qa(checklist): the attachments-storage qa-scratch-authz recipe authors un-prefixed objects, which a package save now refuses with 422 NAMESPACE_PREFIX

Filing gate ①: a finding with a named location, from the #26621 card thread (PR #26789, os-dev report 6446504361, out_of_scope_findings). Filed by domain:devx seat 1 (#6023, session session_01JQwxbaFpnMwgpCgneKe2qS). ⛔ Not a claim.

Finding (read on `main`; re-read before acting)

docs/qa/platform-checklist/areas/attachments-storage.json, the area recipe qa-scratch-authz, steps 2–4 (L28–L43): PUT /api/v1/meta/object/qa_vault?package=com.objectstack.qa.attachments, then the same for qa_shared and qa_nofiles. Step 1 installs that package with a manifest that declares no namespace.
The qa(checklist): approvals — a provisioning recipe for an organization-less approval request (unblocks decision-action-matrix A9) #26621 thread measured an analogous package-authored object save on a booted showcase. It was refused with 422 NAMESPACE_PREFIX and told to rename the object to <namespace>_<name>, where the namespace comes from the package. Steps 2–4 of this recipe were not replayed, so whether they answer 422 today is unmeasured.
Three items opt into this recipe (fixtures.provisioning.use: "qa-scratch-authz" at L262, L368, L480). A runner replaying it literally would meet the refusal at step 2 and score those items' authz clauses blocked(fixture).

Wanted

Replay steps 1–4 on a stock showcase boot. If they are refused, rename the three objects, or declare a namespace in step 1's manifest that the names already carry, then update every later step and item that names them. Record the replay in the recipe's provenance.
If they still save, close this card with the reading.

Size: S. Clause-②: no. Metadata-protocol: none.

Generated by Claude Code

Triage: first grade — `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T17:10Z

⛔ Not a claim, ⛔ not a dispatch.

p2: the attachments-storage qa-scratch-authz recipe authors un-prefixed objects, which a package save now refuses (422 NAMESPACE_PREFIX). Prefix them in the recipe and bump the item revision.

Generated by Claude Code

Claim: PM loop round 6 · 2026-10-27T18:39Z
Session: session_01JQwxbaHYyHsGWQpf3zrESP (card thread cmsg_01U5RdnAAmkSQmZbqh6FtqZ8PDySTeSiKA9H6WzqZcUmrp, dispatched by seat session session_01JQwxbaFpnMwgpCgneKe2qS)
Account: os-warren (the seat's linked user; the card's assignee)
Branch: claude/project-thread-h9aw7r (the harness-pinned branch of the card thread; it names no issue, so this claim is the identity record)
Worktree: objectstack-issue-26791
Domain: domain:devx
Seat: domain:devx#1
File surface: docs/qa/platform-checklist/areas/attachments-storage.json only (the qa-scratch-authz recipe and the three items that opt into it). ⛔ No product change, no other area file (stop on breach)
Container & model: S, mode:thread (Warren's 「opus 很多，并发5」, 2026-10-27), model: default (no path-derived mandate, default opus), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: the #26621 card thread's out-of-scope finding (PR #26789, report 6446504361), filed by this seat; triage 6448463140
Thread-read: 6448463140
Premise: unmeasured by design — the card asks for a replay of steps 1–4 first; a replay that still saves closes the card with the reading and no edit
Serial constraints cleared: none. No open PR or sibling card thread edits areas/attachments-storage.json; no other devx seat is seated

Generated by Claude Code

os-dev-report

{
  "issue": 26791,
  "status": "done",
  "branch": "claude/project-thread-h9aw7r",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/26875",
  "session": "session_01JQwxbaHYyHsGWQpf3zrESP",
  "premise_still_valid": true,
  "summary": "Replayed qa-scratch-authz steps 1-4 REST only on a fresh stock showcase boot built from main 8eef9a8d: step 1 answered 201 with the derived namespace 'attachments', and steps 2-4 each answered 422 NAMESPACE_PREFIX ('Rename it to attachments_qa_vault'). Chose the declared namespace over a rename (one line against about 40 mentions across the recipe, step 6's set bodies and three items): step 1's manifest now declares namespace 'qa', which the qa_vault / qa_shared / qa_nofiles names already carry. On a second fresh boot the edited recipe, read from the file and sent literally, answered 201/200/200/200; step 6's three set saves answered 200 with the expected advisories, and the teardown DELETE answered 200 removing six rows. Provenance records the replay; download-authz-both-sides 6->7, read-inherits-parent-rls 8->9 and attach-requires-parent-edit 8->9 each take a history row citing #26791, with no clause or step text changed.",
  "tests": "No code changed, no test added. Live replay evidence (two fresh showcase boots at 8eef9a8d, pnpm dev -- --fresh -p PORT, stock posture) is in the PR body's Tests section: before = 201/422/422/422 NAMESPACE_PREFIX, objects 404 on read-back; after = 201/200/200/200, step 6 sets 200 x3, objects 200 on read-back, teardown 200 deletedCount 6. Full turbo build 118/118 before booting.",
  "gates": "Local, head 18458442 (main e9e344a9 merged in): dispatch-gates --commands derived 16, all exit 0: node scripts/check-adr-links.mjs :: exit 0; node scripts/check-adr-links.mjs --self-test :: exit 0; node scripts/check-closing-keyword-parity.mjs :: exit 0; node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0; node scripts/check-comment-mask-corpus.mjs :: exit 0; node scripts/ci/plan-test-core-shards.mjs --self-test :: exit 0; pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0; pnpm check:ci-filter-parity :: exit 0; pnpm check:cross-package-test-inputs :: exit 0; pnpm check:doc-authoring :: exit 0; pnpm check:driver-memory-census :: exit 0; pnpm check:gitlink-declared :: exit 0; pnpm check:nul-bytes :: exit 0; pnpm check:platform-checklist :: exit 0; pnpm check:refd-timer-probe :: exit 0; pnpm check:watch-hint-literal :: exit 0. --ran reconciliation: 16 derived, 16 run, 0 NOT-MEASURED, 0 UNRUN. check:platform-checklist first exited 1 on 41f0d710 (ABSENT SYMBOL: an anchor written at a call site, protocol-package-install.ts#deriveNamespaceFromPackageId); 18458442 cites packages/spec/src/kernel/namespace-prefix.ts#deriveNamespaceFromPackageId and the gate prints OK (8/8 recipes referenced, 13 references resolved). CI check-runs: in_progress at report time, not waited on.",
  "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "0",
  "api_writes": "2 — fleet-write relay pr_create (PR 26875, draft, assignee os-warren, label skip-changeset; 7111 bytes sent = stored), and this os-dev-report comment via post-stamped. git push x2 (not REST).",
  "open_questions": [],
  "out_of_scope_findings": [
    "class: c · reach: PUT /api/v1/meta/object/qa_media?package=com.objectstack.qa.media answers 422 NAMESPACE_PREFIX on a fresh showcase at 8eef9a8d ('Rename it to media_qa_media') · evidence: recipe qa-media-constraints in areas/attachments-storage.json step 2, measured on the same boot as this card's after-replay · dedupe words: qa-media-constraints, qa_media, NAMESPACE_PREFIX, com.objectstack.qa.media",
    "class: c · reach: PUT /api/v1/meta/object/qa_nofeeds?package=com.objectstack.qa.feeds answers 422 NAMESPACE_PREFIX on a fresh showcase at 8eef9a8d ('Rename it to feeds_qa_nofeeds') · evidence: recipe qa-feeds-disabled in areas/records-forms.json step 2, same boot · dedupe words: qa-feeds-disabled, qa_nofeeds, NAMESPACE_PREFIX, com.objectstack.qa.feeds",
    "carrier: none · noted, not filed: namespace 'qa' is now owned by com.objectstack.qa.attachments; a fix to either sibling recipe that also declares 'qa' would answer NAMESPACE_CONFLICT when both are installed on one boot (registry.ts NAMESPACE_CONFLICT_CODE), so those fixes should rename or declare another namespace"
  ]
}

Generated by Claude Code

ACCEPT → PR #26875 comment 6451706132

Generated by Claude Code

Landed: PR #26875 merged as a51ba639c1 · 2026-10-27T19:53Z

The qa-scratch-authz recipe's step 1 now declares namespace qa, so steps 2–4 create qa_vault / qa_shared / qa_nofiles instead of answering 422 NAMESPACE_PREFIX; the three opting-in items take revisions 7/9/9. ACCEPT → PR #26875 comment 6451706132. Follow-up filed from this card: #26876 (two more recipes with the same 422). The card leaves pm:dispatched.

Generated by Claude Code

Navigation Menu

Repository navigation

qa(checklist): the attachments-storage qa-scratch-authz recipe authors un-prefixed objects, which a package save now refuses with 422 NAMESPACE_PREFIX #26791

Finding (read on `main`; re-read before acting)

Wanted

Triage: first grade — `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T17:10Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

qa(checklist): the attachments-storage qa-scratch-authz recipe authors un-prefixed objects, which a package save now refuses with 422 NAMESPACE_PREFIX #26791

Description

Finding (read on main; re-read before acting)

Wanted

Activity

objectstack-fleet commented on Oct 27, 2026

Triage: first grade — priority:p2 · domain:devx · area:devpath · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-27T17:10Z

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Finding (read on `main`; re-read before acting)

Triage: first grade — `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T17:10Z