feat(plugin-security)!: retire the four security-catalog row objects (#15204 stage 8)

[objectstack-fleet]

Part of #15204
Clause-②: no (narrowing): it retires four declared objects with their data and REST routes, Setup object pages and exports. It adds no export and widens no accept set; the one widening of the early build (a new metadata-protocol export) is D's landed captureUninstallDeclared now.

C3 stage 8, the code half (S8), card #23056. It lands after S8-T (#22962, the test half) and D (#22900). #15204 stays open: 7a/7b (dead modules, #22975), 8-post (residue), C7b (#22937 / #15211, the id-to-name rewrite and the column drop) and the docs sweep follow.

What this changes

The four security-catalog row objects (sys_position, sys_permission_set, sys_position_permission_set, sys_capability) are no longer registered (ADR-0131 D3). Their data and REST routes go, and so do their Setup object pages. Tables and rows stay for the organization-ownership migration (ADR-0131 D10).

• E1 (ruling 6110777865, E1 → A): the permission mutation projector and its reconcile, the sys_permission_set and sys_position data-door write-throughs and the row-only position backfill are no longer registered. A metadata-door save reaches the catalog through the door's own registry write-through. S8-T's permission-metadata-door-reaches-catalog.dogfood.test.ts pins this. The modules stay for 7a/7b to delete.
• The walled catalog data-door refusal (ADR-0131 D3) is unregistered with the write-throughs. It landed after this stage was first built and guards only the three retired objects.
  • On a group or isolated deployment, a data-door write on those names now answers 404 OBJECT_NOT_FOUND (protocol.assertObjectRegistered) for every caller. S8-T's wall-catalog-refusal dogfood pins this.
  • The walled refusal at /meta, at the clone door and at the /packages doors is unchanged.
  • walled-catalog-data-door.test.ts pinned the registration and is deleted with it. The module walled-catalog-data-door.ts stays, unreferenced, for 7a/7b.
• E3 (E3 → A): sys_user_permission_set.permission_set_id is now Field.text (maxLength 255) and keeps B2's hidden. The column, its ids and both indexes stay the same.
• E6 (seat amendment 6116546399): the first-admin promotion reads no catalog row. An unscoped grant that names no set and carries a legacy id still withholds the promotion. Both pins hold: S8-T's fresh-boot golden and grant-readers-unnamed-grant.
• Uninstall cleanup, on D's landed form: cleanupPackagePermissions keeps D's signature (declared: { permission }, captured by captureUninstallDeclared in both uninstall doors) and drops the row legs: the catalog-row read, the position-binding delete and the by-id grant leg. It revokes by the declared names alone. The by-id leg is C7b's.
• Carried items:
  • Setup nav entries open /apps/setup/metadata/TYPE?scope=environment.
  • These drop the four names: the grants-cache watched set, plugin-sharing bypassObjects, the organization_admin and showcase object-permission entries, SystemObjectName.POSITION / PERMISSION_SET, the platform-object name lists and the tenancy entry.
  • The lint capability-reference-unknown seed-row source goes.
  • Refusal prose names the clone door instead of the sys_permission_set data route.
  • Settings and spec help text are updated, and isRowActive is deleted.
  • The published plugin-security README stops naming the retired objects.
• Regenerated:
  • plugin-security translations and the platform-objects form bundles;
  • spec reference docs;
  • the tenancy and tenant-audit censuses;
  • the keyed-text-bounds MEASURED record.
  • The platform-checklist item access-security.packaged-permission-set-lifecycle is retired.
  • The ADR-0087 semantic entry is catalog-row-objects-retired.
• Kept true by this retirement:
  • ADR-0086's D3 status row anchored to the deleted sys-permission-set.object.ts#managedBy. It now says the row object is retired and anchors to 18.catalog-row-objects-retired.ts; check-adr-symbol-anchors would otherwise red. That one line puts docs/adr/** in this diff.
  • The ADR-0087 entry 18.walled-catalog-tenant-writes-retired no longer promises a data-door 403 on the three retired objects: its surface and acceptanceCriteria say the refusal held while the objects were registered, and that the data door now answers 404.
  • The changeset names @objectstack/objectql's PLATFORM_OBJECT_TENANCY losing its sys_permission_set key (objectql is graded minor), and os migrate plan listing the four tables as unmanaged on an existing database (report-only).
  • scripts/check-keyed-text-bounds.mjs's MEASURED record and header name the tree its five counts hold on.
• Test re-pins for suites that reached main after S8-T (each still pins its own predicate):
  • plugin-security/src/explain-principal-person.test.ts (from fix(plugin-approvals,plugin-security): the approval request actions name the request in their success copy, and Explain access names the principal as a person #23202) takes the retired shapes from the legacy testkit.
  • cli/src/utils/unmanaged-tables.integration.test.ts uses sys_user_permission_set as its plugin-declared negative control; the retired table is now a true positive.
  • cli/src/utils/schema-migrate.host-composition.integration.test.ts pins pending work, coverage and the write absence on sys_user_position / sys_user_permission_set. Its legacy-unique drift moves to sys_audience_binding_suggestion's organization-respelled unique (the same replace_unique_index plan).

Reconciliation with D (#22900, c8a9783eca)

This branch was first built on an early D (fcaedfdaa1). The main merge resolves it as main plus this stage's own commit (dbae752f6e against its first parent), replayed three-way, so no line of the early D that the landed D dropped survives.

• D's captureUninstallDeclared / UninstallDeclared { permission } supersedes this stage's earlier declaredCatalogItemsOf / UninstalledCatalogItem. As a result this diff does not touch packages/metadata-protocol/src/protocol.ts or its index, nor cloud-connection's install-local door or vitest config.
• The cleanup registration in security-plugin.ts is D's. The resolveCbpRelation region is untouched.

Verification

Branch head 23e450a684: main 6d7f4df3c9 plus this diff, 75 files, +456 / −3352. All heavy runs went through os-verify-lock; times are shared-box readings.

• Whole repo: turbo run build (74 of 74), and turbo run typecheck (147 of 147, on 016d329a36). plugin-security and cli typecheck are green after the merge of main that brought fix(plugin-approvals,plugin-security): the approval request actions name the request in their success copy, and Explain access names the principal as a person #23202's suite. pnpm --filter @objectstack/spec check:generated reports all 14 artifacts current. The tenant-audit census (regenerated on the merged tree), the platform-object tenancy census and check-i18n-bundles are in sync.
• Dogfood, full, on b22a9ee6bf (main 4f5679c261 plus this diff; the later main merge touches no package this diff does): 254 files plus 1 skipped, 2099 tests. CI skips the dogfood shards on PRs.
• Suites:
  • on 976023f0da:
    • plugin-security: 187 files, 3851 tests;
    • plugin-auth: 136 files, 2786 tests;
    • the two re-pinned cli integration files: 17 tests, with cli typecheck green;
  • on a29bede970, @objectstack/cli whole (unit and integration, as CI runs it): 403 of 404 files. The one red was schema-migrate.host-composition.integration.test.ts, re-pinned since;
  • on 016d329a36:
    • spec: 662 files, 20114 tests;
    • lint: 138 files, 6665 tests;
    • metadata-protocol: 233 files, 28284 tests;
  • on earlier heads: the consumer suites (core, platform-objects, plugin-sharing, service-settings, objectql, rest, runtime, plugin-approvals, plugin-hono-server, cloud-connection, verify, client, organizations, app-crm, app-showcase).
• Premise (6110777865): a metadata-door permission save reaches the catalog with the projector unwired. permission-metadata-door-reaches-catalog.dogfood.test.ts is green in the full dogfood run above, and no live caller of the projector, either write-through, the backfill or the walled door remains.
• Fresh boot: an empty sqlite file booted through the migrate path with real DDL, composing SecurityPlugin, holds 36 tables and none of the four retired ones.
• Gates: the list derived three-dot against origin/main (150 families), unioned with the dispatch's lead list, ran on the final head. dispatch-gates --ran reconciles every derived family, and every gate exits 0 except check:platform-checklist.
  • That gate's 8 ABSENT SYMBOL / anchor-floor findings are identical on main 150da61aa5 (line-for-line comparison), and the gate is kept out of per-PR CI.
  • check-adr-symbol-anchors, check:adr-anchors, check:adr-0087-registration, check:spec-changes, check:upgrade-guide, check:keyed-text-bounds and check:pm-governed-merges are green.
  • check-governed-merges --test: GOVERNED, docs/adr/** ×1, and over 3000 changed lines.
• Not run locally: pnpm lint (the repo-wide scan is CI's).

Acceptance notes

• Out of scope here, and carried elsewhere:
  • 7a/7b (C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975): the unwired permission-set-projection.ts, position-write-through.ts, position-environment-backfill.ts, walled-catalog-data-door.ts (and its ADR anchor) and the writesExecutedByDataDoor WeakSet.
    • Two of these modules are still imported for helpers. catalog-reference-report.ts and position-environment-backfill.ts take POSITION_OBJECT and metadataDoorAcceptsPositionName from position-write-through.ts; packaged-permission-set-overlay-detection.ts takes tryFind and ProjectionLogger from permission-set-projection.ts.
    • plugin-security's index.ts still exports the projector functions.
    • 7a/7b must re-home those four symbols before deleting the modules.
  • 8-post: comment and description residue, the per-object gates in security-plugin.ts and delegated-admin-gate.ts, and SYSTEM_ROW_PROVENANCE.
  • C7b: the CLI organization-ownership inventory, auto-org-admin-grant resolvePermissionSetIdsForName, the grant-name backfill (now a permanent objects-absent no-op), the by-id uninstall leg, and the blank-name leg-C edge of the first-admin promotion (not measured).
  • The docs sweep: the hand-written content/docs pages and ADRs that name the objects, including system-context.mdx row 55b's data-door clause.
• 18.0.0-next.0's CHANGELOG entry for the walled refusal names a data-door 403 on the three objects. That is true of next.0, and this diff's changeset records the move to 404 for the next release; the unreleased ADR-0087 entry is corrected in this diff.
• Governed path: the ADR-0086 anchor line puts docs/adr/** in this diff, so the PR is Tier H by path as well as by size (check-governed-merges --test: GOVERNED, docs/adr/** ×1). The line is here because the anchor names a file this diff deletes, and check-adr-symbol-anchors reds without it.
• lint/src/validate-capability-references.seed-row.test.ts pins new behaviour that cannot pass on main before this lands, so it rides here rather than in S8-T.
• The objectui pin 1fb1ced362 has the metadata/:type catalog route with ?scope=environment. It imports none of the removed exports (SystemObjectName.POSITION / PERMISSION_SET, SysPositionDetailPage, isRowActive); its sys_permission_set string checks become dead branches, not build breaks.

维护者速读(草稿)

改了什么

• 岗位、权限集、权限集-岗位绑定、能力这四张“目录行对象”不再注册。对应的数据接口、REST 路由和 Setup 里的对象页面随之下线。数据表和行都保留,留给之后的组织归属迁移处理。
• 权限集保存后不再写行镜像,由元数据门直接写入安全目录。两个数据门回写、一次性岗位补数,以及多租户下数据门那一半的目录写入拒绝都已摘除。
• 首位平台管理员的提升不再读取目录行。
• 卸载包时只按包声明的权限集名称撤销授权,不再读写目录行。

为什么改

• ADR-0131 D3 规定岗位、权限集、能力只有一个归宿,就是安全目录(环境注册表)。行对象只是镜像,没有任何授权逻辑读取它,留着只会形成“声明了但不兑现”的第二套入口,AI 和人都容易写错地方。
• 这是 C3 第 8 阶段,前置的 D(feat(plugin-security)!: no seeder or materializer writes a sys_permission_set row; the boot seeds no row for a declared set (#15204 stage 6b-2) #22900)和测试半边 S8-T(test: the stage-8 test half — suites stop depending on the four catalog row objects (#15204 stage 8, S8-T) #22962)先落地。

风险与代价(含回滚)

• 破坏性变更:直接调用 /api/v1/data/sys_permission_set 等四个对象接口的客户端会收到 404。changeset 写明了 FROM → TO 迁移:改用 /api/v1/meta/permission|position|capability 和克隆接口。
• 多租户隔离部署下,目录写入的拒绝仍在 /meta、克隆门和包门生效。数据门那一半随对象一起消失,统一答 404。
• 不删表、不删数据。回滚就是 revert 本 PR,无数据迁移需要回退。
• 受管路径:本 PR 改了 ADR-0086 状态表 D3 行的一处锚点。原锚点指向本 PR 删除的对象文件,不改的话 ADR 锚点检查会红。因此 diff 触及 docs/adr/**,按路径也属 Tier H,不只是按规模。
• 规模:75 个文件、+456/−3352,删除为主(对象定义、生成的翻译、随门一起删除的一份测试),加上为主线新进测试做的几处改钉。超过 3000 行。

席位意见

你要做的

• 本 PR 既触及受管路径 docs/adr/**,又超过 3000 行,需要你批准后由席位落地。批准前席位会附上合约复核结论。

---

Generated by Claude Code

[objectstack-fleet]

维护者速读 · PR #23222（S8，C3 第 8 阶段的代码半边）· domain:engine 2 号席 · session_01ADzJtzYTLUfgrRZHxkagkX · 2026-10-13T14:09Z

改了什么
把四个已退役的安全目录行对象（sys_position、sys_permission_set、sys_position_permission_set、sys_capability）从平台上取消注册。权限集、职位、能力从此只有一个归宿：安全目录（注册表），通过 /api/v1/meta/permission|position|capability 读写。具体包括：

• 取消对象注册、删掉对象定义和职位详情页，Setup 里的三个导航改为打开元数据页；
• 断开权限集投影器、两条数据入口写穿透、职位回填，以及隔离墙下数据入口的拒绝。这些模块只断开接线，代码留给 7a/7b 删除；
• permission_set_id 改成文本字段，列和数据都保留，留给 C7b 的迁移仪式处理；
• 改一份 v18 迁移条目，并把 ADR-0086 里一行指向已删文件的锚点改成文字说明。

共 75 个文件，+456 / −3352 行，删除为主。

为什么改
ADR-0131 D3 规定这三类定义只能有一个来源。S8-T（测试半边）已经先落地，测试不再依赖这四个对象。S8 落地后，C7b 的迁移仪式（#23034）、7a/7b 的模块删除，以及文档和 ADR 的清理，才能接着做。

风险与代价（含回滚）

• 破坏性变更：直接调用 /api/v1/data/sys_permission_set 等四个对象接口的客户端会收到 404。changeset 写明了改前和改后的用法：改用 /api/v1/meta/... 和克隆接口。
• 不动数据：不删表、不删数据，老库里的四张表和数据都保留，os migrate plan 会把它们列为"无人管理"，只报告、不删除，等 C7b 的迁移仪式处理。回滚就是 revert 本 PR。
• 安全保证不丢：隔离墙下，目录写入的拒绝仍在 /meta、克隆入口和包入口生效；数据入口那一半随对象一起消失，统一返回 404。审查确认没有丢掉任何安全保证，也没有遗留调用方。
• dogfood 的记录：PR CI 和合并队列都不跑 dogfood（skills(ci): two-speed CI — fast set on PR and merge-queue runs, full battery hourly on main and before a release, main-red stops the lane, four required contexts plus the guard, timing gates report-only, test budgets not deletions #22998）。dev 在本地跑过：合起来的树上 dogfood 全量 253 个文件通过，后几轮做了针对性重跑。合入后 main 的全量检查是它们在 CI 上的第一条记录，席位会去读。
• 之后要收的尾：S8-T 为兼容两棵树放宽的断言，在 8-post 里收紧；docs 和 ADR 的清理（C3 #15204 docs sweep: ten content/docs pages still describe the four retired catalog row objects; draft now, land after stage 8 #22976、C3 #15204 ADR sweep: ten ADRs cite the four catalog row objects that stage 8 retires; record the retirement per the ADR convention after stage 8 (governed, Tier H) #22978）在 S8 落地后由对应泳道做。

席位意见
建议批准。依据：

• 契约审查完整一轮 PASS（6145593929），它提出的入队前事项都已改完，增量审查 PASS（6146702396），最终头只多了重新生成的审计统计，席位已核对；ACCEPT 6147447002；
• CI 在补丁过程中查出的四处红灯（ADR 锚点、main 新进的一个测试、两个 CLI 集成测试）都已修好，并且都只动测试或锚点，没有绕过任何检查；
• 和 main 无冲突。

要你批准的原因有两个：超过 3000 行；改了 ADR-0086 的一行，碰了受管路径 docs/adr/**。

你要做的
用 os-zhuang 或 hotlong 批准本 PR（或者亲自合并）。批准后，席位转 ready、送进合并队列；落地后立即推进 #23034（C7b 迁移仪式）和 7a/7b。