qa(checklist): records-forms.record-discussion-mentions — the recipient read-gating clause #24802 deferred until #24785's fix merged #24864

Activity

1. objectstack-fleet

   added

   domain:devx

   on Oct 20, 2026
2. objectstack-fleet commented on Oct 20, 2026

   

   objectstack-fleetBot

   on Oct 20, 2026

   ContributorAuthor

   More actions

   Claim: maintainer-directed dispatch (18.0 QA wave, the #24802 remainder)
   Session: session_01CfRDy7SuTfUqaTu2AEH2Hi
   Account: os-warren (the seat's linked user as GET /user answers it; always the card's assignee)
   Branch: claude/issue-24864-mention-clause
   Worktree: none — the author runs in its own cloud session checked out at origin/main 81120caac8 or later
   Domain: domain:devx (self-applied on the filing side, SKILL exception two: the card's body carries the three gate answers; triage may re-route)
   Seat: domain:devx#1 (nominal, the absent-line default — this is the 18.0 QA wave's dispatch session acting on the maintainer's direct instruction quoted on the card, not a lane seat)
   File surface: docs/qa/platform-checklist/areas/records-forms.json (stop on breach; explain in the report)
   Container & model: M, mode:cloud, model: opus (TIER_DEFAULT — dispatch-gates.mjs --tier on this surface reads "no path-derived mandate · floor sonnet · default opus · ceiling fable")
   Clause-②: no — the internal QA ledger and its runner protocol; nothing published
   Responsibility: n/a — not a defect card
   Thread-read: none
   Serial constraints cleared: the anchor #24579 (domain:devx, in flight) edits area files in rounds; whichever lands second merges main. The RUNNER rule 2 wait is over: #24785's fix PR #24794 merged as e5b3de06a6.
   Directed-by: the maintainer, verbatim 「同意建议的改进」, in Claude Code session session_01CfRDy7SuTfUqaTu2AEH2Hi, 2026-10-20 — the directive quoted on #24802, whose fourth clause this card carries.

   ---

   Generated by Claude Code
3. objectstack-fleet

   added

   pm:dispatched

   on Oct 20, 2026
4. objectstack-fleet

   assigned

   os-warren

   on Oct 20, 2026
5. objectstack-fleet commented on Oct 20, 2026

   

   objectstack-fleetBot

   on Oct 20, 2026

   ContributorAuthor

   More actions

   os-dev-report

   {
     "issue": 24864,
     "status": "done",
     "branch": "claude/issue-24864-mention-clause",
     "pr": "https://github.com/objectstack-ai/objectstack/pull/24869",
     "session": "session_01MRkuLGosywLTY6EMcP6fGK",
     "premise_still_valid": true,
     "summary": "records-forms.record-discussion-mentions goes to revision 5. New acceptance[9] (api oracle): an @mention notification reaches a mentioned user only when that user can read the comment's record, by user id or by email alike, and the author is never notified. It is stated at the level of #24794's Summary; the gate is at the producer and judged in each user's own envelope. Also added: steps[13] (stock single leg with an owner-only showcase_private_note against a readable showcase_account; walled cross-organization leg), fixtures.requires[2], knownGaps[2] (cross-organization leg needs a walled boot), and negative[6] (both directions). automated.ref names mention-recipient-gate.integration.test.ts and, per RUNNER rule 6, its layer: the engine (real kernel, ObjectQL, SQLite; plugin-security's read layer played by a middleware), so the pin scores the clause partial at most. QA-source #24783 acceptance[4] and a history row naming #24785 and #24794 were added. #24794 was verified merged (e5b3de06a6, an ancestor of the base 81120caac8). No step-by-step cross-organization reproduction is written.",
     "tests": "Live, stock showcase at 81120caac8, Tenancy: single, after pnpm build --concurrency=2 (76/76, os-verify-lock VERDICT command-exit 0). Sign-up answers 403 SELF_REGISTRATION_CLOSED (invite_only), so the member was minted via POST /api/v1/auth/admin/create-user, then changed its password; its activeOrganizationId is the default organization. As the member: GET showcase_private_note/ID 404, GET showcase_account/ID 200. As admin, three sys_comment creates, each 201: note mentioning the member by id; note by email; account mentioning the member by id plus the admin. Member inbox (GET /api/v1/notifications): exactly 1 collab.mention, for the account comment, actionUrl /showcase_account/ID, unreadCount 1; none for either note comment. Admin inbox: no collab.mention (3 seeded approval.requested rows only). Log: 2x '[audit] mention notification withheld' with reason cannot_read_source, the member's userId (the email mention resolved to it) and the commentId. The single leg is GREEN on current main, as expected. The cross-organization leg was not run (walled boot). Server stopped by process group 5799, port freed. No ablation: the diff changes no tested behaviour.",
     "gates": "On head 45f8e20b: node scripts/check-platform-checklist.mjs exit 0 (OK — 16 areas, 328 items). dispatch-gates --commands derived 13, all exit 0: check-ci-filter-parity, check-closing-keyword-parity (+ --self-test), check-comment-mask-corpus, lint check:doc-formula-expressions, check:cross-package-test-inputs, check:doc-authoring, check:driver-memory-census, check:gitlink-declared, check:nul-bytes, check:platform-checklist, check:refd-timer-probe, check:watch-hint-literal. dispatch-gates --ran exit 0: 13 derived, 13 run, 0 NOT-MEASURED (declared; exit codes in the PR body). CI check-runs on #24869: not yet reported at report time.",
     "mcp_calls": "2 — issue_read x2 (24864 get + comments); #24794's merge state was read with an unauthenticated REST GET, not MCP; no write tool",
     "api_writes": "2 — repository_dispatch to the fleet-write relay (pr_create #24869 with assignees [os-warren] and labels [skip-changeset], read back identical, run 39420159600 success); post-stamped.mjs issue comment on #24864 (this report)",
     "open_questions": [],
     "out_of_scope_findings": [
       "carrier: #24579 (wave anchor, checklist accuracy) · noted, not filed — records-forms.record-discussion-mentions knownGaps[0] and personas[1] say the mention target is 'a second signed-up user' (sys_user rows come from sign-up), but on a stock showcase boot at 81120caac8 POST /api/v1/auth/sign-up/email answers 403 SELF_REGISTRATION_CLOSED (audience posture invite_only). The second user is minted through POST /api/v1/auth/admin/create-user. The new steps[13] spells that out; knownGaps[0] and personas[1] are left to the anchor lane"
     ]
   }

   ---

   Generated by Claude Code
6. objectstack-fleet

   closed this as completedin #24869on Oct 20, 2026
7. objectstack-fleet

   removed

   pm:dispatched

   on Oct 20, 2026