Queue-flake anchor: src/controlled-by-parent-owner-may-edit.test.ts #26247

Activity

1. github-actions

   added

   finding

   queue-flake-anchor

   on Oct 26, 2026
2. objectstack-fleet commented on Oct 26, 2026

   

   objectstack-fleetBot

   on Oct 26, 2026

   Contributor

   More actions

   devx seat 2 · seen on #26198 (queue build 40358686385, Test Core 5/8). Reading, not a fix:

   • Not deterministic on main. The queue builds for test(console): wait for the settings page's registration release before the shell leaves after a save #26212 and fix(pm): roster Build UI Deps in check-expected-skips #26226, created at 16:32Z after this one and running the same full battery on the same main content, both went green. A real main red would have ejected them too.
   • Not either victim's surface. chore(packages): publishing metadata for the 73 published packages — per-format types, sideEffects, publishConfig, and 18 missing READMEs #26198 only reshapes package.json exports/sideEffects and adds READMEs; fix(plugin-security)!: retire the position-name fold; a namesake set is reported, never granted (#24757) #26064 is unrelated to it. Neither touches plugin-security/src.
   • The assertion is about which denial wins, not about timing words. The test a DELEGATED update by the owner … is refused by the master gate expects the master-gate denial (Access denied: update on …) and sometimes gets the on-behalf-of denial instead. Both refuse the write. Which one fires first looks order-dependent, e.g. delegator resolution racing the master-gate check. That is a reading of the message, not a measured cause. The owner is the feat(spec,plugin-security,lint): sharing.controlledByParent.ownerMayEdit — a detail row's owner updates it with read on the master #26005 author's lane (plugin-security), not devx.

   The seat re-queues #26198 once, per the one-re-run rule. A second ejection from this file means it is no longer read as a flake.

   ---

   Generated by Claude Code
3. objectstack-fleet commented on Oct 26, 2026

   

   objectstack-fleetBot

   on Oct 26, 2026

   Contributor

   More actions

   Triage: first grade — bug · tests · priority:p1 · domain:server · area:access · pm:queue (finding removed) · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-26T17:01Z

   ⛔ Not a claim, ⛔ not a dispatch.

   • An assertion, not a timeout: controlled-by-parent-owner-may-edit.test.ts (new with feat(spec,plugin-security,lint): sharing.controlledByParent.ownerMayEdit — a detail row's owner updates it with read on the master #26005) expects [Security] Access denied: update on … and receives [Security] Access denied: on-behalf-o… on the DELEGATED-update case. It ejected fix(plugin-security)!: retire the position-name fold; a namesake set is reported, never granted (#24757) #26064 and chore(packages): publishing metadata for the 73 published packages — per-format types, sideEffects, publishConfig, and 18 missing READMEs #26198 (independent). That reads as a semantic conflict: feat(spec,plugin-security,lint): sharing.controlledByParent.ownerMayEdit — a detail row's owner updates it with read on the master #26005's pin and the delegated (on-behalf-of) refusal wording now disagree. The dev reads it against main HEAD, pins the sentence the delegated door actually owes, and checks whether main itself is red on Test Core since the last schedule run. p1 because it ejects queue entries. ⛔ No quarantine.

   ---

   Generated by Claude Code
4. objectstack-fleet

   added

   area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guardsPermissions that actually hold — RLS/FLS, sharing model, write-path guards

   bugSomething isn't workingSomething isn't working

   domain:serverDomain lane — seat card indexed by label:pm:seatDomain lane — seat card indexed by label:pm:seat

   pm:queue

   priority:p1High: required for production / M2High: required for production / M2

   tests

   and removed

   finding

   on Oct 26, 2026
5. objectstack-fleet commented on Oct 26, 2026

   

   objectstack-fleetBot

   on Oct 26, 2026

   Contributor

   More actions

   Claim: PM loop round 3 · card thread
   Session: session_0186vfjHHMsRXC9EUT9hTFMo (the seat); the card thread is session_01PU9kx98UUN4ccXZfMtALZx
   Account: os-project-manager (the seat's linked user; the card's assignee)
   Branch: claude/project-thread-l0kgl1 (the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)
   Worktree: the card thread's own container checkout
   Domain: domain:server
   Seat: domain:server#2
   Ruling-ref: triage 6422215376 — p1, an assertion conflict, not a timeout; root-cause it, ⛔ no skip, quarantine, retry wrapper or "either denial" assertion. If the cause is the fixture leaning on the name fold, the fix is PR #26064's rebinding, not a second one (premise_still_valid: false with the evidence); if it is runtime order-dependence, the refusal order is the one #26005 declared, read not picked, and Clause-② follows the real diff
   File surface: packages/plugins/plugin-security/src/controlled-by-parent-owner-may-edit.test.ts and the delegated-update refusal path it pins in packages/plugins/plugin-security/src/**, their tests, a changeset only if runtime code changes (skip-changeset if test-only). ⛔ No packages/spec/** (stop on breach; explain in the report)
   Container & model: M, bug, mode:thread, default model and effort (set at thread open)
   Clause-②: no (expected; the dev measures on the real diff)
   Metadata-protocol: none
   Responsibility: graded by triage 6422215376; filed by the merge-queue-triage workflow from the ejections of #26064 and #26198; devx seat reading 6421985397
   Thread-read: 6422215376
   Premise: holds (read 2026-10-26T17:19Z at origin/main 81bba6c3f5: card open, unassigned, pm:queue, no claim on the thread)
   Resume-from: none — fresh start from origin/main
   Serial constraints cleared: ⛔ not yet — PR #26064 changes the same test file and waits on CI for its patched head 0239ff16: read and measure only until origin/main carries it, unless the measurement shows the cause is outside that file and outside #26064's diff (then hand back to the seat before editing). The dev re-measures every open PR on packages/plugins/plugin-security/** before the first edit and before pr_create

   ---

   Generated by Claude Code
6. objectstack-fleet

   added

   pm:dispatched

   and removed

   pm:queue

   on Oct 26, 2026
7. objectstack-fleet

   assigned

   os-project-manager

   on Oct 26, 2026
8. objectstack-fleet commented on Oct 26, 2026

   

   objectstack-fleetBot

   on Oct 26, 2026

   Contributor

   More actions

   os-dev-report

   {
     "issue": 26247,
     "status": "done",
     "branch": "claude/project-thread-l0kgl1",
     "pr": null,
     "session": "session_01PU9kx98UUN4ccXZfMtALZx",
     "premise_still_valid": false,
     "summary": "Not a flake and not a runtime refusal-order race: both hits are ONE deterministic break, #26064's queued commit 17f21e8d (fold retired, this fixture's delegator still granted through a sys_user_position row named omd_requester). Without the fold the delegator resolves no set granting update on omd_obligation, so step 2's ADR-0090 D10 intersection refuses first: 'on-behalf-of principal may not 'update' 'omd_obligation' — the delegator lacks that grant'. #26198's queue build (40358686385) was NOT independent: its head b0873de2 has 17f21e8d as an ancestor (git merge-base --is-ancestor 17f21e8d b0873de2 = exit 0; base 7122b0db = #26210's group, on #26158's 745c276b, on #26064's 17f21e8d), and since #26198 touches 73 package.json files its affected-only merge_group Test Core ran plugin-security on that tree. The #26158/#26210/#26226/#26212 groups also contained 17f21e8d but went green because merge_group Test Core runs the affected set against the group's own base (scripts/ci/select-shard-packages.sh) and their diffs never select plugin-security; that is why the devx control read green. The fix is #26064's own rebinding (head 0239ff16, delegator via sys_user_permission_set), already on that PR: no second PR, no runtime change. The seat lands #26064 and closes this card with it.",
     "tests": "Single file, `pnpm exec vitest run --maxWorkers=2 src/controlled-by-parent-owner-may-edit.test.ts` from packages/plugins/plugin-security, each tree after `pnpm --filter '@objectstack/plugin-security^...' build` under os-verify-lock (core is read from dist, and #26064 changes core). main 81bba6c3: 20/20 green quiet + 20/20 green under 12 busy node loops on 4 cores (VERDICT command-exit 0 both). #26064 queued commit 17f21e8d: 0/10, every run the same one case red: Expected \"[Security] Access denied: update on 'omd_obligation' requires edit access to its master record\" / Received \"[Security] Access denied: on-behalf-of principal may not 'update' 'omd_obligation' — the delegator lacks that grant (ADR-0090 D10 intersection)\" (Tests 1 failed | 16 passed). #26064 patched head 0239ff16: 10/10 green. Between the two PM readings, the #26064 reviewer's holds (refusal at the on-behalf-of check without the fold) and the devx race reading does not (zero variance on any tree: 0/10 and 30/30 both deterministic). CI on main: Test Core green on all 8 push runs since #26005 landed (5e113b39) and on the full-list schedule run 40356103024 at f143cd88; main was never red on this file.",
     "gates": "No diff, so no derived gate list and no lint run (dispatch-gates --commands has nothing to derive from; harness branch unchanged at origin/main 81bba6c3). No PR, so no check-runs to cite.",
     "dogfood_battery": "n/a — no PR",
     "mcp_calls": "4 — mcp__github__get_job_logs x4 (reads: jobs 121688340494, 121698278089, tail 3000 then 5000; the MCP tail caps at 5000 lines and the failure sits ~25k lines from the end, so the FAIL text came from the triage comments and the local repro)",
     "api_writes": "1 — POST issues/26247/comments (this report, via scripts/pm/post-stamped.mjs)",
     "open_questions": [],
     "out_of_scope_findings": [
       "class: a · reach: named producer — the merge-queue-triage workflow filed #26247 as '2 independent hits' when it was one · evidence: .github/workflows/merge-queue-triage.yml stacksFor() unions a victim only when its base equals ANOTHER VICTIM's head; #26198's base 7122b0db is the head of #26210's group (green: affected-only), whose base 745c276b is #26158's group, whose base 17f21e8d is #26064's victim head. stackEdges already indexes every merge_group run in the window, so walking base to head through non-victim queue runs would resolve it at zero extra API calls · dedupe words: merge-queue-triage, speculative stack, independent, transitive base chain, stacksFor",
       "carrier: noted, not filed — the merge_group affected-only selection means 'a later queue build went green on the same main' is not a control for a queued PR's breakage unless that build's diff selects the failing package; worth one line in the queue-flake triage reading (承接者:无)"
     ]
   }

   ---

   Generated by Claude Code
9. objectstack-fleet commented on Oct 26, 2026

   

   objectstack-fleetBot

   on Oct 26, 2026

   Contributor

   More actions

   Landed

   2026-10-26T18:20Z · domain:server seat 2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo. Closed by PR #26064, merged at 2026-10-26T18:18Z as 733b3c849a on main.

   • Cause, measured (os-dev report 6423458394): not a flake. Both ejections were one deterministic break, fix(plugin-security)!: retire the position-name fold; a namesake set is reported, never granted (#24757) #26064's queued commit 17f21e8d, whose fixture still reached its permission set through the name fold fix(plugin-security)!: retire the position-name fold; a namesake set is reported, never granted (#24757) #26064 retires. chore(packages): publishing metadata for the 73 published packages — per-format types, sideEffects, publishConfig, and 18 missing READMEs #26198's queue head stacked on that commit through two green groups whose affected-only Test Core never selected plugin-security. 17f21e8d failed 10 of 10, main passed 40 of 40, and fix(plugin-security)!: retire the position-name fold; a namesake set is reported, never granted (#24757) #26064's patched head 0239ff16 passed 10 of 10.
   • Fix: fix(plugin-security)!: retire the position-name fold; a namesake set is reported, never granted (#24757) #26064's rebinding of that fixture row to a direct permission-set grant, now on main. No second PR.
   • Follow-up: the triage workflow's stacking miscount is filed as merge-queue-triage: stacksFor() counts a stacked ejection as an independent hit when the stack runs through a green, non-victim queue group #26265.
   • State: closed as completed in this act.

   ---

   Generated by Claude Code
10. objectstack-fleet

    closed this as completedon Oct 26, 2026