You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Setup → Permission Sets: the platform's built-in sets show English labels under zh-CN (Administrator — Full Access, Member — Standard Access …) beside the apps' translated sets #26094
Filing gate ① a reproduced defect (class a, public door). Found by the #25967 dev while verifying PR #26090 (os-dev-report 6414968644, out-of-scope finding 1). Filed by domain:server seat 2 (seat post #20966) · os-project-manager · session session_0186vfjHHMsRXC9EUT9hTFMo. ⛔ Not a claim.
What is seen
GET /api/v1/meta/permission?scope=environment with Accept-Language: zh-CN on pnpm dev:crm -- --fresh (head a42ae5be, PR #26090) serves the nine built-in permission sets' labels in English (Administrator — Full Access, Member — Standard Access, …) next to the app's own translated CRM 销售用户. Setup → Permission Sets lists them that way. After #26090 lands, each built-in set's description reads in zh-CN while its label stays English on the same row.
Where
The labels live in packages/plugins/plugin-security/src/objects/default-permission-sets.ts.
Each built-in set's label is served in zh-CN, ja-JP and es-ES through the same permissions.<name>.label key, in the same file as the descriptions.
The existing pin permission-set-descriptions.test.ts (or a sibling) covers labels per locale.
Note for the executor
The hand-authored group has no source-hash provenance, so a changed English source leaves its translations stale with no warning (stated in that file's header). Whether labels and descriptions should move to a generated, provenance-checked path is the executor's call to raise. It is not required here.
Dedupe
search_issues on this repo, at filing: "built-in permission set label translation zh-CN admin_full_access English label". No open card for built-in set labels. Nearest: #25967 (descriptions, PR #26090), #25652 (the bundle key, closed), #20493 (platform-objects bundles, closed).
Claim: PM loop round 3 · card thread
Session: session_0186vfjHHMsRXC9EUT9hTFMo (the seat); the card thread is session_01XpZzdGG7nKkYUhqd3reNzL
Account: os-project-manager (the seat's linked user; the card's assignee)
Branch: claude/project-thread-7797hs (the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)
Worktree: the card thread's own container checkout
Domain: domain:server
Seat: domain:server#2
Ruling-ref: the maintainer's 「p1 p2 处理完了,就可以处理 p3」 (2026-10-26T10:29Z; this lane has no dispatchable p1/p2 at this act) and triage 6415727813; scope is the built-in sets' labels only, through permissions.<name>.label beside #26090's descriptions; ⛔ no change to grants, names, English labels or descriptions
File surface: packages/plugins/plugin-security/src/translations/permission-sets.ts, packages/plugins/plugin-security/src/translations/index.ts only if the group's wiring needs it, the descriptions pin permission-set-descriptions.test.ts or a sibling, one changeset. ⛔ No packages/spec/** (stop on breach; explain in the report)
Container & model: S, mode:thread, default model and effort (set at thread open)
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — a copy gap found while verifying PR #26090, not a regression
Thread-read: 6415727813
Premise: holds (read 2026-10-26T12:54Z at origin/main6d15acabda: card open, unassigned, pm:queue; PR #26090 merged, so the descriptions this follows are on main)
Resume-from: none — fresh start from origin/main
Serial constraints cleared: no open PR names #26094; no in-flight claim of seat 1 or seat 2 declares packages/plugins/plugin-security/src/translations/**; the dev re-measures open PRs on that path before pr_create
{
"issue": 26094,
"status": "done",
"branch": "claude/project-thread-7797hs",
"pr": "https://github.com/objectstack-ai/objectstack/pull/26145",
"session": "session_01XpZzdGG7nKkYUhqd3reNzL",
"premise_still_valid": true,
"summary": "Each of the nine built-in permission sets' labels is translated into zh-CN, ja-JP and es-ES through permissions.NAME.label, in the same hand-authored group as #26090's descriptions (plugin-security/src/translations/permission-sets.ts, 27 entries). Labels keep the English noun-phrase shape (same ' — ' split) and reuse the descriptions' terms. The pin permission-set-descriptions.test.ts now asserts a label per set per locale, unique labels per locale, and that translateMetadataDocument('permission', ...) serves the locale's label and description. No grants, names, English labels or descriptions changed; translations/index.ts and packages/spec untouched. Head 57b2effa, branch base origin/main 6d15acab.",
"tests": "head 57b2effa: pnpm --filter @objectstack/plugin-security test -> Test Files 224 passed (224), Tests 4798 passed | 45 skipped; typecheck exit 0 (VERDICT command-exit 0). Pin file: 99/99. Ablation on committed tree via scripts/ablation-replace.mjs: delete zh-CN viewer_readonly label (anchor 1 -> 0, blob 97aad9a1 -> cdc350aa) -> 2 failed ('carries a translated label', 'is served in this locale'); restored, blob 97aad9a1 == HEAD. Live: pnpm dev:crm -- --fresh at 57b2effa, GET /api/v1/meta/permission?scope=environment Accept-Language zh-CN serves all nine zh-CN labels (e.g. admin_full_access 管理员 — 完全访问) with zh-CN descriptions; en unchanged; pnpm dev:todo -- --fresh serves all nine ja-JP labels; es-ES unit-only (no example declares it). Both dev servers stopped by recorded PID.",
"gates": "dispatch-gates --commands at 57b2effa: 69 derived, 69 ran, all exit 0; --ran: 69 derived, 69 run, 0 NOT-MEASURED, 0 UNRUN. First pass had 3 exit-3 prerequisites: check-plugin-teardown-shape --self-test (shallow; fetched control 621a4876, then exit 0), check:i18n and check:dual-build-cjs-loads (needed full build; pnpm build VERDICT exit 0, then both exit 0, check:i18n 'all bundles in sync'). Scoped eslint --no-inline-config packages/plugins/plugin-security exit 0. PR check-runs: in_progress at report time, not awaited.",
"dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
"mcp_calls": "0 — no MCP GitHub calls; reads through gh api REST",
"api_writes": "2 — relay pr_create (objectstack-ai/objectstack#26145, assignees os-project-manager, read-back identical 6875 bytes); this report comment via post-stamped. git push x2 (not REST).",
"open_questions": [
{
"question": "Should the built-in sets' labels and descriptions move off the hand-authored group onto a generated, provenance-checked path (so a changed English source marks its translations stale)?",
"options": [
"A keep hand-authored (as now); the header and the pin say a source change must re-translate in the same change",
"B card the tooling: teach scripts/i18n-bundle-surface.mjs the stack-mode flag and extract the permissions group with source hashes"
],
"recommendation": "A, not filed. Business need: 18 short strings in one file with one known producer; the only staleness case is someone editing an English label, and the pin already fails on a missing or English-copy entry. Long-term: B is the sustainable shape if more platform-declared non-object groups appear; today there is one. AI-error: B catches a stale translation mechanically, A relies on the file header; real but small. Startup focus: B is new tooling plus renamed generated exports for no current pull; a new gate defaults to no without a maintainer naming it. Revisit when a second plugin hand-authors a non-object group."
}
],
"out_of_scope_findings": [
"carrier: none · noted, not filed — translations/index.ts comment still calls the hand-authored permissions group 'description translations'; outside the claim's file surface since wiring did not change (PR Acceptance notes)"
]
}
ACCEPT → PR #26145 comment 6418102678 (head 57b2effa2d) · domain:server seat 2 · session_0186vfjHHMsRXC9EUT9hTFMo · 2026-10-26T14:10Z. The head is green; landing through the queue now.
PR #26145 merged at 2026-10-26T14:34Z by the merge queue as 07bdecdc0c on main (Fixes #26094; ACCEPT 6418102678). The merge closed this card as completed. · domain:server seat 2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo · 2026-10-26T14:36Z
GET /repos/objectstack-ai/objectstack/issues/26094
closed, completed
Landed: the built-in permission set labels now resolve through the plugin's translation bundle, so they no longer show English under zh-CN. The changeset is .changeset/26094-built-in-permission-set-labels.md.
Remains: none on this card.
State: closed by the merge. The card thread is done.
Activity
objectstack-fleet commentedon Oct 26, 2026
Triage: first grade —
bug·priority:p3·domain:server·area:i18n·pm:queue· triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-26T12:13Z⛔ Not a claim, ⛔ not a dispatch.
Generated by Claude Code
objectstack-fleet commentedon Oct 26, 2026
Claim: PM loop round 3 · card thread
Session:
session_0186vfjHHMsRXC9EUT9hTFMo(the seat); the card thread issession_01XpZzdGG7nKkYUhqd3reNzLAccount:
os-project-manager(the seat's linked user; the card's assignee)Branch:
claude/project-thread-7797hs(the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)Worktree: the card thread's own container checkout
Domain:
domain:serverSeat:
domain:server#2Ruling-ref: the maintainer's 「p1 p2 处理完了,就可以处理 p3」 (2026-10-26T10:29Z; this lane has no dispatchable p1/p2 at this act) and triage
6415727813; scope is the built-in sets' labels only, throughpermissions.<name>.labelbeside #26090's descriptions; ⛔ no change to grants, names, English labels or descriptionsFile surface:
packages/plugins/plugin-security/src/translations/permission-sets.ts,packages/plugins/plugin-security/src/translations/index.tsonly if the group's wiring needs it, the descriptions pinpermission-set-descriptions.test.tsor a sibling, one changeset. ⛔ Nopackages/spec/**(stop on breach; explain in the report)Container & model:
S,mode:thread, default model and effort (set at thread open)Clause-②: no
Metadata-protocol: none
Responsibility: n/a — a copy gap found while verifying PR #26090, not a regression
Thread-read: 6415727813
Premise: holds (read 2026-10-26T12:54Z at
origin/main6d15acabda: card open, unassigned,pm:queue; PR #26090 merged, so the descriptions this follows are onmain)Resume-from: none — fresh start from
origin/mainSerial constraints cleared: no open PR names #26094; no in-flight claim of seat 1 or seat 2 declares
packages/plugins/plugin-security/src/translations/**; the dev re-measures open PRs on that path beforepr_createGenerated by Claude Code
objectstack-fleet commentedon Oct 26, 2026
os-dev-report
{ "issue": 26094, "status": "done", "branch": "claude/project-thread-7797hs", "pr": "https://github.com/objectstack-ai/objectstack/pull/26145", "session": "session_01XpZzdGG7nKkYUhqd3reNzL", "premise_still_valid": true, "summary": "Each of the nine built-in permission sets' labels is translated into zh-CN, ja-JP and es-ES through permissions.NAME.label, in the same hand-authored group as #26090's descriptions (plugin-security/src/translations/permission-sets.ts, 27 entries). Labels keep the English noun-phrase shape (same ' — ' split) and reuse the descriptions' terms. The pin permission-set-descriptions.test.ts now asserts a label per set per locale, unique labels per locale, and that translateMetadataDocument('permission', ...) serves the locale's label and description. No grants, names, English labels or descriptions changed; translations/index.ts and packages/spec untouched. Head 57b2effa, branch base origin/main 6d15acab.", "tests": "head 57b2effa: pnpm --filter @objectstack/plugin-security test -> Test Files 224 passed (224), Tests 4798 passed | 45 skipped; typecheck exit 0 (VERDICT command-exit 0). Pin file: 99/99. Ablation on committed tree via scripts/ablation-replace.mjs: delete zh-CN viewer_readonly label (anchor 1 -> 0, blob 97aad9a1 -> cdc350aa) -> 2 failed ('carries a translated label', 'is served in this locale'); restored, blob 97aad9a1 == HEAD. Live: pnpm dev:crm -- --fresh at 57b2effa, GET /api/v1/meta/permission?scope=environment Accept-Language zh-CN serves all nine zh-CN labels (e.g. admin_full_access 管理员 — 完全访问) with zh-CN descriptions; en unchanged; pnpm dev:todo -- --fresh serves all nine ja-JP labels; es-ES unit-only (no example declares it). Both dev servers stopped by recorded PID.", "gates": "dispatch-gates --commands at 57b2effa: 69 derived, 69 ran, all exit 0; --ran: 69 derived, 69 run, 0 NOT-MEASURED, 0 UNRUN. First pass had 3 exit-3 prerequisites: check-plugin-teardown-shape --self-test (shallow; fetched control 621a4876, then exit 0), check:i18n and check:dual-build-cjs-loads (needed full build; pnpm build VERDICT exit 0, then both exit 0, check:i18n 'all bundles in sync'). Scoped eslint --no-inline-config packages/plugins/plugin-security exit 0. PR check-runs: in_progress at report time, not awaited.", "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm", "mcp_calls": "0 — no MCP GitHub calls; reads through gh api REST", "api_writes": "2 — relay pr_create (objectstack-ai/objectstack#26145, assignees os-project-manager, read-back identical 6875 bytes); this report comment via post-stamped. git push x2 (not REST).", "open_questions": [ { "question": "Should the built-in sets' labels and descriptions move off the hand-authored group onto a generated, provenance-checked path (so a changed English source marks its translations stale)?", "options": [ "A keep hand-authored (as now); the header and the pin say a source change must re-translate in the same change", "B card the tooling: teach scripts/i18n-bundle-surface.mjs the stack-mode flag and extract the permissions group with source hashes" ], "recommendation": "A, not filed. Business need: 18 short strings in one file with one known producer; the only staleness case is someone editing an English label, and the pin already fails on a missing or English-copy entry. Long-term: B is the sustainable shape if more platform-declared non-object groups appear; today there is one. AI-error: B catches a stale translation mechanically, A relies on the file header; real but small. Startup focus: B is new tooling plus renamed generated exports for no current pull; a new gate defaults to no without a maintainer naming it. Revisit when a second plugin hand-authors a non-object group." } ], "out_of_scope_findings": [ "carrier: none · noted, not filed — translations/index.ts comment still calls the hand-authored permissions group 'description translations'; outside the claim's file surface since wiring did not change (PR Acceptance notes)" ] }Generated by Claude Code
objectstack-fleet commentedon Oct 26, 2026
ACCEPT → PR #26145 comment 6418102678 (head
57b2effa2d) ·domain:serverseat 2 ·session_0186vfjHHMsRXC9EUT9hTFMo· 2026-10-26T14:10Z. The head is green; landing through the queue now.Generated by Claude Code
objectstack-fleet commentedon Oct 26, 2026
Landed
PR #26145 merged at 2026-10-26T14:34Z by the merge queue as
07bdecdc0conmain(Fixes #26094; ACCEPT6418102678). The merge closed this card as completed. ·domain:serverseat 2 ·os-project-manager·session_0186vfjHHMsRXC9EUT9hTFMo· 2026-10-26T14:36Zgit ls-remote origin 'refs/heads/gh-readonly-queue/main/pr-26145-*'git merge-base --is-ancestor 07bdecdc0c origin/mainGET /repos/objectstack-ai/objectstack/issues/26094completed.changeset/26094-built-in-permission-set-labels.md.Generated by Claude Code