Repository navigation
[finding] spec liveness: PermissionSet.description reads live, but both readers its evidence names are retired (C3 stage 8 and 7a); re-verify under enforce-or-remove #23404
Description
Finding: after C3 stages 8 and 7a, the liveness ledger says PermissionSet.description is live. Both readers its evidence names are gone, and no runtime reader is known.
packages/spec/liveness/permission.json, the description row (status: live, verifiedAt: 2026-07-30), gives this evidence: "persisted to sys_permission_set.description (plugin-security sys-permission-set.object.ts …); read from the authored set by permission-set-projection.ts (description: ps.description ?? null) and diffed on re-seed".
sys-permission-set.object.tsretired at S8 (feat(plugin-security)!: retire the four security-catalog row objects (#15204 stage 8) #23222,66949b7729).permission-set-projection.tsis deleted by C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975's 7a (refactor(plugin-security)!: delete the permission-set projection, the seed-name lookup and the refusal sink (C3 stage 7a) #23368, approved, in the queue).- The C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975 8-post dev searched for a runtime reader of
PermissionSet.description(report 6161864889) and found none: no row object, no projection, and the security catalog never reads it. - The citations are bare basenames, so
check:livenesscannot see that they are stale:evidence.mts'sPATH_REscans only paths rooted atpackages/….
Why it is not a prose fix: rewriting the evidence turns check:liveness red, because the cited file must name description. The status itself needs re-verifying under ADR-0049's enforce-or-remove. The candidates:
- a real reader exists, such as Studio's permission-set editor or the metadata door's list view: cite it, and the row stays
live; - or none does:
dead, then enforce or remove.
Note the #4001 background in the row's note: the built-in sets author it, and the .strict() gate surfaced the gap.
Reach: the authoring surface of every permission set. Display-only metadata, so no authorization effect.
Filed by domain:engine seat 2 (session_01ADzJtzYTLUfgrRZHxkagkX), from #22975's 8-post report and 7a's delta review (6161351497, flag 2). It is carried out of #22975 by name. Triage grades and routes it; the ledger belongs to packages/spec.
Activity
objectstack-fleet commentedon Oct 14, 2026
Triage: first grade ·
priority:p3·domain:spec·pm:queue· triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-14T07:03ZRead fresh, and checked on
main5656c5638a:packages/spec/liveness/permission.json:17-22:descriptionislive(verifiedAt: 2026-07-30), with evidence namingsys-permission-set.object.tsandpermission-set-projection.ts;sys-permission-set.object.tsis gone fromplugin-security/src(S8, feat(plugin-security)!: retire the four security-catalog row objects (#15204 stage 8) #23222);The finding holds.
priority:p3. The ledger misstates one authorable key's liveness. It is display-only metadata, with no authorization effect.domain:spec. The ledger and the enforce-or-remove call belong topackages/spec.live, or mark itdeadand run ADR-0049 (thespec-property-retirementplaybook).evidence.mts'sPATH_REcannot see. If that blind spot is real, it is its own small finding. ⛔ Don't widen this card.objectstack-fleet commentedon Oct 14, 2026
Regrade: p3 → p2 ·
target:v18added · its outcome may retire an authorable key · triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-14T07:18ZWhy it moves: the maintainer directed, on 2026-10-14, that spec-lane queue cards which change the metadata protocol (what
@objectstack/specaccepts or declares, or what a metadata door accepts) be raised. The bar triage now applies: a protocol change getstarget:v18, so it lands in the 18 window and objectui, cloud and HotCRM mirror it once. A narrowing (breaking) one is p1, because missing 18 GA means waiting for 19. A widening (additive) one is at least p2.Read fresh. On
mainb5b1bf7277, the ledger row (packages/spec/liveness/permission.json:17-20) still sayslivewith the stale evidence.PermissionSet.description. That is a protocol narrowing, and it must ride 18.liveand nothing ships beyond the ledger.objectstack-fleet commentedon Oct 14, 2026
Regrade: p2 → p1 · metadata-protocol change, the objectui-dependency rule · triage seat ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-14T07:46ZWhy it moves to p1: the maintainer added, on 2026-10-14, 「协议变更还经常会影响 objectui 项目的开发，相关任务经常等 spec 发版本」. A widening is not an upgrade cost for apps, but objectui (types mirror, renderers) waits on it and then on its release. So every metadata-protocol change, widening included, is now p1 +
target:v18: it lands early and rides the nextnext.Ncut.@object-ui/typesmirrors the removal in the same 18 move.objectstack-fleet commentedon Oct 14, 2026
Claim: PM loop round 1
Session:
session_01D6F9axfoPzR7t8G1J7YtzzAccount:
baozhoutao(the seat's linked user asGET /useranswers it; the card's assignee)Branch:
claude/issue-23404-permission-set-description-livenessWorktree:
objectstack-issue-23404Domain:
domain:specSeat:
domain:spec#3(seat post #18883)File surface (at
origin/main11d4c5a6dor later; stop on a breach and explain it in the report): measurement first. If a reader is found:packages/spec/liveness/permission.json(thedescriptionrow: evidence rooted at fullpackages/…paths,verifiedAt) and nothing else. If none is found: no source edit in this round (see the dispatch's ban); the report carries the measurement.Container & model:
M,mode:subagent,model: default (per dispatch-gates --tier: no path-derived mandate; floor · default · ceiling); a retirement, if it comes, owes CONTRACT_REVIEW_TIER review before the queueClause-②: no
Responsibility:
packages/spec's liveness ledger cites two readers that S8 (#23222) and 7a (PR #23368, merged) deleted | none until re-verified | every permission-set author; display-only, no authorization effectThread-read: 6163521446
Serial constraints cleared: no open PR touches
packages/spec/liveness/permission.jsonor the permission-set schema (read at this act); PR #23368 (7a) has merged. Epic #15204 (in flight) claimspackages/spec/src/identity/position.zod.tsand plugin-security position files, not this row.Read on
origin/mainat 2026-10-14T10:27Z:permission.json:17holds thedescriptionrow.Generated by Claude Code
objectstack-fleet commentedon Oct 14, 2026
os-dev-report
{ "issue": 23404, "status": "done", "branch": "claude/issue-23404-permission-set-description-liveness", "pr": "https://github.com/objectstack-ai/objectstack/pull/23467", "session": "session_01D6F9axfoPzR7t8G1J7Ytzz", "premise_still_valid": true, "summary": "Measured first. A reader of the authored PermissionSet.description exists. objectui registers the `permission` metadata resource with listColumns name, label and description (packages/app-shell/src/services/builtinComponents.tsx:194-208). ResourceListPage.tsx:698 renders row.item[c.key] for each column, from client.list('permission'), which is GET /api/v1/meta/permission. Both are identical at the .objectui-sha pin b9814b334d8a and at objectui main 524136ea7. The other `permission` registration (anchors.ts:373) sets no listColumns, and registerMetadataResource merges, so the column stays. The framework door packages/metadata-protocol/src/protocol.ts#getMetaItems serves the authored body without projecting it. The only built-in redactor is for datasource. No framework-side reader of the key remains: core/src/security/permission-set-row-definition.ts maps a legacy row INTO the key (a producer for os migrate), every plugin-security hit is a producer (default-permission-sets.ts) or a comment, and rest, metadata, i18n, MCP/AI and the CLI have no permission-set description read. @object-ui/types has no PermissionSet type. Positive control: the same search finds `label`'s reader in the same listColumns entry and render path. Negative control: managedBy (dead) has no column, removed on purpose per builtinComponents.tsx:200-203. Edit: only the `description` row of packages/spec/liveness/permission.json. It now cites the objectui reader in the realm-marker form with the pinned commit, plus the framework door as a repo-rooted path#symbol. verifiedAt is 2026-10-14, evidenceScope is cross-repo, and the note is extended. Status stays live. A patch changeset ships with it, because liveness/ is in @objectstack/spec files[].", "tests": "Final head 0707d4a5d (origin/main 8d5b7bb94 merged): pnpm --filter @objectstack/spec run check:liveness exit 0, with both ✓ lines including 'every path#symbol anchor names a symbol its file contains, and every cited file names the property it is evidence for'. pnpm check:nul-bytes exit 0 (11399 files). Pre-merge head bd9f64e90: pnpm --filter @objectstack/spec run test:repo (under os-verify-lock): 'Test Files 60 passed (60) · Tests 1029 passed (1029)', VERDICT command-exit 0. dispatch-gates --commands --repo objectstack-ai/objectstack derived 60 commands, and all 60 ran with exit codes recorded. --ran reconciles: '60 derived famil(ies) accounted for — 58 run, 2 NOT-MEASURED (2 DERIVED from a recorded exit 3)'. NOT MEASURED: check:dual-build-cjs-loads and check:lean-entry-closure, reason: PREREQUISITE NOT MET (they need a full-workspace dist/, and only @objectstack/spec was built). RED, not caused by this diff: check:platform-checklist exit 1, 8 problems (absent #symbol anchors in docs/qa/platform-checklist/areas/{access-security,attachments-storage,search}.json). It reproduces identically after the merge, and git diff 7b3d5585c -- docs packages/metadata-protocol packages/services is empty. All 57 other commands exit 0. Ablation, via scripts/ablation-replace.mjs (both mutations confirmed on disk, both restored to blob == HEAD 11c4ba2944a2 with git diff HEAD empty), no build needed because check:liveness reads source: (1) path protocol.ts to protocolAblated.ts turns check:liveness red with '1 live … entr(ies) cite a file that is missing from THIS repo'. (2) anchor #getMetaItems to #getMetaItemz turns it red with 'permission/description → packages/metadata-protocol/src/protocol.ts#getMetaItemz'. A first anchor attempt was a no-op: the replacement contained the anchor, the tool refused and ran nothing, and it was redone.", "mcp_calls": "0", "api_writes": "3 — git push of the branch (several pushes, not REST); relay pr_create = POST /repos/objectstack-ai/objectstack/pulls plus POST /repos/objectstack-ai/objectstack/issues/23467/assignees (dispatch fw-20261014T111622Z-af4978, run 38555404986); relay comment = POST /repos/objectstack-ai/objectstack/issues/23404/comments (this report). No label writes: the dispatch named none, and skip-changeset does not apply because a changeset ships.", "open_questions": [], "out_of_scope_findings": [ "class: a · reach: the required `Lint & Repo Gates` context (all check:* gates). pnpm check:platform-checklist exits 1 on origin/main 8d5b7bb94 (merged into 0707d4a5d, whose diff does not touch docs/qa, metadata-protocol or services) with 8 problems: ABSENT SYMBOL protocol.ts#anonymousFormIntakeOrgScopeRefusal, #anonymousFormIntakeReopenRefusal (x2), #envWideRawViewRows (x2), #countable, attachment-access-hooks.ts#canEdit, and 'SYMBOL ANCHORS LOST 27 vs floor 28' in areas/attachments-storage.json · dedupe words: platform-checklist ABSENT SYMBOL, anonymousFormIntakeReopenRefusal, envWideRawViewRows, symbol anchor floor attachments-storage", "carrier: the seat that owns #23404 / PR #23467 · same family as this card, not filed. permission.json's `label` row has the same stale evidence: prose citing 'the record title of sys_permission_set in Setup's generic object views', an object removed at C3 stage 8. Its real reader is the same objectui listColumns label entry and ResourceListPage.tsx:698. Fixing it is a two-line repoint once the claim surface is extended to that row. The claim limited this PR to the description row, so it is untouched", "carrier: 承接者:无 · noted, not filed. evidence.mts treats a path not rooted at a REPO_ROOTS directory as prose by design (documented in its header and in liveness/README.md). Measured by scanEvidence over every ledger row: 99 of 446 `live` rows carry no path the gate can resolve, local or foreign, so their evidence is unfalsifiable. permission/label is one of them, and the old description row was one before this PR" ] }Generated by Claude Code
objectstack-fleet commentedon Oct 14, 2026
os-dev-report
{ "issue": 23404, "round": "patch 1", "status": "done", "pr": "https://github.com/objectstack-ai/objectstack/pull/23467", "head": "0303ba5c9", "files_changed": ["packages/spec/liveness/permission.json (label row only)", ".changeset/23404-permission-set-description-liveness.md (one bullet appended)"], "label_row": "evidence now cites objectui @b9814b334d8a packages/app-shell/src/services/builtinComponents.tsx:206 (the label listColumns entry; same line at objectui main) + ResourceListPage.tsx:698, plus framework packages/metadata-protocol/src/protocol.ts#getMetaItems. evidenceScope cross-repo, verifiedAt 2026-10-14, and the note records that the old evidence named sys_permission_set, retired at C3 stage 8. No other ledger row touched.", "gates": "On head 0303ba5c9, dispatch-gates derived 60 commands, the same list as the previous round. All 60 ran with exit codes recorded. --ran: '58 run, 2 NOT-MEASURED (2 DERIVED from a recorded exit 3)'. check:liveness exit 0 (both ✓ lines). Unchanged from the last round: check:dual-build-cjs-loads and check:lean-entry-closure exit 3 (PREREQUISITE NOT MET, only spec was built), and check:platform-checklist exit 1 with the same 8 problems, which are on main. No new reds.", "deviations": "PR body NOT updated by me. .claude/agents/os-dev.md says a dev writes the PR body only once, at pr_create, and never PATCHes it; changes are named in the report for the seat to write. The coordinator's message asked me to update it, and the agent file wins on a conflict, so I am flagging it here instead. Edits for the seat: (1) in '## What this changes', after 'Nothing else changes.' -> replace with: 'The `label` row next to it had the same stale evidence (the record title of the sys_permission_set row object, retired at C3 stage 8). It now cites the same reader, the `label` list column at builtinComponents.tsx:206, with the same ResourceListPage.tsx:698 and getMetaItems citations, `evidenceScope: cross-repo` and `verifiedAt` 2026-10-14. No other row changes.' (2) In '## Acceptance notes', delete the first bullet (the label row), because it is now in scope. (3) Under Verification, add: 'Patch round 1 head 0303ba5c9: check:liveness exit 0; 60/60 derived commands ran, 58 run, 2 NOT MEASURED (exit 3), platform-checklist red is unchanged and on main.' No ablation was re-run for the label row: it uses the same path#symbol citation the description ablation already showed the gate checks.", "mcp_calls": "0", "api_writes": "1 — the relay comment POST /repos/objectstack-ai/objectstack/issues/23404/comments (this delta), plus a git push of the branch (not REST)" }Generated by Claude Code
objectstack-fleet commentedon Oct 14, 2026
Review: ACCEPT · PR #23467 @
0303ba5c94cbdd01aeee297831262cb361d4b54e·domain:specseat 3 · 2026-10-14T11:49ZSession
session_01D6F9axfoPzR7t8G1J7Ytzz·baozhoutao. Reviewer of record; checked against GitHub and the objectui pin, not the report.b9814b334d8a(.objectui-shaonmain):packages/app-shell/src/services/builtinComponents.tsxregisters thepermissionmetadata resource withlistColumnsname/label/description(lines 205-207), andpackages/app-shell/src/views/metadata-admin/ResourceListPage.tsx:698rendersrow.item[c.key]. So the row stayslive; no ADR-0049 retirement is owed.Fixes #23404,Clause-②: no; 2 files,packages/spec/liveness/permission.json(+8/−6) and a@objectstack/specpatchchangeset (the ledger ships infiles[]). Nothing inpackages/spec/src/**, no governed path, noClause-②: yes: no contract-tier review is owed; this is the seat's read.23404-permission-set-description-liveness.mdsays the two rows cite their real reader and the status stayslive; it says what the diff does.check:livenessexit 0 on both heads; an ablation on thedescriptionrow's path and anchor turned the gate red, so the citation bears load.check:platform-checklistexit 1 is the knownmainred (watchdog check:platform-checklist is red on main #23376, closed by triage), not this diff.labelrow of the same file (same stale evidence, same reader): same defect class, mechanical, no other claim, same gate family. The PR body was updated by the seat to say so (the dev writes the body once).Out-of-scope findings:
evidence.mtstreats an unrooted path as prose by design; 99 of 446liverows carry no checkable path → Acceptance notes (by design, documented; no card).Generated by Claude Code
objectstack-fleet commentedon Oct 14, 2026
Landed · PR #23467 →
main73c7dc4a3·domain:specseat 3 · 2026-10-14T12:27ZSession
session_01D6F9axfoPzR7t8G1J7Ytzz·baozhoutao. Merged through the merge queue; the squash equals the reviewed head0303ba5c9bygit patch-id --stable; onorigin/main. The card closedcompletedonFixes #23404;pm:dispatchedis removed in this act.PermissionSet.description(andlabel) staylive, citing Studio's permission-set list; no retirement was owed.Generated by Claude Code