automation/flow.mdx, content/docs/references/api/automation-api.mdx"
],
"pr_body_replacement": "/tmp/claude-0/-home-user/c403cb8a-8460-5b17-9923-2cf4d6079655/scratchpad/issue-24321/pr-body-r2.md"
}
Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
ACCEPT → PR #24527 comment
6271934562·domain:servicesseat 1 (#6021) ·session_01Nk17Z26X5DB59iQztDBADH· 2026-10-19T16:29Z. Heade5150923a0. Contract review PASS6271787844atCONTRACT_REVIEW_TIER, after FAIL6270059532onc17394ee55. Every check on the head is green or a roster skip. It lands through the merge queue, andFixes #24321closes this card at the merge.Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
Landed ·
domain:servicesseat 1 (#6021) ·marchtian·session_01Nk17Z26X5DB59iQztDBADH· 2026-10-19T17:04Z. PR #24527 merged through the queue as1b4078077at 2026-10-19T17:03Z.Fixes #24321closed this card ascompleted.main:git merge-base --is-ancestor 1b4078077 origin/mainexits 0, and the control2667e2402exits 0. The PR heade5150923a0exits 1, as a squash merge should.pm:dispatchedis removed and the card is unassigned (marchtian). The read-back matched.6257886738): after approve or reject, arunAs:'user'run continues as the decider, with the decider's grants.6267719791Q1 A: arunAs:'system'run keeps system privileges, and its writes are attributed to the decider. hotcrm's four branches andshowcase_invoice_signoffare now attributed to the manager.6267719791Q2 A: send-back, resubmit and withdraw are unchanged.6271787844, ACCEPT6271934562, spec-lane declaration6269616435.6269649076. No card is filed.Generated by Claude Code