Merge remote-tracking branch 'origin/main' into claude/issue-16004-skill-protocol-lines

Author: claude

.changeset/positions-name-is-not-platform-authority.md

@@ -0,0 +1,21 @@
+---
+"@objectstack/plugin-sharing": patch
+"@objectstack/plugin-approvals": patch
+"@objectstack/plugin-security": patch
+"@objectstack/runtime": patch
+---
+
+Four server-side authorization sites stop deriving platform-operator authority from a NAME in `ExecutionContext.positions`, and read the ADR-0095 posture rung instead.
+
+`positions[]` is the security axis, so it carries ADR-0057 D4 `sys_user_position` names alongside the built-ins. `sys_user_position` is `apiEnabled` and its `position` values are unconstrained, so a tenant could mint a row spelling `platform_admin` for one of their own users: `resolveUserAuthzGrants` pushed that name straight onto `grants.positions`, while `grants.posture` — derived from the unscoped `admin_full_access` grant and nothing else — correctly stayed `MEMBER`. Every reader of the name therefore answered `true` for a principal enforcement treats as an ordinary member. `resolve-authz-context.ts` states the rule at `hasPlatformAdminStanding` ("read the RUNG — never `positions.includes(...)`"), but a comment is not a gate and these four had not followed it.
+
+Each site now tests `posture === 'PLATFORM_ADMIN'`, byte-for-byte what `hasPlatformAdminStanding` returns:
+
+- **`plugin-sharing`** — `hasPlatformAuthority`. The minted row satisfied `assertResolvableAdminScope`, so an org-less caller holding only the ORG-scoped `manage_sharing` capability was answered with **every tenant's** sharing rules, and could delete platform-global rules. The `manage_platform_settings` capability spelling is unchanged.
+- **`plugin-approvals`** — `isOverrideActor`. This predicate already read the rung and then ORed the name onto it, which is no protection: an OR is only as strong as its weakest arm. Because the platform arm deliberately crosses the tenant wall, the minted row let a member of one organization approve, reject or recall a **different organization's** pending request while holding no slot in its slate. The `ADMIN_FULL_ACCESS` capability arm and both TENANT_ADMIN arms are unchanged.
+- **`runtime`** — the ADR-0126 §5 activation gate. Under a `group` or `isolated` posture this gate is the only thing between a tenant org admin and the **install-wide** `sys_metadata_activation` row, so the minted row reopened #10243 with a durable row behind it.
+- **`plugin-security`** — `derivePosture` in the explain engine. Narrower than the other three, and stated precisely rather than overclaimed: the name-read sat behind an early `ctx.posture` return that `buildContextForUser` always populates, so the shipping path was already gated and a D4 row never moved it. What the read did reach was a posture-less hand-built context, where it made the panel **report** `PLATFORM_ADMIN` for a principal enforcement treats as a MEMBER — a misreport rather than an admission, but in the one tool an administrator opens to check exactly this.
+
+No behaviour changes for a genuine platform operator: their resolved context carries the rung, and the built-in position is still projected onto `positions[]` for display and predicate use. What changes is that the name alone no longer answers the authorization question.
+
+Graded `patch` on the surface it moves: no exported type, signature or contract changes, and no authorable metadata is added, removed or renamed. The only observable difference is that a principal who never held the capability grant stops being admitted — which is the defect, not a feature anyone could have depended on.

.changeset/throw-arm-error-refresh-symmetry.md

@@ -0,0 +1,13 @@
+---
+"@objectstack/service-automation": patch
+---
+
+`$error` now names the most recent failure in a flow run, whichever way that failure arrived.
+
+The automation engine has two failure arms. When a node FAILS BY RETURNING `{ success: false }`, the engine rewrote the run-wide `$error` (and `<nodeId>.error`) and then decided whether a `fault` edge could route it. When a node FAILED BY THROWING — a `timeoutMs` firing, a dying nested container, a thrown guard — it did both **inside** the `fault`-edge branch, so a thrown failure with no `fault` edge of its own left `$error` holding an earlier, unrelated failure's value.
+
+A node inside a structured region never has a `fault` edge of its own: the region's synthetic sub-flow carries only the region's own edges. So every thrown failure inside a `try_catch`, `loop` body or other region hit this. The result was not a crash but a plausible-looking wrong value: **the message and the code came from two different failures** — `{ code: 'DUPLICATE_RECORD', message: "Node 'mk' timed out after 20ms" }` — and a catch region branching on `{$error.code}` swallowed a store failure as "the row is already there" while the run reported success.
+
+The throw arm now publishes `$error` and `<nodeId>.error` before deciding whether the failure routes, exactly as the returned-failure arm does. What a thrown failure publishes is `{ nodeId, message }`: there is no node result on that path, so no `output` and no classified `code` exist to carry — and that absence is the right answer for a throw rather than a reason to leave a stale `code` standing.
+
+Routing is unchanged. A guard refusal that throws (ADR-0049's unscoped-run refusal, for one) is still un-routable, still fatal, and still reports its own message; the thrown value itself is rethrown exactly as caught.

content/docs/permissions/system-context.mdx

@@ -137,15 +137,15 @@ The largest single consumer — **17 of the 105 sites**.
 | 36 | `sys_record_share` reads are **not** self-scoped | Get: tenant-wide share listing without `manage_sharing` | `sharing-plugin.ts:1189` |
 | 37 | Share-link policy `enabled` check bypassed; system callers re-enter under a system context | Get: link **creation** while the policy is off — resolution is **not** bypassed since #14033 (`publicSharing.enabled` is a standing policy held at every redemption): a link minted this way does not resolve until the block is enabled | `plugin-sharing/src/share-link-service.ts:459`, `:513`, `:517`, `:590`, `:620` |
 | 38 | Sharing-rule provenance stamp skipped | Lose: the row is not marked as an admin customization — seeder / `defineRule` / boot reconcilers are "the package door" | `sharing-rule-provenance.ts:66` |
-| 39 | Sharing-rule service write + delete paths return early | Lose: the manage-rules gate on the service surface, and the platform-global-rule delete guard | `sharing-rule-service.ts:278`, `:503` |
+| 39 | Sharing-rule service write + delete paths return early | Lose: the manage-rules gate on the service surface, and the platform-global-rule delete guard | `sharing-rule-service.ts:279`, `:518` |
 
 ### 4. Approvals, reports, attachments, comments, knowledge
 
 | # | Behaviour when `isSystem` | Package | What you get / what you lose | Anchor |
 |:--|:---|:---|:---|:---|
 | 40 | **Approval record lock released** — a locked record is writable | plugin-approvals | Get: engine self-writes (the status mirror) pass. Lose: the lock that stops edits while an approval is live. Note there is deliberately **no admin exemption** here — only `isSystem` | `lifecycle-hooks.ts:347` |
 | 41 | Delegation write guard bypassed | plugin-approvals | Get: service / seed / import may write delegation rows naming another delegator | `lifecycle-hooks.ts:570` |
-| 42 | Approval actor / submitter / pending-approver checks bypassed (8 sites) | plugin-approvals | Get: approve, reject, recall, reassign without being a pending approver or the submitter | `plugin-approvals/src/approval-service.ts:1093`, `:1202`, `:3458`, `:3606`, `:3774`, `:3845`, `:4034`, `:4074` |
+| 42 | Approval actor / submitter / pending-approver checks bypassed (8 sites) | plugin-approvals | Get: approve, reject, recall, reassign without being a pending approver or the submitter | `plugin-approvals/src/approval-service.ts:1096`, `:1219`, `:3475`, `:3623`, `:3791`, `:3862`, `:4051`, `:4091` |
 | 43 | Saved-report ownership is **assignable**, and an update may reassign it | plugin-reports | Get: `ownerId` from input is honoured. A non-system caller always owns what it creates and can never reassign | `plugin-reports/src/report-service.ts:404`, `:425` |
 | 44 | Saved-report access / export / mutation gates bypassed | plugin-reports | Get: read, bulk-export and overwrite any report | `plugin-reports/src/report-service.ts:343`, `:372`, `:447`, `:684` |
 | 45 | Attachment access hooks return early (insert + update + delete, and the read AST) | service-storage | Lose: attachment visibility scoping | `attachment-access-hooks.ts:300`, `:349`, `:448`, `:524` |
@@ -164,7 +164,7 @@ The largest single consumer — **17 of the 105 sites**.
 | 53 | MCP principal check satisfied | runtime | Get: MCP surface reachable with no user | `domains/mcp.ts:61` |
 | 54 | Package REST route capability gate bypassed | rest | Get: package read/write over REST without `manage_metadata` / `studio.access` / `setup.access` | `package-routes.ts:102` |
 | 55 | Package domain capability gates bypassed | runtime | Get: package management and package-inventory reads without the capability | `domains/packages.ts:250`, `:283` |
-| 56 | Activation write / authoring refusals do not fire | runtime | Get: activation artifacts writable and authorable without the activation-authoring capability | `activation-gate.ts:138`, `:189` |
+| 56 | Activation write / authoring refusals do not fire | runtime | Get: activation artifacts writable and authorable without the activation-authoring capability | `activation-gate.ts:157`, `:211` |
 | 57 | Automation run-state read, flow-authoring write and unrelated-screen read all pass | runtime | Get: run state, flow writes and screen reads with no grant | `domains/automation.ts:254`, `:545`, `:635` |
 | 58 | Audience-binding suggestion recording skipped | plugin-security | Lose: install-time suggestions are not recorded for system callers | `suggested-audience-bindings.ts:703` |
 | 59 | Email-template / webhook provenance stamps skipped | plugin-email, plugin-webhooks | Lose: the row is not marked as an admin customization | `email-template-provenance.ts:77`, `webhook-provenance.ts:68` |

examples/app-showcase/access-matrix.json

@@ -78,6 +78,39 @@
       "modifyAllRecords": false,
       "sharingModel": "public_read_write"
     },
+    {
+      "permissionSet": "showcase_contributor",
+      "object": "showcase_expense_line",
+      "create": true,
+      "read": true,
+      "edit": true,
+      "delete": false,
+      "viewAllRecords": false,
+      "modifyAllRecords": false,
+      "sharingModel": "controlled_by_parent"
+    },
+    {
+      "permissionSet": "showcase_contributor",
+      "object": "showcase_expense_report",
+      "create": true,
+      "read": true,
+      "edit": true,
+      "delete": false,
+      "viewAllRecords": false,
+      "modifyAllRecords": false,
+      "sharingModel": "public_read_write"
+    },
+    {
+      "permissionSet": "showcase_contributor",
+      "object": "showcase_field_zoo",
+      "create": true,
+      "read": true,
+      "edit": true,
+      "delete": false,
+      "viewAllRecords": false,
+      "modifyAllRecords": false,
+      "sharingModel": "public_read_write"
+    },
     {
       "permissionSet": "showcase_contributor",
       "object": "showcase_invoice",
@@ -275,6 +308,61 @@
       "modifyAllRecords": false,
       "sharingModel": "public_read"
     },
+    {
+      "permissionSet": "showcase_member_default",
+      "object": "showcase_business_unit",
+      "create": false,
+      "read": true,
+      "edit": false,
+      "delete": false,
+      "viewAllRecords": false,
+      "modifyAllRecords": false,
+      "sharingModel": "public_read_write"
+    },
+    {
+      "permissionSet": "showcase_member_default",
+      "object": "showcase_cascade",
+      "create": true,
+      "read": true,
+      "edit": true,
+      "delete": false,
+      "viewAllRecords": false,
+      "modifyAllRecords": false,
+      "sharingModel": "public_read_write"
+    },
+    {
+      "permissionSet": "showcase_member_default",
+      "object": "showcase_category",
+      "create": false,
+      "read": true,
+      "edit": false,
+      "delete": false,
+      "viewAllRecords": false,
+      "modifyAllRecords": false,
+      "sharingModel": "public_read_write"
+    },
+    {
+      "permissionSet": "showcase_member_default",
+      "object": "showcase_expense_report",
+      "create": false,
+      "read": true,
+      "edit": false,
+      "delete": false,
+      "viewAllRecords": false,
+      "modifyAllRecords": false,
+      "sharingModel": "public_read_write"
+    },
+    {
+      "permissionSet": "showcase_member_default",
+      "object": "showcase_field_zoo",
+      "create": false,
+      "read": true,
+      "edit": false,
+      "delete": false,
+      "viewAllRecords": false,
+      "modifyAllRecords": false,
+      "sharingModel": "public_read_write"
+    },
     {
       "permissionSet": "showcase_member_default",
       "object": "showcase_inquiry",
@@ -286,6 +374,17 @@
       "modifyAllRecords": false,
       "sharingModel": "private"
     },
+    {
+      "permissionSet": "showcase_member_default",
+      "object": "showcase_preference",
+      "create": true,
+      "read": true,
+      "edit": true,
+      "delete": false,
+      "viewAllRecords": false,
+      "modifyAllRecords": false,
+      "sharingModel": "public_read_write"
+    },
     {
       "permissionSet": "showcase_member_default",
       "object": "showcase_private_note",
@@ -330,6 +429,17 @@
       "modifyAllRecords": false,
       "sharingModel": "public_read_write"
     },
+    {
+      "permissionSet": "showcase_member_default",
+      "object": "showcase_team",
+      "create": false,
+      "read": true,
+      "edit": false,
+      "delete": false,
+      "viewAllRecords": false,
+      "modifyAllRecords": false,
+      "sharingModel": "public_read_write"
+    },
     {
       "permissionSet": "showcase_ops",
       "object": "showcase_announcement",
@@ -341,6 +451,28 @@
       "modifyAllRecords": true,
       "sharingModel": "public_read"
     },
+    {
+      "permissionSet": "showcase_ops",
+      "object": "showcase_business_unit",
+      "create": true,
+      "read": true,
+      "edit": true,
+      "delete": false,
+      "viewAllRecords": false,
+      "modifyAllRecords": false,
+      "sharingModel": "public_read_write"
+    },
+    {
+      "permissionSet": "showcase_ops",
+      "object": "showcase_category",
+      "create": true,
+      "read": true,
+      "edit": true,
+      "delete": false,
+      "viewAllRecords": false,
+      "modifyAllRecords": false,
+      "sharingModel": "public_read_write"
+    },
     {
       "permissionSet": "showcase_ops",
       "object": "showcase_inquiry",
@@ -364,6 +496,28 @@
       "viewAllRecords": false,
       "modifyAllRecords": false,
       "sharingModel": "public_read_write"
+    },
+    {
+      "permissionSet": "showcase_ops",
+      "object": "showcase_project_membership",
+      "create": true,
+      "read": true,
+      "edit": true,
+      "delete": true,
+      "viewAllRecords": false,
+      "modifyAllRecords": false,
+      "sharingModel": "public_read_write"
+    },
+    {
+      "permissionSet": "showcase_ops",
+      "object": "showcase_team",
+      "create": true,
+      "read": true,
+      "edit": true,
+      "delete": false,
+      "viewAllRecords": false,
+      "modifyAllRecords": false,
+      "sharingModel": "public_read_write"
     }
   ]
 }

examples/app-showcase/package.json

@@ -38,6 +38,7 @@
     "@objectstack/cli": "workspace:*",
     "@objectstack/core": "workspace:*",
     "@objectstack/formula": "workspace:*",
+    "@objectstack/lint": "workspace:*",
     "@objectstack/objectql": "workspace:*",
     "@objectstack/plugin-approvals": "workspace:*",
     "@objectstack/plugin-email": "workspace:*",

examples/app-showcase/src/data/objects/cascading-select.object.ts

@@ -26,10 +26,19 @@ import { P } from '@objectstack/spec';
  *    unbound (a system write) — the acting user is bound from the request on
  *    authenticated writes (engine `buildEvalUser`).
  *
- * `sharingModel: 'public_read_write'` so the seeded admin (and the live e2e,
- * objectui `e2e/live/cascading-options.spec.ts`) can create records without a
- * bespoke permission set; belonging to no permission set, it is intentionally
- * absent from the ADR-0090 access-matrix snapshot.
+ * `sharingModel: 'public_read_write'` is the RECORD baseline (gate ②) — no
+ * sharing rule is needed for one persona to see another's row. It is NOT what
+ * makes the object reachable: object-level CRUD (gate ①) comes only from a
+ * permission set and is checked first. This comment used to say the wide OWD let
+ * the seeded admin and the live e2e create records "without a bespoke permission
+ * set". What actually carried the admin was their built-in WILDCARD set: with no
+ * grant anywhere, `nav-object-ungranted` warned on every build and reports the
+ * `nav_cascade` entry as permission-denied for every principal that does not
+ * hold that wildcard set. `showcase_member_default` now grants read/create/edit,
+ * so the object is in the access-matrix snapshot and a plain member holds the
+ * capability the navigation entry already claimed for them. Note where the
+ * narrowing really lives: on one OPTION (`tier: 'restricted'`, admin-only),
+ * not on the object.
  *
  * The server verdict is unit-covered by objectql
  * `rule-validator.option-visibility.test.ts`; this object is the served fixture

examples/app-showcase/src/data/objects/expense-report.object.ts

@@ -31,10 +31,20 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
  */
 export const ExpenseReport = ObjectSchema.create({
   name: 'showcase_expense_report',
-  // [ADR-0090 D1] grandfather stamp: world-writable demo object so any seeded
-  // persona (and the browser e2e) can create/edit reports without a bespoke
-  // permission set. Belonging to no permission set, it is intentionally absent
-  // from the access-matrix snapshot (cf. showcase_cascade).
+  // [ADR-0090 D1] grandfather stamp: the RECORD baseline is world-writable, so
+  // no sharing rule or scope depth is needed to see another persona's report.
+  //
+  // That is gate ② and it is the whole of what this dial buys. It does NOT make
+  // the object reachable: object-level CRUD is gate ①, it is granted only by a
+  // permission set, and it is checked FIRST. This comment used to claim the wide
+  // OWD let "any seeded persona create/edit reports without a bespoke permission
+  // set" — measurably false, and the app shipped the proof: the object sat in
+  // the shared navigation with no grant anywhere, so `nav-object-ungranted`
+  // warned on every build, reporting the entry as permission-denied for every
+  // principal except one holding the platform's built-in wildcard admin set.
+  // The seeded admin holds exactly that set, which is why it looked fine.
+  // The grants now live on `showcase_contributor` (file/edit) and
+  // `showcase_member_default` (read), and both appear in access-matrix.json.
   sharingModel: 'public_read_write',
   label: 'Expense Report',
   pluralLabel: 'Expense Reports',