i18n(plugin-security): ship the security objects, built-in permission sets and positions in all eleven platform languages by objectstack-fleet[bot] · Pull Request #30744 · objectstack-ai/objectstack

objectstack-fleet · 2026-11-06T00:24:49Z

Requested by Elon · project thread

domain:server#1 · os-elon-musk · session_016WV4cya5ej5GQV86RPbRPK

Part of #30512 — package 7 of 11 (@objectstack/plugin-security). The card stays open: settings, sharing, approvals and platform-objects follow, and the last PR of the series makes the bundle check read the platform locale table.

Clause-②: no
Metadata-protocol: none

维护者速读

改了什么： 安全插件的对象（用户权限集指派、用户职位指派等）的名称、字段、帮助和校验提示，加上内置权限集的名称与说明、内置职位（平台管理员、组织所有者等）的名称与说明，补上繁中、阿语、法语、巴葡、俄语、德语、韩语 7 种，与平台语言表的 11 种一致。
为什么改： 平台语言表要求每个界面带齐 11 种语言；这是第 3 期按包补齐的第 7 个包。用这 7 种语言的管理员在「设置 → 权限集 / 职位」里看到的不再是英文。
风险与回滚： 只加翻译数据和注册行，不动逻辑、schema、接口；原有 4 种语言一字未改。唯一的测试改动是职位改名一致性测试多扫 6 种语言（覆盖变宽，没有放宽任何断言）。回滚即撤 PR。
先看： src/translations/index.ts（按表标签注册，zh-CN 在 zh-Hant 前）、permission-sets.ts 与 builtin-positions.ts（手写的两张表），再看 position-rename-consistency.test.ts。
两分钟验证： node scripts/check-i18n-bundles.mjs --filter=security 输出 plugins/plugin-security in sync；pnpm --filter @objectstack/plugin-security test 全绿。
需要你做的： 无，席位落地。

What changes

Seven new locales for the security package under the platform locale table's tags (zh-Hant, ar, fr, pt-BR, ru, de, ko): each a TAG.objects.generated.ts with all 60 object leaves plus its TAG.source-hashes.generated.ts, written by the repo's own os i18n extract --fill=default --source-hashes and served through withSourceFallback like the existing three. zh-CN stays ahead of zh-Hant in index.ts.
The two hand-written tables gain an entry per new locale: permission-sets.ts (label and description of the nine built-in permission sets) and builtin-positions.ts (label and description of the seven built-in positions). Both are registered as each locale's permissions / positions group, and their header sentence now says "every locale" instead of "three entries".
The extract command in scripts/i18n-extract.config.ts lists the seven tags and its merge baseline imports the seven bundles, so check:i18n covers them from this PR on.

Tests

builtin-positions.test.ts and objects/permission-set-descriptions.test.ts already iterate every locale of SecurityTranslations, so each new locale is held to the existing rules with no test edit: exactly the built-in names, no two labels alike, no English copy, no position id in the text, and the served GET /meta/position overlay.
position-rename-consistency.test.ts extends its stale-word scan (no "role" wording left on the renamed objects) to zh-Hant, fr, pt-BR, ru, de and ko. Coverage widens; no assertion changed. Arabic is not added: its word for "role" (دور) is also the word in بدوره ("in turn"), which a correct help text on sys_user_position.delegated_from uses, so a pattern for it would flag correct text.

Acceptance notes

Quality bar ([Decision] Repeater row-property localisation: 604 catalog leaves across four locales — who authors the translated copy? #17508 / PR feat(spec): a repeater property panel names its columns in every locale, not only English #19345): every leaf written for the reader; placeholders, code spans and identifiers byte-identical, checked mechanically per leaf against en (key set, {{holes}}, {holes}, backtick spans, angle tokens: all seven locales OK, zero diffs). Arabic is RTL prose with identifiers left in Latin script. zh-Hant was checked character by character against OpenCC's Traditional (Taiwan) conversion: no Simplified-only character remains.
Leaves equal to English, on purpose: one, de sys_user_position.fields.position.label = Position (the German word). The extractor records it as a source copy in de.source-hashes.generated.ts.
The English source of sys_user_position.fields.delegated_from.help carries the Chinese term (职务代理); every locale keeps it as es-ES already does. Not changed here (the source text belongs to the object, not to this bundle).
No cross-locale coincidence: check:i18n-stale-fill passes with the baseline untouched.
Carried unchanged from the released handover commit ff28e790 (session session_01Utp6Cai5CRdAs4u9gTipWU): the patch id of this PR's diff equals that commit's (446fab73). The serial row "after Setup: replace developer wording and hand-written JSON with fields a business administrator can use #30208 lands" was cleared by the seat: Setup: replace developer wording and hand-written JSON with fields a business administrator can use #30208's server rows that touch this package landed in PR fix: Setup form help speaks to an administrator; queue pages, mail status banner and test toast read in Chinese #30551, an ancestor of this branch.

Verification

Package suite, typecheck, build (verify lock)

turbo run build --filter=!@objectstack/docs: 118/118 tasks successful, exit 0
pnpm --filter @objectstack/plugin-security test && typecheck   (at head 99bc8346, after merging origin/main 447226b2)
 Test Files  246 passed (246)
      Tests  5679 passed | 45 skipped (5724)
check:test-typecheck: OK (tsconfig.test.json, 0 errors)
os-verify-lock: VERDICT command-exit 0
same suite at 41230cb6 (before the merge): 246 files, 5679 passed | 45 skipped, VERDICT command-exit 0

i18n gates and the derived families

node scripts/check-i18n-bundles.mjs --filter=security          (at 99bc8346)
  plugins/plugin-security        in sync (21 bundle(s))                      EXIT 0
node scripts/check-i18n-stale-fill.mjs                          (at 99bc8346)
check-i18n-stale-fill: OK (11 bundle set(s) — no new stale fills, 1 baselined).   EXIT 0
dispatch-gates --commands (at 41230cb6): 61 families, each run and recorded with its exit code: 61 x exit 0
dispatch-gates --ran: 61 derived, 61 run, 0 NOT-MEASURED (a derived zero)
re-derived at 99bc8346: the identical 61-command list; --ran on the same record: 61 run, 0 NOT-MEASURED
pnpm lint (repo-wide, at 41230cb6): exit 0
eslint --no-inline-config on the changed .ts files: exit 0
changed lines 1807 (+1801 / -6), 20 files: under the 3000-line human-merge threshold

The merge of origin/main brought 17 commits, none in plugin-security, plugin-sharing, plugin-approvals or service-settings; the package suite and both i18n checks were re-run on the merged head.

Dogfood: not run — content-only package PR, no ! in the title and no (narrowing) arm.

Generated by Claude Code

… sets and positions in all eleven platform languages The security objects, the built-in permission sets and the built-in positions gain zh-Hant, ar, fr, pt-BR, ru, de and ko under the platform locale table's tags. Each object bundle is written and hashed by the repo's own `os i18n extract --source-hashes` and served through withSourceFallback like the existing three; the hand-written permission-set and position tables carry an entry per locale; the extract command and its merge baseline list the seven tags, so check:i18n covers them. position-rename-consistency extends its stale-word scan to zh-Hant, fr, pt-BR, ru, de and ko. Carried from the released handover commit ff28e79 (written by session_01Utp6Cai5CRdAs4u9gTipWU) onto main 06cccd3 without change. Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016WV4cya5ej5GQV86RPbRPK

Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016WV4cya5ej5GQV86RPbRPK

github-actions · 2026-11-06T00:26:22Z

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-security, touching 45 documentable anchor(s).

23 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 82142ed65ce60cad753bea0aa2b76cb0364b132f.

⛔ 16 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

4 name(s) were too generic to anchor anything (single lowercase words)
the SDK route bridge reached 63 of 221 client-bound route-ledger rows — the other 158 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 158: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 103 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 17 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 82142ed65ce60cad753bea0aa2b76cb0364b132f → packageMentionDocs.

Which tree this was computed on

This run read content/docs from e864b0ece342846378670d6368c399c7a8b46586 — the merge of head 99bc8346e5565c98090662643b476625cf619ba4 into base 82142ed65ce60cad753bea0aa2b76cb0364b132f, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin e864b0ece342846378670d6368c399c7a8b46586 && git checkout e864b0ece342846378670d6368c399c7a8b46586
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 82142ed65ce60cad753bea0aa2b76cb0364b132f 99bc8346e5565c98090662643b476625cf619ba4 && git checkout -B drift-repro 82142ed65ce60cad753bea0aa2b76cb0364b132f && git merge --no-ff 99bc8346e5565c98090662643b476625cf619ba4

node scripts/docs-audit/affected-docs.mjs --json 82142ed65ce60cad753bea0aa2b76cb0364b132f

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 82142ed65ce60cad753bea0aa2b76cb0364b132f → pass the list as
args.docs, on the commit named under Which tree this was computed on.

objectstack-fleet · 2026-11-06T00:51:36Z

domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW

席位核对 · ACCEPT · 2026-11-06T00:51Z · #30512 (package 7 of 11, plugin-security)

Head-sha: 99bc834

Shape: 20 files, +1801/−6, all in packages/plugins/plugin-security/: seven new locale bundles with source-hash companions (zh-Hant, ar, fr, pt-BR, ru, de, ko), the hand-authored permission-sets.ts and builtin-positions.ts tables extended per locale, translations/index.ts registering them under the platform-table tags, the extract config's --locales list, one test, and one patch changeset. That is under the 3000-line threshold and inside claim 6672078792 and its sequence note 6672288503. Not governed. The commit is the released handover ff28e790 by patch id, plus one merge of origin/main.
Spot check (read in the diff):
- The hand-written tables carry an entry for every built-in permission set and position in each new locale. permission-set-descriptions.test.ts and the positions test iterate the bundle's own locale keys (Object.keys(SecurityTranslations)), so the seven new locales are pinned without a test edit.
- position-rename-consistency.test.ts gains six of the seven locales. Arabic is left out, presumably because there is no stale-term pattern to check for it.
- Product terms are kept, and the zh-Hant text is Traditional (spot-read the positions and the permission sets).
Gates: every check-run on this head has concluded: 35 success, 13 skipped, 0 failure. Locally, the dev report 6673191681 shows plugin-security 5679 passed / 45 skipped, typecheck clean, check-i18n-bundles in sync, stale-fill 0, dispatch-gates 61/61 with 0 NOT MEASURED, and pnpm lint 0.
Accepted deviations: none reported.
Out of scope: none found. The Setup: replace developer wording and hand-written JSON with fields a business administrator can use #30208 rows were cleared before this PR (6672288503).
Contract: Clause-②: no, Metadata-protocol: none, confirmed from the diff: translations only, with no key or shape change.
Landing: ready, then auto-merge, through the relay. The card's plugin-security checklist row is ticked on merge.

claude added 2 commits November 5, 2026 23:35

Merge origin/main into claude/project-thread-1jep1s

99bc834

Co-authored-by: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016WV4cya5ej5GQV86RPbRPK

github-actions Bot added size/xl documentation Improvements or additions to documentation tests tooling Fix lands in tooling, not a product package — enters pm:queue only with Unblocks: or a named surface labels Nov 6, 2026

objectstack-fleet Bot mentioned this pull request Nov 6, 2026

i18n phase 3 (platform metadata and built-in emails): extraction and bundle checks read PLATFORM_LOCALES; backfill the seven missing locales #30512

Open

7 of 13 tasks

objectstack-fleet Bot marked this pull request as ready for review November 6, 2026 00:52

objectstack-fleet Bot enabled auto-merge November 6, 2026 00:52

objectstack-fleet Bot added this pull request to the merge queue Nov 6, 2026
Any commits made after this event will not be merged.

Merged via the queue into main with commit e00bcc6 Nov 6, 2026
49 checks passed

objectstack-fleet Bot deleted the claude/project-thread-1jep1s branch November 6, 2026 01:10

objectstack-fleet Bot mentioned this pull request Nov 6, 2026

i18n(plugin-sharing): ship the sharing and queue objects in all eleven platform languages #30767

Open

Navigation Menu

Repository navigation

i18n(plugin-security): ship the security objects, built-in permission sets and positions in all eleven platform languages - #30744

i18n(plugin-security): ship the security objects, built-in permission sets and positions in all eleven platform languages#30744
objectstack-fleet[bot] merged 2 commits into
mainfrom
claude/project-thread-1jep1s

objectstack-fleet Bot commented Nov 6, 2026

Uh oh!

github-actions Bot commented Nov 6, 2026

Uh oh!

objectstack-fleet Bot commented Nov 6, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

objectstack-fleet Bot commented Nov 6, 2026

维护者速读

What changes

Tests

Acceptance notes

Verification

Uh oh!

github-actions Bot commented Nov 6, 2026

📓 Docs Drift Check

Uh oh!

objectstack-fleet Bot commented Nov 6, 2026

席位核对 · ACCEPT · 2026-11-06T00:51Z · #30512 (package 7 of 11, plugin-security)

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant