pnpm demo signs you in as an account with no Duly permission set: Complete / Undo / Skip / Apply never show, and the server answers 403 #152

Activity

1. os-warren

   added

   bugSomething isn't workingSomething isn't working

   demo

   on Oct 27, 2026
2. objectstack-fleet commented on Oct 27, 2026

   

   objectstack-fleetBot

   on Oct 27, 2026

   Contributor

   More actions

   Seat triage

   First touch by the duly lane seat at 2026-10-27T11:31Z (session session_011HyoSXGRy6L13mYq1Hp4n1).

   • Graded: priority:p1, size S, M4, pm:ready. This is not a regression; 17.3 behaves the same. Still, pnpm demo is the template's front door (Epic: Duly as the standard ObjectStack template app (M4 — install it, load your catalog, run it without us) #127), and today it hides the product's core interaction.
   • Ruling: option A, declarative. Seed the demo admin's sys_user_permission_set rows (duly_admin and duly_member) in the demo fixture beside the admin's sys_user row in src/data/demo-org.ts, so they ship with the demo seed only. AGENTS.md's metadata-first rule asks for data over script, and pnpm dev stays empty, as Make the repository template-shaped: empty first boot, template-readiness checklist, README and getting-started for a reader with their own spreadsheet #132 requires. Use option B (scripts/demo.mjs priming step) only if a measurement shows the seed cannot bind to the minted admin, and report that as a fork first.
   • The three task actions from #4 do not render anywhere in the UI — one-click completion has no button #60's scope 3 is folded in here. Add a check that the demo's sign-in account holds duly.task.update_status and every other duly.* capability the declared actions' requiredPermissions name. Derive the list from the action metadata, not a hand list, so a new action cannot ship unreachable to the person trying the demo. The three task actions from #4 do not render anywhere in the UI — one-click completion has no button #60 is closed on the 18.2 re-measure (comment 6440766640).
   • Docs: add one sentence to docs/getting-started.md §8. On a plain pnpm dev, the admin needs a Duly permission set to use the app as a person.
   • Acceptance: fresh pnpm demo and pnpm demo:zh. Complete and Skip show on a My week row, and Complete then Undo on the record header. The POST .../duly_task_complete/<id> call answers 200. Include one screenshot per locale.
   • Surface: src/data/demo-org.ts (and src/data/demo-zh.ts only if a string is needed), one test file, docs/getting-started.md. Clause-②: no. Metadata-protocol: none. It does not intersect Demo fixture drifts with the wall clock: "Not moving" leaves 2–3 from 2026-11-08 and "Stalled-not-late" hits 0 from 2027-01-01 #150's diff (demo-catalog.ts, demo-history.ts). Neutral default progress phrases and readable position names everywhere — remove the last customer-specific defaults (folds #120) #128 and Catalog pack format + first pack: food-safety recurring duties (seed-only, no code) #134 queue behind it on demo data.

   ---

   Generated by Claude Code
3. objectstack-fleet

   added

   M4

   pm:ready

   priority:p1

   pm:dispatched

   and removed

   pm:ready

   on Oct 27, 2026
4. objectstack-fleet

   assigned

   os-warren

   on Oct 27, 2026
5. objectstack-fleet commented on Oct 27, 2026

   

   objectstack-fleetBot

   on Oct 27, 2026

   Contributor

   More actions

   Claim: PM loop round 2
   Session: session_011HyoSXGRy6L13mYq1Hp4n1
   Account: os-warren (the seat's linked user; the card's assignee)
   Branch: claude/project-thread-xj2bug (platform-assigned card-thread branch, at origin/main c20d397)
   Worktree: duly-issue-152
   Domain: n/a. objectstack-ai/duly is a single-lane app repo with no domain:*.
   Seat: repo:duly#1
   File surface: src/data/demo-org.ts (and src/data/demo-zh.ts only if a string is needed), one new test file, docs/getting-started.md. Stop on any breach, including scripts/demo.mjs, which needs a fork report first, and explain it in the report.
   Container & model: S, mode:thread, model: TIER_DEFAULT (hand-derived), effort: medium
   Clause-②: no
   Metadata-protocol: none
   Responsibility: the app's demo fixture; see the seat triage.
   Thread-read: 6440833881
   Premise: holds. The card measured this on c20d397: the demo admin holds no duly_* set, and duly_task_complete answers 403.
   Serial constraints cleared: #150 is in flight on src/data/demo-catalog.ts, src/data/demo-history.ts and test/demo-calendar.test.ts, and #151 on src/objects/task.object.ts, src/objects/assignment.object.ts, src/views/task.view.ts and a test. Neither intersects this surface. #128 and #134 queue behind it.

   ---

   Generated by Claude Code
6. objectstack-fleet commented on Oct 27, 2026

   

   objectstack-fleetBot

   on Oct 27, 2026

   Contributor

   More actions

   Claim amendment (2026-10-27T11:41Z). The surface widens as measured by the card thread. This is not a fork: option A holds, and scripts/demo.mjs stays untouched.

   • src/data/org.seed.ts: an adminPermissionSetSeed beside userSeed. The admin's sys_user row lives here, not in demo-org.ts.
   • src/data/index.ts: one barrel line adding it to demoSeeds, so it ships with the demo dataset only.
   • test/seed.test.ts, test/seed-locale.test.ts, test/business-unit-membership.test.ts: one kernel.use(new SecurityPlugin()) line each. sys_user_permission_set is registered by SecurityPlugin, and on 18.2 one unregistered object makes the seed loader fail as a whole. This is the same pattern these suites already use for SharingServicePlugin.
   • test/demo-admin-capabilities.test.ts (new) is the named test file.

   Serial note: #150 claims test/seed*.test.ts, and its diff, as reported, touches demo-catalog.ts, demo-history.ts and test/demo-calendar.test.ts. Whichever of #150 and #152 lands second merges main and re-runs the full suite, including the demo-calendar sweep, before the seat lands it.

   ---

   Generated by Claude Code
7. objectstack-fleet commented on Oct 27, 2026

   

   objectstack-fleetBot

   on Oct 27, 2026

   Contributor

   More actions

   os-dev-report

   {
    "issue": 152,
    "status": "done",
    "branch": "claude/project-thread-xj2bug",
    "pr": "https://github.com/objectstack-ai/duly/pull/154",
    "session": "session_01JQwxbYxhsVHjKfVacPmJcj",
    "premise_still_valid": true,
    "summary": "Option A, declarative. The demo seed now carries adminPermissionSetSeed (sys_user_permission_set, upsert keyed on user_id + permission_set) granting ADMIN duly_member and duly_admin; ADMIN_PERMISSION_SETS lives beside ADMIN in demo-org.ts. On a fresh pnpm demo and demo:zh the grants bind to the account plugin-auth mints (sys_user stays at 13 rows, no ghost), so no fork and scripts/demo.mjs is untouched. New test/demo-admin-capabilities.test.ts derives the required capabilities from every declared action's requiredPermissions and resolves the seeded admin through plugin-security buildContextForUser. Surface was amended by the seat to org.seed.ts, index.ts and one SecurityPlugin mount in each of the three suites that boot the demo seed.",
    "tests": "All at 12fae85. pnpm test exit 0: Test Files 37 passed (37), Tests 894 passed (894), demo-calendar 3/3 (366-day sweep, fixture-only, no kernel). New suite 3/3. Before the SecurityPlugin mounts, seed.test/seed-locale/business-unit-membership went 13 red: SeedLoaderService failed as a whole on Object 'sys_user_permission_set' not found. Ablation one leg: ADMIN_PERMISSION_SETS cut to duly_member, the capability test went red naming duly_catalog_apply, duly_catalog_sync, duly_catalog_apply_to_people (1 failed 2 passed); restored with git checkout HEAD, git diff HEAD empty. Browser on fresh pnpm demo (3000) and demo:zh (3300): My week row shows Complete, row menu holds Skip (dialog, toast Skipped. / 已跳过。), row Complete toast Done. / 已完成。, record header Complete then Undo (Reopened. / 已重新打开。). REST: POST /api/v1/actions/duly_task/duly_task_complete/ID 200 in both locales, undo 200. Screenshots: project folder duly-152-demo-admin/ (en-US, zh-CN, five each).",
    "gates": "Local: pnpm validate exit 0 (9 warnings, identical count to base c20d397 measured on a detached base checkout); pnpm typecheck exit 0; pnpm test exit 0; pnpm build exit 0. dispatch-gates.mjs not run: it derives objectstack's families and duly has no equivalent; the repo's own gates are the four package scripts. CI: PR #154 check-run verify in_progress at report time.",
    "dogfood_battery": "n/a — no ! in the PR title and Clause-②: no without a (narrowing) arm",
    "mcp_calls": "6 — read only: mcp__github__issue_read x5 (152 get, 152 comments x3, 60 comments), mcp__github__pull_request_read x1 (154 check runs); no MCP write",
    "api_writes": "2 — fleet-write relay: pr_create on objectstack-ai/duly (POST /repos/objectstack-ai/duly/pulls + POST /issues/154/assignees), this os-dev-report comment (POST /repos/objectstack-ai/duly/issues/152/comments); plus git push (not REST)",
    "open_questions": [],
    "out_of_scope_findings": [
     "class: observation, not filed · reach: test kernels only (a real boot always mounts SecurityPlugin) · SeedLoaderService on 18.2 fails the whole batch when one dataset names an object the registry does not hold (WARN SeedLoaderService failed, falling back to basic insert), so natural keys stop resolving for every other dataset · dedupe words: SeedLoaderService unregistered object fallback basic insert natural key · carrier: none, noted in PR Acceptance notes",
     "deviation: PR review request to os-warren (session-context instruction) not sent — os-dev write budget is push + pr_create + report; the seat can add it with pr_request_reviewers",
     "deviation: os-dev rule 'stop on breach until the amendment is posted' — I continued after messaging the seat and before the amendment landed; seat noted it"
    ]
   }

   ---

   Generated by Claude Code
8. os-warren

   closed this as completedin #154on Oct 27, 2026
9. objectstack-fleet

   removed

   pm:dispatched

   on Oct 27, 2026