Skip to content

docs(skills): teach the isDefault everyone baseline and its app-capability rule in objectstack-data security.md #18531

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
os-zhuang merged 3 commits into from
Sep 17, 2026
+13 −1
Merged

docs(skills): teach the isDefault everyone baseline and its app-capability rule in objectstack-data security.md #18531

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4ea4389
docs(skills): teach the isDefault everyone baseline and its app-capab…
claude Sep 16, 2026
68e1b07
Merge origin/main (21b7c12b4) into claude/issue-17359-skills-capabili…
claude Sep 17, 2026
dfe3551
chore(scripts): raise the security.md skills token ceiling to 2543 un…
claude Sep 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion scripts/check-skills-token-ratchet.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -421,7 +421,16 @@ export const CEILINGS = new Map([
// NEW FILE (#14296 item 1 = A, condition (b)): the entry's Security & Access
// Control block moved here whole. Pinned at its landed count — no headroom,
// because a split that arrives with budget is a raise wearing a new path.
['skills/objectstack-data/rules/security.md', 2480],
// 2480 -> 2543 (#17359, PR #18531): one three-line bullet after the RBAC
// section's `Source:` line — `isDefault: true` is the `everyone` baseline
// (ADR-0090 D5); it may carry app capabilities declared under `capabilities:`
// and granted via `systemPermissions`; lint and boot refuse a platform
// capability or an undeclared name there. The DECLARE/GRANT pair was taught
// nowhere in the bundle, so an author writing `systemPermissions` from the
// schema alone writes the refused shape. +63 tokens, zero headroom to absorb
// any of it, ceiling +63. Maintainer ruling 2026-09-17 (recorded on #17359 as
// comment 5710537499), verbatim and untranslated: 「security.md 允许增加到 2543」.
['skills/objectstack-data/rules/security.md', 2543],
// 3024 -> 3109 (2026-08-31 app-repo-principles raise, see the block above).
// Severity Levels listed the three values and left the CHOICE unstated: a
// block rests on a judgement a person made, so a machine-inferred signal — a
Expand Down
3 changes: 3 additions & 0 deletions skills/objectstack-data/rules/security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,9 @@ export const salesUser = definePermissionSet({
`allowTransfer` (ownership change), `viewAllRecords` / `modifyAllRecords`
(super-user, bypass sharing).
- Source: `node_modules/@objectstack/spec/src/security/permission.zod.ts`
- **`isDefault: true` = the `everyone` baseline (ADR-0090 D5).** It may carry app
capabilities declared under `capabilities:` (`defineCapability`) and granted via
`systemPermissions`; lint and boot refuse a platform capability or undeclared name there.
- Combine with `enable.apiMethods` to also restrict the HTTP surface.

## Assigning a permission set to a user
Expand Down
Loading