docs/adr: three security-plugin.ts symbol anchors (ADR-0055:26, ADR-0055:58, ADR-0123:4) resolve only on tokens inside bodies the #25223 split moves; repoint them to method declarations the class keeps

Filing gate ①, finding (a), a reproduced gate failure on a named landing point. Filed by domain:services seat 1 (seat post #6021) · os-sales · session session_016g7nYP9wdNx1GDa5XDr7Uy, from #25223 cut 2's os-dev-report 6353666083 (out-of-scope finding 1), under ruling 6353073966 item 3. ⛔ Not a claim.

reach: named producer. The #25223 move-only split of security-plugin.ts cannot move the remainder of cut 2 (computeControlledByParentFilter, controlledByParentChainRefusal) or cut 4's composeWriteTenantWall until this lands (ruling 6353073966 item 4). Measured: at the withdrawn five-body head 94ef3e320f, node scripts/check-adr-symbol-anchors.mjs exits 1 with two unresolved-symbol findings; the base 5801a4f2c exits 0.

Who acts: domain:services seat 1 authors the PR (S, docs only). docs/adr/** is Tier H (AGENTS.md Prime Directive 14), so the PR lands only on an APPROVED review by a GOVERNED_APPROVERS account. The director seat requests that review in its next Tier H batch. No seat readies, queues or arms it before then.

Dedupe: issue search for "ADR symbol anchor … sharingModel controlled_by_parent refuseNoActiveOrganization repoint" (open and closed) returned 11 hits. None carries these anchors. The nearest are #18101 (the resolver refusing real declaration sites) and #21697 (dispatch-gates derivation), and they are different defects.

维护者速读

Three ADR pointers into packages/plugins/plugin-security/src/security-plugin.ts resolve by coincidence of spelling. Each lands on a local variable or a string literal inside a function body, while its sentence describes a different mechanism. The PR changes the three anchors and nothing else: no prose, and no anchor-exempt marker. Each new target is a method declaration the class keeps across every cut of the split.

The reading (ruling `6353073966`, at `5801a4f2c`)

anchor	resolves on today	what the sentence describes	candidate target
ADR-0055:26 `security-plugin.ts#sharingModel`	`declaration`, one site: the local `const sharingModel = …` inside `computeControlledByParentFilter` (`:9208`)	the #1994 by-id write pre-image check, "the exact hook to extend with a master-access check"	`#checkControlledByParentWrite` (`:9492`), or a file-level anchor if the author reads the #1994 step (inline in `start()`, step 2.7) as naming no symbol
ADR-0055:58 `security-plugin.ts#controlled_by_parent`	`literal`, three sites inside the read derivation (`:9035`, `:9209`, `:9275`)	the §3 write pre-image block	`#checkControlledByParentWrite`
ADR-0123:4 `security-plugin.ts#refuseNoActiveOrganization`	`declaration`: the local closure `const refuseNoActiveOrganization = (…)` inside `composeWriteTenantWall` (`:8499`)	D2's refusal, step 3.7	`#composeWriteTenantWall` (`:8432`)

The write half the two ADR-0055 sentences name (checkControlledByParentWrite through assertMasterRowEditable) holds no 'controlled_by_parent' token and binds no sharingModel. The gate's header says why the gate cannot see this: it checks that an anchor "POINTS AT SOMETHING REAL", not that the sentence is true. The targets above are candidates. The PR author proposes them and the maintainer approves or amends.

Acceptance

The PR's diff is the three anchor spellings in docs/adr/0055-master-detail-controlled-by-parent.md and docs/adr/0123-no-active-organization-session-semantics.md. Nothing else changes.
node scripts/check-adr-symbol-anchors.mjs exits 0 on the head, with each of the three new anchors resolving as declaration class.
⛔ No prose edit (the gate header: "Do not repair prose to clear this gate"). ⛔ No anchor-exempt marker (maintainer-only).
Lands only on the maintainer's APPROVED review. If the maintainer declines, the bodies stay in security-plugin.ts for the series' end state (ruling item 4), and [maintainer] refactor(plugin-security): split src/security-plugin.ts (10,746 lines, +2,803 in 30 days) along its SecurityPlugin seams, one move-only slice per PR #25223's final report says so.

Generated by Claude Code

Claim: PM loop · seat-filed card, claimed directly by the filing seat (pm-dispatch 例外二: filed by this seat, lane domain:services, body carries the filing gate's three items) · 2026-10-22T23:41Z
Session: session_016g7nYP9wdNx1GDa5XDr7Uy (the dispatching seat; the dev is a mode:subagent run of this session, told apart by its branch)
Account: os-sales (the seat's linked user; the card's assignee)
Branch: claude/issue-25314-adr-anchor-repoint
Worktree: objectstack-issue-25314
Domain: domain:services
Seat: domain:services#1 (seat post #6021, project run by the Sales account)
Ruling-ref: 6353073966 (item 3, on #25223)
File surface: docs/adr/0055-master-detail-controlled-by-parent.md (lines 26 and 58, the anchor spelling only) and docs/adr/0123-no-active-organization-session-semantics.md (line 4, the anchor spelling only). ⛔ No prose edit, ⛔ no anchor-exempt marker, ⛔ no other file. Stop on a breach and explain it in the report.
Landing: Tier H (docs/adr/**, AGENTS.md Prime Directive 14). The PR stays a draft and lands only on an APPROVED review by a GOVERNED_APPROVERS account. No seat readies, queues or arms it before.
Container & model: S 级机械卡 (three anchor spellings, docs only), mode:subagent, model: default tier, effort: medium. The dev runs as the general-purpose agent with .claude/agents/os-dev.md as its role file.
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect in shipped behaviour (three ADR pointers)
Thread-read: none
Serial constraints cleared: none of the 17 open PRs touches docs/adr/0055-* or docs/adr/0123-* (file lists read at claim time). #25223's split keeps the three target method shells (checkControlledByParentWrite, composeWriteTenantWall) in the class across every cut.

Generated by Claude Code

os-dev-report

{
  "issue": 25314,
  "status": "done",
  "branch": "claude/issue-25314-adr-anchor-repoint",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/25316",
  "session": "session_016g7nYP9wdNx1GDa5XDr7Uy",
  "premise_still_valid": true,
  "summary": "Draft PR #25316 changes exactly three anchor spellings: ADR-0055:26 security-plugin.ts#sharingModel becomes a file-level anchor, because the sentence names the #1994 by-id pre-image re-read, which is inline step 2.7 in the start() middleware and has no symbol of its own. ADR-0055:58 #controlled_by_parent becomes #assertControlledByParentWrite, not the ruling's first candidate #checkControlledByParentWrite: section 3 describes the step 2.8 master-edit gate, which is assertControlledByParentWrite, already the write-half anchor at ADR-0055:125 and listed in ruling 6353073966 as a kept method shell. checkControlledByParentWrite is the served service member that wraps it for one by-id update. ADR-0123:4 #refuseNoActiveOrganization becomes #composeWriteTenantWall, as the ruling proposed. No prose edit, no anchor-exempt marker, no other file. The PR is a draft, assigned to os-sales, labelled skip-changeset, with os-sales, hotlong and os-zhuang requested. It stays a draft for the maintainer's APPROVED review. The newest Claim on the card (6353768445) names this branch.",
  "anchor_block": {
    "measured_on": "origin/main 258f4e6aa (base) and head 0dafb657eb; security-plugin.ts byte-identical in both; resolver = extractAnchors + symbolSegmentResolution + symbolResolutionClass from scripts/symbol-anchors.mjs, comments stripped",
    "anchors": [
      { "anchor": "docs/adr/0055-master-detail-controlled-by-parent.md:26", "old": "security-plugin.ts#sharingModel — declaration at :9208 (local const inside computeControlledByParentFilter)", "new": "security-plugin.ts (file-level; path still checked, no symbol class)" },
      { "anchor": "docs/adr/0055-master-detail-controlled-by-parent.md:58", "old": "security-plugin.ts#controlled_by_parent — literal at :9035, :9209, :9275", "new": "security-plugin.ts#assertControlledByParentWrite — declaration at :9654 (private async method)" },
      { "anchor": "docs/adr/0123-no-active-organization-session-semantics.md:4", "old": "security-plugin.ts#refuseNoActiveOrganization — declaration at :8499 (local closure inside composeWriteTenantWall)", "new": "security-plugin.ts#composeWriteTenantWall — declaration at :8432 (private async method)" }
    ],
    "gate_base": "node scripts/check-adr-symbol-anchors.mjs at 258f4e6aa: exit 0 — 2383 anchors across 142 records resolve — 467 symbol (440 declaration, 27 literal), 1888 file-level, 28 cross-repo, 6 exempt, 18 continuation",
    "gate_head": "node scripts/check-adr-symbol-anchors.mjs at 0dafb657eb: exit 0 — 2383 anchors across 142 records resolve — 466 symbol (440 declaration, 26 literal), 1889 file-level, 28 cross-repo, 6 exempt, 18 continuation",
    "assumption_check": "PM assumption falsified in part. The declaration count is flat (440 to 440), not +1, because :58 moves literal to declaration (+1) and :26 moves declaration to file-level (-1). The literal count drops by 1 and the file-level count rises by 1. The exports named in the order exist as assumed."
  },
  "tests": "Docs-only diff. No package was touched, so there was no build closure, no package test or typecheck, and no ablation. The anchor resolution was measured with a scratch script (not committed) on the resolver's exported functions. Readings are in anchor_block.",
  "gates": "dispatch-gates --commands --repo objectstack-ai/objectstack at 0dafb657eb: 20 families for 2 paths. Each ran under os-verify-lock with its exit captured before any pipe, and all exited 0: check-adr-links (+ --self-test), check-adr-symbol-anchors (+ --self-test), check-ci-filter-parity, check-closing-keyword-parity (+ --self-test), check-comment-mask-corpus, check:adr-anchors, check:closed-ceremony-text, check:cross-package-test-inputs, check:doc-authoring, check:driver-memory-census, check:gitlink-declared, check:nul-bytes, check:pm-governed-merges, check:pm-prior-rulings, check:refd-timer-probe, check:watch-hint-literal, and @objectstack/lint check:doc-formula-expressions. The last one first exited 3 (PREREQUISITE NOT MET). After the prescribed turbo build of @objectstack/formula and @objectstack/lint (VERDICT 0) it re-ran with exit 0. --ran reconciliation: 20 derived, 20 run, 0 NOT-MEASURED, a derived zero with exit codes recorded. CI at report time: Check Changeset success, Check Documentation Links success, Auto Label success, Check PR Size success, Dogfood Regression Gate success, the claim/closing-keyword guards success, Lint scoped query-options erasure success. Still in_progress: Governed Surface Queue Guard, the Lint lanes, Type Check lanes and Test Core 1-6/6.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "0",
  "api_writes": "3 relay strokes (fleet-write dispatch), all exit 0 with read-back: (1) pr_create, which is POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /issues/25316/assignees [os-sales] + POST /issues/25316/labels [skip-changeset] + the relay's own governed-review follow-up POST /pulls/25316/requested_reviewers (hotlong, os-zhuang); the body was read back with 7500 bytes sent and 7500 stored, identical; (2) pr_request_reviewers, POST /pulls/25316/requested_reviewers [os-sales]; (3) this os-dev-report comment, POST /issues/25314/comments via post-stamped. Also 2 git pushes, outside the relay: the empty-branch probe the role file requires, then the one commit 0dafb657eb.",
  "open_questions": [
    { "question": "ADR-0055:58 target: the ruling's first candidate #checkControlledByParentWrite, or #assertControlledByParentWrite as proposed?", "options": ["A keep #assertControlledByParentWrite — the step 2.8 gate the section 3 sentence describes, already the write-half anchor at ADR-0055:125", "B amend to #checkControlledByParentWrite — the served member wrapping it; also resolves as declaration on two object-literal service keys (:2442, :5346)"], "recommendation": "A, because the sentence describes a gate that refuses update/delete/create, and the served member only answers one by-id update with an outcome. Either way the maintainer's review decides." },
    { "question": "Conflict noted, not resolved silently: the order fixed the PR body's first line as an HTML comment (claude-projects-attribution). The role file's clean-exit section forbids HTML comments in GitHub text, because the sanitizer may eat them.", "options": ["A keep as the order specified (done; read-back shows it stored byte-identical)", "B drop that line from future PR bodies"], "recommendation": "A for this PR, since the read-back confirms it survived. The role-file rule concerns markers the PM scans for, and this line is not one. The PM should settle which text governs." }
  ],
  "out_of_scope_findings": [
    "class: observation (not filed) · reach: none measured · ADR-0055:58 says 'In the pre-image block' and names update/delete/create. The gate it describes is step 2.8, the block after the step 2.7 pre-image check, and it covers insert/update/delete/transfer/restore/purge. The sentence reads narrower than the code but is not false. Prose untouched per the gate header. carrier: none — noted in the PR's Acceptance notes only",
    "class: observation (not filed) · reach: none · A file-level anchor at ADR-0055:26 is not judged by symbol. A later cut that moves the step 2.7 middleware out of security-plugin.ts (cut 9+) will not red on it. carrier: #25223's per-cut anchor map (ruling 6353073966 item 2)"
  ]
}

Landed · domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · 2026-10-23T02:26Z

reading	value
PR #25316	APPROVED by `os-zhuang` 2026-10-23T00:58Z, merged by `os-zhuang` 2026-10-23T01:16Z (Tier H)
`origin/main`	carries `97967a9a06`

State: the card closed completed through the PR. This stroke clears pm:dispatched and the assignee. The anchors as merged are ADR-0055:26 → security-plugin.ts (file-level), ADR-0055:58 → #assertControlledByParentWrite, and ADR-0123:4 → #composeWriteTenantWall. That lifts ruling 6353073966 item 4's hold on #25223.

Generated by Claude Code

Navigation Menu

Repository navigation

docs/adr: three security-plugin.ts symbol anchors (ADR-0055:26, ADR-0055:58, ADR-0123:4) resolve only on tokens inside bodies the #25223 split moves; repoint them to method declarations the class keeps #25314

维护者速读

The reading (ruling `6353073966`, at `5801a4f2c`)

Acceptance

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

docs/adr: three security-plugin.ts symbol anchors (ADR-0055:26, ADR-0055:58, ADR-0123:4) resolve only on tokens inside bodies the #25223 split moves; repoint them to method declarations the class keeps #25314

Description

维护者速读

The reading (ruling 6353073966, at 5801a4f2c)

Acceptance

Activity

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 23, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

The reading (ruling `6353073966`, at `5801a4f2c`)