RBAC + 组织架构权限：真实 UI 测试结论 — 后端判定全部正确，但「记录范围（readScope/writeScope）」在 Setup/Studio 无法配置与查看，另有 7 项管理体验缺口（待 PM 确认排期） #26059

Activity

1. objectstack-fleet

   added

   needs-user-decision

   on Oct 26, 2026
2. objectstack-fleet commented on Oct 26, 2026

   

   objectstack-fleetBot

   on Oct 26, 2026

   ContributorAuthor

   More actions

   Triage: graded as a decision card — priority:p1 · domain:ui · area:access · pm:awaiting-maintainer · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-26T10:56Z

   ⛔ Not a claim, ⛔ not a dispatch. This card is the parent. Its items are split into child cards once the maintainer answers.

   Verified on origin/main: ADR-0084:47 requires "a permission matrix (roles × objects × CRUD + record scope)". PermissionMatrixEditor.tsx (around :961–985) only preserves readScope / writeScope and offers no control. No open or recent card tracks the gap (600 newest scanned; #26040 and #26056 are adjacent, not the same).

   Triage leaning on the four questions:

   1. Item 1 → p1, domain:ui. Two scope selects per object row, with the existing all-records exclusions (A permission set accepts a hierarchy readScope beside viewAllRecords: true, never reads it, and emits no diagnostic — the declaration materialises and a capability census counts it as coverage #16870) and an unlicensed-hierarchySecurity hint. Wire PermissionPreview read-only into the permission-set and position pages. About 2–3 dev-days.
   2. Item 5 (manual share UI): not this period. Rule-based sharing works, and the server door exists. File it as a p3 card for later.
   3. Split the rest by landing site, not one card:
      • ✨ Set up Copilot instructions #2: delegated-admin hints, domain:ui plus docs, p2.
      • Implement ObjectStack protocol specification with Zod schemas and TypeScript interfaces #3: the server reason in the toast, domain:ui, p2.
      • Add Changesets and GitHub Actions automation #4: position drafts visible in the list, domain:ui, p2.
      • Migrate from npm to pnpm #6: hide or grey New without Create, domain:ui, p3.
      • Remove explicit pnpm version from workflows to fix version conflict #7: field-type Enter picks the current type, domain:ui, p3.
      • Convert to monorepo with scoped packages #8: the BU member title shows ids, domain:server, p3.
   4. Item 9 → framework, domain:server, p2, two cards. 9a: the runtime save of an unlicensed hierarchy scope is silent where defineStack refuses it. 9b: explain names the wrong cause when the resolver is absent.

   • Also: hierarchySecurity is WAIVED in coverage.json with no item. A domain:devx p2 card turns this run into checklist items.

   ---

   Generated by Claude Code
3. objectstack-fleet

   added

   area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guardsPermissions that actually hold — RLS/FLS, sharing model, write-path guards

   domain:ui

   pm:awaiting-maintainer

   priority:p1High: required for production / M2High: required for production / M2

   on Oct 26, 2026
4. objectstack-fleet commented on Oct 26, 2026

   

   objectstack-fleetBot

   on Oct 26, 2026

   ContributorAuthor

   More actions

   Brief-claimed-by: session_01KrKXQVvgYk2AJ4VkqMobyb · batch #396 · 2026-10-26T12:17Z

   Director seat, summon #51 continuation (ledger objectstack#12708). Presented to the maintainer in batch #396 as its one item, at the maintainer's word in the summon chat (「再和我讨论 #26059 清单确认」). Seat increment (re-verified on origin/main cdd4eea9; the test conclusions and the triage leanings 6414323834 are not restated):

   • Governing text holds. ADR-0084:47 (Accepted): the Access pillar's editor is "a permission matrix (roles × objects × CRUD + record scope)". PermissionMatrixEditor.tsx:961–975 only carries readScope / writeScope through a save (the type-alias-convention.pin.test.ts 的分节注释写着 "717 isomorphic aliases",实际 822 —— 唯一没被计数断言盖住的数字 #6605 repair) and offers no control. ADR-0090's ObjectUI landing list (:642) names "permission matrix gains OWD context per object row" and no scope column — the requirement sits in ADR-0084 and was never carried into 0090's list, as the card says. So item 1 is a declared-but-unbuilt editor, not a new capability: no ADR change, the contract already exists.
   • The pieces for item 1 exist. ObjectAccessScopeSchema = own | own_and_reports | unit | unit_and_below | org (permission.zod.ts:18); the contradictory-pair refusal (A permission set accepts a hierarchy readScope beside viewAllRecords: true, never reads it, and emits no diagnostic — the declaration materialises and a capability census counts it as coverage #16870: View All / Modify All beside a depth) is on the BASE schema (:632), so the server already refuses what the UI must grey out; previews/PermissionPreview.tsx:78–137 already renders both scopes (SCOPE_ORDER, own+reports, unit+below) and is not wired into the permission-set or position pages. platform-capabilities.ts:224: "ADR-0057 hierarchy scopes ship in the enterprise edition" — the source for the unlicensed hint.
   • Item 9a's premise is the card's, not re-verified: git grep -iE 'hierarchy.{0,40}(licen|entitl|enterprise)' on packages/{spec,core,plugins/plugin-security,objectql}/src finds notes only, no compile-time refusal of an unlicensed hierarchy scope in defineStack; where that refusal lives (lint, or the cloud security-enterprise package) is for the dispatched dev to name before 9a is built as "make the runtime match the compile path".
   • Coverage: cloud docs/qa/platform-checklist/coverage.json:42 — hierarchySecurity WAIVED 2026-10-24, no item; this run is the material for the checklist card (domain:devx, in cloud, cloud:checklist-author).
   • Adjacent cards fix(components): a refused submit focuses the first invalid field instead of toasting the field list over the dialog title #26040 (refused submit focuses the first invalid field) and fix(app-shell): no drafts-ledger read for a member, no published read for a new draft #26056 (drafts-ledger read) are not this card's items; no duplicate found by the triage scan of the 600 newest.
   • Half-state read, not written: needs-user-decision + pm:awaiting-maintainer together; the second leaves in the ruling's stroke.
   • Facets block (the card carried none; written for the four questions as one decision):

   os-decision-facets

   • ① 项目长远合理性：问题 1 是 ADR-0084 已声明、未建的编辑器，补上即「声明 = 执行」；问题 9 两张卡让运行时元数据保存与 explain 不再静默（ADR-0078 / ADR-0049）。
   • ② 实际业务拉动：客户管理员自建权限集时设不了组织范围、也看不到现状（实测 33/33 后端通过，唯独界面缺口）；问题 5 的手动共享服务端门已有、仅缺入口，零客户要求。
   • ③ 防 AI 犯错：矩阵里的范围下拉按 A permission set accepts a hierarchy readScope beside viewAllRecords: true, never reads it, and emits no diagnostic — the declaration materialises and a capability census counts it as coverage #16870 置灰互斥项、未授权时提示，错配置在保存前被拒；9a/9b 让「声明了但不生效」在保存与 explain 上响亮。
   • ④ 创业阶段不扩散：问题 1 零新键（枚举与校验已在 spec）；问题 5 本期不做；其余按落点拆卡而不合成一张「体验卡」，避免一张永不关闭的清单卡。
     Prior rulings read: ADR-0084 record scope · PermissionMatrixEditor readScope · #16870 · #6605 · hierarchySecurity → ADR-0084:47, ADR-0090:642, permission.zod.ts:632, platform-capabilities.ts:224, cloud coverage.json:42; thread: 6414323834.
   • Facets read: same direction as triage on Q1, Q3, Q4; on Q2 the seat recommends file a p3 queue card, not this period (an existing server door with no UI entry is a gap card, not a new capability). Workload (card column + triage): Q1 ui M (2–3 dev-days); Q3 six cards S each (five ui, one server) + docs; Q4 two server cards S–M; checklist card devx S–M in cloud.
5. objectstack-fleet commented on Oct 26, 2026

   

   objectstack-fleetBot

   on Oct 26, 2026

   ContributorAuthor

   More actions

   Item-by-item reading for the maintainer · director seat · 2026-10-26T12:26Z

   Asked in the summon chat (「26059 要每个问题给我具体分析」). Every claim below was read on objectstack origin/main cdd4eea9; where the seat did not read a path line by line it says so. Each item: cause → where it lands → fix shape → size → grade the seat recommends.

   1. Record scope (readScope / writeScope) cannot be set or seen in the UI — p1, domain:ui, one card. Cause: ADR-0084:47 declares the Access editor as "a permission matrix (roles × objects × CRUD + record scope)"; PermissionMatrixEditor.tsx models C/R/U/D/Tr/VA/MA (:273–283) and carries readScope/writeScope through a save untouched (:961–975, the #6605 repair) — the column was never built, and ADR-0090's ObjectUI list (:642) names OWD context, not scope. Lands in: PermissionMatrixEditor.tsx (two selects per object row, enum ObjectAccessScopeSchema permission.zod.ts:18), the permission-set and position pages (wire previews/PermissionPreview.tsx:78–137, which already renders both scopes, read-only), and the hint source platform-capabilities.ts:224 ("hierarchy scopes ship in the enterprise edition"). Constraints already enforced server-side and only mirrored in the UI: View All beside a read depth and Modify All beside either depth are refused on the BASE schema (permission.zod.ts:632, #16870) — the selects grey out, they do not re-implement. Unlicensed hierarchySecurity: the three hierarchy values stay selectable with the hint "requires enterprise; otherwise owner-only" (the open runtime fails closed, sharing-service.ts:377). Size: ui M, 2–3 dev-days, no spec change, no ADR change.

   2. A delegated admin cannot enter Setup; the scope block gives no hint — p2, domain:ui + docs, one card. Cause: AdminScopeSchema scopes WHAT may be assigned, not the doors the assigner needs: Setup entry is the capability setup.access (capabilities.ts:49), and choosing a person or unit needs sys_user / sys_business_unit / sys_business_unit_member read plus sys_user_position CRUD — the docs example lists the object grants (delegated-administration.mdx:26–36) but not setup.access. The UI block (PermissionAdvancedFacets.tsx:405–420, :677) gates only the business-unit boundary (objectui#9464). Fix: in the block, a one-line checklist of the companion grants with a "grant these" action that adds them to the same permission set (one save, no new key), and the docs page gains setup.access. Not a server change: the server is right to refuse. Size: ui S + docs S.

   3. The refusal toast drops the server's reason — p2, two halves, domain:server first. Cause, deliberate on the UI side: isPermissionError (ui/packages/react/src/utils/error-message.ts:202) treats every 403 / PERMISSION_DENIED as one class and the form renders it as the fixed line form.noPermissionToSave (flowResponse.ts:336–369, ruling objectstack#24914 B′) — a rule that exists so a denial never leaks why. The delegated-admin gate throws PermissionDeniedError for scope violations (delegated-admin-gate.ts:403–503) with reasons that describe the CALLER's own scope (:1136–1179, "outside the delegated subtree", "not in the scope's allowlist") — safe to show, but indistinguishable on the wire from a denial that must stay opaque. Fix shape: the gate answers its own code (e.g. DELEGATION_SCOPE_VIOLATION, registered in the ADR-0112 ledger, status 403) and the UI renders that code's message while PERMISSION_DENIED keeps the fixed line. Not "show every 403 message": that reverses 24914 B′. Size: server S (code + ledger row + pins) → ui S.

   4. A new position saves as a draft the list does not show — p2, domain:ui, one card (confirm the premise first). Reading: the editor writes mode: 'draft' only when the item sits under a packageId (PermissionMatrixEditor.tsx:1104, ADR-0086 P0/P2: authoring inside an installed package is a draft until publish), and EmbeddedItemEditor.tsx:167 does the same; the Setup list reads published items. So the measured path is probably a position created inside a package's scope, and the gap is the list, not the save. Fix: the list shows the caller's drafts with an "unpublished" badge and a Publish action (the drafts ledger is the read #26056 is fixing for members; the position row rides that). Premise for the dev: reproduce which packageId the Setup "New" carried; if none, the draft write itself is the defect. Size: ui S.

   5. No end-user "share this record with…" entry — p3, domain:ui, filed for later, not this period. Reading: the server door exists (GET/POST /api/v1/data/:object/:id/shares, rest-route-ledger.ts:403–404, family record-shares); the record page's Share item copies a link (RecordDetailView.tsx:3436–3464). Rule-based sharing through Setup works (card: 3/3). A dialog (user / team / position / business unit × read / edit) is a permanent surface with zero measured customer pull; the door being there makes this a gap card, not a capability card. Size when picked up: ui M.

   6. New shows for a user without Create — p3, domain:ui, one card (defect). Reading: the list already gates New by resolveAffordance('listNew') → crud.create from the object's effective API operations AND perms.can(object, 'create') (ObjectDataPage.tsx:503, affordanceGrants.ts:293–310, objectstack#3391). The card still saw New for the auditor, so one of the two inputs answered true: the most likely is can() before /me/permissions is loaded (resolveFieldAffordance returns true when !perms.isLoaded, :321; whether can does the same was not read line by line) or View All cascading into the create verdict. The dev reproduces with the auditor set and pins the verdict. Size: ui S.

   7. Field-type search: Enter picks the current type — p3, domain:ui, one card. Reading: inspectors/FieldTypePicker.tsx:40–47 documents "Enter picks the highlighted type" and the list is a cmdk Command; the current type is rendered as the checked item, and with the current value kept at the top of the filtered list the highlight stays on it after typing. Fix: on a non-empty query, highlight the first MATCH (or drop the current type to its group) so Enter selects what the user typed. Size: ui S, one test.

   8. Business-unit member title shows raw ids — p3, domain:server (platform-objects), one card. Cause is a formula, not the renderer: sys-business-unit-member.object.ts:52–55 — display_title is record.user_id + ' in ' + record.business_unit_id and titleFormat: '{user_id} in {business_unit_id}' (:38) — so the title IS the ids by declaration. Fix: a title over the two lookups' display names; whether the formula language can read a lookup's name was not found in formula/src/stdlib.ts (no lookup-display helper located), so the dev names the mechanism (formula over related display names, or a stamped title kept by hook on both ids) before writing. Size: server S.

   9a. Runtime save of an unlicensed hierarchy scope is silent — p2, domain:server, one card (premise verified). The compile path does refuse: stack.zod.ts:4818–4845 validateHierarchyScopeCapability — a stack using unit / unit_and_below / own_and_reports without requires: ['hierarchy-security'] errors with STACK_HIERARCHY_SCOPE_CAPABILITY_REQUIRED ("the open runtime would silently fail closed to owner-only; the metadata would lie, ADR-0049"). Its only reader is stack.zod.ts; the metadata PUT door runs no such check, so the same declaration is accepted at runtime with _diagnostics.valid: true and falls closed to owner-only — exactly the inert metadata ADR-0078 forbids. Fix: the runtime save door asks the kernel whether hierarchy-security is mounted and, when it is not, answers a diagnostic that names the enterprise requirement (refuse vs warn is the one choice for the maintainer; the seat reads ADR-0078 as refuse-on-publish, warn-on-draft). Size: server S–M. Lives in the framework: a self-hosted community runtime has the same silence; cloud's community mode is one host of it.

   9b. explain names the wrong cause when the resolver is absent — p2, domain:server, one card. Reading: explain-engine.ts:2040–2075 builds the depth record from sharingFilter / depthAdmitsRow / sharingMatches; when no hierarchy resolver is mounted the open sharing service answers owner-only (sharing-service.ts:377–378), so sharingMatches === false and the branch at :2063 prints "outside the caller's 'unit_and_below' read depth" — true of the computation, false about the configuration. Fix: a resolver-absent branch ahead of it ("hierarchy resolver absent — requires enterprise; depth evaluated as 'own'"), one pinned explain cell. Size: server S. Pairs naturally with 9a in one dispatch.

   Checklist: cloud docs/qa/platform-checklist/coverage.json:42 holds hierarchySecurity WAIVED 2026-10-24 with no item; this run's 33 scenarios are the material. One domain:devx p2 card in cloud (cloud:checklist-author), after the maintainer's letters.

   维护者速读(逐项)

   #	一句话成因	落点	改法	大小 / 等级
   1	ADR-0084 声明了「矩阵 + 记录范围」,矩阵编辑器只模型了 CRUD/VA/MA,范围列从未建(#6605 只保住不丢)	ui 矩阵编辑器 + 权限集/岗位页	每行两个范围下拉;按 #16870 置灰互斥项;未授权提示「需企业版,否则按本人」;PermissionPreview 只读接入两页	ui M · p1
   2	分级范围只管「能分什么」,不管「进门要什么」:setup.access 与 sys_user/sys_business_unit/成员读、sys_user_position CRUD 是配套授权,文档缺 setup.access,UI 块无提示	ui 高级面板 + 文档	块内列出配套授权并提供「一键补全」到同一权限集;文档补 setup.access	ui S + docs S · p2
   3	UI 故意把一切 403 显示成固定一句(裁决 #24914 B′,防泄露原因);分级管理员的越界原因是关于操作者自己的,安全可显示,但线上与普通拒绝无法区分	先 server 后 ui	分级门禁自己的错误码(ADR-0112 台账登记)+ UI 对该码显示服务端文案;普通 PERMISSION_DENIED 不变	server S → ui S · p2
   4	在包范围内新建的元数据按 ADR-0086 存为草稿直到发布;列表只读已发布	ui 列表	列表显示本人草稿 + 「未发布」标记 + 发布入口(搭 #26056 的草稿台账读);dev 先复现 Setup「New」带的 packageId	ui S · p2
   5	服务端 /data/:object/:id/shares 门已有,记录页 Share 只是复制链接	ui 记录页	「共享给…」对话框;本期不做,立 p3 排队	ui M · p3(后排)
   6	列表已按 /me/permissions 判定 New,但审计员仍看到:疑为权限未加载时 can() 回 true 或 View All 级联;需复现	ui 列表	复现审计员权限集,钉判定	ui S · p3
   7	类型搜索是 cmdk 列表,当前类型置顶且保持高亮,回车选高亮	ui FieldTypePicker	有搜索词时高亮第一个匹配项	ui S · p3
   8	标题就是公式 user_id + ' in ' + business_unit_id	platform-objects	标题改为两个 lookup 的显示名(公式能否读关联显示名未定位到,dev 先定机制)	server S · p3
   9a	编译期有 validateHierarchyScopeCapability 拒绝,运行时 PUT 门不跑它,静默回落 owner-only(ADR-0078 禁止的惰性元数据)	框架 metadata 保存门	保存时问内核 hierarchy-security 是否挂载,未挂载给诊断并指明企业版(发布拒绝 / 草稿告警由您定)	server S–M · p2
   9b	explain 的 depth 分支只看共享服务的 owner-match 结果,解析器缺席时得出「在范围之外」的错误原因	框架 explain	解析器缺席分支先行:「hierarchy resolver absent — requires enterprise」	server S · p2(与 9a 同派)
   附	hierarchySecurity 在 cloud 测试清单 WAIVED、无测试项	cloud devx	把本轮 33 个场景整理成正式测试项	devx S–M · p2

   回批格式:26059 Q1 是/否 Q2 p3/本期 Q3 分卡/合并 Q4 框架/cloud,如对任一项的等级或改法有改动,逐项点名即可。
6. objectstack-fleet commented on Oct 26, 2026

   

   objectstack-fleetBot

   on Oct 26, 2026

   ContributorAuthor

   More actions

   Ruling: batch #396 item 1 · letter Q1 是 / Q2 不做 / Q3 分拆 / Q4 框架 · maintainer 「共享给指定人 不考虑，其他是否建议分拆issue」「哪些需要cloud访问权限的可以交给cloud 车道」 2026-10-26T12:40Z

   Recorded by the director seat (summon #51 continuation, session_01KrKXQVvgYk2AJ4VkqMobyb, ledger objectstack#12708; brief 6415795834, item-by-item reading 6415971852). The maintainer's two sentences, taken together with the seat's split proposal they answer: item 5 is out; the rest is split by landing site; whatever needs cloud access goes to the cloud lane.

   Q1 → 是. Item 1 is the p1 child: the permission matrix gains a read-scope and a write-scope select per object row (ObjectAccessScopeSchema, permission.zod.ts:18), greyed by the #16870 pairs the BASE schema already refuses (:632), the three hierarchy values carrying the hint "requires enterprise; otherwise owner-only" (platform-capabilities.ts:224); previews/PermissionPreview.tsx wired read-only into the permission-set and position pages. No spec key, no ADR change (ADR-0084:47 already declares it).

   Q2 → 不做. Item 5 (an end-user "share this record with…" dialog) is not filed and not built; rule-based sharing and the server door stay as they are. A future card needs a customer asking.

   Q3 → 分拆, by landing site — nine child cards, filed by the claiming seat of this parent (the domain:ui seat, with the triage seat first-touching each), every one carrying Ruling-ref: naming this comment and Part of #26059:

   1. ui p1 — item 1 as above.
   2. server p2 — items 9a + 9b in one dispatch: the runtime metadata save door asks the kernel whether the hierarchy resolver is mounted (the open sharing service fails closed without it, sharing-service.ts:377) and answers a diagnostic naming the enterprise requirement when it is not — the compile path already refuses (stack.zod.ts:4818–4845, STACK_HIERARCHY_SCOPE_CAPABILITY_REQUIRED), so this makes the runtime path match it (ADR-0078 / ADR-0049); shape unless the maintainer says otherwise: refuse on publish, warn on a draft save. 9b: explain-engine.ts:2040–2075 gains a resolver-absent branch ahead of the depth verdict ("hierarchy resolver absent — requires enterprise; depth evaluated as 'own'"). Framework code only: cloud mounts SecurityEnterprisePlugin by licence (apps/objectos-ee/objectstack.config.ts:1333, :1597) and changes nothing.
   3. server p2 — item 3, server half: the delegated-admin gate (delegated-admin-gate.ts:403–503, reasons :1136–1179) answers its own code (e.g. DELEGATION_SCOPE_VIOLATION, status 403, ADR-0112 ledger row), distinct from PERMISSION_DENIED.
   4. ui p2 — item 3, ui half, Blocked-by: card 3: the toast renders that code's server message; PERMISSION_DENIED keeps form.noPermissionToSave (ruling 24914 B′ unchanged).
   5. ui + docs p2 — item 2: the Delegated Admin Scope block lists the companion grants (setup.access, sys_user / sys_business_unit / sys_business_unit_member read, sys_user_position CRUD) with a one-click "grant these" into the same set; delegated-administration.mdx gains setup.access.
   6. ui p2 — item 4: the metadata list shows the caller's drafts with an "unpublished" badge and a Publish action (beside fix(app-shell): no drafts-ledger read for a member, no published read for a new draft #26056's drafts-ledger read); premise first: which packageId the Setup "New" carried (PermissionMatrixEditor.tsx:1104, ADR-0086 P0/P2) — a draft written with none is itself the defect.
   7. ui p3 — item 6: New hidden or greyed without Create; reproduce with the auditor set and pin the resolveAffordance('listNew') verdict (affordanceGrants.ts:293–310; suspected can() before /me/permissions loads).
   8. ui p3 — item 7: FieldTypePicker highlights the first match when a query is present, so Enter picks it.
   9. server p3 — item 8: sys_business_unit_member's title over the two lookups' display names instead of record.user_id + ' in ' + record.business_unit_id (sys-business-unit-member.object.ts:38, :52–55); the dev names the mechanism first.

   Q4 → 框架, as card 2 above. Cloud lane (the maintainer's second sentence): what needs cloud access is the verification, not the code — one domain:devx p2 card in objectstack-ai/cloud (cloud:checklist-author): turn this run's 33 scenarios into docs/qa/platform-checklist/ items, retire the hierarchySecurity WAIVED row (coverage.json:42), and re-run them on objectos-ee in both the licensed and the community posture as each child lands in a pin cloud carries. That card is the end-to-end re-verification of children 1–6; it carries Blocked-by: none (authoring the items starts now) and its run record waits on the pins.

   Workload of the chosen letters (reading 6415971852): ui M + ui S ×5 + docs S; server S–M + S + S; cloud devx S–M. Item 5: 0.

   Execution: needs-user-decision → pm:queue in this act (domain:ui, p1, area:access); pm:awaiting-maintainer removed in the same stroke (half-state beside the decision label). This card is the parent: the first claimant files the nine children and the cloud card request, relabels this card tracking with a checklist comment, and keeps it open until the last child closes. Decisions are anchored here; a question born in a child goes on that child linking here.
7. objectstack-fleet

   added

   pm:queue

   pm:dispatched

   and removed

   needs-user-decision

   pm:awaiting-maintainer

   pm:queue

   on Oct 26, 2026
8. objectstack-fleet

   assigned

   os-steve

   on Oct 26, 2026
9. objectstack-fleet commented on Oct 26, 2026

   

   objectstack-fleetBot

   on Oct 26, 2026

   ContributorAuthor

   More actions

   Claim: PM loop · parent filing · 2026-10-26T14:54Z
   Session: session_01SMps7wq7rBTk53e8KTSEup
   Account: os-steve
   Domain: domain:ui
   Seat: domain:ui#2
   Role: first claimant of this parent, per the 2026-10-26T12:40Z ruling (Q3 → 分拆). No branch and no code on this card.
   Scope of this claim:

   1. File the nine child cards named in the ruling. Each one carries Ruling-ref: (this ruling comment) and Part of #26059, and the triage seat first-touches it.
      • The ui children (1, 4, 5, 6, 7, 8) are filed domain:ui.
      • The server children (2, 3, 9) are filed domain:server.
   2. Request the cloud-lane domain:devx verification card (objectstack-ai/cloud, cloud:checklist-author) through the coordinator. This seat has no access to the cloud repository.
   3. Relabel this card tracking, post a checklist comment, and keep it open until the last child closes.
      Writes: only through the relay tools (issue-create.mjs, post-stamped.mjs, label-write.mjs). ⛔ No GitHub MCP writes.
      Serial constraints cleared: none; this is filing only.
10. objectstack-fleet commented on Oct 26, 2026

    

    objectstack-fleetBot

    on Oct 26, 2026

    ContributorAuthor

    More actions

    Tracking: #26059's children, per the ruling's Q3 (分拆)

    Ruling-ref: 6416233738 (#26059 (comment))

    Each child carries Part of #26059 and that Ruling-ref:. The triage seat first-touches each one. Item 5 (an end-user "share this record with…" dialog) is not filed, per Q2 (不做).

    • Permission matrix (Setup / Studio Access): readScope and writeScope cannot be set or seen, though ADR-0084 declares the record-scope column #26187: ui p1. Permission matrix: a read-scope and a write-scope select per object row, greyed by the A permission set accepts a hierarchy readScope beside viewAllRecords: true, never reads it, and emits no diagnostic — the declaration materialises and a capability census counts it as coverage #16870 pairs, with an unlicensed hint; PermissionPreview read-only on the permission-set and position pages (item 1, Q1)
    • metadata save + explain: an unlicensed hierarchy scope saves silently at runtime though defineStack refuses it, and explain blames the depth #26188: server p2. Runtime metadata save of an unlicensed hierarchy scope gets a diagnostic (refuse on publish, warn on draft), and explain gains a resolver-absent branch (items 9a + 9b, Q4 框架)
    • delegated-admin gate: scope violations answer PERMISSION_DENIED, so a client cannot tell them from an opaque denial (own registered code) #26189: server p2. The delegated-admin gate answers its own registered 403 code for scope violations, distinct from PERMISSION_DENIED (item 3, server half)
    • Record form toast: a delegated-admin scope refusal shows the fixed no-permission line instead of the server's reason #26190: ui p2. The record-form toast shows that code's server message; PERMISSION_DENIED keeps form.noPermissionToSave (item 3, ui half; Blocked-by delegated-admin gate: scope violations answer PERMISSION_DENIED, so a client cannot tell them from an opaque denial (own registered code) #26189)
    • Setup permission set, Delegated Admin Scope: no hint or one-click grant for the companion grants a delegate needs to enter Setup and pick people #26191: ui + docs p2. The Delegated Admin Scope block lists the companion grants, with a one-click "grant these"; delegated-administration.mdx gains setup.access (item 2)
    • Setup Positions: a new position saved as a draft does not appear in the list, with no unpublished badge and no Publish action #26192: ui p2. A Setup-created position draft is visible in the list with an "unpublished" badge and Publish, after the packageId premise is settled (item 4)
    • Object list: New shows for a user without Create (auditor, read-only finance) and the save is then refused 403 #26193: ui p3. New is hidden or greyed without Create; reproduce with the auditor set and pin the listNew verdict (item 6)
    • Studio field type picker: typing a type name and pressing Enter picks the current type, not the first match #26194: ui p3. FieldTypePicker highlights the first match on a query, so Enter picks it (item 7)
    • sys_business_unit_member: the record title shows raw ids (user id in business unit id) instead of the person's and the unit's names #26195: server p3. The sys_business_unit_member title is built over the two lookups' display names; mechanism named first (item 8)
    • Cloud-lane verification card: requested from the coordinator (objectstack-ai/cloud, domain:devx, cloud:checklist-author). It turns this run's 33 scenarios into docs/qa/platform-checklist/ items, retires the hierarchySecurity WAIVED row (coverage.json:42), and re-runs them in the licensed and community postures as children 1–6 land. Blocked-by: none.

    This card stays open as tracking until the last child above closes.
11. objectstack-fleet

    added

    tracking

    and removed

    pm:dispatched

    on Oct 26, 2026
12. objectstack-fleet

    unassigned

    os-steve

    on Oct 26, 2026
13. objectstack-fleet commented on Oct 26, 2026

    

    objectstack-fleetBot

    on Oct 26, 2026

    ContributorAuthor

    More actions

    2026-10-26T20:37Z · domain:server seat 2 · child 9 (Q3, #26195) landed: PR #26300 merged as 1f40201977 (landing record on #26195). This tracking card stays open for its other children.

    ---

    Generated by Claude Code