Repository navigation
QA run · release-18.3.0-w3-tier1-a (73/73) · c4c515ad · 2026-10-29 · 59 PASS / 14 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #27409
Description
domain:devx#1 · sunhaolin · session_017xRBcScm27Q3R5mkYLPWdB
Part of #27377 (wave 3, W3-C2a)
Selector release-18.3.0-w3-tier1-a: Tier 1 half A of the 18.3.0 release-candidate sweep, the 73 runnable items that carry automated.ref in access-security, ai, api-backend, approvals, attachments-storage, automation and cli. Release-candidate rerun (SKILL §5 trigger 1). Every item has a verdict: 59 PASS / 14 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN. No item is planned.
Environment fingerprint
- Subject: framework
c4c515ad3cc342043a2b81b5a06a5793f79a23e8(detached, never followed main). The Console was built in-repo from that same commit (ui/):pnpm build --concurrency=2(114/114 tasks), thenpnpm console:build --concurrency=2(cache hit plus copy).pnpm buildalone leftpackages/console/distabsent, so the first boots answered/_console503 untilconsole:buildran. Browser legs were re-driven after that. - Node v22.22.0, pnpm 10.31.0, Playwright chromium from
/opt/pw-browsers. - App:
examples/app-showcase. Canonical boot per area, each with its own port and file DB:OS_PORT=PORT OS_STORAGE_LOCAL_ROOT=/tmp/w3c2a/AREA/uploads setsid pnpm -C examples/app-showcase exec objectstack dev --ui --seed-admin -p PORT -d file:/tmp/w3c2a/AREA/data.db. Ports: cli 41411, ai 41412, approvals 41413, api-backend 41414, attachments-storage 41415, automation 41416 (plus a Vite console dev server on 41496 for the live Playwright spec), access-security 41417. - Extra boots: a walled
isolatedboot for access-security (OS_TENANCY_POSTURE, OS_PLATFORM_OWNER_EMAIL, OS_AUTH_MEMBERSHIP_POLICY); a second automation boot withOS_AUTOMATION_SCHEDULED_WORK_ENABLED=1from a scratch copy of the showcase; scratch apps and copies for cli under /tmp/w3c2a/cli; a local registry with no upstream for the cli scaffold pre-release leg (108 tarballs packed from c4c515a). - Seed:
--seed-admin(admin@objectos.ai), the showcase demo personas, and members minted by invite then sign-up (RUNNER environment facts). - Times: 2026-10-29 04:20Z to 05:30Z.
- Execution: one coordinating runner plus seven per-area runner subagents in parallel, each with its own port and DB. Their verdicts were checked against their evidence files and transcripts before this record was written. One subagent's self-reported minutes were inconsistent with its wall clock, so the time figures below use wall clock where they disagree.
Scope: selector and the revision each verdict is valid for
Revisions as node scripts/checklist-select.mjs reports them at c4c515a. All 73 match the area files.
- access-security (23): rls-both-sides r9, write-path-guards r8, record-access-explain r4, crud-permission-matrix r10, owd-sharing-matrix r6, fls-mask-and-strip r7, anonymous-deny-surfaces r5, public-form-withdrawal-layers r5, activation-write-operator-gate r12, platform-owner-email-anchor r11, me-permissions-aggregation-parity r4, record-view-read-audit r6, share-link-landing-page r6, anonymous-floor-v18-doors r5, walled-environment-metadata-operator-only r6, meta-authoring-trail-and-audience-gates r4, security-catalog-activation-and-clone-doors r3, security-catalog-one-holder-and-boot-report r4, grant-table-write-contract r8, parent-and-organization-write-guards r7, deployment-tables-platform-only r4, share-link-combined-gates r5, org-admin-assignment-boundary r2
- ai (6): mcp-http-surface r7, mcp-stdio-fail-closed r8, mcp-validate-expression r5, skill-instructions-mcp-prompts r4, mcp-oauth-private-host-transport r5, mcp-coded-refusals-and-runtime-exposure r3
- api-backend (13): query-contract-matrix r7, bulk-write-contract r6, declarative-endpoint-execution r6, packaged-action-disabled-dispatch r9, action-activation-door-contract r7, rest-crud-config-contract r6, rest-batch-config-contract r6, rest-metadata-config-contract r8, rest-route-generation-tombstones r4, second-object-exposure-and-internal-fields r3, data-request-shape-and-query-arity r4, meta-read-doors-v18 r4, error-sentences-and-unique-violation-wire-code r5
- approvals (4): email-action-token-door r9, status-mirror-field r5, request-page-reply-and-reader-visibility r4, act-door-and-admin-rescue-slate r5
- attachments-storage (10): presigned-upload-roundtrip r3, download-authz-both-sides r9, read-inherits-parent-rls r9, attach-requires-parent-edit r9, sys-file-status-pipeline r5, orphan-tombstone-reap r3, upload-session-abort r6, inline-grid-receipt-cells r5, upload-limits-scope-and-ownership r3, chunked-upload-integrity r8
- automation (10): trigger-type-matrix r9, screen-flow-roundtrip r7, durable-suspend-restart r3, paused-run-trigger-record-masked r5, setup-packaged-automation-board r10, flow-registration-verdict-on-read r2, flow-authoring-refusals-v18 r4, flow-run-semantics-v18 r3, inbound-hook-timestamped-signature r2, scheduled-work-opt-in r2
- cli (7): scaffold-first-run r7, dev-automigrate-policy r8, migrate-meta-write-stored-and-all r3, organization-ownership-ceremony r6, meta-package-flags-and-explain r3, validate-v18-authoring-verdicts r2, verify-derived-proof-families r3
Tier 1 pins: one vitest invocation per area per package
62 invocations at --maxWorkers=1 covered every pinned test file the 73 refs name: 279 file runs, 7488 passed, 0 failed, 3 skipped. The 3 skips are by design: two rls-multitenant cases and one cross-tenant matrix case. cli *.e2e.test.* ran separately under OS_TEST_TIERS=nightly. The ui jsdom suites ran from the ui/ root (the objectui vitest guard refuses a package-dir run).
| area | invocations | file runs | passed |
|---|---|---|---|
| access-security | 19 | 96 | 2249 |
| ai | 6 | 18 | 293 |
| api-backend | 7 | 51 | 1783 |
| approvals | 5 | 18 | 545 |
| attachments-storage | 6 | 27 | 667 |
| automation | 12 | 32 | 1076 |
| cli | 7 | 37 | 875 |
Live Playwright specs:
ui/e2e/live/screen-flow.spec.tswas run against the automation boot. 1 passed on the third attempt, after two runs that failed while the console dev server was still cold. Run 2 had completed server-side.ui/e2e/live/grid-file-upload.spec.tswas not run. That item was driven by hand against the built console instead.
Per RUNNER rule 6, each clause names the layer its pin drives. A pin below the clause's oracle scored the clause partial unless its live leg was driven on the area's boot.
Reproduction rules
None: 0 clause fail. The product defects found by off-clause probes are extracted as their own cards, each with its own reproduction. They are listed in the close-out comment.
Derived item verdicts
- PASS (59): every item not listed below.
- PARTIAL (14), each with the clause that kept it below PASS:
- access-security.rls-both-sides: A5. The D11 spot-check needs the maintainer-held write-up (qa(checklist): park the blocked partial-coverage gaps of the 17.7 pre-release runs (#21720, #21721, #21782, #21784) — each gets a fixture recipe, a pin, a re-pointed clause or a recorded knownGap #22017).
- access-security.crud-permission-matrix: A5. Guest create-without-read is not observable on a stock boot (security: no door can bind a permission set to the
guestanchor — ADR-0138 D3 item 5 has no enforcer (PUT /meta/position/guestanswers 403 NOT_OVERRIDABLE; guest suggestions are refused) #23267). - ai.mcp-oauth-private-host-transport: A0 blocked(fixture), the host holds no RFC1918 or link-local address. A2 partial, its private-address leg is missing.
- api-backend.action-activation-door-contract: A4. The 503 arm for a degraded metadata plane has no stock door and no pin.
- approvals.email-action-token-door: A0, A1, A3 and A4 are below the oracle (no pin and no stock door mints an action token). A5 blocked(fixture).
- approvals.status-mirror-field: A2. The user-less cascade refusal on an SLA auto-decision has service-unit evidence only.
- approvals.request-page-reply-and-reader-visibility: A2, no non-admin persona holds read on
sys_approval_requeston the stock showcase. A3, flipping the reader flag needs an object metadata write. - attachments-storage.read-inherits-parent-rls: A3. The bounded-probe half is reachable only through engine and unit pins.
- attachments-storage.sys-file-status-pipeline: A2. The deleted-row-with-live-holder half has no live door.
- attachments-storage.orphan-tombstone-reap: A1. The failed byte-delete veto has unit evidence only.
- attachments-storage.upload-session-abort: A3, the warning text is asserted only on a mock logger. A4,
failedis reachable only through a test seam. - automation.paused-run-trigger-record-masked: A0 and A1. No stock object has an
internal: truefield, so the internal-key-absent half rests on the in-process pin. - automation.setup-packaged-automation-board: A5. A plain member cannot open the Setup app, so the member's refusal is seen only as the server body.
- cli.organization-ownership-ceremony: A4. The drop gate was driven on the 18.0.0-next.5 dump, because no v17-shaped DB was provisioned.
Fixture gaps and partial-coverage gaps are parked on #27377. The anchor comment lists them.
Off-clause probes (RUNNER rule 8)
About 48 agent-minutes in total, after the clauses had verdicts, on the same boots and personas:
- access-security, ~6 min: the explain and share-link doors as admin, a plain member and the auditor; empty, unknown and missing ids. No finding. One cosmetic observation: the anonymous share page shows raw owner and organization ids.
- ai, ~2 min, short of budget: MCP HTTP auth with empty, unknown and revoked keys;
get_recordwith an empty id;validate_expressionwith empty or blank input and a bad site;prompts/getwith an empty name. Finding:validate_expressionanswers ok:true for a blank expression (extracted). - api-backend, ~10 min: list and query doors with boundary
$top,$skip,$orderby,$filter,$selectand$expandvalues; bulk doors as admin and two members. No defect. - approvals, ~10 min: the act page (no token, empty token, oversized token, a script token that came back escaped), the reply door, and member access to others' requests. No defect. One hardening note: the write routes answer 403 for an existing request and 404 for an unknown id. It is not exploitable, because it needs a signed-in member and reveals only whether a random UUID exists.
- attachments-storage, ~5 min:
aclflips by other personas; unknown, empty and malformed ids on download and complete; size and filename edges on presign; chunk-index edges; attaching another user's file. Findings: two defects in chunk-index and presign-size validation (extracted), and one more:- attachments-storage.download-authz-both-sides · observed beside the clauses · security finding — detail withheld, fix dispatched
- automation, ~8 min: run, screen and resume doors with unknown ids and bad inputs; toggle and clone edge cases; the action activation doors. Findings: cloning a packaged flow records no actor, and
/automation/_statusreports a time_relative flow as bound when its trigger refused it (both extracted). - cli, ~7 min:
meta registerwith a blank package,explainboundaries,migrate meta --fromboundaries, ceremony re-plan and re-apply. No defect. One low-severity observation:--from 99warns but is not refused.
Time: environment prep vs testing
- Environment prep: cold install plus
pnpm buildtook 13 min wall (04:21Z to 04:34Z), plus 1 min ofconsole:build, plus about 39 agent-minutes of per-area boots and fixtures. - Testing: the pin batches took 26 min wall (04:34Z to 05:00Z), plus about 167 agent-minutes of clause scoring and live legs, plus about 48 agent-minutes of probes.
- Ratio: about 1 to 4.5. Wall clock for the whole run was about 70 min.
Per-clause verdicts
One row per acceptance clause, with the layer and one line of text oracle evidence. Each negative[] entry was checked under the clause it guards. access-security is below; ai, api-backend and approvals are in the first comment; attachments-storage, automation and cli are in the second.
access-security
| item · rev | clause | verdict | layer · text evidence |
|---|---|---|---|
| access-security.rls-both-sides · r9 | A0 | pass | HTTP-in-process: showcase-private-owd.dogfood.test.ts — 8 passed (in-process HTTP stack via app.request): 'a member LISTS only the notes they own', 'the OTHER member is symmetric' |
| access-security.rls-both-sides · r9 | A1 | pass | HTTP-in-process: showcase-private-owd: 'a member cannot READ another owner's note by id', 'a foreign by-id read is non-2xx' passed |
| access-security.rls-both-sides · r9 | A2 | pass | HTTP-in-process: showcase-private-owd: 'a refused foreign PATCH leaves the row byte-identical on the admin re-read' passed (negative[0] held) |
| access-security.rls-both-sides · r9 | A3 | pass | HTTP-in-process: showcase-private-owd: 'the admin (platform posture) lists every note this file created — the entitled side' passed |
| access-security.rls-both-sides · r9 | A4 | pass | CLI-spawn: objectstack verify --rls (examples/app-showcase, own invocation, exit 0): per-persona line '21 PROVEN (21 consistent, 0 HOLES) · 3 NOT PROVEN (0 member-visible, 0 probe-blocked, 3 skipped)'; total '38 PROVEN (38 consis… |
| access-security.rls-both-sides · r9 | A5 | partial | CLI-spawn: skip half pass: 3 skipped rows each explained (showcase_project_membership 'no plain-text probe field'; ext_customer/ext_order 'external read-only object'); D11 spot-check blocked(dependency, #22017 row 11) |
| access-security.write-path-guards · r8 | A0 | pass | HTTP-in-process: showcase-static-readonly.dogfood.test.ts — 4 passed (in-process HTTP) incl. the INSERT strip ADVERTISED case (droppedFields + X-ObjectStack-Dropped-Fields) |
| access-security.write-path-guards · r8 | A1 | pass | HTTP-in-process: showcase-static-readonly.dogfood.test.ts UPDATE strip case passed (4/4) |
| access-security.write-path-guards · r8 | A2 | pass | HTTP-in-process: owner-anchor-and-bulk-writes.dogfood.test.ts — 12 passed (in-process HTTP): member owner forge refused, row not created |
| access-security.write-path-guards · r8 | A3 | pass | HTTP-in-process: owner-anchor-and-bulk-writes: transfer/disown refused with owner unchanged, self-owner insert 2xx; admin 'a privileged caller CAN …' cases passed (negative[0]) |
| access-security.write-path-guards · r8 | A4 | pass | HTTP-in-process: owner-anchor-and-bulk-writes: member REST createMany of 3 rows reads back owner_id == caller (12/12 passed) |
| access-security.write-path-guards · r8 | A5 | pass | HTTP-in-process: showcase-readonly-when-parent.dogfood.test.ts — 9 passed (in-process HTTP): paid invoice/lines locked; mixed updateMany per-row droppedFields reason readonly_when |
| access-security.write-path-guards · r8 | A6 | pass | HTTP-in-process: showcase-readonly-when-parent: continueOnError updateMany total 3/succeeded 2/failed 1, violating row VALIDATION_FAILED unchanged (9/9 passed) |
| access-security.record-access-explain · r4 | A0 | pass | browser (live /_console, booted server): Studio Access pillar > Explain access, user=auditor/plain, showcase_private_note, probe record: screenshot shows 10 layers + 'Record … is VISIBLE / NOT visible', 'Decided by: View/Modify A… |
| access-security.record-access-explain · r4 | A1 | pass | HTTP-booted-server: POST /api/v1/security/explain as admin {userId:auditor, recordId}: 200, record {visible:true, decidedBy:'vama_bypass'}, layer vama_bypass contributors [showcase_auditor] (pin zoo explain case is in-process onl… |
| access-security.record-access-explain · r4 | A2 | pass | HTTP-booted-server: auditor: explain visible:true ∧ GET /data/showcase_private_note/‹id> 200; plain member: explain visible:false ∧ GET 404 RECORD_NOT_FOUND |
| access-security.record-access-explain · r4 | A3 | pass | HTTP-booted-server: plain-member explain: 200, record {visible:false, decidedBy:'sharing'}, no EXPLAIN_FAILED; negative[0]: admin asking, principal is the plain member (sets [showcase_member_default, member_default]) |
| access-security.record-access-explain · r4 | A4 | pass | browser + HTTP-booted-server: panel's own /security/explain network body vs my API-twin body: identical layer ids/verdicts/contributors/record outcomes for both personas (compare=true); panel text renders the same 10 layers |
| access-security.crud-permission-matrix · r10 | A0 | pass | HTTP-in-process: showcase-crud-persona-matrix.dogfood.test.ts — 49 passed (in-process HTTP): every allowed cell 2xx + persisted; plus verify --rls CRUD tail 15 verified, 0 FAILED |
| access-security.crud-permission-matrix · r10 | A1 | pass | HTTP-in-process: crud-persona-matrix: denials 403 PERMISSION_DENIED; 'the 16 showcase_field_ops_delegate × sys_* cells answer the matrix' (405 on sys_user create/delete) passed |
| access-security.crud-permission-matrix · r10 | A2 | pass | HTTP-in-process: crud-persona-matrix sweep asserts denied CREATE leaves no row (49/49 passed) |
| access-security.crud-permission-matrix · r10 | A3 | pass | HTTP-in-process: crud-persona-matrix: 'viewAllRecords: the auditor reads a FOREIGN private note…' and '…inquiry, invoice and invoice line…' passed |
| access-security.crud-permission-matrix · r10 | A4 | pass | HTTP-in-process: crud-persona-matrix: 'modifyAllRecords: ops PATCHes a FOREIGN announcement; the same PATCH by a plain member is denied' passed |
| access-security.crud-permission-matrix · r10 | A5 | blocked | n/a: blocked(dependency, #23267): no door binds a set to the guest anchor (knownGaps[2]); not attempted |
| access-security.crud-permission-matrix · r10 | A6 | pass | HTTP-in-process: crud-persona-matrix: 'records the verdict of every cell…' + 41 showcase_* rows + delegate × sys_* case; plus verify --rls RLS block (21 PROVEN, 0 HOLES) |
| access-security.owd-sharing-matrix · r6 | A0 | pass | HTTP-in-process: showcase-private-owd.dogfood.test.ts — 8 passed (in-process HTTP) |
| access-security.owd-sharing-matrix · r6 | A1 | pass | HTTP-in-process: showcase-public-read-owd.dogfood.test.ts — 4 passed (in-process HTTP); live corroboration: plain member GET of admin announcement by id 200 |
| access-security.owd-sharing-matrix · r6 | A2 | pass | HTTP-in-process: showcase-crud-persona-matrix modifyAllRecords case passed |
| access-security.owd-sharing-matrix · r6 | A3 | pass | HTTP-in-process: showcase-crud-persona-matrix: contributor × showcase_project edit 2xx persisted; member_default × project edit 403 (49/49); live: C PATCH 200, P PATCH 403 PERMISSION_DENIED |
| access-security.owd-sharing-matrix · r6 | A4 | pass | HTTP-in-process: showcase-invoice-line-contributor-pair.dogfood.test.ts — 5 passed (in-process HTTP); D11 verdict recorded on rls-both-sides acceptance[5] only (dedupe #7687) |
| access-security.owd-sharing-matrix · r6 | A5 | pass | HTTP-in-process: invoice-line-contributor-pair: auditor list and by-id carry C1 line (5/5 passed) |
| access-security.owd-sharing-matrix · r6 | A6 | pass | HTTP-in-process: all four models driven by the cited pins: private, public_read, public_read_write, controlled_by_parent (+ controlled-by-parent 4, showcase-invoice-cbp 4 passed) |
| access-security.fls-mask-and-strip · r7 | A0 | pass | HTTP-in-process: showcase-permission-zoo.dogfood.test.ts — 12 passed (in-process HTTP) 'FLS: a contributor can edit a project but NOT its budget fields'; live: C name PATCH 200 |
| access-security.fls-mask-and-strip · r7 | A1 | pass | HTTP-in-process: zoo FLS case passed; live: C budget PATCH 403 '[Security] Field write denied … [budget]', admin re-read 90000 before/after |
| access-security.fls-mask-and-strip · r7 | A2 | pass | HTTP-in-process: zoo 'FLS: the admin's budget write on the same project succeeds and persists' passed |
| access-security.fls-mask-and-strip · r7 | A3 | pass | browser (live /_console): contributor edit form …/showcase_project/record/‹id>/edit rendered (screenshot): budget input disabled=true, spent disabled=true, 'You do not have edit access to this field'; name enabled |
| access-security.fls-mask-and-strip · r7 | A4 | pass | HTTP-in-process + browser: showcase-fls-read-mask-strip.dogfood.test.ts — 8 passed (in-process HTTP); live stock showcase_client_liaison member: API record lacks budget/spent/budget_remaining keys, UI detail shows no Budget; admi… |
| access-security.anonymous-deny-surfaces · r5 | A0 | pass | HTTP-in-process: showcase-anonymous-deny-surfaces.dogfood.test.ts — 75 passed (in-process HTTP, platform-default posture) |
| access-security.anonymous-deny-surfaces · r5 | A1 | pass | HTTP-in-process: showcase-anonymous-deny-surfaces.dogfood.test.ts — 75 passed (in-process HTTP, platform-default posture): action probe nonexistent id 401 |
| access-security.anonymous-deny-surfaces · r5 | A2 | pass | HTTP-in-process: showcase-anonymous-deny-surfaces.dogfood.test.ts — 75 passed (in-process HTTP, platform-default posture) |
| access-security.anonymous-deny-surfaces · r5 | A3 | pass | HTTP-in-process: showcase-anonymous-deny-surfaces.dogfood.test.ts — 75 passed (in-process HTTP, platform-default posture) |
| access-security.anonymous-deny-surfaces · r5 | A4 | pass | HTTP-in-process: showcase-anonymous-deny-surfaces.dogfood.test.ts — 75 passed (in-process HTTP, platform-default posture) |
| access-security.anonymous-deny-surfaces · r5 | A5 | pass | HTTP-in-process: showcase-anonymous-deny-surfaces.dogfood.test.ts — 75 passed (in-process HTTP, platform-default posture): anonymous GET /forms/contact-us 200 |
| access-security.anonymous-deny-surfaces · r5 | A6 | pass | HTTP-in-process: showcase-anonymous-deny-surfaces.dogfood.test.ts — 75 passed (in-process HTTP, platform-default posture): all seven variant families driven |
| access-security.public-form-withdrawal-layers · r5 | A0 | pass | HTTP-in-process: showcase-public-form-withdrawal-layers.dogfood.test.ts — 4 passed (in-process HTTP): save 200 env-wide, both doors 404 FORM_NOT_FOUND, 0 rows |
| access-security.public-form-withdrawal-layers · r5 | A1 | pass | HTTP-in-process: same file: both doors open, row lands in the active organization (4/4) |
| access-security.public-form-withdrawal-layers · r5 | A2 | pass | plugin-unit: packages/rest/src/public-form-withdrawal.test.ts — 27 passed (RestServer over mocked protocol) + metadata-core anonymous-form-intake.test.ts 47 passed (test oracle) |
| access-security.public-form-withdrawal-layers · r5 | A3 | pass | plugin-unit: public-form-withdrawal.test.ts kill-switch describe (27 passed) + protocol.org-scoped-write-refused.test.ts 306 passed (in-process protocol, stub registry) |
| access-security.public-form-withdrawal-layers · r5 | A4 | pass | plugin-unit: anonymous-form-intake.test.ts schema-parsed false case + protocol block (a) passed (47 / 306) |
| access-security.public-form-withdrawal-layers · r5 | A5 | pass | plugin-unit: protocol.org-scoped-write-refused.test.ts block (c) package-less env-wide copy cases passed (306) |
| access-security.activation-write-operator-gate · r12 | A0 | pass | HTTP-in-process: activation-write-operator-gate-single.dogfood.test.ts — 11 passed (in-process HTTP, stock single): flow toggle 403 FLOW_ENABLEMENT_DENY_MESSAGE (tier, not §5) |
| access-security.activation-write-operator-gate · r12 | A1 | pass | HTTP-in-process: same file: action door 403 'a packaged action' / 'functionally equivalent to deleting it' |
| access-security.activation-write-operator-gate · r12 | A2 | pass | HTTP-in-process: same file: {enabled:"false"} still 403 at both doors; no sys_metadata_activation row |
| access-security.activation-write-operator-gate · r12 | A3 | pass | HTTP-in-process: same file: runtime manage_metadata set without platform_admin admitted 200 at both doors, row key set has no organization_id |
| access-security.activation-write-operator-gate · r12 | A4 | pass | plugin-unit + HTTP-booted-server (walled): automation-activation-posture-gate 19 + action-activation-posture-gate 29 passed; live isolated boot: org owner with manage_metadata 403 PERMISSION_DENIED naming 'isolated' posture + 'pl… |
| access-security.activation-write-operator-gate · r12 | A5 | pass | plugin-unit: isSystem arms in automation-activation-posture-gate.test.ts (19) / action-activation-posture-gate.test.ts (29) passed; live restart re-hydration line not separately read |
| access-security.platform-owner-email-anchor · r11 | A0 | pass | HTTP-in-process: platform-owner-email-anchor.dogfood.test.ts — 6 passed (in-process HTTP, restarted deployments on one DB): unset → M 403, admin 200 |
| access-security.platform-owner-email-anchor · r11 | A1 | pass | HTTP-in-process: same file: unverified match confers nothing |
| access-security.platform-owner-email-anchor · r11 | A2 | pass | HTTP-in-process: same file: non-matching address confers nothing; admin still 200 |
| access-security.platform-owner-email-anchor · r11 | A3 | pass | HTTP-in-process: same file: [authz] refusal printed once naming the entry, M refused while verified |
| access-security.platform-owner-email-anchor · r11 | A4 | pass | engine: resolve-authz-context.platform-admin-config.test.ts — 37 passed (unit over resolver) + dogfood live leg with system-stamped email_verified (6/6) |
| access-security.platform-owner-email-anchor · r11 | A5 | pass | engine: resolve-authz-context.platform-admin-config.test.ts L5 + ADR-0131 D5 describes (37) + platform-admin.test.ts 25 + admin-standing-surface.test.ts 10 passed |
| access-security.me-permissions-aggregation-parity · r4 | A0 | pass | HTTP-booted-server: C map showcase_project allowEdit:true → C PATCH 200 persisted; P map allowEdit:false → P PATCH 403 PERMISSION_DENIED |
| access-security.me-permissions-aggregation-parity · r4 | A1 | pass | HTTP-booted-server: C fields['showcase_project.budget'] {readable:true,editable:false}; C budget PATCH 403, value 90000 unchanged; C GET carries budget 90000 |
| access-security.me-permissions-aggregation-parity · r4 | A2 | pass | HTTP-booted-server: /me/apps: admin [showcase_app, setup(setup.access), account], P [showcase_app, account]; 0 apps violate requiredPermissions ⊆ systemPermissions or tab hidden for admin/P/C/W |
| access-security.me-permissions-aggregation-parity · r4 | A3 | pass | HTTP-booted-server: anonymous: /auth/me/permissions 200 {authenticated:false}, /auth/me/localization 200 {authenticated:false}, /me/apps 200 {apps:[]} |
| access-security.me-permissions-aggregation-parity · r4 | A4 | pass | HTTP-booted-server: P ?userId=‹C id> on /auth/me/permissions returns P's own userId and a body identical to P's own; localization likewise P's |
| access-security.me-permissions-aggregation-parity · r4 | A5 | pass | HTTP-booted-server: P localization 200 {currency:null, locale:'en-US', timezone:'UTC'}; after admin PUT /api/settings/localization {currency:EUR,timezone:Asia/Shanghai} → EUR / Asia/Shanghai (restored after) |
| access-security.me-permissions-aggregation-parity · r4 | A6 | pass | HTTP-booted-server: W (sets incl organization_admin_no_bypass, no admin_full_access): zoo entry present + read 200; project allowEdit:true, own PATCH 200; sys_secret absent from map, read 403; only sys_secret + sys_flow_credentia… |
| access-security.record-view-read-audit · r6 | A0 | pass | HTTP-in-process: record-view-read-audit.dogfood.test.ts — 7 passed (in-process HTTP with AuditPlugin): stock boot 0 read rows, no install line |
| access-security.record-view-read-audit · r6 | A1 | pass | HTTP-in-process: same file: install line 'on 1 object(s) — showcase_account', one row per detail read, un-opted read none |
| access-security.record-view-read-audit · r6 | A2 | pass | HTTP-in-process: same file: row action read, user_id M, old/new null, created_at in read window |
| access-security.record-view-read-audit · r6 | A3 | pass | HTTP-in-process: same file: filtered LIST read leaves count unchanged |
| access-security.record-view-read-audit · r6 | A4 | pass | HTTP-in-process: same file: exclusion warning names sys_job; install set omits it |
| access-security.record-view-read-audit · r6 | A5 | pass | plugin-unit: read-audit.test.ts — 33 passed (plugin unit) isSystem/no-principal skips; audit-plugin.test.ts 21 passed |
| access-security.share-link-landing-page · r6 | A0 | pass | browser (live /_console) + network: link_only link with per-link redact [summary]: resolve 200 body has no internal_notes/deal_value/summary values (150000 absent); page renders record + 'Some fields are hidden by the owner: inte… |
| access-security.share-link-landing-page · r6 | A1 | pass | browser + network: password link: 401 NEEDS_PASSWORD → 'Password required'; wrong → 401 WRONG_PASSWORD 'Wrong password.'; right → 200 render; both 401 bodies record-free |
| access-security.share-link-landing-page · r6 | A2 | pass | browser (screenshot) + network: revoked and expired: 'This link has expired or was revoked.' (410 EXPIRED_OR_REVOKED); garbage token: 'This link is invalid or no longer available.' (404 INVALID_OR_EXPIRED); bodies record-free |
| access-security.share-link-landing-page · r6 | A3 | pass | browser + network: signed_in link anonymous: 401 SIGN_IN_REQUIRED record-free, 'Sign in required' + 'The owner shared this link with signed-in users only.', Sign in href /_console/login?redirect=%2Fs%2F‹token>, 0 password inputs;… |
| access-security.share-link-landing-page · r6 | A4 | pass | browser (screenshot): fresh context /s/‹token> renders standalone layout with no console chrome/sidebar and no login redirect |
| access-security.anonymous-floor-v18-doors · r5 | A0 | pass | HTTP-in-process: all 8 named files ≥1 test, 0 failed: anonymous-floor-v18-doors 13, showcase-anonymous-deny-surfaces 75, anonymous-door-sweep 20, rest-api-description-anonymous-deny 9, rest-docs-viewer-retired 6, i18n-anonymous-d… |
| access-security.anonymous-floor-v18-doors · r5 | A1 | pass | HTTP-in-process: anonymous-floor-v18-doors: six doors 401 UNAUTHENTICATED/AUTH_REQUIRED, admin control 200 (/keys 405) (13/13) |
| access-security.anonymous-floor-v18-doors · r5 | A2 | pass | HTTP-in-process: showcase-anonymous-deny-surfaces retired-viewer case: GET /api/v1/docs 404 = control body, all callers |
| access-security.anonymous-floor-v18-doors · r5 | A3 | pass | HTTP-in-process: anonymous-floor-v18-doors: BOGUS token resolve non-401 4xx (live probe: /share-links/%20/resolve 404 INVALID_OR_EXPIRED) |
| access-security.anonymous-floor-v18-doors · r5 | A4 | pass | HTTP-in-process: anonymous-floor-v18-doors: anonymous submit 201 body keys ['id'], forged fields not stored |
| access-security.walled-environment-metadata-operator-only · r6 | A0 | pass | HTTP-in-process: all 7 files 0 failed: meta-migrate-stored-walled-refusal 6, packages-walled-write-refusal 30, automation-walled-definition-write 12, meta-walled-catalog-refusal 19, wall-environment-metadata-refusal 23, wall-cata… |
| access-security.walled-environment-metadata-operator-only · r6 | A1 | pass | HTTP-booted-server (walled): isolated boot, org-A owner holding manage_metadata (not platform_admin), 2 rounds: PUT meta/object 403 FORBIDDEN (read-back 404), PUT meta/permission 403 FORBIDDEN, view publish 403 FORBIDDEN, DELETE … |
| access-security.walled-environment-metadata-operator-only · r6 | A2 | pass | HTTP-booted-server: walled operator: PUT meta/object/qa_walled_probe 200 + read-back 200 (deleted after), clone 200; single boot: admin same PUT 200 + read-back 200 |
| access-security.meta-authoring-trail-and-audience-gates · r4 | A0 | pass | HTTP-in-process: meta-view-audience-alternate-doors 8, wall-authoring-trail-doors 31, meta-history-diff-authoring-door 20, meta-view-dashboard-audience-gate 19 — 0 failed |
| access-security.meta-authoring-trail-and-audience-gates · r4 | A1 | pass | HTTP-in-process: wall-authoring-trail-doors single describe: history/audit/diff 403 FORBIDDEN, /packages/:id/commits 403 PERMISSION_DENIED (31 passed) |
| access-security.meta-authoring-trail-and-audience-gates · r4 | A2 | pass | HTTP-in-process: meta-view-audience-alternate-doors: gated view absent from list, by-name/published/layers/draft 403 PERMISSION_DENIED, /history FORBIDDEN first vs studio.access PERMISSION_DENIED; ETag replay 403 not 304 (8 passe… |
| access-security.security-catalog-activation-and-clone-doors · r3 | A0 | pass | HTTP-in-process: catalog-activation-door.dogfood 10, permission-set-clone-door.dogfood 7, runtime catalog-activation-door 71, permission-set-clone 23 — 0 failed |
| access-security.security-catalog-activation-and-clone-doors · r3 | A1 | pass | HTTP-in-process: catalog-activation-door.dogfood: position off 200, one row, grants stop/return |
| access-security.security-catalog-activation-and-clone-doors · r3 | A2 | pass | HTTP-in-process: catalog-activation-door.dogfood: everyone/guest 400 naming anchor, unknown 404 |
| access-security.security-catalog-activation-and-clone-doors · r3 | A3 | pass | HTTP-in-process: permission-set-clone-door.dogfood: 200 facets w/o adminScope/isDefault/packageId; 409; 404; 400; 403; 401 (7 passed); live walled operator clone 200 |
| access-security.security-catalog-one-holder-and-boot-report · r4 | A0 | pass | HTTP-in-process: security-catalog-one-holder-http 4, cold-boot-environment-holder 4, standalone-stack one-holder 6, cli security-catalog-overlays.integration 6, catalog-reference-report 15, permission-set-owner-binding 19, permis… |
| access-security.security-catalog-one-holder-and-boot-report · r4 | A1 | pass | HTTP-in-process: one-holder-http: install-local 422 PLUGIN_REGISTER_FAILED naming showcase_auditor + com.example.showcase, /packages unchanged |
| access-security.security-catalog-one-holder-and-boot-report · r4 | A2 | pass | HTTP-in-process: one-holder-http: PUT meta/permission with foreign packageId 400 VALIDATION_ERROR at packageId |
| access-security.security-catalog-one-holder-and-boot-report · r4 | A3 | pass | CLI-in-process (oclif): security-catalog-overlays.integration.test.ts 6 passed: preview exit 1 with rows, --apply --yes exit 0, --json listed/deleted/rows |
| access-security.security-catalog-one-holder-and-boot-report · r4 | A4 | pass | HTTP-in-process (captured process output): one-holder-http: clean boot one INFO line; reboot with 51 orphan grants logs one ERROR '[security] 51 … grant(s) …' capped at 50 |
| access-security.grant-table-write-contract · r8 | A0 | pass | HTTP-in-process: grant-table-write-contract.dogfood 3, permission-set-assignment-window.dogfood 7, grant-permission-set-name 16, window-order 11, granted-by-writer-provenance 20, grant-holder-membership-refusal 21 — 0 failed |
| access-security.grant-table-write-contract · r8 | A1 | pass | HTTP-in-process: grant-table-write-contract: permission_set_id 400 INVALID_FIELD, duplicate 409 UNIQUE_VIOLATION |
| access-security.grant-table-write-contract · r8 | A2 | pass | HTTP-in-process: permission-set-assignment-window: inverted window 400 VALIDATION_FAILED [[valid_until, rule_violation]], no 'unevaluable'; valid window 201 |
| access-security.grant-table-write-contract · r8 | A3 | pass | HTTP-in-process: grant-table-write-contract: granted_by naming another user stores the caller |
| access-security.grant-table-write-contract · r8 | A4 | pass | HTTP-booted-server (walled): isolated boot: org-A owner grants showcase_contributor to two non-members of org A → 400 VALIDATION_FAILED fields[0] {field:user_id, code:reference_not_found}; self-grant control 201 |
| access-security.parent-and-organization-write-guards · r7 | A0 | pass | HTTP-in-process: parent-and-organization-write-guards 6, cbp-parent-attachment-comment-gates 10, cbp-explain-master-write 20, tenant-wall-organization-removal 34, engine-unreadable-master-detail-header 30, engine-predicate-relate… |
| access-security.parent-and-organization-write-guards · r7 | A1 | pass | HTTP-booted-server (walled): isolated boot: owner PATCH own showcase_private_note {organization_id:null} 403 PERMISSION_DENIED, org kept; title PATCH 200 (control); inserts with organization_id null and '' stamped org A (also pin… |
| access-security.parent-and-organization-write-guards · r7 | A2 | pass | HTTP-in-process: parent-and-organization-write-guards: unreadable vs nonexistent header same 400 reference_not_found body; cbp detail one 403 body |
| access-security.parent-and-organization-write-guards · r7 | A3 | pass | HTTP-in-process: cbp-parent-attachment-comment-gates (10) ATTACHMENT_PARENT_ACCESS / ATTACHMENT_DELETE_DENIED; cbp-explain-master-write (20) explain not-writable by sharing matches PATCH |
| access-security.deployment-tables-platform-only · r4 | A0 | pass | HTTP-in-process: deployment-tables-platform-only.dogfood 15, deployment-level-no-tenant-column 31, sys-flow-dispatch.object 4, sys-presence.object 12 — 0 failed |
| access-security.deployment-tables-platform-only · r4 | A1 | pass | HTTP-in-process: deployment-tables-platform-only: org admin 403 PERMISSION_DENIED on all seven, platform admin 200 |
| access-security.deployment-tables-platform-only · r4 | A2 | pass | HTTP-in-process: same file: organization_id filter 400 INVALID_FIELD on all seven |
| access-security.share-link-combined-gates · r5 | A0 | pass | HTTP-in-process: share-link-combined-gates.dogfood 4, share-link-eligibility 43, share-link-envelope.conformance 26, share-links-messages-audience 85, share-links-refusal-order 60 — 0 failed |
| access-security.share-link-combined-gates · r5 | A1 | pass | HTTP-in-process: combined-gates: link A three variants 401 SIGN_IN_REQUIRED byte-identical |
| access-security.share-link-combined-gates · r5 | A2 | pass | HTTP-in-process: combined-gates: link B five variants 404 INVALID_OR_EXPIRED byte-identical with unknown token; control 200 |
| access-security.share-link-combined-gates · r5 | A3 | pass | HTTP-in-process: combined-gates: /messages 404 NOT_FOUND where /resolve refused, 400 UNSUPPORTED where it passed |
| access-security.org-admin-assignment-boundary · r2 | A0 | pass | engine: org-admin-assignment-boundary.posture.test.ts 60, delegated-admin-gate.test.ts 137, rbac-objects.test.ts 13 — 0 failed |
| access-security.org-admin-assignment-boundary · r2 | A1 | pass | engine: posture file per-cell in/out-of-boundary cases, three postures (60 passed) |
| access-security.org-admin-assignment-boundary · r2 | A2 | pass | engine: posture file platform and member cells (60 passed) |
| access-security.org-admin-assignment-boundary · r2 | A3 | pass | engine: posture file report/explain case per posture (60 passed) |
Derived: rls-both-sides PARTIAL · write-path-guards PASS · record-access-explain PASS · crud-permission-matrix PARTIAL · owd-sharing-matrix PASS · fls-mask-and-strip PASS · anonymous-deny-surfaces PASS · public-form-withdrawal-layers PASS · activation-write-operator-gate PASS · platform-owner-email-anchor PASS · me-permissions-aggregation-parity PASS · record-view-read-audit PASS · share-link-landing-page PASS · anonymous-floor-v18-doors PASS · walled-environment-metadata-operator-only PASS · meta-authoring-trail-and-audience-gates PASS · security-catalog-activation-and-clone-doors PASS · security-catalog-one-holder-and-boot-report PASS · grant-table-write-contract PASS · parent-and-organization-write-guards PASS · deployment-tables-platform-only PASS · share-link-combined-gates PASS · org-admin-assignment-boundary PASS
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 29, 2026
domain:devx#1 · sunhaolin · session_017xRBcScm27Q3R5mkYLPWdB
Per-clause verdicts, part 2 of 3 (ai · api-backend · approvals) — the record body holds access-security, part 3 holds attachments-storage · automation · cli.
ai
Derived: mcp-http-surface PASS · mcp-stdio-fail-closed PASS · mcp-validate-expression PASS · skill-instructions-mcp-prompts PASS · mcp-oauth-private-host-transport PARTIAL · mcp-coded-refusals-and-runtime-exposure PASS
api-backend
Derived: query-contract-matrix PASS · bulk-write-contract PASS · declarative-endpoint-execution PASS · packaged-action-disabled-dispatch PASS · action-activation-door-contract PARTIAL · rest-crud-config-contract PASS · rest-batch-config-contract PASS · rest-metadata-config-contract PASS · rest-route-generation-tombstones PASS · second-object-exposure-and-internal-fields PASS · data-request-shape-and-query-arity PASS · meta-read-doors-v18 PASS · error-sentences-and-unique-violation-wire-code PASS
approvals
Derived: email-action-token-door PARTIAL · status-mirror-field PARTIAL · request-page-reply-and-reader-visibility PARTIAL · act-door-and-admin-rescue-slate PASS
Generated by Claude Code
objectstack-fleet commentedon Oct 29, 2026
domain:devx#1 · sunhaolin · session_017xRBcScm27Q3R5mkYLPWdB
Per-clause verdicts, part 3 of 3 (attachments-storage · automation · cli).
attachments-storage
Derived: presigned-upload-roundtrip PASS · download-authz-both-sides PASS · read-inherits-parent-rls PARTIAL · attach-requires-parent-edit PASS · sys-file-status-pipeline PARTIAL · orphan-tombstone-reap PARTIAL · upload-session-abort PARTIAL · inline-grid-receipt-cells PASS · upload-limits-scope-and-ownership PASS · chunked-upload-integrity PASS
automation
Derived: trigger-type-matrix PASS · screen-flow-roundtrip PASS · durable-suspend-restart PASS · paused-run-trigger-record-masked PARTIAL · setup-packaged-automation-board PARTIAL · flow-registration-verdict-on-read PASS · flow-authoring-refusals-v18 PASS · flow-run-semantics-v18 PASS · inbound-hook-timestamped-signature PASS · scheduled-work-opt-in PASS
cli
@objectstack/*); repo bin scaffold exit 0, pnpm install ok (no "Dependency installation failed"), validate 0,…npm run validateexit 0,npm run buildexit 0 -> dist/objectstack.json 2.5KB; lockfile integrity of all 60@objectstack/*entries == local tarball sha512npx os start --artifact ./dist/objectstack.json --port 41411booted healthy (no RC skew: scaffold pins 18.2.0 == candidate tarballs); health 200, ready exit 0@objectstack/skills@18.2.0 dist/skills by name (11=11), 0 symlinks, no .agents, no dogfood-verification; GitHub-path `skills add ‹checkout>/skills …os dev -d file:host.dbwith no authored key: "[schema-drift] auto-reconciled replace_unique_index on qaam2_item.uq_field", legacy index gone; replanted +os start(non-dev): warnin…os migrate meta --from 17exit 0, tree checksum bae216a5dfd7b53b before == aftermigrate apply --allow-destructive --yes --jsonexit 1, message refused_organization_ownership_unmigrated, tables [sy…os explain field-no-consumersexit 0; --json {rule,covers,paragraphs}; no arg lists schemas + "Rule Explanations" (field-no-consumers present) exit 0; no_such_rule exit 1 "Unknown schema or rule id"Derived: scaffold-first-run PASS · dev-automigrate-policy PASS · migrate-meta-write-stored-and-all PASS · organization-ownership-ceremony PARTIAL · meta-package-flags-and-explain PASS · validate-v18-authoring-verdicts PASS · verify-derived-proof-families PASS
Generated by Claude Code
objectstack-fleet commentedon Oct 29, 2026
domain:devx#1 · sunhaolin · session_017xRBcScm27Q3R5mkYLPWdB
Close-out for this record (SKILL §5).
Extracted: #27411 · ai.mcp-validate-expression · observed beside the clauses
Extracted: #27412 · attachments-storage.chunked-upload-integrity · observed beside the clauses
Extracted: #27413 · attachments-storage.presigned-upload-roundtrip · observed beside the clauses
Extracted: #27414 · automation.setup-packaged-automation-board · observed beside the clauses
Extracted: #27415 · automation.trigger-type-matrix · observed beside the clauses
Parked-on: #27377 · 14 PARTIAL items: coverage gaps, fixture gaps and checklist-accuracy findings (listed in the anchor comment)
Four-way disposition: there is no clause
failin this run (0 FAIL), so no fail row needs a disposition.All five extracted cards are product defects found by off-clause probes. Each is filed without
qa-runorpm:*labels so triage grades it.One further probe finding is an authorization finding. Under the maintainer's 2026-10-29 disclosure ruling it is not filed on GitHub, and its fix was dispatched directly. Its row in the record body reads only "security finding — detail withheld, fix dispatched".
Generated by Claude Code
objectstack-fleet commentedon Oct 29, 2026
domain:devx#1 · sunhaolin · session_017xRBcScm27Q3R5mkYLPWdB
Closing at 2026-10-29T05:39Z: the close-out is complete. Five product defects were extracted (#27411 to #27415). The 14 PARTIAL coverage gaps, the fixture gaps and the checklist-accuracy findings are parked on #27377 (comment 6488948228). There was no clause fail, so no fail row needs a disposition.
Generated by Claude Code
docs(qa): wave-3 accuracy slice S3 — access-security + identity-auth …