`attach-requires-parent-edit` c3: #4757 multi-delete pin can't execute against the prebuilt `@objectstack/core` (stale-dist / CI)

[huangyiirene]

Symptom

All 17 cases in packages/services/service-storage/src/attachment-access-hooks.test.ts error with:

TypeError: withoutOperationPrivateKeys is not a function

The predicate-less unscoped-multi-delete refusal (#4757) cannot be expressed over REST (deleteMany with no ids/where → 400 before the hook is reached), so it rests on this unit pin — which cannot run in the checkout, leaving #4757 unguarded by an executable test here.

Root cause

Located — a build-ordering / CI test-infra gap, not a runtime defect. withoutOperationPrivateKeys is exported on origin/main at packages/core/src/security/operation-private-keys.ts:115 (and re-exported from packages/core/src/security/index.ts:145). The test resolves a stale built @objectstack/core that predates that export; the source is correct and the live server enforced every other gate in this item. The fix is a CI/build-ordering one: rebuild @objectstack/core before running the service-storage suite (or give the pin a live oracle).

Reproduction

Against the prebuilt tree, run attachment-access-hooks.test.ts → 17/17 error TypeError: withoutOperationPrivateKeys is not a function. Confirm git grep withoutOperationPrivateKeys origin/main -- packages/core/src/security/operation-private-keys.ts shows the export exists → the source is not missing the function; the built dist is stale.

Source

Extracted from the QA run #7635 (framework 92f26f7, console 6314e87f).

[claude]

Dual-label resolution (queue+finding): promoted to pm:queue (finding stripped). Concrete, scoped CI/build-ordering fix with a named landing site — the #4757 pin's missing symbol is a stale prebuilt @objectstack/core, and withoutOperationPrivateKeys is verified exported at packages/core/src/security/operation-private-keys.ts:115 on origin/main @ 6a9dec6. domain:devx stands (test-infra/build ordering, not runtime code). No open duplicate found; #7671 cross-references this card as the owner.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[huangyiirene]

Claim: PM loop round 4 (devx seat, 2026-08-11 term) — wave 4 unit B
Session: session_01GZKbx4xyF7U5WXj6ch49BM
Branch: claude/issue-7668-storage-test-build-order
Worktree: cloud session, own clone
Domain: domain:devx
File surface: the build-ordering fix face — expected turbo.json (test task deps) or the service-storage package's test config; the dev derives the true landing site and declares it in the PR (⛔ no product code, no checklist area files). If the right fix is instead a live oracle for the #4757 pin, that changes the surface into packages/services/service-storage test code — report the fork before implementing it.
Container & model: M, mode:cloud, model: opus
Serial constraints cleared: no other claim or open PR touches turbo.json or the service-storage test infra (checked at claim time). ⚠️ turbo.json is a shared hot file — merge origin/main before opening the PR.

---

Generated by Claude Code