Repository navigation
QA run · access-security.packaged-flow-write-door-parity (1/1) · ba4afcc2 · 2026-10-19 · 1 PASS / 0 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #24607
Description
Second-round 18.0 release-sweep re-test (maintainer-approved re-test on the release candidate; round 1 at 5b14b7f3, anchor #24579). This item was re-driven because #24518 (04669a4) changed runAs: 'user' permission seeding after round 1.
Environment fingerprint
- framework
ba4afcc2391922a86678bf5e47b1a0e4d2c87ff1;.objectui-sha4016370af3c9c9dafec2bc5299afd8e8079701b8 - app: a scratch copy of
examples/app-showcaseat that sha (packagecom.example.showcase; the packaged flowshowcase_urgent_task_alertis unchanged) - boot:
OS_PORT=47411 OS_LOG_LEVEL=info objectstack dev --ui --seed-admin -p 47411 -d file:(scratch)/data.db, 2026-10-19 14:27Z - persona: the seeded admin (holds manage-metadata, so any refusal is the package lock)
- sequential, one runner
Scope
- selector
access-security.packaged-flow-write-door-parity, revision 2. Judged 1 of 1.
Per-clause verdicts
| clause | verdict | oracle evidence (text) |
|---|---|---|
| step 1 capture | done | GET /api/v1/automation/showcase_urgent_task_alert stored; GET /api/v1/meta/flow/showcase_urgent_task_alert?layers=true shows _packageId com.example.showcase with the code layer populated |
| acceptance[0] /meta door refuses | pass | PUT /api/v1/meta/flow/showcase_urgent_task_alert (label + " qa") 403 NOT_OVERRIDABLE "provided by a managed package and is sealed against in-place edits"; with ?package=com.example.showcase it is 403 ITEM_LOCKED "that package is read-only, and its packaged base is locked" |
| acceptance[1] update door parity | pass | PUT /api/v1/automation/showcase_urgent_task_alert with the same modified definition 403 NOT_OVERRIDABLE, the same lock sentence |
| acceptance[2] delete door parity | pass | DELETE /api/v1/automation/showcase_urgent_task_alert 403 NOT_OVERRIDABLE "sealed against removal"; the flow still serves |
| acceptance[3] no residue, still fires | pass | the GET after the probes is byte-identical to the capture, so no restore was needed; POST /api/v1/data/showcase_task {priority:"urgent",...} produces a completed run at 14:33:44Z; /api/v1/automation/_status shows enabled:true, bound:true |
| negatives | hold | every refusal quotes the package lock, never a capability tier; the toggle door was not touched |
Derived item verdict: PASS (round 1 #24559: PASS, unchanged). Pin at this sha: packages/qa/dogfood/test/packaged-flow-write-door-parity.dogfood.test.ts 5/5.
Checklist-accuracy findings / fixture gaps
None.
Handover
None.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 19, 2026
Nothing to extract and nothing to park: every clause passed.
Generated by Claude Code