Repository navigation
Studio Access pillar: a delegated-admin scope control shows a different value from what the runtime enforces when the key is unset (detail withheld pending maintainer) #26706
Description
Filing gate: ① product defect, reproduced, landing site named. Maintainer direct dispatch; the authorizing words are quoted in the claim comment.
Summary
In Studio › Access › a permission set › Delegated admin, one scope control displays a state for an unset key that disagrees with the default the delegated-admin gate enforces. An admin who reads the screen misjudges the scope they are delegating.
- Measured 2026-10-27 at
3fcafcd3by the Studio QA Access card. The PM read both sides of the code. - The exact control, the direction and the reproduction are withheld pending maintainer, per the maintainer's instruction for security defects that are not to be disclosed. The implementer receives them privately.
Acceptance (public part)
- For an unset key, the control shows exactly what the gate enforces, and a save does not change the effective scope unless the admin changed the control.
- A pin covers the unset case on the display side, tied to the spec default.
Filing facts
- Business reason: delegated administration is how larger customers hand out admin power safely; the screen must state the delegated scope truthfully.
- Reader who acts: an
os-devimplementer, dispatched directly by this PM session (domain:ui). - Dedupe: semantic search
delegated admin include subtree shows off when unset but runtime defaults trueon objectstack-ai/objectstack → 3 hits (delegated-admin gate: scope violations answer PERMISSION_DENIED, so a client cannot tell them from an opaque denial (own registered code) #26189, [finding] The delegated-admin gate resolves an EMPTY subtree on a stockobjectstack devboot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057, [finding]sys_user_permission_set.delegated_fromis declared and data-door-writable, but the runtime delegation gate structurally never reads it on this object #9730), all closed and none about this display. - Source: Studio QA run, 2026-10-27, coordinator session
session_01J8VVAkZns5rNnK2rtszzbQ.
Activity
objectstack-fleet commentedon Oct 27, 2026
Claim: PM loop round 1 (maintainer direct dispatch)
Session:
session_01J8VVAkZns5rNnK2rtszzbQAccount:
huangyiireneBranch:
claude/issue-26706-delegated-admin-scope-displayWorktree:
objectstack-issue-26706Domain:
domain:uiSeat:
domain:ui#1(direct-dispatch session, not a lane seat)File surface:
ui/packages/app-shell/src/views/metadata-admin/**(delegated-admin facet only) (stop on breach; explain in the report)Container & model:
S,mode:subagent,model: TIER_DEFAULT (dispatch-gates --tier: no path-derived mandate),effort: xhigh(security)Clause-②: no
Metadata-protocol: none
Responsibility: detail withheld pending maintainer |
none| detail withheld pending maintainerThread-read: none
Premise: holds (measured 2026-10-27 at 3fcafcd; PM read both sides on origin/main 4373103)
Serial constraints cleared: in-flight #26597 (same directory, field-permission editor in
PermissionMatrixEditor.tsx) — disjoint file expected (this card isPermissionAdvancedFacets.tsx); if either touches the other's file, the later PR rebases over the earlierDirect-dispatch authority — maintainer, this session, 2026-10-27, verbatim: 「不能公开的安全问题，你直接使用pm-dispatch 派发处理」
Reproduction steps stay off GitHub per that instruction; they go to the implementer in the private dispatch prompt.
Generated by Claude Code
objectstack-fleet commentedon Oct 28, 2026
os-dev-report
{
"issue": 26706,
"status": "done",
"branch": "claude/issue-26706-delegated-admin-scope-display",
"pr": "#26990",
"session": "session_01J8VVAkZns5rNnK2rtszzbQ — mode:subagent, the parent's harness-stamped id",
"premise_still_valid": true,
"summary": "The delegated-admin scope facet shows the spec default for an unset key. Each switch in ui/packages/app-shell/src/views/metadata-admin/PermissionAdvancedFacets.tsx draws scopeSwitchOn(scope, key): the scope's own boolean, or else the AdminScopeSchema default restated in ADMIN_SCOPE_SWITCH_DEFAULTS (typed against the spec's AdminScope). Drawing a default writes nothing, and a flip writes an explicit boolean. Write paths, the business-unit gate and the server are unchanged. Landing site = the card's expected site, and no other ui/ surface draws these keys. Draft PR #26990 opened through the relay, assignee huangyiirene, no labels (a patch changeset ships, so no skip-changeset). The exploitable detail is withheld from GitHub per the dispatch disclosure rule and goes in the private final report only.",
"tests": "Facet suites (7 PermissionAdvancedFacets.*.test.tsx + spec-symbol-parity.test.ts), pnpm --dir ui exec vitest run --maxWorkers=2, under the verify lock: on 3592965 'Test Files 8 passed (8) / Tests 113 passed (113)', VERDICT command-exit 0; on 394213f (after the merge of origin/main f1cd529) the same 8/8 and 113/113, exit 0. New pin PermissionAdvancedFacets.adminScopeDefault-26706.test.tsx has 6 cases; every expected value is read from the installed AdminScopeSchema. Two expectations in adminScopeAnchor.test.tsx updated (the boolean a single flip writes follows the drawn state). @object-ui/app-shell type-check (tsc --noEmit && tsc -p tsconfig.test.json): exit 0 on 3592965 and on 394213f. tsc -p tsconfig.test.json --listFilesOnly lists both changed test files. Ablation, once, on 3592965 via scripts/ablation-replace.mjs in wrap mode: one switch's checked reading put back to its pre-change expression. Anchor 1->0, replacement 0->1, blob cabc1416e0fd -> c5282ce2ba31; grep -c on disk replacement 1, anchor 0. Result 'Tests 6 failed | 12 passed (18)' across the two facet files, red as declared in advance. Restored: blob == HEAD cabc1416e0fd, git diff HEAD empty, git status --porcelain empty. The subject is imported by relative path (src), so no dist leg applies.",
"gates": "dispatch-gates --commands --repo objectstack-ai/objectstack (no paths) derived 34 commands. On 3592965: 34/34 exit 0. On 394213f: 33 exit 0, and 'pnpm --dir ui exec vitest run scripts/' exit 1 with 'Tests 9 failed | 5056 passed | 2 skipped'. All 9 were 'Test timed out in 15000ms' in whole-tree scans on the contended box. The 6 timed-out files re-run alone under the lock: 'Test Files 6 passed (6) / Tests 522 passed (522)', exit 0. --ran with exit codes recorded: '34 derived famil(ies) accounted for — 34 run, 0 NOT-MEASURED (a DERIVED zero)'. Declared narrowing: by report time origin/main was 93 commits past the merge and 6 gate-input files had moved upstream; CI runs those families on the PR merge ref. Closure build pnpm --filter '@object-ui/app-shell^...' build: VERDICT command-exit 0 (pre-merge and post-merge). PR check-runs at report time on 394213f: 17 in_progress, 2 opt-in jobs skipped. Not run locally (CI-owned): pnpm lint, test:repo, the workspace type-check lanes.",
"dogfood_battery": "n/a — no
!in the PR title and no (narrowing) arm","mcp_calls": "0",
"api_writes": "2 — relay repository_dispatch strokes: (1) pr_create = POST /repos/objectstack-ai/objectstack/pulls + POST /repos//issues/26990/assignees; (2) comment = POST /repos//issues/26706/comments (this report). Plus git push of the branch (not REST).",
"open_questions": [],
"out_of_scope_findings": []
}