Skip to content

Setup → Permission Sets: the platform's built-in sets show English labels under zh-CN (Administrator — Full Access, Member — Standard Access …) beside the apps' translated sets #26094

Closed

Description

@objectstack-fleet

Filing gate ① a reproduced defect (class a, public door). Found by the #25967 dev while verifying PR #26090 (os-dev-report 6414968644, out-of-scope finding 1). Filed by domain:server seat 2 (seat post #20966) · os-project-manager · session session_0186vfjHHMsRXC9EUT9hTFMo. ⛔ Not a claim.

What is seen

GET /api/v1/meta/permission?scope=environment with Accept-Language: zh-CN on pnpm dev:crm -- --fresh (head a42ae5be, PR #26090) serves the nine built-in permission sets' labels in English (Administrator — Full Access, Member — Standard Access, …) next to the app's own translated CRM 销售用户. Setup → Permission Sets lists them that way. After #26090 lands, each built-in set's description reads in zh-CN while its label stays English on the same row.

Where

Wanted

  • Each built-in set's label is served in zh-CN, ja-JP and es-ES through the same permissions.<name>.label key, in the same file as the descriptions.
  • The existing pin permission-set-descriptions.test.ts (or a sibling) covers labels per locale.

Note for the executor

The hand-authored group has no source-hash provenance, so a changed English source leaves its translations stale with no warning (stated in that file's header). Whether labels and descriptions should move to a generated, provenance-checked path is the executor's call to raise. It is not required here.

Dedupe

search_issues on this repo, at filing: "built-in permission set label translation zh-CN admin_full_access English label". No open card for built-in set labels. Nearest: #25967 (descriptions, PR #26090), #25652 (the bundle key, closed), #20493 (platform-objects bundles, closed).


Generated by Claude Code

Activity

  1. added
    bugSomething isn't working
    area:i18nThe customer's own language, across UI, metadata and notifications
    domain:serverDomain lane — seat card indexed by label:pm:seat
    on Oct 26, 2026
  2. objectstack-fleet commented on Oct 26, 2026

    @objectstack-fleet
    ContributorAuthor

    Triage: first grade — bug · priority:p3 · domain:server · area:i18n · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-26T12:13Z

    ⛔ Not a claim, ⛔ not a dispatch.


    Generated by Claude Code

  3. added
    pm:queueReady for the PM dispatch loop
    pm:dispatchedDispatched to a dev agent by /pm-dispatch
    and removed
    pm:queueReady for the PM dispatch loop
    on Oct 26, 2026
  4. objectstack-fleet commented on Oct 26, 2026

    @objectstack-fleet
    ContributorAuthor

    Claim: PM loop round 3 · card thread
    Session: session_0186vfjHHMsRXC9EUT9hTFMo (the seat); the card thread is session_01XpZzdGG7nKkYUhqd3reNzL
    Account: os-project-manager (the seat's linked user; the card's assignee)
    Branch: claude/project-thread-7797hs (the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)
    Worktree: the card thread's own container checkout
    Domain: domain:server
    Seat: domain:server#2
    Ruling-ref: the maintainer's 「p1 p2 处理完了,就可以处理 p3」 (2026-10-26T10:29Z; this lane has no dispatchable p1/p2 at this act) and triage 6415727813; scope is the built-in sets' labels only, through permissions.<name>.label beside #26090's descriptions; ⛔ no change to grants, names, English labels or descriptions
    File surface: packages/plugins/plugin-security/src/translations/permission-sets.ts, packages/plugins/plugin-security/src/translations/index.ts only if the group's wiring needs it, the descriptions pin permission-set-descriptions.test.ts or a sibling, one changeset. ⛔ No packages/spec/** (stop on breach; explain in the report)
    Container & model: S, mode:thread, default model and effort (set at thread open)
    Clause-②: no
    Metadata-protocol: none
    Responsibility: n/a — a copy gap found while verifying PR #26090, not a regression
    Thread-read: 6415727813
    Premise: holds (read 2026-10-26T12:54Z at origin/main 6d15acabda: card open, unassigned, pm:queue; PR #26090 merged, so the descriptions this follows are on main)
    Resume-from: none — fresh start from origin/main
    Serial constraints cleared: no open PR names #26094; no in-flight claim of seat 1 or seat 2 declares packages/plugins/plugin-security/src/translations/**; the dev re-measures open PRs on that path before pr_create


    Generated by Claude Code

  5. objectstack-fleet commented on Oct 26, 2026

    @objectstack-fleet
    ContributorAuthor

    os-dev-report

    {
      "issue": 26094,
      "status": "done",
      "branch": "claude/project-thread-7797hs",
      "pr": "https://github.com/objectstack-ai/objectstack/pull/26145",
      "session": "session_01XpZzdGG7nKkYUhqd3reNzL",
      "premise_still_valid": true,
      "summary": "Each of the nine built-in permission sets' labels is translated into zh-CN, ja-JP and es-ES through permissions.NAME.label, in the same hand-authored group as #26090's descriptions (plugin-security/src/translations/permission-sets.ts, 27 entries). Labels keep the English noun-phrase shape (same ' — ' split) and reuse the descriptions' terms. The pin permission-set-descriptions.test.ts now asserts a label per set per locale, unique labels per locale, and that translateMetadataDocument('permission', ...) serves the locale's label and description. No grants, names, English labels or descriptions changed; translations/index.ts and packages/spec untouched. Head 57b2effa, branch base origin/main 6d15acab.",
      "tests": "head 57b2effa: pnpm --filter @objectstack/plugin-security test -> Test Files 224 passed (224), Tests 4798 passed | 45 skipped; typecheck exit 0 (VERDICT command-exit 0). Pin file: 99/99. Ablation on committed tree via scripts/ablation-replace.mjs: delete zh-CN viewer_readonly label (anchor 1 -> 0, blob 97aad9a1 -> cdc350aa) -> 2 failed ('carries a translated label', 'is served in this locale'); restored, blob 97aad9a1 == HEAD. Live: pnpm dev:crm -- --fresh at 57b2effa, GET /api/v1/meta/permission?scope=environment Accept-Language zh-CN serves all nine zh-CN labels (e.g. admin_full_access 管理员 — 完全访问) with zh-CN descriptions; en unchanged; pnpm dev:todo -- --fresh serves all nine ja-JP labels; es-ES unit-only (no example declares it). Both dev servers stopped by recorded PID.",
      "gates": "dispatch-gates --commands at 57b2effa: 69 derived, 69 ran, all exit 0; --ran: 69 derived, 69 run, 0 NOT-MEASURED, 0 UNRUN. First pass had 3 exit-3 prerequisites: check-plugin-teardown-shape --self-test (shallow; fetched control 621a4876, then exit 0), check:i18n and check:dual-build-cjs-loads (needed full build; pnpm build VERDICT exit 0, then both exit 0, check:i18n 'all bundles in sync'). Scoped eslint --no-inline-config packages/plugins/plugin-security exit 0. PR check-runs: in_progress at report time, not awaited.",
      "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
      "mcp_calls": "0 — no MCP GitHub calls; reads through gh api REST",
      "api_writes": "2 — relay pr_create (objectstack-ai/objectstack#26145, assignees os-project-manager, read-back identical 6875 bytes); this report comment via post-stamped. git push x2 (not REST).",
      "open_questions": [
        {
          "question": "Should the built-in sets' labels and descriptions move off the hand-authored group onto a generated, provenance-checked path (so a changed English source marks its translations stale)?",
          "options": [
            "A keep hand-authored (as now); the header and the pin say a source change must re-translate in the same change",
            "B card the tooling: teach scripts/i18n-bundle-surface.mjs the stack-mode flag and extract the permissions group with source hashes"
          ],
          "recommendation": "A, not filed. Business need: 18 short strings in one file with one known producer; the only staleness case is someone editing an English label, and the pin already fails on a missing or English-copy entry. Long-term: B is the sustainable shape if more platform-declared non-object groups appear; today there is one. AI-error: B catches a stale translation mechanically, A relies on the file header; real but small. Startup focus: B is new tooling plus renamed generated exports for no current pull; a new gate defaults to no without a maintainer naming it. Revisit when a second plugin hand-authors a non-object group."
        }
      ],
      "out_of_scope_findings": [
        "carrier: none · noted, not filed — translations/index.ts comment still calls the hand-authored permissions group 'description translations'; outside the claim's file surface since wiring did not change (PR Acceptance notes)"
      ]
    }

    Generated by Claude Code

  6. objectstack-fleet commented on Oct 26, 2026

    @objectstack-fleet
    ContributorAuthor

    ACCEPT → PR #26145 comment 6418102678 (head 57b2effa2d) · domain:server seat 2 · session_0186vfjHHMsRXC9EUT9hTFMo · 2026-10-26T14:10Z. The head is green; landing through the queue now.


    Generated by Claude Code

  7. objectstack-fleet commented on Oct 26, 2026

    @objectstack-fleet
    ContributorAuthor

    Landed

    PR #26145 merged at 2026-10-26T14:34Z by the merge queue as 07bdecdc0c on main (Fixes #26094; ACCEPT 6418102678). The merge closed this card as completed. · domain:server seat 2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo · 2026-10-26T14:36Z

    Reading Probe Result
    Queue membership git ls-remote origin 'refs/heads/gh-readonly-queue/main/pr-26145-*' 0 refs (left the queue)
    Ancestry git merge-base --is-ancestor 07bdecdc0c origin/main holds
    Card state GET /repos/objectstack-ai/objectstack/issues/26094 closed, completed
    • Landed: the built-in permission set labels now resolve through the plugin's translation bundle, so they no longer show English under zh-CN. The changeset is .changeset/26094-built-in-permission-set-labels.md.
    • Remains: none on this card.
    • State: closed by the merge. The card thread is done.

    Generated by Claude Code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

area:i18nThe customer's own language, across UI, metadata and notificationsbugSomething isn't workingdomain:serverDomain lane — seat card indexed by label:pm:seatpm:dispatchedDispatched to a dev agent by /pm-dispatchpriority:p3

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions