docs(skills): teach the isDefault everyone baseline and its app-capability rule in objectstack-data security.md by os-justin · Pull Request #18531 · objectstack-ai/objectstack

os-justin · 2026-09-16T21:05:43Z

Status 2026-09-17 — the paragraph below is historical and discharged: the follow-up it names landed as #18535 (PR #18602, origin/main 21b7c12b4), the ceiling was ruled, and this branch merged origin/main; see "Patch round" at the end.

⛔ Blocked-by: the #17189 step-② follow-up (the plugin-security boot refusal and the packages/lint security-anchor-high-privilege rule passing the declared-capability list) — not landed on origin/main 2496415, and no open card names it. Do not land this PR before that follow-up: today the bullet's second sentence describes the protocol (packages/spec/src/security/high-privilege.ts + the ADR-0090 D5 revision, landed by PR #17814 and PR #17811) and not yet the running lint/boot — see "Premise check" below.

What

One 3-line bullet in skills/objectstack-data/rules/security.md, inserted after the Source: line of "## Object-level permissions (RBAC)" — the construct accepted on the card (assessment 5616225081, ACCEPT 5616301504) with the ACCEPT's boot-wording correction applied (「fails lint and boot」 overstated the boot side; boot refuses the binding with a warning, it does not fail). Every other line of the file is byte-identical (git diff --numstat = 3 0); skills/objectstack-platform/SKILL.md unchanged; no other file.

Lines 35–37, widths 81 / 82 / 91 characters (the file's widest line is 93):

- **`isDefault: true` = the `everyone` baseline (ADR-0090 D5).** It may carry app
  capabilities declared under `capabilities:` (`defineCapability`) and granted via
  `systemPermissions`; lint and boot refuse a platform capability or undeclared name there.

Wording deviation, declared: the dispatch's suggested passive form 「is refused by lint and at boot」 puts line 3 at 101 characters, over the 93 cap; the active form above keeps every noun of the accepted text and the ACCEPT's own verb ("refuse") at 91. No other word moved.

Premise check on `origin/main` `2496415`

A1 holds: security.md is 211 lines, widest line 93, lines 31–34 verbatim as quoted in the assessment. Its last touch is 7d350a4 (docs(skills): state what single posture means for the organization count in objectstack-data #17476, the Multi-tenancy section), not 6a3bcd8 as the dispatch read; the neighbours are unaffected.
A2 holds in substance: git grep -F over skills/** at 2496415 — defineCapability 0, systemPermissions 0, isDefault 1 (a list-view example), capabilities: 5 — and all five are the data-hook VM tokens (capabilities: ['api.read', …] in objectstack-data/references/data-hooks.md ×4 and objectstack-ui/rules/actions.md ×1), a third registry, not the ADR-0066 D1 stack key. Positive control definePermissionSet = 5 hits. The bullet duplicates nothing.
A3 holds, and the boot side is narrower than the dispatch assumed: bindBaselineToEveryone (packages/plugins/plugin-security/src/security-plugin.ts:3581) logs ctx.logger.warn('[security] refusing to bind fallback set to everyone — high-privilege bits', { set, offending }) and continues — a warning and no binding, never a failure. ⚠️ Its call is describeHighPrivilegeBits(boot) (:3585) with NO AnchorBindingContext, and so are the other three consumers: security-plugin.ts:5475, suggested-audience-bindings.ts:961, packages/lint/src/validate-security-posture.ts:771. The predicate's own contract (high-privilege.ts:134): 「Omission refuses」. PR feat(spec): an app-declared capability token is not a platform system permission at the everyone anchor #17811's changeset says it in so many words: 「No shipped behaviour moves in this release. Every current caller invokes the predicates with the old arity … The @objectstack/plugin-security boot refusal and the @objectstack/lint security-anchor-high-privilege rule pass the declared list in a follow-up」. ⇒ Today a DECLARED app token on the isDefault: true set is still refused by lint (error) and at boot (warn, no binding) — the shape hotclm hit. The bullet is correct for the protocol and premature for the runtime; per 「文档应该以实际实现为准」 this PR waits for the follow-up. The 「or undeclared name」 clause stays: the implicit placeholder derivation in bootstrap-declared-capabilities.ts is alive, and describeHighPrivilegeBits excuses only names on context.declaredCapabilities, platform floor absolute.
Keys and anchor, all present: capabilities on ObjectStackDefinitionSchema (packages/spec/src/stack.zod.ts:467, .describe('[ADR-0066 D1] …')); defineCapability (packages/spec/src/security/capabilities.ts:214); systemPermissions on PermissionSetSchema (packages/spec/src/security/permission.zod.ts:691, schema at :587); isDefault at :682 with .describe('[ADR-0090 D5] App baseline for the everyone position …'); ADR-0090 D5 at docs/adr/0090-permission-model-v2-concept-convergence.md:46, its An app-declared capability with scope: 'org' counts as a high-privilege bit, so a set carrying only app capability tokens cannot bind to the everyone anchor #17189 revision block at :249. Control: a nonexistent key greps 0 in permission.zod.ts.

Line readings (the `skills/**` rule)

reading	before (`2496415`)	after (`4ea43892e`)	net
`skills/objectstack-data/rules/security.md`	211	214	+3
package: every `SKILL.md` under `skills/` (10) + `skills/objectstack-data/{rules,references}/*` (10) — 20 files	8959	8962	+3

Token reading (the sister gate scripts/check-skills-token-ratchet.mjs, convention ceil(utf8 bytes / 4)): security.md is 2543 tokens against a ceiling of 2480 (CEILINGS row at scripts/check-skills-token-ratchet.mjs:424, pinned at the landed count with zero headroom) — over by 63, the gate is RED at this head. Verdict line, verbatim: 「✗ check-skills-token-ratchet: skills/objectstack-data/rules/security.md is 2543 tokens; the ratchet ceiling is 2480 (over by 63). … The other direction lands only in a PR whose body quotes a maintainer ruling authorizing it. ⛔ MAINTAINER-ONLY」. Not raised here and not paid by deletion (the accepted construct pins every other line of the file). Landing needs that one row moved to 2543 under the maintainer's word, or an equivalent deletion in the same file directed by the PM.

Changeset

skip-changeset, by measurement: a walk over every tracked package.json finds 0 manifests whose files[] names a skills path (positive control: 70 manifests name dist); no skills/*/package.json exists; the catalog ships from the GitHub tree by npx skills add objectstack-ai/objectstack/skills (skills/README.md; packages/create-objectstack/src/skills-install.ts:62 SKILLS_CATALOG = 'objectstack-ai/objectstack/skills'), never inside an npm tarball. .github/workflows/pr-automation.yml:758 lists skills/ among the releases-nothing paths.

Gates (local, at `4ea43892e`)

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 22 commands; every one was run with redirect-then-$? capture; --ran reconcile: 「22 derived, 22 run, 0 NOT-MEASURED, 0 UNRUN」, exit 0.

21 × exit 0 — among them check:skill-frame-sync, check:skill-identifier-liveness, check:skill-compatibility, check:nul-bytes, check:doc-authoring, check:role-word, check:corpus-claim-drift, check:cross-package-test-inputs, check:pm-governed-merges, check-skills-token-ratchet --self-test.
node scripts/check-skills-token-ratchet.mjs → exit 1 (the +63 above).
pnpm --filter @objectstack/lint run check:doc-formula-expressions → first run exit 3 PREREQUISITE NOT MET (@objectstack/formula and @objectstack/lint unbuilt — not a measurement); built both under scripts/pm/os-verify-lock.sh (VERDICT command-exit 0, held 142s), re-run → exit 0.
Not applicable: the 14 pending-changeset families (no changeset, by the measurement above); the 2 workflow-valued families and the 1 path-scheduled CI job are CI's own.
No ① dependency-closure build and no ② package test: the diff touches no package.
Control-character self-scan of the file: none.

Acceptance notes

noted, not filed — 承接者: the PM, relayed in the dev report as a class (b) contract finding with dedupe words: ADR-0090 D5 [ruled] and describeHighPrivilegeBits say a declared app token is not an offending bit, while the four consumers listed under A3 still refuse it. PR feat(spec): an app-declared capability token is not a platform system permission at the everyone anchor #17811's changeset promises the follow-up; no open card in domain:services (48), domain:devx (103), domain:spec (144), security (19) or finding (78) names it (lists read 2026-09-16, keyword set 17189 / bindBaselineToEveryone / declaredCapabilities / AnchorBindingContext / security-anchor-high-privilege).
noted, not filed — 承接者: 无: with this bullet the word "capabilities" names three registries across the published bundle (data-hook VM tokens, requires: platform service tokens, ADR-0066 D1 stack declarations). Not a defect; the assessment placed the stack key beside its GRANT key on purpose.

维护者速读(草稿)

改了什么:在 skills/objectstack-data/rules/security.md 的「Object-level permissions (RBAC)」键列表里加一条三行要点:isDefault: true 的权限集就是 everyone 基线(ADR-0090 D5);它可以携带本应用在 capabilities: 下用 defineCapability 声明、再经 systemPermissions 授予的应用能力;平台能力或未声明的名字放在那里会被 lint 与启动拒绝。文件其余各行一字未动,skills/objectstack-platform/SKILL.md 不动。

2026-09-17 补丁轮:合入 origin/main(合并提交 68e1b07e1;#18535 已落地,这三行描述的 lint 与启动行为已成真,三行本身一字未改),并按维护者裁定把 scripts/check-skills-token-ratchet.mjs 里 security.md 的 token 上限行从 2480 抬到 2543,上限行旁按该文件自己的抬限格式逐字引用裁定「security.md 允许增加到 2543」;合并后实测恰为 2543(ceil(utf8 bytes / 4)),余量 0,其它上限行不动。

为什么改:#17189 裁定 (i) 之后,「默认权限集携带本应用自己的门牌令牌」这一组合从被拒变为合法(前提是先声明),而已发布的 skills 里没有任何一处写到这三个键;AI 作者照 schema 直接写 systemPermissions 就会写出 hotclm 踩过的那种形状。已接受的评估(5616225081)裁定只加这一条、不加反例、+3 行。

风险与代价(含回滚):① 时序——#17811 只落了协议这一半(spec 谓词 + ADR 修订),启动侧与 lint 侧尚未把声明清单传给谓词,今天照这条要点写出的默认集仍会被 lint 报错、启动只警告不绑定;所以本 PR ⛔ 不应先于那一半落地(正文顶部已标 Blocked-by)。② 已发布 skills 的 token 棘轮:security.md 上限 2480、余量 0,本次 +63 使 check-skills-token-ratchet 变红;上限行(scripts/check-skills-token-ratchet.mjs:424)按门禁自述只有维护者裁定可抬,本 PR 未抬。回滚 = revert 这一个提交(单文件 +3 行,无发布物)。

2026-09-17 更新:① 已解除——#18535 落地,启动侧与 lint 侧都已把声明清单传给谓词;② 已解除——维护者裁定抬到 2543,本 PR 抬行,check-skills-token-ratchet 在新 head 上为绿。回滚 = revert 两个非合并提交(4ea43892 三行 + dfe355143 上限行),仍无发布物。

席位意见:

你要做的:① 确认 #17189 第 ② 步(plugin-security 启动拒绝 + packages/lint 规则传入声明清单)是否已有卡;没有则立卡,并让本 PR 排在它之后合并。② 决定 token 上限:把 security.md 那一行抬到 2543(在本 PR 正文引用你的裁定),或指示在同一文件删等量内容(这会动已接受评估钉死的其他行)。③ 之后由 skills 席四件套复核,你点合并。

2026-09-17 更新:① ② 已完成(#18535 落地;上限已按你的裁定抬到 2543 并在正文与上限行旁引用),只剩 ③。

Patch round — merge main + ceiling raise (2026-09-17)

Both park conditions discharged (park note 5704585750, update 5710537792, unpark 5711767613). The Blocked-by: paragraph at the top of this body is historical: #18535 landed on origin/main as 21b7c12b4 (PR #18602). Same branch, commits added on top — no rebase, no force-push, no new PR.

Merge: 68e1b07e1 = git merge --no-ff origin/main (21b7c12b4) into the branch. Clean (git merge-tree --write-tree exit 0; 37 commits behind at merge time); no os-regen-pending recorded (the branch touches no generated artifact). Three-dot delta vs origin/main after the round: skills/objectstack-data/rules/security.md +3/−0 (byte-identical to 4ea43892), scripts/check-skills-token-ratchet.mjs +10/−1.

Re-count (the ratchet's convention, ceil(utf8 bytes / 4)): security.md on origin/main 21b7c12b4 = 9913 bytes → 2479 tokens (main did not touch the file since the branch forked); branch head before the round 4ea43892 = 10170 bytes → 2543; after the merge (68e1b07e1, and the head dfe355143) = 10170 bytes → 2543. Not more than 2543, so the raise is exactly the ruling. Line readings unchanged: file 211 → 214 (+3), widest line 93, package (20 files) 8959 → 8962.

Ratchet row (CEILINGS in scripts/check-skills-token-ratchet.mjs):

before: ['skills/objectstack-data/rules/security.md', 2480], (line 424 on 21b7c12b4)
after: ['skills/objectstack-data/rules/security.md', 2543], (line 433 on dfe355143), with the raise recorded beside the row in the file's own raise-ritual form (before → after, the surface it authorizes, the arithmetic +63 / headroom 0 / ceiling +63, the ruling verbatim with its record id). No other row moves; the ceiling equals the measurement.

Maintainer ruling, verbatim and untranslated (maintainer, 2026-09-17, recorded on #17359 as comment 5710537499):

「security.md 允许增加到 2543」

That is the authorization the ratchet's own rule requires: 「the other direction lands only in a PR whose body quotes a maintainer ruling authorizing it」.

Re-read of the three lines against the landed code (origin/main 21b7c12b4):

clause	verdict	evidence
`isDefault: true` = the `everyone` baseline (ADR-0090 D5)	still true	`packages/spec/src/security/permission.zod.ts:682` `.describe('[ADR-0090 D5] App baseline for the everyone position …')`; ADR-0090 D5 at `docs/adr/0090-permission-model-v2-concept-convergence.md:46`
it may carry app capabilities declared under `capabilities:` (`defineCapability`) and granted via `systemPermissions`	now true at boot and in lint (protocol-only before #18535)	`packages/plugins/plugin-security/src/declared-capability-context.ts` (`readDeclaredCapabilityContext` reads the stack's `capabilities:` declarations, registry first, metadata service as fallback); boot bind `security-plugin.ts:3592–3595` `describeHighPrivilegeBits(boot, anchorContext)`; engine write gate `:5503–5508`; confirm path `suggested-audience-bindings.ts:968–972`; lint `packages/lint/src/validate-security-posture.ts:439–443` builds `anchorContext` from `stack.capabilities`, `:795` passes it to `describeAnchorForbiddenBits`
lint and boot refuse a platform capability or undeclared name there	still true	`packages/spec/src/security/high-privilege.ts:70–74` the platform floor (`PLATFORM_CAPABILITY_NAMES` is never excused), `:134` 「Omission refuses」 — a token absent from `declaredCapabilities` stays offending; lint emits `security-anchor-high-privilege` at severity `error` (`validate-security-posture.ts:795–808`); boot logs `[security] refusing to bind fallback set to everyone — high-privilege bits` and skips the binding (`security-plugin.ts:3595–3600`)

No clause corrected; the three lines are unchanged.

Ablation of the row (from the committed head dfe355143; trap-restored, absolute paths; no dist/ involved — the gate reads its own source): with the row reverted to 2480 on disk (grep counts: 2480-row 1, 2543-row 0) the gate exits 1 — 「✗ check-skills-token-ratchet: skills/objectstack-data/rules/security.md is 2543 tokens; the ratchet ceiling is 2480 (over by 63). … ⛔ MAINTAINER-ONLY」; restored with git checkout HEAD -- …: git hash-object = HEAD blob 5b984866, git diff HEAD empty, git status --porcelain empty, gate exits 0 again with 「is 2543 tokens (ceiling 2543; headroom 0)」.

Gates (worktree at dfe355143; node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, change set derived from the merge base 21b7c12b4, 2 paths): 40 commands derived, all 40 run with redirect-then-$? capture; --ran reconcile: 「40 derived, 40 run, 0 NOT-MEASURED, 0 UNRUN」, exit 0. pnpm --filter @objectstack/lint run check:doc-formula-expressions measured after building @objectstack/lint... under scripts/pm/os-verify-lock.sh (「VERDICT command-exit 0 · held the lock 136s · waited 0s」). pnpm check:pm-dispatch-gates took 626 s under contention. The list, byte-for-byte as derived, with exit codes:

node scripts/check-ci-filter-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0
node scripts/check-comment-mask-corpus.mjs :: exit 0
node scripts/check-declaration-mirrors.mjs :: exit 0
node scripts/check-declaration-mirrors.mjs --self-test :: exit 0
node scripts/check-doc-route-spelling.mjs --advisory :: exit 0
node scripts/check-doc-route-spelling.mjs --self-test :: exit 0
node scripts/check-scripts-symbol-anchors.mjs :: exit 0
node scripts/check-scripts-symbol-anchors.mjs --self-test :: exit 0
node scripts/check-self-test-wired.mjs :: exit 0
node scripts/check-self-test-wired.mjs --self-test :: exit 0
node scripts/check-self-test-workflow-commands.mjs :: exit 0
node scripts/check-self-test-workflow-commands.mjs --self-test :: exit 0
node scripts/check-skills-token-ratchet.mjs :: exit 0
node scripts/check-skills-token-ratchet.mjs --self-test :: exit 0
node scripts/check-whole-set-label-write.mjs :: exit 0
node scripts/check-whole-set-label-write.mjs --self-test :: exit 0
node scripts/pm/bare-root-worklist.mjs --self-test :: exit 0
pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0
pnpm check:agent-test-spelling :: exit 0
pnpm check:bash32-floor :: exit 0
pnpm check:cli-command-ids :: exit 0
pnpm check:corpus-claim-drift :: exit 0
pnpm check:cross-package-test-inputs :: exit 0
pnpm check:doc-authoring :: exit 0
pnpm check:driver-memory-census :: exit 0
pnpm check:entry-guard :: exit 0
pnpm check:nul-bytes :: exit 0
pnpm check:parse-guard :: exit 0
pnpm check:pm-dispatch-gates :: exit 0
pnpm check:pm-governed-merges :: exit 0
pnpm check:pnpm-filter-targets :: exit 0
pnpm check:ratchet-remedy-authority :: exit 0
pnpm check:refd-timer-probe :: exit 0
pnpm check:role-word :: exit 0
pnpm check:skill-compatibility :: exit 0
pnpm check:skill-frame-sync :: exit 0
pnpm check:skill-identifier-liveness :: exit 0
pnpm check:watch-hint-literal :: exit 0

Named verdict lines: check-skills-token-ratchet 「✓ … security.md is 2543 tokens (ceiling 2543; headroom 0)」 and 「34 authored bundle file(s) within their ceilings; 10 generator-owned file(s) measured, not ratcheted」; its --self-test 「65 cases pass」; check-ratchet-remedy-authority 「255 scripts swept … 15 mark the expanding remedy ⛔ MAINTAINER-ONLY」 (unchanged); check-skill-frame-sync self-test 14 cases + the frame coherent. Not owed locally: the 51 artifact-roster, 11 wide-population and 14 pending-changeset families, the path-scheduled CI job and the always-runs tail (CI's own); no ① dependency-closure build or ② package test is owed — the diff touches no package.

Governed: node scripts/pm/check-governed-merges.mjs --test skills/objectstack-data/rules/security.md scripts/check-skills-token-ratchet.mjs → exit 3, 「GOVERNED — a human merge is the review record for this PR」 (1 of 2 paths hit the register; skills/** is the rules layer). Still draft; not for any seat to land.

Changeset: still skip-changeset — scripts/check-skills-token-ratchet.mjs is a repo-root gate script (private root package; no files[] ships it), and the skills/** measurement above stands. Label set read back after the round: documentation, size/s, skip-changeset (no label written this round).

Control characters: grep -naP over both touched files → no match (exit 1).

Generated by Claude Code

…ility rule in objectstack-data security One bullet in the permission-set key list of `skills/objectstack-data/rules/security.md`, inserted after the `Source:` line of "## Object-level permissions (RBAC)": `isDefault: true` is the `everyone` baseline (ADR-0090 D5); it may carry app capabilities declared under `capabilities:` (`defineCapability`) and granted via `systemPermissions`; lint and boot refuse a platform capability or an undeclared name there. No other line of the file moves; `skills/objectstack-platform/SKILL.md` is unchanged. Claude-Session: https://claude.ai/code/session_01Gqi43smmqjJ5sUrhfoPeKu Co-authored-by: Claude <noreply@anthropic.com>

os-justin · 2026-09-16T21:12:50Z

Parked (draft, ⛔ not for approval yet) — skills seat, session_01Gqi43smmqjJ5sUrhfoPeKu, 2026-09-16T21:12Z. The three lines are the accepted construct (#17359 assessment 5616225081, ACCEPT 5616301504) and read correctly against ADR-0090 D5 and packages/spec/src/security/high-privilege.ts; they do NOT yet describe today's boot and lint, whose consumers call the predicate without the declared list — that gap is #18535, and this card's Blocked-by: points at it. Release conditions, both: ① #18535 lands (then this PR merges origin/main and re-runs the skills/** gates); ② the maintainer rules the check-skills-token-ratchet ceiling for skills/objectstack-data/rules/security.md (2480 → 2543, +63 — put to the maintainer in the seat's round report, recommendation: raise, quoted here at landing). Expected-red signature on this head, and only this one: check-skills-token-ratchet 「is 2543 tokens; the ratchet ceiling is 2480 (over by 63)」. The four-piece (record, 速读终稿, needs-user-decision, review request) is hung when ① holds.

Generated by Claude Code

os-justin · 2026-09-17T07:15:46Z

Park note update — skills seat, session_01Gqi43smmqjJ5sUrhfoPeKu, 2026-09-17T07:15Z. Release condition ② is discharged: the maintainer ruled, verbatim in the seat's chat, 「security.md 允许增加到 2543」 (recorded on #17359). The raise rides this PR's patch round: ratchet row skills/objectstack-data/rules/security.md 2480 → 2543 in scripts/check-skills-token-ratchet.mjs with the ruling quoted beside it, and this body quotes it. Condition ① (#18535 on origin/main) still holds the park; the seat is claiming #18535 as the ownerless blocker. ⛔ Still draft, ⛔ not for approval yet.

Generated by Claude Code

os-justin · 2026-09-17T09:03:23Z

Unparked — skills seat, session_01Gqi43smmqjJ5sUrhfoPeKu, 2026-09-17T09:03Z. Both release conditions are discharged: #18535 landed as 21b7c12b4 at 2026-09-17T09:00:08Z (the consumers now pass the declared capabilities), and the ceiling ruling stands (5710537499, 「security.md 允许增加到 2543」). A patch round is in flight on this branch (claim continuation 5711767613): merge origin/main, re-read the three lines against the landed code, ratchet row 2480 → 2543 quoting the ruling, PR body quoting it, skills/** gates green. The four-piece (维护者速读终稿, needs-user-decision, review request to os-zhuang + hotlong) follows the seat's review of the new head. ⛔ Still draft until then.

Generated by Claude Code

…-guidance Release condition (1) of the park on PR #18531: #18535 landed on main, so the three lines this branch adds to skills/objectstack-data/rules/security.md now describe landed lint and boot behaviour. Claude-Session: https://claude.ai/code/session_01Gqi43smmqjJ5sUrhfoPeKu Co-authored-by: Claude <noreply@anthropic.com>

…der the maintainer ruling scripts/check-skills-token-ratchet.mjs row ['skills/objectstack-data/rules/security.md', 2480] -> 2543, in the file's own raise-ritual form: the ruling quoted verbatim and untranslated beside the row (recorded on #17359 as comment 5710537499) and the surface it authorizes named. The merged file measures 2543 tokens (ceil(utf8 bytes / 4)), so the raise is exactly the ruling. No other row moves. Claude-Session: https://claude.ai/code/session_01Gqi43smmqjJ5sUrhfoPeKu Co-authored-by: Claude <noreply@anthropic.com>

os-justin · 2026-09-17T09:31:14Z

维护者速读(终稿)

skills 席 session_01Gqi43smmqjJ5sUrhfoPeKu,2026-09-17T09:31Z。对照本席自己读的 diff(head dfe355143)校正 dev 草稿;席位意见已填。

改了什么 — 两个文件。① skills/objectstack-data/rules/security.md:在「Object-level permissions (RBAC)」键列表的 Source: 行之后加一条三行要点:isDefault: true 的权限集就是 everyone 基线(ADR-0090 D5);它可以携带本应用在 capabilities: 下用 defineCapability 声明、再经 systemPermissions 授予的应用能力;平台能力或未声明的名字放在那里会被 lint 与启动拒绝。+3 行,其余一字未动(与你已接受的构造字节相同)。② scripts/check-skills-token-ratchet.mjs:security.md 的 token 上限行 2480 → 2543,旁注按该文件自己的抬限格式逐字引用你的裁定「security.md 允许增加到 2543」(2026-09-17,记录 5710537499);合并后实测恰为 2543,余量 0,其它上限行不动。

为什么改 — #17189 裁定后,「默认权限集携带本应用自己声明的门牌令牌」从被拒变为合法(先声明再授予),但已发布 skills 里没有任何一处写这三个键,AI 作者照 schema 直接写 systemPermissions 就会写出 hotclm 踩过的形状。#18535 今天落地(21b7c12b4)后,启动与 lint 都已把声明清单传给谓词,这三行描述的是已运行的行为,不再是协议承诺。

风险与代价(含回滚) — 发布技能规则层,一条要点;token 上限只按你的裁定放宽 63,零余量。回滚 = revert 两个非合并提交(三行 + 上限行),无发布物。若将来 #18535 的行为被撤回,这三行会重新变成「文档先于实现」,届时需同步删除。

席位意见 — 荐合。构造是你已接受的原文,一字未改;两个停放条件(实现落地、上限裁定)都已按记录满足;门禁 40/40 绿,棘轮读数与裁定数字相等。

你要做的(一个动作) — Approve 本 PR(或直接人工合并);席位随后按裁定 C 落地。

Generated by Claude Code

os-justin added the skip-changeset PR has no user-facing published change; bypasses the changeset gate label Sep 16, 2026 — with Claude

github-actions Bot added size/xs documentation Improvements or additions to documentation labels Sep 16, 2026

os-justin mentioned this pull request Sep 17, 2026

[finding] AnchorBindingContext's docblock tells a boot caller to read sys_capability rows that do not exist at the ADR-0090 D5 bind moment — a literal follower refuses every declared token one layer in #18603

Closed

claude added 2 commits September 17, 2026 09:05

github-actions Bot added size/s and removed size/xs labels Sep 17, 2026

os-justin added the needs-user-decision label Sep 17, 2026 — with Claude

os-justin requested review from hotlong and os-zhuang September 17, 2026 09:31

os-zhuang approved these changes Sep 17, 2026

View reviewed changes

os-zhuang marked this pull request as ready for review September 17, 2026 09:37

os-zhuang added this pull request to the merge queue Sep 17, 2026

os-justin removed the needs-user-decision label Sep 17, 2026

Merged via the queue into main with commit 7299b94 Sep 17, 2026
47 checks passed

os-zhuang deleted the claude/issue-17359-skills-capability-guidance branch September 17, 2026 09:53

Navigation Menu

docs(skills): teach the isDefault everyone baseline and its app-capability rule in objectstack-data security.md - #18531

docs(skills): teach the isDefault everyone baseline and its app-capability rule in objectstack-data security.md#18531
os-zhuang merged 3 commits into
mainfrom
claude/issue-17359-skills-capability-guidance

os-justin commented Sep 16, 2026 •

edited

Loading

Uh oh!

os-justin commented Sep 16, 2026

Uh oh!

os-justin commented Sep 17, 2026

Uh oh!

os-justin commented Sep 17, 2026

Uh oh!

os-justin commented Sep 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

os-justin commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Premise check on origin/main 2496415

Line readings (the skills/** rule)

Changeset

Gates (local, at 4ea43892e)

Acceptance notes

维护者速读(草稿)

Patch round — merge main + ceiling raise (2026-09-17)

Uh oh!

os-justin commented Sep 16, 2026

Uh oh!

os-justin commented Sep 17, 2026

Uh oh!

os-justin commented Sep 17, 2026

Uh oh!

os-justin commented Sep 17, 2026

维护者速读(终稿)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

os-justin commented Sep 16, 2026 •

edited

Loading

Premise check on `origin/main` `2496415`

Line readings (the `skills/**` rule)

Gates (local, at `4ea43892e`)