docs(skills): teach the isDefault everyone baseline and its app-capability rule in objectstack-data security.md (#18531)

Fixes #17359

**Status 2026-09-17 — the paragraph below is historical and
discharged**: the follow-up it names landed as #18535 (PR #18602,
`origin/main` `21b7c12b4`), the ceiling was ruled, and this branch
merged `origin/main`; see "Patch round" at the end.

⛔ **Blocked-by: the #17189 step-② follow-up (the `plugin-security` boot
refusal and the `packages/lint` `security-anchor-high-privilege` rule
passing the declared-capability list) — not landed on `origin/main`
`2496415`, and no open card names it.** Do not land this PR before that
follow-up: today the bullet's second sentence describes the protocol
(`packages/spec/src/security/high-privilege.ts` + the ADR-0090 D5
revision, landed by PR #17814 and PR #17811) and not yet the running
lint/boot — see "Premise check" below.

## What

One 3-line bullet in `skills/objectstack-data/rules/security.md`,
inserted after the `Source:` line of "## Object-level permissions
(RBAC)" — the construct accepted on the card (assessment 5616225081,
ACCEPT 5616301504) with the ACCEPT's boot-wording correction applied
(「fails lint and boot」 overstated the boot side; boot refuses the
binding with a warning, it does not fail). Every other line of the file
is byte-identical (`git diff --numstat` = `3 0`);
`skills/objectstack-platform/SKILL.md` unchanged; no other file.

Lines 35–37, widths 81 / 82 / 91 characters (the file's widest line is
93):

```markdown
- **`isDefault: true` = the `everyone` baseline (ADR-0090 D5).** It may carry app
  capabilities declared under `capabilities:` (`defineCapability`) and granted via
  `systemPermissions`; lint and boot refuse a platform capability or undeclared name there.
```

Wording deviation, declared: the dispatch's suggested passive form 「is
refused by lint and at boot」 puts line 3 at 101 characters, over the 93
cap; the active form above keeps every noun of the accepted text and the
ACCEPT's own verb ("refuse") at 91. No other word moved.

## Premise check on `origin/main` `2496415`

- **A1 holds**: `security.md` is 211 lines, widest line 93, lines 31–34
verbatim as quoted in the assessment. Its last touch is `7d350a4`
(#17476, the Multi-tenancy section), not `6a3bcd8` as the dispatch read;
the neighbours are unaffected.
- **A2 holds in substance**: `git grep -F` over `skills/**` at `2496415`
— `defineCapability` 0, `systemPermissions` 0, `isDefault` 1 (a
list-view example), `capabilities:` 5 — and all five are the data-hook
VM tokens (`capabilities: ['api.read', …]` in
`objectstack-data/references/data-hooks.md` ×4 and
`objectstack-ui/rules/actions.md` ×1), a third registry, not the
ADR-0066 D1 stack key. Positive control `definePermissionSet` = 5 hits.
The bullet duplicates nothing.
- **A3 holds, and the boot side is narrower than the dispatch assumed**:
`bindBaselineToEveryone`
(`packages/plugins/plugin-security/src/security-plugin.ts:3581`) logs
`ctx.logger.warn('[security] refusing to bind fallback set to everyone —
high-privilege bits', { set, offending })` and `continue`s — a warning
and no binding, never a failure. ⚠️ Its call is
`describeHighPrivilegeBits(boot)` (:3585) with NO
`AnchorBindingContext`, and so are the other three consumers:
`security-plugin.ts:5475`, `suggested-audience-bindings.ts:961`,
`packages/lint/src/validate-security-posture.ts:771`. The predicate's
own contract (`high-privilege.ts:134`): 「Omission refuses」. PR #17811's
changeset says it in so many words: 「No shipped behaviour moves in this
release. Every current caller invokes the predicates with the old arity
… The `@objectstack/plugin-security` boot refusal and the
`@objectstack/lint` `security-anchor-high-privilege` rule pass the
declared list in a follow-up」. ⇒ Today a DECLARED app token on the
`isDefault: true` set is still refused by lint (error) and at boot
(warn, no binding) — the shape hotclm hit. The bullet is correct for the
protocol and premature for the runtime; per 「文档应该以实际实现为准」 this PR waits
for the follow-up. The 「or undeclared name」 clause stays: the implicit
placeholder derivation in `bootstrap-declared-capabilities.ts` is alive,
and `describeHighPrivilegeBits` excuses only names on
`context.declaredCapabilities`, platform floor absolute.
- **Keys and anchor, all present**: `capabilities` on
`ObjectStackDefinitionSchema` (`packages/spec/src/stack.zod.ts:467`,
`.describe('[ADR-0066 D1] …')`); `defineCapability`
(`packages/spec/src/security/capabilities.ts:214`); `systemPermissions`
on `PermissionSetSchema`
(`packages/spec/src/security/permission.zod.ts:691`, schema at :587);
`isDefault` at :682 with `.describe('[ADR-0090 D5] App baseline for the
everyone position …')`; ADR-0090 D5 at
`docs/adr/0090-permission-model-v2-concept-convergence.md:46`, its
#17189 revision block at :249. Control: a nonexistent key greps 0 in
`permission.zod.ts`.

## Line readings (the `skills/**` rule)

| reading | before (`2496415`) | after (`4ea43892e`) | net |
|:--|--:|--:|--:|
| `skills/objectstack-data/rules/security.md` | 211 | 214 | +3 |
| package: every `SKILL.md` under `skills/` (10) +
`skills/objectstack-data/{rules,references}/*` (10) — 20 files | 8959 |
8962 | +3 |

Token reading (the sister gate `scripts/check-skills-token-ratchet.mjs`,
convention ceil(utf8 bytes / 4)): `security.md` is **2543** tokens
against a ceiling of **2480** (`CEILINGS` row at
`scripts/check-skills-token-ratchet.mjs:424`, pinned at the landed count
with zero headroom) — **over by 63, the gate is RED at this head**.
Verdict line, verbatim: 「✗ check-skills-token-ratchet:
skills/objectstack-data/rules/security.md is 2543 tokens; the ratchet
ceiling is 2480 (over by 63). … The other direction lands only in a PR
whose body quotes a maintainer ruling authorizing it. ⛔
MAINTAINER-ONLY」. Not raised here and not paid by deletion (the accepted
construct pins every other line of the file). Landing needs that one row
moved to 2543 under the maintainer's word, or an equivalent deletion in
the same file directed by the PM.

## Changeset

`skip-changeset`, by measurement: a walk over every tracked
`package.json` finds **0** manifests whose `files[]` names a `skills`
path (positive control: 70 manifests name `dist`); no
`skills/*/package.json` exists; the catalog ships from the GitHub tree
by `npx skills add objectstack-ai/objectstack/skills`
(`skills/README.md`;
`packages/create-objectstack/src/skills-install.ts:62` `SKILLS_CATALOG =
'objectstack-ai/objectstack/skills'`), never inside an npm tarball.
`.github/workflows/pr-automation.yml:758` lists `skills/` among the
releases-nothing paths.

## Gates (local, at `4ea43892e`)

`node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack` derived 22 commands; every one was run with
redirect-then-`$?` capture; `--ran` reconcile: 「22 derived, 22 run, 0
NOT-MEASURED, 0 UNRUN」, exit 0.

- 21 × exit 0 — among them `check:skill-frame-sync`,
`check:skill-identifier-liveness`, `check:skill-compatibility`,
`check:nul-bytes`, `check:doc-authoring`, `check:role-word`,
`check:corpus-claim-drift`, `check:cross-package-test-inputs`,
`check:pm-governed-merges`, `check-skills-token-ratchet --self-test`.
- `node scripts/check-skills-token-ratchet.mjs` → **exit 1** (the +63
above).
- `pnpm --filter @objectstack/lint run check:doc-formula-expressions` →
first run exit 3 `PREREQUISITE NOT MET` (`@objectstack/formula` and
`@objectstack/lint` unbuilt — not a measurement); built both under
`scripts/pm/os-verify-lock.sh` (`VERDICT command-exit 0`, held 142s),
re-run → exit 0.
- Not applicable: the 14 pending-changeset families (no changeset, by
the measurement above); the 2 workflow-valued families and the 1
path-scheduled CI job are CI's own.
- No ① dependency-closure build and no ② package test: the diff touches
no package.
- Control-character self-scan of the file: none.

## Acceptance notes

- noted, not filed — 承接者: the PM, relayed in the dev report as a class
(b) contract finding with dedupe words: ADR-0090 D5 [ruled] and
`describeHighPrivilegeBits` say a declared app token is not an offending
bit, while the four consumers listed under A3 still refuse it. PR
#17811's changeset promises the follow-up; no open card in
`domain:services` (48), `domain:devx` (103), `domain:spec` (144),
`security` (19) or `finding` (78) names it (lists read 2026-09-16,
keyword set `17189 / bindBaselineToEveryone / declaredCapabilities /
AnchorBindingContext / security-anchor-high-privilege`).
- noted, not filed — 承接者: 无: with this bullet the word "capabilities"
names three registries across the published bundle (data-hook VM tokens,
`requires:` platform service tokens, ADR-0066 D1 stack declarations).
Not a defect; the assessment placed the stack key beside its GRANT key
on purpose.

## 维护者速读(草稿)

**改了什么**:在 `skills/objectstack-data/rules/security.md` 的「Object-level
permissions (RBAC)」键列表里加一条三行要点:`isDefault: true` 的权限集就是 `everyone`
基线(ADR-0090 D5);它可以携带本应用在 `capabilities:` 下用 `defineCapability` 声明、再经
`systemPermissions` 授予的应用能力;平台能力或未声明的名字放在那里会被 lint
与启动拒绝。文件其余各行一字未动,`skills/objectstack-platform/SKILL.md` 不动。

2026-09-17 补丁轮:合入 `origin/main`(合并提交 `68e1b07e1`;#18535 已落地,这三行描述的 lint
与启动行为已成真,三行本身一字未改),并按维护者裁定把 `scripts/check-skills-token-ratchet.mjs` 里
`security.md` 的 token 上限行从 2480 抬到
2543,上限行旁按该文件自己的抬限格式逐字引用裁定「security.md 允许增加到 2543」;合并后实测恰为
2543(`ceil(utf8 bytes / 4)`),余量 0,其它上限行不动。

**为什么改**:#17189 裁定 (i) 之后,「默认权限集携带本应用自己的门牌令牌」这一组合从被拒变为合法(前提是先声明),而已发布的
skills 里没有任何一处写到这三个键;AI 作者照 schema 直接写 `systemPermissions` 就会写出 hotclm
踩过的那种形状。已接受的评估(5616225081)裁定只加这一条、不加反例、`+3` 行。

**风险与代价(含回滚)**:① 时序——#17811 只落了协议这一半(spec 谓词 + ADR 修订),启动侧与 lint
侧尚未把声明清单传给谓词,今天照这条要点写出的默认集仍会被 lint 报错、启动只警告不绑定;所以本 PR ⛔ 不应先于那一半落地(正文顶部已标
Blocked-by)。② 已发布 skills 的 token 棘轮:`security.md` 上限 2480、余量 0,本次 +63 使
`check-skills-token-ratchet`
变红;上限行(`scripts/check-skills-token-ratchet.mjs:424`)按门禁自述只有维护者裁定可抬,本 PR
未抬。回滚 = revert 这一个提交(单文件 +3 行,无发布物)。

2026-09-17 更新:① 已解除——#18535 落地,启动侧与 lint 侧都已把声明清单传给谓词;② 已解除——维护者裁定抬到
2543,本 PR 抬行,`check-skills-token-ratchet` 在新 head 上为绿。回滚 = revert
两个非合并提交(`4ea43892` 三行 + `dfe355143` 上限行),仍无发布物。

**席位意见**:

**你要做的**:① 确认 #17189 第 ② 步(`plugin-security` 启动拒绝 + `packages/lint`
规则传入声明清单)是否已有卡;没有则立卡,并让本 PR 排在它之后合并。② 决定 token 上限:把 `security.md` 那一行抬到
2543(在本 PR 正文引用你的裁定),或指示在同一文件删等量内容(这会动已接受评估钉死的其他行)。③ 之后由 skills
席四件套复核,你点合并。

2026-09-17 更新:① ② 已完成(#18535 落地;上限已按你的裁定抬到 2543 并在正文与上限行旁引用),只剩 ③。

## Patch round — merge main + ceiling raise (2026-09-17)

Both park conditions discharged (park note 5704585750, update
5710537792, unpark 5711767613). The `Blocked-by:` paragraph at the top
of this body is historical: #18535 landed on `origin/main` as
`21b7c12b4` (PR #18602). Same branch, commits added on top — no rebase,
no force-push, no new PR.

**Merge**: `68e1b07e1` = `git merge --no-ff origin/main` (`21b7c12b4`)
into the branch. Clean (`git merge-tree --write-tree` exit 0; 37 commits
behind at merge time); no `os-regen-pending` recorded (the branch
touches no generated artifact). Three-dot delta vs `origin/main` after
the round: `skills/objectstack-data/rules/security.md` +3/−0
(byte-identical to `4ea43892`), `scripts/check-skills-token-ratchet.mjs`
+10/−1.

**Re-count** (the ratchet's convention, `ceil(utf8 bytes / 4)`):
`security.md` on `origin/main` `21b7c12b4` = 9913 bytes → 2479 tokens
(main did not touch the file since the branch forked); branch head
before the round `4ea43892` = 10170 bytes → 2543; after the merge
(`68e1b07e1`, and the head `dfe355143`) = 10170 bytes → **2543**. Not
more than 2543, so the raise is exactly the ruling. Line readings
unchanged: file 211 → 214 (+3), widest line 93, package (20 files) 8959
→ 8962.

**Ratchet row** (`CEILINGS` in
`scripts/check-skills-token-ratchet.mjs`):
- before: `['skills/objectstack-data/rules/security.md', 2480],` (line
424 on `21b7c12b4`)
- after: `['skills/objectstack-data/rules/security.md', 2543],` (line
433 on `dfe355143`), with the raise recorded beside the row in the
file's own raise-ritual form (before → after, the surface it authorizes,
the arithmetic +63 / headroom 0 / ceiling +63, the ruling verbatim with
its record id). No other row moves; the ceiling equals the measurement.

**Maintainer ruling**, verbatim and untranslated (maintainer,
2026-09-17, recorded on #17359 as comment 5710537499):

> 「security.md 允许增加到 2543」

That is the authorization the ratchet's own rule requires: 「the other
direction lands only in a PR whose body quotes a maintainer ruling
authorizing it」.

**Re-read of the three lines against the landed code** (`origin/main`
`21b7c12b4`):

| clause | verdict | evidence |
|:--|:--|:--|
| `isDefault: true` = the `everyone` baseline (ADR-0090 D5) | still true
| `packages/spec/src/security/permission.zod.ts:682`
`.describe('[ADR-0090 D5] App baseline for the everyone position …')`;
ADR-0090 D5 at
`docs/adr/0090-permission-model-v2-concept-convergence.md:46` |
| it may carry app capabilities declared under `capabilities:`
(`defineCapability`) and granted via `systemPermissions` | now true at
boot and in lint (protocol-only before #18535) |
`packages/plugins/plugin-security/src/declared-capability-context.ts`
(`readDeclaredCapabilityContext` reads the stack's `capabilities:`
declarations, registry first, metadata service as fallback); boot bind
`security-plugin.ts:3592–3595` `describeHighPrivilegeBits(boot,
anchorContext)`; engine write gate `:5503–5508`; confirm path
`suggested-audience-bindings.ts:968–972`; lint
`packages/lint/src/validate-security-posture.ts:439–443` builds
`anchorContext` from `stack.capabilities`, `:795` passes it to
`describeAnchorForbiddenBits` |
| lint and boot refuse a platform capability or undeclared name there |
still true | `packages/spec/src/security/high-privilege.ts:70–74` the
platform floor (`PLATFORM_CAPABILITY_NAMES` is never excused), `:134`
「Omission refuses」 — a token absent from `declaredCapabilities` stays
offending; lint emits `security-anchor-high-privilege` at severity
`error` (`validate-security-posture.ts:795–808`); boot logs `[security]
refusing to bind fallback set to everyone — high-privilege bits` and
skips the binding (`security-plugin.ts:3595–3600`) |

No clause corrected; the three lines are unchanged.

**Ablation of the row** (from the committed head `dfe355143`;
trap-restored, absolute paths; no `dist/` involved — the gate reads its
own source): with the row reverted to 2480 on disk (grep counts:
2480-row 1, 2543-row 0) the gate exits 1 — 「✗
check-skills-token-ratchet: skills/objectstack-data/rules/security.md is
2543 tokens; the ratchet ceiling is 2480 (over by 63). … ⛔
MAINTAINER-ONLY」; restored with `git checkout HEAD -- …`: `git
hash-object` = HEAD blob `5b984866`, `git diff HEAD` empty, `git status
--porcelain` empty, gate exits 0 again with 「is 2543 tokens (ceiling
2543; headroom 0)」.

**Gates** (worktree at `dfe355143`; `node scripts/pm/dispatch-gates.mjs
--commands --repo objectstack-ai/objectstack`, change set derived from
the merge base `21b7c12b4`, 2 paths): 40 commands derived, all 40 run
with redirect-then-`$?` capture; `--ran` reconcile: 「40 derived, 40 run,
0 NOT-MEASURED, 0 UNRUN」, exit 0. `pnpm --filter @objectstack/lint run
check:doc-formula-expressions` measured after building
`@objectstack/lint...` under `scripts/pm/os-verify-lock.sh` (「VERDICT
command-exit 0 · held the lock 136s · waited 0s」). `pnpm
check:pm-dispatch-gates` took 626 s under contention. The list,
byte-for-byte as derived, with exit codes:

```text
node scripts/check-ci-filter-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0
node scripts/check-comment-mask-corpus.mjs :: exit 0
node scripts/check-declaration-mirrors.mjs :: exit 0
node scripts/check-declaration-mirrors.mjs --self-test :: exit 0
node scripts/check-doc-route-spelling.mjs --advisory :: exit 0
node scripts/check-doc-route-spelling.mjs --self-test :: exit 0
node scripts/check-scripts-symbol-anchors.mjs :: exit 0
node scripts/check-scripts-symbol-anchors.mjs --self-test :: exit 0
node scripts/check-self-test-wired.mjs :: exit 0
node scripts/check-self-test-wired.mjs --self-test :: exit 0
node scripts/check-self-test-workflow-commands.mjs :: exit 0
node scripts/check-self-test-workflow-commands.mjs --self-test :: exit 0
node scripts/check-skills-token-ratchet.mjs :: exit 0
node scripts/check-skills-token-ratchet.mjs --self-test :: exit 0
node scripts/check-whole-set-label-write.mjs :: exit 0
node scripts/check-whole-set-label-write.mjs --self-test :: exit 0
node scripts/pm/bare-root-worklist.mjs --self-test :: exit 0
pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0
pnpm check:agent-test-spelling :: exit 0
pnpm check:bash32-floor :: exit 0
pnpm check:cli-command-ids :: exit 0
pnpm check:corpus-claim-drift :: exit 0
pnpm check:cross-package-test-inputs :: exit 0
pnpm check:doc-authoring :: exit 0
pnpm check:driver-memory-census :: exit 0
pnpm check:entry-guard :: exit 0
pnpm check:nul-bytes :: exit 0
pnpm check:parse-guard :: exit 0
pnpm check:pm-dispatch-gates :: exit 0
pnpm check:pm-governed-merges :: exit 0
pnpm check:pnpm-filter-targets :: exit 0
pnpm check:ratchet-remedy-authority :: exit 0
pnpm check:refd-timer-probe :: exit 0
pnpm check:role-word :: exit 0
pnpm check:skill-compatibility :: exit 0
pnpm check:skill-frame-sync :: exit 0
pnpm check:skill-identifier-liveness :: exit 0
pnpm check:watch-hint-literal :: exit 0
```

Named verdict lines: `check-skills-token-ratchet` 「✓ … security.md is
2543 tokens (ceiling 2543; headroom 0)」 and 「34 authored bundle file(s)
within their ceilings; 10 generator-owned file(s) measured, not
ratcheted」; its `--self-test` 「65 cases pass」;
`check-ratchet-remedy-authority` 「255 scripts swept … 15 mark the
expanding remedy ⛔ MAINTAINER-ONLY」 (unchanged);
`check-skill-frame-sync` self-test 14 cases + the frame coherent. Not
owed locally: the 51 artifact-roster, 11 wide-population and 14
pending-changeset families, the path-scheduled CI job and the
always-runs tail (CI's own); no ① dependency-closure build or ② package
test is owed — the diff touches no package.

**Governed**: `node scripts/pm/check-governed-merges.mjs --test
skills/objectstack-data/rules/security.md
scripts/check-skills-token-ratchet.mjs` → exit 3, 「GOVERNED — a human
merge is the review record for this PR」 (1 of 2 paths hit the register;
`skills/**` is the rules layer). Still draft; not for any seat to land.

**Changeset**: still `skip-changeset` —
`scripts/check-skills-token-ratchet.mjs` is a repo-root gate script
(private root package; no `files[]` ships it), and the `skills/**`
measurement above stands. Label set read back after the round:
`documentation`, `size/s`, `skip-changeset` (no label written this
round).

**Control characters**: `grep -naP` over both touched files → no match
(exit 1).

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Gqi43smmqjJ5sUrhfoPeKu)_

---
_Generated by [Claude Code](https://claude.ai/code)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-justin

scripts/check-skills-token-ratchet.mjs

@@ -421,7 +421,16 @@ export const CEILINGS = new Map([
   // NEW FILE (#14296 item 1 = A, condition (b)): the entry's Security & Access
   // Control block moved here whole. Pinned at its landed count — no headroom,
   // because a split that arrives with budget is a raise wearing a new path.
-  ['skills/objectstack-data/rules/security.md', 2480],
+  // 2480 -> 2543 (#17359, PR #18531): one three-line bullet after the RBAC
+  // section's `Source:` line — `isDefault: true` is the `everyone` baseline
+  // (ADR-0090 D5); it may carry app capabilities declared under `capabilities:`
+  // and granted via `systemPermissions`; lint and boot refuse a platform
+  // capability or an undeclared name there. The DECLARE/GRANT pair was taught
+  // nowhere in the bundle, so an author writing `systemPermissions` from the
+  // schema alone writes the refused shape. +63 tokens, zero headroom to absorb
+  // any of it, ceiling +63. Maintainer ruling 2026-09-17 (recorded on #17359 as
+  // comment 5710537499), verbatim and untranslated: 「security.md 允许增加到 2543」.
+  ['skills/objectstack-data/rules/security.md', 2543],
   // 3024 -> 3109 (2026-08-31 app-repo-principles raise, see the block above).
   // Severity Levels listed the three values and left the CHOICE unstated: a
   // block rests on a judgement a person made, so a machine-inferred signal — a

skills/objectstack-data/rules/security.md

@@ -32,6 +32,9 @@ export const salesUser = definePermissionSet({
   `allowTransfer` (ownership change), `viewAllRecords` / `modifyAllRecords`
   (super-user, bypass sharing).
 - Source: `node_modules/@objectstack/spec/src/security/permission.zod.ts`
+- **`isDefault: true` = the `everyone` baseline (ADR-0090 D5).** It may carry app
+  capabilities declared under `capabilities:` (`defineCapability`) and granted via
+  `systemPermissions`; lint and boot refuse a platform capability or undeclared name there.
 - Combine with `enable.apiMethods` to also restrict the HTTP surface.
 
 ## Assigning a permission set to a user