qa(checklist): access-security — provisioning recipe for a bound guest anchor (unblocks crud-permission-matrix c5)

Filing gate: ③ a maintainer-directed task — in the 18.2.0 wave-2 session (2026-10-27), on the PM's list of improvements ("补测试数据配方: write the recurring fixture gaps up as area-level provisioning recipes"), the maintainer answered, verbatim: 「补测试数据配方。立卡」.
Business reason: access-security.crud-permission-matrix acceptance[5] (the guest create-without-read asymmetry) scored blocked(fixture) in wave 1 (#25812) and wave 2 (#26481): the guest anchor ships unbound on a stock boot (knownGaps[2]), so a P0 item never scores one of its clauses.
Reader: the lane owning docs/qa/platform-checklist/** and packages/qa/** (domain:devx). The shape to copy is the area-level fixtures recipe block in docs/qa/platform-checklist/README.md ("Area-level fixtures"), the worked instance qa-scratch-authz in areas/attachments-storage.json; items opt in with fixtures.provisioning.use.
Dedupe (open AND closed): "checklist fixture provisioning recipe blocked fixture knownGaps org-less approval request" → 29 hits; the nearest is #21851 (closed: four other recipes, landed). None covers the gaps below.

Gap

access-security.crud-permission-matrix acceptance[5] — a recipe that binds the guest anchor on a stock showcase boot (the permission set and the door that binds it), plus the guest persona that reads through it, replayable in a few calls.

Done when

The recipe is written once at the area level (a keyed block beside items), with the exact call sequence a runner replays on a stock showcase boot, and each listed item references it with fixtures.provisioning.use + why.
Each listed clause is re-driven once on the recipe and its verdict recorded in the item history (citing this card); the item's knownGaps line for the gap is removed or reworded.
node scripts/check-platform-checklist.mjs stays green (it resolves every provisioning.use and refuses an unreferenced recipe).
A gap that turns out to be a product limit rather than a fixture (no door exists at all) is filed as its own card and stays blocked with that card as blocked.ref.

Generated by Claude Code

Triage: first grade — `tests` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T11:05Z

⛔ Not a claim, ⛔ not a dispatch.

p2, maintainer-directed (wave-2 session, 「补测试数据配方。立卡」): write the provisioning recipe so the named clauses can be scored, in docs/qa/platform-checklist/** / packages/qa/**, with the item revisions bumped. domain:devx. ⛔ No product change rides this card. If a recipe needs a door the platform lacks, that is a separate product card.

Generated by Claude Code

Claim: PM loop round 9 · 2026-10-27T21:00Z
Session: session_01JQwxbYtweo3WYSXaFn71a5 (card thread cmsg_01U5RdnAAmkSQmZbqh6FtqZ8GwrioG5ADPUvzoisipKr8y, dispatched by seat session session_01JQwxbaFpnMwgpCgneKe2qS)
Account: os-warren (the seat's linked user; the card's assignee)
Branch: claude/project-thread-ftgbli (the harness-pinned branch of the card thread; it names no issue, so this claim is the identity record)
Worktree: objectstack-issue-26623
Domain: domain:devx
Seat: domain:devx#1
File surface: docs/qa/platform-checklist/areas/access-security.json only: item access-security.crud-permission-matrix (steps, knownGaps[2], history; fixtures.provisioning and an area-level recipe only if a binding door exists — the thread's early read finds none, ADR-0138 D3 item 5 under ruling C on #23267). ⛔ No product change, no .github/** or .claude/** edit, no other item touched (stop on breach)
Container & model: S/M, mode:thread (Warren's 「opus 很多，并发5」, 2026-10-27), model: default (no path-derived mandate, default opus), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: maintainer-directed in the 18.2.0 wave-2 session (「补测试数据配方。立卡」); crud-permission-matrix acceptance[5] scored blocked(fixture) in waves 1 (#25812) and 2 (#26481)
Thread-read: 6440328198
Premise: holds on origin/main 1708115e2f — crud-permission-matrix (rev 9) knownGaps[2] still records clause 5 as unobservable because the guest anchor ships unbound; access-security.json carries no area-level fixtures block yet (read by the seat)
Serial constraints cleared: none fully. ⚠️ PR #26905 (#26571 slice 3, queued) and the coming #26571 slice 4 edit other items of access-security.json; merge origin/main right before the PR and re-run check-platform-checklist. No other devx seat is seated

Generated by Claude Code

os-dev-report

{
  "issue": 26623,
  "status": "done",
  "branch": "claude/project-thread-ftgbli",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/26923",
  "session": "session_01JQwxbYtweo3WYSXaFn71a5",
  "premise_still_valid": true,
  "summary": "No recipe could be written, because no door binds a set to the guest anchor: ADR-0138 D3 item 5, amended implementation-first by ruling C on #23267 (comment 6159279205), builds that door only when a named deployment needs one. Per the accepted slice: no area recipe and no fixtures.provisioning reference; nothing new filed, since the product card is the existing, ruled #23267. Item access-security.crud-permission-matrix only: knownGaps[2] now records acceptance[5] as blocked(dependency) with ref #23267 instead of blocked(fixture), and lists the refused routes (PUT /meta/position/guest 403 NOT_OVERRIDABLE as pinned in guest-grants-channel.dogfood.test.ts, confirmAudienceBindingSuggestion refusing a guest row, the package door refusing a built-in name) plus ADR-0138 D2's 401 on /api/v1/data for any anonymous caller; steps[5] and the closing phrase of automated.ref say blocked(dependency), #23267; revision 9 -> 10 with a history row citing #26623 that records the re-drive. Item-level blocked stays absent, since the other six clauses run on a stock boot.",
  "tests": "No code changed. Full turbo build at main 1708115e2f, then one REST re-drive of acceptance[5] on a fresh stock showcase boot (pnpm dev -- --fresh -p 4310, no env posture) as the dev admin: GET /api/v1/meta/position/guest 200 (provenance package, no permissionSets); PUT /api/v1/meta/position/guest naming showcase_guest_portal 403 NOT_OVERRIDABLE, re-read unchanged; GET /api/v1/security/suggested-bindings 200 with one row (everyone, showcase_member_default, confirmed) and no guest row; anonymous POST and GET /api/v1/data/showcase_inquiry 401 UNAUTHENTICATED each. Nothing written; temp DB discarded. Verdict: blocked(dependency, #23267).",
  "gates": "Local, head e197a554 (main 57820085 merged in): dispatch-gates --commands derived 16, all exit 0: node scripts/check-adr-links.mjs :: exit 0; node scripts/check-adr-links.mjs --self-test :: exit 0; node scripts/check-closing-keyword-parity.mjs :: exit 0; node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0; node scripts/check-comment-mask-corpus.mjs :: exit 0; node scripts/ci/plan-test-core-shards.mjs --self-test :: exit 0; pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0; pnpm check:ci-filter-parity :: exit 0; pnpm check:cross-package-test-inputs :: exit 0; pnpm check:doc-authoring :: exit 0; pnpm check:driver-memory-census :: exit 0; pnpm check:gitlink-declared :: exit 0; pnpm check:nul-bytes :: exit 0; pnpm check:platform-checklist :: exit 0; pnpm check:refd-timer-probe :: exit 0; pnpm check:watch-hint-literal :: exit 0. --ran reconciliation: 16 derived, 16 run, 0 NOT-MEASURED. CI check-runs: not waited on at report time.",
  "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "0",
  "api_writes": "2 — fleet-write relay pr_create (PR 26923, draft, assignee os-warren, label skip-changeset; 7157 bytes sent = stored), and this os-dev-report comment via post-stamped. git push x1 (not REST).",
  "body_amendments": [],
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none · noted, not filed: the claim surface named steps, knownGaps[2] and history; the closing phrase of the same item's automated.ref also said blocked(fixture) and was changed to blocked(dependency), #23267 so the item does not contradict itself. Named in the PR body's Acceptance notes",
    "carrier: none · noted, not filed: PR #26905 edits other items in access-security.json and had not landed when main was merged here; whichever lands second merges origin/main and re-runs check-platform-checklist",
    "carrier: none · noted, not filed: the full turbo build held the shared verify lock 16m39s (os-verify-lock warned); a live-boot ledger card needs the full build per check-dev-prereqs, so this is the known cost, not a new finding"
  ]
}

Generated by Claude Code

ACCEPT → PR #26923 comment 6454451017 · auto-merge armed · 2026-10-27T21:50Z

Landed: the guest-anchor clause of crud-permission-matrix now records blocked(dependency) on #23267 (revision 10) via PR #26923, merged as 95aa781608 · 2026-10-27T22:09Z

Navigation Menu

Repository navigation

qa(checklist): access-security — provisioning recipe for a bound guest anchor (unblocks crud-permission-matrix c5) #26623

Gap

Done when

Triage: first grade — `tests` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T11:05Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

qa(checklist): access-security — provisioning recipe for a bound guest anchor (unblocks crud-permission-matrix c5) #26623

Description

Gap

Done when

Activity

objectstack-fleet commented on Oct 27, 2026

Triage: first grade — tests · priority:p2 · domain:devx · area:devpath · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-27T11:05Z

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first grade — `tests` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T11:05Z