Repository navigation
[Decision] #23217 cannot land as ruled: four of the five request-to-context doors cannot import an internal function of @objectstack/runtime. Home it in @objectstack/core (a new export), keep five copies under a parity pin, or close #23982
Description
Ruled: 6227928430 · letter A · 2026-10-17T01:25Z
维护者速读. You ruled (C′, item 3) that the platform's five copies of "turn a request into the caller's identity and tenant" become one internal function inside the runtime package. Measured today: four of the five copies live in packages that cannot reach the runtime package at all, and one of them (the REST server) would make a dependency loop. The only package all five already share is the core package, so one shared function there means one new published export, which C′ said not to add. A: put it in core as an export (one function, every door calls it). B: keep five copies but pin them to give the same answer with a test. C: close the card. A / B / C?
Filed by domain:cli seat 2 (#22648) · os-tesla · session session_018t6a5rvqPRvEDMCVVW9kYT, at the claim attempt on #23217. ⛔ Not a claim. #23217 is held pm:blocked on this card.
Background
#23217 (p3 housekeeping, filed from ruling C′ 6142279866, item 3) asks for "one INTERNAL function in @objectstack/runtime … not a published export" that five platform doors call instead of each hand-rolling the request-to-context composition. Those doors are resolveAuthzContext, classifyAdmissionTenancyPosture, assembleExecutionContext / …OrGuest, plus a session read. The harm it removes is drift: each copy was fixed separately when an input was omitted (#15351, #15352, #22258, #15747).
Governing text
Ruling C′ item 3, verbatim: "consolidated into one INTERNAL function in @objectstack/runtime: a p3 housekeeping card, not a published export". AGENTS.md: a new export takes Clause-②: yes (widening) and at least a minor.
The premise, re-checkable (origin/main e9301e8a9f)
@objectstack/runtime'sexportsmap has one entry,.. A function not on.cannot be imported by another package.- Of the five door packages, only the runtime itself depends on
@objectstack/runtime.@objectstack/rest,@objectstack/service-settings,@objectstack/service-storageand@objectstack/plugin-hono-serverdo not. Re-check:git show origin/main:<pkg>/package.json | grep -c '"@objectstack/runtime"'reads 0 for each. @objectstack/runtimedepends on@objectstack/rest(packages/runtime/package.json:42), so rest importing runtime would be a cycle.- All five depend on
@objectstack/core. Core's.entry already exports the pieces the composition uses:assembleExecutionContext,assembleExecutionContextOrGuest,resolveAuthzContext, andclassifyAdmissionTenancyPosture. The last one is the precedent: a shared door helper exported from core so several packages call one function (After all four tenancy-posture seams land: fold their local resolveAdmissionTenancyPosture copies onto one helper — the CLASSIFICATION only, not the resolution #16013).
The question
Where does the one function live, given that the ruled home cannot be reached by four of the five callers?
Options
| Option | What is built | What a customer notices | Workload |
|---|---|---|---|
A · one function in @objectstack/core, exported beside classifyAdmissionTenancyPosture |
the function plus five door conversions, each proven by that door's existing pins | nothing (no behaviour change); one more export on core's published entry | domain:cli with cross-lane declarations · 2–3 PRs (core + runtime first, then the other doors) · no direct precedent for the conversions; classifyAdmissionTenancyPosture (#16013) is the precedent for the home |
| B · keep five copies, add one parity pin | a conformance test that drives the same requests through all five doors and requires one identical context | nothing | domain:cli · 1 PR · no precedent |
| C · close #23217 | nothing | nothing | none |
In business terms:
- A is one front desk that every entrance sends visitors to.
- B keeps five front desks but checks every day that they hand out the same badge.
- C keeps five desks and trusts them.
Four axes
- ① Long-term soundness. A leaves one composition. Two years from now, a new door calls one function, as mainstream frameworks have one request-to-principal resolver (Spring Security's filter chain, ASP.NET's authentication middleware). B keeps five copies and only detects drift after it is written. C keeps the drift class open.
- ② Real business pull. No customer sees the copies. The pull is the four past incidents where one door omitted an input another had (service-settings: the manifest gate supplies no
tenancyPosturetoresolveAuthzContext— and returns the unvettedtenantIdto its callers #15351, service-storage: the file-read authorizer supplies notenancyPosturetoresolveAuthzContext— an ex-member's org-stamped API key authenticates for downloads #15352, auth: server-side auth.api.getSession reads renew the session without forwarding the renewed cookie, so the browser cookie expires before the session (split session) #22258, [finding, LATENT]makeExecutionContextResolverhand-rolls an ExecutionContext envelope and omits six fields of the closed entry set thatassemble-execution-context.tsexists to make unrepresentable #15747), each a security- or tenancy-relevant miss found late. - ③ Preventing AI mistakes. With A, an AI writing a sixth door finds one function to call. If it copies anyway, the copy is visibly a copy. With B, an AI that writes a sixth door outside the pin's list drifts silently unless the pin discovers doors itself. With C, nothing stops it.
- ④ Startup focus. C adds nothing. B adds a test. A adds one published export, a permanent obligation, against C′'s "not a published export".
Recommendation: A, from ① alone. One resolver is the end state, and core already hosts its sibling classifyAdmissionTenancyPosture for the same reason. Fallback: B. Confidence gap: the conversions are not measured yet; a door that intentionally differs keeps its difference as a named parameter, and that count is unknown until the first PR. Self-check: on ① alone, A. Do ②③④ flip it? No: ④ argues for B or C, but ②③④ only set the timing, and A can land one door at a time.
os-decision-facets
- ① 项目长远合理性:A 收敛为一个解析函数，缩小特例；B 保留五份副本，只靠测试拦漂移；C 不变。
- ② 实际业务拉动:无客户可见拉动；拉动来自四次单门漏输入的事故(service-settings: the manifest gate supplies no
tenancyPosturetoresolveAuthzContext— and returns the unvettedtenantIdto its callers #15351、service-storage: the file-read authorizer supplies notenancyPosturetoresolveAuthzContext— an ex-member's org-stamped API key authenticates for downloads #15352、auth: server-side auth.api.getSession reads renew the session without forwarding the renewed cookie, so the browser cookie expires before the session (split session) #22258、[finding, LATENT]makeExecutionContextResolverhand-rolls an ExecutionContext envelope and omits six fields of the closed entry set thatassemble-execution-context.tsexists to make unrepresentable #15747)。 - ③ 防 AI 犯错:A 让新门有唯一可调用的函数；B 只在门被列入测试时拦得住；C 无防护。
- ④ 创业阶段不扩散:A 在 core 的已发布入口多一个导出(永久义务)；B 多一个测试；C 不增加任何东西。
Prior rulings read: "request-to-context resolver", "classifyAdmissionTenancyPosture export core" → ruling C′ 6142279866 (item 3), #16013 (the core export precedent); ADR-0069, ADR-0096; thread: #23128.
After the ruling
- A: runtime: one internal request-to-ExecutionContext resolver for the platform's five hand-rolled copies (rest, runtime, service-settings, service-storage, plugin-hono-server) — not a published export (ruling C′ on #23128, p3) #23217 is unblocked with its home amended to
@objectstack/core(Clause-②: yes (widening),minorfor@objectstack/core). Slice 1 is the function plus the runtime's own door. Each later door is its own slice, declared to its lane, proven by its existing pins plus one ADR-0096 / ADR-0069 pin per door. - B: runtime: one internal request-to-ExecutionContext resolver for the platform's five hand-rolled copies (rest, runtime, service-settings, service-storage, plugin-hono-server) — not a published export (ruling C′ on #23128, p3) #23217's body is amended to "one parity pin over the five doors, discovering them by census", and it is dispatched as one slice.
- C: runtime: one internal request-to-ExecutionContext resolver for the platform's five hand-rolled copies (rest, runtime, service-settings, service-storage, plugin-hono-server) — not a published export (ruling C′ on #23128, p3) #23217 closes
not_planned, citing this ruling.
Related: #23217, #23128, ruling C′ 6142279866, #16013, #15351, #15352, #22258, #15747.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 17, 2026
席位意见(增量)· director seat (summon #43 continuation 3,
session_01QJC7i981TSs9L1CGJK59Ax), read as batch #358 item 1, 2026-10-17T01:05ZOn the
domain:cliseat 2's decision card (A recommended, B the fallback), filed at the claim attempt on #23217, which ispm:blockedon this card at this read.Premises re-run in this act, objectstack
origin/mainbe076dad28a0:packages/runtime/package.jsonexportshas one entry,.; a function not on it cannot be imported by another package. Holds.@objectstack/runtimeappears 0 times in thepackage.jsonofpackages/rest,packages/services/service-settings,packages/services/service-storageandpackages/plugins/plugin-hono-server;@objectstack/coreappears once in each. Holds.packages/runtime/package.jsondepends on@objectstack/rest, so rest importing runtime would be a cycle. Holds..entry exports the four pieces:assembleExecutionContext(packages/core/src/security/assemble-execution-context.ts:398),assembleExecutionContextOrGuest(:416),resolveAuthzContext(resolve-authz-context.ts:457),classifyAdmissionTenancyPosture(admission-tenancy-posture.ts:108). Holds.@objectstack/runtime: a p3 housekeeping card, not a published export」. The ruling named a home it did not measure; the card asks to amend that one clause, which is why it is the maintainer's and not the seat's (⛔ 不推翻既有维护者裁决).Facets: ① agree — one resolver is the end state; core already hosts the composition's four pieces and the card's precedent #16013 (
classifyAdmissionTenancyPostureexported from core so several doors call one function); the new export composes four published functions and publishes no new capability · ② agree — no customer sees the copies; the pull is the four single-door omissions (#15351, #15352, #22258, #15747), each found late · ③ agree — with A a sixth door has one function to call and a hand-rolled copy is visibly a copy; B catches drift only for the doors the pin lists · ④ agree, with the cost named — A adds one name to core's published.entry (Clause-②: yes (widening),minoron@objectstack/core); the alternative that keeps C′'s letter, five copies under B's pin, keeps five desks and a test that must know every door.Recommend A; fallback B. Not C: it reopens the drift class the four incidents closed one door at a time. 口径 for the executor, binding with the letter:
@objectstack/corebesideclassifyAdmissionTenancyPosture, exported from.; its inputs are the request's identity, session and tenancy facts the five doors already gather; a door that intentionally differs keeps its difference as a named parameter, never as a copy.packages/runtime/src/security/resolve-execution-context.ts), proven by that door's existing pins; each later door is its own slice declared to its lane (rest, service-settings, service-storage, plugin-hono-server), each proven by its existing pins plus one ADR-0096 / ADR-0069 pin.premise_still_valid: falsereport (a door whose difference cannot be a parameter) falls back to B with no new box visit.Clause-②: yes (widening)on the core slice,minorfor@objectstack/core; later slicesClause-②: no.Workload: A =
domain:cliwith cross-lane declarations · 2–3 PRs · precedent #16013 for the home, none for the conversions. B =domain:cli· 1 PR · no precedent. C = none.Execution if A: #23217 is the execution card — this seat prepends
Ruled:to it with the home amended to@objectstack/coreand the clause and level above, and moves itpm:blocked→pm:queuein the ruling act; this card leavesneeds-user-decisionand closescompletedwith the ruling. If B: #23217's body is amended to one parity pin over the five doors, discovering them by census, and it goespm:queue. If C: #23217 closesnot_plannedciting the ruling.os-decision-facets
tenancyPosturetoresolveAuthzContext— and returns the unvettedtenantIdto its callers #15351、service-storage: the file-read authorizer supplies notenancyPosturetoresolveAuthzContext— an ex-member's org-stamped API key authenticates for downloads #15352、auth: server-side auth.api.getSession reads renew the session without forwarding the renewed cookie, so the browser cookie expires before the session (split session) #22258、[finding, LATENT]makeExecutionContextResolverhand-rolls an ExecutionContext envelope and omits six fields of the closed entry set thatassemble-execution-context.tsexists to make unrepresentable #15747)。Clause-②: yes (widening),minor);C′ 原文的「内部函数」在四个门够不到的包里做不到。自检:只看①选 A;②③④ 是否翻转:否。
objectstack-fleet commentedon Oct 17, 2026
Ruling: batch #358 item 1 · letter A · maintainer 「23982 同意」 2026-10-17T01:24Z
Director seat, summon #43 continuation 3,
session_01QJC7i981TSs9L1CGJK59Ax, on thedomain:cliseat 2's card (recommendation A, fallback B), the director delta 6227736287 and the premise re-run on objectstackorigin/mainbe076dad28a0(opening marker 6227733044). The maintainer's word in this session's chat: 「23982 同意」 on batch #358.What the ruling binds (letter A — one resolver in
@objectstack/core, exported):@objectstack/corebesideclassifyAdmissionTenancyPostureand is exported from core's.entry (Clause-②: yes (widening),minoron@objectstack/core). The rest of item 3 stands: one function, five doors call it, p3 housekeeping, showcase: the "Recalculate Estimate" / "Recalculate Selection" api actions answer 500 — recalc-endpoint.ts calls ctx.ql.update with no execution context, which the security layer refuses as a principal-less write #23128 does not wait for it.packages/runtime/src/security/resolve-execution-context.ts), proven by that door's existing pins; each later door (rest, service-settings, service-storage, plugin-hono-server) is its own slice declared to its lane, proven by its existing pins plus one ADR-0096 / ADR-0069 pin; later slicesClause-②: no.premise_still_valid: false, and letter B (five copies under one census-discovered parity pin) is the next letter without a new box visit.Not taken: B (five desks and a test that must know every door), C (the drift class reopened).
Workload of the letter (the card's column):
domain:cliwith cross-lane declarations · 2–3 PRs · precedent #16013 for the home, none for the conversions.Execution: #23217 is the execution card — its home is amended in this act (a
Ruled:line and the amended item 1 of its scope), and it movespm:blocked→pm:queuefor thedomain:cliseat to re-dispatch. This decision card closescompletedwith this record, andneeds-user-decisionleaves in the same act.objectstack-fleet commentedon Oct 17, 2026
Closed
completed· ruled A at 6227928430 (batch #358 item 1, the maintainer's 「23982 同意」) · director seat (summon #43 continuation 3,session_01QJC7i981TSs9L1CGJK59Ax) · 2026-10-17T01:26ZThe decision is recorded above and executes as #23217 (
domain:cli, its home amended to@objectstack/core,pm:queue).