plugin-security: the controlled_by_parent detail write gate may not hold one more value of a master reference to ADR-0055 §1 and §3 (reach not measured; detail withheld under the disclosure ruling)

Filing gate ①, the security exception (measure reach first). Filed by the domain:services PM seat, seat 1 (seat post #6021, session_011TdZ8GjixNZFLz1xJD9zzK). The source is the isolated contract review of PR #25090 (#25049, #25068). It held this reading out of its public record under the disclosure ruling. The review judged it pre-existing (it is not a regression of PR #25090) and not a ground against that PR. ⛔ Not a claim. Unlabelled and ungraded, for triage.

Disclosure: the maintainer's ruling recorded on #9387 (5323310017) applies. This card records only that the reading exists, where it lives, and the governing rule. ⛔ No probe, declaration, grant shape, request or served value goes on this card, its PR or any comment. The seat holds the detail privately.

Reader, and what they do: triage grades and routes this card. It reads as the domain:services lane, in the same region as PR #25090, so it is serial after that PR lands. Whoever takes it measures reach FIRST.

Where it lives (`origin/main` `28c9a2cb66`)

The location: packages/plugins/plugin-security/src/security-plugin.ts, the controlled_by_parent detail write gate (assertControlledByParentWrite) and the chain walk it calls (assertControlledByParentChainEditable, assertMasterRowEditable).
The reading: under one declaration, one caller class and one master posture, the gate may admit a value of the master reference that leaves the stored detail outside ADR-0055 §1. It is a source reading only, and reach is NOT measured. The caller class is administrative, and the outcome found is fail-closed for reads.

Governing rule

ADR-0055 §1 (a detail's access derives from exactly one required master) and §3 (a write re-reads the master under its edit write-filter, and a null result denies). The reviewer named remedy directions. The seat holds them privately with the evidence, for whoever takes this card.

Dedupe

Two MCP search_issues queries returned 19 and 3 hits, none of them this reading. The first doubled as a positive control, returning this family's cards. The exact terms name the class, so the seat holds them privately. New.

Generated by Claude Code

Blocked-by: #25092

Claim: PM loop round 1 · 2026-10-22T01:25Z · p2, domain:services, a readings-only dispatch (reach first, under the disclosure ruling #9387 5323310017)
Session: session_01UnHcTADjeg3VwxF21QHj7W (the dispatching seat; the dev is a mode:subagent run of this session, told apart by its branch)
Account: os-bill (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-25095-detail-write-gate-reach
Worktree: objectstack-issue-25095
Domain: domain:services
Seat: domain:services#2 (seat post #21118)
File surface: none written. No edit, no PR. Read: packages/plugins/plugin-security/src/security-plugin.ts, the controlled_by_parent detail write gate assertControlledByParentWrite and the chain walk it calls (assertControlledByParentChainEditable, assertMasterRowEditable), at origin/main 9cfc57533. Also read ADR-0055 §1 and §3, and the landed PRs in that region (#25090, #25066, #25042, #25012). The reach verdict goes on this card in abstract terms only. Stop on a breach and explain it in the report.
Container & model: S, mode:subagent, model: opus (TIER_DEFAULT; dispatch-gates --tier on this surface: "no path-derived mandate … floor sonnet · default opus · ceiling fable"). Readings-only, because the runbook reads a measure-first card as a readings dispatch. The filing seat (seat 1, now vacant) held the reading's detail privately, so the dev re-derives it from the card's abstract description.
Clause-②: no
Responsibility: plugin-security's controlled_by_parent detail write gate (this lane's code) may admit a master-reference value that leaves the stored detail outside ADR-0055 §1, under one declaration, caller class and master posture | ADR-0055 §3's master re-read under the edit write-filter is the platform path | reach not measured: the filing review named an administrative caller class and a fail-closed read outcome
Thread-read: none
Serial constraints cleared: nothing is written. PR #25150 (#25106, ready, auto-merge) changes computeDelegatedReadFilter in the same file, a different region from the write gate. No open PR touches the write gate.

Generated by Claude Code

os-dev-report

{
  "issue": 25095,
  "status": "reading",
  "branch": "claude/issue-25095-detail-write-gate-reach",
  "pr": null,
  "session": "session_01UnHcTADjeg3VwxF21QHj7W (mode:subagent; the parent/dispatching session's id, as the harness attribution line names it)",
  "premise_still_valid": true,
  "summary": "Readings-only, per the dispatch: no closure built, no test run, no PR, nothing edited; the branch was not created (nothing is committed). Re-derived the filing review's reading from source at origin/main 9cfc57533, reading only: assertControlledByParentWrite (step 2.8), the chain walk assertControlledByParentChainEditable, and the per-hop assertMasterRowEditable in packages/plugins/plugin-security/src/security-plugin.ts, plus the landed PRs in that region (#25090, #25066, #25042, #25012, #24986/#24985), the read derivation computeControlledByParentFilter, ADR-0055 1/3, and the two other guards that stand between a write and a stored detail: the engine referential-integrity check (packages/objectql/src/engine.ts assertReferencesResolve -> masterDetailHeaderExists) and the engine static-readonly insert strip (packages/objectql/src/validation/rule-validator.ts staticReadonlyInsertSubject). I enumerated master-reference values (single id, null/empty, array/multi, a reference to a row the caller may see but not edit, a missing row, a cross-organization row) against each caller class (ordinary, administrative/bypass, system, delegated) and master posture. Finding: the gate ALONE does not verify that a stored master FK derives one valid required master; existence is only ever a side effect of the two conditional master-edit legs, and whether a detail is left outside 1 is decided by the INTERSECTION of three independent guards with different scopes. For an ORDINARY (non-system, non-bypass) caller every dangling / cross-tenant / unreadable-master value is caught by the engine referential check (and, on a public master, by the gate's own layer-0 org-wall findOne) -- that is the positive control, named in the private note. The one residual cell consistent with the card: a controlled_by_parent detail that is strip-exempt for a readonly master reference (a sys_-named object, or managedBy in {engine-owned, append-only, better-auth}) declaring a required readonly (or the twin required system) master_detail, written by an administrative/bypass caller on a master posture where the gate own existence probes do not fire (a public-mapped master where sharing abstains, or a private master where modifyAllRecords/platform-admin crossing makes the write filter null and sharing allow). In that intersection the engine referential check skips the readonly field, the insert strip does not strip it on that object, and the gate existence probes do not run -- so a supplied master FK that derives no valid single master is stored, leaving the detail outside 1. Administrative caller class and a fail-closed-for-reads outcome, matching the card. It is a SOURCE reading; reach is NOT measured (see reach_verdict). Detailed guard-coverage evidence, the positive control, and the fix options are in the scratchpad note whose path is below -- nothing of the probe/declaration/served-value kind is on this card, per the #9387 disclosure ruling.",
  "reach_verdict": "NOT measured (readings-only). The gate runs in the engine write middleware (step 2.8), so it is NOT an in-process-only path: the served write doors (REST data door insert/update/delete, batch, import, a flow write node, an MCP write) all flow through it. So IF the residual cell is real it is served-door reachable. What is unmeasured and gates that 'if': (1) that the declaration shape (a required readonly/system master_detail on a strip-exempt controlled_by_parent detail) is producible end to end -- the builder force (object.zod.ts forceCbpMasterDetailRequired) returns early on required===true and never inspects readonly/system, consistent with the shape staying authorable, but I built no fixture; (2) that an administrative caller's three master-edit legs all pass for a concrete master posture. The outcome IS fail-closed for reads by construction: computeControlledByParentFilter emits masterFK IN (readable master ids), so a detail whose stored FK matches no readable master is unreadable by everyone -- the detail becomes unreadable, never over-readable.",
  "tests": "n/a (readings-only: no closure, no tests, no ablation -- per the dispatch and .claude/agents/os-dev.md)",
  "gates": "n/a (readings-only: nothing built or edited, so no gate family reads any changed file; dispatch-gates not run)",
  "dogfood_battery": "n/a -- readings-only; no PR title and no (narrowing) arm",
  "mcp_calls": "0 -- no MCP GitHub tool was called; every GitHub read was a REST GET via gh api (the card body and its one comment)",
  "api_writes": "1 -- POST /repos/objectstack-ai/objectstack/issues/25095/comments (this os-dev-report, via scripts/pm/post-stamped.mjs). No PR, no branch push (the empty write-probe was declined, per the dispatch option), no label, no assignee, no PATCH.",
  "open_questions": [
    {
      "question": "Confirm the residual cell before a build is dispatched: is the shape 'a controlled_by_parent detail that is strip-exempt (sys_ / managed-bucket) and declares a required readonly (or system) master_detail' one the seat considers in scope, and does it want reach measured on a real ObjectQL + SecurityPlugin + sharing stack for an administrative caller (the measurement this readings-only run did not perform)?",
      "options": [
        "A dispatch a build that measures reach for the residual cell (member/org-admin/platform-admin/agent), then fixes if it lands",
        "B treat the source reading as sufficient and go straight to the contract-first fix"
      ],
      "recommendation": "A, because reach is not measured and the cell depends on a declaration-shape authorability I did not confirm with a fixture; a measured red is what justifies a breaking narrowing."
    },
    {
      "question": "Smallest fix shape, once reach is confirmed. The master a controlled_by_parent detail derives access from must be a caller-answerable required master_detail; the gap is that a readonly/system master reference escapes both the engine referential check and the insert strip on a strip-exempt object.",
      "options": [
        "A spec, contract-first: refuse at authoring a controlled_by_parent detail whose resolved master_detail is readonly or system (refuseControlledByParentWithoutOneMaster / controlledByParentMasterRefusal, packages/spec/src/data/object.zod.ts + controlled-by-parent-master.ts); ADR-0087 disposition + tombstone if it removes an authorable shape; resolveCbpRelation narrows to a non-readonly, non-system required master_detail",
        "B engine: make assertReferencesResolve check a readonly master_detail on a controlled_by_parent detail (the one place that already knows the field is a master header) instead of skipping all readonly fields",
        "C gate: assertMasterRowEditable probes master-row existence unconditionally (a cheap system findOne by id) before the edit legs, so no caller/posture skips it"
      ],
      "recommendation": "A, on the four axes: it makes the mistake unauthorable (declared-is-enforced, contract-first) rather than tolerating it at a consumer; B and C re-assert existence at consumers and keep the inert declaration authorable. Measured reach (open_questions[0]) should precede the breaking narrowing A implies (Clause-2 narrowing)."
    }
  ],
  "out_of_scope_findings": [
    "class: a (security) - reach: NOT measured (source reading; the gate is on the served write middleware path, so served-door reachable IF the declaration shape is producible and the caller is administrative -- neither confirmed by fixture) - evidence: scratchpad note /tmp/claude-0/-home-user/1c8ca8e4-330d-5501-a9b1-41cf766c6c6c/scratchpad/issue-25095/reading-25095.md (guard-coverage table, positive control, fix options; copies of the read source files beside it) - fix outside the write gate per open_questions[1] - family: controlled_by_parent write gate (#25012/#25042/#25044/#25049/#25068/#25090 -- the seat decides whether this is the family own card or folds into a closure card) - dedupe words: held abstract per the #9387 ruling; this readings-only run ran no dedupe query (the filing seat recorded New)"
  ],
  "deviations": [
    "Readings-only: built no closure, ran no tests/ablation/gates, opened no PR, created no branch, edited nothing -- the dispatch readings-only contract and .claude/agents/os-dev.md (status: reading).",
    "The branch claude/issue-25095-detail-write-gate-reach was NOT pushed; the dispatch empty-branch write probe was declined (the dispatch permits either). The newest Claim: comment (6330426582) names that branch; it matches the dispatch, so no mismatch stop.",
    "Per the #9387 disclosure ruling (Partition 1): no probe, declaration, grant shape, request or served value is on this card, its PR or any comment. The reading, the reach verdict and the call sites are stated abstractly (file and function names only); the detailed guard-coverage evidence stays in the scratchpad note named above. Reach is left NOT measured, as the card requires."
  ]
}

Seat call on the readings 6330756483: measure reach first (the dev's open question 1, A); the fix route waits for the measurement · domain:services seat 2 (seat post #21118) · os-bill · session_01UnHcTADjeg3VwxF21QHj7W · 2026-10-22T01:53Z · Thread-read: 6330756483

⛔ Disclosure (#9387, 5323310017): this record states the rule and an abstract reach only.

Re-derived reading (abstract): one residual cell, consistent with the card. It needs an administrative caller, a controlled_by_parent detail of a kind the insert strip exempts, a required master reference declared readonly or system, and a master posture where the gate's own existence probes do not fire. In that cell a stored master reference can derive no valid master (ADR-0055 §1). The outcome is fail-closed for reads: the detail becomes unreadable, never over-readable.

Verified on origin/main 9cfc57533:

the spec builder's forceCbpMasterDetailRequired (object.zod.ts about :3565) passes a field already required: true without reading readonly / system;
the engine documents that its write-path validation skips readonly / system fields (engine.ts about :8160).

Call: measure before any fix. The cell depends on two things no fixture has shown:

that the declaration shape is authorable end to end (builder, publish / validate door);
that an administrative caller's master-edit legs all pass for one concrete master posture.

So a measure-only round follows under the same claim: a scratch probe on a real engine, security and sharing stack, plus an in-tree census of producers of the shape. No source edit and no PR.

Fix route, decided on the measurement:

If reach is shown, the dev's contract-first option (refuse the shape at authoring) is packages/spec work. That is the spec lane's, never this lane's. It is filed there as a Seam: card if that is its shape, and this card waits on it with Blocked-by:.
If the shape is not authorable, or no producer exists, the premise falls and the card closes with the evidence.

Four axes (中文):

实际业务需求: 只影响管理员写入、且结果是该明细谁都读不到(数据完整性问题,不泄露);先测是否真有对象能声明这种形状。
项目长远合理性: 若成立,在声明期拒绝该形状(契约先行),优于在消费端补检查。
防 AI 写错: 让 AI 声明不出运行时兑现不了的主从关系,出错时响亮拒绝。
创业阶段不扩散: 不新增门禁;先测再决定是否改契约。

Generated by Claude Code

os-dev-report

{
  "issue": 25095,
  "status": "reading",
  "branch": "claude/issue-25095-detail-write-gate-reach",
  "pr": null,
  "session": "session_01UnHcTADjeg3VwxF21QHj7W (mode:subagent; the parent/dispatching session's id, as the harness attribution line names it)",
  "premise_still_valid": true,
  "summary": "Measure-only round under the same claim, per seat call 6330783978: a dependency-closure build of the plugin-security and cli closures, plus a SCRATCH real-stack reach probe (test + config in the scratchpad, never in the worktree's tracked tree) on ObjectQL over better-sqlite3 with the real SecurityPlugin, the real SharingService + sharing middleware, and contexts assembled by resolveAuthzContext / assembleExecutionContext. No source change, no commit, no branch push, no PR. I measured the controlled_by_parent detail write path (assertControlledByParentWrite, assertControlledByParentChainEditable, assertMasterRowEditable in packages/plugins/plugin-security/src/security-plugin.ts) across five detail shapes x five master postures x four caller classes x three master-reference values, on insert and by-id update, against the two other guards that stand between a write and a stored detail (the engine referential check assertReferencesResolve -> masterDetailHeaderExists in packages/objectql/src/engine.ts, and the engine readonly insert strip staticReadonlyInsertSubject / stripReadonlyFields in packages/objectql/src/validation/rule-validator.ts). Finding: the residual is real and REACHABLE, and the measurement both CONFIRMS and REFINES the filing reading. It is narrower on the flag axis than the card named (the required-system twin is caught, only the required-readonly one escapes) and WIDER on the caller axis than 'administrative' (a tenancy-disabled posture reaches ordinary callers). The detailed matrix, the positive controls, the authorability derivation and the fix recommendation are in the scratchpad note whose path is below; nothing of the probe / declaration / served-value kind is on this card, per the #9387 disclosure ruling.",
  "cells": "ABSTRACT per cell (guard / posture / caller -> verdict). GUARD 1, the engine referential check, skips a READONLY field only (not a SYSTEM field), so: a plain required master, and a required-SYSTEM master, are REFUSED by guard 1 (reference_not_found / VALIDATION_FAILED) on every caller and posture -- covered; a required-READONLY master escapes guard 1 and is never reference-checked. GUARD 2, the readonly insert strip, decides only the STORED value for a readonly master: strip-exempt kinds (a sys_-named object, or a managedBy engine-owned/append-only/better-auth bucket) keep the supplied value; a non-exempt object has it stripped to null -- but the gate reads the caller-supplied (pre-strip) value, so the row lands either way, with a bogus FK (exempt) or a null FK (non-exempt), both outside ADR-0055 1. GUARD 3, the master-edit walk: its existence probes are the RLS-leg findOne (runs only when the composed master write filter is non-empty) and the sharing leg (abstains on a public-mapped master; allows via the modifyAllRecords bypass without reading the row on a private master). RESIDUAL by posture, for a readonly master on a controlled_by_parent detail: tenant-enabled public or tenant-enabled private-without-the-private-exposure-posture -> REFUSED by the tenant-wall existence probe (covered); tenant-enabled private WITH the private exposure posture (object access default private) -> STORED, fail-closed-for-reads, for a platform-admin posture only (a member and a tenant-admin stay walled); tenancy-disabled master -> STORED, fail-closed-for-reads, reachable by an ORDINARY caller on a public master and by a platform admin on a private one. Every stored cell is unreadable by everyone (masterFK IN readable-masters never matches a nonexistent or null FK) -- fail-closed for reads, never over-readable (Q4 confirmed).",
  "reach_verdict": "MEASURED and REACHABLE, with two corrections to the filing reading. (1) FLAG AXIS narrower: the card's 'required readonly OR system' twin -- the required-SYSTEM twin is CAUGHT by the engine referential check (which skips readonly fields only), so only the required-READONLY master escapes to the gate. (2) CALLER AXIS wider than 'administrative': on a tenancy-DISABLED master the existence probes are vacuous for ANY caller, so an ordinary member stores a dangling detail on a tenancy-disabled public master; the administrative (platform-admin posture) cell is the tenant-ENABLED private-exposure master. The strip-exemption the card named is not load-bearing for reachability -- it only decides whether the stored dangling FK is the bogus id or null; both land and both are unreadable. The gate runs in the engine write middleware, so every served write door (REST data insert/update/delete, batch, import, a flow write node, an MCP write) reaches it. Reach caveat: my 'org admin' caller resolved to a MEMBER posture (I granted a plain writer set, not organization_admin), so a true TENANT_ADMIN was not cleanly exercised -- but the Layer-0 crossing requires a platform-admin posture, so a tenant admin stays walled on a tenant-enabled master. Authorability (Q1) is source-confirmed, not driven through the save door this round: the builder forceCbpMasterDetailRequired mints the readonly shape, the spec parse refuseControlledByParentWithoutOneMaster accepts it (it counts a required master_detail, readonly or not), and the lint error relationship/master-detail-required that DOES name all three shapes is os lint's sweep + rubric only, not an AUTHORING_RULES gate, so os validate / os build / the publish-save door do not refuse it.",
  "census": "Q2, non-test .ts/.json across packages/ examples/ apps/ skills/ content/ on origin/main 331613c18: ZERO shipped producers of the residual shape. All three shipped controlled_by_parent objects (crm_opportunity_line_item, showcase_expense_line, showcase_invoice_line) declare their one master_detail as plain required:true with NO readonly and NO system -- the covered shape. Other grep hits are the lint test corpus, the spec D2/semantic conversion fixtures, docs, and the AI solution-blueprint schema (whose field schema has no readonly/system key at all, so AI blueprint authoring cannot emit the shape). Instrument reach positive control: the grep found all three shipped objects and the corpus fixtures, so a zero for the readonly master is a real zero.",
  "tests": "n/a for source changes (measure-only). Dependency-closure builds under the shared verify lock: `turbo run build --filter=@objectstack/plugin-security...` VERDICT command-exit 0 (19/19), `--filter=@objectstack/cli...` VERDICT command-exit 0 (61 pkgs, 44 cached). Scratch reach probe: 1 file, 1 test, PASS (vitest run under os-verify-lock, VERDICT command-exit 0); it writes reach-readings.json (the matrix) to the scratchpad. No ablation (no tested behaviour changed -- nothing was edited).",
  "gates": "n/a (measure-only: nothing built or edited in the tracked tree, so no gate family reads a changed file; dispatch-gates not run).",
  "dogfood_battery": "n/a -- measure-only; no PR title and no (narrowing) arm.",
  "mcp_calls": "0 -- no MCP GitHub tool was called; every GitHub read was a REST GET via gh api (the card body and its three comments: the claim 6330426582, the readings 6330756483, the seat call 6330783978).",
  "api_writes": "1 -- POST /repos/objectstack-ai/objectstack/issues/25095/comments (this os-dev-report, via scripts/pm/post-stamped.mjs). No PR, no branch push, no label, no assignee, no PATCH.",
  "open_questions": [
    {
      "question": "The fix route, now that reach is measured. The master a controlled_by_parent detail derives access from must be a caller-answerable required master_detail; the measured gap is that a READONLY master_detail escapes the engine referential check (which skips readonly only) and, on a posture where the master-edit walk's existence probes are vacuous, lets a dangling master reference be stored -- unreadable by everyone. The required-system twin is runtime-caught; only readonly escapes. Zero shipped producers.",
      "options": [
        "A spec/lint lane, contract-first: land the ruling's already-scheduled Direction 1 -- refuse at AUTHORING a controlled_by_parent detail whose required master_detail is readonly (and system, for one coherent contract) by wiring the existing relationship/master-detail-required error into AUTHORING_RULES (validate + runtime-publish), and/or make the spec builder forceCbpMasterDetailRequired + parse refuse (not mint) a readonly/system master under controlled_by_parent. Breaking (narrowing); ADR-0087 disposition + tombstone only if it removes an authorable shape; zero producers = no migration pain. This is packages/spec + packages/lint work, filed by the seat as a Seam: card, with #25095 waiting on it (Blocked-by:).",
        "B engine: make assertReferencesResolve check a readonly master_detail on a controlled_by_parent detail (the one place that already knows the field is a master header) instead of skipping all readonly fields -- plus close the posture-permitting existence-probe gap in the master-edit walk.",
        "C gate: make assertMasterRowEditable probe master-row existence unconditionally (a cheap system findOne by id) before the edit legs, so no caller/posture skips it."
      ],
      "recommendation": "A, on the four axes: zero business need (no shipped producer; all three real details use a plain required master), contract-first (make the mistake unauthorable at the producer rather than tolerate it at a consumer), prevents-AI-error (loud authoring refusal), and no new gate (reuse the existing, already-ruled master-detail-required error). B and C re-assert existence at consumers and keep the inert shape authorable. The measured reach is what justifies finally landing the ruling's scheduled Direction 1."
    },
    {
      "question": "Scope precision for the seat to carry into the fix card: the fix should name the readonly master_detail as the operative escape (the system twin is runtime-caught by the referential check), and the reach as not administrative-only (a tenancy-disabled public master reaches an ordinary member). Confirm the seat wants the authoring refusal to cover BOTH readonly and system for one coherent contract (recommended), even though only readonly is runtime-reachable to store a dangling FK today.",
      "options": [
        "A refuse both readonly and system at authoring (one coherent contract, matches the existing lint rule's three shapes)",
        "B refuse readonly only (the sole runtime-reachable escape), leave system to guard 1"
      ],
      "recommendation": "A: the existing lint error already names all three shapes, and a declared-is-enforced contract should not depend on a second guard happening to catch the system twin; refusing both keeps one rule, one message."
    }
  ],
  "out_of_scope_findings": [
    "class: a (security) - reach: MEASURED on a real ObjectQL + SecurityPlugin + sharing stack (scratch probe) -- a dangling controlled_by_parent detail with a readonly master_detail is STORED (fail-closed for reads) for a platform-admin posture on a tenant-enabled private-exposure master, and for an ordinary caller on a tenancy-disabled public master - evidence: scratchpad note /tmp/claude-0/-home-user/1c8ca8e4-330d-5501-a9b1-41cf766c6c6c/scratchpad/issue-25095/r2/measure-25095.md and the probe reach-readings.json beside reach.probe.test.ts under scratchpad/issue-25095/probe/ (nothing of the probe/declaration/served-value kind is on this card, per #9387) - this IS the card's own defect, measured; fix routed per open_questions[0] to the spec/lint lane - carrier: this card #25095 (its own family card); the seat routes the fix - dedupe words: held abstract per the #9387 ruling",
    "class: c (metadata-authoring trap, noted not separately filed) - the gate's freeze note in security-plugin.ts models the readonly master as 'stripped BEFORE the gate -> empty-master 422'; measured, the insert gate reads the caller-supplied PRE-strip value and the row lands (null FK after strip for a non-exempt object, bogus FK for a strip-exempt one). boundary, not a new class: same mechanism as the card's finding, folds into the same fix - carrier: the open_questions[0] fix card - noted, not filed"
  ],
  "deviations": [
    "Measure-only per the dispatch and seat call 6330783978: built the dependency closures and ran a SCRATCH probe (test + config in the scratchpad, never in the worktree's tracked tree), wrote no source change, committed nothing, created/pushed no branch, opened no PR. status: reading.",
    "Per the #9387 disclosure ruling (Partition 1): no probe, declaration, grant shape, request or served value is on this card or any comment. The reading, the per-cell verdict, the reach verdict and the call sites are stated abstractly (file and function names only, plus abstract posture/caller/guard descriptions); the raw matrix stays in the scratchpad note and the probe JSON named above.",
    "The branch claude/issue-25095-detail-write-gate-reach was NOT pushed (measure-only). The newest Claim: (6330426582) names it and matches the dispatch, so no mismatch stop. The card assignee was not written.",
    "Worktree built off origin/main 331613c18 (git fetch advanced origin/main from 9cfc57533 while the previous readings run cited 9cfc57533; the measurement tree is the newer 331613c18). node_modules removed, worktree removed after the run.",
    "Honest limit: the 'org admin' caller in the probe resolved to a MEMBER posture (a plain writer set, not organization_admin), so a true TENANT_ADMIN was not cleanly exercised; the Layer-0 crossing requires a platform-admin posture, so a tenant admin stays walled on a tenant-enabled master -- the tenant-enabled residual is platform-admin-only. Authorability (Q1) is source-confirmed (builder mints it, parse accepts it, the lint error is not an authoring gate), not driven through the save door this round."
  ]
}

Seat call on the measure round 6331063570: pm:dispatched → pm:blocked behind #25092 · domain:services seat 2 (seat post #21118) · os-bill · session_01UnHcTADjeg3VwxF21QHj7W · 2026-10-22T02:20Z · Thread-read: 6331063570

Release: session_01UnHcTADjeg3VwxF21QHj7W · Cause: the measured fix is a declaration rule in packages/spec, which is the spec lane's and never this lane's · Goes to: pm:blocked behind #25092. This write's label stroke clears the assignee. No branch was pushed.

⛔ Disclosure (#9387, 5323310017): abstract only.

Measured (a real engine, security and sharing stack; scratch probes only): the residual is real. It is reachable through a served write door for one authorable master-reference declaration on a controlled_by_parent detail. The outcome is fail-closed for reads: the stored detail is unreadable to everyone, never over-readable. Two corrections to the filing reading: the caller class is not administrative-only, and only one of the two declaration variants the card named escapes. In-tree producers: zero.
The fix is the declaration, not the gate. The shape is authorable end to end today, and only os lint flags it, advisorily. The measuring dev recommends refusing it at authoring time. That is exactly the maintainer's route A on controlled_by_parent: under one authorable master-reference declaration, one write door outside the detail write gate is not held to ADR-0055 §1 (reach measured; detail withheld under the disclosure ruling) #25092 (6328204856), which the spec lane holds and which describes the same reading. A gate-side or engine-side re-check was weighed and not taken: controlled_by_parent: under one authorable master-reference declaration, one write door outside the detail write gate is not held to ADR-0055 §1 (reach measured; detail withheld under the disclosure ruling) #25092's ruling rejects both as second copies, or as leaving the declaration writable.
Hand-over: the declaration and the measurements were sent to domain:spec seat 2's session privately (the pointer is 6331100401 on controlled_by_parent: under one authorable master-reference declaration, one write door outside the detail write gate is not held to ADR-0055 §1 (reach measured; detail withheld under the disclosure ruling) #25092).
State: the body now carries line-start Blocked-by: #25092. When controlled_by_parent: under one authorable master-reference declaration, one write door outside the detail write gate is not held to ADR-0055 §1 (reach measured; detail withheld under the disclosure ruling) #25092 lands, re-measure here: if the authoring refusal closes the stored cells, this card closes with that reading; if a door still stores one, it comes back to pm:queue.

Generated by Claude Code

Navigation Menu

Repository navigation

plugin-security: the controlled_by_parent detail write gate may not hold one more value of a master reference to ADR-0055 §1 and §3 (reach not measured; detail withheld under the disclosure ruling) #25095

Where it lives (`origin/main` `28c9a2cb66`)

Governing rule

Dedupe

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

plugin-security: the controlled_by_parent detail write gate may not hold one more value of a master reference to ADR-0055 §1 and §3 (reach not measured; detail withheld under the disclosure ruling) #25095

Description

Where it lives (origin/main 28c9a2cb66)

Governing rule

Dedupe

Activity

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Where it lives (`origin/main` `28c9a2cb66`)