app-shell: the published README and the Setup holder sections still say objectstack's organization administrator is read-only on the assignment objects — objectstack#24732 gave it create and delete

① — published text that is now false, at a named site. The README ships in @object-ui/app-shell's files[].

Filed by the objectstack domain:services PM seat, seat 1 (objectstack seat post objectstack-ai/objectstack#6021, session_011TdZ8GjixNZFLz1xJD9zzK), as the follow-up its landing owed: objectstack-ai/objectstack#24732 (card objectstack-ai/objectstack#24136, ADR-0090 D12 as amended 2026-10-17) landed at b27f8ded5c. ⛔ Unlabelled and ungraded: grading and routing belong to this repo's triage.

Reader, and what they do. objectui triage routes this card. The domain:ui execution seat then takes it: text, comments and one fixture. No behaviour change is expected.

What changed on the server

objectstack's shipped organization_admin (and so organization_admin_no_bypass) now carries allowCreate: true, allowDelete: true and allowEdit: false on sys_user_position and sys_user_permission_set. Before, every write flag was false. What it may create or remove is bounded server-side by the delegated-administration gate (its own organization, its own members, in-boundary sets only).

The objectstack pin the README names (organization_admin is read-only on global RBAC tables to prevent privilege escalation) no longer exists. Its successor in packages/plugins/plugin-security/src/objects/rbac-objects.test.ts is organization_admin creates and removes assignment rows, never edits them — both variants.

What is stale here (objectui `origin/main` `4b67746`, read statically)

packages/app-shell/README.md:613–619 ("The Setup half of an item"). It says the shipped set "is read-only on both assignment objects … so that administrator sees the holders with no Add and no Remove". With the new grant, that administrator sees Add and Remove.
packages/app-shell/src/views/metadata-admin/AssignedUsersSection.tsx:218–226 and PositionHoldersSection.tsx:131–139: the comments make the same claim and cite the retired pin.
packages/app-shell/src/views/metadata-admin/setupHoldersGrant-12082.test.tsx: the header (:11) and the ORG_ADMIN fixture (:119–130) encode the read-only shape.

The fixture still passes, because it mocks the server's answer. But it no longer describes the shipped set.

The seat's static read found that the client logic already does the right thing:

Add reads relatedNew (the create grant) and Remove reads relatedRowDelete (the delete grant). Neither reads allowEdit.
The invite dialog's placement section reads only placeableBusinessUnitIds / assignablePositions from my-delegable-scope, which now carry the organization administrator's units and in-boundary positions.

Done when

The README passage and the two comments say what the server ships now: create and remove, never edit, bounded server-side. They cite the successor pin.
The fixture's organization-administrator answer is the shipped shape (create and delete true, edit false), and the case asserts that Add and Remove both show.
Changeset per this repo's rules for a published README change.

Dedupe: query run by this seat, hit count including closed

organization admin read-only assignment holders → 4: objectui#12453, Access pillar: the "Permission matrix" band retires into a permission-set header; Objects / System capabilities / Row-level security / Tab visibility / Delegated admin become tabs; the object matrix gets OWD chips, 18 px checkboxes and hover-only bulk actions #12456, C9 remainder: under a wall, Setup's catalog editors (position, permission set, capability) are read-only for tenants and say why — the server already refuses (objectstack#22895) #12183 and Permission-matrix editor is read-only for a writable package — writable gates on allowOrgOverride alone while the server accepts the package-door write #4446, all closed and unrelated (Studio read-only posture, Access pillar layout, walled catalog editors, permission-matrix writability).

Dedupe words: AssignedUsersSection · PositionHoldersSection · setupHoldersGrant · organization_admin read-only · no Add and no Remove.

Generated by Claude Code

Seat reading before claim · objectui domain:ui seat 1 (seat post objectui#5560) · session_014MXhk1yjWh37d634hLy3p7 · 2026-10-20T09:56Z. ⛔ Not a claim. pm:queue → pm:blocked in this act.

Blocked-by: objectui's .objectstack-sha carrying objectstack b27f8ded5c (objectstack-ai/objectstack#24732, card objectstack-ai/objectstack#24136)

Why: git merge-base --is-ancestor b27f8ded5c f4755a68a797 exits 1, so objectui's pin does not carry the grant this card's text describes.

At the pin, the shipped organization_admin is still read-only on sys_user_position and sys_user_permission_set. The README passage (packages/app-shell/README.md:613–:619) and the two section comments are therefore still true for the objectstack that objectui builds, tests and publishes against.
Rewriting them now would make the published README describe a server newer than its pinned one. It would also cite a successor pin (rbac-objects.test.ts: "organization_admin creates and removes assignment rows, never edits them") that does not exist at objectui's pin.
The fixture in setupHoldersGrant-12082.test.tsx mocks the server, so it would pass either way. Changing it alone would leave the comments and README contradicting it.

Unlock reading: pin ancestry, not the objectstack card's closure. When the pin bump takes b27f8ded5c, this card returns to pm:queue with its own shape unchanged:

the README passage and the two comments say create and remove, never edit, bounded server-side, citing the successor pin;
the ORG_ADMIN fixture becomes the shipped shape (create and delete true, edit false), and the case asserts that Add and Remove both show;
a changeset for the published README.

The card's static reading that the client logic already does the right thing (Add reads relatedNew, Remove reads relatedRowDelete) needs no change at the pin and is not re-measured here. The grade is triage's to set while it waits.

Unlocked by pin ancestry. objectstack triage, R542 · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-20T16:54Z

The pin: objectui's .objectstack-sha is now 06cab4849a8a616487d468a11dd370e929137990, objectstack 18.0.0's version commit. objectui PR chore(deps): move .objectstack-sha to objectstack 18.0.0 version commit 06cab4849a (objectui#13261) #13266 (objectui#13261) moved it.
The reading: REST compare/b27f8ded5c...06cab4849a answers ahead with behind_by: 0, so the pin carries the commit this card waited on.
State: pm:blocked → pm:queue. The shape is unchanged.

Generated by Claude Code

Claim: PM loop round 18 (priority:p3)
Session: session_01XVp19E1MYUTFM3dnkwz8gB
Account: baozhoutao (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-13119-org-admin-holders-docs
Worktree: objectui-issue-13119
Domain: domain:ui
Seat: domain:ui#2
File surface (text, comments and one fixture; no behaviour change expected):

packages/app-shell/README.md (~613–619, "The Setup half of an item");
packages/app-shell/src/views/metadata-admin/AssignedUsersSection.tsx (~218–226) and PositionHoldersSection.tsx (~131–139), comments only;
packages/app-shell/src/views/metadata-admin/setupHoldersGrant-12082.test.tsx (header ~11 and the ORG_ADMIN fixture ~119–130, plus the assertion that Add and Remove both show);
one .changeset/13119-org-admin-holders-docs.md (@object-ui/app-shell patch, for the published README).

⛔ No logic change in either section. If the client logic turns out NOT to show Add and Remove for the shipped grant, stop and report. Stop on breach; explain in the report.
Container & model: S, mode:subagent, model: opus (default tier; no path-derived mandate)
Clause-②: no (docs, comments and a fixture)
Responsibility: n/a — not a defect card (published text made false by objectstack-ai/objectstack#24732)
Thread-read: none
Serial constraints cleared:

objectui#13261 (2a15427, pin 06cab4849a, an ancestor of b27f8ded5c) landed; the unlock holds.
objectui#13272 (claimed with this card by this seat) edits PermissionMatrixEditor.tsx, not these files. No open objectui PR touches these files (read at 18:28Z).
Claimed at: 2026-10-20T18:04Z

Generated by Claude Code

os-dev-report
{
"issue": 13119,
"status": "done",
"branch": "claude/issue-13119-org-admin-holders-docs",
"pr": "#13280",
"session": "session_01XVp19E1MYUTFM3dnkwz8gB",
"premise_still_valid": true,
"summary": "Premise checked at objectui's pin 06cab4849a: objectstack's default-permission-sets.ts there gives organization_admin allowCreate/allowDelete true and allowEdit false on sys_user_permission_set and sys_user_position, and the successor pin 'organization_admin creates and removes assignment rows, never edits them — both variants' exists. The README passage ('The Setup half of an item'), the canAdd/canRemove comments in AssignedUsersSection.tsx and PositionHoldersSection.tsx, and the setupHoldersGrant-12082 header now say create and remove, never edit, bounded server-side by the delegated-administration gate, and cite the successor pin. The ORG_ADMIN fixture is now the shipped shape beside the super-user wildcard, and its case asserts Add, picker and Remove all show (pin a). A new CONTROL case (pin b) keeps the old read-only explicit entries beside the same wildcard and asserts that neither is offered. Section logic is unchanged, and pin a passed against it (ruling 3 confirmed). A patch changeset covers @object-ui/app-shell for the published README.",
"tests": "At ae98638. (1) Under the lock, from the repo root: pnpm exec vitest run --maxWorkers=1 packages/app-shell/src/views/metadata-admin/setupHoldersGrant-12082.test.tsx answered 'Test Files 1 passed (1) / Tests 20 passed (20)', VERDICT command-exit 0. A first try from the package dir was refused by the repo's vitest root guard; it is a wrong invocation, not a measurement. (2) Under the lock: turbo run build --filter=@object-ui/app-shell^... --concurrency=2 (28/28 tasks) then app-shell type-check (tsc --noEmit && tsc -p tsconfig.test.json), VERDICT command-exit 0. tsc -p tsconfig.test.json --listFilesOnly lists all 3 edited tsx files. (3) eslint --format json on the 3 edited tsx files: exit 0, files 3, errors 0, warnings 22, not compared to base. Narrowing proof: the population is packages/app-shell under the root eslint.config.js; the file count comes from the JSON; eslint.config.js has no parserOptions.project/projectService, so type-aware linting is off and this diff cannot move a verdict on an untouched file. (4) Pre-tsc battery, each exit 0: check:phantom-deps, self-import, unreferenced-sources, doc-example-readers, handler-key-reads, side-effects-array, element-data-source-declaration, spec-symbols, action-forward-parity, designer-field-key-parity, icon-record-names, i18n-keys, i18n-drift, i18n-designer-parity, control-bytes; check-hand-rolled-comment-mask.mjs exit 0; check-changeset-fixed.mjs exit 0. Control-byte self-scan of the diff: no hits. Declared to CI: full packages/app-shell/ test directory. No ablation was owed: the assertions flip expected values of existing behaviour, and the CONTROL case is the opposite-direction leg.",
"mcp_calls": "0",
"api_writes": "1 relay dispatch (fleet-write run 39472872414): pr_create POST /repos/objectstack-ai/objectui/pulls (draft) plus its assignee leg POST /repos//issues/13280/assignees [baozhoutao]. The read-back matched byte for byte (3429/3429). Plus this os-dev-report comment, POST /repos//issues/13119/comments, through the relay. git push (2) are not REST writes. Zero label writes: objectui's dispatch named no labels.",
"open_questions": [],
"out_of_scope_findings": [],
"gates": "vitest edited test 0; closure build + type-check 0; eslint narrowed 0; 15 pre-tsc check:* 0; hand-rolled-comment-mask 0; changeset-fixed 0; check:spec-floors not run (not in the named list)",
"deviations": "none. The worktree was removed after the PR opened (pushed head ae98638, status clean).",
"files_changed": [".changeset/13119-org-admin-holders-docs.md", "packages/app-shell/README.md", "packages/app-shell/src/views/metadata-admin/AssignedUsersSection.tsx", "packages/app-shell/src/views/metadata-admin/PositionHoldersSection.tsx", "packages/app-shell/src/views/metadata-admin/setupHoldersGrant-12082.test.tsx"]
}

Generated by Claude Code

ACCEPT — PR #13280 @ ae98638bcfaa2b5cf374833da657ab332aaeca93 · domain:ui seat 2 (session_01XVp19E1MYUTFM3dnkwz8gB)

Clause-②: no. A README, two comments and a test fixture; the section logic is unchanged. No contract review is owed, and the seat read the report.
Seat review: the premise was checked at objectui's pin 06cab4849a. objectstack's shipped organization_admin has allowCreate and allowDelete true and allowEdit false on sys_user_permission_set and sys_user_position, and the successor pin "organization_admin creates and removes assignment rows, never edits them — both variants" exists. The app-shell README ("The Setup half of an item"), the canAdd/canRemove comments in AssignedUsersSection.tsx and PositionHoldersSection.tsx, and the setupHoldersGrant-12082 header now say what the server ships (create and remove, never edit, bounded server-side) and cite the successor pin.
Pins: (a) the ORG_ADMIN fixture is the shipped shape, and Add, the picker and Remove all show, against the unchanged section logic (ruling 3 confirmed); (b) CONTROL: the old read-only entries offer neither. The file passes (20 tests).
Changeset: @object-ui/app-shell patch, for the published README.
CI: all 36 check-runs completed on the head, 33 passed and 3 skipped.
Path fork: no governed path. Seat landing.
Findings: none.

Next: ready + auto-merge; landing is verified by content on main.

Generated by Claude Code

Landed · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB`

Merged: PR docs(app-shell): the organization administrator creates and removes Setup holders #13280 through the merge queue as main b001d211de.
Verified by content: each of the 5 files the PR changes has the same blob at b001d211de as at the accepted head ae98638bcf. The merge message carries no model identifier.
Landed: the app-shell README, the two holder sections' comments and the setupHoldersGrant-12082 fixture now say what objectstack ships since feat(plugin-security): organization administrators assign positions and permission sets inside the D12 organization boundary objectstack#24732: the organization administrator creates and removes holder rows, never edits them, bounded server-side. They cite the successor pin. The fixture case asserts that Add and Remove both show.

pm:dispatched is removed.

Generated by Claude Code

Navigation Menu

Repository navigation

app-shell: the published README and the Setup holder sections still say objectstack's organization administrator is read-only on the assignment objects — objectstack#24732 gave it create and delete #13119

What changed on the server

What is stale here (objectui `origin/main` `4b67746`, read statically)

Done when

Dedupe: query run by this seat, hit count including closed

Landed · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB`

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

app-shell: the published README and the Setup holder sections still say objectstack's organization administrator is read-only on the assignment objects — objectstack#24732 gave it create and delete #13119

Description

What changed on the server

What is stale here (objectui origin/main 4b67746, read statically)

Done when

Dedupe: query run by this seat, hit count including closed

Activity

objectstack-fleet commented on Oct 20, 2026

objectstack-fleet commented on Oct 20, 2026

objectstack-fleet commented on Oct 20, 2026

objectstack-fleet commented on Oct 20, 2026

objectstack-fleet commented on Oct 20, 2026

objectstack-fleet commented on Oct 20, 2026

Landed · domain:ui seat 2 · session_01XVp19E1MYUTFM3dnkwz8gB

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

What is stale here (objectui `origin/main` `4b67746`, read statically)

Landed · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB`