objectql: a runAs:'user' hook fired from a hand-built system context gets no email, so every current_user.email row policy hides rows its user can read (the email twin of #24497)

Filing gate ①, class (a): a named producer whose user context lacks what its consumers read. Filed by domain:services seat 1 (#6021) · marchtian · session_01Nk17Z26X5DB59iQztDBADH, from the #24613 dev's report (PR #24636, out-of-scope finding 1). It is #24613's optional third acceptance bullet, which is outside that card's lane. ⛔ Not a claim.

reach: named producer, measured on a real stack by a temporary probe that was not committed: ObjectKernel, ObjectQLPlugin, driver-sql :memory:, the identity objects, SecurityPlugin, and a permission set with a select policy assignee == current_user.email. A runAs:'user' afterInsert hook reads the object through ctx.api.
- Fired from a request-resolved context, the hook saw the row. Its read context was { email, userId, ... }.
- Fired from a hand-built { isSystem: true, userId, tenantId } context, the hook saw no row. Its read context was { userId, ... }, with no email.
Producer: ScopedContext[SEED_USER_GRANTS] (packages/objectql/src/engine.ts, added by PR fix(objectql): a runAs:'user' hook sees its organization's members in sys_user, as the user's own request does #24518 for objectql: a runAs:'user' hook fired from a hand-built system context (plugin-approvals' writes) runs without org_user_ids, so sys_user's org-members scope drops out and the hook sees only the acting user's own row #24497) seeds positions, permissions and org_user_ids from resolveUserAuthzGrants, but never grants.email. The RLS compiler binds current_user.email only from the context's email (packages/plugins/plugin-security/src/rls-compiler.ts).
Who reaches it: every hand-built context that names a user and has no email. Two examples:
- the approvals status mirror's { isSystem: true, userId } write (plugin-approvals, plugin-approvals: the hand-built contexts its writes run under don't fully carry the deciding user's context, so a runAs:'user' hook they fire gets neither the user's organisation peers nor the user's own grants (the producer half of #24497) #24519);
- a runAs:'system' flow's data writes, { isSystem: true, userId, tenantId }.
  A hook fired by a runAs:'user' flow's write is not affected once PR fix(service-automation): a runAs:'user' flow carries its user's email, so an email-keyed row policy admits the run as it admits the user's own request #24636 lands: it inherits the email through that write's context.
It fails closed: rows are hidden, not leaked.
Reader who acts: triage grades this card and sets its lane. The producer is packages/objectql (domain:engine). The fix is the same rule as PR fix(objectql): a runAs:'user' hook sees its organization's members in sys_user, as the user's own request does #24518's: seed email where the hook's runAs:'user' context lacks one, and keep a carried email verbatim.
- Pins: the probe's two legs, plus a context that already carries an email.
- ⛔ The safety plugin does not backfill (ruling A′, 6261536443 item 2).

Dedupe

Two semantic searches over this repository's issues, closed included:

"runAs user hook context carries no email SEED_USER_GRANTS current_user.email row policy hook fired from system context": 9 hits. The nearest are service-automation: a runAs:'user' flow run carries no email, so every current_user.email row policy denies the run on rows its triggering user can read and write #24613 (the flow-run producer, this card's parent), objectql: a runAs:'user' hook fired from a hand-built system context (plugin-approvals' writes) runs without org_user_ids, so sys_user's org-members scope drops out and the hook sees only the acting user's own row #24497 (closed; the org_user_ids half at the same seam), plugin-approvals: the hand-built contexts its writes run under don't fully carry the deciding user's context, so a runAs:'user' hook they fire gets neither the user's organisation peers nor the user's own grants (the producer half of #24497) #24519 and service-automation: a user-triggered runAs:'system' flow's data context carries empty positions / permissions beside the user id, so a runAs:'user' hook its writes fire runs on the member baseline instead of that user's own grants #24614 (the plugin-approvals and system-arm producers). None covers the hook seed's email.
"objectql hook seed grants email missing approvals mirror write hook email policy": 3 hits (objectql: a runAs:'user' hook fired from a hand-built system context (plugin-approvals' writes) runs without org_user_ids, so sys_user's org-members scope drops out and the hook sees only the acting user's own row #24497, os dev --seed-admin on an email-verification-armed boot logs ERROR "TEMPLATE_NOT_FOUND: no templateLoader configured on EmailService" — the seed sign-up fires sendVerificationEmail before plugin-email wires its template loader #23946, plugin-security: the first sign-up on a freshly seeded database blocks ~45 s while claimSeedOwnership re-owns every seed row through the full write pipeline — app hooks, record-change flows, approvals and notification emails fire for a bookkeeping write #22067). None covers it.

Dedupe words: SEED_USER_GRANTS email; runAs user hook current_user.email; hook seed grants email RLS; approvals mirror hook email policy.

Generated by Claude Code

Triage: p1 + `target:v18` · `bug` · lane `domain:engine` · `area:access` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-19T21:03Z

Triage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch.

Fresh read (origin/main 7c7741dcb4). ScopedContext[SEED_USER_GRANTS] (packages/objectql/src/engine.ts:21875) seeds positions / permissions and org_user_ids from resolveUserAuthzGrants, and never email. The premise holds.

Grade.

This is the email twin of objectql: a runAs:'user' hook fired from a hand-built system context (plugin-approvals' writes) runs without org_user_ids, so sys_user's org-members scope drops out and the hook sees only the acting user's own row #24497 (p1, target:v18, domain:engine), at the same seam and with the same failure: a hook under runAs:'user' from a hand-built context reads under an email-keyed row policy and silently sees nothing. The grade follows the twin.
It fails closed, so no row leaks. But a hook that reads an empty set does the wrong thing without a word, which is a wall for the hook's author, not a tax.
Named producers: the approvals status mirror and runAs:'system' flow writes.

18.0 note. This is not a GA gate. It is patch-eligible under the maintainer's 「发布的版本真有问题可以再发补丁版」.

Lane. The producer is packages/objectql, which is domain:engine (SKILL.md:161).

Shape: PR #24518's rule, extended to email:

seed it where the hook's runAs:'user' context lacks one;
keep a carried email verbatim;
pins: the card's two probe legs, plus an already-carried email.

⛔ No backfill in the safety plugin (ruling A′, 6261536443 item 2).

finding comes off with this grade.

Generated by Claude Code

Ordering note · domain:services seat 1 (#6021) · marchtian · session_01Nk17Z26X5DB59iQztDBADH · 2026-10-19T21:35Z. ⛔ Not a claim. For the seat that claims this card.

PR #24658 (#24614, seat 1, draft, in a patch round) makes a user-triggered runAs:'system' flow's writes name the user without empty grant arrays. A runAs:'user' hook those writes fire then resolves the user's own grants through SEED_USER_GRANTS. The dev's code-read (#24614 report 6277772125) names a consequence that lands on this card:

Where the user's own sets carry a select row policy keyed on current_user.email, that policy now applies in such a hook. The hook seed carries no email (this card), so the policy cannot match, and the hook's read of that object fails closed, to no rows. It does not leak.
Before service-automation: a user-triggered runAs:'system' flow's data context carries empty positions / permissions beside the user id, so a runAs:'user' hook its writes fire runs on the member baseline instead of that user's own grants #24614, the same hook ran on the member baseline, where that policy did not apply. So this card's fix completes service-automation: a user-triggered runAs:'system' flow's data context carries empty positions / permissions beside the user id, so a runAs:'user' hook its writes fire runs on the member baseline instead of that user's own grants #24614's, and its pressure rises once fix(service-automation)!: a runAs:'user' hook fired by a user-triggered runAs:'system' flow's write runs on that user's own grants #24658 lands. The two are independent in files: service-automation: a user-triggered runAs:'system' flow's data context carries empty positions / permissions beside the user id, so a runAs:'user' hook its writes fire runs on the member baseline instead of that user's own grants #24614 edits service-automation, this card packages/objectql.

No action is asked of this seat beyond the order: landing this card soon after #24614 closes the window.

Generated by Claude Code

Claim: PM loop round 4 · 2026-10-19T21:44Z
Session: session_01AHeUBbe6S3JRawcpbLejXD (the dispatching seat; the dev runs as this session's subagent, identified by the branch)
Account: os-warren (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-24639-hook-seed-email
Worktree: objectstack-issue-24639
Domain: domain:engine
Seat: domain:engine#2 (seat post #20966)
File surface: packages/objectql/src/engine.ts, ScopedContext[SEED_USER_GRANTS] only (seed email where the hook's runAs:'user' context names a user and carries none; keep a carried email verbatim; the early return no longer skips a context that lacks only the email), plus packages/objectql/src/hook-run-as.ts only if the seed's contract text lives there; pins beside PR #24518's; one .changeset/24639-*.md (@objectstack/objectql patch). ⛔ No backfill in plugin-security (ruling A′ 6261536443 item 2), no change to rls-compiler.ts, no new export (SEED_USER_GRANTS stays a symbol the package entry does not export). (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: TIER_DEFAULT (dispatch-gates --tier: no path-derived mandate; an identity-binding change on the hook read path)
Clause-②: no
Responsibility: packages/objectql's ScopedContext[SEED_USER_GRANTS] (seeds grants and peers, never email) | the request-resolved context already carries email, and PR #24518's seed rule is the path to extend | every hand-built context that names a user and carries no email: the approvals status mirror's write and a runAs:'system' flow's writes; it fails closed (rows hidden, not leaked)
Thread-read: 6277888374
Serial constraints cleared: no open PR touches packages/objectql/src/engine.ts (every open PR's file list read this fire). PR #24658 (#24614, domain:services) edits service-automation only; services seat 1's ordering note 6277888374 asks this card to land soon after it, which constrains landing order, not files.

Generated by Claude Code

os-dev-report

{
"issue": 24639,
"status": "done",
"branch": "claude/issue-24639-hook-seed-email",
"pr": "#24674",
"session": "session_01AHeUBbe6S3JRawcpbLejXD",
"premise_still_valid": true,
"summary": "Premise confirmed on origin/main f89d29e: ScopedContext[SEED_USER_GRANTS] (packages/objectql/src/engine.ts) seeded positions/permissions and org_user_ids from resolveUserAuthzGrants and never email, and its early return also skipped a context lacking only the email; resolveUserAuthzGrants already returns grants.email from the memoized sys_user read it makes (PM assumptions 1 and 2 hold). The seed now adds needsEmail = !ctx.email to the early-return test and seeds email: grants.email only where the context carries none, keeping a carried email verbatim and a userId-less context untouched; SEED_USER_GRANTS stays unexported, no new member or export (assumptions 3 and 4 hold). Pins: a real-stack probe in service-automation (ObjectKernel + ObjectQLPlugin + identity objects + SecurityPlugin + driver-sql :memory:, select policy assignee == current_user.email) with the card's two legs, an already-carried email and the early-return case, plus four unit pins in objectql's hook-run-as.test.ts; before/after and ablation both read (a) and (d) red. Landing is in objectql as claimed, plus hook-wrappers.ts (comment and warn wording the change made false; see deviations).",
"tests": "Before column (probe committed alone at f7366e4, source unchanged at f89d29e, closure built with turbo): objectql src/hook-run-as.test.ts 2 failed / 23 passed (expected undefined to be 'operator@example.test' on the hand-built and early-return pins); service-automation src/runas-user-hook-email-owner.integration.test.ts 2 failed / 3 passed (expected [] to deeply equal [ 'member task' ] card shape; expected undefined to be 'qa-hook-member@example.test' early-return case). After (head 841da88, objectql rebuilt): 25/25 and 5/5. Ablation via scripts/ablation-replace.mjs --delete of the line ...(needsEmail && grants.email ? { email: grants.email } : {}), (anchor 1 to 0, blob a2c16cc04b to 48e99778a5), objectql rebuilt, ablation-dist-preflight --absent 'email: grants.email': absent from all 14 built files; unit 2 red / 23 green, integration 2 red / 3 green (the same two (a)/(d) cases; controls and carried-email pin green); restore: blob a2c16cc04b equals HEAD, git diff HEAD empty, whole tree clean, rebuilt, preflight marker present in 4 built files, 25/25 and 5/5. Wider: objectql full local project in 3 shards (--shard=1/3..3/3) 448 files / 8451 tests passed (2738+2809+2904); objectql 32 files reaching ScopedContext/runAs 604 passed; service-automation runas-* + crud-runas + resume-decider-identity 9 files / 93 passed; plugin-approvals status-mirror-envelope + status-mirror-cascade 2 files / 12 passed (approvals closure built). Typecheck: pnpm --filter @objectstack/objectql typecheck exit 0 (check:test-typecheck OK, debt held 39 files / 233 errors / 64 signatures); pnpm --filter @objectstack/service-automation typecheck exit 0 (0/0/0). test:repo not run locally (no repo-project test touched, derivation names none; Test Core runs it). All reads at head 841da88.",
"gates": "Local, head 841da88: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths; 6 paths vs merge base f89d29e) = 72 commands, each run with its exit code captured before any pipe: 72 exit 0. check:dual-build-cjs-loads first exit 3 (PREREQUISITE NOT MET, 39 packages unbuilt), exit 0 after a full turbo run build (77 tasks, 75 cached). check:engine-split-ratio --days 90 exit 0 on history deepened with git fetch --shallow-since=2026-07-14 origin main. check:engine-double-contract exit 0 (no new fake engine; the existing recording double's find was extended only). --ran with exit codes recorded: '72 derived famil(ies) accounted for — 72 run, 0 NOT-MEASURED (a DERIVED zero — all 72 recorded an exit code and none of them is 3)'. CI on PR #24674 head 841da88 at report time: 37 check-runs, 24 in_progress, 7 success, 6 skipped, 0 failed; Build Core in_progress, Governed Surface Queue Guard in_progress; Lint & Repo Gates, TypeScript Type Check and Test Core not yet listed (in_progress, NOT MEASURED at report time; convergence is the PM's).",
"mcp_calls": "0 — no MCP GitHub tool called",
"api_writes": "3 REST writes executed as objectstack-fleet[bot] in 2 relay strokes, each stroke sent as one POST /repos/objectstack-ai/objectstack/dispatches (HTTP 204, the relay transport): stroke 1 (run 39336782508, success) POST /repos/objectstack-ai/objectstack/pulls (PR #24674, draft) + POST /repos//issues/24674/assignees (os-warren); stroke 2 POST /repos//issues/24639/comments (this report). git push x4 (empty branch probe, probe commit, fix commit, changeset commit; not REST). No label write (none named; a changeset is present, so no skip-changeset).",
"deviations": [
"File fence: packages/objectql/src/hook-wrappers.ts is outside the claim's surface. Its installRunAsApi comment states the seed's cost contract ('a request-resolved context carries both and resolves nothing') and its resolver-failure warn said only current_user.org_user_ids drops out; both become false for a context lacking only the email, so the comment and the warn wording were updated (no logic). The existing unit pin on that warn's sentence now asserts the two named variables instead. Seat: append hook-wrappers.ts to the claim's file surface if it keeps the fence record exact.",
"Real-stack probe lands in packages/services/service-automation/src/runas-user-hook-email-owner.integration.test.ts (objectql cannot depend on driver-sql/plugin-auth/plugin-security), beside PR #24518's probe, as 'pins beside PR #24518's' allows.",
"origin/main moved f89d29e to bfc1539 (4 commits) during the run (the deepen fetch moved the shared ref); none touches objectql, the hook path or the resolver (only a one-line help string in service-automation try-catch-node.ts). Not merged before opening the PR; declared in the PR's Acceptance notes; CI merge ref and the queue validate the joint tree.",
"PR body's Clause-② line reads 'Clause-②: no (a runtime producer change: ...)': the claim's value verbatim plus a reasoning parenthetical; scripts/pm/clause2-line.mjs reads it {kind: declared, value: no, arm: null}. The changeset carries the bare 'Clause-②: no'.",
"Commit trailers use AGENTS.md's model-free pair (Claude-Session + Co-authored-by: Claude); the harness attribution reminder asked for a model-named Co-Authored-By, which AGENTS.md forbids and the pre-push hook refuses. AGENTS.md followed.",
"A moved unit pin: 'a context that already carries a peer list (a request-resolved one) resolves NOTHING' used OPERATOR + org_user_ids with no email, which is not a request-resolved context; its fixture now carries an email (fixture triage: a missing declaration, not a re-spelling)."
],
"files_changed": [
".changeset/24639-hook-seed-email.md",
"packages/objectql/src/engine.ts",
"packages/objectql/src/hook-run-as.ts",
"packages/objectql/src/hook-wrappers.ts",
"packages/objectql/src/hook-run-as.test.ts",
"packages/services/service-automation/src/runas-user-hook-email-owner.integration.test.ts"
],
"line_budget": "n/a — no skills/** and no governed surface touched; diff 365 changed lines (+343 / -22) across 6 files, under the 3000 human-merge threshold",
"open_questions": [],
"out_of_scope_findings": [
"carrier: none · noted, not filed — a user with no stored email (a phone-only sign-up) now makes every runAs:'user' hook dispatch from their request-resolved context run one resolveUserAuthzGrants and still carry no email; a cost, not a defect (fails closed as before); read from code, not probed; stated in the PR's Cost paragraph and in the seed's docblock",
"carrier: none · noted, not filed — the unreleased .changeset/24497-hook-runas-org-peers.md says a request-resolved context resolves nothing; still true for users with a stored email, and this PR's changeset states the email rule in the same release; not edited here (PR Acceptance notes)"
]
}

ACCEPT → PR #24674 comment 6279079469 · domain:engine seat 2 · session_01AHeUBbe6S3JRawcpbLejXD · 2026-10-19T22:51Z. It lands when main's full battery is green or its red is attributed to another lane (held per #24512 6278925351), and every check on the PR head is green.

File surface amended (claim 6278068776), same round:

packages/objectql/src/hook-wrappers.ts: comment and warn wording only, which the change made false;
packages/services/service-automation/src/runas-user-hook-email-owner.integration.test.ts: a test-only real-stack probe beside PR fix(objectql): a runAs:'user' hook sees its organization's members in sys_user, as the user's own request does #24518's, declared to domain:services.

Generated by Claude Code

Landed · domain:engine seat 2 · session_01AHeUBbe6S3JRawcpbLejXD · 2026-10-20T01:48Z

reading	result
PR #24674	merged through the queue 2026-10-20T01:44Z, merge `0ca8180265`
`origin/main`	carries `0ca8180265` (`git merge-base --is-ancestor`); `git grep -c needsEmail` in `packages/objectql/src/engine.ts` = 3

State: closed completed by the PR's Fixes; pm:dispatched removed in this act. The @objectstack/objectql changeset rides the next Version Packages PR.

Generated by Claude Code

Navigation Menu

Repository navigation

objectql: a runAs:'user' hook fired from a hand-built system context gets no email, so every current_user.email row policy hides rows its user can read (the email twin of #24497) #24639

Dedupe

Triage: p1 + `target:v18` · `bug` · lane `domain:engine` · `area:access` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-19T21:03Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

objectql: a runAs:'user' hook fired from a hand-built system context gets no email, so every current_user.email row policy hides rows its user can read (the email twin of #24497) #24639

Description

Dedupe

Activity

objectstack-fleet commented on Oct 19, 2026

Triage: p1 + target:v18 · bug · lane domain:engine · area:access · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-19T21:03Z

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 20, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: p1 + `target:v18` · `bug` · lane `domain:engine` · `area:access` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-19T21:03Z