Repository navigation
Commit 2acff87
Part of #15204
Clause-②: no
**The console pin hop `088e0f705520` → `9646e2ed2bf3`** (objectui
`main`, `9646e2ed2bf315a6ae99b2a1633bc7c7d162f7b9`, exactly that
commit). This hop exists for objectui#12185 (`d928c8394`,
objectui#12183). Under a wall (`isolated` / `group`), Setup's security
catalog pages (position, permission set, capability) are read-only for a
tenant and say why, while the platform operator keeps write. The server
already refuses those writes (#22895, #22935).
**Tier:** no governed surface (`GOVERNED_SURFACES` in
`scripts/pm/check-governed-merges.mjs`). 20 files.
## The hop: 9 objectui commits, all on objectui `main`
- `d928c8394`, objectui#12185 (objectui#12183): under a wall, the
catalog pages are read-only for a tenant and say why;
- `9646e2ed2`, objectui#12193: the fallback email-template form stops
offering the retired `category` / `isSystem` keys;
- `5dd583f5e`, objectui#12199: a gallery card whose title field is a
lookup draws the referenced name;
- `26b0bd2d1`, objectui#12189, and `35a2b59a5`, objectui#12180:
objectui#6349 batches 12 and 11 (one authority each for the
FilterBuilder types, `DataSource`, `DomProps`, `SchemaNode`);
- `5b20aed39`, objectui#12181: a hatch-elevated type's packaged item
opens read-only;
- `b0c5f9ddf`, objectui#12177: Studio names an environment overlay, not
an org overlay;
- `0f31c3a03`, objectui#12186 (CLI test) and `7e30d0b6e`, objectui#12182
(docs deploy CI): ship no console code.
## The pin round, as #22967's
**Console Pin Gate steps, run locally** (each exited 0):
1. Client build: `turbo run build --filter=@objectstack/client...`.
2. `scripts/build-console.sh` at the pin.
3. `check:console-sha`: "Console dist matches the objectui pin
(objectui@9646e2ed2bf3)".
4. `check:console-injection --require-stamp`.
**Artefacts that travel with the pin:**
- **Console changeset.** `scripts/bump-objectui.sh` generated
`.changeset/console-9646e2ed2bf3.md`: `@objectstack/console` **minor**,
the level #22967 used (also the level the script derived from objectui's
own changesets). It has 13 releasing entries and 0 breaking, so there is
no ADR-0087 placeholder. One commit carries no changeset and is listed
by subject. `Clause-②: no` was added by hand, as in #22967.
`check:objectui-changeset` passes.
- **SDUI manifest.** `node scripts/gen-sdui-manifest-node.mjs`:
`sdui.manifest.json` is byte-identical across the hop (107 components),
and `scripts/sdui-manifest.record.json` is re-recorded at the pin.
`check-sdui-manifest` passes.
- **Lockstep record.** `pnpm gen:sdui-lockstep` re-records
`packages/sdui-parser/objectui-lockstep.json` at `9646e2ed2bf3`.
objectui's `sdui-parser` changed on this hop (objectui#12180's type
renames), and `check:sdui-lockstep` still passes: 214 grammar lines are
byte-identical, all 25 diagnostic codes agree, and the `not-a-container`
predicate agrees. **No parser port is owed.**
- **Pin citations, re-measured for this hop only** (re-measure, never
find-and-replace):
- one file that any record cites changed on the hop:
`plugin-list/src/ListView.tsx` (+9/-9, objectui#12189, the FilterBuilder
group type's rename). All nine lines were replaced in place (`:13`,
`:324`, `:326`, `:332`, `:399`, `:756`, `:774`, `:777`, `:1558`), so
**no line in the file moved** and no cited range contains a changed
line. Its `case 'kanban'` / `'calendar'` / `'timeline'` / `'gantt'` /
`'map'` / `'tree'` arms held at `3762` / `3813` / `3902` / `3959` /
`4079` / `4120-4144`. `resolveListMapConfig` `:209-214` and
`resolveTimelineDateBinding` `:695-699` held too, each ending before the
next changed line below it;
- the records citing it got hand-written hop sentences: the four
view-type rows of the functional-completeness table (`calendar`,
`gantt`, `timeline`, `map`), plus the `object-gantt` and
flat-`TreeConfig` records in `component.zod.ts`. The `kanban` row-cap
record names `ListView.tsx` / `ObjectView.tsx` only as an earlier
re-read's record, and its sentence says so;
- every other record cites only files that are byte-identical across the
hop, and each gains a hop sentence saying so. Every cited objectui file
was resolved against the tree at the pin and checked with `git diff
--quiet 088e0f705520 9646e2ed2bf3 -- <path>`, one file at a time; bare
names (`index.tsx`, `types.ts`, `button.tsx`) were resolved by their
record's context. That covers `form.tsx`, `autoLayout.ts`,
`field-type-alias.ts`, `ObjectCalendar.tsx`, the `en` / `zh` / `de`
packs, `data-objectstack/src/index.ts` and the action renderers, so the
`FormField.span` describe's claim holds (pin re-stamped,
`content/docs/references/ui/view.mdx` regenerated by `check:generated
--fix`, the only stale artifact);
- the six migration entries were recounted with `git grep -o -F`, which
reproduces every `088e0f705520` figure exactly. The corpus is 8540
files, and every retired name each entry counts still reads 0. A
superset was counted to be safe: every current export of
`plugin-lifecycle-advanced.zod.ts`, `metrics.zod.ts` and
`tracing.zod.ts`, plus every key each entry names. Every term is 0
except the unrelated `Span` 519 / `SpanSchema` 57, which the tracing
entry already explains and which are unchanged. The lit controls moved
with the corpus, e.g. `objectstack` 18400 → 18438, `tenant` 1365 → 1393;
- `check:objectui-pin-citations --verify-anchors`: 55 asserting
citations match `9646e2ed2`, and the 13 quoted anchors verify against
objectui at the pin. `gen:migration-registry` regenerates the six
generated-registry rows;
- changeset `.changeset/objectui-pin-citations-9646e2ed2bf3.md`:
`@objectstack/spec` patch, `Clause-②: no`.
## Browser check, against this branch's built console
`examples/app-showcase` was booted `--fresh` on this branch's console
dist (Playwright, Chromium), once per posture. **Harness note:** as
committed, the showcase cannot boot walled. It does not declare
`@objectstack/organizations`, and the CLI refuses a walled posture
without it (ADR-0093 D5). A walled boot also needs
`OS_PLATFORM_OWNER_EMAIL` and a declared `OS_AUTH_MEMBERSHIP_POLICY`.
For the `isolated` and `group` runs I added the dependency to the
showcase's `package.json` locally and uncommitted, set
`OS_PLATFORM_OWNER_EMAIL=admin@objectos.ai` and
`OS_AUTH_MEMBERSHIP_POLICY=invite-only`, and reverted both files
afterwards. `/auth/config` served `tenancyPosture: isolated` / `group`
with `degradedTenancy: false`.
**Tenant fixture (each walled run):** `tenant@wall.test` owns
organization "Tenant A". The operator authored a runtime permission set
`w_meta_author` (`manage_metadata`) and a runtime position
`wall_demo_pos`, and granted `w_meta_author` to the tenant inside Tenant
A. The tenant's `/auth/me/permissions` carries `manage_metadata`, and
its session reads `isPlatformAdmin: false`. The server refuses the
tenant's `PUT /meta/position/wall_probe` with `403 FORBIDDEN` naming the
posture.
| | position list / editor | permission-set list / editor | capability
list / editor |
|:--|:--|:--|:--|
| **`isolated`, tenant** | no New; `catalog-readonly-reason`; editor
`walled-catalog-readonly-banner`, no Design / Save / Delete, Delegatable
switch disabled | no New; reason line; editor `perm-walled-readonly`,
badge "Read-only (the platform operator defines this catalog)", no Save
/ Clone | read-only by the package lock ("locked …
`com.example.showcase@0.1.0`"), the type's own tier, as objectui#12185
specifies for a stock capability |
| **`isolated`, operator** | New offered; editor in Design with editable
fields and the save / delete affordances | New offered; editor offers
Save | read-only (code-only type: the server refuses a runtime
capability for everyone, `allowRuntimeCreate=false`) |
| **`group`, tenant** | as `isolated` | as `isolated` | as `isolated` |
| **`group`, operator** | as `isolated`; **a label edit auto-saved**:
`PUT /meta/position/wall_demo_pos?mode=draft` → 200 | as `isolated` | as
`isolated` |
| **`single`, non-operator `manage_metadata` holder**
(`author@single.test`, `isPlatformAdmin: false`) | New offered, editor
editable, no wall notes; **a label edit auto-saved**: `PUT …?mode=draft`
→ 200 | New offered; editor offers Save | read-only (type tier, as
before) |
The one enabled switch on the tenant's permission-set editor is the
matrix's "Only granted" view filter, not a write.
**User page grant pickers** (`single`, as the operator, on
`author@single.test`'s record): the Positions tab's New opens the grant
form, and `registry-ref-position` lists 17 positions (16 stock plus
`wall_demo_pos`). The Permission Sets tab's New opens
`registry-ref-permission`, which lists 18 permission sets. Picking
`auditor` and `showcase_auditor` and pressing Create wrote both rows
(`POST /data/sys_user_position` → 201, `POST
/data/sys_user_permission_set` → 201), confirmed through the data API.
**`everyone` is still listed** among the positions: the open objectui
finding #22967 carried, unchanged by this hop.
Also seen, not this hop's: a fresh workspace opens the "Set the
workspace timezone" dialog over Setup until it is dismissed.
## Verification (local)
- full `turbo run build` green (74/74, none cached);
- `check:generated`: 14/14 current after the `view.mdx` regeneration;
- `dispatch-gates --ran`: 125 derived families. The sweep was running
when this draft opened, and its verdict follows in a comment.
---
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_018yfmohHttjK9aTbKnZLuDr
---------
Co-authored-by: Claude <noreply@anthropic.com>
1 parent 3071d3e commit 2acff87
20 files changed
Lines changed: 259 additions & 55 deletions
File tree
- .changeset
- content/docs/references/ui
- packages
- sdui-parser
- spec/src
- data
- kernel
- migrations/entries/semantic
- ui
- scripts
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
| 1 | + | |
| 2 | + | |
| 3 | + | |
| 4 | + | |
| 5 | + | |
| 6 | + | |
| 7 | + | |
| 8 | + | |
| 9 | + | |
| 10 | + | |
| 11 | + | |
| 12 | + | |
| 13 | + | |
| 14 | + | |
| 15 | + | |
| 16 | + | |
| 17 | + | |
| 18 | + | |
| 19 | + | |
| 20 | + | |
| 21 | + | |
| 22 | + | |
| 23 | + | |
| 24 | + | |
| 25 | + | |
| 26 | + | |
| 27 | + | |
| 28 | + | |
| 29 | + | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
| 1 | + | |
| 2 | + | |
| 3 | + | |
| 4 | + | |
| 5 | + | |
| 6 | + | |
| 7 | + | |
| 8 | + | |
| 9 | + | |
| 10 | + | |
| 11 | + | |
| 12 | + | |
| 13 | + | |
| 14 | + | |
| 15 | + | |
| 16 | + | |
| 17 | + | |
| 18 | + | |
| 19 | + | |
| 20 | + | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | | - | |
| 1 | + | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
213 | 213 | | |
214 | 214 | | |
215 | 215 | | |
216 | | - | |
| 216 | + | |
217 | 217 | | |
218 | 218 | | |
219 | 219 | | |
| |||
343 | 343 | | |
344 | 344 | | |
345 | 345 | | |
346 | | - | |
| 346 | + | |
347 | 347 | | |
348 | 348 | | |
349 | 349 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
6 | 6 | | |
7 | 7 | | |
8 | 8 | | |
9 | | - | |
10 | | - | |
| 9 | + | |
| 10 | + | |
11 | 11 | | |
12 | 12 | | |
13 | 13 | | |
| |||
21 | 21 | | |
22 | 22 | | |
23 | 23 | | |
24 | | - | |
| 24 | + | |
25 | 25 | | |
26 | 26 | | |
27 | 27 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
61 | 61 | | |
62 | 62 | | |
63 | 63 | | |
64 | | - | |
| 64 | + | |
| 65 | + | |
| 66 | + | |
| 67 | + | |
65 | 68 | | |
66 | 69 | | |
67 | 70 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
298 | 298 | | |
299 | 299 | | |
300 | 300 | | |
301 | | - | |
| 301 | + | |
| 302 | + | |
| 303 | + | |
| 304 | + | |
| 305 | + | |
| 306 | + | |
| 307 | + | |
| 308 | + | |
| 309 | + | |
302 | 310 | | |
303 | 311 | | |
304 | 312 | | |
| |||
440 | 448 | | |
441 | 449 | | |
442 | 450 | | |
443 | | - | |
| 451 | + | |
| 452 | + | |
| 453 | + | |
| 454 | + | |
| 455 | + | |
| 456 | + | |
| 457 | + | |
444 | 458 | | |
445 | 459 | | |
446 | 460 | | |
| |||
545 | 559 | | |
546 | 560 | | |
547 | 561 | | |
548 | | - | |
| 562 | + | |
| 563 | + | |
| 564 | + | |
| 565 | + | |
| 566 | + | |
| 567 | + | |
| 568 | + | |
| 569 | + | |
549 | 570 | | |
550 | 571 | | |
551 | 572 | | |
| |||
647 | 668 | | |
648 | 669 | | |
649 | 670 | | |
650 | | - | |
| 671 | + | |
| 672 | + | |
| 673 | + | |
| 674 | + | |
| 675 | + | |
| 676 | + | |
| 677 | + | |
| 678 | + | |
651 | 679 | | |
652 | 680 | | |
653 | 681 | | |
| |||
0 commit comments