Repository navigation
A member can create a duty with source catalog, another person as owner and a foreign business unit #178
Description
Found by the #176 card thread (F3) on main 94419c6, @objectstack 18.2.0, live pnpm demo as demo member Owen Pryce. The report is in the project file duly-176-task-provenance/step0.md. This is the duly_duty counterpart of #176, which fixes the same shape on duly_task only.
What happens
POST /api/v1/data/duly_duty with { source: 'catalog', owner: <Sami>, business_unit: <Quality> } answers 201, stored as sent, with review_status: to_confirm.
- Owen cannot advance it himself (no
allowEditon the duty, 403). - It does reach an approver's queue. The approve option's
visibleWhen(record.owner != current_user.id) passes for anyone except Sami, so a confirmation by somebody else dispatches work to Sami that he never agreed to, labelled as role-catalog work.
What done looks like
- Measure every door (data POST and PATCH, MCP, the form) as a member and as a manager.
source: server-owned on the duty, as A member can write source, owner and business_unit on their own task, and so enter governed readings or someone else's #176 makes it on the task.catalogonly from Apply catalog or Sync,manageronly from a manager's assignment path, andselfotherwise. Catalog apply and the seed keep writing it.business_unit: derived from the owner's position on create, as the field's description already says, and not caller-chosen.owner: stop for a seat ruling before changing it. Who may create a duty for whom is part of the open decision [Decision] Permission model for duty review in the open edition — field-level write grant, platform action, or hook? #130 (the permission model for duty review), and the review pipeline (to_review/to_confirm) may be the intended check. Report what each role can do today.- Tests cover each refusal or strip on each door, plus catalog apply and the seed unaffected.
Generated by Claude Code
Activity
objectstack-fleet commentedon Nov 2, 2026
Claim: PM loop round 7
Session:
session_011HyoSXGRy6L13mYq1Hp4n1Account:
os-warren(the seat's linked user; the card's assignee)Branch:
claude/project-thread-42z0rr(platform-assigned card-thread branch, atorigin/main94419c6)Worktree:
duly-issue-178Domain: n/a. objectstack-ai/duly is a single-lane app repo with no
domain:*.Seat:
repo:duly#1File surface:
src/security/permission-sets.ts(an FLS map onduly_duty:source,owner,business_unitnot editable for member and manager, editable forduly_admin),src/hooks/duty.hook.ts(a business-unit stamp for a hand-made duty),src/hooks/index.tsonly if a new hook export needs it,src/objects/duty.object.ts(comments only),test/duty-provenance.test.ts(new). No task files. Stop on any breach until the seat posts a Claim amendment.Container & model:
M,mode:thread,model: TIER_DEFAULT(hand-derived),effort: highClause-②: no
Metadata-protocol: none
Responsibility: Make a duty's provenance server-owned for members and managers on every door through field-level security, which the 18.2 console honours on the form. Seat rulings: O1, owner is locked for member and manager. B1, a hand-made duty's
business_unitis stamped from the writer's primary business unit, matching the field's own description. Seed, Apply catalog and Import keep writing these fields.Thread-read: none
Premise: Step 0 on 18.2.0 at 94419c6 (project file
duly-178-duty-provenance/step0.md): data POST and MCP create accept a forgedsource,ownerand unit for member and manager; PATCH is 403 for both. FLS gives 403 'Field write denied' on REST and MCP, and the form renders the fields read-only and omits them.readonlyis the wrong tool here, because Import maps readonly fields as match-only.Serial constraints cleared: #176 (task provenance) may also need
src/security/permission-sets.tsandsrc/hooks/index.ts. Whichever lands second mergesmain(never rebase) and re-runs the gates. F2 (aduly_admincan self-approve) and F3 (the owner's confirm step is unreachable) are routed to decision #130; F4 (Apply leavesbusiness_unitnull in the demo) is a separate card.Generated by Claude Code
objectstack-fleet commentedon Nov 2, 2026
Claim amendment (duly lane seat, session
session_011HyoSXGRy6L13mYq1Hp4n1, 2026-11-02T06:57Z).test/task-duty-access.test.ts, thebeforeAllfixture only.duly_member, creates "his own duty" withownerandsourceset. Under the FLS lock that is the intended 403.sourceorowneron a task. Keep this change to the fixture lines. Whichever lands second mergesmain(never rebase) and re-runs the gates.Generated by Claude Code
Lock task provenance with field-level security instead of readonly (#176
Lock a task's source, owner and business unit against caller writes w…
Merge main (#176 task provenance) into #178
Give an applied duty its owner's business unit, and say when there is…