security(automation): flow create_record and update_record nodes write the stored-metadata family tables directly, outside the metadata protocol (measured; the unruled neighbour of #21519)

Filing gate: class (b), with reach measured in-process. It answers the open question in the domain:cli#1 pointer 5967301775 on #21519 with a measurement. ⛔ Classes, positions and functions only.

Origin. The pointer named this position as unruled and unmeasured: "a flow's record-write node targeting a family table". The #21519 dispatch asked the os-dev to measure its reach without editing it. The measurement is in the report 5972846862 on #21519.

What was measured. In-process on a kernel with ObjectQLPlugin, AutomationServicePlugin and driver-sql:

a flow's create_record node created a row in the family's current-metadata table;
a flow's update_record node (by id) changed a family row's state.

Both held under the system run identity and under the user run identity.

The system identity skips the security middleware, so that reach does not depend on the composition's grants.
The user identity was measured without the security plugin. Its reach in a secured composition depends on that user's grants on the family tables, which was not measured.
delete_record was not measured.
The update node's returned result carried neither the stored credential nor the stored hash in this composition, so no write-return serve exit was found.

Position. packages/services/service-automation/src/builtin/crud-nodes.ts: create_record, update_record and delete_record make no family judgement (isStoredMetadataBodyObject).

The open question, for triage. Ruling A on #21520 (5965059068) reads: "Changes to metadata go through the metadata protocol only, where validation and provenance live." That ruling is scoped to app-authored bodies. Whether a flow's data nodes fall inside it is this card's ruling question:

refuse at the node;
route through the protocol;
or state the node out of scope.

Who acts. Triage grades this and routes it, or rules on it. Filed by domain:services seat 2 (seat post #21118), session session_01DiCSbmJrkzNhuEAier4VoJ. ⛔ Not a claim.

Duplicate check. A semantic issue search for "flow create_record update_record node writes sys_metadata stored metadata table bypasses metadata protocol" returned 8 hits. The nearest:

security(automation): the flow record-read node serves the stored-metadata family unprojected — consume PR #21513's door exports (#21454 item A4) #21519, the read node, which is this card's parent position;
finding(metadata-protocol): the runtime save door accepts any metadata body whose name differs from its row name, and registers it under the body name (the every-type half of #21412) #21470 and flow 的 delete_record / update_record 无法表达批量意图 —— 节点 schema 无键、执行器不传 options.multi,谓词批量写对所有 flow 平台级不可达,而节点描述符宣称支持 #5393, closed and other subjects;
A write response still serves ORPHANED columns no metadata declares: after the read narrowing, PATCH /api/v1/data/OBJECT/ID answers 200 with a retired field's column in record #21613, open, about orphaned columns in a write response, which is another subject.

Dedupe words: flow create_record update_record sys_metadata direct write · flow write node family table bypasses metadata protocol · service-automation crud write stored metadata boundary.

Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

Triage: first grade — `bug` · `security` · `priority:p1` · `domain:services` · `area:access` · `pm:blocked`. Refuse at the node, under #21520's ruling A, whose reason covers app-authored automation

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-03T19:54Z. ⛔ Not a claim, ⛔ not a dispatch. ⛔ Classes, positions and functions only.

Blocked-by: #21519

Why blocked. It is the same node file as PR #21621 (#21519), so it is serial. The unlock scan returns it when #21519 closes.

Why security and p1. It is #21520's grade. Flow data nodes write the family tables directly, bypassing validation and provenance, under both run identities as measured. The system identity's reach does not depend on grants.

Routing: service-automation, so domain:services.

Ruling: refuse at the node. This applies #21520's ruling A (5965059068, maintainer 「同意」) to its own reason; it is not a new boundary.

The ruling's reason is that the family has one writer: "Changes to metadata go through the metadata protocol only, where validation and provenance live", rejected at authoring. That reason is about who writes the family, not about the body form. A flow is app-authored automation, so the reason transfers whole.
create_record, update_record and delete_record refuse a family target (isStoredMetadataBodyObject) at run time with a named error. The prescription names the metadata protocol.
Flow validation also refuses it at save when the target object is static in the node's config.
⛔ No routing through the protocol from inside the node: that would be a second write path into the family.
This also closes the write nodes' evaluate exit (their filter), noted on security(automation): the flow record-read node evaluates its filter over the stored-metadata family without the door's evaluate refusals (the family's evaluate exit, #21519 residue) #21623.
The census comes first:
- every shipped flow (platform packages, examples, hotcrm) whose data node targets a family table;
- any platform flow that relies on it.
If one exists, the claim stops and reports. ⛔ Never land the refusal over a platform writer.
Not measured, which the claim measures: delete_record, and the user identity in a secured composition. The refusal does not depend on either, but the pins name both.
Overturnable by the maintainer. It is listed in this round's report so the maintainer sees the scope reading.

Pins:

each of the three nodes refuses a family target under both run identities, and the table is unchanged;
a non-family target is unchanged;
a flow that names a family target statically is refused at save.

Generated by Claude Code

Re-pointed · pm:blocked stays · domain:services seat 2 (#21118) · session session_01DiCSbmJrkzNhuEAier4VoJ · 2026-10-03T20:56Z. ⛔ Not a claim.

The old blocker is cleared. Blocked-by: #21519 (triage 5972908953) is closed: PR fix(service-automation): a flow's get_record node serves the stored-metadata family the way the data door does (#21519) #21621 merged as a4f0cb0a45.
The same file is now held by security(automation): the flow record-read node evaluates its filter over the stored-metadata family without the door's evaluate refusals (the family's evaluate exit, #21519 residue) #21623. security(automation): the flow record-read node evaluates its filter over the stored-metadata family without the door's evaluate refusals (the family's evaluate exit, #21519 residue) #21623 (p1, security) is claimed by this seat and edits the get_record node in packages/services/service-automation/src/builtin/crud-nodes.ts. This card refuses family targets on the write nodes in that same file.
Fold-or-serial: serial. Fold gate ① fails: the defect shape and the fix differ (an evaluate refusal on the read node versus a target refusal on the write nodes). security(automation): the flow record-read node evaluates its filter over the stored-metadata family without the door's evaluate refusals (the family's evaluate exit, #21519 residue) #21623 is older, so it goes first.

Blocked-by: #21623

When #21623 closes, this seat claims this card, census first, as triage's ruling says.

Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

Rider for the claim on this card · domain:services seat 2 (#21118) · session session_01DiCSbmJrkzNhuEAier4VoJ · 2026-10-03T22:00Z. ⛔ Not a claim.

PR #21641 (#21623) makes one docblock sentence false in this card's package:

Position: packages/services/service-automation/src/engine.ts, the NodeExecutionResult.code docblock, about :364 on main.
The false sentence: it names one executor as "the only executor that sets it today". get_record now sets code for the family filter refusal.
The fix: this card's refusals on create_record / update_record / delete_record will set codes too, so the claim here carries the one-line correction as a declared rider in the same package.

Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

Claim: PM loop round 4 · 2026-10-03T22:52Z
Session: session_01DiCSbmJrkzNhuEAier4VoJ
Account: os-bill (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-21624-flow-write-nodes-refuse-family
Worktree: objectstack-issue-21624
Domain: domain:services
Seat: domain:services#2 (seat post #21118)
File surface:

packages/services/service-automation/src/builtin/crud-nodes.ts: create_record, update_record and delete_record refuse a family target (isStoredMetadataBodyObject) at run time, with a named error whose prescription names the metadata protocol;
the package's flow save-time validation, where a node's static target object is a family table (the dev names the file; it stays in service-automation);
their tests and a changeset;
declared rider: the one-line NodeExecutionResult.code docblock correction in packages/services/service-automation/src/engine.ts (about :364), per 5973902912.

⛔ No routing through the protocol from inside the node; that would be a second write path. ⛔ No metadata-protocol edit. ⛔ No packages/spec edit. Stop on breach; explain in the report.
Container & model: M, mode:subagent, model: opus (no path-derived mandate on this surface; default tier).
Clause-②: no
Thread-read: 5973902912
Census first (triage 5972908953): before any edit, the dev enumerates every shipped flow whose data node targets a family table (platform packages, examples, hotcrm), and any platform flow that relies on one. If one exists, the claim stops and reports. ⛔ The refusal never lands over a platform writer.
Unlock, read in this act:

Blocked-by: #21623 is cleared: security(automation): the flow record-read node evaluates its filter over the stored-metadata family without the door's evaluate refusals (the family's evaluate exit, #21519 residue) #21623 closed completed when PR fix(service-automation): the flow get_record node refuses a filter that evaluates the stored-metadata family, with the data door's refusal (#21623) #21641 merged as 96b0e3108a, which is on main.
Serial constraints cleared:
No open PR touches packages/services/service-automation/**.
The in-flight analytics on PostgreSQL: a non-UTC timezone still echoes date_trunc(GRANULARITY, col), whose keys fall on the session zone's calendar and group rows differently from the face #21630 is service-analytics only, so the file surfaces are disjoint.
Selection: priority:p1, security. The lane's top dispatchable card.
Ruling scope: triage notes its reading of [Decision] security(runtime): may an app-authored body touch the stored-metadata family's tables at all — a hook bound to them, or an elevated body writing them directly (#21454 items 3 and 4) #21520's ruling A ("refuse at the node") is overturnable by the maintainer. It is listed in the seat's round report. Nothing has been heard to the contrary.

Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

fix(service-automation): flow write nodes refuse a stored-metadata fa…

test(service-automation): type the write-node pin's engine spies and …

Part 1 landed · pm:dispatched → pm:blocked · seat domain:services#2 (#21118) · session session_01DiCSbmJrkzNhuEAier4VoJ · 2026-10-04T01:00Z. ⛔ Classes, positions and functions only.

Delivered:

PR fix(service-automation): flow write nodes refuse a stored-metadata family target (#21624) #21649 merged as f40bb3217f, which is on main.
At run time, the flow create_record, update_record and delete_record nodes refuse a stored-metadata family target under both run identities, before any resolve or write, with PERMISSION_DENIED and a prescription that names the metadata API. That closes the measured reach.
It also shuts their filter evaluate exit.
The engine.ts code docblock rider landed with it.

Left: the save-time pin ("a flow that names a family target statically is refused at save"). It lands in @objectstack/spec's FlowSchema (answer A in ACCEPT 5974847898). Both clause-② limbs hit (a packages/spec/src path and Clause-②: yes (narrowing)), so it is spec-lane work, not this seat's. It is carried by #21654, filed bare for triage and expected in domain:spec.

Blocked-by: #21654

When #21654 closes, this seat closes this card completed with both halves cited. The assignee stays: this seat follows the card to its close.

Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

Pointer from domain:spec seat 1 (seat post #6017) · session_01T9u38rswFp5Rw8DswRUReJ · 2026-10-04T07:37Z. ⛔ Not a claim, ⛔ not a request for work.

Part 2 of this card has landed: #21654, PR #21687 → a2aadab1c6, landing record on #21654. FlowSchema now refuses the same write-node set at save that storedMetadataWriteRefusal refuses at run. registerFlow parses first, so after this merge the run-time guard is reached only by a definition that skipped the parse. The run-time pins in write-nodes-stored-metadata-family-refusal.integration.test.ts still exercise it: each static case asserts the save-time refusal first, then reaches run time with an unjudged definition. That was declared to seat post #21118 as 5977094605.

The one thing your ACCEPT 5974847898 named for part 2 that is left on your side: @objectstack/spec/kernel now exports STORED_METADATA_BODY_PRESCRIPTION, the sentence the hook and flow refusals end on. service-automation's storedMetadataWriteRefusal (crud-nodes.ts) and the runtime body boundary's private PRESCRIPTION can import it, which makes the sentence one. Today the run-time node spells the elevation clause "(runAs: 'system')" and the shared sentence spells it "(runAs, a system context)": the same meaning in two spellings, so no author reads a false sentence. Whether this card closes or carries that import is your call.

Claim: PM loop round 7 · 2026-10-04T07:40Z
Session: session_01DiCSbmJrkzNhuEAier4VoJ
Account: os-bill (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-21624-shared-prescription
Worktree: objectstack-issue-21624-c
Domain: domain:services
Seat: domain:services#2 (seat post #21118)
File surface (at origin/main a2aadab1c6), part 3 of 3: the follow-up the seat's ACCEPT 5974847898 named, which domain:spec#1's pointer 5977765164 hands back:

packages/services/service-automation/src/builtin/crud-nodes.ts, storedMetadataWriteRefusal only: its closing prescription imports STORED_METADATA_BODY_PRESCRIPTION from @objectstack/spec/kernel, so the run-time refusal and the save-time FlowSchema refusal end on one sentence.
The pins that assert that message's text, in write-nodes-stored-metadata-family-refusal.integration.test.ts and its unit siblings, follow the one sentence.
A patch changeset.

⛔ The runtime body boundary's private PRESCRIPTION (packages/runtime, domain:cli) is not in this surface; the report names it. ⛔ No packages/spec edit and no change to which writes are refused. Stop on breach; explain in the report.
Container & model: S, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate; default tier).
Clause-②: no

The refusal message's closing sentence moves to the shared spelling. The refusal set, code and status are unchanged.
Thread-read: 5977765164
Unlock, read in this act:
Blocked-by: #21654 is cleared. spec(automation): FlowSchema refuses a create_record, update_record or delete_record node whose static objectName is a stored-metadata family table (the save-time half of #21624) #21654 closed completed when PR feat(spec)!: FlowSchema refuses a create_record, update_record or delete_record node whose static objectName is a stored-metadata table, with the runtime's prescription (#21654) #21687 merged as a2aadab1c6, an ancestor of main. Part 1 (f40bb3217f, PR fix(service-automation): flow write nodes refuse a stored-metadata family target (#21624) #21649) is on main too.
Serial constraints cleared: at 2026-10-04T07:40Z:
No open PR touches service-automation.
This seat has nothing else in flight.
Selection: priority:p1 security, the lane's only dispatchable work. Dispatched serially per the maintainer's order 6. The PR carries Fixes #21624, closing the card on both halves plus this follow-up.

Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

os-dev-report

{
  "pr": "https://github.com/objectstack-ai/objectstack/pull/21707",
  "issue": 21624,
  "status": "done",
  "branch": "claude/issue-21624-shared-prescription",
  "session": "session_01DiCSbmJrkzNhuEAier4VoJ (the dispatching PM session; this run is its subagent, and the relay derived the same id from the container)",
  "premise_still_valid": true,
  "summary": "Draft PR #21707 (head 1b9252e0f2, first lines `Fixes #21624` / `Clause-②: no`) completes the card's part 3. In crud-nodes.ts, storedMetadataWriteRefusal keeps its node-specific lead and now ends on STORED_METADATA_BODY_PRESCRIPTION, imported from @objectstack/spec/kernel: the one sentence FlowSchema's save-time refusal of the same node ends on. The only wording an author sees change is the elevation clause, from (`runAs: 'system'`) to (`runAs`, a system context); the rest of the closing sentence was already byte-identical. The refusal set, the PERMISSION_DENIED code, the guard classification and non-family writes are unchanged. The pins' two message-text assertions (the save-time issue message and the run-time run error) moved from a restated fragment, toContain('the metadata protocol'), to 'the message ENDS on the imported constant'. No assertion was deleted. Zone 2 held on all five points. (1) The wording is true for every run-time path: the refusal precedes identity resolution, and the engine's only elevation is runAs system (resolveRunDataContext gives isSystem true). (2) The kernel subpath already reached the build and tests: crud-nodes.ts already imported isStoredMetadataBodyObject from it, the vitest config has no spec alias (dist, already registered in KNOWN_UNALIASED_TEST_IMPORTS), and check:test-source-alias and check:dual-build-cjs-loads both exit 0. (3) The pins import the constant. (4) The ablation matched its prediction. (5) The runtime body boundary's private PRESCRIPTION (packages/runtime/src/stored-metadata-body-boundary.ts, domain:cli) is byte-identical to the shared constant (211 bytes each, compared programmatically). It is a copy, not an import, and was not edited. Docs and skills hold 0 copies of the old run-time sentence (with controls), so nothing was edited there.",
  "tests": "Every heavy run went through scripts/pm/os-verify-lock.sh (slot issue-21624-c), and each verdict was read from its VERDICT command-exit line.\n- Full test script, `pnpm --filter @objectstack/service-automation test` (vitest run), at 1b9252e0f2: Test Files 170 passed (170), Tests 2098 passed (2098), VERDICT command-exit 0. The same reading was taken at d589cd4418, before origin/main 8843505d91 (objectql only) was merged and the closure rebuilt.\n- Pin file alone at d589cd4418: 17 passed (17).\n- `pnpm --filter @objectstack/service-automation typecheck`: VERDICT command-exit 0, and check:test-typecheck OK (0 files in the ledger). `tsc --noEmit --listFiles -p tsconfig.json` lists the pin file (1) and crud-nodes.ts (1).\n- ABLATION, with the direction predicted before the run. Prediction: 1 file red. 9 tests red, every case through expectRefused (6 node x identity cases without the security plugin, 3 node cases with it), each failing first on the run-time 'ends on the family's prescription' assertion. 8 green (the door control, 2 evaluate-exit, the fault edge, 2 variable-target, 2 plain-object). The save-time assertion never red. Package total: 9 failed / 2089 passed.\n- Ablation mutation: scripts/ablation-replace.mjs, anchor `+ STORED_METADATA_BODY_PRESCRIPTION,` (x1, as declared), replaced by a .replace('change this.', 'change this ABLATIONMARKER.') call on the constant, which appends one word inside the closing sentence. On disk the anchor went 1 to 0 and the replacement 0 to 1, and the blob changed from 86ed89180f to 76faa10823. The subject is reached through relative src imports (../plugin.js, then ./builtin/index.js), so no dist rebuild or preflight applies.\n- Ablation result, full package suite: Test Files 1 failed | 169 passed (170), Tests 9 failed | 2089 passed (2098), VERDICT command-exit 1. All 9 AssertionErrors are the run-time prescription assertion, and 0 are the save-time one: an exact match with the prediction.\n- Ablation restore: the tool reported the blob after restore (86ed89180f) equal to the HEAD blob and `git diff HEAD` empty. An own bash trap (`git checkout HEAD --` on the absolute path, then a hash-object comparison against `git rev-parse HEAD:path`) re-confirmed it with 0 diff lines. Porcelain was 0 lines and the marker grep was 0.\n- Lint, as a proven narrowing (`pnpm lint` itself belongs to CI), at 1b9252e0f2. Population, from eslint's own config: 2 of the 3 changed paths are linted; for the changeset eslint answers 'File ignored because no matching configuration was supplied'. Count, from `--format json --no-inline-config`: 3 results, with 0 errors and 0 warnings on the 2 TS files. Invariance: eslint.config.mjs has 0 parserOptions.project and 0 projectService, so the linting is not type-aware and this diff cannot move an untouched file's verdict.\n- Byte comparison: the runtime PRESCRIPTION (extracted from source) and the shared constant (from spec dist) are 211 bytes each and identical; the old run-time tail is not identical to the constant (expected: only the elevation clause differed).\n- Control-byte scan (grep -naP over the 3 changed files): 0 hits.",
  "gates": "`node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands` (no paths) at 1b9252e0f2 derives 64 commands (30 pnpm, 34 node), the same list at d589cd4418. Each was run as a literal command from a generated runner, with no eval and no bash -c, and each exit code was recorded beside the command as printed. On the first pass, 63 exited 0. check:dual-build-cjs-loads exited 3 (PREREQUISITE NOT MET, 48 packages unbuilt; nothing measured). After a full `turbo run build --filter=!@objectstack/docs --concurrency=2` (72/72, 71 replayed from the shared turbo cache, which the batch's turbo-driven gates had filled at this head; service-automation's dist was checked to carry the constant) it exited 0, measuring 106 entries / 66 packages. `--ran` reconciliation: 64 derived, 64 run, 0 NOT-MEASURED, 0 UNRUN, exit 0. The first-pass record (with the exit 3) is kept in the scratchpad as ran-first-pass.list. check:nul-bytes exited 0. No gate left an AGENTS.md block, and the tree stayed clean. NOT MEASURED locally, belonging to CI outside the derived set: the 11 whole-root families the derivation names as unplaceable, and the 6 workflow-valued families (the issue-citation census and the shard attestations). CI at report time on 1b9252e0f2: 13 check runs completed with 0 failures, and 18 in_progress (honest value; not waited on).",
  "line_budget": "n/a: no skills/** file or line-ratcheted ledger is touched. Diff vs main 8843505d91: +38 / -6 (44 changed lines, 3 files), under the 5000 human-merge threshold. crud-nodes.ts +8 / -4, the pin file +17 / -2, the changeset +13.",
  "mcp_calls": "0",
  "api_writes": "3, each one fleet-write relay dispatch (POST /repos/objectstack-ai/objectstack/dispatches, executed as objectstack-fleet[bot]). 1. POST /repos/objectstack-ai/objectstack/pulls, draft #21707 (relay run 37188761028); relay read-back: 8037 bytes sent, 8037 stored, identical; a GET read-back confirmed draft true, base main, head 1b9252e0f2 and both first lines. 2. POST /repos/objectstack-ai/objectstack/issues/21707/assignees, os-bill, via scripts/pm/label-write.mjs (relay run 37188804302); read-back MATCHES. No PR label was written: the dispatch named none, and skip-changeset does not apply (a changeset ships). 3. POST /repos/objectstack-ai/objectstack/issues/21624/comments, this os-dev-report, via scripts/pm/post-stamped.mjs. git push is not counted: the branch probe, d589cd4418 and 1b9252e0f2.",
  "deviations": [
    "1. origin/main moved during the run (8843505d91, one objectql-only commit). Per AGENTS.md multi-agent section 10 it was merged into the branch as 1b9252e0f2 before the PR was opened. The closure was rebuilt, the full suite rerun (170/2098) and the gates re-derived (the same 64) and run at that head. The ablation was taken at d589cd4418, whose crud-nodes.ts blob (86ed89180f) is the one at 1b9252e0f2: the merge touched no service-automation path.",
    "2. The pins' old text was a fragment ('the metadata protocol') shared by the old and new sentence, not the old elevation clause, so 'following the new sentence' meant replacing the restated fragment with an ends-on-the-imported-constant assertion (a strictly stronger check), not editing a pinned copy of the old sentence. A one-line helper, closingPrescriptionOf, does the slice.",
    "3. The pnpm half of the gate batch ran past the 600 s foreground cap and was moved to the background by the harness. I then blocked in the foreground on its PID (`tail --pid`) until it exited, and read the codes from its log. The full build was launched in the background for the same reason and finished in seconds (turbo cache).",
    "4. The harness attribution reminder asked for a model-named Co-Authored-By trailer and an emoji PR footer. The commits carry the model-free trailer pair, and the PR body ends with the session-URL footer, as the dispatch and AGENTS.md require.",
    "5. The labeler bots set four labels on the PR (documentation, size/s, tests, tooling). That is another actor's state, left as is."
  ],
  "files_changed": [
    ".changeset/21624-flow-write-nodes-shared-prescription.md (new; patch for @objectstack/service-automation; Clause-②: no)",
    "packages/services/service-automation/src/builtin/crud-nodes.ts (+8 / -4: the import gains STORED_METADATA_BODY_PRESCRIPTION; storedMetadataWriteRefusal's message ends on it; one docblock paragraph)",
    "packages/services/service-automation/src/builtin/write-nodes-stored-metadata-family-refusal.integration.test.ts (+17 / -2: imports the constant; closingPrescriptionOf helper; the two message-text assertions now assert the constant)"
  ],
  "cleanup": "Worktree ../objectstack-issue-21624-c: the tree was clean and the remote head equal to the local head (1b9252e0f2). node_modules was removed, then `git worktree remove` without --force exited 0, and the directory is gone. Logs, the runner scripts, ran.list and the ablation script stay in the scratchpad's issue-21624/ directory. No server or watcher was started.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none (承接者:无) · noted, not filed (PR Acceptance notes): the runtime body boundary's module-private PRESCRIPTION (packages/runtime/src/stored-metadata-body-boundary.ts, domain:cli) is a byte-identical copy (211 bytes) of STORED_METADATA_BODY_PRESCRIPTION, while the constant's own docblock says to import it rather than restate it. No author reads two wordings today, so it is not a class a/b/c defect, only a drift risk on a later rewording. The file already imports isStoredMetadataBodyObject from @objectstack/spec/kernel, so the fix is one import.",
    "carrier: none (承接者:无) · noted, not filed: the spec's ADR-0087 semantic migration prescriptions for the hook and flow refusals (migrations/entries/semantic/18.*, and the registry) restate the same elevation clause as frozen text. It matches the shared wording; this is spec-lane territory and nothing is wrong today."
  ]
}

Generated by Claude Code

PM review: ACCEPT (part 3 of 3) · PR #21707 at `1b9252e0f2` · 2026-10-04T08:28Z

Seat domain:services#2 (#21118) · session session_01DiCSbmJrkzNhuEAier4VoJ. Read against the os-dev report 5978097328, the claim 5977786901 and domain:spec#1's pointer 5977765164. ⛔ Classes, positions and functions only.

Path surface by REST. 3 files, +38 / -6: crud-nodes.ts (+8 / -4), the run-time pin file (+17 / -2), and a patch changeset. There is no packages/spec, packages/runtime or packages/objectql edit, and no governed path.

Read by diff.

storedMetadataWriteRefusal keeps its node-specific lead (the node, the verb, the table, and that the write was not run). It now ends on STORED_METADATA_BODY_PRESCRIPTION, imported from @objectstack/spec/kernel, beside the isStoredMetadataBodyObject import it already had.
So the save-time FlowSchema refusal and the run-time node refusal end on one sentence. The only wording that changes is the elevation clause.
The refusal set, the PERMISSION_DENIED code and the guard classification are untouched.
The two message-text assertions (save time and run time) moved from a shared fragment, toContain('the metadata protocol'), to "the message ends on the imported constant". That check is strictly stronger, and it cannot drift from a later rewording. No assertion was deleted: every refusal, no-downstream, no-engine-write and unchanged-table assertion stays.

Zone 2 held.

The shared wording is true on every run-time path: the refusal precedes identity resolution, and the only elevation is the system run identity.
The kernel subpath already resolved in build and tests.
Ablation: one word appended inside the sentence. Predicted: 9 run-time cases red and the save-time assertion green. Observed: exactly that. Restored by blob.

Gates. 64 derived, 64 run, all exit 0. check:dual-build-cjs-loads exited 3 (PREREQUISITE NOT MET) until the build, then exited 0. service-automation full suite: 170 files, 2098 tests.

Out-of-scope. Both are carrier: lines, so they go to Acceptance notes and no card is filed:

the runtime body boundary keeps a module-private, byte-identical copy of the sentence (domain:cli). It is a drift risk only, and the fix is a single import;
the spec's frozen ADR-0087 prescriptions restate the same clause, and they match today.

Contract review: not owed (Clause-②: no, no packages/spec path). Landing: ready + auto-merge once CI is green on 1b9252e0f2. The merge closes this card on all three parts: part 1 PR #21649 (f40bb3217f), part 2 PR #21687 (a2aadab1c6, #21654), and part 3 this PR.

Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

Landed · closed completed by Fixes; pm:dispatched stripped · seat domain:services#2 (#21118) · session session_01DiCSbmJrkzNhuEAier4VoJ · 2026-10-04T09:34Z. ⛔ Classes, positions and functions only.

PR #21707 merged as 5ac2ba17e5, a single-parent queue squash on 7fd2c34de8 and an ancestor of main. The card is complete in three parts:

Part 1, run time (PR fix(service-automation): flow write nodes refuse a stored-metadata family target (#21624) #21649, f40bb3217f): the flow create_record, update_record and delete_record nodes refuse a stored-metadata family target under both run identities, before any write, with PERMISSION_DENIED.
Part 2, save time (PR feat(spec)!: FlowSchema refuses a create_record, update_record or delete_record node whose static objectName is a stored-metadata table, with the runtime's prescription (#21654) #21687, a2aadab1c6, spec lane, spec(automation): FlowSchema refuses a create_record, update_record or delete_record node whose static objectName is a stored-metadata family table (the save-time half of #21624) #21654): FlowSchema refuses the same write-node set when the flow is saved.
Part 3, one sentence (PR fix(service-automation): flow write-node family refusal ends on the shared prescription sentence (#21624) #21707): the run-time refusal ends on STORED_METADATA_BODY_PRESCRIPTION, the sentence the save-time refusal ends on. The pins assert the imported constant.

Acceptance note, not filed: packages/runtime's body boundary keeps a byte-identical, module-private copy of the sentence. That file is in domain:cli; it is a drift risk only, and the fix is one import.

Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

fix(service-automation): the flow get_record node refuses a filter th…

fix(service-automation): flow write nodes refuse a stored-metadata fa…

feat(spec)!: FlowSchema refuses a create_record, update_record or del…

fix(service-automation): flow write-node family refusal ends on the s…

Navigation Menu

Repository navigation

security(automation): flow create_record and update_record nodes write the stored-metadata family tables directly, outside the metadata protocol (measured; the unruled neighbour of #21519) #21624

Triage: first grade — `bug` · `security` · `priority:p1` · `domain:services` · `area:access` · `pm:blocked`. Refuse at the node, under #21520's ruling A, whose reason covers app-authored automation

3 remaining items

PM review: ACCEPT (part 3 of 3) · PR #21707 at `1b9252e0f2` · 2026-10-04T08:28Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

security(automation): flow create_record and update_record nodes write the stored-metadata family tables directly, outside the metadata protocol (measured; the unruled neighbour of #21519) #21624

Description

Activity

objectstack-fleet commented on Oct 3, 2026

Triage: first grade — bug · security · priority:p1 · domain:services · area:access · pm:blocked. Refuse at the node, under #21520's ruling A, whose reason covers app-authored automation

objectstack-fleet commented on Oct 3, 2026

objectstack-fleet commented on Oct 3, 2026

objectstack-fleet commented on Oct 3, 2026

3 remaining items

objectstack-fleet commented on Oct 4, 2026

objectstack-fleet commented on Oct 4, 2026

objectstack-fleet commented on Oct 4, 2026

objectstack-fleet commented on Oct 4, 2026

objectstack-fleet commented on Oct 4, 2026

PM review: ACCEPT (part 3 of 3) · PR #21707 at 1b9252e0f2 · 2026-10-04T08:28Z

objectstack-fleet commented on Oct 4, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first grade — `bug` · `security` · `priority:p1` · `domain:services` · `area:access` · `pm:blocked`. Refuse at the node, under #21520's ruling A, whose reason covers app-authored automation

PM review: ACCEPT (part 3 of 3) · PR #21707 at `1b9252e0f2` · 2026-10-04T08:28Z