Demo staffing: an app has no way to declare the demo accounts its seed data is dealt to — every app re-writes a local "create users, assign positions, re-evaluate sharing" script (HotCRM has one; hotclm needs the same)

Filing class: ③ platform gap, filed at destination from an app ruling. Reader: domain:server / auth + sharing triage. Unlabelled, no assignee. Origin: objectstack-ai/hotclm#28, ruled D by the maintainer on 2026-10-25 (ruling comment objectstack-ai/hotclm#28 (comment)): "demo accounts are the platform's to create; the app only declares them".

Context

A metadata app's demo seed deals records to named people: hotclm's 120 contracts and 143 obligations go to Business Requester 1/2/3, the legal rows to Legal Counsel 1/2. The seed cannot create a user (by design — sys_user writes are refused by the ADR-0092 guard and a seeded row could not sign in anyway), so a fresh pnpm demo boots with exactly one account (the dev admin from maybeSeedDevAdmin), which holds no app permission set and sees an empty navigation. The operator must read the README, create five accounts in Setup with the names spelled exactly, then re-run the seed so the deferred owner_id references resolve. One mistyped character leaves the owner NULL with nothing but a deferred-reference ERROR in the boot log.

What apps do today

HotCRM wrote scripts/demo-staff.ts (its #640): POST /api/v1/auth/admin/create-user per person, sys_user_position rows, re-evaluate every active sharing rule, then sign in as each demo user and assert the three layers connect; localhost-only, idempotent, names kept in a file the stack config never imports so they never reach a real deployment. hotclm would be the second copy, hotsrm the third. The step every copy must get right is a platform-internal fact: plugin-sharing materialises grants from the record write hook, which returns early for isSystem writes, so seeded rows carry no grants until a rule is re-evaluated — "assign the position" alone is silently not enough.

The gap

There is no platform primitive for "the demo accounts this app's seed assumes". The platform already has the one-user version of it (maybeSeedDevAdmin mints a loginable admin on a dev boot) but nothing an app can declare.

What is asked

A declarative demo-staffing primitive, shape the platform's to choose, e.g. in the stack definition:

demo: {
  staff: [
    { name: 'Business Requester 1', email: 'requester1@demo.local', position: undefined, permissionSets: ['clm_requester'] },
    { name: 'Legal Counsel 1', position: 'legal_counsel' },
    …
  ],
}

applied by os dev / os demo (or the dev-admin seeding step) only on a local boot, idempotently: create through the auth door, assign positions / permission sets, re-evaluate sharing rules, verify each account can sign in and reach its navigation, refuse to run against a non-local URL. Seed datasets then resolve owner_id by name on the first boot, with no second run and no README step. The list must not be part of the built artifact (same discipline as HotCRM's demo-staffing.ts).

Verification checklist for the implementer: HotCRM scripts/demo-staff.ts's four steps, as measured there.

Dedupe

search_issues on this repo for demo accounts / staffing / seeded users: #25083, #24409, #14157, #14349, #15337 — all about the dev admin, SSO setup users or lock-out on seeded people directories; 0 about an app-declared demo staff list. objectstack#16712 (positions inserted after bootstrap do not resolve permissions) is adjacent and is the reason step 3 exists.

Not asked

No seeding of sys_user through datasets (§10 of hotclm's design and the ADR-0092 guard both forbid it; this primitive goes through the auth door).
No app-side script in hotclm while this is open (its AGENTS.md → Platform gaps); hotclm#28 is Blocked-by this card.

Triage: first grade — `enhancement` · `priority:p1` · `domain:spec` · `area:identity` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-25T11:55Z

⛔ Not a claim, ⛔ not a dispatch.

Ruled on [Decision] pnpm demo 开箱即用时没有任何账号能打开「我的合同」——要不要让脚本建账号，与 #11 第一问耦合 hotclm#28 (D): demo accounts are the platform's to create, and the app only declares them.
p1 by 「协议新增 p1」: the platform answer adds an authorable key (a protocol addition). Spec first, then the runtime.
Security boundary in the shape: metadata that mints sign-in-capable users must be dev/demo-only (the maybeSeedDevAdmin posture) and refused on any production boot. That guard is part of the spec PR, and the maintainer approves the shape there.

Generated by Claude Code

Claim: PM loop round 2
Session: session_01SHjswg4gueCJQMHKteQQJ4 (the card thread; seat session session_01K2Tat8JEt4AhLASV4V4QWE posts this claim)
Account: marchtian
Branch: claude/project-thread-r0v9yx
Worktree: objectstack-issue-25777
Domain: domain:spec
Seat: domain:spec#4 (seat post #18917)
File surface: packages/spec/src/stack* (demo staff key) + packages/cli/src/commands/dev.ts + packages/plugins/plugin-auth + packages/plugins/plugin-sharing (re-evaluation call) + tests + changeset
Container & model: M–L, mode:thread, model: default tier (dispatch-gates --tier: "no path-derived mandate", floor sonnet · default opus · ceiling fable), effort: xhigh (p1, security boundary)
Clause-②: yes
Metadata-protocol: added
Responsibility: n/a — not a defect card
Thread-read: 6397316789
Premise: holds (at main 5f5f0b42: no stack key declares demo accounts; only maybeSeedDevAdmin (plugin-auth) seeds one dev admin; no open PR names #25777)
Ruling-ref: hotclm#28 comment 6396320437 (letter D)
Serial constraints cleared: open PR #25626 (plugin-auth, multi-org Create User, baozhoutao) is in plugin-auth: ordinary concurrency, later lander merges.

Order: /mnt/project-files/spec-seat/orders/25777.md with _common.md (project files). Batch of six on the project owner's order 「你应该并发6」 (2026-10-25). Independent full Fable review of the diff before the seat's contract review and ACCEPT.

wip: demoStaff tests, generated artifacts, changeset (#25777)

fix(plugin-auth,spec,cli,runtime): address review of demoStaff (#25777)

fix(plugin-auth,spec): demoStaff review nits and gate findings (#25777)

fix(plugin-auth,cli): demoStaff gate findings from the full gate run (#…

os-dev-report
{
"issue": 25777,
"status": "done",
"branch": "claude/project-thread-r0v9yx",
"pr": "#25830",
"session": "session_01SHjswg4gueCJQMHKteQQJ4",
"premise_still_valid": true,
"summary": "A stack declares demoStaff: [{ name, email, position?, permissionSets? }] (strict entry; defineStack refuses an undeclared position or permission set and duplicate names or addresses, STACK_CROSS_REFERENCE_INVALID 422). On a local development boot plugin-auth creates each account after the dev admin through the operator provisioning ticket (sign-up door, verified, dev seed password), assigns position and sets in the Default Organization only, and AppPlugin defers its inline seed to kernel:bootstrapped so seed owner_id references resolve on first boot; idempotent. Every other boot creates nothing with an ADR-0112 code (403 not-development / migrate-and-exit / walled-posture / non-loopback-base-url, 428 no-prior-login, 503 unanswerable); os build deletes the key before objectstack.json. PM assumption 1 is refuted (plugin-sharing retired the isSystem skip; recipient-membership-recompute re-evaluates on a sys_user_position write), so no separate sharing re-evaluation step was added. Draft PR #25830 awaits the maintainer's shape approval (Tier H: spec + skills/**).",
"tests": "At ed03f3f under os-verify-lock: pnpm --filter @objectstack/spec test exit 0 (721 files, 21835 passed, 1 todo); pnpm --filter @objectstack/plugin-auth test exit 0 (195 files, 3704 passed, 10 skipped); pnpm --filter @objectstack/runtime test exit 0 (445 files, 7106 passed, 19 skipped); pnpm --filter @objectstack/cli exec vitest run --project unit exit 0 (332 files, 4848 passed); cli integration test/build-demo-staff-artifact.test.ts exit 0 (1 passed; run locally because the diff adds it); pnpm --filter @objectstack/{spec,plugin-auth,runtime,cli} typecheck exit 0 each; pnpm --filter @objectstack/spec check:generated exit 0. New tests: spec stack-demo-staff 14, plugin-auth demo-staff 14 (each gate clause code+status+reason) and demo-staff-provisioning 9 on a real kernel (sqlite: create, Default Organization assignment, sign-in, only the dev admin holds admin_full_access, idempotent, existing account untouched, no-membership failure, production 403 at info, migrate-and-exit 403, non-loopback 403, no prior login 428), runtime app-plugin.seed-demo-staff 6, cli build artifact 1 + serve contract 1. Smoke: os dev on examples/app-todo (temporary edit, reverted): first boot seeded task owner = Todo Helper 1, helper1@todo.example signs in with admin123, objectstack.json 0 hits.",
"gates": "node scripts/pm/dispatch-gates.mjs --commands on the final diff: 153 commands, all run on ed03f3f with exit codes recorded before any pipe: 153 exit 0. --ran: 153 derived famil(ies) accounted for, 153 run, 0 NOT-MEASURED (a DERIVED zero). Prerequisite dists built first so check:skill-examples, check:dual-build-cjs-loads, check:i18n-coverage measured. Earlier full runs (636410b, 67953e8) found and this PR fixes: check:llms-txt, check:quick-reference-counts, check:objectql-double-limit, check:engine-double-contract (pinned ledger --write), check-tenant-audit-census (+ self-test), and the cli unit pin test option-b-reader-acceptance. CI check-runs on #25830: not yet concluded at report time.",
"dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
"line_budget": {
"order_size": "M–L",
"insertions": 2000,
"deletions": 41,
"files": 36,
"by_kind": {
"source": "+816 -4",
"tests": "+1057 -2",
"generated_or_ledger": "+76 -14",
"docs_changeset_skill": "+41 -20",
"gate_script": "+10 -1"
},
"skill_md": {
"file": "skills/objectstack-platform/SKILL.md 488 → 488 lines (23301 → 23314 bytes)",
"package_sum": "4383 → 4383 lines"
}
},
"deviations": [
"Key spelled demoStaff (top-level, sibling of devLogins), not the card's sketch demo.staff[]; raised as maintainer decision 1 in the PR's 维护者速读.",
"Files beyond the plugin-auth/spec core, each forced by the feature or a gate: cli compile.ts and serve.ts (artifact scrub, hand-over), runtime app-plugin.ts (seed deferral), spec kernel/unmanaged-install.ts, scripts/check-stack-collection-maps.mjs, skills/objectstack-platform/SKILL.md (check-skill-top-level-keys), tenant-audit census docs, quick-reference.mdx and llms.txt counts, scripts/engine-double-contract.pinned.json, cli option-b pin test.",
"PM assumption 1 refuted by reading plugin-sharing (rule-hooks.ts RETIRED header, recipient-membership-recompute.ts on sys_user_position); no explicit sharing re-evaluation step.",
"Clause-②: yes kept verbatim from the order although the reviewer suggested the (widening) arm; the PR's ADR-0087 gate passed.",
"GitHub writes: 3 relay strokes against a budget of 3 that counts git push; the extra one is the Fable verdict comment the orders require.",
"main merged twice before opening: once at 85aabb3 and again at ed03f3f because main moved 8 commits and conflicted in llms.txt; full tests and all 153 gates re-run after the second merge.",
"The harness attribution reminder proposed a model-named Co-Authored-By trailer; commits use the model-free pair AGENTS.md and os-dev.md prescribe."
],
"files_changed": [
".changeset/25777-demo-staff.md",
"content/docs/getting-started/quick-reference.mdx",
"content/docs/permissions/tenant-audit-census.mdx",
"content/docs/references/index.mdx",
"content/docs/references/system/demo-staff.mdx",
"content/docs/references/system/index.mdx",
"content/docs/references/system/meta.json",
"docs/audits/2026-07-unknown-key-strictness-ledger.counts/system.md",
"docs/audits/2026-08-tenant-audit-write-call-sites.counts.md",
"packages/cli/src/commands/compile.ts",
"packages/cli/src/commands/serve-auth-demo-staff.contract.test.ts",
"packages/cli/src/commands/serve.ts",
"packages/cli/test/build-demo-staff-artifact.test.ts",
"packages/cli/test/option-b-reader-acceptance.pin.test.ts",
"packages/plugins/plugin-auth/src/auth-plugin.ts",
"packages/plugins/plugin-auth/src/demo-staff-provisioning.test.ts",
"packages/plugins/plugin-auth/src/demo-staff.test.ts",
"packages/plugins/plugin-auth/src/demo-staff.ts",
"packages/plugins/plugin-auth/src/walled-owner-verification-path.ts",
"packages/runtime/src/app-plugin.seed-demo-staff.test.ts",
"packages/runtime/src/app-plugin.ts",
"packages/spec/api-surface/system.json",
"packages/spec/authorable-surface/system.json",
"packages/spec/declaration-map/system.json",
"packages/spec/export-origins/system.json",
"packages/spec/json-schema.manifest/system.json",
"packages/spec/llms.txt",
"packages/spec/src/assembled-package-body.test.ts",
"packages/spec/src/kernel/unmanaged-install.ts",
"packages/spec/src/stack-demo-staff.test.ts",
"packages/spec/src/stack.zod.ts",
"packages/spec/src/system/demo-staff.zod.ts",
"packages/spec/src/system/index.ts",
"scripts/check-stack-collection-maps.mjs",
"scripts/engine-double-contract.pinned.json",
"skills/objectstack-platform/SKILL.md"
],
"mcp_calls": "4 — mcp__github__issue_read (#25777 get, #25777 get_comments x2, #16712 get); no write tool. Plus 1 non-GitHub harness call mcp__claude-code-remote__subscribe_pr_activity (#25830). The review subagent was told not to use mcp__github__ tools.",
"api_writes": "3 — each a POST /repos/objectstack-ai/objectstack/dispatches (fleet-write relay, as objectstack-fleet[bot]): pr_create #25830 (run 40219215428, body read back identical, assignee marchtian); issue comment 6401184564 on #25830 (Fable verdicts); this os-dev-report comment on #25777. git push is not REST.",
"fable_review": {
"verdict_comment": "6401184564",
"url": "#25830 (comment)",
"passes": [
"whole diff: REQUEST-CHANGES",
"7c1034383: APPROVE-WITH-NITS",
"636410bc4: APPROVE",
"67953e839: APPROVE"
]
},
"open_questions": [],
"out_of_scope_findings": [
"class: a · reach: exception: security (may leak data) · evidence: os build of a stack with a callable writes dist/objectstack-runtime.HASH.mjs, which bundles the authored objectstack.config.ts module (packages/cli/src/utils/build-runtime.ts generateEntrySource); measured for demoStaff: the demo address appears in the .mjs (1 line) and not in objectstack.json; devLogins (email + password) and data are carried by the same mechanism, not measured separately · dedupe words: runtime bundle config text, devLogins password build artifact, objectstack-runtime mjs authored config",
"carrier: none — noted in the PR's Acceptance notes; for the seat to file"
],
"maintainer_decisions_in_pr": {
"where": "PR #25830 body, 维护者速读 → 你要做的 (the triage puts shape approval on the spec PR)",
"items": [
"Stack key name — recommended: A, because top-level stack keys are flat and devLogins, the nearest sibling, already sits there; B adds a namespace with one member.",
"Dev-only config text inside the runtime module — recommended: B as a separate card, because devLogins carries passwords and the same path carries them; this PR keeps objectstack.json clean.",
"Seed deferral prints plugin-security's PROVISIONAL WARN at kernel:ready on boots that create demo accounts — recommended: A, because it only appears on dev boots that declare demoStaff and the settlement is correct.",
"Refusal is skip-and-log, not a failed boot",
"Shared dev seed password; password refused in the schema",
"Walled postures always refused",
"Listing demo accounts in the os dev banner left out"
]
}
}

Generated by Claude Code

docs(quick-start): name demoStaff among the stack keys that configure…

fix(scripts): allow-list demo-staff.ts in check:authz-resolver with i…

os-dev-report
{
"issue": 25777,
"status": "done",
"branch": "claude/project-thread-r0v9yx",
"pr": "#25830",
"session": "session_01SHjswg4gueCJQMHKteQQJ4",
"premise_still_valid": true,
"summary": "A stack declares demoStaff: [{ name, email, position?, permissionSets? }] (strict entry; defineStack refuses an undeclared position or permission set and duplicate names or addresses, STACK_CROSS_REFERENCE_INVALID 422). On a local development boot plugin-auth creates each account after the dev admin through the operator provisioning ticket (sign-up door, verified, dev seed password), assigns position and sets in the Default Organization only, and AppPlugin defers its inline seed to kernel:bootstrapped so seed owner_id references resolve on first boot; idempotent. Every other boot creates nothing with an ADR-0112 code (403 not-development / migrate-and-exit / walled-posture / non-loopback-base-url, 428 no-prior-login, 503 unanswerable); os build deletes the key before objectstack.json. PM assumption 1 is refuted (plugin-sharing retired the isSystem skip; recipient-membership-recompute re-evaluates on a sys_user_position write), so no separate sharing re-evaluation step was added. Draft PR #25830 awaits the maintainer's shape approval (Tier H: spec + skills/**). Head is now 7a2e7a8: CI on #25830 is green and the PR is mergeable (clean); it waits on the maintainer.",
"tests": "At ed03f3f under os-verify-lock: pnpm --filter @objectstack/spec test exit 0 (721 files, 21835 passed, 1 todo); pnpm --filter @objectstack/plugin-auth test exit 0 (195 files, 3704 passed, 10 skipped); pnpm --filter @objectstack/runtime test exit 0 (445 files, 7106 passed, 19 skipped); pnpm --filter @objectstack/cli exec vitest run --project unit exit 0 (332 files, 4848 passed); cli integration test/build-demo-staff-artifact.test.ts exit 0 (1 passed; run locally because the diff adds it); pnpm --filter @objectstack/{spec,plugin-auth,runtime,cli} typecheck exit 0 each; pnpm --filter @objectstack/spec check:generated exit 0. New tests: spec stack-demo-staff 14, plugin-auth demo-staff 14 (each gate clause code+status+reason) and demo-staff-provisioning 9 on a real kernel (sqlite: create, Default Organization assignment, sign-in, only the dev admin holds admin_full_access, idempotent, existing account untouched, no-membership failure, production 403 at info, migrate-and-exit 403, non-loopback 403, no prior login 428), runtime app-plugin.seed-demo-staff 6, cli build artifact 1 + serve contract 1. Smoke: os dev on examples/app-todo (temporary edit, reverted): first boot seeded task owner = Todo Helper 1, helper1@todo.example signs in with admin123, objectstack.json 0 hits.",
"gates": "node scripts/pm/dispatch-gates.mjs --commands on the final diff: 153 commands, all run on ed03f3f with exit codes recorded before any pipe: 153 exit 0. --ran: 153 derived famil(ies) accounted for, 153 run, 0 NOT-MEASURED (a DERIVED zero). Prerequisite dists built first so check:skill-examples, check:dual-build-cjs-loads, check:i18n-coverage measured. Earlier full runs (636410b, 67953e8) found and this PR fixes: check:llms-txt, check:quick-reference-counts, check:objectql-double-limit, check:engine-double-contract (pinned ledger --write), check-tenant-audit-census (+ self-test), and the cli unit pin test option-b-reader-acceptance. CI check-runs on #25830: not yet concluded at report time. CI after the PR opened: the lint lane Single authz resolver guard (pnpm check:authz-resolver, a gate outside the 153 derived) went red on ed03f3f because demo-staff.ts queries both grant tables; fixed in 7a2e7a8 by the gate's own prescribed remedy, an ALLOW entry with its reason (it reads one literal row per insert for idempotency and builds no context). On 7a2e7a8 every check-run concluded success or skipped (48 runs: Lint & Repo Gates, TypeScript Type Check, Test Core 1-8/8, Build Core, Build Docs, Governed Surface Queue Guard, Check Changeset and the rest).",
"dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
"line_budget": {
"order_size": "M–L",
"insertions": 2014,
"deletions": 44,
"files": 38,
"by_kind": {
"source": "+816 -4",
"tests": "+1057 -2",
"generated_or_ledger": "+76 -14",
"docs_changeset_skill": "+41 -20",
"gate_script": "+10 -1"
},
"skill_md": {
"file": "skills/objectstack-platform/SKILL.md 488 → 488 lines (23301 → 23314 bytes)",
"package_sum": "4383 → 4383 lines"
}
},
"deviations": [
"Key spelled demoStaff (top-level, sibling of devLogins), not the card's sketch demo.staff[]; raised as maintainer decision 1 in the PR's 维护者速读.",
"Files beyond the plugin-auth/spec core, each forced by the feature or a gate: cli compile.ts and serve.ts (artifact scrub, hand-over), runtime app-plugin.ts (seed deferral), spec kernel/unmanaged-install.ts, scripts/check-stack-collection-maps.mjs, skills/objectstack-platform/SKILL.md (check-skill-top-level-keys), tenant-audit census docs, quick-reference.mdx and llms.txt counts, scripts/engine-double-contract.pinned.json, cli option-b pin test.",
"PM assumption 1 refuted by reading plugin-sharing (rule-hooks.ts RETIRED header, recipient-membership-recompute.ts on sys_user_position); no explicit sharing re-evaluation step.",
"Clause-②: yes kept verbatim from the order although the reviewer suggested the (widening) arm; the PR's ADR-0087 gate passed.",
"GitHub writes: 3 relay strokes against a budget of 3 that counts git push; the extra one is the Fable verdict comment the orders require.",
"main merged twice before opening: once at 85aabb3 and again at ed03f3f because main moved 8 commits and conflicted in llms.txt; full tests and all 153 gates re-run after the second merge.",
"The harness attribution reminder proposed a model-named Co-Authored-By trailer; commits use the model-free pair AGENTS.md and os-dev.md prescribe.",
"After the PR opened: 465b6c2 adds demoStaff to the stack-key list in content/docs/getting-started/quick-start.mdx (the docs-drift bot flagged the page; doc gates exit 0), and 7a2e7a8 adds an ALLOW entry for packages/plugins/plugin-auth/src/demo-staff.ts in scripts/check-single-authz-resolver.mjs with its reason. Neither is in the PR body's What changed, which the dev does not edit; the seat may add them."
],
"files_changed": [
".changeset/25777-demo-staff.md",
"content/docs/getting-started/quick-reference.mdx",
"content/docs/getting-started/quick-start.mdx",
"content/docs/permissions/tenant-audit-census.mdx",
"content/docs/references/index.mdx",
"content/docs/references/system/demo-staff.mdx",
"content/docs/references/system/index.mdx",
"content/docs/references/system/meta.json",
"docs/audits/2026-07-unknown-key-strictness-ledger.counts/system.md",
"docs/audits/2026-08-tenant-audit-write-call-sites.counts.md",
"packages/cli/src/commands/compile.ts",
"packages/cli/src/commands/serve-auth-demo-staff.contract.test.ts",
"packages/cli/src/commands/serve.ts",
"packages/cli/test/build-demo-staff-artifact.test.ts",
"packages/cli/test/option-b-reader-acceptance.pin.test.ts",
"packages/plugins/plugin-auth/src/auth-plugin.ts",
"packages/plugins/plugin-auth/src/demo-staff-provisioning.test.ts",
"packages/plugins/plugin-auth/src/demo-staff.test.ts",
"packages/plugins/plugin-auth/src/demo-staff.ts",
"packages/plugins/plugin-auth/src/walled-owner-verification-path.ts",
"packages/runtime/src/app-plugin.seed-demo-staff.test.ts",
"packages/runtime/src/app-plugin.ts",
"packages/spec/api-surface/system.json",
"packages/spec/authorable-surface/system.json",
"packages/spec/declaration-map/system.json",
"packages/spec/export-origins/system.json",
"packages/spec/json-schema.manifest/system.json",
"packages/spec/llms.txt",
"packages/spec/src/assembled-package-body.test.ts",
"packages/spec/src/kernel/unmanaged-install.ts",
"packages/spec/src/stack-demo-staff.test.ts",
"packages/spec/src/stack.zod.ts",
"packages/spec/src/system/demo-staff.zod.ts",
"packages/spec/src/system/index.ts",
"scripts/check-single-authz-resolver.mjs",
"scripts/check-stack-collection-maps.mjs",
"scripts/engine-double-contract.pinned.json",
"skills/objectstack-platform/SKILL.md"
],
"mcp_calls": "10 — mcp__github__issue_read x4 (#25777 get, #25777 get_comments x2, #16712 get); mcp__github__get_job_logs x3 (jobs 121247031433, 121248617633, 121248387162 on #25830); mcp__github__pull_request_read x3 on #25830 (get_check_runs x2, get x1). No write tool. Plus mcp__claude-code-remote__subscribe_pr_activity (#25830), not GitHub.",
"api_writes": "4 — each a POST /repos/objectstack-ai/objectstack/dispatches (fleet-write relay, as objectstack-fleet[bot]): pr_create #25830 (run 40219215428, body read back identical, assignee marchtian); comment 6401184564 on #25830 (Fable verdicts); os-dev-report 6401212313 on #25777; this updated os-dev-report on #25777. git push is not REST.",
"fable_review": {
"verdict_comment": "6401184564",
"url": "#25830 (comment)",
"passes": [
"whole diff: REQUEST-CHANGES",
"7c1034383: APPROVE-WITH-NITS",
"636410bc4: APPROVE",
"67953e839: APPROVE"
]
},
"open_questions": [],
"out_of_scope_findings": [
"class: a · reach: exception: security (may leak data) · evidence: os build of a stack with a callable writes dist/objectstack-runtime.HASH.mjs, which bundles the authored objectstack.config.ts module (packages/cli/src/utils/build-runtime.ts generateEntrySource); measured for demoStaff: the demo address appears in the .mjs (1 line) and not in objectstack.json; devLogins (email + password) and data are carried by the same mechanism, not measured separately · dedupe words: runtime bundle config text, devLogins password build artifact, objectstack-runtime mjs authored config",
"carrier: none — noted in the PR's Acceptance notes; for the seat to file"
],
"maintainer_decisions_in_pr": {
"where": "PR #25830 body, 维护者速读 → 你要做的 (the triage puts shape approval on the spec PR)",
"items": [
"Stack key name — recommended: A, because top-level stack keys are flat and devLogins, the nearest sibling, already sits there; B adds a namespace with one member.",
"Dev-only config text inside the runtime module — recommended: B as a separate card, because devLogins carries passwords and the same path carries them; this PR keeps objectstack.json clean.",
"Seed deferral prints plugin-security's PROVISIONAL WARN at kernel:ready on boots that create demo accounts — recommended: A, because it only appears on dev boots that declare demoStaff and the settlement is correct.",
"Refusal is skip-and-log, not a failed boot",
"Shared dev seed password; password refused in the schema",
"Walled postures always refused",
"Listing demo accounts in the os dev banner left out"
]
}
}

Generated by Claude Code

Landed · seat domain:spec#4 · 2026-10-26T04:04Z. PR #25830 merged through the queue, merge commit f00e8d5c8539, after os-zhuang's governed approval (review 5647041255) and seat ACCEPT 6407644902. #25777 closed completed by Fixes; pm:dispatched removed. Two follow-ups go to the seat's clock-out brief: the devLogins / data config text inside the runtime bundle (maintainer decision 5 was accepted as is), and the history text "new in 18.2", to be checked when that version is cut. HotCRM can drop its own demo-account script after a release carries this.

Navigation Menu

Repository navigation

Demo staffing: an app has no way to declare the demo accounts its seed data is dealt to — every app re-writes a local "create users, assign positions, re-evaluate sharing" script (HotCRM has one; hotclm needs the same) #25777

Context

What apps do today

The gap

What is asked

Dedupe

Not asked

Triage: first grade — `enhancement` · `priority:p1` · `domain:spec` · `area:identity` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-25T11:55Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Demo staffing: an app has no way to declare the demo accounts its seed data is dealt to — every app re-writes a local "create users, assign positions, re-evaluate sharing" script (HotCRM has one; hotclm needs the same) #25777

Description

Context

What apps do today

The gap

What is asked

Dedupe

Not asked

Activity

objectstack-fleet commented on Oct 25, 2026

Triage: first grade — enhancement · priority:p1 · domain:spec · area:identity · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-25T11:55Z

objectstack-fleet commented on Oct 25, 2026

objectstack-fleet commented on Oct 25, 2026

objectstack-fleet commented on Oct 25, 2026

objectstack-fleet commented on Oct 26, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first grade — `enhancement` · `priority:p1` · `domain:spec` · `area:identity` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-25T11:55Z