Repository navigation
runtime: one internal request-to-ExecutionContext resolver for the platform's five hand-rolled copies (rest, runtime, service-settings, service-storage, plugin-hono-server) — not a published export (ruling C′ on #23128, p3) #23217
Description
Ruled: 6257816853 · slice 5 letter A · item 3 letter (i) · 2026-10-19T01:38Z
Ruled: 6227928430 · letter A on #23982 (batch #358 item 1) · home amended to @objectstack/core · 2026-10-17T01:27Z
Filed by the director seat (summon #37, session_01LqNgdPZB2Jnr5HpGbaqLeB) on the maintainer's ruling C′ on #23128 (「同意」, recorded at 6142279866) under 「立卡你决定，不需要我同意」. ⛔ Not a claim. Filing gate ①: a measured duplication with named sites. Priority p3: housekeeping inside the platform; nothing user-visible changes and #23128 does not wait for it.
What is measured (#23128's dev, on dc93781c19)
Five platform doors each hand-roll the same request-to-context composition (resolveAuthzContext + classifyAdmissionTenancyPosture + assembleExecutionContext / assembleExecutionContextOrGuest + a session read): packages/rest/src/rest-server.ts:3060, packages/runtime/src/security/resolve-execution-context.ts:150, packages/service-settings/.../settings-service-plugin.ts:285, packages/service-storage/.../storage-service-plugin.ts:862 and :1247, packages/plugins/plugin-hono-server/src/current-user-endpoints.ts:443. Each copy was fixed separately when an input was omitted (the tenancy posture: #15351, #15352; the in-process session read: #22258; a six-field omission: #15747).
What to build (one PR, or one per door after the first)
- One function in
@objectstack/core, exported from its.entry besideclassifyAdmissionTenancyPosture(Clause-②: yes (widening),minoron@objectstack/core; the home amended by the ruling on [Decision] #23217 cannot land as ruled: four of the five request-to-context doors cannot import an internal function of@objectstack/runtime. Home it in@objectstack/core(a new export), keep five copies under a parity pin, or close #23982, batch [WIP] Update action step configuration based on job run #358 item 1 — the runtime home C′ named is unreachable from four of the five doors; later slicesClause-②: no) that takes the pieces a door holds (the request's headers or the Hono context, the auth service, the ObjectQL engine) and returns the ExecutionContext, with the two choices made once and documented: the anonymous entry (fail-closedassembleExecutionContextunless the door's product semantics say guest) and the ADR-0069 auth gate. - The five doors call it; each conversion is proven by that door's existing pins (no new behaviour; a door that intentionally differs keeps its difference as a named parameter, never a copy).
- ⛔ No new published export, no change to any door's outward behaviour, no app-author surface (ruling C′: code-mounted app routes are retired, so no app needs this).
Acceptance
git grep -cof the composition's distinctive lines over the five files reads 0 outside the shared function. The hono/auth/medoor reaches 0 copies and adopts the composition's reading (ruling6257816853item 1). One exception: storage's ADR-0069 gate reader (buildAuthGateSessionReader) stays a hand-written door fact beside the one composition, as a copy under security: a session the ADR-0069 auth gate holds can still be served by the storage route family (detail withheld under the disclosure ruling) #24366's parity pin (d8e11b58e7, PR fix(service-storage)!: the family gate and the route judge the same credential #24388; ruling6257816853item 3 (i)). Its three grep hits (resolveApiKeyAdmission(,classifyAdmissionTenancyPosture(, andinProcessSessionReadInput(in the sharedbuildGetSession) are that reader family. One more hit reads outside the line's subject: settings'resolveAdmissionTenancyPosturecallsclassifyAdmissionTenancyPosture(to feed the settings SERVICE's owntenancyPostureoption, not a request-to-context composition. It was measured and kept in slice 3 (PR refactor(service-settings): the settings door calls the one request-to-ExecutionContext composition, resolveRequestExecutionContext #24297's body) and noted by the seat at slice 5's review. Every door's pins are green; the ADR-0096 principal-less refusal and the ADR-0069 gate read the same on each door before and after (a pin per door).
Related: #23128 (ruling C′, dev report 6138940364) · #15747 · #15351 · #15352 · #22258 · ADR-0096 · ADR-0069.
Activity
objectstack-fleet commentedon Oct 16, 2026
Blocked-by: #23982
Held
pm:blockedon the decision card #23982 ·domain:cliseat 2 (#22648) ·os-tesla· sessionsession_018t6a5rvqPRvEDMCVVW9kYT· 2026-10-16T15:39Z · ⛔ not a claim.@objectstack/runtime, whoseexportshas only..@objectstack/rest,@objectstack/service-settings,@objectstack/service-storageand@objectstack/plugin-hono-server.@objectstack/restcannot depend on it: runtime depends on rest, so it would be a cycle.@objectstack/core. A home there is a new published export, which ruling C′ item 3 excluded.@objectstack/runtime. Home it in@objectstack/core(a new export), keep five copies under a parity pin, or close #23982 (A: home in core as an export; B: five copies under one parity pin; C: close). The next lane card takes this slot meanwhile.Generated by Claude Code
objectstack-fleet commentedon Oct 17, 2026
Ruled on #23982 (batch #358 item 1, record 6227928430, letter A) · director seat (summon #43 continuation 3,
session_01QJC7i981TSs9L1CGJK59Ax) · 2026-10-17T01:26ZThe home this card inherited from ruling C′ (6142279866 item 3), an internal function in
@objectstack/runtime, is unreachable from four of the five doors: rest, service-settings, service-storage and plugin-hono-server do not depend on the runtime package, and the runtime depends on rest. The maintainer's letter A amends the home clause only: the one function lives in@objectstack/corebesideclassifyAdmissionTenancyPosture, exported from core's.entry (Clause-②: yes (widening),minoron@objectstack/core); slice 1 is the function plus the runtime's own door, each later door its own slice withClause-②: no; a door's intentional difference is a named parameter, never a copy; one conformance test over the function and every converted door; the carried fallback is letter B (one census-discovered parity pin) on apremise_still_valid: falsereport. Item 1 of the scope below is amended in this act to match; the rest stands. This card leavespm:blockedforpm:queuein this act — thedomain:cliseat re-dispatches from here.objectstack-fleet commentedon Oct 18, 2026
Claim: PM loop round 2 · #23217 slice 1: the one request-to-
ExecutionContextfunction in@objectstack/core, plus the runtime's own door, under letter A · 2026-10-18T01:35ZSession:
session_01QyoWKK9RwUNxBxmevy9NebAccount:
marchtian(the seat's linked user asGET /useranswers it; always the card's assignee)Branch:
claude/issue-23217-s1-core-request-contextWorktree:
objectstack-issue-23217-s1Domain:
domain:cliSeat:
domain:cli#2(seat post #22648)Ruling-ref:
6227928430(#23982, batch #358 item 1, letter A, the maintainer's 「23982 同意」), which amends ruling C′6142279866item 3 in its home clause only. The card's amended scope6227947754binds.File surface (read on
origin/main7be3cc728; line numbers move; stop on a breach and explain it in the report):packages/core/src/security/: one new module holding the function, besideadmission-tenancy-posture.ts(classifyAdmissionTenancyPosture,:108); its re-export fromsecurity/index.ts(core's.entry re-exports./security/index.js); and its unit tests.domain:engine, declared on [PM seat] domain:engine — 🟢 os-project-manager #6367.packages/runtime/src/security/resolve-execution-context.ts: the runtime's door calls the function, proven by that door's existing pins. Those include finding(mcp/oauth): an OAuth-token MCP agent acting for an ordinary user is denied every object operation — the D10 delegator is resolved with no active organization, so the user's organization-scoped grants do not count #24137's OAuth arm, landed by this seat at5a9a80bd2.minorchangeset on@objectstack/core. A changeset on@objectstack/runtimeonly if a published byte a reader sees moves.rest-server.ts,service-settings,service-storage,plugin-hono-server'scurrent-user-endpoints.ts), which are later slices, each declared to its lane;packages/specpath;packages/core/src/security/resolve-authz-context.ts(named in refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write undersingleand refused under a wall (ADR-0131 D2/D3/D5/D13) #15204's claim; called here, never edited);dispatcher-plugin.tsandplugin-hono-server(runtime(dispatcher): on the standalone server an anonymous non-POST to /api/v1/actions gets the adapter's 405 instead of the v18 401 floor — registerActionRoutes mounts POST only (the #23909 / #24024 gap, for /actions) #24228, this seat);resolve-session-principal.tsandhttp-dispatcher.ts(PR feat(spec): the remaining getSession readers read the declared AuthSessionApi result (user.isPlatformAdmin, role, name); the top-level activeOrganizationId fallback is removed #24232).Container & model:
M,mode:subagent,model: TIER_DEFAULT(this run'sdispatch-gates.mjs --tier --repo objectstack-ai/objectstack: "Model tier — no path-derived mandate")Clause-②: yes
Basis for the Clause-② line:
(widening), as the ruling states. The function is a new export from@objectstack/core's.entry. No door's outward behaviour changes, and the runtime door's existing pins prove it. The review of record owed for the declaration is this lane seat's own, atTIER_DEFAULT(the--tierfloor for aClause-②: yesdeclaration with no published-schema face).Responsibility: n/a — a ruled consolidation card (filing gate ①, a measured duplication with five named sites), not a defect.
Thread-read: 6227947754
Serial constraints cleared:
packages/core/src/security/,packages/core/src/index.tsorresolve-execution-context.ts.pm:dispatchedclaims, only refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write undersingleand refused under a wall (ADR-0131 D2/D3/D5/D13) #15204's namespackages/core/src/security/(resolve-authz-context.ts,security-catalog.ts). Its last activity is 2026-10-11, it has no open PR, and this slice calls that file without editing it.pm:on-holdRestart-touch:names these files.5a9a80bd2, merged).dispatcher-plugin.tsandplugin-hono-server's adapter, which are disjoint.Scope: p3, inside this seat's p1/p2/p3 scope (the maintainer, in this session's chat: 「暂时只处理 p1 p2 任务」, then 「p3 任务也可以开始处理」). By take order verify: classify hotcrm's "platform-semantics pins" — each becomes a derived proof family in
@objectstack/verifyor a platform regression test in dogfood, never an app test (epic hotcrm#1579, step 5c) #15953 comes first, but its remaining slice needs objectstack-ai/hotcrm's widget declarations and test as evidence, and that repository is outside this session's scope; its last clause also waits on hotcrm's move to protocol 18. So runtime: one internal request-to-ExecutionContext resolver for the platform's five hand-rolled copies (rest, runtime, service-settings, service-storage, plugin-hono-server) — not a published export (ruling C′ on #23128, p3) #23217, which now qualifies through the named published surface letter A gives it, takes the slot.Generated by Claude Code
objectstack-fleet commentedon Oct 18, 2026
os-dev-report
{ "issue": 23217, "status": "done", "branch": "claude/issue-23217-s1-core-request-context", "pr": "https://github.com/objectstack-ai/objectstack/pull/24248", "session": "session_01QyoWKK9RwUNxBxmevy9Neb (mode:subagent; the dispatching PM session's harness-stamped id, as the commit Claude-Session trailers carry it)", "premise_still_valid": true, "summary": "Slice 1 of #23217 under letter A (6227928430). Added resolveRequestExecutionContext in packages/core/src/security/request-execution-context.ts, exported from core's . entry through security/index.ts beside classifyAdmissionTenancyPosture. It does the session read under the in-process rule, the tenancy-posture classification, resolveAuthzContext, the localization, the ADR-0069 gate and the assembly. It makes two documented choices (anonymous: fail-closed | guest; authGate: withhold | resolved | reread-when-active), and every other measured door difference is a required named parameter (11 in total, 0 item-5 fallbacks; table in door_differences). The runtime door packages/runtime/src/security/resolve-execution-context.ts now keeps only what is its own (service lookups, header normalisation, the /mcp OAuth verification and scope reading) and calls the function: 209 lines out, 87 in. Its 39 pins and #24137's 15 OAuth pins are green unchanged. The ruling-item-4 conformance test is in runtime with one row per converted door. Draft PR #24248 is Part of #23217, assigned to marchtian, with a minor changeset on @objectstack/core.", "tests": "HEAD f5a955e12 (after merging origin/main af284b05e). (1) Core local project, under the verify lock: 'Test Files 104 passed (104) / Tests 2551 passed (2551)'. The edited repo-project ledger src/security/authz-store-unavailable.test.ts: 'Tests 40 passed (40)'. (2) Runtime local project, under the lock: 'Test Files 413 passed (413) / Tests 6318 passed | 19 skipped (6337)', 'VERDICT command-exit 0 · held the lock 559s'. (3) Door and dispatcher pins, verbose reporter, at 7667d9b4d before the merge (the post-merge full suite includes them): resolve-execution-context.test.ts 39, resolve-execution-context.oauth-organization.test.ts 15 of 15, request-execution-context.conformance.test.ts 7, plus http-dispatcher.mcp-oauth, http-dispatcher.tenancy-posture-outage, http-dispatcher.keys and in-process-session-renewal.pin: 'Test Files 7 passed (7) / Tests 111 passed (111)'. (4) New core unit file: 20 passed. (5) Typecheck: pnpm --filter @objectstack/core typecheck exit 0 (test layer held at 4 files / 4 errors) and pnpm --filter @objectstack/runtime typecheck exit 0 (27 files / 190 errors held, unchanged). The core test tsconfig compiles the new test (--listFiles counts 2 request-execution-context files). ABLATION, choice 1, at 7667d9b4d, declared direction RED. The function was mutated to always take the fail-closed entry ('return assembleExecutionContext(assembly); // ABLATION-23217-anonymous-entry'), landed by scripts/ablation-replace.mjs: 'anchor 1 -> 0, blob e3a17adddf47 -> 86ec4e1f04b5', marker count 1. Runtime's vitest aliases @objectstack/core to ../core/src/index.ts, so no dist preflight applies. Observed: core 'Tests 1 failed | 19 passed (20)', the choice-1 guest-envelope case. Runtime 'Tests 10 failed | 36 passed (46)': 9 door pins, including '#6216 a sessionless request still yields the WHOLE guest envelope' and the tenancy 'POSITIVE CONTROL', plus the conformance CONTROL. Restore: 'blob == HEAD (e3a17adddf47) and git diff HEAD is empty', marker 0. Direction observed equals the direction declared. Note: the conformance equalities stay green under the ablation by construction, because both sides call the one function; the CONTROL case and the unit battery are what catch a defect in the function itself.", "gates": "Local subset, at f5a955e12. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths) derived 84 commands; each was run with its exit code captured before any pipe into ran.list. 83 exit 0; pnpm check:dual-build-cjs-loads exit 3 (PREREQUISITE NOT MET: 40 packages have no dist, it needs a whole-tree build), so NOT MEASURED; CI runs it. Reconciliation, node scripts/pm/dispatch-gates.mjs --ran ran.list: exit 0, 'Run reconciliation — 84 derived, 83 run, 1 NOT-MEASURED, 0 UNRUN'. Its staleness line: origin/main moved to 9975c26ae while the run was going, and 3 stale files are rest adr-anchors and check-route-envelope.mjs, unrelated to this diff. Among the derived commands: pnpm check:authz-resolver exit 0, pnpm check:published-files exit 0, pnpm check:dts-closure exit 0, pnpm check:lean-entry-closure exit 0, pnpm check:pm-dispatch-gates exit 0, pnpm check:type-check-coverage exit 0, pnpm check:type-check-debt exit 0, pnpm check:nul-bytes exit 0, node scripts/check-adr-0087-registration.mjs --base origin/main exit 0, node scripts/check-changeset-no-major.mjs --base origin/main exit 0. Edited gate script: node scripts/check-single-authz-resolver.mjs --self-test exit 0 and the gate exit 0 ('all 3 entry points delegate'); no test file names the script (git grep: package.json, check-ratchet-remedy-authority.mjs and bare-root-worklist.mjs only). Lane blind spot: pnpm exec eslint --no-inline-config over the 7 changed .ts/.mjs files exit 0, no output. Local-only family: pnpm check:dev-prereqs exit 0 (spec, core and plugin-auth built from the sources on disk). Runtime test:repo was not run locally; it is CI's (Test Core). PR check-runs, one read at the time of this report: 'No other open PR may claim the same issue' success; 'Packed-tarball smoke (opt-in)' skipped; the other 21, including the Lint and Type Check lanes, 'Check Changeset', 'Governed Surface Queue Guard', 'Part-of PR must not also close its card' and 'The card this PR closes must claim this branch', in_progress. Required Test Core and Build Core were not yet listed.", "mcp_calls": "0", "api_writes": "2: (1) POST /repos/objectstack-ai/objectstack/dispatches (the pr_create stroke through scripts/pm/fleet-write/dispatch.mjs; relay run 39091336245 sent POST /repos/objectstack-ai/objectstack/pulls, which opened #24248 as a draft, and POST /repos/objectstack-ai/objectstack/issues/24248/assignees with marchtian; read-back '15523 byte(s) sent, 15523 stored — identical'); (2) POST /repos/objectstack-ai/objectstack/issues/23217/comments (this os-dev-report, via scripts/pm/post-stamped.mjs). Not REST: git push of the branch. No label write: the dispatch named no label, and skip-changeset does not apply because the PR carries a changeset.", "line_budget": "n/a: nothing under skills/** and no ledger file touched", "files_changed": [ ".changeset/23217-core-request-execution-context.md", "packages/core/src/security/request-execution-context.ts", "packages/core/src/security/request-execution-context.test.ts", "packages/core/src/security/index.ts", "packages/core/src/security/authz-store-unavailable.test.ts", "packages/runtime/src/security/resolve-execution-context.ts", "packages/runtime/src/security/request-execution-context.conformance.test.ts", "scripts/check-single-authz-resolver.mjs" ], "door_differences": [ "Measured on origin/main 7be3cc728 before slice 1 was written. Doors: rest = rest-server.ts computeExecCtx; runtime = runtime/src/security/resolve-execution-context.ts; settings = settings-service-plugin.ts verifiedContextFromRequest; storage = storage-service-plugin.ts buildFileReadAuthorizer + buildAuthGateSessionReader; hono = current-user-endpoints.ts makeExecutionContextResolver. 11 differences, all named parameters, 0 item-5 fallbacks.", "1 anonymous: rest fail-closed | runtime guest | settings fail-closed ({ enforced: true }) | storage fail-closed ('unauthenticated') | hono fail-closed -> parameter anonymous", "2 ADR-0069 gate: rest key = the admission's posture, session = re-read while isAuthGateActive(), a failed re-read is 503 | runtime withheld (the dispatcher's enforceAuthGate + onAdmission) | settings authz.authGate, no re-read | storage its own gate reader with the same shape as rest | hono withheld (allow-listed /me routes) -> parameter authGate: withhold | resolved | reread-when-active", "3 credential doors: API key + session everywhere except hono, which passes headers undefined (session only) -> parameter credentials", "4 no session API: rest and hono answer no context (the key is not honoured) | runtime and settings resolve (the key is honoured) | storage has no authorizer without auth (door-level) -> parameter sessionApi: required | optional", "5 session source: the auth service's in-process read everywhere; runtime /mcp adds a verified token's session or none for an unverifiable JWT -> parameter session: request | none | { established }", "6 tenancy posture: rest kernel or provider | runtime lookup thunk | settings and storage async accessor when present | hono none -> parameter tenancy (a TenancyServiceResolver thunk; the resolution stays at the door per #16013)", "7 admission channel: runtime only -> parameter onAdmission", "8 localization: rest settings provider | runtime settings lookup | hono withheld | settings and storage none -> parameter localization: withhold | { settings }", "9 request locale: rest header or ?locale (metaRequestLocale) | runtime Accept-Language | hono none -> parameter requestLocale (a value)", "10 session bearer: runtime carries it | rest and hono withhold it | storage carries it in the raw envelope -> parameter accessToken: carry | withhold", "11 OAuth provenance: runtime /mcp only -> parameter oauth (H2: verification and the scope reading stay at the door, because they need @objectstack/spec/ai, which core does not depend on)", "Door-side, not the composition and not a copy: header normalisation (the function takes a Web Headers), service resolution, fault relay (the function propagates everything), post-assembly additions (rest __kernel, __authEnvironmentId, memo, perf disclosure; hono perf disclosure), output consumption (settings projects to SettingsContext; storage hands the envelope to engine.find)" ], "handover_slice2": [ "Door: packages/rest/src/rest-server.ts computeExecCtx (merged head :3098). Call the function with anonymous 'fail-closed', authGate 'reread-when-active', credentials 'api-key-and-session', sessionApi 'required', session 'request', localization { settings: () => this.settingsServiceProvider ? seamOrUndefined(() => this.settingsServiceProvider(environmentId)) : undefined }, requestLocale this.extractLocale(req), accessToken 'withhold', oauth undefined, onAdmission undefined.", "The tenancy thunk stays rest's own: the kernel getServiceAsync branch or the tenancyServiceProvider branch, undefined when neither applies.", "Kept at the door: environment and auth-service resolution and the 'if (!authService) return undefined' early return, header normalisation (append per array element), the ql resolution through wiredEngineOrLoud, __kernel, __authEnvironmentId, the execCtxMemo, the perf disclosure, and the catch with its apiKeyLifecycleRefusals side channel.", "Then: move the rest row of DELEGATORS in scripts/check-single-authz-resolver.mjs to resolveRequestExecutionContext; remove rest-server.ts from the core TRANSPORT_LEDGER in authz-store-unavailable.test.ts if it no longer calls resolveAuthzContext({; add rest as a conformance row (runtime already depends on @objectstack/rest); add the ruling's one ADR-0096 / ADR-0069 pin; Clause-②: no.", "Later slices: settings and storage rows need runtime devDependencies on @objectstack/service-settings and @objectstack/service-storage (no cycle: neither depends on runtime). Storage today hands the raw ResolvedAuthzContext to engine.find; the envelope adds isSystem false and principalKind human and drops credential (no objectql, plugin-security or plugin-sharing source reads context.credential). Hono's session read drops a session with no user.id, while the resolver reads user.id ?? session.userId; slice 5 measures it." ], "deviations": [ "Two files outside the claim's literal surface, both forced by moving the resolveAuthzContext call: packages/core/src/security/authz-store-unavailable.test.ts (its transport ledger is set-equal to the call sites, so the runtime door row became the new core module, propagates), and scripts/check-single-authz-resolver.mjs (DELEGATORS now names each delegator's call; without it, check (2) would have been satisfied for the runtime door by docblock prose alone). For the seat to declare.", "The ablation is of choice 1, the anonymous entry, not the suggested ADR-0069 gate. The runtime door withholds the gate on the envelope, so a gate ablation cannot redden any runtime door pin; the anonymous entry reddens both a core unit test and runtime door pins.", "The runtime door now looks up 'auth' once, at the top, ahead of the tenancy read. Answers are identical for any lookup that resolves or rejects. Only a lookup that throws synchronously for 'auth' while the tenancy service also failed to build now surfaces the synchronous error instead of the 503; the dispatcher's resolveService never throws. Stated in the PR's Acceptance notes.", "The PR body writes the exported signature with the angle brackets as single guillemets (the sanitizer strips tag-shaped fragments) and points to the byte-exact lines at f5a955e12.", "The PR body carries 'Clause-②: yes (widening)' on one line with 'Ruling-ref: 6227928430' below it. The dispatch's wording can also be read as '(widening)' on its own line; both read as a widening yes to scripts/pm/clause2-line.mjs.", "Commit subjects on the branch end with (WIP); they carry no card relation, and a squash merge takes the PR title.", "origin/main moved to 9975c26ae (unrelated rest files) after the merge and the gate run; no second merge, per the after-PR merge rule.", "check:dual-build-cjs-loads was NOT MEASURED locally (exit 3, a whole-tree build prerequisite); runtime test:repo was not run locally. Both are CI's." ], "open_questions": [], "out_of_scope_findings": [ "carrier: the domain:cli seat (a card text edit) · noted, not filed. #23217's title ('not a published export') and its scope item 3 ('No new published export') still read as ruling C′ wrote them, while letter A (6227928430) amended item 1 to an export from core's . entry.", "carrier: #23217's later slices · noted, not filed. The storage envelope difference (raw ResolvedAuthzContext versus the assembled envelope) and hono's user.id session filter are slice-4 and slice-5 measurements; see handover_slice2." ] }Generated by Claude Code
42 remaining items
objectstack-fleet commentedon Oct 18, 2026
需裁增量 · 第 3 项的输入已落地 ·
domain:cli席 1 ·session_01SYEJqDL3NXxrJRBVqaMu9T· 2026-10-18T21:39Z接上一条需裁评论,只补一处变化。services 席的说明
6255326912写到:#24366 已经落地(d8e11b58e7,PR #24388,契约复核 PASS6254884596)。buildAuthGateSessionReader)仍是手写的一份,和resolveRequestExecutionContext之间用对拍测试钉住,没有并入统一函数。authGate模式("无论哪种凭据接纳请求,都判会话自身的状态")。现有的'resolved'和'reread-when-active'两种模式都不是它。这是domain:engine的设计问题。请在裁第 5 片时一并裁第 3 项:
domain:engine卡,给 core 加这个authGate模式,再把 reader 并进去。长远看只剩一个组合,但要新增一个永久的公共参数值。无论第 5 片选 A 还是 B,(i) 和 (ii) 都可以单独定。回复格式:「第 5 片 X,第 3 项 i/ii」。
Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
席位意见(增量)· director seat (summon #43 continuation 5,
session_01QJC7i981TSs9L1CGJK59Ax), read as batch #367 item 2 (slice 5 and item 3), 2026-10-19T01:12ZOn the
domain:cliseat 1's release to the box (6255142643; A recommended for slice 5: the hono/auth/medoor calls the one composition and adopts its reading; B: a new named parameter 「accept only a session withuser.id」; C: letter B for this door only, a parity pin; D: the strict reading for everyone — listed to be refused) and its addendum on item 3 (6255470847; (i) recommended: #24366's parity pin closes the storage reader; (ii): adomain:enginecard for a newauthGatemode). The maintainer's words in this session's chat: 「继续决裁」.Premises re-run in this act — objectstack
origin/main44a5011fe623:user.id:packages/plugins/plugin-hono-server/src/current-user-endpoints.ts:478return session?.user?.id ? session : null;. Holds.session.userId:packages/core/src/security/resolve-authz-context.ts:549userId = sessionData?.user?.id ?? sessionData?.session?.userId;. Holds.findSessionreturnsnullwhen the session's user is missing; plugin-auth'scustomSessionpasses through); cloud's producers not measured (the seat cannot read cloud — this seat can: cloud's control plane uses the framework's plugin-auth session read, so no second producer there either, read at cloud9099bd1ea646). Taken as measured, with that one addition.d8e11b58e7, PR fix(service-storage)!: the family gate and the route judge the same credential #24388): the storage gate reader stays a hand-written door fact with a parity pin. Holds.Facets: ① agree with A and (i) — the door's rule is a sessionless guard that was later read as a rule (its origin
b398ad258if (!session?.user?.id) return undefined;, moved byf792290df); converging keeps one composition, which is what ruling 6227928430 item 3 means by 「a copy is never the way to keep a difference」; B widens a public parameter for a reading no producer yields; C keeps the fifth copy forever; D flips every other caller against theAuthSessionApicontract · ② no measured deployment changes its answer; the only reading that would change (a session withsession.userIdand nouser.id) has no producer · ③ one function, one reading; (i) is the ruled fallback for a door whose difference cannot be a parameter (ruling item 5), already landed with its pin · ④ A is one PR in the slice's shape (precedent PR #24364); (ii) adds a permanent public parameter value for one reader.Recommend slice 5 A · item 3 (i). 口径, binding with the letter: (1) the hono door calls
resolveRequestExecutionContextwith its existing parameters and adopts the composition's reading; the parity probe's 18 wirings become the PR's pins; the card's acceptance line for this file reaches 0 copies; (2) item 3 closes as 「copy + parity pin」 (#24366); the card's acceptance line for storage is rewritten to say so; (ii) is not filed. Workload:domain:cliS, one PR. Execution: the card leaves the box topm:queuefor thedomain:cliseat; the card body's acceptance lines are rewritten by that seat.os-decision-facets
自检:只看①选 A + (i);②③④ 是否翻转:否。
objectstack-fleet commentedon Oct 19, 2026
Ruling: batch #367 item 2 · slice 5 letter A · item 3 letter (i) · maintainer 「23217 同意」 2026-10-19T01:38Z
Director seat, summon #43 continuation 5,
session_01QJC7i981TSs9L1CGJK59Ax, on thedomain:cliseat 1's release of this card to the box (6255142643, slice 5; addendum 6255470847, item 3) and the director delta 6257551534 (opening marker #12708, comment 6247058702). The maintainer's words in this session's chat: 「23217 同意」 on the director's recommendation (slice 5 A, item 3 (i)).What the ruling binds:
/auth/medoor (packages/plugins/plugin-hono-server/src/current-user-endpoints.ts, the guard at:478) callsresolveRequestExecutionContextwith its existing parameters and adopts the composition's reading (packages/core/src/security/resolve-authz-context.ts:549: a session read that carriessession.userIdand nouser.idnames that user). The dev's 18-wiring parity probe becomes the PR's pins; the only reading whose answer changes has no producer in this repository or in cloud's control plane (read at cloud9099bd1ea646). The card's acceptance line for this file reaches 0 copies. No new named parameter (B), no door-local letter B (C), no strict reading for everyone (D).d8e11b58e7, PR fix(service-storage)!: the family gate and the route judge the same credential #24388) closes the storage gate reader: a hand-written door fact beside the one composition, pinned, as ruling 6227928430 item 5 allows for a door whose difference cannot be a parameter. The card's acceptance line for storage is rewritten to 「copy + parity pin」; nodomain:enginecard for a newauthGatemode (ii).@objectstack/core; no published export; no app-author surface).Workload of the letter:
domain:cliS, one PR in the slice's shape (precedent PR #24364).Execution: this card leaves the box —
needs-user-decision→pm:queuein this act; thedomain:cliseat rewrites the two acceptance lines in the body and dispatches slice 5.objectstack-fleet commentedon Oct 19, 2026
Claim: PM loop round 5 ·
domain:cliseat 1 · #23217 slice 5 (re-dispatch under ruling6257816853, letter A): the hono/auth/medoor calls the oneresolveRequestExecutionContextand adopts its reading · 2026-10-19T01:41ZSession:
session_01SYEJqDL3NXxrJRBVqaMu9TAccount:
zhuangjianguo(the seat's linked user asGET /useranswers it; always the card's assignee)Branch:
claude/issue-23217-s5-hono-doorWorktree:
objectstack-issue-23217-s5Domain:
domain:cliSeat:
domain:cli#1(seat post #6024)Ruling-ref:
6257816853(batch Add configurable logger with Pino for Node.js and browser support #367 item 2, maintainer 「23217 同意」 2026-10-19T01:38Z), re-read at its source in this act. Item 1: the door "callsresolveRequestExecutionContextwith its existing parameters and adopts the composition's reading … The dev's 18-wiring parity probe becomes the PR's pins … No new named parameter (B), no door-local letter B (C), no strict reading for everyone (D)". Item 2: storage's gate reader closes as "copy + parity pin". Item 3:6227928430's other terms stand.handover_slice5in report6255071471. It is mechanical.File surface (read on
origin/main8baeda520; line numbers move; stop on a breach and explain it in the report):packages/plugins/plugin-hono-server/src/current-user-endpoints.ts:makeExecutionContextResolver(about:446) callsresolveRequestExecutionContextonce, with slice 1's row for this door re-measured in6255071471. ThereadSessionguard (:478) leaves. The door keeps its facts: the per-requestctx.getService('auth')/getObjectQLguards, the kernel-resolver seam, and its catch withrethrowAuthzStoreUnavailable.resolveAuthzContext,userAuthGateSourceOf,apiKeyLifecyclePolicySourceOf,assembleExecutionContextandinProcessSessionReadInputleave its imports where unused./tmp/claude-0/-home-user/d33106cb-b8f5-52d0-bdde-228e8c81c74e/scratchpad/issue-23217-s5/zz-hono-door-probe.oneoff.test.ts) becomes committed pins. Thesession.userId-only wiring now asserts the composition's answer: that user, signed in.packages/core/src/security/authz-store-unavailable.test.ts: the hono row ofTRANSPORT_LEDGERleaves, and the CONTROL floor becomes 7 with the reasoning in the hand-over.scripts/check-single-authz-resolver.mjs:DELEGATORSgains the hono row.packages/runtime/src/security/request-execution-context.conformance.test.ts: aHONO_ROW, per the hand-over.expectedPrincipallearnscredentials; the CONTROL carries a session claiming a non-member organization; no alias, becauseKNOWN_UNALIASED_TEST_IMPORTSalready lists the package.patchchangeset on@objectstack/plugin-hono-server.@objectstack/core's function itself (no new parameter, per the ruling);packages/spec/src/**;hono-plugin.ts; storage'sbuildAuthGateSessionReader(closed by item 2 as a copy).Container & model:
M,mode:subagent,model: default tier(dispatch-gates.mjs --tier: "Model tier — no path-derived mandate")Clause-②: no
Basis for the Clause-② line: ruling
6227928430's "later slicesClause-②: no". One answer changes, for a session read withsession.userIdand nouser.id(signed-out → signed-in). The ruling measured that no producer yields it, here or in cloud's control plane. No export or published surface moves.Responsibility: n/a — not a defect card (a maintainer-ruled housekeeping card)
Thread-read: 6257816853
Serial constraints cleared:
authz-store-unavailable.test.ts,request-execution-context.ts,check-single-authz-resolver.mjsor the conformance test.pm:dispatchedclaim names them (17 cards read).packages/restimport undo,hook.zod.ts). Batch 2: this and security: the import undo door writes with skipAutomations and skipStateMachine for any caller who may undo — what an undo owes an app's controls (detail withheld under the disclosure ruling) #24380.6254881518(packages/core/**readers) and [PM seat] domain:spec — ⏳ vacant #60176254886923(scripts/**) still stand from the first dispatch of this slice.Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
Dev interrupted, re-dispatched ·
domain:cliseat 1 · sessionsession_01SYEJqDL3NXxrJRBVqaMu9T· 2026-10-19T01:45Z. The session's container restarted, and the dev run under claim6257852620stopped before it pushed any work.claude/issue-23217-s5-hono-doorstill equalsmain8baeda520. The claim stands unchanged, and a fresh dev starts slice 5 under ruling6257816853letter A from the hand-over in6255071471.Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
os-dev-report
{ "issue": 23217, "status": "done", "branch": "claude/issue-23217-s5-hono-door", "pr": "https://github.com/objectstack-ai/objectstack/pull/24437", "session": "session_01SYEJqDL3NXxrJRBVqaMu9T (mode:subagent; the dispatching PM session's harness-stamped id)", "premise_still_valid": true, "summary": "Slice 5 of #23217, the last door, done under ruling 6257816853 (slice 5 letter A). makeExecutionContextResolver in packages/plugins/plugin-hono-server/src/current-user-endpoints.ts now calls resolveRequestExecutionContext once, with slice 1's row for this door as re-measured in 6255071471: fail-closed, authGate withhold, credentials session-only, sessionApi required, session request, tenancy undefined, localization withhold, no requestLocale, accessToken withhold, oauth and onAdmission undefined. The door keeps its facts: the per-request getService('auth') read and the guarded getObjectQL, the kernel-resolver seam, the perf-disclosure gate (now read off the assembled context, with the same value), and its catch with rethrowAuthzStoreUnavailable, which still answers the function's propagated getApi() rejection as no context. The readSession user.id guard is gone. The only changed answer is the ruled one: a session read with session.userId and no user.id is now signed in as that user, as at the other four doors. resolveAuthzContext, assembleExecutionContext, userAuthGateSourceOf, apiKeyLifecyclePolicySourceOf, inProcessSessionReadInput and IAuthService left the imports. @objectstack/core's function was not edited. Readers moved in the same PR: core's TRANSPORT_LEDGER lost the hono row, and its scanner floor went from 8 to 7 with the hand-over's reasoning. DELEGATORS in check-single-authz-resolver.mjs gained the hono file. The runtime conformance test gained a HONO_ROW, credentials in expectedPrincipal, a seventh request (a session.userId-only read, resolved as u_ses at all five doors), and a hono CONTROL. Two pins were added: a route-level ADR-0096 / ADR-0069 pin on the booted HonoServerPlugin, and the 18-wiring parity probe committed as current-user-endpoints.resolver-wirings.pin.test.ts. There is also a patch changeset. Core's docblock table was read row by row: no row turns false, so it is not edited. Fixes #23217 is the PR's first line; the acceptance grep is in the PR body (open question below).", "tests": "BEFORE, on the hand-written door (door blob c0e104d2c, main 8baeda520, pins at 348b11ba7): pnpm --filter @objectstack/plugin-hono-server exec vitest run --maxWorkers=2 over the two pin files read 'Tests 4 failed | 25 passed (29)'. The 4 failures are exactly the ruled-reading rows (3 wirings and the route row): the door answered no context / {authenticated:false}. AFTER, at 86cd71673 (door blob e7cc167d5): hono suite 'Test Files 34 passed (34)', 'Tests 422 passed (422)'; conformance 'Tests 13 passed (13)'; core ledger (--project repo) 'Tests 36 passed (36)', which is 37 minus the hono row. FINAL HEAD 2f7f09a8e (origin/main e22defb13 merged), under the verify lock: turbo run build --filter=!@objectstack/docs --concurrency=2 gave '76 successful, 76 total'. Hono suite 'Test Files 34 passed (34)', 'Tests 422 passed (422)'. Runtime conformance (--project local) 'Test Files 1 passed (1)', 'Tests 13 passed (13)' (7 requests, the identity test, 5 CONTROLs). Core src/security/ 'Test Files 43 passed (43)', 'Tests 961 passed (961)'. typecheck exit 0 for plugin-hono-server (test layer 0/0/0; tsc -p tsconfig.test.json --listFiles lists both new pins), core (4/4/4 held) and runtime (27 files/190 errors/68 signatures held; none of the --listFiles errors is in request-execution-context.conformance.test.ts). The rest of the runtime suite was not run locally: the conformance file is the only runtime file touched, and CI's Test Core runs it. ABLATION, declared direction RED, at 86cd71673, two legs in one verify-lock call. Each leg went through scripts/ablation-replace.mjs (anchor hit x1, blob changed e7cc167d5 to 0ac83b40f / 15c883940), then a hono build, then scripts/ablation-dist-preflight.mjs, which found the marker in 2 built files with the tree reading on the mutate leg; the hono row reads the door from dist. Leg 1 reverts the door to its hand-written composition (main's import block through makeExecutionContextResolver; marker 'session?.user?.id ? session : null'): wirings pin 'Tests 3 failed | 17 passed (20)', route pin 'Tests 1 failed | 8 passed (9)', conformance 'Tests 1 failed | 12 passed (13)'. Every failure is a ruled-reading row or the session.userId-only request. Leg 2 changes credentials 'session-only' to 'api-key-and-session' (dist marker 'credentials: \"api-key-and-session\"'): wirings '2 failed | 18 passed (20)', route pin '1 failed | 8 passed (9)', conformance '3 failed | 10 passed (13)' (the API key, the ex-member key, the hono CONTROL). Each restore: blob == HEAD e7cc167d5, git diff HEAD empty (diffbytes=0), hono rebuilt, preflight --absent exit 0. At the end git status --porcelain was empty. Observed direction equals declared. Logs: /tmp/claude-0/-home-user/d33106cb-b8f5-52d0-bdde-228e8c81c74e/scratchpad/issue-23217-s5/r3/ablation.log and abl-*.log beside it.", "gates": "Local subset at 2f7f09a8e: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths) derived 90 commands (DERIVE_EXIT 0). 89 ran unlocked with each exit code captured before any pipe, and all exited 0. pnpm check:type-check-debt ran under the verify lock with slot issue-23217-s5-r3: exit 0, 'none above its recorded number'. --ran gave '90 derived, 90 run, 0 NOT-MEASURED, 0 UNRUN', exit 0. Among them: check:authz-resolver 'all 6 entry points delegate'; check:test-source-alias OK; check:slot-lookup '100 unswept site(s) in 25 file(s), none new'; check:cross-package-test-inputs OK; check:dual-build-cjs-loads exit 0 on the built tree; check:nul-bytes OK; check-adr-0087-registration and check-empty-changeset OK; check:pm-dispatch-gates exit 0. The declared-wide population ran too, 10 families, all exit 0: init-service-contract, live-db-isolation, meta-type-normalized, optional-error-sink, resume-authority-declared, runner-env-posture, settings-bind-window, startup-registry-verdict, verify-stand-in, wildcard-fallthrough. --ran lists them as outside the derivation, not an error. The edited gate script: node scripts/check-single-authz-resolver.mjs exit 0, and --self-test exit 0. pnpm exec eslint --no-inline-config over the five changed .ts/.mjs files: exit 0, no output. CI on PR #24437 head 2f7f09a8e when this report was written: 37 check-runs, 7 success, 6 skipped, 24 in_progress. Build Core, Governed Surface Queue Guard and Check Changeset are in_progress; Lint & Repo Gates, TypeScript Type Check and Test Core have not reported yet. The report was not held for CI.", "mcp_calls": "0", "api_writes": "2 relay writes, each through the fleet-write relay as objectstack-fleet[bot] (POST /repos/objectstack-ai/objectstack/dispatches, HTTP 204). (1) pr_create through scripts/pm/with-fleet.sh --via dispatch, which made POST /repos/objectstack-ai/objectstack/pulls (draft, forced) and the assignee POST /repos/objectstack-ai/objectstack/issues/24437/assignees ['zhuangjianguo']. The body read back byte-identical, 15353 bytes. (2) This os-dev-report, POST /repos/objectstack-ai/objectstack/issues/23217/comments, through scripts/pm/post-stamped.mjs. Not REST: git push of 348b11ba7, 86cd71673 and 2f7f09a8e. Reads only otherwise: single-comment, single-card, comment-list, PR and check-runs GETs.", "line_budget": "+851 / -153 over 7 files vs origin/main (dispatch-gates: 1004 changed lines, under the 3000 human-merge threshold). Nothing under skills/** and no governed surface.", "files_changed": [ ".changeset/23217-s5-auth-me-door.md", "packages/plugins/plugin-hono-server/src/current-user-endpoints.ts", "packages/plugins/plugin-hono-server/src/current-user-endpoints.request-context-door.pin.test.ts", "packages/plugins/plugin-hono-server/src/current-user-endpoints.resolver-wirings.pin.test.ts", "packages/core/src/security/authz-store-unavailable.test.ts", "packages/runtime/src/security/request-execution-context.conformance.test.ts", "scripts/check-single-authz-resolver.mjs" ], "deviations": [ "The conformance test gained a seventh request beyond the hand-over's list: a session read naming its user by session.userId alone. All five doors resolve it as u_ses. Without it, the dispatch's ablation clause ('the new pins and the conformance row must turn red') could not hold: none of the six existing requests carries the shape, so the reverted door would read green there. It sits before the last request, which the existing CONTROLs read by position.", "The route-level ADR-0096 / ADR-0069 pin carries one row beyond the hand-over's list: the ruled reading on the three real routes. The pin is then red under the revert leg too, not only the wirings pin.", "Ablation leg 2 (credentials 'session-only' to 'api-key-and-session') is my choice of a second leg, shaped like slice 4's two legs. The dispatch named only the revert.", "The ablation and the first typecheck ran at 86cd71673, before origin/main e22defb13 (plugin-auth only) was merged. Every targeted suite, the typechecks and the gate battery re-ran at the final head 2f7f09a8e.", "origin/main moved to db1f1fd20 (#24417, packages/spec only) after the local verification and before pr_create. It was not merged: the paths are disjoint and no conflict exists, and os-dev.md merges main after a PR opens only on a conflict, a main-caused red or a queue removal. CI's merge ref carries it.", "Commit trailers are the model-free pair AGENTS.md requires (Claude-Session plus Co-authored-by: Claude). The harness reminder offered a model-named trailer, and it yields to project instructions.", "The lost run's scratchpad files (issue-23217-s5/ at 01:42Z) were not reused. The ruling, delta, claim, report and card were re-read at source into issue-23217-s5/r3/.", "Disclosure: nothing from the withheld storage card is in the PR, the changeset, the commits or this report. The storage exception is cited only as ruling 6257816853 item 2 (letter (i), copy + parity pin).", "Cleanup, after this comment: rm -rf node_modules in /home/user/objectstack-issue-23217-s5, then git worktree remove (no --force). The branch stays on the remote at 2f7f09a8e, so a patch round starts from it." ], "open_questions": [ { "question": "Does the PR close the card, given the acceptance grep at HEAD 2f7f09a8e? Over the five door files, resolveAuthzContext( and assembleExecutionContext(OrGuest)( read 0 everywhere, and the hono door reads 0 on every line. Two files still have hits. Settings has 1 classifyAdmissionTenancyPosture( in resolveAdmissionTenancyPosture (about :469). It feeds the settings SERVICE's tenancyPosture option, not the HTTP door, and it was kept in slice 3. Storage has 3: resolveApiKeyAdmission( (about :1283, the gate reader's key arm), classifyAdmissionTenancyPosture( (about :1432, the gate reader's posture read), and inProcessSessionReadInput( (about :973, buildGetSession, which the gate reader shares with the upload session resolver).", "options": [ "A: keep 'Fixes #23217'. Storage's three hits are the gate reader that the acceptance line names as its one exception (copy + parity pin). The settings hit is a service option, not a request-to-context copy. Cost: none.", "B: change the first line to 'Part of #23217'. The settings service-option line and storage's buildGetSession are then read as outside the exception, and the card stays open for a decision about them. Cost: a seat body edit and a further slice or ruling." ], "recommendation": "A. Neither hit composes a request into an ExecutionContext. Both were measured and kept in ACCEPTed slices 3 and 4, and the ruling's exception covers the storage gate reader family. The PR body's Acceptance notes name B as the alternative, so the seat can make the change from this report without a dev PATCH." } ], "out_of_scope_findings": [] }Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
ACCEPT → PR #24437 comment 6258700854 (slice 5, the last door; head
2f7f09a8e;Fixes #23217). It lands through the queue once green, and the card closes on the merge. The acceptance line now names the remaining grep hits: storage's gate reader family, and settings' service-option posture read. Filed from the review: none.Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
Landed: PR #24437 →
8ed3786a3·domain:cliseat 1 ·zhuangjianguo· sessionsession_01SYEJqDL3NXxrJRBVqaMu9T· 2026-10-19T03:59Zmerged: true, merge commit8ed3786a3, merged 2026-10-19T03:58Z through the merge queue (enqueued 2026-10-19T03:29Z)origin/main8ed3786a3is an ancestor oforigin/main, with a single parent (squash). The 7 files and +851 / −153 match what was reviewed at2f7f09a8egh-readonly-queue/main/*pr-24437*head remains6254873392→ report6255071471(needs_decision) → release to the box6255142643, addendum6255470847;6257816853(slice 5 A, item 3 (i));6257852620→ the first run lost to a container restart (note on this card) → report6258657763→ ACCEPT6258700854→ pointer6258706124.6254881518, [PM seat] domain:spec — ⏳ vacant #60176254886923./auth/medoor callsresolveRequestExecutionContextwith its existing parameters and adopts the composition's reading. One answer changes, for asession.userId-only read, and no producer yields that read.TRANSPORT_LEDGERloses the hono row (floor 7),DELEGATORSgains it, and the runtime conformance test gainsHONO_ROW.completedon the merge.pm:dispatchedis removed in the stroke after this comment.Generated by Claude Code