docs(plugin-security): correct the managed-write-denies docblock on member_default

[claude]

Fixes#13822

Comments only. The module docblock of managed-object-write-denies.ts still
described member_default as granting CRUD through an objects['*']
wildcard. #5491 removed that wildcard, and the set's own declaration in
objects/default-permission-sets.ts now opens by saying the opposite.

Premise verified first, on today's origin/main

The card's premise is a zero, so it is measured with the same-shaped non-zero
controls in the same run. A per-set census over default-permission-sets.ts,
comments stripped first so a '*' in prose cannot be counted as a
declaration and a declaration cannot hide behind one:

set (as declared) decl lines objects['*'] decls wildcard bits
ADMIN_FULL_ACCESS 132-177 0
ORGANIZATION_ADMIN 177-390 1 allowRead=true, allowCreate=true, allowEdit=true, allowDelete=true, viewAllRecords=true, modifyAllRecords=true
'member_default' 390-864 0
'viewer_readonly' 864-993 1 allowRead=true, allowCreate=false, allowEdit=false, allowDelete=false
MCP_AGENT_PERMISSION_SET_READ 993-1003 1 allowRead=true
MCP_AGENT_PERMISSION_SET_WRITE 1003-1018 1 allowRead=true, allowCreate=true, allowEdit=true, allowDelete=true
MCP_AGENT_PERMISSION_SET_RESTRICTED 1018-1049 0
ORGANIZATION_ADMIN_NO_BYPASS 1049-1074 0
TOTAL wildcard declarations in file: 4

member_default reads 0 while three sibling sets in the same run read 1, so
the zero is a reading and not a blind spot. Its only object spread is
...denyWritesOnManagedObjects(), whose keys are BETTER_AUTH_MANAGED_OBJECTS
— no wildcard arrives that way either. The two sets reading 0 with a wildcard
elsewhere are known and named below.

So the granting shape today, for the four sets this module targets:

target set	wildcard	what the injected managed-table entry does there
organization_admin	full CRUD + viewAllRecords/modifyAllRecords	narrows the wildcard
MCP write set	full CRUD	narrows the wildcard
viewer_readonly	read-only	belt-and-suspenders over a wildcard that already denies (its own comment says so)
member_default	none since #5491	it is the read grant itself — this set's access is exactly the objects it NAMES

Two sets read 0 in the census but do hold a wildcard, neither of them
member_default: admin_full_access takes its from
ADMIN_FULL_ACCESS_CAPABILITIES in @objectstack/spec, and
organization_admin_no_bypass is derived at module load by
deriveWallLessOrgAdmin. Both are outside the census's file by construction,
not missing from it.

What changed

Three sites in this one file carried the same claim; each now states the
mechanism in force rather than leaving the gap a deleted sentence would leave.

1. Module docblock opening — "The default write-granting permission sets
   (...) grant CRUD via a '*' wildcard". Replaced by the per-set breakdown
   above, carrying member_default's * wildcard object grant (C/R/E) union-merges into every org member — app-side explicit-allow object gates are erased on three axes #5491's reason and the 2026-08-07 maintainer ruling forward
   from the sibling declaration.
2. "Deliberately NOT covered" section — "are also wildcard-granted in these
   sets" now reads "reached by the wildcard in the target sets that carry one",
   and the viewAllRecords/modifyAllRecords argument names
   organization_admin, the only target set whose wildcard carries those bits.
3. MANAGED_DENY_TARGET_SETS docblock — "The default sets whose '*'
   wildcard grants writes" was the same false membership rule stated as a
   definition. It now says what membership actually is, and points at the
   module docblock for the per-set detail.

MANAGED_DENY_TARGET_SETS' membership is untouched — the deny entries are
harmless and the list is a deliberate allowlist, exactly as the card says.

Verification

The non-comment diff is empty, and the comparator is proven live. Comments
stripped from both sides, whitespace collapsed, compared:

path : packages/plugins/plugin-security/src/managed-object-write-denies.ts
base ref : c54d4d3d7d0a7f3e6ec848dd0cb415ee35ebbb37
raw bytes : base=5664 working=6889 (differ: True)
non-comment chars : base=1372 working=1372
NON-COMMENT DIFF : EMPTY
CONTROL (one code line added to the working copy, comments untouched)
CONTROL non-comment diff : NON-EMPTY (comparator is live)

Syntactic parse, the one real failure mode of a docblock edit (a stray
*/ closing the block early), with a live-detector control:

 0 parse diagnostic(s) WORKING (after the docblock rewrite)
0 parse diagnostic(s) BASE c54d4d3d7 (control: known-good)
316 parse diagnostic(s) CONTROL (same file with a docblock closed early)
PARSE CHECK: PASS (and the detector is proven live by the control)

ESLint, repo-wide, CI's own command — pnpm lint = eslint . --no-inline-config
— exit 0 in 117s. The edited file is confirmed inside the receiving population
rather than assumed to be: --format json on that path returns 1 file entry,
0 errors, 0 warnings, 0 suppressed messages.

Gate families re-derived from the actual diff with
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (no path
arguments; exit 0), both sections read whole. 20 matched families plus the two
i18n convention gates. Exit codes captured before any pipe. All green except:

• pnpm check:i18n — exit 1, NOT MEASURED: its own verdict line reads
  "PREREQUISITE NOT MET — the workspace CLI is not built ... Nothing was
  checked". Its inputs are read rather than assumed: this plugin's
  scripts/i18n-extract.config.ts imports six object definitions from
  ../src/objects/index.js plus the four generated bundles, and
  managed-object-write-denies.ts is named by neither — it is imported only by
  security-plugin.ts and three test files.
• node scripts/check-test-completeness.mjs — exit 3, NOT MEASURED: it
  grades a saved turbo run test log and none was named. Its own text says
  this is the expected local branch, not a red.
• pnpm check:dual-build-cjs-loads — not run; it needs a full build. See the
  declared narrowing below.

Declared narrowing: the dependency-closure build, this package's vitest run
and check:dual-build-cjs-loads were not run locally. Stated as a narrowing,
not reported as coverage. The shared verify lock was continuously held with 3-4
runs queued and waits of 340-685s throughout this task. Three readings say what
the narrowing does and does not exclude: (1) the compiled output is a function
of the non-comment source, and that source is identical on both sides — 1372
characters each, by a comparator a control proves live; (2) the diff is exactly
one path, git diff --stat reading 30 insertions / 14 deletions, all inside
/** */ blocks, with no config, tsconfig, package.json or test file touched,
so no untouched file's verdict can move; (3) the file still parses clean under
the TypeScript parser and under ESLint's TypeScript parser, independently. CI
runs the farm on this PR regardless, which is where those three land.

A dispatch-gates staleness note is recorded rather than acted on: HEAD is 3
commits behind origin/main (9b18c0475) and one file the derivation reads,
scripts/import-prerequisite.mjs, changed across that range.

Union re-run and all readings above are from 255eabdee, the branch head.

Scope

No behaviour change: this is prose, and only prose. Out of scope and untouched,
per the dispatch: packages/plugins/plugin-security/src/security-plugin.ts
(read for the call site, never edited) and every other file on the in-flight
fence. #13903 is not addressed here — the repo-wide sweep of the retired
elevation-gate premise is its own face, its table names no line in this file,
and none of its rows are touched. No changeset: comments only, nothing
released, so this PR carries skip-changeset.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️1 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/managed-object-write-denies.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/managed-object-write-denies.ts) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 14 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json e612dd0f5bac1313b4d8e2adb061521e210cb65f → packageMentionDocs.

[claude]

Out-of-scope finding filed while implementing this card, per AGENTS.md Prime Directive #10: #14029 — organization_admin_no_bypass holds a write-granting wildcard but is not in MANAGED_DENY_TARGET_SETS, so applyManagedWriteDenies walks past it and the registry-derived denies never reach it. Behaviour-class, deliberately NOT touched in this PR, which is prose only. Filed unassigned for triage.

Session: https://claude.ai/code/session_016ZC5rNQj3WEet5HAmmAkMs

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#13822

Comments only. The module docblock of managed-object-write-denies.ts still
described member_default as granting CRUD through an objects['*']
wildcard. #5491 removed that wildcard, and the set's own declaration in
objects/default-permission-sets.ts now opens by saying the opposite.

Premise verified first, on today's origin/main

The card's premise is a zero, so it is measured with the same-shaped non-zero
controls in the same run. A per-set census over default-permission-sets.ts,
comments stripped first so a '*' in prose cannot be counted as a
declaration and a declaration cannot hide behind one:

set (as declared) decl lines objects['*'] decls wildcard bits
ADMIN_FULL_ACCESS 132-177 0
ORGANIZATION_ADMIN 177-390 1 allowRead=true, allowCreate=true, allowEdit=true, allowDelete=true, viewAllRecords=true, modifyAllRecords=true
'member_default' 390-864 0
'viewer_readonly' 864-993 1 allowRead=true, allowCreate=false, allowEdit=false, allowDelete=false
MCP_AGENT_PERMISSION_SET_READ 993-1003 1 allowRead=true
MCP_AGENT_PERMISSION_SET_WRITE 1003-1018 1 allowRead=true, allowCreate=true, allowEdit=true, allowDelete=true
MCP_AGENT_PERMISSION_SET_RESTRICTED 1018-1049 0
ORGANIZATION_ADMIN_NO_BYPASS 1049-1074 0
TOTAL wildcard declarations in file: 4

member_default reads 0 while three sibling sets in the same run read 1, so
the zero is a reading and not a blind spot. Its only object spread is
...denyWritesOnManagedObjects(), whose keys are BETTER_AUTH_MANAGED_OBJECTS
— no wildcard arrives that way either. The two sets reading 0 with a wildcard
elsewhere are known and named below.

So the granting shape today, for the four sets this module targets:

target set	wildcard	what the injected managed-table entry does there
organization_admin	full CRUD + viewAllRecords/modifyAllRecords	narrows the wildcard
MCP write set	full CRUD	narrows the wildcard
viewer_readonly	read-only	belt-and-suspenders over a wildcard that already denies (its own comment says so)
member_default	none since #5491	it is the read grant itself — this set's access is exactly the objects it NAMES

Two sets read 0 in the census but do hold a wildcard, neither of them
member_default: admin_full_access takes its from
ADMIN_FULL_ACCESS_CAPABILITIES in @objectstack/spec, and
organization_admin_no_bypass is derived at module load by
deriveWallLessOrgAdmin. Both are outside the census's file by construction,
not missing from it.

What changed

Three sites in this one file carried the same claim; each now states the
mechanism in force rather than leaving the gap a deleted sentence would leave.

1. Module docblock opening — "The default write-granting permission sets
   (...) grant CRUD via a '*' wildcard". Replaced by the per-set breakdown
   above, carrying member_default's * wildcard object grant (C/R/E) union-merges into every org member — app-side explicit-allow object gates are erased on three axes #5491's reason and the 2026-08-07 maintainer ruling forward
   from the sibling declaration.
2. "Deliberately NOT covered" section — "are also wildcard-granted in these
   sets" now reads "reached by the wildcard in the target sets that carry one",
   and the viewAllRecords/modifyAllRecords argument names
   organization_admin, the only target set whose wildcard carries those bits.
3. MANAGED_DENY_TARGET_SETS docblock — "The default sets whose '*'
   wildcard grants writes" was the same false membership rule stated as a
   definition. It now says what membership actually is, and points at the
   module docblock for the per-set detail.

MANAGED_DENY_TARGET_SETS' membership is untouched — the deny entries are
harmless and the list is a deliberate allowlist, exactly as the card says.

Verification

The non-comment diff is empty, and the comparator is proven live. Comments
stripped from both sides, whitespace collapsed, compared:

path : packages/plugins/plugin-security/src/managed-object-write-denies.ts
base ref : c54d4d3d7d0a7f3e6ec848dd0cb415ee35ebbb37
raw bytes : base=5664 working=6889 (differ: True)
non-comment chars : base=1372 working=1372
NON-COMMENT DIFF : EMPTY
CONTROL (one code line added to the working copy, comments untouched)
CONTROL non-comment diff : NON-EMPTY (comparator is live)

Syntactic parse, the one real failure mode of a docblock edit (a stray
*/ closing the block early), with a live-detector control:

 0 parse diagnostic(s) WORKING (after the docblock rewrite)
0 parse diagnostic(s) BASE c54d4d3d7 (control: known-good)
316 parse diagnostic(s) CONTROL (same file with a docblock closed early)
PARSE CHECK: PASS (and the detector is proven live by the control)

ESLint, repo-wide, CI's own command — pnpm lint = eslint . --no-inline-config
— exit 0 in 117s. The edited file is confirmed inside the receiving population
rather than assumed to be: --format json on that path returns 1 file entry,
0 errors, 0 warnings, 0 suppressed messages.

Gate families re-derived from the actual diff with
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (no path
arguments; exit 0), both sections read whole. 20 matched families plus the two
i18n convention gates. Exit codes captured before any pipe. All green except:

• pnpm check:i18n — exit 1, NOT MEASURED: its own verdict line reads
  "PREREQUISITE NOT MET — the workspace CLI is not built ... Nothing was
  checked". Its inputs are read rather than assumed: this plugin's
  scripts/i18n-extract.config.ts imports six object definitions from
  ../src/objects/index.js plus the four generated bundles, and
  managed-object-write-denies.ts is named by neither — it is imported only by
  security-plugin.ts and three test files.
• node scripts/check-test-completeness.mjs — exit 3, NOT MEASURED: it
  grades a saved turbo run test log and none was named. Its own text says
  this is the expected local branch, not a red.
• pnpm check:dual-build-cjs-loads — not run; it needs a full build. See the
  declared narrowing below.

Declared narrowing: the dependency-closure build, this package's vitest run
and check:dual-build-cjs-loads were not run locally. Stated as a narrowing,
not reported as coverage. The shared verify lock was continuously held with 3-4
runs queued and waits of 340-685s throughout this task. Three readings say what
the narrowing does and does not exclude: (1) the compiled output is a function
of the non-comment source, and that source is identical on both sides — 1372
characters each, by a comparator a control proves live; (2) the diff is exactly
one path, git diff --stat reading 30 insertions / 14 deletions, all inside
/** */ blocks, with no config, tsconfig, package.json or test file touched,
so no untouched file's verdict can move; (3) the file still parses clean under
the TypeScript parser and under ESLint's TypeScript parser, independently. CI
runs the farm on this PR regardless, which is where those three land.

A dispatch-gates staleness note is recorded rather than acted on: HEAD is 3
commits behind origin/main (9b18c0475) and one file the derivation reads,
scripts/import-prerequisite.mjs, changed across that range.

Union re-run and all readings above are from 255eabdee, the branch head.

Scope

No behaviour change: this is prose, and only prose. Out of scope and untouched,
per the dispatch: packages/plugins/plugin-security/src/security-plugin.ts
(read for the call site, never edited) and every other file on the in-flight
fence. #13903 is not addressed here — the repo-wide sweep of the retired
elevation-gate premise is its own face, its table names no line in this file,
and none of its rows are touched. No changeset: comments only, nothing
released, so this PR carries skip-changeset.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️1 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/managed-object-write-denies.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/managed-object-write-denies.ts) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 14 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json e612dd0f5bac1313b4d8e2adb061521e210cb65f → packageMentionDocs.

[claude]

Out-of-scope finding filed while implementing this card, per AGENTS.md Prime Directive #10: #14029 — organization_admin_no_bypass holds a write-granting wildcard but is not in MANAGED_DENY_TARGET_SETS, so applyManagedWriteDenies walks past it and the registry-derived denies never reach it. Behaviour-class, deliberately NOT touched in this PR, which is prose only. Filed unassigned for triage.

Session: https://claude.ai/code/session_016ZC5rNQj3WEet5HAmmAkMs

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#13822

Comments only. The module docblock of managed-object-write-denies.ts still
described member_default as granting CRUD through an objects['*']
wildcard. #5491 removed that wildcard, and the set's own declaration in
objects/default-permission-sets.ts now opens by saying the opposite.

Premise verified first, on today's origin/main

The card's premise is a zero, so it is measured with the same-shaped non-zero
controls in the same run. A per-set census over default-permission-sets.ts,
comments stripped first so a '*' in prose cannot be counted as a
declaration and a declaration cannot hide behind one:

set (as declared) decl lines objects['*'] decls wildcard bits
ADMIN_FULL_ACCESS 132-177 0
ORGANIZATION_ADMIN 177-390 1 allowRead=true, allowCreate=true, allowEdit=true, allowDelete=true, viewAllRecords=true, modifyAllRecords=true
'member_default' 390-864 0
'viewer_readonly' 864-993 1 allowRead=true, allowCreate=false, allowEdit=false, allowDelete=false
MCP_AGENT_PERMISSION_SET_READ 993-1003 1 allowRead=true
MCP_AGENT_PERMISSION_SET_WRITE 1003-1018 1 allowRead=true, allowCreate=true, allowEdit=true, allowDelete=true
MCP_AGENT_PERMISSION_SET_RESTRICTED 1018-1049 0
ORGANIZATION_ADMIN_NO_BYPASS 1049-1074 0
TOTAL wildcard declarations in file: 4

member_default reads 0 while three sibling sets in the same run read 1, so
the zero is a reading and not a blind spot. Its only object spread is
...denyWritesOnManagedObjects(), whose keys are BETTER_AUTH_MANAGED_OBJECTS
— no wildcard arrives that way either. The two sets reading 0 with a wildcard
elsewhere are known and named below.

So the granting shape today, for the four sets this module targets:

target set	wildcard	what the injected managed-table entry does there
organization_admin	full CRUD + viewAllRecords/modifyAllRecords	narrows the wildcard
MCP write set	full CRUD	narrows the wildcard
viewer_readonly	read-only	belt-and-suspenders over a wildcard that already denies (its own comment says so)
member_default	none since #5491	it is the read grant itself — this set's access is exactly the objects it NAMES

Two sets read 0 in the census but do hold a wildcard, neither of them
member_default: admin_full_access takes its from
ADMIN_FULL_ACCESS_CAPABILITIES in @objectstack/spec, and
organization_admin_no_bypass is derived at module load by
deriveWallLessOrgAdmin. Both are outside the census's file by construction,
not missing from it.

What changed

Three sites in this one file carried the same claim; each now states the
mechanism in force rather than leaving the gap a deleted sentence would leave.

1. Module docblock opening — "The default write-granting permission sets
   (...) grant CRUD via a '*' wildcard". Replaced by the per-set breakdown
   above, carrying member_default's * wildcard object grant (C/R/E) union-merges into every org member — app-side explicit-allow object gates are erased on three axes #5491's reason and the 2026-08-07 maintainer ruling forward
   from the sibling declaration.
2. "Deliberately NOT covered" section — "are also wildcard-granted in these
   sets" now reads "reached by the wildcard in the target sets that carry one",
   and the viewAllRecords/modifyAllRecords argument names
   organization_admin, the only target set whose wildcard carries those bits.
3. MANAGED_DENY_TARGET_SETS docblock — "The default sets whose '*'
   wildcard grants writes" was the same false membership rule stated as a
   definition. It now says what membership actually is, and points at the
   module docblock for the per-set detail.

MANAGED_DENY_TARGET_SETS' membership is untouched — the deny entries are
harmless and the list is a deliberate allowlist, exactly as the card says.

Verification

The non-comment diff is empty, and the comparator is proven live. Comments
stripped from both sides, whitespace collapsed, compared:

path : packages/plugins/plugin-security/src/managed-object-write-denies.ts
base ref : c54d4d3d7d0a7f3e6ec848dd0cb415ee35ebbb37
raw bytes : base=5664 working=6889 (differ: True)
non-comment chars : base=1372 working=1372
NON-COMMENT DIFF : EMPTY
CONTROL (one code line added to the working copy, comments untouched)
CONTROL non-comment diff : NON-EMPTY (comparator is live)

Syntactic parse, the one real failure mode of a docblock edit (a stray
*/ closing the block early), with a live-detector control:

 0 parse diagnostic(s) WORKING (after the docblock rewrite)
0 parse diagnostic(s) BASE c54d4d3d7 (control: known-good)
316 parse diagnostic(s) CONTROL (same file with a docblock closed early)
PARSE CHECK: PASS (and the detector is proven live by the control)

ESLint, repo-wide, CI's own command — pnpm lint = eslint . --no-inline-config
— exit 0 in 117s. The edited file is confirmed inside the receiving population
rather than assumed to be: --format json on that path returns 1 file entry,
0 errors, 0 warnings, 0 suppressed messages.

Gate families re-derived from the actual diff with
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (no path
arguments; exit 0), both sections read whole. 20 matched families plus the two
i18n convention gates. Exit codes captured before any pipe. All green except:

• pnpm check:i18n — exit 1, NOT MEASURED: its own verdict line reads
  "PREREQUISITE NOT MET — the workspace CLI is not built ... Nothing was
  checked". Its inputs are read rather than assumed: this plugin's
  scripts/i18n-extract.config.ts imports six object definitions from
  ../src/objects/index.js plus the four generated bundles, and
  managed-object-write-denies.ts is named by neither — it is imported only by
  security-plugin.ts and three test files.
• node scripts/check-test-completeness.mjs — exit 3, NOT MEASURED: it
  grades a saved turbo run test log and none was named. Its own text says
  this is the expected local branch, not a red.
• pnpm check:dual-build-cjs-loads — not run; it needs a full build. See the
  declared narrowing below.

Declared narrowing: the dependency-closure build, this package's vitest run
and check:dual-build-cjs-loads were not run locally. Stated as a narrowing,
not reported as coverage. The shared verify lock was continuously held with 3-4
runs queued and waits of 340-685s throughout this task. Three readings say what
the narrowing does and does not exclude: (1) the compiled output is a function
of the non-comment source, and that source is identical on both sides — 1372
characters each, by a comparator a control proves live; (2) the diff is exactly
one path, git diff --stat reading 30 insertions / 14 deletions, all inside
/** */ blocks, with no config, tsconfig, package.json or test file touched,
so no untouched file's verdict can move; (3) the file still parses clean under
the TypeScript parser and under ESLint's TypeScript parser, independently. CI
runs the farm on this PR regardless, which is where those three land.

A dispatch-gates staleness note is recorded rather than acted on: HEAD is 3
commits behind origin/main (9b18c0475) and one file the derivation reads,
scripts/import-prerequisite.mjs, changed across that range.

Union re-run and all readings above are from 255eabdee, the branch head.

Scope

No behaviour change: this is prose, and only prose. Out of scope and untouched,
per the dispatch: packages/plugins/plugin-security/src/security-plugin.ts
(read for the call site, never edited) and every other file on the in-flight
fence. #13903 is not addressed here — the repo-wide sweep of the retired
elevation-gate premise is its own face, its table names no line in this file,
and none of its rows are touched. No changeset: comments only, nothing
released, so this PR carries skip-changeset.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️1 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/managed-object-write-denies.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/managed-object-write-denies.ts) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 14 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json e612dd0f5bac1313b4d8e2adb061521e210cb65f → packageMentionDocs.

[claude]

Out-of-scope finding filed while implementing this card, per AGENTS.md Prime Directive #10: #14029 — organization_admin_no_bypass holds a write-granting wildcard but is not in MANAGED_DENY_TARGET_SETS, so applyManagedWriteDenies walks past it and the registry-derived denies never reach it. Behaviour-class, deliberately NOT touched in this PR, which is prose only. Filed unassigned for triage.

Session: https://claude.ai/code/session_016ZC5rNQj3WEet5HAmmAkMs

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#13822

Comments only. The module docblock of managed-object-write-denies.ts still
described member_default as granting CRUD through an objects['*']
wildcard. #5491 removed that wildcard, and the set's own declaration in
objects/default-permission-sets.ts now opens by saying the opposite.

Premise verified first, on today's origin/main

The card's premise is a zero, so it is measured with the same-shaped non-zero
controls in the same run. A per-set census over default-permission-sets.ts,
comments stripped first so a '*' in prose cannot be counted as a
declaration and a declaration cannot hide behind one:

set (as declared) decl lines objects['*'] decls wildcard bits
ADMIN_FULL_ACCESS 132-177 0
ORGANIZATION_ADMIN 177-390 1 allowRead=true, allowCreate=true, allowEdit=true, allowDelete=true, viewAllRecords=true, modifyAllRecords=true
'member_default' 390-864 0
'viewer_readonly' 864-993 1 allowRead=true, allowCreate=false, allowEdit=false, allowDelete=false
MCP_AGENT_PERMISSION_SET_READ 993-1003 1 allowRead=true
MCP_AGENT_PERMISSION_SET_WRITE 1003-1018 1 allowRead=true, allowCreate=true, allowEdit=true, allowDelete=true
MCP_AGENT_PERMISSION_SET_RESTRICTED 1018-1049 0
ORGANIZATION_ADMIN_NO_BYPASS 1049-1074 0
TOTAL wildcard declarations in file: 4

member_default reads 0 while three sibling sets in the same run read 1, so
the zero is a reading and not a blind spot. Its only object spread is
...denyWritesOnManagedObjects(), whose keys are BETTER_AUTH_MANAGED_OBJECTS
— no wildcard arrives that way either. The two sets reading 0 with a wildcard
elsewhere are known and named below.

So the granting shape today, for the four sets this module targets:

target set	wildcard	what the injected managed-table entry does there
organization_admin	full CRUD + viewAllRecords/modifyAllRecords	narrows the wildcard
MCP write set	full CRUD	narrows the wildcard
viewer_readonly	read-only	belt-and-suspenders over a wildcard that already denies (its own comment says so)
member_default	none since #5491	it is the read grant itself — this set's access is exactly the objects it NAMES

Two sets read 0 in the census but do hold a wildcard, neither of them
member_default: admin_full_access takes its from
ADMIN_FULL_ACCESS_CAPABILITIES in @objectstack/spec, and
organization_admin_no_bypass is derived at module load by
deriveWallLessOrgAdmin. Both are outside the census's file by construction,
not missing from it.

What changed

Three sites in this one file carried the same claim; each now states the
mechanism in force rather than leaving the gap a deleted sentence would leave.

1. Module docblock opening — "The default write-granting permission sets
   (...) grant CRUD via a '*' wildcard". Replaced by the per-set breakdown
   above, carrying member_default's * wildcard object grant (C/R/E) union-merges into every org member — app-side explicit-allow object gates are erased on three axes #5491's reason and the 2026-08-07 maintainer ruling forward
   from the sibling declaration.
2. "Deliberately NOT covered" section — "are also wildcard-granted in these
   sets" now reads "reached by the wildcard in the target sets that carry one",
   and the viewAllRecords/modifyAllRecords argument names
   organization_admin, the only target set whose wildcard carries those bits.
3. MANAGED_DENY_TARGET_SETS docblock — "The default sets whose '*'
   wildcard grants writes" was the same false membership rule stated as a
   definition. It now says what membership actually is, and points at the
   module docblock for the per-set detail.

MANAGED_DENY_TARGET_SETS' membership is untouched — the deny entries are
harmless and the list is a deliberate allowlist, exactly as the card says.

Verification

The non-comment diff is empty, and the comparator is proven live. Comments
stripped from both sides, whitespace collapsed, compared:

path : packages/plugins/plugin-security/src/managed-object-write-denies.ts
base ref : c54d4d3d7d0a7f3e6ec848dd0cb415ee35ebbb37
raw bytes : base=5664 working=6889 (differ: True)
non-comment chars : base=1372 working=1372
NON-COMMENT DIFF : EMPTY
CONTROL (one code line added to the working copy, comments untouched)
CONTROL non-comment diff : NON-EMPTY (comparator is live)

Syntactic parse, the one real failure mode of a docblock edit (a stray
*/ closing the block early), with a live-detector control:

 0 parse diagnostic(s) WORKING (after the docblock rewrite)
0 parse diagnostic(s) BASE c54d4d3d7 (control: known-good)
316 parse diagnostic(s) CONTROL (same file with a docblock closed early)
PARSE CHECK: PASS (and the detector is proven live by the control)

ESLint, repo-wide, CI's own command — pnpm lint = eslint . --no-inline-config
— exit 0 in 117s. The edited file is confirmed inside the receiving population
rather than assumed to be: --format json on that path returns 1 file entry,
0 errors, 0 warnings, 0 suppressed messages.

Gate families re-derived from the actual diff with
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (no path
arguments; exit 0), both sections read whole. 20 matched families plus the two
i18n convention gates. Exit codes captured before any pipe. All green except:

• pnpm check:i18n — exit 1, NOT MEASURED: its own verdict line reads
  "PREREQUISITE NOT MET — the workspace CLI is not built ... Nothing was
  checked". Its inputs are read rather than assumed: this plugin's
  scripts/i18n-extract.config.ts imports six object definitions from
  ../src/objects/index.js plus the four generated bundles, and
  managed-object-write-denies.ts is named by neither — it is imported only by
  security-plugin.ts and three test files.
• node scripts/check-test-completeness.mjs — exit 3, NOT MEASURED: it
  grades a saved turbo run test log and none was named. Its own text says
  this is the expected local branch, not a red.
• pnpm check:dual-build-cjs-loads — not run; it needs a full build. See the
  declared narrowing below.

Declared narrowing: the dependency-closure build, this package's vitest run
and check:dual-build-cjs-loads were not run locally. Stated as a narrowing,
not reported as coverage. The shared verify lock was continuously held with 3-4
runs queued and waits of 340-685s throughout this task. Three readings say what
the narrowing does and does not exclude: (1) the compiled output is a function
of the non-comment source, and that source is identical on both sides — 1372
characters each, by a comparator a control proves live; (2) the diff is exactly
one path, git diff --stat reading 30 insertions / 14 deletions, all inside
/** */ blocks, with no config, tsconfig, package.json or test file touched,
so no untouched file's verdict can move; (3) the file still parses clean under
the TypeScript parser and under ESLint's TypeScript parser, independently. CI
runs the farm on this PR regardless, which is where those three land.

A dispatch-gates staleness note is recorded rather than acted on: HEAD is 3
commits behind origin/main (9b18c0475) and one file the derivation reads,
scripts/import-prerequisite.mjs, changed across that range.

Union re-run and all readings above are from 255eabdee, the branch head.

Scope

No behaviour change: this is prose, and only prose. Out of scope and untouched,
per the dispatch: packages/plugins/plugin-security/src/security-plugin.ts
(read for the call site, never edited) and every other file on the in-flight
fence. #13903 is not addressed here — the repo-wide sweep of the retired
elevation-gate premise is its own face, its table names no line in this file,
and none of its rows are touched. No changeset: comments only, nothing
released, so this PR carries skip-changeset.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️1 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/managed-object-write-denies.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/managed-object-write-denies.ts) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 14 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json e612dd0f5bac1313b4d8e2adb061521e210cb65f → packageMentionDocs.

[claude]

Out-of-scope finding filed while implementing this card, per AGENTS.md Prime Directive #10: #14029 — organization_admin_no_bypass holds a write-granting wildcard but is not in MANAGED_DENY_TARGET_SETS, so applyManagedWriteDenies walks past it and the registry-derived denies never reach it. Behaviour-class, deliberately NOT touched in this PR, which is prose only. Filed unassigned for triage.

Session: https://claude.ai/code/session_016ZC5rNQj3WEet5HAmmAkMs

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#13822

Comments only. The module docblock of managed-object-write-denies.ts still
described member_default as granting CRUD through an objects['*']
wildcard. #5491 removed that wildcard, and the set's own declaration in
objects/default-permission-sets.ts now opens by saying the opposite.

Premise verified first, on today's origin/main

The card's premise is a zero, so it is measured with the same-shaped non-zero
controls in the same run. A per-set census over default-permission-sets.ts,
comments stripped first so a '*' in prose cannot be counted as a
declaration and a declaration cannot hide behind one:

set (as declared) decl lines objects['*'] decls wildcard bits
ADMIN_FULL_ACCESS 132-177 0
ORGANIZATION_ADMIN 177-390 1 allowRead=true, allowCreate=true, allowEdit=true, allowDelete=true, viewAllRecords=true, modifyAllRecords=true
'member_default' 390-864 0
'viewer_readonly' 864-993 1 allowRead=true, allowCreate=false, allowEdit=false, allowDelete=false
MCP_AGENT_PERMISSION_SET_READ 993-1003 1 allowRead=true
MCP_AGENT_PERMISSION_SET_WRITE 1003-1018 1 allowRead=true, allowCreate=true, allowEdit=true, allowDelete=true
MCP_AGENT_PERMISSION_SET_RESTRICTED 1018-1049 0
ORGANIZATION_ADMIN_NO_BYPASS 1049-1074 0
TOTAL wildcard declarations in file: 4

member_default reads 0 while three sibling sets in the same run read 1, so
the zero is a reading and not a blind spot. Its only object spread is
...denyWritesOnManagedObjects(), whose keys are BETTER_AUTH_MANAGED_OBJECTS
— no wildcard arrives that way either. The two sets reading 0 with a wildcard
elsewhere are known and named below.

So the granting shape today, for the four sets this module targets:

target set	wildcard	what the injected managed-table entry does there
organization_admin	full CRUD + viewAllRecords/modifyAllRecords	narrows the wildcard
MCP write set	full CRUD	narrows the wildcard
viewer_readonly	read-only	belt-and-suspenders over a wildcard that already denies (its own comment says so)
member_default	none since #5491	it is the read grant itself — this set's access is exactly the objects it NAMES

Two sets read 0 in the census but do hold a wildcard, neither of them
member_default: admin_full_access takes its from
ADMIN_FULL_ACCESS_CAPABILITIES in @objectstack/spec, and
organization_admin_no_bypass is derived at module load by
deriveWallLessOrgAdmin. Both are outside the census's file by construction,
not missing from it.

What changed

Three sites in this one file carried the same claim; each now states the
mechanism in force rather than leaving the gap a deleted sentence would leave.

1. Module docblock opening — "The default write-granting permission sets
   (...) grant CRUD via a '*' wildcard". Replaced by the per-set breakdown
   above, carrying member_default's * wildcard object grant (C/R/E) union-merges into every org member — app-side explicit-allow object gates are erased on three axes #5491's reason and the 2026-08-07 maintainer ruling forward
   from the sibling declaration.
2. "Deliberately NOT covered" section — "are also wildcard-granted in these
   sets" now reads "reached by the wildcard in the target sets that carry one",
   and the viewAllRecords/modifyAllRecords argument names
   organization_admin, the only target set whose wildcard carries those bits.
3. MANAGED_DENY_TARGET_SETS docblock — "The default sets whose '*'
   wildcard grants writes" was the same false membership rule stated as a
   definition. It now says what membership actually is, and points at the
   module docblock for the per-set detail.

MANAGED_DENY_TARGET_SETS' membership is untouched — the deny entries are
harmless and the list is a deliberate allowlist, exactly as the card says.

Verification

The non-comment diff is empty, and the comparator is proven live. Comments
stripped from both sides, whitespace collapsed, compared:

path : packages/plugins/plugin-security/src/managed-object-write-denies.ts
base ref : c54d4d3d7d0a7f3e6ec848dd0cb415ee35ebbb37
raw bytes : base=5664 working=6889 (differ: True)
non-comment chars : base=1372 working=1372
NON-COMMENT DIFF : EMPTY
CONTROL (one code line added to the working copy, comments untouched)
CONTROL non-comment diff : NON-EMPTY (comparator is live)

Syntactic parse, the one real failure mode of a docblock edit (a stray
*/ closing the block early), with a live-detector control:

 0 parse diagnostic(s) WORKING (after the docblock rewrite)
0 parse diagnostic(s) BASE c54d4d3d7 (control: known-good)
316 parse diagnostic(s) CONTROL (same file with a docblock closed early)
PARSE CHECK: PASS (and the detector is proven live by the control)

ESLint, repo-wide, CI's own command — pnpm lint = eslint . --no-inline-config
— exit 0 in 117s. The edited file is confirmed inside the receiving population
rather than assumed to be: --format json on that path returns 1 file entry,
0 errors, 0 warnings, 0 suppressed messages.

Gate families re-derived from the actual diff with
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (no path
arguments; exit 0), both sections read whole. 20 matched families plus the two
i18n convention gates. Exit codes captured before any pipe. All green except:

• pnpm check:i18n — exit 1, NOT MEASURED: its own verdict line reads
  "PREREQUISITE NOT MET — the workspace CLI is not built ... Nothing was
  checked". Its inputs are read rather than assumed: this plugin's
  scripts/i18n-extract.config.ts imports six object definitions from
  ../src/objects/index.js plus the four generated bundles, and
  managed-object-write-denies.ts is named by neither — it is imported only by
  security-plugin.ts and three test files.
• node scripts/check-test-completeness.mjs — exit 3, NOT MEASURED: it
  grades a saved turbo run test log and none was named. Its own text says
  this is the expected local branch, not a red.
• pnpm check:dual-build-cjs-loads — not run; it needs a full build. See the
  declared narrowing below.

Declared narrowing: the dependency-closure build, this package's vitest run
and check:dual-build-cjs-loads were not run locally. Stated as a narrowing,
not reported as coverage. The shared verify lock was continuously held with 3-4
runs queued and waits of 340-685s throughout this task. Three readings say what
the narrowing does and does not exclude: (1) the compiled output is a function
of the non-comment source, and that source is identical on both sides — 1372
characters each, by a comparator a control proves live; (2) the diff is exactly
one path, git diff --stat reading 30 insertions / 14 deletions, all inside
/** */ blocks, with no config, tsconfig, package.json or test file touched,
so no untouched file's verdict can move; (3) the file still parses clean under
the TypeScript parser and under ESLint's TypeScript parser, independently. CI
runs the farm on this PR regardless, which is where those three land.

A dispatch-gates staleness note is recorded rather than acted on: HEAD is 3
commits behind origin/main (9b18c0475) and one file the derivation reads,
scripts/import-prerequisite.mjs, changed across that range.

Union re-run and all readings above are from 255eabdee, the branch head.

Scope

No behaviour change: this is prose, and only prose. Out of scope and untouched,
per the dispatch: packages/plugins/plugin-security/src/security-plugin.ts
(read for the call site, never edited) and every other file on the in-flight
fence. #13903 is not addressed here — the repo-wide sweep of the retired
elevation-gate premise is its own face, its table names no line in this file,
and none of its rows are touched. No changeset: comments only, nothing
released, so this PR carries skip-changeset.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️1 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/managed-object-write-denies.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/managed-object-write-denies.ts) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 14 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json e612dd0f5bac1313b4d8e2adb061521e210cb65f → packageMentionDocs.

[claude]

Out-of-scope finding filed while implementing this card, per AGENTS.md Prime Directive #10: #14029 — organization_admin_no_bypass holds a write-granting wildcard but is not in MANAGED_DENY_TARGET_SETS, so applyManagedWriteDenies walks past it and the registry-derived denies never reach it. Behaviour-class, deliberately NOT touched in this PR, which is prose only. Filed unassigned for triage.

Session: https://claude.ai/code/session_016ZC5rNQj3WEet5HAmmAkMs

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#13822

Comments only. The module docblock of managed-object-write-denies.ts still
described member_default as granting CRUD through an objects['*']
wildcard. #5491 removed that wildcard, and the set's own declaration in
objects/default-permission-sets.ts now opens by saying the opposite.

Premise verified first, on today's origin/main

The card's premise is a zero, so it is measured with the same-shaped non-zero
controls in the same run. A per-set census over default-permission-sets.ts,
comments stripped first so a '*' in prose cannot be counted as a
declaration and a declaration cannot hide behind one:

set (as declared) decl lines objects['*'] decls wildcard bits
ADMIN_FULL_ACCESS 132-177 0
ORGANIZATION_ADMIN 177-390 1 allowRead=true, allowCreate=true, allowEdit=true, allowDelete=true, viewAllRecords=true, modifyAllRecords=true
'member_default' 390-864 0
'viewer_readonly' 864-993 1 allowRead=true, allowCreate=false, allowEdit=false, allowDelete=false
MCP_AGENT_PERMISSION_SET_READ 993-1003 1 allowRead=true
MCP_AGENT_PERMISSION_SET_WRITE 1003-1018 1 allowRead=true, allowCreate=true, allowEdit=true, allowDelete=true
MCP_AGENT_PERMISSION_SET_RESTRICTED 1018-1049 0
ORGANIZATION_ADMIN_NO_BYPASS 1049-1074 0
TOTAL wildcard declarations in file: 4

member_default reads 0 while three sibling sets in the same run read 1, so
the zero is a reading and not a blind spot. Its only object spread is
...denyWritesOnManagedObjects(), whose keys are BETTER_AUTH_MANAGED_OBJECTS
— no wildcard arrives that way either. The two sets reading 0 with a wildcard
elsewhere are known and named below.

So the granting shape today, for the four sets this module targets:

target set	wildcard	what the injected managed-table entry does there
organization_admin	full CRUD + viewAllRecords/modifyAllRecords	narrows the wildcard
MCP write set	full CRUD	narrows the wildcard
viewer_readonly	read-only	belt-and-suspenders over a wildcard that already denies (its own comment says so)
member_default	none since #5491	it is the read grant itself — this set's access is exactly the objects it NAMES

Two sets read 0 in the census but do hold a wildcard, neither of them
member_default: admin_full_access takes its from
ADMIN_FULL_ACCESS_CAPABILITIES in @objectstack/spec, and
organization_admin_no_bypass is derived at module load by
deriveWallLessOrgAdmin. Both are outside the census's file by construction,
not missing from it.

What changed

Three sites in this one file carried the same claim; each now states the
mechanism in force rather than leaving the gap a deleted sentence would leave.

1. Module docblock opening — "The default write-granting permission sets
   (...) grant CRUD via a '*' wildcard". Replaced by the per-set breakdown
   above, carrying member_default's * wildcard object grant (C/R/E) union-merges into every org member — app-side explicit-allow object gates are erased on three axes #5491's reason and the 2026-08-07 maintainer ruling forward
   from the sibling declaration.
2. "Deliberately NOT covered" section — "are also wildcard-granted in these
   sets" now reads "reached by the wildcard in the target sets that carry one",
   and the viewAllRecords/modifyAllRecords argument names
   organization_admin, the only target set whose wildcard carries those bits.
3. MANAGED_DENY_TARGET_SETS docblock — "The default sets whose '*'
   wildcard grants writes" was the same false membership rule stated as a
   definition. It now says what membership actually is, and points at the
   module docblock for the per-set detail.

MANAGED_DENY_TARGET_SETS' membership is untouched — the deny entries are
harmless and the list is a deliberate allowlist, exactly as the card says.

Verification

The non-comment diff is empty, and the comparator is proven live. Comments
stripped from both sides, whitespace collapsed, compared:

path : packages/plugins/plugin-security/src/managed-object-write-denies.ts
base ref : c54d4d3d7d0a7f3e6ec848dd0cb415ee35ebbb37
raw bytes : base=5664 working=6889 (differ: True)
non-comment chars : base=1372 working=1372
NON-COMMENT DIFF : EMPTY
CONTROL (one code line added to the working copy, comments untouched)
CONTROL non-comment diff : NON-EMPTY (comparator is live)

Syntactic parse, the one real failure mode of a docblock edit (a stray
*/ closing the block early), with a live-detector control:

 0 parse diagnostic(s) WORKING (after the docblock rewrite)
0 parse diagnostic(s) BASE c54d4d3d7 (control: known-good)
316 parse diagnostic(s) CONTROL (same file with a docblock closed early)
PARSE CHECK: PASS (and the detector is proven live by the control)

ESLint, repo-wide, CI's own command — pnpm lint = eslint . --no-inline-config
— exit 0 in 117s. The edited file is confirmed inside the receiving population
rather than assumed to be: --format json on that path returns 1 file entry,
0 errors, 0 warnings, 0 suppressed messages.

Gate families re-derived from the actual diff with
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (no path
arguments; exit 0), both sections read whole. 20 matched families plus the two
i18n convention gates. Exit codes captured before any pipe. All green except:

• pnpm check:i18n — exit 1, NOT MEASURED: its own verdict line reads
  "PREREQUISITE NOT MET — the workspace CLI is not built ... Nothing was
  checked". Its inputs are read rather than assumed: this plugin's
  scripts/i18n-extract.config.ts imports six object definitions from
  ../src/objects/index.js plus the four generated bundles, and
  managed-object-write-denies.ts is named by neither — it is imported only by
  security-plugin.ts and three test files.
• node scripts/check-test-completeness.mjs — exit 3, NOT MEASURED: it
  grades a saved turbo run test log and none was named. Its own text says
  this is the expected local branch, not a red.
• pnpm check:dual-build-cjs-loads — not run; it needs a full build. See the
  declared narrowing below.

Declared narrowing: the dependency-closure build, this package's vitest run
and check:dual-build-cjs-loads were not run locally. Stated as a narrowing,
not reported as coverage. The shared verify lock was continuously held with 3-4
runs queued and waits of 340-685s throughout this task. Three readings say what
the narrowing does and does not exclude: (1) the compiled output is a function
of the non-comment source, and that source is identical on both sides — 1372
characters each, by a comparator a control proves live; (2) the diff is exactly
one path, git diff --stat reading 30 insertions / 14 deletions, all inside
/** */ blocks, with no config, tsconfig, package.json or test file touched,
so no untouched file's verdict can move; (3) the file still parses clean under
the TypeScript parser and under ESLint's TypeScript parser, independently. CI
runs the farm on this PR regardless, which is where those three land.

A dispatch-gates staleness note is recorded rather than acted on: HEAD is 3
commits behind origin/main (9b18c0475) and one file the derivation reads,
scripts/import-prerequisite.mjs, changed across that range.

Union re-run and all readings above are from 255eabdee, the branch head.

Scope

No behaviour change: this is prose, and only prose. Out of scope and untouched,
per the dispatch: packages/plugins/plugin-security/src/security-plugin.ts
(read for the call site, never edited) and every other file on the in-flight
fence. #13903 is not addressed here — the repo-wide sweep of the retired
elevation-gate premise is its own face, its table names no line in this file,
and none of its rows are touched. No changeset: comments only, nothing
released, so this PR carries skip-changeset.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️1 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/managed-object-write-denies.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/managed-object-write-denies.ts) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 14 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json e612dd0f5bac1313b4d8e2adb061521e210cb65f → packageMentionDocs.

[claude]

Out-of-scope finding filed while implementing this card, per AGENTS.md Prime Directive #10: #14029 — organization_admin_no_bypass holds a write-granting wildcard but is not in MANAGED_DENY_TARGET_SETS, so applyManagedWriteDenies walks past it and the registry-derived denies never reach it. Behaviour-class, deliberately NOT touched in this PR, which is prose only. Filed unassigned for triage.

Session: https://claude.ai/code/session_016ZC5rNQj3WEet5HAmmAkMs

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#13822

Comments only. The module docblock of managed-object-write-denies.ts still
described member_default as granting CRUD through an objects['*']
wildcard. #5491 removed that wildcard, and the set's own declaration in
objects/default-permission-sets.ts now opens by saying the opposite.

Premise verified first, on today's origin/main

The card's premise is a zero, so it is measured with the same-shaped non-zero
controls in the same run. A per-set census over default-permission-sets.ts,
comments stripped first so a '*' in prose cannot be counted as a
declaration and a declaration cannot hide behind one:

set (as declared) decl lines objects['*'] decls wildcard bits
ADMIN_FULL_ACCESS 132-177 0
ORGANIZATION_ADMIN 177-390 1 allowRead=true, allowCreate=true, allowEdit=true, allowDelete=true, viewAllRecords=true, modifyAllRecords=true
'member_default' 390-864 0
'viewer_readonly' 864-993 1 allowRead=true, allowCreate=false, allowEdit=false, allowDelete=false
MCP_AGENT_PERMISSION_SET_READ 993-1003 1 allowRead=true
MCP_AGENT_PERMISSION_SET_WRITE 1003-1018 1 allowRead=true, allowCreate=true, allowEdit=true, allowDelete=true
MCP_AGENT_PERMISSION_SET_RESTRICTED 1018-1049 0
ORGANIZATION_ADMIN_NO_BYPASS 1049-1074 0
TOTAL wildcard declarations in file: 4

member_default reads 0 while three sibling sets in the same run read 1, so
the zero is a reading and not a blind spot. Its only object spread is
...denyWritesOnManagedObjects(), whose keys are BETTER_AUTH_MANAGED_OBJECTS
— no wildcard arrives that way either. The two sets reading 0 with a wildcard
elsewhere are known and named below.

So the granting shape today, for the four sets this module targets:

target set	wildcard	what the injected managed-table entry does there
organization_admin	full CRUD + viewAllRecords/modifyAllRecords	narrows the wildcard
MCP write set	full CRUD	narrows the wildcard
viewer_readonly	read-only	belt-and-suspenders over a wildcard that already denies (its own comment says so)
member_default	none since #5491	it is the read grant itself — this set's access is exactly the objects it NAMES

Two sets read 0 in the census but do hold a wildcard, neither of them
member_default: admin_full_access takes its from
ADMIN_FULL_ACCESS_CAPABILITIES in @objectstack/spec, and
organization_admin_no_bypass is derived at module load by
deriveWallLessOrgAdmin. Both are outside the census's file by construction,
not missing from it.

What changed

Three sites in this one file carried the same claim; each now states the
mechanism in force rather than leaving the gap a deleted sentence would leave.

1. Module docblock opening — "The default write-granting permission sets
   (...) grant CRUD via a '*' wildcard". Replaced by the per-set breakdown
   above, carrying member_default's * wildcard object grant (C/R/E) union-merges into every org member — app-side explicit-allow object gates are erased on three axes #5491's reason and the 2026-08-07 maintainer ruling forward
   from the sibling declaration.
2. "Deliberately NOT covered" section — "are also wildcard-granted in these
   sets" now reads "reached by the wildcard in the target sets that carry one",
   and the viewAllRecords/modifyAllRecords argument names
   organization_admin, the only target set whose wildcard carries those bits.
3. MANAGED_DENY_TARGET_SETS docblock — "The default sets whose '*'
   wildcard grants writes" was the same false membership rule stated as a
   definition. It now says what membership actually is, and points at the
   module docblock for the per-set detail.

MANAGED_DENY_TARGET_SETS' membership is untouched — the deny entries are
harmless and the list is a deliberate allowlist, exactly as the card says.

Verification

The non-comment diff is empty, and the comparator is proven live. Comments
stripped from both sides, whitespace collapsed, compared:

path : packages/plugins/plugin-security/src/managed-object-write-denies.ts
base ref : c54d4d3d7d0a7f3e6ec848dd0cb415ee35ebbb37
raw bytes : base=5664 working=6889 (differ: True)
non-comment chars : base=1372 working=1372
NON-COMMENT DIFF : EMPTY
CONTROL (one code line added to the working copy, comments untouched)
CONTROL non-comment diff : NON-EMPTY (comparator is live)

Syntactic parse, the one real failure mode of a docblock edit (a stray
*/ closing the block early), with a live-detector control:

 0 parse diagnostic(s) WORKING (after the docblock rewrite)
0 parse diagnostic(s) BASE c54d4d3d7 (control: known-good)
316 parse diagnostic(s) CONTROL (same file with a docblock closed early)
PARSE CHECK: PASS (and the detector is proven live by the control)

ESLint, repo-wide, CI's own command — pnpm lint = eslint . --no-inline-config
— exit 0 in 117s. The edited file is confirmed inside the receiving population
rather than assumed to be: --format json on that path returns 1 file entry,
0 errors, 0 warnings, 0 suppressed messages.

Gate families re-derived from the actual diff with
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (no path
arguments; exit 0), both sections read whole. 20 matched families plus the two
i18n convention gates. Exit codes captured before any pipe. All green except:

• pnpm check:i18n — exit 1, NOT MEASURED: its own verdict line reads
  "PREREQUISITE NOT MET — the workspace CLI is not built ... Nothing was
  checked". Its inputs are read rather than assumed: this plugin's
  scripts/i18n-extract.config.ts imports six object definitions from
  ../src/objects/index.js plus the four generated bundles, and
  managed-object-write-denies.ts is named by neither — it is imported only by
  security-plugin.ts and three test files.
• node scripts/check-test-completeness.mjs — exit 3, NOT MEASURED: it
  grades a saved turbo run test log and none was named. Its own text says
  this is the expected local branch, not a red.
• pnpm check:dual-build-cjs-loads — not run; it needs a full build. See the
  declared narrowing below.

Declared narrowing: the dependency-closure build, this package's vitest run
and check:dual-build-cjs-loads were not run locally. Stated as a narrowing,
not reported as coverage. The shared verify lock was continuously held with 3-4
runs queued and waits of 340-685s throughout this task. Three readings say what
the narrowing does and does not exclude: (1) the compiled output is a function
of the non-comment source, and that source is identical on both sides — 1372
characters each, by a comparator a control proves live; (2) the diff is exactly
one path, git diff --stat reading 30 insertions / 14 deletions, all inside
/** */ blocks, with no config, tsconfig, package.json or test file touched,
so no untouched file's verdict can move; (3) the file still parses clean under
the TypeScript parser and under ESLint's TypeScript parser, independently. CI
runs the farm on this PR regardless, which is where those three land.

A dispatch-gates staleness note is recorded rather than acted on: HEAD is 3
commits behind origin/main (9b18c0475) and one file the derivation reads,
scripts/import-prerequisite.mjs, changed across that range.

Union re-run and all readings above are from 255eabdee, the branch head.

Scope

No behaviour change: this is prose, and only prose. Out of scope and untouched,
per the dispatch: packages/plugins/plugin-security/src/security-plugin.ts
(read for the call site, never edited) and every other file on the in-flight
fence. #13903 is not addressed here — the repo-wide sweep of the retired
elevation-gate premise is its own face, its table names no line in this file,
and none of its rows are touched. No changeset: comments only, nothing
released, so this PR carries skip-changeset.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️1 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/managed-object-write-denies.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/managed-object-write-denies.ts) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 14 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json e612dd0f5bac1313b4d8e2adb061521e210cb65f → packageMentionDocs.

[claude]

Out-of-scope finding filed while implementing this card, per AGENTS.md Prime Directive #10: #14029 — organization_admin_no_bypass holds a write-granting wildcard but is not in MANAGED_DENY_TARGET_SETS, so applyManagedWriteDenies walks past it and the registry-derived denies never reach it. Behaviour-class, deliberately NOT touched in this PR, which is prose only. Filed unassigned for triage.

Session: https://claude.ai/code/session_016ZC5rNQj3WEet5HAmmAkMs

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#13822

Comments only. The module docblock of managed-object-write-denies.ts still
described member_default as granting CRUD through an objects['*']
wildcard. #5491 removed that wildcard, and the set's own declaration in
objects/default-permission-sets.ts now opens by saying the opposite.

Premise verified first, on today's origin/main

The card's premise is a zero, so it is measured with the same-shaped non-zero
controls in the same run. A per-set census over default-permission-sets.ts,
comments stripped first so a '*' in prose cannot be counted as a
declaration and a declaration cannot hide behind one:

set (as declared) decl lines objects['*'] decls wildcard bits
ADMIN_FULL_ACCESS 132-177 0
ORGANIZATION_ADMIN 177-390 1 allowRead=true, allowCreate=true, allowEdit=true, allowDelete=true, viewAllRecords=true, modifyAllRecords=true
'member_default' 390-864 0
'viewer_readonly' 864-993 1 allowRead=true, allowCreate=false, allowEdit=false, allowDelete=false
MCP_AGENT_PERMISSION_SET_READ 993-1003 1 allowRead=true
MCP_AGENT_PERMISSION_SET_WRITE 1003-1018 1 allowRead=true, allowCreate=true, allowEdit=true, allowDelete=true
MCP_AGENT_PERMISSION_SET_RESTRICTED 1018-1049 0
ORGANIZATION_ADMIN_NO_BYPASS 1049-1074 0
TOTAL wildcard declarations in file: 4

member_default reads 0 while three sibling sets in the same run read 1, so
the zero is a reading and not a blind spot. Its only object spread is
...denyWritesOnManagedObjects(), whose keys are BETTER_AUTH_MANAGED_OBJECTS
— no wildcard arrives that way either. The two sets reading 0 with a wildcard
elsewhere are known and named below.

So the granting shape today, for the four sets this module targets:

target set	wildcard	what the injected managed-table entry does there
organization_admin	full CRUD + viewAllRecords/modifyAllRecords	narrows the wildcard
MCP write set	full CRUD	narrows the wildcard
viewer_readonly	read-only	belt-and-suspenders over a wildcard that already denies (its own comment says so)
member_default	none since #5491	it is the read grant itself — this set's access is exactly the objects it NAMES

Two sets read 0 in the census but do hold a wildcard, neither of them
member_default: admin_full_access takes its from
ADMIN_FULL_ACCESS_CAPABILITIES in @objectstack/spec, and
organization_admin_no_bypass is derived at module load by
deriveWallLessOrgAdmin. Both are outside the census's file by construction,
not missing from it.

What changed

Three sites in this one file carried the same claim; each now states the
mechanism in force rather than leaving the gap a deleted sentence would leave.

1. Module docblock opening — "The default write-granting permission sets
   (...) grant CRUD via a '*' wildcard". Replaced by the per-set breakdown
   above, carrying member_default's * wildcard object grant (C/R/E) union-merges into every org member — app-side explicit-allow object gates are erased on three axes #5491's reason and the 2026-08-07 maintainer ruling forward
   from the sibling declaration.
2. "Deliberately NOT covered" section — "are also wildcard-granted in these
   sets" now reads "reached by the wildcard in the target sets that carry one",
   and the viewAllRecords/modifyAllRecords argument names
   organization_admin, the only target set whose wildcard carries those bits.
3. MANAGED_DENY_TARGET_SETS docblock — "The default sets whose '*'
   wildcard grants writes" was the same false membership rule stated as a
   definition. It now says what membership actually is, and points at the
   module docblock for the per-set detail.

MANAGED_DENY_TARGET_SETS' membership is untouched — the deny entries are
harmless and the list is a deliberate allowlist, exactly as the card says.

Verification

The non-comment diff is empty, and the comparator is proven live. Comments
stripped from both sides, whitespace collapsed, compared:

path : packages/plugins/plugin-security/src/managed-object-write-denies.ts
base ref : c54d4d3d7d0a7f3e6ec848dd0cb415ee35ebbb37
raw bytes : base=5664 working=6889 (differ: True)
non-comment chars : base=1372 working=1372
NON-COMMENT DIFF : EMPTY
CONTROL (one code line added to the working copy, comments untouched)
CONTROL non-comment diff : NON-EMPTY (comparator is live)

Syntactic parse, the one real failure mode of a docblock edit (a stray
*/ closing the block early), with a live-detector control:

 0 parse diagnostic(s) WORKING (after the docblock rewrite)
0 parse diagnostic(s) BASE c54d4d3d7 (control: known-good)
316 parse diagnostic(s) CONTROL (same file with a docblock closed early)
PARSE CHECK: PASS (and the detector is proven live by the control)

ESLint, repo-wide, CI's own command — pnpm lint = eslint . --no-inline-config
— exit 0 in 117s. The edited file is confirmed inside the receiving population
rather than assumed to be: --format json on that path returns 1 file entry,
0 errors, 0 warnings, 0 suppressed messages.

Gate families re-derived from the actual diff with
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (no path
arguments; exit 0), both sections read whole. 20 matched families plus the two
i18n convention gates. Exit codes captured before any pipe. All green except:

• pnpm check:i18n — exit 1, NOT MEASURED: its own verdict line reads
  "PREREQUISITE NOT MET — the workspace CLI is not built ... Nothing was
  checked". Its inputs are read rather than assumed: this plugin's
  scripts/i18n-extract.config.ts imports six object definitions from
  ../src/objects/index.js plus the four generated bundles, and
  managed-object-write-denies.ts is named by neither — it is imported only by
  security-plugin.ts and three test files.
• node scripts/check-test-completeness.mjs — exit 3, NOT MEASURED: it
  grades a saved turbo run test log and none was named. Its own text says
  this is the expected local branch, not a red.
• pnpm check:dual-build-cjs-loads — not run; it needs a full build. See the
  declared narrowing below.

Declared narrowing: the dependency-closure build, this package's vitest run
and check:dual-build-cjs-loads were not run locally. Stated as a narrowing,
not reported as coverage. The shared verify lock was continuously held with 3-4
runs queued and waits of 340-685s throughout this task. Three readings say what
the narrowing does and does not exclude: (1) the compiled output is a function
of the non-comment source, and that source is identical on both sides — 1372
characters each, by a comparator a control proves live; (2) the diff is exactly
one path, git diff --stat reading 30 insertions / 14 deletions, all inside
/** */ blocks, with no config, tsconfig, package.json or test file touched,
so no untouched file's verdict can move; (3) the file still parses clean under
the TypeScript parser and under ESLint's TypeScript parser, independently. CI
runs the farm on this PR regardless, which is where those three land.

A dispatch-gates staleness note is recorded rather than acted on: HEAD is 3
commits behind origin/main (9b18c0475) and one file the derivation reads,
scripts/import-prerequisite.mjs, changed across that range.

Union re-run and all readings above are from 255eabdee, the branch head.

Scope

No behaviour change: this is prose, and only prose. Out of scope and untouched,
per the dispatch: packages/plugins/plugin-security/src/security-plugin.ts
(read for the call site, never edited) and every other file on the in-flight
fence. #13903 is not addressed here — the repo-wide sweep of the retired
elevation-gate premise is its own face, its table names no line in this file,
and none of its rows are touched. No changeset: comments only, nothing
released, so this PR carries skip-changeset.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️1 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/managed-object-write-denies.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/managed-object-write-denies.ts) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 14 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json e612dd0f5bac1313b4d8e2adb061521e210cb65f → packageMentionDocs.

[claude]

Out-of-scope finding filed while implementing this card, per AGENTS.md Prime Directive #10: #14029 — organization_admin_no_bypass holds a write-granting wildcard but is not in MANAGED_DENY_TARGET_SETS, so applyManagedWriteDenies walks past it and the registry-derived denies never reach it. Behaviour-class, deliberately NOT touched in this PR, which is prose only. Filed unassigned for triage.

Session: https://claude.ai/code/session_016ZC5rNQj3WEet5HAmmAkMs

Generated by Claude Code

---

Generated by Claude Code