ADR-0139 D5.1 follow-up: once the ReadableIds leaf composes for a delegated caller, retire each consumer's 'delegated-caller' whole-read probe routing (plugin-audit gates, service-storage attachments) #25034

Activity

1. objectstack-fleet

   added

   area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guardsPermissions that actually hold — RLS/FLS, sharing model, write-path guards

   domain:services

   enhancementNew feature or requestNew feature or request

   pm:blocked

   priority:p3

   on Oct 21, 2026
2. objectstack-fleet commented on Oct 21, 2026

   

   objectstack-fleetBot

   on Oct 21, 2026

   ContributorAuthor

   More actions

   Unlock: pm:blocked → pm:queue

   Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-21T10:02Z. ⛔ Not a claim.

   Blocked-by: #25009: #25009 closed completed at 2026-10-21T04:38Z. No other blocker is named.

   ---

   Generated by Claude Code
3. objectstack-fleet

   added

   pm:queue

   pm:dispatched

   and removed

   pm:blocked

   pm:queue

   on Oct 21, 2026
4. objectstack-fleet

   assigned

   os-sales

   on Oct 22, 2026
5. objectstack-fleet commented on Oct 22, 2026

   

   objectstack-fleetBot

   on Oct 22, 2026

   ContributorAuthor

   More actions

   Claim: card thread · domain:services seat 1 (seat post #6021, project run by the Sales account) · p3, area:access · 2026-10-22T16:13Z
   Session: session_01RTeCSatTcP3SkMdpQumyfU
   Account: os-sales (the seat's linked user; the card's assignee)
   Branch: claude/project-thread-982vgc (the harness-pinned branch for this session; it names no issue, so the Duplicate Fix Guard's branch-name hint will not match. This claim is the identity record)
   Worktree: objectstack-issue-25034 (a linked worktree in this session's own container)
   Domain: domain:services
   Seat: domain:services#1 (seat post #6021)
   File surface (read on origin/main e58bd0e3e; stop on a breach and explain it in the report): packages/plugins/plugin-audit/src/parent-record-read-gate.ts (planParentReads, the ParentProbeClass / ParentReadPlan unions, the module header), packages/services/service-storage/src/attachment-access-hooks.ts (planAttachmentParentReads, WholeReadProbe, the read-gate docblock), the docblocks of activity-read-visibility.ts, audit-log-read-visibility.ts and comment-access-hooks.ts that name the class, the unit and integration pins of those gates in both packages, the two clauses of docs/qa/platform-checklist/areas/attachments-storage.json that list the delegated caller among D5's classes (a domain:devx path, declared in the PR), and one patch changeset for @objectstack/plugin-audit and @objectstack/service-storage.
   Container & model: M, card thread (in-session executor), model: default tier (dispatch-gates.mjs --tier: "no path-derived mandate … floor sonnet · default opus · ceiling fable"), effort: xhigh (set by the coordinator for this card)
   Clause-②: no
   Basis for the Clause-② line: no published accept set or public surface changes. The access answer for a delegated caller is unchanged (the security service's delegator intersection, ADR-0090 D10); only the mechanism moves from the bounded probe to the composed leaf, which ADR-0139 D5.1 (as amended by ruling 6303721609) already decided.
   Metadata-protocol: none
   Responsibility: n/a — not a defect card
   Thread-read: 6313299181
   Serial constraints cleared: #25009 (the engine composition) closed completed. No open PR touches packages/plugins/plugin-audit/, packages/services/service-storage/ or the checklist file (the ten open PRs' file lists, read just before this claim; the only hit is the Version Packages PR's CHANGELOG.md / package.json). #25107 is held behind PR #25198 and is not touched here.

   ---

   Generated by Claude Code
6. objectstack-fleet commented on Oct 22, 2026

   

   objectstack-fleetBot

   on Oct 22, 2026

   ContributorAuthor

   More actions

   os-dev-report

   {
     "issue": 25034,
     "status": "done",
     "branch": "claude/project-thread-982vgc",
     "pr": "https://github.com/objectstack-ai/objectstack/pull/25259",
     "session": "session_01RTeCSatTcP3SkMdpQumyfU",
     "premise_still_valid": true,
     "summary": "The parent-record read gates no longer route a delegated (on-behalf-of) caller to the bounded whole-read probe. This covers plugin-audit's activity, ledger and comment-thread gates (planParentReads) and service-storage's attachment gate (planAttachmentParentReads). They write such a caller the same ReadableIds leaves as any caller, and the engine composes those leaves from the delegator intersection (ADR-0139 D5.1 as amended by 6303721609; #25009). D5.2 (middleware-narrowed) and D5.3 (other-datasource) parents keep the probe, read under the delegated context, and the two whole-read states are unchanged. The isDelegatedCaller helpers and the 'delegated-caller' probe value are gone (neither is exported). The platform-checklist item attachments-storage.read-inherits-parent-rls goes to revision 7 to name D5's two remaining classes, and the changeset is a patch for both packages.",
     "tests": "plugin-audit 60 files / 985 passed; service-storage 62 files / 1131 passed (pnpm test in each package). New pins: 3 unit stand-ins (comment-thread-leaf, activity-read-visibility, attachment-read-leaf) and 3 real-engine suites (parent-record-read-leaf, comment-parent-pair, attachment-read-leaf integration). The real-engine suites give the security stand-in a delegator intersection that withholds 3 DOC records, and pin two things: (1) the delegated read is served exactly the intersection past the 2000-row window with a true count, through leaves for DOC and VAULT and probe branches only for GATED and FAR; (2) parity with the probe, where resolveReadableParentIds over every parent pair at rest equals the leaf-served set. ABLATION A: the old routing restored from e58bd0e3 turned all 10 new pins red. plugin-audit 7/96 failed: unit 'expected [ null ] to deeply equal [ crm_case, crm_deal, null ]' / 'expected [] to deeply equal [ crm_case, crm_deal ]'; integration 'expected [] to deeply equal ArrayContaining [e5_doc, e5_vault]'; parity 1764 or 1771 served vs 2299. service-storage 3/31 failed: 1758 vs 2299. ABLATION B: objectql dist readableIdsScopeOf handed {...chain.context, onBehalfOf: undefined} turned all 6 intersection and parity pins red, with withheld rows leaking (2302/2303 vs 2299). Both were restored, from HEAD and from a byte copy of dist.",
     "gates": "LOCAL: dispatch-gates --commands derived 72 commands, all run, every final exit 0; '--ran' answers '72 derived, 72 run, 0 NOT-MEASURED, 0 UNRUN'. Three first answered exit 3 on a prerequisite and were re-run to 0: check-plugin-teardown-shape --self-test (shallow clone; fixture commit fetched), check:dual-build-cjs-loads and check:i18n (full pnpm build). check:dts-closure, check:published-files, check:sourcemap-no-sources-content and check:lean-entry-closure were re-run to 0 after that build. Typecheck for both packages exit 0 (NODE_OPTIONS heap 8192); eslint --no-inline-config on the changed .ts files exit 0; both packages built, with check-dts-emitted green. CI on head b62709ac: 41 check runs, 0 failures. Success: Test Core (1-6/6 and aggregate), Build Core, TypeScript Type Check, Type Check workspace / debt ledger / consumer gates / source gates, Lint & Repo Gates, Lint ESLint / repo & tooling gates / CI, release & engine gates / docs & code guards / PM dispatch-gates / scoped tooling self-tests / scoped query-options erasure / scoped slot lookup & corpus, Check Changeset, Check PR Size, Dogfood Regression Gate, Governed Surface Queue Guard, the single-writer-path, same-issue, card-claims-branch and Part-of guards, Check Documentation Links, Flag docs affected, Auto Label, filter. Skipped (opt-in or path-scheduled): Console Pin Gate, Build Docs, Temporal Conformance, Dogfood Verify CLI, Dogfood Regression Gate shards, Packed-tarball smoke, 18.x upgrade harness.",
     "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
     "mcp_calls": "7 — reads only: mcp__github__issue_read x4 (get #25034, get_comments #25034 x2, get_comments #25095 for a serial-constraint read), mcp__github__pull_request_read x3 (get #25259, get_check_runs x2). No MCP write tool.",
     "api_writes": "5 relay writes (objectstack-fleet[bot], fleet-write dispatch): (1) run 39812060449, label-write.mjs on #25034: POST labels pm:dispatched, DELETE label pm:queue, POST assignees os-sales; (2) post-stamped.mjs claim comment 6345532716 on #25034; (3) run 39817640320, pr_create #25259 (draft) with POST assignees os-sales; (4) run 39817759945, pr_request_reviewers os-sales on #25259; (5) this report comment. git push is not a REST write.",
     "open_questions": [],
     "out_of_scope_findings": [],
     "deviations": [
       "Claim posted by this card thread itself, not by the seat (this project's card-thread practice, as on #25175/#25138).",
       "Branch is the harness-pinned claude/project-thread-982vgc, not claude/issue-25034-*; declared in the claim and the PR body.",
       "File surface: the claim named 'the two clauses' of attachments-storage.json. The same item's automated.ref and source[1] restate the same three-class list, so they were corrected too, with the item's revision bumped to 7 and a history entry added. Same file and same item, a domain:devx path declared in the claim.",
       "Lint was run with eslint over the changed .ts files rather than a whole-repo pnpm lint; CI Lint ESLint is green.",
       "Ablation B temporarily patched packages/objectql/dist (an untracked build artifact, outside the file surface) and restored it byte-for-byte from a copy."
     ]
   }

   ---

   Generated by Claude Code
7. objectstack-fleet

   closed this as completedin #25259on Oct 22, 2026
8. objectstack-fleet commented on Oct 22, 2026

   

   objectstack-fleetBot

   on Oct 22, 2026

   ContributorAuthor

   More actions

   Landed · domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · 2026-10-22T17:51Z

   reading	value
   PR #25259	MERGED through the queue (ACCEPT 6346976991)
   origin/main	carries 0f1eeeeeb7

   State: the card closed completed through Fixes; this stroke clears pm:dispatched and the assignee.

   ---

   Generated by Claude Code
9. objectstack-fleet

   removed

   pm:dispatched

   on Oct 22, 2026
10. objectstack-fleet

    unassigned

    os-sales

    on Oct 22, 2026