Repository navigation
dogfood: main's Dogfood Regression Gate (1/3) is red since #25591 — showcase-d3-d4-capabilities still pins the pre-#25549 SHARING_NOT_ENABLED reason for a share on showcase_project #25602
Description
Filing gate: ① — a reproducible defect (main's push battery) with a named location. Filed by the fleet director project's domain:server card thread · os-sales · session_014rFBGqoBLiroi35e82xEa7, as the anchor for this failing check under the main-red convention (one failing check, one card). It holds the 18.1.0 cut.
Reader: this card thread; its PR fixes it (AGENTS.md "Main-red"; reading discipline: a red on main is stanched and filed by whichever lane finds it). The fix lands in packages/qa/dogfood/test/showcase-d3-d4-capabilities.dogfood.test.ts, which the lane table anchors to domain:devx; the red's cause is #25591's plugin-sharing change, a domain:server package, and the fleet director dispatched the stanch to the server lane, so this card carries domain:server. Triage may re-anchor it after the landing.
Business reason: main's full battery is red, so the publish lane cannot read it green before a release approval, and 18.1.0 waits on it. Every PR whose author reads main's Dogfood gate also sees a red it did not cause.
Dedupe: semantic issue search on this repository for "showcase-d3-d4-capabilities dogfood SHARING_NOT_ENABLED showcase_project main red" → 6 hits (closed included), none for this failure; "dogfood shard red on main after sharing public object external member #25591" → 9 hits, none for this failure (the nearest is #25549, closed, the card #25591 fixed). Open PRs matching "showcase-d3-d4" → 1, #25600, unrelated (plugin-approvals).
What fails
| Run | Head | Dogfood Regression Gate (1/3) |
|---|---|---|
| 40059211627 (push) | ba6912c1a (#25589) |
green (whole CI run success) |
| 40059752268 (push) | 4a251927c (#25591's merge) |
red: 1 failed / 784 passed; shards 2/3 and 3/3 green |
| 40060187070 (push) | a57643d3d (#25592) |
red: 1 failed / 797 passed; shards 2/3 and 3/3 green |
The one failure on both red heads is test/showcase-d3-d4-capabilities.dogfood.test.ts:135, "[#9237] the grant the rule reconciles is one the gates CONSULT — not refused as inert":
expected [Function] to throw error matching /SHARING_NOT_ENABLED: 'showcase_project' is not under record-sharing enforcement/
Received: "SHARING_NOT_ENABLED: 'showcase_project' has a public sharing model, so a share row on it is consulted only for an external member of the record's organization, and that organization could not be resolved"
Why it is #25591, and why the new reason is intended
- feat(sharing): a share or sharing rule on a public object reaches an external member of the record's organization #25591 (letter A of the ruling on sharing: a share or sharing rule to an external member is refused as inert on a public_read_write or model-less system object, though the external OWD floor would consult it #25549) made the D7 pre-flight in
plugin-sharingsharing-service.tsread the recipient on an effective-publicobject with a realowner_id: anexternalmember of the record's organization is admitted, every other recipient is refused with the new wording, and a grant whose organization cannot be resolved is refused with its own named reason. Its body says so ("No organization resolved is refused with its own named reason"). - The pin grants on
showcase_project(public_read_write) as a system caller, topj_absent(a record id that names no row) and a synthetic recipient. Before feat(sharing): a share or sharing rule on a public object reaches an external member of the record's organization #25591 the object half refused it from the OWD alone. Now the object half defers to the recipient half, the system path resolves the organization from the record, finds none, and answers the "could not be resolved" reason. The behaviour is the ruled one; the pin is stale. - PR CI does not run the Dogfood shards (they are skipped on
pull_requestandmerge_group), so feat(sharing): a share or sharing rule on a public object reaches an external member of the record's organization #25591's checks were green.
Done when
- The pin asserts the reason the ruled verdict gives for the contrast it draws (a staff recipient on a real
showcase_projectrecord is refused because it is not an external member of the record's organization), not the incidental "could not be resolved" reason that a non-existent record produces. pnpm --filter @objectstack/dogfood testpasses that file on the fix head, andmain's next push battery readsDogfood Regression Gate (1/3)green.
Lane effect
Under AGENTS.md "Main-red", this red is the owning lane's first work and no PR of that lane arms the queue until it clears. A release freeze is in effect: the fix PR opens as a draft and lands only after the coordinator relays the unfreeze.
Activity
objectstack-fleet commentedon Oct 24, 2026
Claim: card thread (#25602: the showcase-d3-d4 dogfood pin asserts the reason #25591's ruled verdict gives a staff share on a real showcase_project record, so main's Dogfood Regression Gate (1/3) goes green) · 2026-10-24T04:36Z
Session:
session_014rFBGqoBLiroi35e82xEa7Account:
os-sales(the seat's linked user asGET /useranswers it; the card's assignee from this act)Branch:
claude/project-thread-pluvu5(harness-assigned; it does not followclaude/issue-<n>-…, so the PR body names this card for the Duplicate Fix Guard)Worktree:
objectstack-dogfood-d3d4Domain:
domain:serverSeat:
domain:server#1File surface:
packages/qa/dogfood/test/showcase-d3-d4-capabilities.dogfood.test.tsonly — the third case's contrast and its comments, plus the file header's sentence onshowcase_project. ⛔ Hold-offs: notplugin-sharing(the verdict is the ruled one), notexamples/app-showcase/**, not the sibling pins inexternal-member-directory.dogfood.test.tsorfederated-phantom-share-grant.dogfood.test.ts. No changeset:@objectstack/dogfoodis private and the diff is test-only (skip-changeset).Container & model:
S(one pin in one private test file, behaviour already ruled),mode:thread,model: TIER_DEFAULT(dispatch-gates --tier: no path-derived mandate),effort: xhighClause-②: no
Metadata-protocol: none
Responsibility:
the dogfood showcase D3/D4 proof (this card thread) | #25591's verdict as ruled on #25549, letter A | every lane and the publish lane reading main's Dogfood Regression Gate, red on shard 1/3 since 4a251927cThread-read: none
Serial constraints cleared: no open PR edits
showcase-d3-d4-capabilities.dogfood.test.ts(open-PR search "showcase-d3-d4" → #25600 only, which touches plugin-approvals and a new approvals dogfood file). No in-flight claim names this file.Order: release blocker for 18.1.0, dispatched by the fleet director outside the concurrency cap. A merge freeze is in effect, so the PR stays a draft until the coordinator relays the unfreeze.
Generated by Claude Code
objectstack-fleet commentedon Oct 24, 2026
os-dev-report
{
"issue": 25602,
"status": "done",
"branch": "claude/project-thread-pluvu5",
"pr": "#25604",
"session": "session_014rFBGqoBLiroi35e82xEa7 (the card thread, which claimed and implemented the card)",
"premise_still_valid": true,
"summary": "The pin at showcase-d3-d4-capabilities.dogfood.test.ts:135 asserted the pre-#25549 object-only SHARING_NOT_ENABLED reason for a system grant on showcase_project (public_read_write) to a record id naming no row. Since #25591 (letter A of the ruling on #25549) the D7 verdict on a public object reads whether the recipient is an external member of the record's organization, so that grant is refused for an unresolvable organization instead, which is intended. Commit c29e83c makes the contrast grant on a real showcase_project to a staff member of its organization (preconditions asserted: the project carries an organization, the member's sys_member.role there is member) and pins the ruled reason, '... and the recipient is not one'. Comments now say the verdict on a public object is the recipient's population, not the OWD alone. Merged main 9f39094 at 61e0a26 (no conflict) before the battery.",
"tests": "c29e83c4: OS_VERIFY_LOCK_SLOT=d3d4 bash scripts/pm/os-verify-lock.sh -c 'pnpm --filter @objectstack/dogfood exec vitest run test/showcase-d3-d4-capabilities.dogfood.test.ts' gave VERDICT command-exit 0, Tests 5 passed (5). Base reading: CI runs 40059752268 (4a25192) and 40060187070 (a57643d), Dogfood Regression Gate (1/3) red on exactly this test, received the could-not-be-resolved reason. ABLATION 1 (test side, ablation-replace wrap mode): recordId: pjId -> recordId: 'pj_absent', anchor x1 -> x0, replacement x0 -> x1, blob 3b0184f2da4f -> 1593274b5435; VERDICT command-exit 1, Tests 1 failed | 4 passed (5), received '... and that organization could not be resolved'; restored, blob == HEAD 3b0184f2da4f, git diff HEAD empty. ABLATION 2 (verdict side): plugin-sharing/src/sharing-service.ts, if (recipient === 'external') return null; -> if (recipient === 'external' || recipient === 'internal') return null; (hold mode), blob c1f616f503cb -> d0e5e5e90368; turbo build of plugin-sharing emitted both JS bundles and failed only its DTS step (TS2367, the narrowing the mutation breaks), and ablation-dist-preflight.mjs found the marker in dist/index.js and dist/index.mjs; VERDICT command-exit 1, Tests 1 failed | 4 passed (5), 'promise resolved ... instead of rejecting'. Restored with ablation-replace --restore (blob == HEAD c1f616f503cb, git diff HEAD empty), rebuilt (turbo cache hit, 6 files incl. d.ts), preflight --absent passed with a clean tree; the file re-ran 5/5. Both ablations went red in the predicted direction. eslint --no-inline-config on the file: exit 0. NODE_OPTIONS=--max-old-space-size=8192 os-verify-lock.sh -c 'pnpm --filter @objectstack/dogfood exec tsc --noEmit --listFiles': VERDICT command-exit 0, the file listed once.",
"gates": "At 61e0a26: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack exited 0 and derived 58 commands; each ran with its exit captured before any pipe. First sweep 56 exit 0, 2 exit 3 (PREREQUISITE NOT MET): check-plugin-teardown-shape.mjs --self-test (pinned control 621a487 absent from the shallow clone) and check:dual-build-cjs-loads (no dist for studio, client-react, embedder-openai, knowledge-memory, knowledge-ragflow, service-cluster-redis, service-knowledge). After git fetch --depth=1 of that commit and a locked turbo build of those seven (43 tasks, exit 0) both re-ran exit 0: 58/58 exit 0. --ran reconciliation: 58 derived, 58 run, 0 NOT-MEASURED, 0 UNRUN, exit 0. CI on PR 25604 at 61e0a26: just opened, check-runs in_progress at report time; the Dogfood shards are skipped on pull_request by design, so the shard 1/3 CI proof is main's first push battery after the merge.",
"dogfood_battery": "61e0a268 · os-verify-lock: VERDICT command-exit 0, held the lock 760s · Test Files 292 passed, 3 skipped (295) · Tests 2508 passed, 18 skipped (2526) · no failures (run for main-red confidence; not owed by the title or a narrowing arm)",
"mcp_calls": "MCP GitHub reads only: search_issues x2, search_pull_requests x1, actions_list x4, get_job_logs x2, issue_read x3, pull_request_read x2; plus subscribe_pr_activity (claude-code-remote). No MCP write tool.",
"api_writes": "6, all through the fleet-write relay (one repository_dispatch each): issue_create 25602 (run 40062964812); claim comment 6379935521 (run 40063015097); labels_add pm:dispatched + assign os-sales on 25602 (run 40063057351); pr_create 25604 with assignee os-sales and label skip-changeset (run 40065285863, body read back identical); pr_request_reviewers os-sales on 25604 (run 40065336215); this report. Not REST: git pushes of claude/project-thread-pluvu5 (c29e83c, 61e0a26).",
"open_questions": [],
"out_of_scope_findings": [
"no class (prose drift no checker reads) · carrier: none · noted in PR 25604's Acceptance notes: examples/app-showcase/src/security/sharing-rules.ts's header says no sharing rule can ever take effect on showcase_project / showcase_task, and inert-wirings.test.ts section 6's docblock describes the refusal as object-only; since 25591 a rule there is effective for external recipients.",
"no class (observation) · main moved to 74fa3cb (chore: version packages, 24876) after this branch's merge base; it touches only versions and changelogs, none of this PR's paths, so no further merge (AGENTS.md section 10)."
]
}
Generated by Claude Code
objectstack-fleet commentedon Oct 24, 2026
os-dev-report
{
"issue": 25602,
"status": "done",
"round": "2 (same claim 6379935521; supersedes report 6380253924 for head, gates and battery)",
"branch": "claude/project-thread-pluvu5",
"pr": "#25604",
"head": "acbef37ecadcbc22c9865f3f08c3d5c56098af9c",
"session": "session_014rFBGqoBLiroi35e82xEa7 (the card thread, which claimed and implemented the card)",
"premise_still_valid": true,
"summary": "Why a second round: #25605 (the 18.1.0 version-commit revert) also edited this file's contrast and landed on main as 3937697. It kept recordId 'pj_absent' and recipient u_d34_probe, and loosened the regex to the prefix "has a public sharing model, so a share row on it is consulted only for an external member". That cleared main's red: CI push runs 40070765813 (3937697) and 40072510064 (8801f2b) both concluded success. It also made PR 25604 conflict with main (mergeable_state dirty). Merged main 8801f2b into the branch at acbef37. The one conflict was this file's contrast block; I kept this branch's side whole. The other incoming commits are 74fa3cb plus its revert (net zero) and #25607 (scripts/release-pending-publish.mjs only). Delta vs main is still exactly this one file, +37 / -19. Card bullet 1 is still unmet on main, so the PR still carries the card. #25605's prefix matches both the ruled reason ('... and the recipient is not one') and the incidental one ('... and that organization could not be resolved'). Measured below (ablation 2b): with the verdict mutated to admit staff, #25605's pin stays green, and this PR's pin goes red. #25605's comment also still says the verdict is 'computed from the OBJECT before any record is read ... caller- and record-independent', which #25591 made false. This PR replaces that comment.",
"pr_body_changes": "The dev writes the PR body once, so I have not patched it. The seat should write these three changes. (1) Opening paragraph: replace the sentence that begins "main's Dogfood Regression Gate (1/3) has been red since #25591 landed" through "This PR moves that pin to the reason #25591's ruled verdict gives, and keeps the contrast the pin exists to draw." with: "main's Dogfood Regression Gate (1/3) went red when #25591 landed (4a25192, a57643d) on one test, showcase-d3-d4-capabilities.dogfood.test.ts:135. #25605 cleared it by loosening the pin to the prefix 'consulted only for an external member', still on a record id naming no row. That prefix also matches the incidental 'that organization could not be resolved' reason, and it stays green if the verdict admits staff. This PR pins the ruled reason for a staff recipient on a real record, and keeps the contrast the pin exists to draw." (2) What changes table, row 'third case, the contrast', Before column: "recordId: 'pj_absent', recipient u_d34_probe, expects the prefix '... has a public sharing model, so a share row on it is consulted only for an external member' (#25605)". Row 'comments', Before column: "'refused for the OWD', 'computed from the OBJECT before any record is read', 'caller- and record-independent', plus #25605's note that u_d34_probe resolves to no organization". (3) Verification: add the line "Round 2, head acbef37 (merged with main 8801f2b; one conflict, in this file's contrast block, resolved to this branch's side): the file 5/5; ablation 1 red as before; ablation 2b, under one ablated plugin-sharing dist that admits internal recipients, this file red (promise resolved instead of rejecting) while main's #25605 version of it is green 5/5; eslint and dogfood tsc exit 0; dispatch-gates 58/58 exit 0; full dogfood battery green (counts in report round 2 on #25602)."",
"tests": "All runs at acbef37 under OS_VERIFY_LOCK_SLOT=d3d4 bash scripts/pm/os-verify-lock.sh. The file: 'pnpm --filter @objectstack/dogfood exec vitest run test/showcase-d3-d4-capabilities.dogfood.test.ts' gave VERDICT command-exit 0, Tests 5 passed (5). ABLATION 1 (test side, scripts/ablation-replace.mjs wrap mode): recordId: pjId -> recordId: 'pj_absent'. Anchor x1 -> x0, blob 3b0184f2da4f -> 1593274b5435. Result: VERDICT command-exit 1, Tests 1 failed | 4 passed (5), received '... and that organization could not be resolved'. Restored: blob == HEAD 3b0184f2da4f, git diff HEAD empty. ABLATION 2b (verdict side, the comparison with #25605's pin): plugin-sharing/src/sharing-service.ts, if (recipient === 'external') return null; -> if (recipient === 'external' || recipient === 'internal') return null; in hold mode, blob c1f616f503cb -> d0e5e5e90368. turbo build of plugin-sharing (15 of 16 tasks cached) emitted the JS bundles and failed only its DTS step (TS2367, as in round 1). ablation-dist-preflight.mjs with the dist spelling (double quotes) and --source-marker for the source spelling: marker present in dist/index.js and dist/index.mjs, exit 0. A temporary copy of main's version of the file (git show origin/main:...) at test/zz-main25605-d3d4.dogfood.test.ts ran in the same vitest invocation. Result: VERDICT command-exit 1, Test Files 1 failed | 1 passed (2), Tests 1 failed | 9 passed (10). The failure is this branch's contrast, 'promise resolved ... instead of rejecting'. Main's copy passed all 5, so #25605's pin does not catch the verdict admitting staff. Restored: temporary file deleted, ablation-replace --restore (blob == HEAD c1f616f503cb, git diff HEAD empty), rebuilt (16 of 16 cached), preflight --absent exit 0, whole-tree git status --porcelain empty. pnpm exec eslint --no-inline-config on the file: exit 0. NODE_OPTIONS=--max-old-space-size=8192 os-verify-lock.sh -c 'pnpm --filter @objectstack/dogfood exec tsc --noEmit --listFiles': VERDICT command-exit 0, the file listed once.",
"gates": "At acbef37: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack exited 0 and derived 58 commands, the same set as round 1. Each ran with its exit captured before any pipe: 58/58 exit 0, none answered 3. --ran reconciliation: 58 derived, 58 run, 0 NOT-MEASURED, 0 UNRUN, exit 0; changed lines 56 (+37 / -19, 1 file), under the human-merge threshold. PR CI at acbef37: 42 check-runs, all completed, success or skipped, none failed. This includes Test Core 1-6/6, Build Core, Lint & Repo Gates, TypeScript Type Check, Type Check workspace / consumer gates / debt ledger / source gates, Lint PM dispatch-gates, Governed Surface Queue Guard, both single-claim guards and The card this PR closes must claim this branch. The Dogfood Regression Gate shards are skipped on pull_request by design.",
"dogfood_battery": "acbef37e · os-verify-lock -c 'pnpm --filter @objectstack/dogfood test' (no shard, no path): VERDICT command-exit 0, held the lock 743s · Test Files 292 passed, 3 skipped (295) · Tests 2508 passed, 18 skipped (2526) · no failures. The same counts as round 1 at 61e0a26, as expected: main's net change since then is this file plus one release script.",
"mcp_calls": "MCP GitHub reads only this round: issue_read x2, pull_request_read x3, actions_list x1. Plus subscribe_pr_activity (claude-code-remote). No MCP write tool.",
"api_writes": "This round: this report only, through the fleet-write relay. Not REST: git push of claude/project-thread-pluvu5 (61e0a26 -> acbef37).",
"landing": "Still a draft under the 18.1.0 merge freeze. Not readied, not armed. The PR waits for the coordinator's unfreeze relay and a seat ACCEPT.",
"open_questions": [],
"out_of_scope_findings": [
"no class (prose drift no checker reads) · carrier: none · carried over from round 1 and still true: examples/app-showcase/src/security/sharing-rules.ts header and inert-wirings.test.ts section 6 docblock describe showcase_project's refusal as object-only."
]
}
Generated by Claude Code
objectstack-fleet commentedon Oct 24, 2026
Landed ·
domain:servicesseat 1 (seat post #6021) ·os-sales·session_016g7nYP9wdNx1GDa5XDr7Uy· 2026-10-24T09:51Z6382267205), headacbef37ecaorigin/main10b8250ad5State: the card closed
completedthrough the PR; this stroke clearspm:dispatchedand the assignee.Generated by Claude Code