[objectstack-fleet]

Requested by Warren · project thread
Fixes #26623

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:crud-permission-matrix 的 acceptance[5](guest 只建不读)不再记作 blocked(fixture),改记 blocked(dependency, security: no door can bind a permission set to the guest anchor — ADR-0138 D3 item 5 has no enforcer (PUT /meta/position/guest answers 403 NOT_OVERRIDABLE; guest suggestions are refused) #23267);knownGaps[2]、steps[5]、automated.ref 末句随之改写,revision 9 → 10 加一行 history。
• 为什么不写配方:没有任何门能把权限集绑到 guest 锚点。ADR-0138 D3 item 5 经 security: no door can bind a permission set to the guest anchor — ADR-0138 D3 item 5 has no enforcer (PUT /meta/position/guest answers 403 NOT_OVERRIDABLE; guest suggestions are refused) #23267 裁定 C(维护者:暂无公开站点或门户的产品计划)把绑定门推迟到有具体部署需要时再建。这是已裁定的产品限制,不是缺测试数据。
• 实测:在全新的 stock showcase 上走 REST,PUT /api/v1/meta/position/guest 返回 403 NOT_OVERRIDABLE,建议绑定列表里没有 guest 行,匿名建和读 inquiry 都是 401。
• 风险与回滚:只改一个 QA 台账 JSON 文件里的一个条目,不动产品代码;回滚即 revert 本 PR。
• 两分钟验证:node scripts/check-platform-checklist.mjs,预期 OK。
• 需要你做的:无,席位落地。

What changes

docs/qa/platform-checklist/areas/access-security.json, item access-security.crud-permission-matrix only:

• fixtures.knownGaps[2] now records clause 5 as a ruled product limit, not a fixture gap: record it blocked(dependency) with ref security: no door can bind a permission set to the guest anchor — ADR-0138 D3 item 5 has no enforcer (PUT /meta/position/guest answers 403 NOT_OVERRIDABLE; guest suggestions are refused) #23267. It cites ADR-0138 D3 item 5 as amended by ruling C on security: no door can bind a permission set to the guest anchor — ADR-0138 D3 item 5 has no enforcer (PUT /meta/position/guest answers 403 NOT_OVERRIDABLE; guest suggestions are refused) #23267 (6159279205), and lists every route that is refused: PUT /api/v1/meta/position/guest 403 NOT_OVERRIDABLE (pinned in packages/qa/dogfood/test/guest-grants-channel.dogfood.test.ts), confirmAudienceBindingSuggestion refusing a guest row, and the package door refusing a built-in position name. It keeps the member-persona and public-form reasons, adds that ADR-0138 D2 keeps /api/v1/data at 401 for anonymous callers even with the anchor bound, and names the in-process guest-channel cases that hold the clause's shape on an inline fixture (which score nothing here). Its last sentence says to write the recipe once the security: no door can bind a permission set to the guest anchor — ADR-0138 D3 item 5 has no enforcer (PUT /meta/position/guest answers 403 NOT_OVERRIDABLE; guest suggestions are refused) #23267 door exists.
• steps[5] says blocked(dependency, #23267) and why.
• The closing words of automated.ref say blocked(dependency), #23267 instead of blocked(fixture).
• revision 9 → 10, plus a history row citing qa(checklist): access-security — provisioning recipe for a bound guest anchor (unblocks crud-permission-matrix c5) #26623 that records the live re-drive below.

No area-level recipe and no fixtures.provisioning reference were added. A provisioning recipe needs a door a runner can replay, and check:platform-checklist refuses a recipe that no item references. No new card was filed: the product card for the missing door is #23267, which already exists and is ruled (closed, ruling C). Item-level blocked stays absent, since the other six clauses can be run on a stock boot.

Why

Card #26623 asked for a recipe that binds the guest anchor so acceptance[5] can be scored. Its Done-when 4 covers this case: a gap that turns out to be a product limit stays blocked, with that limit's card as the ref. The old knownGaps[2] blamed the stock showcase ("the guest anchor ships unbound … binding is an admin action"). That reading sends every wave looking for a fixture that cannot exist, so the ledger now gives the real reason.

Verification

acceptance[5] was re-driven once, REST only, on a fresh stock showcase boot (full turbo run build at main 1708115, then pnpm dev -- --fresh -p 4310, no env posture), as the dev admin:

POST /api/v1/auth/sign-in/email (admin)                         -> 200
GET  /api/v1/meta/position/guest                                 -> 200  _provenance "package", _packageId com.objectstack.plugin-security, no permissionSets
PUT  /api/v1/meta/position/guest {permissionSets:[showcase_guest_portal]} -> 403 NOT_OVERRIDABLE  "'position/guest' is provided by a managed package and is sealed: it cannot be written here."
GET  /api/v1/meta/position/guest (re-read)                       -> 200  unchanged, no permissionSets
GET  /api/v1/security/suggested-bindings                         -> 200  one row: anchor "everyone", showcase_member_default, confirmed; no guest row
POST /api/v1/data/showcase_inquiry (anonymous)                   -> 401 UNAUTHENTICATED
GET  /api/v1/data/showcase_inquiry (anonymous)                   -> 401 UNAUTHENTICATED

Nothing was written, so there was nothing to tear down. The boot's temp DB was discarded.

Local gates on head e197a55 (main 5782008 merged in), derived by node scripts/pm/dispatch-gates.mjs --commands: 16 families, all exit 0; --ran reconciles 16 derived, 16 run, 0 NOT-MEASURED. check:platform-checklist prints OK — 16 areas, 329 items … 8/8 recipes referenced.

Gate run

node scripts/check-adr-links.mjs :: exit 0
node scripts/check-adr-links.mjs --self-test :: exit 0
node scripts/check-closing-keyword-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0
node scripts/check-comment-mask-corpus.mjs :: exit 0
node scripts/ci/plan-test-core-shards.mjs --self-test :: exit 0
pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0
pnpm check:ci-filter-parity :: exit 0
pnpm check:cross-package-test-inputs :: exit 0
pnpm check:doc-authoring :: exit 0
pnpm check:driver-memory-census :: exit 0
pnpm check:gitlink-declared :: exit 0
pnpm check:nul-bytes :: exit 0
pnpm check:platform-checklist :: exit 0
pnpm check:refd-timer-probe :: exit 0
pnpm check:watch-hint-literal :: exit 0

CI families outside the derived list are left to the PR's check-runs.

Acceptance notes

• The claim's surface named steps, knownGaps[2] and history. The closing words of automated.ref were changed too (blocked(fixture) → blocked(dependency), #23267, one phrase), so the item does not contradict itself. Nothing else in the item and no other item was touched.
• ⚠️ PR test(dogfood): pin access-security checklist clauses at the oracle's layer, slice 3 #26905 edits other items in this file. Whichever PR lands second merges origin/main and re-runs check-platform-checklist.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (not touched)
• 2. Every name I added uses the casing for its kind. (no name added)
• 3. No formatter ran; pnpm lint passes. (no linted file touched)
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset. (publishes nothing: skip-changeset)
• 6. packages/spec touched: its generated artifacts are regenerated and committed. (not touched)
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.
• The Before Submitting list in CONTRIBUTING.md is done.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JQwxbYtweo3WYSXaFn71a5

[objectstack-fleet]

维护者速读

• 改了什么:access-security.json 里 crud-permission-matrix 升到第 10 版。第 5 条(guest_portal 只建不读)原来记为 blocked(fixture),现改为 blocked(dependency),指向 security: no door can bind a permission set to the guest anchor — ADR-0138 D3 item 5 has no enforcer (PUT /meta/position/guest answers 403 NOT_OVERRIDABLE; guest suggestions are refused) #23267:平台没有把权限集绑到 guest 锚点的门,不是缺夹具。steps[5] 和 automated.ref 同步改写,并加一条历史。
• 为什么改:卡片 qa(checklist): access-security — provisioning recipe for a bound guest anchor (unblocks crud-permission-matrix c5) #26623 要一份绑定 guest 锚点的区域级供给配方。线程现场复跑后确认写不出来:PUT /meta/position/guest 返回 403 NOT_OVERRIDABLE,suggested-bindings 只有 everyone 一行,匿名请求 401。ADR-0138 D3 第 5 项经 security: no door can bind a permission set to the guest anchor — ADR-0138 D3 item 5 has no enforcer (PUT /meta/position/guest answers 403 NOT_OVERRIDABLE; guest suggestions are refused) #23267 裁决 C,要等有具名部署需要时才建这扇门。
• 风险与回滚:只改清单文字,1 个文件 +10/−4,不碰代码、CI、依赖。回滚 = revert 本 PR。
• 先看:knownGaps[2] 的新措辞,以及历史第 10 行引用的现场复跑。
• 两分钟验证:node scripts/check-platform-checklist.mjs,退出 0。
• 需要你做的:无,席位落地。合并后 qa(checklist): access-security — provisioning recipe for a bound guest anchor (unblocks crud-permission-matrix c5) #26623 关闭。
• 席位意见:不另开重复卡,结在已裁决的 security: no door can bind a permission set to the guest anchor — ADR-0138 D3 item 5 has no enforcer (PUT /meta/position/guest answers 403 NOT_OVERRIDABLE; guest suggestions are refused) #23267 上。

席位核对

ACCEPT · domain:devx#1 · session_01JQwxbaFpnMwgpCgneKe2qS · head cec7a8ffc7 · 2026-10-27T21:48Z

1. Shape: 1 file, +10/−4: docs/qa/platform-checklist/areas/access-security.json. Not governed (check-governed-merges --pr 26923). File surface as in claim 6453445273; Fixes #26623.
2. Read by the seat: the whole diff. crud-permission-matrix revision 9→10. knownGaps[2] now records clause 5 as blocked(dependency) with ref security: no door can bind a permission set to the guest anchor — ADR-0138 D3 item 5 has no enforcer (PUT /meta/position/guest answers 403 NOT_OVERRIDABLE; guest suggestions are refused) #23267, because no door binds a set to the guest anchor (ADR-0138 D3 item 5, ruling C, comment 6159279205); the member-through-baseline and REST-anonymous-401 reasons are kept. steps[5] cites knownGaps[2] with the same reason. The new history row cites the live re-drive at 1708115e2f: PUT /meta/position/guest 403 NOT_OVERRIDABLE, suggested-bindings holding only the everyone row, anonymous 401. No fixtures.provisioning reference is added, so no unreferenced area recipe appears.
3. Gates: head check-runs on cec7a8ffc7: 26 success, 13 skipped, 0 failing; check-expected-skips --pr 26923: OK; mergeable clean. Report 6454050023.
4. Accepted deviations: the card asked for a recipe; the PR closes it on the stated dependency instead, because the door the recipe needs does not exist by ruling. The automated.ref closing phrase is reworded to match.
5. Out of scope: building the guest bind door (ADR-0138 D3 item 5) stays with security: no door can bind a permission set to the guest anchor — ADR-0138 D3 item 5 has no enforcer (PUT /meta/position/guest answers 403 NOT_OVERRIDABLE; guest suggestions are refused) #23267 until a named deployment needs it. Skills-docs: not owed.
6. Landing: not governed, CI green on this head, mergeable clean ⇒ the seat readies it and arms auto-merge through the relay. At merge qa(checklist): access-security — provisioning recipe for a bound guest anchor (unblocks crud-permission-matrix c5) #26623 closes and leaves pm:dispatched.