revert: PR #30222 (main red #30255) by objectstack-fleet[bot] · Pull Request #30262 · objectstack-ai/objectstack

objectstack-fleet · 2026-11-05T04:06:32Z

Requested by Bill · project thread

domain:server#2 · os-bill · session_01Utp6Cbvcmv8YWFhFJwzjKL

维护者速读

改了什么： 回退 PR fix(plugin-security): every member reads and posts comments, and reads the activity history, of the records they can read #30222（490d136f）：member_default 去掉 sys_comment 和 sys_activity 两行，连同它的测试和 changeset，文件恢复到合并前的原样。
为什么改： 合入后 main 的 Dogfood Regression Gate (2/3) 连红两次。没装审计插件的启动里，这两个对象没有注册，克隆 member_default 被保存门以 422 拒收。按 main 红的约定先止血。
风险与回滚： 只撤落地，不撤裁决：普通成员暂时回到改动前（没有评论和动态），等前向修复。这个 changeset 还没发布，所以回退不发布任何东西。
先看： packages/plugins/plugin-security/src/objects/default-permission-sets.ts 的差异。
两分钟验证： git diff 314ad955 HEAD -- packages/plugins/plugin-security .changeset 为空。
需要您做的： 无，席位落地。

Clause-②: no
Metadata-protocol: none

What this does

Reverts the squash commit 490d136f (PR #30222, #30108's landing): the two member_default grants (sys_comment read, create and edit; sys_activity read), the comment block above them, the integration test file, the flipped pins in member-default-explicit-allow.test.ts and comment-reaction-own-record-floor.test.ts, and the changeset .changeset/30108-member-default-feed-grants.md.

The five paths are byte-identical to their state in 314ad955, the commit before the landing: git diff 314ad955 HEAD over them is empty. No later commit on main touched them.

#30108's ruling A stands. Only the landing is undone, and the forward fix follows in its own PR, as the seat directed.

Why main went red

Measured in run 41961254209 (797f9257), Dogfood Regression Gate (2/3), case permission-set-clone-door.dogfood.test.ts "a platform set (the lock-and-clone rule's commonest source) copies into its shipping package's pair": the clone answered 422 INVALID_METADATA with two findings, objects.sys_comment and objects.sys_activity, each "no package registers an object of that name and none is saved here".

@objectstack/verify's bootStack constructs no AuditPlugin (fact 3 of packages/cli/src/commands/serve-audit-registration.contract.test.ts), and the showcase's requires does not name audit, so neither object is registered on that boot. The save door's unknown-grant refusal (#28990, packages/metadata-protocol/src/protocol-save-door-refusals.ts) judges every grant of a new item, and a clone is a new item. The same refusal reaches any deployment that does not install @objectstack/plugin-audit, not only the dogfood boot.

The merge queue skips the dogfood shards, so the PR's own checks did not run this case.

Verification

See the seat hand-off for the local run of the dogfood case on this head.

Generated by Claude Code

…records a member can read The platform baseline names sys_comment (read, create, edit) and sys_activity (read). The rows stay decided by plugin-audit's parent-record gates: a member reads and posts comments, and reads the history, of exactly the records they can read. No delete bit, no row policy, no export. A real-stack pin covers a readable record, an unreadable one (row scope and object level), an external member with and without an explicit grant, an object with enable.feeds false, and the console feed read's access-denied log count. Claude-Session: https://claude.ai/code/session_01Utp6CatT2ajve5PJf1Hhzj Co-authored-by: Claude <noreply@anthropic.com>

…-24iijl Claude-Session: https://claude.ai/code/session_01Utp6CatT2ajve5PJf1Hhzj Co-authored-by: Claude <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_01Utp6CatT2ajve5PJf1Hhzj Co-authored-by: Claude <noreply@anthropic.com>

…ned main red This reverts commit 490d136, the landing of the member_default feed grants, together with its changeset. On a boot that does not install @objectstack/plugin-audit (the verify harness's showcase), neither object is registered, so the permission-set clone door's save refuses a copy of member_default with 422 INVALID_METADATA on both grants. The ruling stands; only the landing is undone, and the forward fix follows. Claude-Session: https://claude.ai/code/session_01Utp6CatT2ajve5PJf1Hhzj Co-authored-by: Claude <noreply@anthropic.com>

objectstack-fleet · 2026-11-05T04:07:37Z

domain:server#2 · os-bill · session_01Utp6Cbvcmv8YWFhFJwzjKL

维护者速读

改了什么： 整体回退 fix(plugin-security): every member reads and posts comments, and reads the activity history, of the records they can read #30222（成员默认可读写评论、可读动态那两行授权），恢复到合并前的样子。
为什么改： fix(plugin-security): every member reads and posts comments, and reads the activity history, of the records they can read #30222 合入后 main 红（main red: Dogfood Regression Gate (2/3) fails permission-set-clone-door after PR #30222 (member_default grants sys_comment) #30255）：没装 plugin-audit 的启动里 sys_comment / sys_activity 未注册，克隆 member_default 到定制包会被 422 拒收。dogfood 用例拦到了，真实部署同样会中招。
风险与回滚： 回到合并前状态，新应用普通成员看评论又会「没有权限」，等前向修复重新落地。
先看： 五个文件与合并前 314ad955 逐字节一致。
两分钟验证： git diff 314ad955 1d7cf41e -- <五个路径> 为空。
需要您做的： 无，席位经合并队列落地（止血回退，非受管面）。
席位意见： ACCEPT。按 main-red 约定第一道止血是回退；[Decision] Every non-admin member of a new app sees "no permission" for comments and activity on records they can read #30108 的裁决 A 不变，前向修复（继承授权不再被拒 + 两行加回）随后单独一个 PR。

席位核对 — ACCEPT · domain:server#2 · head `1d7cf41e2d34c5713698633aee48aa0b2d463d9a`

形态: draft, author objectstack-fleet[bot] (relay pr_create), no assignee, no review request; 5 files, +13 −607; check-governed-merges --pr 30262: NOT governed, 620 lines ≤ 3000.
回退核对 (seat-measured): the net diff against origin/main is exactly the 5 paths of 490d136f (PR fix(plugin-security): every member reads and posts comments, and reads the activity history, of the records they can read #30222), and each is byte-identical to the pre-merge 314ad955 (git diff --quiet per path); no later commit on main touched them. The .changeset/30108-member-default-feed-grants.md goes with it, so nothing ships for [Decision] Every non-admin member of a new app sees "no permission" for comments and activity on records they can read #30108 until the forward fix.
为什么回退而不是前向: the root cause (dev, from run 41961254209): @objectstack/verify's boot stack and the showcase do not install AuditPlugin, so sys_comment and sys_activity are not registered there, and the save door's unknown-object grant refusal (metadata: a runtime permission-set save accepts a grant on an object that does not exist (200) — the build refuses the same grant (#18202), so a typo silently grants nothing #28990) rejects them on a fresh clone. The forward fix changes a metadata-protocol request shape and the refusal, so it is not mechanical and needs its own review; deployments without plugin-audit hit the same 422, so the revert stops the bleed now.
门禁: CI runs on this head through the queue; the dev is running the permission-set-clone-door dogfood case locally.
落地条款: Clause-②: no, Metadata-protocol: none, no changeset (it removes [Decision] Every non-admin member of a new app sees "no permission" for comments and activity on records they can read #30108's unreleased one). Refs #30255, Refs #30108: neither card closes. Ordinary queue landing by this seat: pr_ready + automerge_enable on this head.

github-actions · 2026-11-05T04:08:06Z

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)), so this run has no opinion about the docs.

What this run could not see

1 name(s) were too generic to anchor anything (single lowercase words)
a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 17 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 31260ca8e446fa4fbe94ff8fd2a9030ddfb53a9a → packageMentionDocs.

objectstack-fleet · 2026-11-05T04:09:56Z

domain:server#2 · os-bill · session_01Utp6Cbvcmv8YWFhFJwzjKL

Changeset confirmation (route 0, #18375 ruling D): Check Changeset stays red on purpose, and skip-changeset is not applied.

git diff --name-status against the merge base shows one .changeset row, D .changeset/30108-member-default-feed-grants.md, and no A.
The note removed is [Decision] Every non-admin member of a new app sees "no permission" for comments and activity on records they can read #30108's own pending note (PR fix(plugin-security): every member reads and posts comments, and reads the activity history, of the records they can read #30222, landed by this seat at 490d136f, not yet released): the @objectstack/plugin-security patch for the member_default grants on sys_comment and sys_activity. This PR reverts that code byte for byte, so the note would announce a change that no longer ships; removing it is the correction.
The note returns, rewritten, with the forward fix for main red: Dogfood Regression Gate (2/3) fails permission-set-clone-door after PR #30222 (member_default grants sys_comment) #30255 (the clone door, plus the two grants re-added) in its own PR.

Confirmed by the lane seat that owns both #30108 and #30255. Check Changeset is not a required context, so this red does not block the queue.

objectstack-fleet · 2026-11-05T04:20:34Z

domain:server#2 · os-bill · session_01Utp6Cbvcmv8YWFhFJwzjKL

Check Changeset, route 0 (#18375): this PR deletes a pending release note and adds none, so the check stays red and no skip-changeset label is applied.

The note: .changeset/30108-member-default-feed-grants.md ('@objectstack/plugin-security': patch), added by PR fix(plugin-security): every member reads and posts comments, and reads the activity history, of the records they can read #30222 (490d136f).
What changed under it: the note is deleted (git diff --name-status row D), together with the change it describes, which this PR reverts. The note was never released: it is still pending on main, which is why there was a file to delete. So after this PR the pending release set no longer announces the member_default feed grants, and nothing else changes.
The forward fix re-lands the grants with their own changeset, after this revert merges.

Please confirm in writing here. Check Changeset is not a required context, so its red does not block the queue.

Report taken 2026-11-05T04:20Z.

Generated by Claude Code

claude added 4 commits November 5, 2026 01:03

Merge remote-tracking branch 'origin/main' into claude/project-thread…

d22f921

…-24iijl Claude-Session: https://claude.ai/code/session_01Utp6CatT2ajve5PJf1Hhzj Co-authored-by: Claude <noreply@anthropic.com>

Merge origin/main into claude/project-thread-24iijl

b06d302

Claude-Session: https://claude.ai/code/session_01Utp6CatT2ajve5PJf1Hhzj Co-authored-by: Claude <noreply@anthropic.com>

github-actions Bot added size/l documentation Improvements or additions to documentation tests tooling labels Nov 5, 2026

objectstack-fleet Bot marked this pull request as ready for review November 5, 2026 04:08

objectstack-fleet Bot enabled auto-merge November 5, 2026 04:08

objectstack-fleet Bot mentioned this pull request Nov 5, 2026

fix(automation)!: a currency or percent screen field refuses a non-number on resume, and the console renders percent as a numeric input #30269

Merged

9 tasks done

objectstack-fleet Bot added this pull request to the merge queue Nov 5, 2026

This was referenced Nov 5, 2026

4-hourly full run: red on main (CI) #30274

Open

[PM seat] triage (objectstack-wide) — 🟢 Routine · session_01AavokzJ5DndAwitDXvKy4U · trig_01NcnCtMS2tH46nUg1a5TaMJ (hourly) · state = body + the round records newer than it #6015

Open

Merged via the queue into main with commit 119c2db Nov 5, 2026
48 of 49 checks passed

objectstack-fleet Bot deleted the claude/project-thread-24iijl branch November 5, 2026 05:08

Navigation Menu

Repository navigation

revert: PR #30222 (main red #30255) - #30262

revert: PR #30222 (main red #30255)#30262
objectstack-fleet[bot] merged 4 commits into
mainfrom
claude/project-thread-24iijl

objectstack-fleet Bot commented Nov 5, 2026

Uh oh!

objectstack-fleet Bot commented Nov 5, 2026

Uh oh!

github-actions Bot commented Nov 5, 2026

Uh oh!

objectstack-fleet Bot commented Nov 5, 2026

Uh oh!

objectstack-fleet Bot commented Nov 5, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

objectstack-fleet Bot commented Nov 5, 2026

维护者速读

What this does

Why main went red

Verification

Uh oh!

objectstack-fleet Bot commented Nov 5, 2026

维护者速读

席位核对 — ACCEPT · domain:server#2 · head 1d7cf41e2d34c5713698633aee48aa0b2d463d9a

Uh oh!

github-actions Bot commented Nov 5, 2026

📓 Docs Drift Check

Uh oh!

objectstack-fleet Bot commented Nov 5, 2026

Uh oh!

objectstack-fleet Bot commented Nov 5, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

席位核对 — ACCEPT · domain:server#2 · head `1d7cf41e2d34c5713698633aee48aa0b2d463d9a`