Repository navigation
OBJECT_API_METHOD_NOT_ALLOWED names an operation its own allowed array contains — the refusal reports the conjunct that PASSED #15416
Description
Measured in passing while driving sys_user write doors for cloud#1989, on a real
walled boot of the cloud control plane at framework pin 5b2ad1b41.
What was measured
sys_user declares enable.apiMethods: ['get','list','update','bulk']
(packages/platform-objects/src/identity/sys-user.object.ts:907). Three requests,
each refused, each naming an operation that its own allowed array contains:
POST /api/v1/data/sys_user/deleteMany -> 405
{"error":"API operation 'bulk' is not allowed on object 'sys_user'",
"code":"OBJECT_API_METHOD_NOT_ALLOWED","object":"sys_user",
"allowed":["get","list","update","bulk","aggregate","history","search","import","export"]}
POST /api/v1/data/sys_user/createMany -> 405 (identical envelope)
POST /api/v1/batch -> 405 (identical envelope)
POST /api/v1/data/sys_user/import -> 405
{"error":"API operation 'import' is not allowed on object 'sys_user'", ...
"allowed":[... ,"import","export"]}
bulk is in the allowed set and the refusal says bulk is not allowed. Same for
import. Meanwhile POST /api/v1/data/sys_user/updateMany and
POST /api/v1/data/sys_user/batch — which also need bulk — are ADMITTED and
answer 200. So the refusal is correct in outcome (deleteMany needs bulk AND
delete; createMany needs bulk AND create; import needs a create face) but the
message names the wrong conjunct: it reports the conjunct that PASSED.
Why this is worth a card rather than a shrug
The allowed array is load-bearing as a DISCRIMINATOR, not decoration.
apps/cloud/test/unscoped-control-plane-tenant-wall.test.ts states the rule it
inherited from cloud#1225: a declaration re-widened to create/update can still
405 for an unrelated reason, so only the set proves WHICH gate answered. An
envelope whose set contradicts its own message cannot serve that purpose — a
future measurement reading it concludes the object still has the verb open when
the gate in fact closed a different conjunct, or the reverse.
Suggested shape
The refusal should name the conjunct that actually failed (delete / create),
or the allowed set should be the set the gate evaluated against. Either one
makes message and set agree; shipping both as they are makes the envelope
self-contradicting.
Filed with no assignee by the cloud#1989 measurement seat. Not repaired there:
that card is measurement-only and this is a framework-owned surface.
Activity
os-zhuang commentedon Sep 4, 2026
分诊 ·
domain:cli/priority:p2/pm:queueAnchor read, not guessed — and the read turned up a second emit site the card does not name.
origin/mainf1d7872, 2026-09-04T23:45:27Z — the message template`API operation '${operation}' is not allowed on object '${object}'`exists in exactly two places:packages/rest/src/rest-server.ts:366packages/mcp/src/stdio-data-bridge.ts:275Both are in the
domain:clilane (rest,mcp), so the anchor is unambiguous and no cross-lane hand-off is needed. Confirmed alongside:sys-user.object.ts:907still declaresapiMethods: ['get','list','update','bulk'].⛔ The MCP site is in scope for this card and must not be left behind. A fix that repairs only the REST envelope leaves an identically self-contradicting refusal on the MCP surface, and the next measurement seat files this card again from the other door. Whoever takes it should check whether
stdio-data-bridge.ts:275derives itsallowedarray the same way — if it does, one fix serves both; if it does not, say so in the PR rather than silently fixing one.Grade — p2
The card is right that the refusal is correct in outcome —
deleteManyneedsbulkANDdelete,createManyneedsbulkANDcreate, andupdateMany/batch(which need onlybulk) are correctly admitted with 200. Nothing is wrongly allowed or wrongly denied. So this is not a permission defect and not p1.What makes it p2 rather than p3 is that the
allowedarray is load-bearing as a discriminator, not decoration, and the card cites the pin that says so:apps/cloud/test/unscoped-control-plane-tenant-wall.test.ts, carrying the rule from cloud#1225 — a declaration re-widened to create/update can still 405 for an unrelated reason, so only the set proves WHICH gate answered.An envelope whose message contradicts its own set cannot serve that purpose, and the failure is silent and directional: a future measurement reads
allowed: [… "bulk" …]against a message sayingbulkis not allowed and concludes either "the verb is still open" (missing a real closure) or "the gate closed bulk" (filing a false finding). This repo has already paid for exactly that class this week. A refusal message that names the conjunct that passed is worse than a vague one, because it is specific and wrong.Boundary test — Bug, no manual floor
Both suggested shapes restore internal consistency; neither widens the accept set, and neither changes which requests are refused.⚠️ But the wire body is a published contract, so the choice between them is not free-form:
delete/create) in the message — changes theerrorstring only; theallowedset keeps meaning "what the object declares".allowedthe set the gate evaluated against — changes the semantics of a field clients read, which is the more invasive of the two despite looking like the smaller diff.⇒ Prefer 1 unless there is a reason not to; if 2 is chosen, it needs the ruling that goes with changing a published field's meaning, and
unscoped-control-plane-tenant-wall.test.tshas to be re-read first because it is the consumer that depends on today's meaning.One thing to measure before writing either: the card shows three distinct requests (
deleteMany,createMany,POST /api/v1/batch) producing an identical envelope namingbulk. Whether:366can even see which conjunct failed, or whether the conjunct check happens upstream and onlybulkreaches the formatter, decides whether option 1 is a one-line change or a plumbing change. ⛔ Do not assume it is one line.⛔ Not a claim, not a dispatch — routing only.
Generated by Claude Code
os-sales commentedon Sep 7, 2026
Claim: PM loop round R70
Session:
session_01YFY46JydE1gMxQG1TqBcMZBranch:
claude/issue-15416-method-not-allowed-names-failing-conjunctWorktree:
objectstack-issue-15416Domain:
domain:cliFile surface:
packages/rest/src/rest-server.ts,packages/mcp/src/stdio-data-bridge.ts, plus their tests (stop on breach; explain in the report)Container & model:
M,mode:subagent,model: opus(⛔ no path-derived mandate —dispatch-gates.mjs --tierderived at1ecee3e5from a detached worktree atorigin/main, ⛔ not from the shared checkout)Clause-②: no
Serial constraints cleared:
none— see the measurement belowHARD SERIAL cleared — 28/28 MEASURED, ⛔ and the first pass was not a clearance
Both target files scanned against every open PR (28 rows):
⛔ That is NOT MEASURED, never "0 collisions" — this lane's rule, and the reason it exists is that a shallow clone's silence is indistinguishable from a true negative. Re-measured:
⇒ 28/28 measured, 0 collisions on
rest-server.tsandstdio-data-bridge.ts. This is a reading, not a silence.⭐ RULING — take option 1. The card offers two shapes; they are not equivalent.
The card says either shape "makes message and set agree". True, but they cost differently, and triage (
5547738677) already named why:Name the conjunct that actually failed (
delete/create) in theerrormessage. Theallowedarray keeps meaning "what the object declares".⛔ Do NOT take option 2 (redefining
allowedto be the set the gate evaluated against). It changes the semantics of a field clients already read — the smaller-looking diff is the more invasive one. Theallowedarray is load-bearing as a discriminator:apps/cloud/test/unscoped-control-plane-tenant-wall.test.tscarries the cloud#1225 rule that a declaration re-widened to create/update can still 405 for an unrelated reason, so only the set proves WHICH gate answered. Redefining it silently retargets that consumer.⇒ Option 1 is a message repair; option 2 is a published-contract change requiring a maintainer ruling. This seat rules option 1 and ⛔ does not authorise option 2.
The message template exists in exactly two places (
origin/mainf1d7872):packages/rest/src/rest-server.ts:366packages/mcp/src/stdio-data-bridge.ts:275⛔ A fix that repairs only REST leaves an identically self-contradicting refusal on MCP, and the next measurement seat files this card again from the other door. Both are in this lane, so there is no hand-off. Check whether the MCP site derives its
allowedarray the same way: if it does, one fix serves both; if it does not, say so in the PR rather than silently fixing one.The card shows three distinct requests (
deleteMany,createMany,POST /api/v1/batch) producing an identical envelope namingbulk. Whether:366can even see which conjunct failed — or whether the conjunct check happens upstream and onlybulkever reaches the formatter — decides whether option 1 is a one-line change or a plumbing change. If it is plumbing, that is the finding; report it, do not force a one-liner.rest-server.tsis LINE-NUMBER ANCHORED — this is not theoreticalcontent/docs/permissions/system-context.mdxanchors that file by absolute line number, and it names it 4 times (measured at1ecee3e5). This lane reddenedcheck-system-context-censustwice on this exact file, once from a diff that was nothing but comments:⇒ Any line added or removed above an anchor reds that gate. Repair with the gate's own
--fix(it rewrites a pure shift and refuses a population change — a refusal means stop and think, ⛔ not edit harder), and verify structurally by comparing census populations with a re-validated non-zero control. ⛔ Never verify by comparing line content — several anchored lines in that file are the same string.Generated by Claude Code
claude commentedon Sep 7, 2026
os-dev-report
{ "issue": 15416, "status": "done", "branch": "claude/issue-15416-method-not-allowed-names-failing-conjunct", "pr": "https://github.com/objectstack-ai/objectstack/pull/16511", "premise_still_valid": true, "failing_conjunct_reachable_at_formatter": "YES — option 1 is LOCAL, not plumbing. `apiAccessDenialFromEnable` already receives the whole conjunction: the `enable` block, the canonical operation, and the `ApiAccessOpts` carrying `bulkChild` / `writeMode` that every bulk and import route passes through `enforceApiAccess`. Nothing upstream discards the child; the formatter simply never asked which half was false. The measurement also widened the defect by one shape: the envelope self-contradicts in exactly the cases where `isApiOperationAllowed` consults its options, and there are TWO — `bulk AND child`, and `import` refined by `writeMode` (an insert import needs `create` while `import` sits in the effective set via create OR update). With no options passed the verdict reduces to membership in the very set serialized as `allowed`, so the two halves cannot disagree.", "one_fix_served_both_emit_sites": "NO — and the MCP site needed no repair, which is the finding rather than a shortcut. Both surfaces derive `allowed` identically via `effectiveOperationsArray(resolveEffectiveApiMethods(enable))`; they differ on the CHECK side, which is the side that produces the contradiction. `enforceApiExposure` passes no `OperationCheckOptions`, and `GATED_ACTIONS` is six words (query/get/create/update/delete/aggregate) containing neither conjunction-bearing operation, so the class is structurally unreachable on stdio. A shared helper would need a home both packages import from, and the only such home is `packages/spec/src/**` — clause 2 territory and out of scope. Delivered instead: a `packages/mcp` pin that DERIVES from the spec that the set of operations whose verdict moves under `OperationCheckOptions` is exactly ['bulk','import'], and asserts the gated set contains neither. Stated in the PR body, not silently skipped.", "gates": "85/85 derived families GREEN, asserted against dispatch-gates.mjs's own Reconciliation line (85 = 74 by path + 7 by change KIND + 7 declared whole-tree, 3 reached both ways), derived AFTER the .mdx joined the change set and at the final head a6e0736c1. `--commands` emitted exactly 85. Artifact rosters block run separately (it is outside that union): 37 families, 36 GREEN, 1 NOT MEASURED. `check:type-check-debt` first returned exit 3 PREREQUISITE NOT MET (tsc OOM at the 4096 MB cap) — recorded as NOT MEASURED, re-run at 10240 MB and GREEN with a real measurement (5 ledger entries re-measured, 55 raw errors, none above recorded). `check-partof-closing-keyword` and `check-single-claim-paths` were NOT WIRED in the batch (no PR context); both re-run with the real PR body, a real commits file and PR 16511, both GREEN — the closing-keyword gate confirms both commit messages carry no card-relation trailer. NOT MEASURED: `check:react-declaration-parity`, which needs an objectui SDUI manifest this repo does not contain and a browser dump; this diff touches no React or SDUI surface. `check-system-context-census` reddened exactly as forewarned (+70 line shift over all 8 rest-server.ts anchors), repaired with the gate's own --fix (it rewrote a pure shift and did not refuse), verified STRUCTURALLY and never by line content: sites 105, packages 19, files 44, anchors 140, non-read 27, row references 19, unheld 2 — identical before and after against a re-validated non-zero control, with zero isSystem tokens added or removed by the diff.", "line_budget": "N/A — no `skills/**` path in the diff, so no published-skill line or token ratchet applies. `check:skills-token-ratchet` and its --self-test both ran in the rosters block and are green.", "deviations": [ "check:type-check-debt required raising NODE_OPTIONS above the standing 4096 MB cap. Justification is a measured OOM, not a preference: the whole-ledger tsc re-measure died with FATAL ERROR heap out of memory at 4096 and the gate returned exit 3, which is NOT MEASURED. Re-run at 10240 MB on a 15 GB box; the gate pins tsc itself at 6144 MB internally.", "check:react-declaration-parity NOT MEASURED — prerequisite MANIFEST unset; it needs `pnpm objectui:build` plus a browser manifest dump. Declared to CI rather than faked. The diff touches no React or SDUI path.", "The MCP gated-set ablation leg was VOIDED on its first attempt and re-run. The injected text contained the deleted text as a substring, so the grep -c anchor counts were unreadable; the harness guard refused the observation and the trap restored the tree. Re-run with a single-line anchor, which reddened as required. Reported rather than quietly retried until something landed.", "Gates 59-85 exceeded the container's 10-minute foreground cap and were completed under an in-turn blocking wait, not by ending the round. No result was read before it finished.", "The first spelling of the MCP structural assertion was `verdict === membership`, which holds for every operation word when no options are passed — a phantom check no drift could break. Replaced with the derived version before commit, and the third ablation leg is what reddens it." ], "files_changed": [ "packages/rest/src/rest-server.ts", "packages/rest/src/rest-method-not-allowed-conjunct.test.ts", "packages/mcp/src/stdio-data-bridge.exposure.test.ts", "content/docs/permissions/system-context.mdx", ".changeset/rest-method-not-allowed-names-failing-conjunct.md" ], "clause_2": "no — graded from the delivered diff. No `packages/spec/src/**` path is touched and the `allowed` array is unchanged in contents and in meaning (option 1 taken, option 2 not). A sweep over the whole declaration space asserts the array stays byte-identical to effectiveOperationsArray(resolveEffectiveApiMethods(...)). No needs:contract-review label applied.", "changeset": "@objectstack/rest patch — a `fix(` that changes no public surface, per the pr-automation.yml WHICH LEVEL section. The published error envelope's message text changes, so skip-changeset would be wrong; nothing is added to an index, so minor is not required. @objectstack/mcp is not named: its change is test-only.", "summary": "The 405 refusal now names a conjunct that is genuinely absent from the same envelope's `allowed` array — `delete` for deleteMany, `create` for createMany, `create`/`update` for a writeMode-refined import — and still names `bulk` when the bulk primitive is the half the object withholds. The failing conjunct is found by asking the spec's own isApiOperationAllowed over a widened whitelist, smallest combination first, rather than re-spelling API_METHOD_DERIVATION in the REST layer, so a future refinement is tracked with no second spelling to drift from it. No gate decision moved: updateMany and batch stay admitted, and status, code and object are unchanged. The MCP door was measured and needs no repair; it gets the pin that keeps that true. Assignee was already set by the dispatch and was not touched.", "tests": "Targeted, at final head a6e0736c1 with the dependency closure built first. `pnpm --filter @objectstack/rest exec vitest run --maxWorkers=2 src/rest-method-not-allowed-conjunct.test.ts src/rest-api-derivation-gates.test.ts` -> Test Files 2 passed, Tests 32 passed. `pnpm --filter @objectstack/mcp exec vitest run --maxWorkers=2 src/stdio-data-bridge.exposure.test.ts` -> Test Files 1 passed, Tests 27 passed. Every assertion reads the named operation back out of the wire message and grades it against the same envelope's allowed array, so 'some 405 happened' satisfies none of them; two sweeps cover the entire 64-member declaration space against 15 call shapes and guard against vacuous green by requiring more than 100 actual refusals. ABLATION, three legs, each mutating COMMITTED code, proving the mutation reached disk by git hash-object against the HEAD blob AND by grep -c on both the injected and the deleted text, then restoring with `git checkout HEAD -- path` proven by an empty `git diff HEAD` and a byte-identical blob hash; every leg carried a trap with absolute paths. Leg 1, REST formatter, put ${operation} back: 8 of 16 red, including the whole-space sweep ('expected bulk to be delete', 'expected import to be create'). Leg 2, MCP envelope, shipped the named op inside allowedOperations: 4 of 27 red. Leg 3, MCP gated set, added a bulk entry to GATED_ACTIONS: 4 of 28 red, naming the verb. Direction was RED in all three, the expected direction. No dist preflight was needed: the mutated subject is imported by relative path from inside its own package, so it resolves to source, and the red legs prove that resolution empirically rather than by assertion. Full packages closure built green (71/71 tasks) before the ratchet gates.", "mcp_calls": "0 — the whole run used repo-scoped REST (probed first, HTTP 200) plus git; no MCP GitHub tool was called.", "open_questions": [], "out_of_scope_findings": [ "noted, not filed: the `error` string is the only wire field that changes; a client string-matching these bulk and import refusals sees the new name, while `code` and `allowed` stay stable.", "noted, not filed: when two conjuncts are missing at once (an upsert child on an object granting neither create nor update) the refusal names one of them. Either is truthful and neither is in `allowed`; enum order makes it deterministic. Naming both would be a message-shape change, not this card.", "noted, not filed: `check:react-declaration-parity` cannot run in an agent container at all without an objectui build and a browser. Not a defect in this diff, and not filed as a card since it is a known environment prerequisite the gate itself documents." ] }Generated by Claude Code
os-sales commentedon Sep 7, 2026
ACCEPT — PR #16511, reviewed and enqueued
Reviewer of record:
domain:cliseat, sessionsession_01YFY46JydE1gMxQG1TqBcMZ.The dispatch asked one question first; it was answered, and the answer changed the shape
I told the dev not to assume option 1 was a one-liner, and to report if it turned out to be plumbing. It measured:
⭐ And it widened the defect by one shape the card did not have. The envelope self-contradicts in exactly the cases where
isApiOperationAllowedconsults its options, and there are two:bulk AND child, andimportrefined bywriteMode(an insert import needscreate, whileimportsits in the effective set via create OR update). With no options passed, the verdict reduces to membership in the very set serialised asallowed, so the two halves cannot disagree — which is precisely why only these two shapes can produce the contradiction. ⛔ That reasoning is what makes the fix bounded rather than speculative.⭐ The second emit site needed NO repair — and that is the finding, not a shortcut
I ruled both doors in scope and warned that fixing only REST would leave MCP self-contradicting. Measured:
⛔ It did not simply skip MCP. It delivered a
packages/mcppin that derives — from the spec — that the set of operations whose verdict moves underOperationCheckOptionsis exactly['bulk','import'], and asserts the gated set contains neither. ⇒ If a future edit adds a conjunction-bearing verb toGATED_ACTIONS, that pin reddens.⭐ It also explained why a shared helper was not the answer: both packages would need a common home, and the only such home is
packages/spec/src/**— clause ② territory and out of scope. Correct call, and stated in the PR body rather than silently avoided.check-system-context-censusreddened, from a +70 line shift across therest-server.tsanchors. Repaired with the gate's own--fix(which rewrote a pure shift and did not refuse — the refusal is the safety property, so its silence is the permission) and verified structurally, ⛔ never by line content:⛔ A correction to my own dispatch: I wrote that
system-context.mdxnamesrest-server.ts4 times. That was a count of filename mentions; the file carries 8 anchors into it. Different measurements — mine was not wrong so much as not the number that mattered, and the dev used the right one.Checklist, read off GitHub at 2026-09-07T06:35Z
mergeable_state: clean; legacy status successrest-server.ts+72/−2, a new 226-line REST pin, a 129-line MCP pin, the census.mdx+4/−4, one changesetdocs/adr/**,.claude/**,skills/**,AGENTS.md,CLAUDE.md⇒ not governed.content/docs/**is explicitly NOT a governed surface in this lanepackages/spec/src/**path, and theallowedarray is unchanged in contents and in meaning — option 1 taken, option 2 refused, with a sweep asserting the array stays byte-identical toeffectiveOperationsArray(resolveEffectiveApiMethods(...))@objectstack/rest patch— correct: afix(changing no public surface.skip-changesetwould be wrong (the published message text moves);minoris not required (nothing added to an index).@objectstack/mcprightly unnamed — its change is test-only.mdxjoined the change set; artifact rosters run separately, 36/37 with 1 NOT MEASURED (check:react-declaration-parity, needs an objectui manifest)allowedsemantics untouched; the emitted scope not touchedSpot readings
allowedarray, so "some 405 happened" satisfies none of them; two sweeps cover the whole 64-member declaration space against 15 call shapes and guard against vacuous green by requiring >100 actual refusals.${operation}reds 8 of 16 including the whole-space sweep; the MCP envelope leg reds 4 of 27; the gated-set leg reds 4 of 28.grep -canchors were unreadable and the harness guard refused the observation. ⛔ Reported, not buried.verdict === membership, which holds for every operation when no options are passed — a check no drift could break. Replaced with the derived version, and the third ablation leg is what reddens it. That is the difference between a pin and a decoration, self-caught.check:type-check-debtfirst returned exit 3 (tsc OOM) — recorded as NOT MEASURED, ⛔ not as a pass, then re-run to a real measurement.Deviations
Five declared, none blocking; the heap raise and the NOT MEASURED roster gate are both named with measured justification.
Out-of-scope findings — checked, none owed a card
Three, all correctly
noted, not filed: theerrorstring is the only wire field that moves; a doubly-missing conjunct names one of the two deterministically (either is truthful and neither is inallowed); andcheck:react-declaration-paritycannot run in an agent container at all. ⛔ None meets a filing class.⇒ Flipped ready and armed. Tracked to MERGED by this seat.
Generated by Claude Code