Repository navigation
chore(objectui): move the console pin to carry objectui#12475 (objectui main 720f6d4): the shipped console still shows History and Audit to an organization admin, which #23546's narrowed trail doors now refuse with 403 #23691
Description
Filing gate ①, cross-repo rule 3 (a follow-up for the consuming side, filed by the seat that accepted the producer PR). reach: the named producer is the console build at the current pin.
.objectui-shaonorigin/mainisb9814b334d8a.- At that objectui commit, Setup's catalog item editors (
ResourceEditPage.tsx,PermissionMatrixEditor.tsx) render History and Audit with no capability gate. That was read at that very pin by rest/runtime: under a wall, the /meta history, audit and package-commits doors admit setup.access, which organization admins hold, so an organization admin reads the environment-wide authoring trail of any item #23546's readings6189071639. - Since PR fix(rest,runtime)!: the authoring-trail doors stop admitting setup.access, so an organization admin is refused the environment's trail #23674 (
c2635881e0, rest/runtime: under a wall, the /meta history, audit and package-commits doors admit setup.access, which organization admins hold, so an organization admin reads the environment-wide authoring trail of any item #23546),GET /meta/:type/:name/history,/auditand/diffrefuse a caller holdingsetup.accesswithoutstudio.access/manage_metadatawith403 FORBIDDEN. An organization admin on the shipped console therefore gets two buttons that always fail.
Filed by domain:cli seat 2 (#22648) · sunhaolin · session session_01Q9PZ5Pzqcus4woVvTZwWNU. ⛔ Not a claim. Grade and lane are triage's. The last pin card, #23392, was domain:devx.
What is owed
- Ruling
6190477105item 3 (the maintainer's A1 on rest/runtime: under a wall, the /meta history, audit and package-commits doors admit setup.access, which organization admins hold, so an organization admin reads the environment-wide authoring trail of any item #23546): "The pin bump follows the objectui PR, through the repo's bump script." - The objectui half has landed: app-shell (Setup catalog editors): show History and Audit only to a caller the trail doors admit — objectstack#23546 narrows /meta history, audit and diff away from setup.access objectui#12475, closed by objectui PR docs(cli): past-tense the deleted detectMode VITEST arm in two serve e2e headers #12495 as objectui
main720f6d4at 13:59Z. It addsuseCanReadAuthoringTrail()(studio.accessormanage_metadata) and renders History and Audit only under it. - The hop:
b9814b334d8ato a commit carrying720f6d4(71 commits ahead at 14:55Z, by RESTcompare). Moving the pin carries every objectui change in that range, not only The 19 remainingcheck:comment-mask-adoptionrows are recorded by SHAPE, not by measured behaviour — two of the first three converted were deleting real code #12475. - How: through
scripts/bump-objectui.shand thenpnpm objectui:build(the pin-update procedure, sdui.manifest.json 的来源未定:声明一致性 ratchet 目前只在手工pnpm sdui:manifest时跑,CI 里从来不跑(#4690 的遗留决定) #5960, [finding] nothing wires an sdui.manifest.json, so validateJsxPages runs parse-only and validateTree — including both ported lockstep diagnostics — is dead code in the production gate #12924). ⛔ Not as a rider on another PR.
Reader who acts
Triage grades it and routes it (the console-pin lane).
Dedupe words: console pin objectui 720f6d4; .objectui-sha b9814b334d8a; useCanReadAuthoringTrail; History Audit 403 organization admin console.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 15, 2026
Triage: first grade ·
bug·priority:p0·security·domain:devx·pm:queue· scope widened to carry objectstack-ai/objectui#12493 · triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-15T15:52ZRead fresh. This card owes the console pin hop for objectstack-ai/objectui#12475 (objectui
main720f6d4), per ruling6190477105item 3.Widened in this act: the p0 objectstack-ai/objectui#12493 (a
?handoffPrompt=URL drove the AI build agent with no user action, and could publish metadata as an environment owner) landed at 15:28Z. That is objectui PR objectstack-ai/objectui#12536 → objectuimainb512428..objectui-shaisb9814b334d, read in R419.720f6d4andb512428. One bump, throughscripts/bump-objectui.shthenpnpm objectui:build.Grade p0 +
security: this bump is the only way objectstack-ai/objectui#12493's fix reaches objectstack's shipped console and the next 18 prerelease. Its upper bound is the p0 it delivers.Lane
domain:devx(the console pin; the last pin card, #23392, wasdomain:devx).Scope:
mainat or afterb512428, and read the range'scomparecount in the PR body. Every objectui change in the range rides with it.AiChatPagenever sends?handoffPrompt=;setup.access-only caller.findingleaves on grading.objectstack-fleet commentedon Oct 15, 2026
Claim: PM loop round 3 ·
domain:devxseat 2 · 2026-10-15T16:55Z ·priority:p0(it jumps the line; this seat has nothing in flight under 「串行派发」)Session:
session_016PVjjuVPte5XEJvaQx1E4tAccount:
os-sales(the seat's linked user asGET /useranswers it; the card's assignee)Branch:
claude/issue-23691-console-pin-hopWorktree:
objectstack-issue-23691Domain:
domain:devxSeat:
domain:devx#2File surface:
.objectui-sha;sdui.manifest.json;scripts/sdui-manifest.record.json;packages/sdui-parser/objectui-lockstep.json; the console changeset and the pin-citation changeset under.changeset/thatscripts/bump-objectui.shderives; the pin-citation re-measure sites thatcheck:objectui-pin-citationsnames. Stop on breach and explain it in the report. ⛔ No objectui source edit: both fixes have landed there. ⛔ Nopackages/console/dist/or.cache/objectui-*by hand. A describe text this hop makes TRUE inpackages/spec/src/**is in scope only if a gate demands it: name it in the report, and the PR then owes a## Contract reviewatCONTRACT_REVIEW_TIERbefore the queue.Container & model:
M,mode:subagent,model: TIER_DEFAULT(dispatch-gates --tieratf77ba411e: "no path-derived mandate"; the same shape as the last hop, #23392 / PR #23424)Clause-②: no
Responsibility: the console bundle at the pin
b9814b334d8aproduces the risk: it renders History and Audit with no capability gate, which an organization admin now meets as403, and it auto-sends a?handoffPrompt=URL to the AI build agent with no user action (objectstack-ai/objectui#12493) | no platform path covers it: both fixes are on objectuimain(720f6d4,b512428), and only this pin hop ships them in objectstack's console | every organization admin on the shipped console reaches the first, and anyone who opens a crafted link reaches the secondThread-read: 6196301086
Serial constraints cleared:
.objectui-shais inSINGLE_CLAIM_PATHS. No open PR touches it,sdui.manifest.json,scripts/sdui-manifest.record.jsonorpackages/sdui-parser/objectui-lockstep.json: all 11 open non-release PRs' file lists were read at this act.pm:dispatchedcard's claim names those files.main=1f23d5b070fa, 83 commits ahead of the pin and 0 behind. It is 12 commits past720f6d4and 2 pastb512428, so it carries both. Its own CI on that tip was still running when read (41 success, 22 in progress, 0 failed). The dev re-reads it and pins a tip whose objectui CI is green and that carries both.Generated by Claude Code
objectstack-fleet commentedon Oct 15, 2026
os-dev-report
{
"issue": 23691,
"status": "done",
"branch": "claude/issue-23691-console-pin-hop",
"pr": "#23709",
"session": "session_016PVjjuVPte5XEJvaQx1E4t (the dispatching seat's session; mode:subagent)",
"premise_still_valid": true,
"summary": "Draft PR #23709 moves .objectui-sha from b9814b334d8a to objectui main 1f23d5b070fa (REST compare 83 ahead / 0 behind, 300 files), which carries 720f6d4 (objectstack-ai/objectui#12475, History/Audit behind useCanReadAuthoringTrail) and b512428 (objectstack-ai/objectui#12493, no ?handoffPrompt= auto-send); both merge-base --is-ancestor exit 0. 1f23d5b070fa was chosen over the tip b5416943ce45 because its objectui required set read 41/41 completed-success at 17:43Z while the tip's push run was still running (later one cancelled Lint) and main had moved on to 518a8e308466. Through scripts/bump-objectui.sh --no-commit then objectui:build and gen-sdui-manifest-node.mjs, the PR carries the derived console changeset (major, objectui's declared sync major, safe in pre mode on next: the next.1 cut consumed two majors and stayed 18.0.0-next.x; ADR-0087 answered not-required (no-migration-prescription) for all five breaking entries), the regenerated sdui.manifest.json + record (107 components, sha256 370153544e9b, record:related_list gains parentDataSource), and the re-recorded sdui-parser lockstep (grammar and predicate blobs unchanged, no port owed). Both acceptance readings are evidenced at the pin by source, the objectui pin tests and the BUILT bundle (with positive controls); no live browser run.",
"tests": "At HEAD 7ab227d (final commit), through os-verify-lock (VERDICT command-exit 0, held 20s): pnpm --filter @objectstack/sdui-parser exec vitest run --maxWorkers=2 → Test Files 14 passed (14), Tests 225 passed (225); pnpm --filter @objectstack/lint exec vitest run --maxWorkers=2 src/validate-jsx-pages.production-witness.test.ts (reads the real repo-root sdui.manifest.json) → Test Files 1 passed, Tests 5 passed. packages/cli tests that read a console-dist manifest declared to CI (no package source changed). No ablation: no tested behaviour changed (pin + generated artefacts only). Builds: client+sdui-parser closure 34 tasks VERDICT 0; scripts/build-console.sh at 1f23d5b070fa VERDICT 0 (canary import/jobs present, one zod literal {major:4,minor:6,patch:5}, spec injection asserted); full turbo build (!docs) 75 tasks VERDICT 0. Acceptance (a): git grep for get('handoffPrompt') at objectui 1f23d5b070fa under packages/apps → no hit, at the old pin → AiChatPage.tsx:882; built asset ObjectView-CPn8lYVn.js: .get(handoffPrompt) in any quote 0 hits (0 across all 3434 assets), positive control .get(package) 1 hit in the same component, followed by the navigation-state reader; dist copy cmp-identical; served by a smoke boot byte-identical with the same 0/1. Pin test AiChatPage.handoffNeverFromUrl-12493.test.tsx read (URL sends nothing; nav-state handoff once; reload no resend; control typed message sends). Acceptance (b): useCanReadAuthoringTrail = ['studio.access','manage_metadata'].some(...) in hooks/useCanAuthorMetadata.ts; ResourceEditPage.tsx:1210 call, gates at 1228/2322/2334/3251/3286; PermissionMatrixEditor.tsx:476 call, gates at 1560/1624/1787 (History only, no Audit entry there); pin test trailDoorsGate-12475.test.tsx (setup.access-only sees neither; studio.access / manage_metadata see both; unreported fails open; create-mode control). Bundle: useCanAuthorMetadata-B_1yXw8l.js exports the gate, metadata-admin-GnoOznL8.js imports it as ht, Sn=ht(), both audit-button and history-button behind !n&&Sn&&. Live browser: not run (source + bundle reading only). Smoke boot pnpm dev -- --fresh -p 43198: health 200 (18.0.0-next.1), /_console/ 200 18552 bytes, entry 200, served /_console/.objectui-sha = 1f23d5b070fa4d0cee0274902944d247bc4588b7; stopped by recorded PIDs, port free.",
"gates": "Local subset at 7ab227d: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths, merge base f77ba41) derived 69 commands; each run with its exit code captured before any pipe: 67 exit 0 first time; node scripts/check-plugin-teardown-shape.mjs --self-test exit 3 (fixture 621a487 absent in the shallow clone) → fetched at depth 1 → exit 0 (48 cases); pnpm check:dual-build-cjs-loads exit 3 (PREREQUISITE NOT MET, no dist) → full turbo build → exit 0 (110 entries / 68 packages). --ran reconciliation exit 0: '69 derived, 69 run, 0 NOT-MEASURED, 0 UNRUN'. Named: check-sdui-manifest exit 0 (+ --self-test 13 cases), check:sdui-lockstep exit 0, check:objectui-changeset 0, check-adr-0087-registration --base origin/main 0, check-changeset-no-major --base origin/main 0 (pre mode, major noticed), check-empty-changeset 0, check:console-sha 0, check:console-injection 0. check:objectui-pin-citations (named by the dispatch) does not exist on main: retired in 1418de4 (ruling C on #23434). node scripts/pm/check-governed-merges.mjs --branch: 0 of 5 paths governed, 151 lines under 3000. CI on PR #23709 at 2026-10-15T17:46Z (not re-run locally): 37 check-runs, 11 success, 6 skipped, 20 in_progress. Success: Governed Surface Queue Guard, Dogfood Regression Gate, Check PR Size, Check Documentation Links, Auto Label, the claim/single-writer/closing-card guards. In progress: Build Core, Test Core 1-6/6, all Type Check lanes, all Lint lanes, Check Changeset. Console Pin Gate skipped on the PR (it is a main full-battery job). NOT MEASURED locally: repo-wide pnpm lint and the Type Check lanes (CI-owned).",
"mcp_calls": "0",
"api_writes": "2 relay strokes (each one POST /repos/objectstack-ai/objectstack/dispatches from this session, executed as objectstack-fleet[bot]): (1) pr_create → POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /repos//issues/23709/assignees [os-sales], read back 13704 bytes identical; (2) this report → POST /repos//issues/23691/comments. Plus 3 git pushes (empty-branch probe, 2 commits; not REST). 0 label writes.",
"files_changed": [
".objectui-sha",
".changeset/console-1f23d5b070fa.md",
"sdui.manifest.json",
"scripts/sdui-manifest.record.json",
"packages/sdui-parser/objectui-lockstep.json"
],
"changed_lines": "151 (+141 / -10), 5 files; under the 3000 human-merge line",
"line_budget": "n/a",
"deviations": [
"Standard-clause conflict, named, not silent: .claude/agents/os-dev.md rule 3 says a published statement this round makes false must be fixed in this round. The dispatch (item 5, the claim's file surface) forbids packages/spec/src edits unless a gate demands one. No gate demands one. Ruling C on #23434 says a pin hop moves nothing in packages/spec. I kept the PR to the pin artefacts. The statements made stale are in out_of_scope_findings, and open_questions asks the seat to choose the route.",
"Mechanism assumptions falsified: check:objectui-pin-citations no longer exists (retired 1418de4), so no pin-citation re-measure or pin-citation changeset; objectui main tip had moved to b5416943ce45 with CI still running, so the newest fully-green main commit carrying both fixes (1f23d5b070fa) was pinned, as the dispatch allowed.",
"Shared-state touches (fetches only, no HEAD moves): the sibling objectui clone was deepened with git fetch --unshallow (needed to walk the range; its HEAD stayed cf430cd10 on its branch); scripts/build-console.sh registered and I then removed (git -C objectui worktree remove --force, my own build artefact) the detached worktree .cache/objectui-1f23d5b070fa; in objectstack, git fetch --depth=1 of 621a487 for the teardown self-test fixture.",
"The bump script ran with --no-commit and I committed its two files myself, so each commit carries the model-free trailer pair AGENTS.md requires (Claude-Session + Co-authored-by: Claude), not the harness's model-named Co-Authored-By line. The PR footer uses AGENTS.md's session-URL form, not the harness's form.",
"The local console dist was built before the manifest regeneration, so its copy of sdui.manifest.json is the previous one. The dist is gitignored. CI and the release build their own; packages/console/dist was not edited by hand."
],
"open_questions": [
{
"question": "Liveness verdicts this hop makes stale: page.print (13 ledger rows planned, plus authorWarn/authorHint and 8 PagePrintSchema describes saying 'until it ships, nothing applies it'), record:related_list.parentDataSource (the [PLANNED — not yet rendered] marker, the page.json _note and spec test case E), and translation flows.successMessage / flows.errorMessage (planned). At objectui 1f23d5b070fa the console reads all of them. os-dev rule 3 wants them fixed in this round. The dispatch scoped spec edits out. Which route?",
"options": [
"A: file one domain:spec card now with Blocked-by: #23691. It flips the three verdicts after the pin lands: describes, ledger rows and notes, removing authorWarn, a new planned-with-authorWarn control for packages/lint/src/lint-liveness-properties.test.ts, gen:schema/gen:docs, state-counts and a spec patch changeset. That PR carries its own contract review. Cost: about 1 PR of roughly 100-200 lines. The stale author warning ships only if a release is cut before it lands.",
"B: add those hunks to PR #23709 in a patch round. Cost: PR #23709 then touches packages/spec/src and owes a contract review before the queue, which delays the p0/security console delivery. It is also the same spec-lane work as A, so more of the PR's risk sits outside the pin."
],
"recommendation": "A. The p0 is the handoffPrompt and trail-door fix, and it should not wait on a spec contract review. The flips are only true once this pin lands, so A orders them correctly. Ruling C already moved per-hop spec edits out of pin hops. The flips also need a design choice: the lint test's planned control has to move, and that is spec-lane work, not pin-hop work."
}
],
"out_of_scope_findings": [
"class: a · reach: measured on this branch — @objectstack/lint lintLivenessProperties (ESM dist) on a page declaring print emits rule liveness-planned-property, message 'sets
printbut this page property is planned — ... (not read YET)', hint '... no renderer applies the paper, margins, running header and footer or page numbers yet — printing the page today prints the screen layout'. That is false once this pin ships: objectui @1f23d5b070fa packages/components/src/renderers/layout/page-print.ts#buildPagePrintStylesheet applies all eight keys (objectstack-ai/objectui#11958). Same family, same stale cause: record:related_list.parentDataSource is still marked [PLANNED — not yet rendered] (component.zod.ts describe and docblock, liveness/page.json _note, spec test component-record-related-list-parent-23134.test.ts case E), but objectui packages/plugin-detail/src/renderers/record-related-list.tsx reads it (objectstack-ai/objectui#12294), and the regenerated manifest lists it as a renderer input. translation.json flows.successMessage and flows.errorMessage are planned, but objectui packages/app-shell/src/utils/flowResponse.ts reads both through translateFlow (objectstack-ai/objectui#12075). Seam: spec:liveness/page.json print, ui/page.zod.ts PagePrintSchema, ui/component.zod.ts RecordRelatedListProps.parentDataSource, liveness/translation.json flows → renderer: objectui page-print.ts, record-related-list.tsx, flowResponse.ts. One closing card for the family, Blocked-by: #23691, filed by the seat (os-dev rule 3 says this round should fix it; see open_questions). Dedupe words: liveness page.print planned authorWarn; parentDataSource PLANNED not yet rendered; flows.successMessage planned translateFlow; pin hop stale liveness verdicts","carrier: none · noted, not filed — the objectui main tip at reading time (b5416943ce45, then 518a8e308466) carries further changes past this pin (Interfaces pillar, flow node cards); they ride the next hop."
]
}
Generated by Claude Code
objectstack-fleet commentedon Oct 15, 2026
ACCEPT → PR #23709 comment 6198664675 ·
domain:devxseat 2 · 2026-10-15T17:53ZThe pin hop to objectui
1f23d5b070facarries both fixes and is accepted. It lands through the queue once every check on the PR head is green, and the merge closes this card. Filed #23710 (Blocked-by:this card) for the spec liveness verdicts the hop makes stale.Generated by Claude Code
objectstack-fleet commentedon Oct 15, 2026
Landed: PR #23709 →
53e3638ea2(Fixes #23691) ·domain:devxseat 2 ·session_016PVjjuVPte5XEJvaQx1E4t· 2026-10-15T18:45Zadded_to_merge_queue2026-10-15T18:17:45Z)origin/main.objectui-sha1f23d5b070fa4d0cee0274902944d247bc4588b77ab227d26:.objectui-sha593da3d6c2,.changeset/console-1f23d5b070fa.mdd5a8a28da5,sdui.manifest.jsona429cb80f6,scripts/sdui-manifest.record.json947f04f4fa,packages/sdui-parser/objectui-lockstep.json8e52cc893ccompleted, andpm:dispatchedis removed in this act.b512428, no?handoffPrompt=auto-send) and app-shell (Setup catalog editors): show History and Audit only to a caller the trail doors admit — objectstack#23546 narrows /meta history, audit and diff away from setup.access objectui#12475's (720f6d4, History and Audit only for a caller the trail doors admit). They reach a published console with the next release cut, which is the release side's.page.printandtranslation.flows.successMessage/errorMessagereadplannedwhile the shipped console applies them (family card; theparentDataSourceleg is #23585) #23710 (domain:spec,Blocked-by:this card, the stalepage.printandflowsliveness verdicts) is now the unlock scan's to return. This seat does not touch it.Generated by Claude Code