Repository navigation
fix(pm): advisory_read holds its sender to target-write, by the maintainer's ruling - #29656
Merged
objectstack-fleet[bot] merged 1 commit intoNov 3, 2026
Conversation
…ainer's ruling The relay's advisory_read row now holds its sender to target-write (write, maintain or admin on the target), the gate every other relay row keeps, in place of the advisory's own collaborating_users. The ruling is quoted verbatim beside the row and in the header. The row's grant stays read. The collaborator arm is retired rather than kept as a second setting: it refused every live read, and it excluded no one, since a sender with write on the target can add itself to an advisory. ADVISORY_READ_SENDER_GATES keeps the one value, so any other, collaborator included, fails closed. Self-tests: the executor's advisory_read battery pins a write sender off the collaborators sealed for, a triage sender refused before the GET, and an unknown or retired gate closed (17 -> 18 cases); the validator's fence cases move to the one gate. Claude-Session: https://claude.ai/code/session_01QSeKYn5CmmdShCJifm6WYj Co-authored-by: Claude <noreply@anthropic.com>
Contributor
Author
|
domain:skills#2 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj 席位核对ACCEPT · head
|
objectstack-fleet
Bot
deleted the
claude/issue-29644-advisory-read-sender-gate
branch
November 3, 2026 01:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #29644
Clause-②: no
Metadata-protocol: none
维护者速读
advisory_read)现在只要求发送者对目标仓有写、维护或管理权限,与其余中继操作同一道门;不再要求发送者在该公告的协作者名单上。原「协作者」档位整个删除,任何其他取值仍一律拒绝、不封装任何内容。scripts/pm/fleet-write/三个文件,不进任何发布包;回滚即还原这一个 commit。scripts/pm/fleet-write/ops.mjs(advisory_read行的senderGate与sender关卡,风险最高);execute.mjs(advisory_read自测电池中的发送者用例);validate.mjs(关卡用例)。node scripts/pm/fleet-write/execute.mjs --self-test,预期末行以✓ fleet-write/execute self-test: 260 cases pass across 22 batteries开头。What changes
advisory_read'ssenderGateis'target-write'(was'collaborator'). A read is held to the gate every relay stroke already passes, write, maintain or admin on the target, which the executor judges on the stroke before the advisory's GET. The maintainer's ruling is quoted verbatim in theops.mjsheader paragraph and in the row comment, replacing the text that calledcollaborator"the card's recommendation" and said the maintainer would rule on the pull request.grantstaysread. The row comment says a read refused under it is the maintainer's to rule on, never a raise to write.collaboratorarm is removed, not kept. It measured as refusing every live read, it excluded no one (a write sender can add itself to an advisory), and nothing outside these three files names it, so under the startup-stage rule it retires instead of staying a tested but unused setting.ADVISORY_READ_SENDER_GATESkeeps the one value, and any other value,collaboratorincluded, fails closed with nothing sealed.senderfence no longer reads the sender, soadvisoryReadFenceFailures' context dropssenderandadvisoryReadActionno longer takes it. No exported symbol is renamed or removed.dispatch.mjsis unchanged. None of its cases pins the gate: its end-to-end read's sender is on the fixture's collaborators, so it passes under either gate.A hypothesis, not a finding
These are the readings from the session that led to the ruling (run ids only). The add's PATCH answer listed the sender (run 41545025429). Three reads after it were refused at fence
sender(runs 41545143476, 41545259848, 41546082963). A re-sent add's pre-PATCH GET under the write grant already listed the sender, so it was a no-op (run 41546190167).That the read-grant GET answer omits
collaborating_usersis a hypothesis. It is UNVERIFIED. This PR does not depend on it and does not prove it, and nothing here measured it. Theops.mjsheader says the same.Tests
execute.mjs),advisory_readbattery, 17 to 18 cases:collaborating_usersis now sealed for, and the parts open byte for byte for the seat's key. Before, this case pinned a refusal.collaboratorboth fail closed after the GET, even for a write sender the advisory lists.validate.mjs),advisory_readbattery, 28 cases (count unchanged):target-write, with the grantread.target-writereads no collaborator: someone else listed, none, null or a team alone are all accepted.senderonly under an unknown gate.Acceptance notes
advisory_readby a seat with write on the target that opens, recorded on the card as a run id. It is not done here.ops.mjshas no--self-testof its own. Run with the flag, it exits 0 and prints nothing, because it is only an import. Its table is pinned byvalidate.mjs --self-test.scripts/pm/ships in no package, so this PR carriesskip-changeset.origin/mainmoved two commits past base3482f3d8. Neither touchesscripts/pm/fleet-write/or its imports, so nothing was merged in.Verification
All readings below were taken at head
a8eed928.Relay self-tests, before (base 3482f3d) and after (a8eed92)
Ablation, one-shot (scripts/ablation-replace.mjs, wrap mode, restore proven)
The expected directions were written down before each leg ran. The fix was committed first, so each restore leg points at HEAD.
Gates: dispatch-gates --commands --repo objectstack-ai/objectstack (39 families, all run at a8eed92)
Every exit code was captured before any pipe, and each log's own verdict line was read.
pnpm check:pm-dispatch-gatesran under nohup: its fast tier passed 1945 cases in 403.2s.These run in CI and not locally: the 52 artifact-roster families, the 11 wide-population families, the type-check lanes and the planned Test Core shard step. This diff touches no TypeScript package.
Generated by Claude Code