[objectstack-fleet]

Requested by Elon · project thread

domain:server#3 · os-elon-musk · session_016WV4cyh2cxBQ2LKn2VVfxq

Fixes #27706

What changes

Comments only, in packages/services/service-messaging:

• src/http-outbox.ts, doc comment of assertHttpRedeliverable ("Why this is a security refusal and not a tidiness one"): the sentence "POST /api/v1/webhooks/redeliver is reachable by any authenticated user" and the "that user" clause after it now name the current check: edit (update) access to sys_webhook, as decided by packages/plugins/plugin-webhooks/src/redeliver-entitlement.ts. The refusal's own reason (a parked row carries no signature) is unchanged.
• src/http-outbox-parked-record.integration.test.ts, header comment: the same clause ("which any authenticated user can reach") is corrected the same way.

No code and no assertion changed.

Why

After #27474 the redeliver door admits only a caller with edit access to sys_webhook. A security doc comment that names the wrong check misleads the next person deciding what the door allows.

Verification

• git diff origin/main: 2 files, +7 / -3, all inside comment blocks.
• All 53 gate families derived by dispatch-gates --commands plus pnpm lint were run. 46 exit 0, plus pnpm lint.
• check:dispatcher-error-vocabulary and check:query-options-erasure went red on the first pass only because the gitignored, generated packages/spec/src/migrations/registry.ts did not yet exist in the fresh worktree. Re-run after it was generated: both exit 0.
• Exit 3 (prerequisite not met, needs a whole-tree build), NOT MEASURED locally: check:dts-closure, check:dual-build-cjs-loads, check:i18n, check:lean-entry-closure, check:sourcemap-no-sources-content. A comment-only diff cannot move them; CI measures them.
• check:commit-card-trailers --range origin/main..HEAD: pass.

Out of scope, reported and not edited: src/messaging-service.ts:389-391 (the redeliver doc comment, #10740 paragraph) still says the door "is open to any authenticated user". The package CHANGELOG.md has the same historical phrase, which is a release record and is not hand-edited.

No changeset: comments only (skip-changeset requested from the seat).

Clause-②: no
Metadata-protocol: none

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic.
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes.
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: its generated artifacts are regenerated and committed.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.
• The Before Submitting list in CONTRIBUTING.md is done.

维护者速读

• 改了什么：webhook 重投递入口的两处代码注释，改为写明现行权限（对 sys_webhook 有编辑权）。
• 为什么改：fix(plugin-webhooks): gate webhook redelivery on webhook-administration access #27474 后权限已收紧，注释还写着"任何登录用户可达"，会误导后来判断安全面的人。
• 风险与回滚：只改注释，无行为变化；回滚即 revert。
• 先看：http-outbox.ts 中 assertHttpRedeliverable 的注释段。
• 两分钟验证：看 diff，只有注释行变动。
• 需要你做的：无。

🤖 Generated with Claude Code

https://claude.ai/code/session_016WV4cyh2cxBQ2LKn2VVfxq

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-messaging, touching 2 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/webhooks.mdx (via /api/v1/webhooks/redeliver (route, a path literal in a comment in MessagingService; a path literal in a comment on a changed line))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-2.mdx (via MessagingService (symbol, a top-level class))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 968cacfd10fdec64b6089d0da4f721f1a8a10925 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 47da880ff5f7eba4bdd2f6d877de320fb7b2b00e — the merge of head c4bf56b1fa1b6dbc7f02feabe0cb9c7b2fb179a3 into base 968cacfd10fdec64b6089d0da4f721f1a8a10925, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 47da880ff5f7eba4bdd2f6d877de320fb7b2b00e && git checkout 47da880ff5f7eba4bdd2f6d877de320fb7b2b00e
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 968cacfd10fdec64b6089d0da4f721f1a8a10925 c4bf56b1fa1b6dbc7f02feabe0cb9c7b2fb179a3 && git checkout -B drift-repro 968cacfd10fdec64b6089d0da4f721f1a8a10925 && git merge --no-ff c4bf56b1fa1b6dbc7f02feabe0cb9c7b2fb179a3

node scripts/docs-audit/affected-docs.mjs --json 968cacfd10fdec64b6089d0da4f721f1a8a10925

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 968cacfd10fdec64b6089d0da4f721f1a8a10925 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia

Seat ACCEPT · PR #27776 · head c4bf56b1fa1b6dbc7f02feabe0cb9c7b2fb179a3 · 2026-10-29T23:31Z

席位核对

• Shape: draft → main, with Fixes #27706. Comments only, in three files under packages/services/service-messaging/src/: http-outbox.ts, http-outbox-parked-record.integration.test.ts, and messaging-service.ts. check-governed-merges --pr 27776: NOT governed, +11 / −5.
• Fold: the PR body lists the messaging-service.ts tenant-audit, the update half: ack is a dispatcher sweep but redeliver is request-reachable — two sites on one object with OPPOSITE classifications #10740 sentence as out of scope. It is folded in by the second commit, under the seat's claim amendment on 6509770280 (same defect class, comment only). The body can't be edited through the relay, so this record carries the fold.
• Each changed sentence read against the code it names: the redeliver door admits a caller with edit (update) access to sys_webhook, as packages/plugins/plugin-webhooks/src/redeliver-entitlement.ts decides. The refusal's own reason (a parked row carries no signature) and the tenant-audit, the update half: ack is a dispatcher sweep but redeliver is request-reachable — two sites on one object with OPPOSITE classifications #10740 tenant scoping are unchanged.
• Gate check-runs on this head: 48 total, 34 success, 14 skipped by the path filter, 0 failed.
• Changeset: none (comments only), so skip-changeset is applied by the seat.
• Declarations: Clause-②: no, Metadata-protocol: none. No behaviour changes, and no contract review is owed.
• Landing: Tier S, under the maintainer's landing grant for this term (2026-10-29 22:05Z, seat thread). Ready + auto-merge through the relay.

ACCEPT