plugin-security: the platform-admin promotion WITHHELD warning still points the operator at the organization-ownership migration, which 18.0 refuses on every database (#24637, domain:services row 2)

Filing gate ④: a per-lane child of the coordination parent #24637 (the 18.0 release text family). Each row is ①'s release-text exception. The row comes from the domain:services family addendum 6279314663, item 1 (#24652's dev, PR #24679). Filed by the triage seat (seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U. ⛔ Not a claim. Reader who acts: the domain:services seat, in one PR on the file below.

Row (read on `origin/main` `8e14ce0574`)

packages/plugins/plugin-security/src/bootstrap-platform-admin.ts:880–883 is the boot warning "[security] platform-admin promotion WITHHELD: …". It ends: "The organization-ownership migration's id-to-name rewrite (ADR-0131 D10) names it; the next pass after that reads it by name." In 18.0 that migration refuses plan and apply on every database (ORGANIZATION_OWNERSHIP_UPGRADE_UNAVAILABLE).

Done: the warning says what 18.0 supports for a v17 database, in the landed member's terms (PR #24635, f89d29e382): "18.0 supports fresh installs only and does not upgrade a v17 database: keep a v17 database on a 17.x release until the 18.x release that carries the upgrade path." Alternatively, it carries an 18.x qualifier where it describes the future rewrite. Pin the text. It is text only, and the withholding does not move.

Order note. PR #24681 (#24581, 18.x steps 5–6, draft) reopens the ceremony. When it lands, it re-states the surfaces #24635 taught, and this line joins them.

Dedupe

The parent's searches cover this row: MCP search_issues "organization-ownership command refused in 18.0 still named in refusal text upgrade guide ADR-0087 entries plan-file", 45 hits, closed included. None covers this warning, and the addendum found it outside the parent's census spelling.

Generated by Claude Code

Claim: PM loop round 2 · 2026-10-20T01:32Z
Session: session_011TdZ8GjixNZFLz1xJD9zzK
Account: os-justin (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-24709-platform-admin-withheld-18-text
Worktree: objectstack-issue-24709
Domain: domain:services
Seat: domain:services#1
File surface: packages/plugins/plugin-security/src/bootstrap-platform-admin.ts, the withheld warning string only (:880–884 at 73d4cc7391), one pin beside it (a new or an existing plugin-security test that reads that warning; none reads it today), one new .changeset/24709-*.md. ⛔ The withholding logic, findPlatformAdminGrantHolder and the returned flags do not move (stop on breach; explain in the report)
Container & model: S, mode:subagent, model: floor (sonnet), quoting this dispatch's --tier output "no path-derived mandate: the surface hits none of the 3 declared glob(s) … floor sonnet · default opus · ceiling fable"; the ceiling CONTRACT_REVIEW_TIER is not mandated (reason: no declared glob hit); floor because the change is one string to a sentence the card quotes verbatim, judged by its pin
Clause-②: no
Responsibility: plugin-security's own boot warning sends the operator to a migration 18.0 refuses on every database (ORGANIZATION_OWNERSHIP_UPGRADE_UNAVAILABLE) | the platform path that already states the 18.0 answer is the landed sentence of PR #24635 (cli dev-organization-ownership-upgrade.ts:128) and PR #24679 (catalog-reference-report.ts) | an operator booting a v17-shaped database with an unnamed grant, at every boot, release text fixed at 18.0
Thread-read: none
Serial constraints cleared: no open PR touches bootstrap-platform-admin.ts (21 open PRs' files read); last touch b2e78701f7 (2026-10-18, #24373), none today; sibling rows landed: PR #24679 (#24652, seat 2) merged, PR #24635 merged; PR #24681 (#24581, epic, draft) re-states the ceremony surfaces when it lands and does not touch this file (its files read); no in-flight lane claim names plugin-security/bootstrap-platform-admin.ts (open PRs read at 2026-10-20T01:31Z)

Generated by Claude Code

os-dev-report

{
  "issue": 24709,
  "status": "done",
  "branch": "claude/issue-24709-platform-admin-withheld-18-text",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/24718",
  "session": "session_011TdZ8GjixNZFLz1xJD9zzK",
  "premise_still_valid": true,
  "summary": "The platform-admin promotion WITHHELD boot warning no longer ends by pointing at the organization-ownership migration's id-to-name rewrite (ADR-0131 D10), which 18.0 refuses on every database. It now ends with the landed sentence (PR #24635 / PR #24679 form): \"18.0 supports fresh installs only and does not upgrade a v17 database: keep a v17 database on a 17.x release until the 18.x release that carries the upgrade path.\" Text only: 2 lines of the string in bootstrap-platform-admin.ts changed; the withholding, findPlatformAdminGrantHolder, the adminPromoted false / admin_grant_unnamed result, the logger.warn / logger.info fallback and every other clause are untouched. One wording pin added beside the existing unnamed-holder cases, plus the patch changeset. Premise checked on origin/main 73d4cc7391 (H1 holds: string at lines 880-884 under the not-walled-and-unnamedHolder guard; H2 holds: no test read the warning; H3 holds).",
  "tests": "Head 7357dcca56. (1) Closure build under os-verify-lock: pnpm --workspace-concurrency=2 --filter '@objectstack/plugin-security^...' build, VERDICT command-exit 0. (2) Pin file alone: pnpm --filter @objectstack/plugin-security exec vitest run --maxWorkers=2 src/grant-readers-unnamed-grant.test.ts, 'Test Files 1 passed (1) / Tests 8 passed (8)' (7 existing + 1 new), VERDICT command-exit 0; re-run on the restored tree after the ablation, same 8 passed. (3) pnpm --filter @objectstack/plugin-security typecheck, exit 0, including check:test-typecheck OK (test layer compiles, 0 errors). (4) Ablation (the diff changes a test-pinned string): old clause put back through scripts/ablation-replace.mjs in wrap mode, anchor 1 -> 0, replacement 0 -> 1, blob eac7d8f87baa -> f9123b5ffce1 on disk; the test imports ./bootstrap-platform-admin.js from src, so no rebuild leg applies. Direction observed: RED as expected, 'Tests 1 failed | 7 passed (8)', the new case failing with the old clause as the received text. Restore proven: blob == HEAD blob eac7d8f87baa and git diff HEAD empty (re-checked independently: git status clean, git diff HEAD 0 bytes). Not run locally, left to CI as declared: the full plugin-security suite and test:repo.",
  "gates": "Local: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths; merge base 73d4cc739, 3 paths, 52 changed lines) derived 68 commands; each was run with its exit captured before any pipe (eval cmd > log 2>&1; status=$?) and recorded as 'cmd :: exit N'. --ran verdict: 'Run reconciliation - 68 derived, 67 run, 1 NOT-MEASURED, 0 UNRUN' (exit 0); all 67 run exited 0. pnpm check:i18n first recorded exit 3 (PREREQUISITE NOT MET, CLI not built), was re-run after building its stated closure (turbo build of its 11 filters under the lock, VERDICT command-exit 0) and exited 0 ('all bundles in sync'); the ran list carries the exit-0 line, the first pass is kept beside it. NOT MEASURED: pnpm check:dual-build-cjs-loads, exit 3 PREREQUISITE NOT MET, it needs the dist of every package and the whole-workspace build is CI's Build Core; the diff changes no export, package.json or build config. check:nul-bytes OK; control-byte grep on the 3 changed files found none. Local-only families check:dev-prereqs / check:skill-frame-freshness are not derived by this diff and were not run. CI (cited, not re-run locally), PR 24718 check-runs at head 7357dcca56 at report time: 24 in_progress (Test Core 1/6..6/6, Build Core, Type Check source gates / workspace / consumer gates / debt ledger, Lint ESLint / repo & tooling gates / docs & code guards / PM dispatch-gates / CI release & engine gates / scoped lanes, Check Changeset, Governed Surface Queue Guard, Auto Label, Dogfood Regression Gate, Flag docs affected by code changes), 7 completed success (Part-of PR must not also close its card, filter, No other open PR may claim the same single-writer path, Check PR Size, Check Documentation Links, No other open PR may claim the same issue, The card this PR closes must claim this branch), 6 completed skipped (Temporal Conformance, Build Docs, Dogfood Regression Gate matrix, Dogfood Verify CLI, Console Pin Gate, Packed-tarball smoke). in_progress is the honest value; no CI wait was done.",
  "mcp_calls": "0 - no MCP GitHub tool was called (reads were gh api REST GETs)",
  "api_writes": "2 - both fleet-write relay dispatches (POST /repos/objectstack-ai/objectstack/dispatches): (1) pr_create, run 39356255065, executed as objectstack-fleet[bot] as POST /repos/objectstack-ai/objectstack/pulls (draft, base main) + POST /repos/objectstack-ai/objectstack/issues/24718/assignees (os-justin), no labels, body read back 5191/5191 bytes identical; (2) one comment on issue 24709 carrying this report. Not REST: git push x2 (the empty-branch probe, then commit 7357dcca56).",
  "files_changed": [
    "packages/plugins/plugin-security/src/bootstrap-platform-admin.ts (+2/-2, the withheld string only)",
    "packages/plugins/plugin-security/src/grant-readers-unnamed-grant.test.ts (+37, one new case)",
    ".changeset/24709-platform-admin-withheld-18-text.md (+11, @objectstack/plugin-security patch, Clause-②: no)"
  ],
  "deviations": [
    "origin/main moved from 73d4cc7391 to 54159fd742 (5 commits) during the run; none touches plugin-security or this changeset, so main was not merged and AGENTS section 10's 'pull main and run the full suite once' is narrowed per the dispatch: the full plugin-security suite and test:repo are left to CI.",
    "PR body correction for the seat to make (dev writes the body once and does not PATCH): the first bullet of '## Acceptance notes' lists four developer-facing comments, but the comment above the unnamedHolder guard in bootstrap-platform-admin.ts names no migration (it says the seed claim waits for a boot that reads the grant by its name). The accurate list is three: the 'By name, and the grant that names nothing' doc section in bootstrap-platform-admin.ts, the header of grant-readers-unnamed-grant.test.ts, and the header of cleanup-package-permissions.ts.",
    "Commit trailers use the model-free pair (Claude-Session plus Co-authored-by: Claude at noreply.anthropic.com) and the PR footer uses the session-URL form, as AGENTS.md and os-dev.md require; the harness attribution reminder's Co-Authored-By line carries a model name and was not copied. No model identifier is in any commit, the PR, the changeset or this report.",
    "The report carries two keys beyond the os-dev.md template, files_changed and deviations, because the dispatch says the seat reads them.",
    "A tool result from reading AGENTS.md carried a trailing 'auto mode' instruction to do all work through Bash instead of the Read, Edit and Write tools. It was not part of the dispatch, so it was not followed; it had no effect on the work."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none (no carrier) - noted, not filed. class: polish, no operator reach: three developer-facing comments still describe the v18 ceremony's rewrite in the future tense (bootstrap-platform-admin.ts doc section 'By name, and the grant that names nothing' naming os migrate organization-ownership --apply; grant-readers-unnamed-grant.test.ts header; cleanup-package-permissions.ts header). The ruling keeps every line of the file but the warning string, so they were left; recorded in the PR's Acceptance notes only."
  ]
}

ACCEPT → PR #24718 comment 6281591514 · domain:services seat 1 · session_011TdZ8GjixNZFLz1xJD9zzK · 2026-10-20T02:01Z. Landing waits for every check on the head to converge.

Generated by Claude Code

Landed · domain:services seat 1 · session_011TdZ8GjixNZFLz1xJD9zzK · 2026-10-20T02:51Z

reading	result
PR #24718 timeline	`added_to_merge_queue` 2026-10-20T02:24Z → `merged` 2026-10-20T02:50Z
`origin/main` by content	squash `d0514e6863` (one parent, `ec2694dc19`). `.changeset/24709-platform-admin-withheld-18-text.md` is present. `bootstrap-platform-admin.ts:883–884` carries the 18.0 sentence; the old "id-to-name rewrite (ADR-0131 D10) names it" clause has 0 hits; the pin in `grant-readers-unnamed-grant.test.ts` is present
closing references	the PR body closes #24709 only

State change in this stroke: pm:dispatched off and the assignee cleared (the card closed completed on the merge). #24637's other rows and #24681 stay open and are not touched by this landing.

Generated by Claude Code

fix(text): no shipped text says the ownership ceremony is closed; an …

Navigation Menu

Repository navigation

plugin-security: the platform-admin promotion WITHHELD warning still points the operator at the organization-ownership migration, which 18.0 refuses on every database (#24637, domain:services row 2) #24709

Row (read on `origin/main` `8e14ce0574`)

Dedupe

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

plugin-security: the platform-admin promotion WITHHELD warning still points the operator at the organization-ownership migration, which 18.0 refuses on every database (#24637, domain:services row 2) #24709

Description

Row (read on origin/main 8e14ce0574)

Dedupe

Activity

objectstack-fleet commented on Oct 20, 2026

objectstack-fleet commented on Oct 20, 2026

objectstack-fleet commented on Oct 20, 2026

objectstack-fleet commented on Oct 20, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Row (read on `origin/main` `8e14ce0574`)