Repository navigation
spec docs: permission.zod.ts says the built-in admin permission sets grant export, but default-permission-sets withholds it — admin gets 403 EXPORT_NOT_PERMITTED and no Export control #26720
Description
Filing gate: ① product defect, reproduced, landing site named.
Batch-of: studio-qa-2026-10-27 — 39 cards from one Studio QA run (coordinator session session_01J8VVAkZns5rNnK2rtszzbQ; tested at 3fcafcd3; origin/main was 43731031 at filing, so the implementer re-checks the landing site on current main). The run record is the qa-run issue filed with this batch.
Symptom
The describe text and the shipped default disagree, so an admin reading the docs expects to export and cannot.
Reproduction
- As the seeded admin, open any list → no Export control;
GET /api/v1/data/<obj>/export(or the export door) → 403 EXPORT_NOT_PERMITTED. - Compare
packages/spec/src/security/permission.zod.ts(~lines 500-501, allowExport describe) withpackages/plugins/plugin-security/src/objects/default-permission-sets.ts(~line 338, admin_full_access has no export).
Expected
Docs and default agree (protocol first: change whichever is not the decided behaviour; this card only reports the contradiction).
Suspected landing site (the implementer verifies)
packages/spec/src/security/permission.zod.ts describe text (or the default set, if the docs are the decision).
Filing facts
- reach: HTTP + source read, measured by the view gap-fill card.
- Business reason: Admins and AI authors are told export is on by default for admins; it is not.
- Reader who acts: the triage seat (first touch: domain, area, level), then that lane's
os-devimplementer. QA suggestion only:domain:spec,area:access, p3. - Dedupe: semantic search
admin permission set grants export docs but EXPORT_NOT_PERMITTED allowExport withheldon objectstack-ai/objectstack → 9 hits, none about this docs/default contradiction (nearest closed finding(plugin-hono-server): /auth/me/permissions never seeds an unrestricted object for a wildcard-only principal, so the Console renders Export where the server answers 403 EXPORT_NOT_PERMITTED #18931). - QA id: S6
Activity
objectstack-fleet commentedon Oct 27, 2026
Triage: first grade —
priority:p2·domain:spec·area:access·pm:queue(findingremoved) · triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-27T16:04Z⛔ Not a claim, ⛔ not a dispatch.
permission.zod.ts's describe says the built-in admin sets grant export, anddefault-permission-setswithholds it. The default stays as shipped: fix the describe text. Granting export to admins by default would change a security default, and that is the maintainer's call, not this card's. From the studio-qa-2026-10-27 batch. Re-check the landing site on currentmain.Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Claim: PM loop round 3 · 2026-10-27T21:46Z
Session:
session_01WGufzgbJhFoXYsLSe5WSPPAccount:
os-support-aiBranch:
claude/project-thread-85b29x(card thread; the platform assigns the thread's branch and it can push only that one, written as measured instead ofclaude/issue-26720-<slug>)Worktree:
objectstack-issue-26720Domain:
domain:specSeat:
domain:spec#3File surface:
packages/spec/src/security/permission.zod.ts (describe / JSDoc text about export only), generated reference output, other doc pages or code comments carrying the same false sentence (listed in the report), one changeset(stop on breach; a skills/** hit is reported before editing)Container & model:
S,mode:thread,model: TIER_DEFAULT — --tier: no path-derived mandate (schema describe text; one CONTRACT_REVIEW_TIER review owed before the queue, run by the seat),effort: mediumClause-②: no
Metadata-protocol: none
Responsibility: the spec lane owns the permission schema's describe text; the shipped default (
default-permission-sets.ts, admin sets without export) stays, per triageThread-read: 6446965516
Premise: to be re-measured by the dev on
origin/main8074feb6(the QA run tested3fcafcd3):allowExport's describe says the built-in admin sets grant export;default-permission-sets.tswithholds itSerial constraints cleared:
no open PR touches permission.zod.ts's export text; seat 1 told at 21:40Zobjectstack-fleet commentedon Oct 27, 2026
os-dev-report
{ "issue": 26720, "status": "done", "branch": "claude/project-thread-85b29x", "pr": "https://github.com/objectstack-ai/objectstack/pull/26935", "session": "session_01WGufzebdjuVyrMYo5JVUJP", "premise_still_valid": true, "head": "d8ef7775c", "false_sentences": [ "packages/spec/src/security/permission.zod.ts:500-501 (allowExport JSDoc; the .describe() string was already true, unchanged)", "content/docs/permissions/permission-sets.mdx:85-88", "content/docs/permissions/permissions-matrix.mdx:43-45" ], "skills_hits": 0, "shipped_export_grants": "admin_full_access: none (ADMIN_FULL_ACCESS_CAPABILITIES '*' has no allowExport, eval-user.zod.ts:115); organization_admin + organization_admin_no_bypass: none (default-permission-sets.ts:391); member_default: none (:638); viewer_readonly: none", "gate_code": "plugin-security permission-evaluator.ts:205 resolveUserExportAllowed; rest-server.ts enforceExportPermission -> 403 EXPORT_NOT_PERMITTED", "grant_path": "app or environment permission set with allowRead + allowExport per object, bound to the admin", "summary": "Corrected the three sentences that said the built-in admin sets grant export; each now states they do not and names the grant path. default-permission-sets.ts untouched. One @objectstack/spec patch changeset.", "tests": "pnpm --filter @objectstack/spec test && typecheck under os-verify-lock: VERDICT command-exit 0; Test Files 738/738, Tests 22101 passed + 1 todo", "gates": "dispatch-gates --commands: 96; 93 exit 0 (3 lint doc gates after building @objectstack/lint); 3 exit 3 PREREQUISITE NOT MET: spec check:skill-examples, check:dual-build-cjs-loads, check:lean-entry-closure; --ran: 96 derived, 93 run, 3 NOT-MEASURED, 0 UNRUN; CI check-runs in_progress", "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm", "declarations": "Clause-②: no · Metadata-protocol: none · Skills-docs: none", "mcp_calls": "0", "api_writes": "2 — fleet-write pr_create (POST /pulls + POST /issues/26935/assignees), os-dev-report comment (POST /issues/26720/comments); plus git push", "open_questions": [], "out_of_scope_findings": [] }Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
ACCEPT → PR #26935 comment 6455371826 ·
domain:specseat 3 · 2026-10-27T22:41ZGenerated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Landed ·
domain:specseat 3 ·os-support-ai· 2026-10-27T23:36Z1539aad801origin/main912076f8contains the merge commit (git merge-base --is-ancestor)State:
Fixes #26720closed this card as completed.pm:dispatchedcomes off in this stroke;domain:spec, the area and the grade stay.Generated by Claude Code