Uh oh!
There was an error while loading. Please reload this page.
METADATA_CREATE_SEEDS.object authors its OWD explicitly (sharingModel: 'private') — #7891 blocker A - #8338
Merged
Merged
Conversation
…haringModel: 'private') The runtime already resolves an absent sharingModel on a custom object to 'private' (fail-closed, ADR-0090 D1 — effectiveSharingModel in plugin-sharing). Seeding the operative default makes the platform's own minimal create body an authored decision, so security-owd-unset can move onto the runtime publish surface (#7891) without refusing the seed. Part of the #7891 programme; blocker A (#8308). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Euoy6wyfzgiWtgCg4s6JK2
…fixture Re-measured today through the publish gate's call site: 56 active object writes across 10 test files, every one of which security-owd-unset would refuse once #8310 declares 'object' in runtimeTypes (up from PR #7886's 26/8 — the suite grew). Each fixture now authors sharingModel: 'private', so the suite passes both before and after the #8310 flip. Part of #8308. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Euoy6wyfzgiWtgCg4s6JK2
…mirror; add changeset The runtime-surface measurement test now consumes the REAL seed from @objectstack/spec/kernel and asserts the gate's mirror adds nothing — so a seed regression re-opens the pin instead of passing silently. The pre-#8308 OWD-less body stays as the refusal's positive control. The registry entry (runtimeTypes) is untouched; the flip is #8310's. Part of #8308. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Euoy6wyfzgiWtgCg4s6JK2
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
Contributor
📓 Docs Drift CheckThis PR changes 1 package(s): 106 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
⛔ 7 release-owned page(s) also reference the affected code. These are read-only:
|
hotlong
marked this pull request as ready for review
August 13, 2026 06:34
Uh oh!
There was an error while loading. Please reload this page.
This was referenced Aug 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes#8308
Blocker A of the #7891 programme (
validateSecurityPostureonto the runtime publish surface, #4001 pattern): the platform's own minimal create body forobjectcarried no org-wide default, so declaringobjectinruntimeTypeswould makesecurity-owd-unsetrefuse the platform's own create path. This PR repairs the authoritative create body and its test fallout. It does NOT flip the registration — that is #8310, blocked on this and #8309.The judgment call — resolved as the mechanical repair, with the measured default
The dispatch's escalation clause asked whether authoring a
sharingModelin the seed is a product fork (changing what a tenant's default sharing IS) or a mechanical repair (making an existing default explicit). Measured, not inferred:effectiveSharingModel(packages/plugins/plugin-sharing/src/sharing-service.ts) resolves a custom object (notsys_*, notisSystem) withsharingModel == nulltoprivate— the ADR-0090 D1 fail-closed default;ObjectSchema's own.describe()documents the same ("A CUSTOM object that omits this resolves to private at runtime"). SeedingsharingModel: 'private'therefore changes no tenant's effective sharing — it makes the operative default an authored decision, which is exactly whatsecurity-owd-unsetexists to demand (the leave_request incident class). No product fork; noneeds_decision.Changes
packages/spec/src/kernel/metadata-create-seeds.ts—METADATA_CREATE_SEEDS.objectgainssharingModel: 'private'with the rationale in place.@objectstack/metadata-protocoltest files — every active-stateobjectfixture write now authors its OWD, so the suite passes both before and after [3 of #7891] Flip the registration:runtimeTypesgainsobject+permission/book— whole rule families cross the publish door #8310's flip. Re-measured today at the gate's call site (issue inherited "26 refusals / 48 tests / 8 files" from PR fix(lint): makevalidateSecurityPosture'ssurfaceReasona measured claim (#7576) #7886): 56 active object writes across 10 files, every one refusable bysecurity-owd-unsetalone, no other rule id — the suite grew since fix(lint): makevalidateSecurityPosture'ssurfaceReasona measured claim (#7576) #7886's measurement. Each fixture was judged individually; two are refusal pins where an OWD-less body would have swapped the pinned refusal (NOT_OVERRIDABLE, package-writability 403s) for the gate's 422 post-flip, and the gate's own "does not gate an undeclared type" case now carries a clean body plus a comment handing its re-pin to [3 of #7891] Flip the registration:runtimeTypesgainsobject+permission/book— whole rule families cross the publish door #8310.packages/lint/src/validate-security-posture.runtime-surface.test.ts— new pin: the REAL seed (consumed from the registry, not re-spelled) is clean at the gate's mirror; the pre-[1 of #7891]METADATA_CREATE_SEEDS.objectgains an authoredsharingModel— or an explicit default-OWD ruling (blocker A) #8308 OWD-less body stays as the refusal's positive control. The registry entry (runtimeTypes) is untouched.@objectstack/specpatch).Measurement method (deviation, disclosed)
PR #7886 measured the fallout by flipping
runtimeTypesand rebuilding. In this session the sandbox's action classifier repeatedly denied rebuildingpackages/lintwith a temporary flip in the tree, so the re-measurement used the gate's exact mirror instead: a temporary (never-committed) recording tap atsaveMetaItem's gate call site captured every active-stateobjectwrite (body + live object context + owning test file) across the full metadata-protocol suite, and each record was judged withvalidateSecurityPostureusing the identical baseline/candidate set-difference the runtime gate performs (thewouldGateAddconstruction the runtime-surface test pins against the realrunRuntimeAuthoringRules). Before the fixture repair: 56 refusable writes / 10 files, allsecurity-owd-unset. After: 0. #8310's real flip will re-verify this end to end at registration time.Verification
@objectstack/specfull suite: 388 files / 10249 tests green with the repaired seed (includesmetadata-create-seeds.test.tsschema validation of every seed).@objectstack/metadata-protocolfull suite green before and after the fixture repair (77 files / 1117 tests).@objectstack/metadata-core: 10 files / 162 tests green. Typecheck: spec + lint green (metadata-protocol is DEBT-ledgered, no typecheck script).check:generated: all 13 artifacts current.check:nul-bytes,check:cross-package-test-inputs,check:spec-parsed-alias: green.Part of #7891. #8309 and #8310 remain open; #8310 is not addressed here.
Generated by Claude Code