owd-save-gate: the ADR-0090 D11 authoring gate never runs on any host-config deployment (keyed on environmentId, not authoringChannel)

[huangyiirene]

Symptom

Nothing on a host-config deploy refuses an ADR-0090 D11 OWD violation. Studio turns the external-OWD description amber and says "publishing will be rejected (ADR-0090 D11)", then leaves Save draft and Publish enabled, and both succeed.

PUT /api/v1/meta/object/qa_probe {…, sharingModel:'private', externalSharingModel:'public_read'}

• Expected 403 owd_external_wider.
• Actual 200; GET returns the violating pair persisted — on the draft path, the active path, and with ?package=. Reproduced 3× on one boot, 3× on a second boot with a fresh DB, plus once through the browser.

Root cause

Located by the run at packages/metadata-protocol/src/protocol.ts. The #3050 authoring-gate call is wrapped in if (this.environmentId !== undefined). The showcase config is a host config (isHostConfig → shouldBootWithLibrary(config) === false), so serve.ts takes the lightweight assembler, which constructs new ObjectQLPlugin() with no options → environmentId stays undefined → the guard is false and runAuthoringGate is never called. So R2 (owd_external_wider) and R1 (owd_widening_forbidden) execute on no self-hosted/host-config deployment.

This is the same proxy-signal hazard #6710 already diagnosed and retired for the sibling #4463 gate. The authoringChannel infrastructure from #6710 exists on origin/main (protocol.ts ~L2929; runAuthoringGate returns early for authoringChannel === 'package-author' ~L3094), but the #3050 gate call site (protocol.ts ~L10003) is still gated on if (this.environmentId !== undefined) — its own comment reaffirms "Environment writes only … environmentId undefined". Confirmed not fixed on origin/main.

The gate logic itself is not the bug: object-posture-gate.test.ts is 18/18 green. A grep for owd_external_wider finds only the gate source and its unit test — there is no integration test exercising R2 through the real save path.

Filed publicly as an authoring-validation gap: external-principal enforcement is #2696-planned, so a wider external baseline does not itself disclose anything today — it is a validation gap, not a live disclosure.

Reproduction

1. Boot the showcase app via the CLI host-config path (serve.ts lightweight assembler).
2. PUT /api/v1/meta/object/qa_probe with {sharingModel:'private', externalSharingModel:'public_read'}.
3. Observe 200; GET the object → the violating pair persisted. Repeat with ?package= and against the active path — all 200.

Suggested fix

Key the #3050 gate on the declared authoringChannel, as #6710 did for #4463, instead of on environmentId !== undefined. Add an integration test that exercises R1/R2 through the real save path.

Source

Extracted from the QA run #7637 (framework 92f26f7, console 09987b680).

[os-zhuang]

Claimed — domain:metadata seat.

• Session: session_01RrWAcS8TRynu6xWwZJeZwH
• Branch: claude/issue-7674-owd-gate-authoring-channel
• Worktree: ../objectstack-7674 (dedicated)
• File surface: packages/metadata-protocol/src/protocol.ts — the OWD posture is lint-only at runtime: env can widen a packaged object's sharingModel via OS_METADATA_WRITABLE, and external≤internal (ADR-0090 D11) is never enforced on the write path #3050 gate call site (~L10003) — plus a new integration test.

Dispatched as a declared-≠-enforced card with the fix shape already precedented in the same file. #6710 diagnosed and retired this exact proxy-signal hazard for the sibling #4463 gate — key on the declared authoringChannel rather than on environmentId. That infrastructure is on main (~L2929, with runAuthoringGate early-returning for authoringChannel === 'package-author' ~L3094); the #3050 call site was simply never moved onto it. The dev follows #6710's shape rather than inventing one.

Premise re-verification required before implementing. The card's line numbers come from a run against framework 92f26f75 and main moves fast, so the dev confirms on current main that the call site is still environmentId-gated and that the authoringChannel infrastructure is where #6710 left it — reporting what they find rather than patching by line number.

The missing test is as much the deliverable as the predicate. The card makes the point sharply: object-posture-gate.test.ts is 18/18 green on a gate that never runs, and a grep for owd_external_wider finds only the gate source and its own unit test. So the dispatch requires an integration test driving R1 and R2 through the real save path — draft path, active path and ?package=, all three measured as 200 today — with code and status asserted on every refusal (a bare rejects.toThrow() is green against an implementation that throws a naked Error).

The negative direction is treated as load-bearing, not as garnish: a legal OWD pair must still save, and the package-author channel must still early-return as #6710 established. A gate that starts refusing package authoring would be a worse defect than the one being closed, and it is the obvious way to overshoot here.

⚠️ Serialization constraint, named: protocol.ts is the hottest file in the repo and five other queued cards land in it — #7556, #7654, #7682, #7643, #7656 — all deliberately held out of this round for that reason. This change must be additive at the gate call site; ⛔ no restructuring of runAuthoringGate, ⛔ no refactoring of the surrounding save path. If the shared helper must change shape, the dev stops and reports rather than doing it with the queue stacked behind them.

Scope boundary: filed publicly as an authoring-validation gap, not a live disclosure — external-principal enforcement is #2696-planned, so a wider external baseline discloses nothing today. ⛔ Not to be widened into external-principal enforcement.

---

Generated by Claude Code

[claude]

{
 "issue": 7674,
 "status": "done",
 "branch": "claude/issue-7674-owd-gate-authoring-channel",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/7710",
 "premise_still_valid": true,
 "summary": "Premise re-verified on current main (6a9dec62c) before implementing: the #3050 gate call site was still `if (this.environmentId !== undefined)` at protocol.ts:10058 (card said ~L10003), and the #6710 authoringChannel infrastructure was where the card said (constructor param protocol.ts:2929, default 'environment'; runAuthoringGate's sibling assertRuntimeAuthoringRules early-returning for 'package-author' at protocol.ts:3094). Fix follows #6710's shape: one predicate at the call site, `if (this.authoringChannel !== 'package-author')`. runAuthoringGate and the surrounding save path are untouched \u2014 additive at the call site per the serialization constraint; the rest of the protocol diff is comment correction of three docblocks that stated in prose that the #3050 gate keeps reading environmentId (that sentence is how the defect survived #6710 by one gate). The missing integration test is the other half: new packages/rest/src/meta-object-owd-gate.test.ts (12 cases) drives R1 and R2 through a real sqlite engine, a real protocol on the host-config topology (no environmentId, asserted not assumed), the real registerObjectPostureGate wiring, and the real PUT /api/v1/meta/:type/:name route \u2014 403 owd_external_wider on the draft path, the active path and ?package=, each asserting code AND status AND that nothing persisted. Negative direction pinned as load-bearing: four legal OWD pairs still save, a tightening overlay of a packaged object is still allowed, and the package-author channel still bypasses (green before and after, on purpose). ONE BEHAVIOUR CELL FLIPS BEYOND THE DEFECT, deliberately and called out in the PR: a kernel with an environment id AND a declared 'package-author' channel was gated and now is not \u2014 #6710's direction applied fully rather than half; package authoring is gated at build time (validateSecurityPosture is CLI_ONLY) and no assembly in this repo declares that channel today. Also replaced wholesale (not re-spelled) the case in protocol.runtime-authoring-gate.test.ts that asserted the OPPOSITE invariant ('the #3050 gate ... must stay keyed there') \u2014 it is now a four-cell environmentId x authoringChannel matrix. Two facts measured while confirming the premise, both sharpening the card: authoring-rules.ts marks its own validateSecurityPosture CLI_ONLY with a surfaceReason stating that this gate already covers the runtime surface (false on every host config \u2014 declared-not-enforced on both tables at once), and a repo-wide grep for owd_external_wider found only the gate source and its 18/18-green unit test.",
 "tests": "REVERSE VERIFICATION, direction predicted before running: reverting the one predicate should turn every refusal case red by ANSWERING 200 (not by throwing) and leave every negative case green. Measured after rebuilding metadata-protocol so the suite read the reverted dist (the first attempt was green because vitest resolves the built dist \u2014 noted, then corrected): 'Tests 6 failed | 6 passed (12)'; the four R2 cases 'expected 200 to be 403' (the issue's measured 200s, reproduced in process) and the two R1 cases \"expected 'NOT_OVERRIDABLE' to be 'owd_widening_forbidden'\" \u2014 with the gate dead the write travels one door further and SysMetadataRepository.assertAllowed() refuses it with a different code from a different layer, which is exactly why a throw-only assertion would have proven nothing. All six negative cases stayed green. That run also exposed a latent order-dependency in the new suite, now fixed: OS_METADATA_WRITABLE is memoised in TWO places and with the fix in place the posture gate refuses first, so the repository memo is never warmed and clearing only the protocol's LOOKS sufficient. FORWARD (fix restored, metadata-protocol rebuilt): pnpm --filter @objectstack/metadata-protocol test -> 'Test Files 72 passed (72) | Tests 1066 passed (1066)'; pnpm --filter @objectstack/rest test -> 'Test Files 88 passed (88) | Tests 1415 passed (1415)' (incl. the new 12); pnpm --filter @objectstack/plugin-security test -> '46 passed (46) | 952 passed (952)'; pnpm --filter @objectstack/objectql test -> '182 passed (182) | 3228 passed (3228)'; pnpm --filter @objectstack/rest typecheck -> clean (metadata-protocol declares no typecheck script \u2014 it is a DEBT-ledger package, not an omission by this PR). Build closure used the SUFFIX direction ('@objectstack/rest^...', i.e. rest's dependencies) \u2014 correct here because this change narrows no exported type, so there is no downstream signature surface to sweep. Gate families touching this surface, all green locally: check:nul-bytes, check:error-code-casing, check:route-envelope (pre-existing rest-server.ts ratchet unchanged \u2014 that file is untouched), check:durability-log-level, check:startup-registry-verdict, check:meta-type-normalized, check:published-files, check:engine-double-contract, check:adr-anchors, check:adr-links, check:type-check-coverage, check:empty-changeset, check:adr-0087-registration. CI on PR #7710 is in_progress at the time of this report (reporting at draft-PR time per #6644 L2; CI convergence is the PM's read).",
 "open_questions": [],
 "out_of_scope_findings": []
}

---

Generated by Claude Code

[claude]

{
 "issue": 7674,
 "status": "done",
 "branch": "claude/issue-7674-owd-gate-authoring-channel",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/7710",
 "premise_still_valid": true,
 "summary": "UPDATED REPORT after the PM's patch round on two CI-only ratchets. Both were tripped by the new integration test's own surface, not by the fix; neither was remedied by raising a number, and neither number moved. (1) query-options-erasure: the one new site was `engine.find('sys_metadata', { where: ... } as any)` in the suite's persistence probe. The input is NOT off-contract, so the remedy is the first one the rule's message prescribes \u2014 drop the assertion and let it infer against EngineQueryOptions, keeping tsc as the enforcing channel for those keys (#4674). No `as unknown as EngineQueryOptions` escape was warranted; the ratchet re-measures at 242, the ceiling, and the baseline key set is unchanged. (2) TypeScript Type Check TEST_DEBT: @objectstack/rest measured 159 against a recorded 155 which since #6939 carries NO margin \u2014 the PM's guess at the package was correct. All four errors were in the new file: one TS2835 (a relative import without its `.js` extension \u2014 the AGENTS.md trap, and already 124 of this entry's debt) and three TS2554 from hand-rolled `registerObject` calls missing the required `packageId`. Fixed by adding the extension and moving the three platform-object registrations onto `registerApp` under `com.objectstack.metadata-objects` \u2014 the seam `assembleMetadataProtocol` itself uses, so the harness got more faithful rather than merely quieter. Re-measured at exactly 155; ledger untouched, no other entry lowered. The patch commit touches ONE file (packages/rest/src/meta-object-owd-gate.test.ts, +28/-9). Everything owed at review is intact and verified from the diff: the gate call site is still the single additive predicate `if (this.authoringChannel !== 'package-author')`, runAuthoringGate is unrestructured, R1 and R2 still run through the real PUT /api/v1/meta/object/:name on the draft path, the active path and ?package= with code AND status asserted (plus non-persistence), and the package-author early-return case is untouched and green.",
 "tests": "CI ON PR #7710 IS NOW FULLY GREEN at 8ec06469f \u2014 both named gates confirmed by polling the check-runs API in the foreground: 'completed success ESLint' and 'completed success TypeScript Type Check'. Every other check on the commit is success as well (Test Core 1-3, Build Core, Build Docs, Check Changeset, Validate Package Dependencies, Dogfood Regression Gate 1-3, ADR maintainer approval, Temporal Conformance); 'Console Pin Gate' is skipped. LOCAL RE-VERIFICATION of the two ratchets, reproduced the way CI evaluates them rather than via the package scripts that cannot see them: full closure built (`turbo run build --filter='./packages/*' --filter='./packages/*/*'`, 70 tasks), then `pnpm check:query-options-erasure` -> 'ratchet holds: 67 unswept non-test site(s) ... test surface: 242 site(s) in 48 file(s) - at the ceiling ... baseline key set verified against 6a9dec6: no files added'; and `pnpm check:type-check-debt` -> '33 ledger entr(ies) re-measured in 199.6s, 1786 raw tsc error(s) total, none above its recorded number'. Measured the rest TEST_DEBT directly too, mirroring measureTestDebt (sibling tsconfig with the test exclusion lifted): 159 before the patch with all four errors attributed to the new file by line, 155 after, zero from the new file. Temp tsconfig removed, not committed. SUITES RE-RUN after the patch (the .js import and the registerApp change both affect resolution and registry state, so this was not a formality): pnpm --filter @objectstack/rest test -> 'Test Files 88 passed (88) | Tests 1415 passed (1415)'; pnpm --filter @objectstack/metadata-protocol test -> '72 passed (72) | 1066 passed (1066)'; the new suite alone -> '12 passed (12)'. eslint over the four changed files -> exit 0. The reverse verification from the first report still stands unchanged (fix reverted + metadata-protocol rebuilt -> 'Tests 6 failed | 6 passed (12)': four R2 cases 'expected 200 to be 403' and two R1 cases \"expected 'NOT_OVERRIDABLE' to be 'owd_widening_forbidden'\", all six negative cases green).",
 "open_questions": [],
 "out_of_scope_findings": []
}

---

Generated by Claude Code

[os-zhuang]

ACCEPT — PR #7710, marked ready and armed into the merge queue. Green after one patch round.

The diff is exactly the shape this card needed, and I verified that from the diff rather than from the report. The change lands at the call site in saveMetaItem — if (this.environmentId !== undefined) becomes a read of the declared authoringChannel, mirroring what #6710 did for assertRuntimeAuthoringRules a few hundred lines up. runAuthoringGate's body is untouched (it appears once in the diff, in a comment reference), and environmentId keeps every job that genuinely is about row scope — the environment_id stamp/filter and the ADR-0005 overlay-whitelist gate. Exactly one responsibility was taken off it. With five cards queued behind this file, that restraint was the constraint I cared most about and it held.

The comment left at the site names the real lesson better than the card did: #6710 re-keyed one gate and left its sibling on the retired proxy, so "the identical proxy-signal defect outlived its own diagnosis on the sibling gate." A partial migration is how a fixed hazard comes back — and writing that at the line, rather than in a PR body that scrolls away, is what stops the third sibling repeating it. The stale sentence that used to list "the #3050 authoring-gate scope" among environmentId's surviving jobs was corrected in the same pass, which is the other half of not leaving a trap behind.

The missing coverage was the real deliverable and it was treated that way. The card's sharpest observation is that object-posture-gate.test.ts was 18/18 green on a gate that never ran, with a repo-wide grep for owd_external_wider finding only the gate source and its own unit test. The fix adds packages/rest/src/meta-object-owd-gate.test.ts — an integration test at the REST layer, which is the only place that drives the real save path the card measured 200s on. Putting it in packages/rest rather than next to the unit test is what makes it prove something new, and Validate Package Dependencies passed on the devDependency that required.

Both ratchets were cleared the right way, which is the second time today this mattered:

• ESLint query-options-erasure (test surface 242 → 243) — fixed at the call site rather than by raising the count.
• TypeScript Type Check (a TEST_DEBT entry drifted upward) — likewise. Verified from the diff: scripts/check-type-check-coverage.mjs is absent, so no ledger was raised, and the patch commit is scoped to exactly that (test(rest): clear two CI ratchets the new OWD gate suite tripped) rather than smuggling product changes into a green-up.

Verified independently: seven files; no docs/adr/**; no content/docs/releases/; changeset present; closed_by_pull_requests names #7710 and Fixes is right, since the card is fully closed by it. Gate conclusions read personally — ESLint success, TypeScript Type Check success — plus the Test Core rollup and the Dogfood gate.

Scope boundary held: this stays an authoring-validation fix. External-principal enforcement is #2696-planned and was not pulled in, so the card lands as filed — a validation gap closed, not a disclosure fix mislabelled as one.

---

Generated by Claude Code