docs(skills, spec): every published package declares one anchor-safe isDefault permission set - #25930

📓 Docs Drift Check

⚠️ 1 changed file(s) yielded no anchor (packages/spec/src/marketplace/marketplace.zod.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: f1340f32fa7594793d379cf024f5b0dd39f7b013
Local-runs: none
Scope: packages/spec/src/marketplace/marketplace.zod.ts, skills/objectstack-data/rules/security.md + packages/spec/src/security/high-privilege.ts, packages/spec/src/security/index.ts, packages/spec/package.json, packages/lint/src/validate-security-posture.ts, packages/plugins/plugin-security/src/suggested-audience-bindings.ts, packages/plugins/plugin-security/src/security-plugin.ts, packages/plugins/plugin-security/src/app-default-permission-set.ts, scripts/check-skills-token-ratchet.mjs, content/docs/references/marketplace/marketplace.mdx, .changeset/25773-published-package-default-permission-set.md, packages/skills/package.json

Face: governed rule text (skills/**) + published spec file (packages/spec/src/**/*.zod.ts ships in files[]). Inputs: card #25773 body and comments 6397310741 / 6407727166 / 6408339288, ruling record 6341690661 on #25083, PR #25930 body, file list, net diff cb0a2fcf..f1340f32 (merge-base cb0a2fcf), check-runs on f1340f32. Author objectstack-fleet[bot] (fleet account; no external-author note owed).

① Derived judgments

1. Accept set: unchanged — right. The only packages/spec/src/** hunk is inside the /** # Marketplace Protocol … */ module doc block of marketplace.zod.ts (L31–L40: one new ## What a published package declares paragraph, one trailing-space fix). No schema, key, enum value, export or .describe() moved; CONSUMER_INSTALLABLE_TYPES import and every *Schema below are byte-identical. No new spec key, so the land-with-first-reader rule is not engaged. Clause-②: no and Metadata-protocol: none are correct for this diff.
2. Fidelity to consequence (ii) — right, no scope creep. The ruling orders text only: 「every published package declares one anchor-safe isDefault: true set」 in security.md (semantics → requirement) and the marketplace docs. The diff is four files, all prose/doc-block/changeset; no lint rule, runtime branch, schema or gate was added. The security.md bullet states the rule as a predicate an author can run, naming the symbol rather than paraphrasing it, as the card asked.
3. The predicate exists and means what the text says — right, with one precision note. describeAnchorForbiddenBits(def, anchor: 'everyone' | 'guest', context?) is defined in packages/spec/src/security/high-privilege.ts L192–L215, re-exported by export * from './high-privilege' (security/index.ts L21), and @objectstack/spec/security is a real subpath in packages/spec/package.json#exports. For 'everyone' it returns describeHighPrivilegeBits(def, context) and otherwise null (L203–L205), i.e. null ⇔ no platform/undeclared systemPermissions, no VAMA, no delete/transfer/export bit — exactly the anchor-safe reading the text gives. Precision note for the approver: the text shows the two-argument call; the gates pass the stack's declared capabilities as the third argument (anchorContext in lint L966, capabilities in the derivation L660), and without it an app capability in systemPermissions reads as forbidden (high-privilege.test.ts L162 vs L163). The call as written is therefore stricter than the gate, never looser — a set it passes is anchor-safe — and the bullet's next sentence (systemPermissions may name only app capabilities declared under capabilities:) carries the context semantics. Acceptable at this token budget; noted, not a defect.
4. The named refusals exist — right. Lint: SECURITY_ANCHOR_HIGH_PRIVILEGE = 'security-anchor-high-privilege' (validate-security-posture.ts L129), applied with severity: 'error' to every ps.isDefault === true set via describeAnchorForbiddenBits(ps, 'everyone', anchorContext) (L966–L983). Binding: suggested-audience-bindings.ts imports the predicate (L81) and the everyone derivation withholds an offending set with reason (L660–L661, EVERYONE_POSITION = 'everyone' from spec/identity/position.zod.ts); confirmAudienceBindingSuggestion (L995) runs the same gate. Boot: everyoneBaseline in security-plugin.ts L2237–L2243 still refuses via describeHighPrivilegeBits. The old wording 「lint and boot refuse …」 became 「lint … and the binding refuse it」; the boot-time withhold is the binding derivation re-run, so the meaning survives.
5. The honesty clauses are true — right. 「With none, invited members get nothing until an admin assigns each; no gate counts them」 / mdx 「no gate refuses a package that declares none, or more than one」: appDefaultPermissionSetName (app-default-permission-set.ts) returns the first isDefault set's name or undefined, with no diagnostic; the only isDefault counting in packages/lint is flow out-edges (lint-flow-patterns.ts L1187), not permission sets. Nothing in the cited code refuses zero or many. The published text states the gap instead of implying enforcement.
6. Token ratchet paid in-file — right. Recomputed with the gate's own convention (ceil(utf8 bytes / 4), check-skills-token-ratchet.mjs header) from the blobs, no local run: cb0a2fcf 10250 B → 2563; f1340f32 10244 B → 2561; pinned ceiling ['skills/objectstack-data/rules/security.md', 2563] (L555) untouched (script not in the diff). Lines 220 → 220, so no re-wrap is counted as savings. Deletions and where their meaning lives: (a) stack.zod.ts path aside — the schema name ObjectStackDefinitionSchema stays; (b) rls.zod.ts parenthetical — the source line stays, the table above it already lists the grammar; (c) field.zod.ts parenthetical — the section heading already names secret + requiredPermissions; (d) ADR-0105 §「Today's two postures」 pointer — the paragraph itself still states both postures and keeps ADR-0093, ADR-0132 and the tenancy-modes URL (the §-level pointer to docs/adr/0105 L68 is the one real loss, minor); (e) 「plugin-security's FieldMasker enforces it. The real channels are:」 → 「(FieldMasker). Two more channels:」 — exactly two channels follow (secret, requiredPermissions); (f) the capability clause folded into the anchor-safe sentence, which is what the predicate refuses in systemPermissions. No meaning the file carried is gone.
7. Marketplace page regenerated, not hand-edited — right. marketplace.mdx keeps its AUTO-GENERATED — DO NOT EDIT banner; the generator demotes module-doc headings one level (# → ##, ## → ###, matching the neighbouring ### Platform Management Flow), and the nine added mdx lines are the nine source lines verbatim. The CI sync step (Check generated reference docs are in sync with the spec, lint.yml L5469, job Type Check · source gates) is continue-on-error: true, so that job's colour is not the evidence here; the textual comparison above is.
8. Card closure — right. Fixes #25773 is correct: all three 「What to change」 items (skill text, marketplace source + regenerated page, ratchet paid in-file) land in this PR; the card's two boundary items (gate enforcement, hotcrm#2231) are explicitly not this card.

② Semver level

• @objectstack/skills (private unset, files: [dist, …], dist is skills/** copied by scripts/sync-catalog.mjs) ships the edited rules/security.md → published text, patch.
• @objectstack/spec (files[] includes src/**/*.zod.ts) ships the edited doc block → published text, patch.
• Changeset .changeset/25773-published-package-default-permission-set.md names exactly these two packages at patch, carries line-initial Clause-②: no and Metadata-protocol: none matching the PR body, and its prose matches the diff (requirement, predicate, refusals, honesty clause, in-file trims). Per AGENTS.md Post-Task Checklist step 3, none takes patch and a diff that publishes from a released package is never skip-changeset. Correct.

③ Boundary flags

• open_questions: [] — nothing to answer.
• out_of_scope_findings 「carrier: maintainer — no gate refuses a package that declares none or more than one」: ESCALATE (maintainer-only, non-blocking). The ruling orders the text; the card's boundary says a publish-time gate needs the maintainer's own word; the published text already states the absence honestly (①5). Nothing for this PR to do; the question rides to the maintainer with the Tier H approval reading of this PR body (「Acceptance notes」).
• deviations: attribution link points at the card thread (harness block) and the worktree was kept — neither touches the diff; no action.
• Dev-reported local gate runs (113 families, check:generated, spec build/typecheck) are the dev's evidence; this record's gate reading is the head's check-runs below.
• Observation for the lane seat, not a diff fact: the PR is draft: false while the claim (6407727166) said Tier H 「stays draft after an at-tier contract review PASS」. Readiness changes nothing here — the governed queue guard still requires a GOVERNED_APPROVERS approval — but the seat may want to reconcile the claim's wording with the relay's pr_create shape.

Check-runs on f1340f32 (final state):
Read via REST after every run completed (0 in progress, 46 polls). 41 success — among them the two required floors Lint & Repo Gates and TypeScript Type Check, Type Check · source gates (the job carrying the published-skills token ratchet step), Build Docs, Check Changeset, Spec property liveness, Governed Surface Queue Guard (run 40269931909), Test Core 1–8 and aggregate, Build Core, Type Check UI, Type Check · consumer gates, Type Check · workspace, and the card/branch/single-writer guards. 7 skipped (UI shards, Temporal Conformance, dogfood matrix, two opt-in harnesses — path-filtered, not failures). 1 cancelled: Governed Surface Queue Guard run 40269862184 (pull_request, created 2026-10-26T04:35:31Z), superseded 49 s later by the success run 40269931909 of the same workflow on the same head (created 2026-10-26T04:36:20Z) — a concurrency cancellation, not a red. No failure on the head; the second landing condition (all checks green) holds at this reading. Tier H: this PASS is the first landing condition; the PR still waits for a GOVERNED_APPROVERS approval.

Implemented-by: claude/project-thread-2drwet
Reviewed-by: session_014FZ3TJucS1L7BdMe5DAzXC

VERDICT: PASS

_{Isolated contract reviewer (pm-dispatch CONTRACT_REVIEW_TIER), read-only over the diff, the card and the head's check-runs; record written 2026-10-26T05:05Z.}