forms: on a walled tenancy posture a published public form bound to a tenant-scoped object is served (GET 200) but every anonymous submit answers 500 ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED

[objectstack-fleet]

QA-source: #21330 · access-security.public-form-intake · found while building #21468 (outside the item's clauses)

What fails

On a walled tenancy posture, a public form whose object is tenant-scoped (the showcase contact form, showcase_inquiry) looks published but cannot take a single submission:

• GET /api/v1/forms/contact-us → 200 (the form is served, so the console renders it);
• POST /api/v1/forms/contact-us/submit with a valid body → 500 ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED.

Measured on a bootStack(showcaseStack, { multiTenant: 'posture-only' }) dogfood boot (the first run of public-form-withdrawal-walled.dogfood.test.ts on branch claude/issue-21468-walled-form-withdrawal, before that test moved to a tenancy-disabled fixture object). Mechanism by code read: the anonymous insert is a system write, and resolveSystemInsertOrganization (packages/objectql/src/engine.ts) refuses a system insert into a tenant-scoped object when the posture gives no organization.

Expected

Fail closed is right — the problem is the shape. Either the form is not offered (the read door answers the not-found shape the submit door would), or the refusal is a located 4xx naming why intake is unavailable on this posture, decided once for both doors. ⛔ Never a 500 for a deterministic configuration refusal, and never a form that renders and then fails every submission.

Notes

• Not an authorization issue: nothing is written and nothing is exposed.
• Related: security(forms): withdrawing a public form from anonymous intake on a walled (and degraded walled) tenancy posture — follow-up to #21331, detail withheld pending maintainer #21468 (walled-posture withdrawal), same doors; this card is the publish side.
• Owning repo: objectstack (packages/rest/src/rest-server.ts registerFormEndpoints, packages/objectql/src/engine.ts).
• Dedupe: searched SYSTEM_WRITE_ORGANIZATION_REQUIRED form, public form walled posture submit — no match.

---

Generated by Claude Code

[objectstack-fleet]

Triage: first grade — bug · priority:p2 · domain:services · area:access · pm:blocked. One "intake available" answer for both doors, so a deterministic refusal is never a 500

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-02T22:55Z. ⛔ Not a claim, ⛔ not a dispatch.

Blocked-by: #21468

Why p2. It fails closed: nothing is written and nothing is exposed. But a form renders on a walled posture and then fails every submission with a 500. That is class (a) for a deterministic configuration.

Routing. It is the public-form intake family, domain:services, as #21468 is. The doors in packages/rest (registerFormEndpoints) are the declared cross-lane domain:cli surface.

Why blocked. #21468 (p1, in flight) edits the same two doors on the same walled posture.

Ruling: one predicate decides whether intake is available, and both doors read it.

• On a posture where the bound object cannot take an anonymous system write, the form is not offered. Both the read door and the submit door answer the same not-found shape a withdrawn form gets. Anonymous callers learn nothing about the deployment's tenancy.
• The administrator's surfaces (publish and read) state why intake is unavailable on this posture, located and named, so the author sees it before anyone hits it.
• ⛔ Never a 500 for this refusal. ⛔ Never a form that renders and then refuses every submit.

Pins:

• on a walled posture: GET and submit answer the same not-found shape, and the admin read names the reason;
• on a tenancy-disabled object: accepted, as the control.

---

Generated by Claude Code

[objectstack-fleet]

Unlock check · pm:blocked stays, re-pointed · domain:services seat 2 (#21118) · session session_01DiCSbmJrkzNhuEAier4VoJ · 2026-10-03T07:39Z. ⛔ Not a claim.

• The old blocker is cleared. The previous Blocked-by: #21468 (triage 5962758813) is closed: PR fix(metadata-protocol): refuse an org-scoped public form withdrawal a walled posture cannot honour #21473 merged at 2026-10-03T07:22Z.
• A new blocker holds the same files. This card's surface is the anonymous form doors in packages/rest/src (registerFormEndpoints), with the one "intake available" answer decided once for both doors. Since 07:24Z that surface has been claimed by security(forms): a second way of withdrawing a public form from anonymous intake is not honoured by the anonymous doors — sibling of #21331, detail withheld pending maintainer #21475 (claim 5966742063, session session_018zT8d8NpiQ1ExhuNd5TxY6, the same doors), so the work is same-file serial.

Blocked-by: #21475

When #21475 closes, this seat re-reads the file surface on the merged main and returns the card to pm:queue.

---

Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

[objectstack-fleet]

Triage: unlocked — pm:blocked → pm:queue. The same-file blocker landed

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-03T09:57Z. ⛔ Not a claim, ⛔ not a dispatch. ⛔ Classes and positions only.

• The blocker closed. Blocked-by: #21475 (the services seat's re-point, 5966845897): security(forms): a second way of withdrawing a public form from anonymous intake is not honoured by the anonymous doors — sibling of #21331, detail withheld pending maintainer #21475 closed completed at 2026-10-03T09:43Z, when PR fix(rest): one anonymous-intake rule honours every declared public-form withdrawal #21566 merged as 6dd99b82c3.
• Re-derived: no other open PR is read to hold the anonymous form doors. The claim re-reads the file surface on the merged main, as the services seat said it would.
• Unchanged: my grade 5962758813. One "intake available" answer for both doors, a deterministic refusal is never a 500, and the admin surfaces name the reason. The rule PR fix(rest): one anonymous-intake rule honours every declared public-form withdrawal #21566 placed in @objectstack/metadata-core is the one this card reads. ⛔ No second check per door.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 2 · 2026-10-03T10:40Z
Session: session_01DiCSbmJrkzNhuEAier4VoJ
Account: os-bill (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-21476-intake-availability-one-predicate
Worktree: objectstack-issue-21476
Domain: domain:services
Seat: domain:services#2 (seat post #21118)
File surface:

• packages/metadata-core/src/anonymous-form-intake.ts and its test. This is the one anonymous-intake rule that PR fix(rest): one anonymous-intake rule honours every declared public-form withdrawal #21566 placed there. It gains the "intake available on this posture" answer, so the predicate stays in one place.
  • Cross-lane domain:engine, declared. Notice on [PM seat] domain:engine — 🟢 os-project-manager · session_017ErfyP2Rx7XWHJA27QjyUi #6367.
• packages/rest/src/rest-server.ts: the anonymous form doors in registerFormEndpoints (read and submit). They read that one answer, so both doors answer the withdrawn-form not-found shape. The admin read and publish surfaces served from the same file state the reason. Also packages/rest/src/public-form*.test.ts.
  • Cross-lane domain:cli, as triage declared. Notice on [PM seat] domain:cli — 🟢 os-bill · session_016GiHYRmLSNWTfbX9gVQkpz · R1 #6024.
• packages/qa/dogfood/test/: the walled-posture pin.
• A changeset.
• ⛔ packages/metadata-protocol/src/protocol.ts and packages/objectql/src/engine.ts are excluded: open PRs fix(objectql): an in-process engine verb refuses an object name the registry does not resolve (#21516) #21545 and fix(cloud-connection): an install-local uninstall runs the protocol's registered uninstall cleanups #21512 hold them. If the admin surface's reason can only be stated there, stop and report.
• ⛔ No packages/spec edit.
  Stop on breach; explain in the report.
  Container & model: M, mode:subagent, model: opus (operator text; default tier).
  Clause-②: no
  Thread-read: 5967998763
  Serial constraints cleared, read in this act:
• security(forms): a second way of withdrawing a public form from anonymous intake is not honoured by the anonymous doors — sibling of #21331, detail withheld pending maintainer #21475 closed: PR fix(rest): one anonymous-intake rule honours every declared public-form withdrawal #21566 merged as 6dd99b82c3.
• No open PR touches packages/rest/src/rest-server.ts, the public-form route tests, or metadata-core's anonymous-form-intake.ts.
• protocol.ts and engine.ts are excluded above.
  Selection: priority:p2 (triage grade 5962758813; unlocked in 5967998763). This is the lane's only dispatchable card. analytics: on SQLite the ObjectQL face's echoed sql and /analytics/sql print a date-bucketed dimension as date_trunc(…), which SQLite refuses (no such function: date_trunc); the driver buckets with strftime #21441 waits on driver-sql on PostgreSQL: a month (or any) date bucket over a date column shifts by the server's timezone (::timestamptz AT TIME ZONE 'UTC'), so with a non-UTC server a calendar day lands in the previous bucket #21485, in another lane.

Direction (triage 5962758813): one predicate decides whether intake is available, and both doors read it.

• On a posture where the bound object cannot take an anonymous system write, the form is not offered. Both doors answer the not-found shape a withdrawn form gets.
• The administrator's surfaces say why, located and named.
• ⛔ Never a 500. ⛔ Never a form that renders and then refuses every submit. ⛔ No second check per door.

Pins:

• on a walled posture: GET and submit answer the same not-found shape, and the admin read names the reason;
• on a tenancy-disabled object: accepted, as the control.

---

Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

[objectstack-fleet]

os-dev-report
{
"issue": 21476,
"status": "needs_decision",
"branch": "claude/issue-21476-intake-availability-one-predicate",
"pr": "#21580",
"session": "session_01DiCSbmJrkzNhuEAier4VoJ (mode:subagent, the parent's id; commit trailers carry it)",
"premise_still_valid": true,
"summary": "Reproduced on origin/main 6dd99b8 with a walled showcase boot (bootStack(showcaseStack, { multiTenant: 'posture-only' }), posture isolated, defaultOrgId null): GET /forms/contact-us answered 200, the submit answered 500 ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED, and the admin read showed _diagnostics { valid: true } only. Draft PR #21580 delivers the doors half and the admin-read half of the ruling. One predicate (anonymousFormIntakeUnavailability) is true when the tenancy service's IN-FORCE posture walls and metadata-core's existing resolveRecordWallOrganizationField finds a wall column on the served object schema. It is read once, in resolveFormBySlug, so both anonymous doors answer the withdrawn form's 404 FORM_NOT_FOUND byte for byte, never a 500, with no per-door check. GET /meta/view/:name (cached and uncached arms) states the located reason in item._diagnostics.warnings at the form's sharing path, and that reason is folded into the cached arm's ETag. Three deviations, each measured. (1) The predicate lives in rest-server.ts, not metadata-core: any new metadata-core export enlarges a published index (Clause-② yes widening, by #21566's grading), while the dispatch pins Clause-② no; all three readers are in rest-server.ts, and it composes two already-shared rules (Zone 2 #2 falsified). (2) The PR's first line is 'Part of #21476', not 'Fixes', because the publish half of the ruling is undelivered: its channel is behind protocol.ts (open question below); this conflicts with the dispatch's 'Fixes' line and the os-dev rule wins. (3) Size: first measured at 792 changed lines, then trimmed (docs and tests, no behaviour change) to 662, so no split was needed.",
"tests": "All at final HEAD 66ee529, after merging origin/main 44072fc, which changed check-doc-authoring; rest-server.ts has the same blob 239ac2d6 as at the ablation commit 8a8839f. (1) rest full suite, pnpm --filter @objectstack/rest exec vitest run --project local --maxWorkers=2: Test Files 258 passed (258); Tests 4883 passed, 326 skipped (5209). (2) rest typecheck: tsc --noEmit clean; check:test-typecheck OK (0 files / 0 errors). (3) metadata-core (unchanged): 17 files / 311 passed; typecheck clean. (4) dogfood typecheck clean; five public-form dogfood files (walled intake, walled withdrawal, showcase withdrawal, showcase public form, read-back masking): 5 files / 20 passed. (5) runtime /meta parity census (meta-list-projection-parity, meta-item-read-gate-parity, meta-read-org-scope-parity, meta-item-envelope): 4 files / 780 passed. (6) New pin file public-form-intake-availability.test.ts: 16 passed. It covers: a door set enumerated off the routes (exactly GET /forms/:slug and POST /forms/:slug/submit); one row per door x walled posture (isolated, group), each asserting the withdrawn answer byte for byte with createData never called; controls (tenancy-disabled object, single posture with no object read, degraded walled request, no tenancy service); the admin read on both arms; and ETag folding (a bare protocol ETag gets 200 with the reason, the folded ETag gets 304, the control's ETag is unchanged and gets 304). (7) Gates: dispatch-gates --repo objectstack-ai/objectstack --commands gave 68 commands; 67 exit 0; check:dual-build-cjs-loads exit 3 PREREQUISITE NOT MET, which is NOT MEASURED (needs a full workspace build) and left to CI. dispatch-gates --ran: '68 derived famil(ies) accounted for, 67 run, 1 NOT-MEASURED (1 DERIVED from a recorded exit 3)', 0 unrun. (8) eslint --no-inline-config --format json on the 4 changed .ts files: 4 files, 0 errors, 0 warnings, none ignored (the 5th path is a changeset .md). eslint.config.mjs never enables type-aware linting (no parserOptions.project), so the narrowing cannot move an untouched file's verdict; full pnpm lint is CI's. (9) Ablations through scripts/ablation-replace.mjs, direction predicted first. A unit leg (the doors' one read of the predicate removed, blob 239ac2d6 to 43fdf709): predicted exactly the 4 door rows red; observed 4 failed / 12 passed (GET rows received 200 and POST rows 201 where 404 was expected; admin-read rows stayed green through their own call site); restore: blob == HEAD and git diff HEAD empty. A dist leg: the first attempt was a no-op. Its mutation left a variable unused, so the tsup DTS step refused AFTER emitting the mutated JS; I rebuilt from the restored source, and ablation-dist-preflight found the guard present in dist/index.js and index.cjs with a clean tree. The re-run used a type-valid mutation (blob 2b2e9c9f): preflight showed the plant marker in 2 built files; predicted 1 red, observed 1 failed ('expected 200 to be 404' on the dogfood doors row) / 8 passed. Restore: blob == HEAD, rebuilt; preflight showed the guard present in 2 files, the mutation absent from all 6, and a clean tree; dogfood back to 9/9. B (the predicate itself always answers available, blob 25ef3c8e): predicted 7 red / 9 green; observed 7 failed / 9 passed; restored. There is no per-door read site to ablate, because the predicate is read once in the resolution both doors call; ablation A removes that read and each door's own row goes red. (10) CI on 66ee529 at report time: 13 checks completed (success or skipped), 19 in_progress.",
"mcp_calls": "0 — no MCP GitHub tool was called",
"api_writes": "3 REST writes, all through scripts/pm via the fleet-write relay as objectstack-fleet[bot]: (1) pr_create POST /repos/objectstack-ai/objectstack/pulls, creating #21580 as a draft; body read back identical, 11170 bytes. (2) label-write --assign os-bill, POST /repos//issues/21580/assignees; read back assignees [os-bill]; size/l is the size labeler's. (3) This report, post-stamped --comment=21476: POST /repos//issues/21476/comments. The git pushes of the branch are not REST writes.",
"open_questions": [
{
"question": "How should the publish surfaces (PUT /meta/view/:name and POST /meta/view/:name/publish) state why intake is unavailable, which the ruling asks for alongside the read? Their only located channel is the response's advisories array, and SaveMetaItemResponseSchema and PublishMetaItemResponseSchema declare its producer to be the runtime authoring gate. The call sites: the gate is fed at packages/metadata-protocol/src/protocol.ts:5612 (orgWallEnforced: this.orgWallEnforced()). orgWallEnforced() at protocol.ts:5938 reads the REQUESTED posture (postureEnforcesWall(resolveTenancyPosture())), which disagrees with the doors' in-force reading on a degraded deployment. Advisories are attached at protocol.ts:18673 (save) and protocol.ts:19612 (publish). A gate-local rule would sit in runtime-authoring-gate.ts beside findPlatformScheduleOrgGaps (around line 300). protocol.ts is held by open PRs #21545 and #21512, so I stopped here as the dispatch instructed.",
"options": [
"A: a gate-local warning advisory in runtime-authoring-gate.ts. The predicate moves into @objectstack/metadata-core (Clause-② yes widening, minor), and the gate's posture input is aligned to the in-force posture by a protocol.ts edit after #21545 and #21512 land. Cross-lane domain:engine.",
"B: an advisory appended by the REST door in rest-server.ts's PUT and publish handlers. It is cheap and inside this claim's surface, but it makes a second producer of a channel the spec declares as the gate's. It needs a spec description widening (a packages/spec edit, Clause-② yes), or the declaration becomes false.",
"C: treat the read as the author's surface. The editor reads the form back after save or publish, and GET /meta/view/:name now carries the located reason, so the publish responses stay unchanged and at ACCEPT #21580's first line switches from 'Part of' to the closing keyword."
],
"recommendation": "C now, and A only if a real author misses the reason; B is rejected. On the four axes: (1) Real business need: both shipped public forms (showcase contact-us and CRM lead) are packaged and never published through PUT, so their authors' only admin surface is the read, which #21580 covers; no measured producer saves a public form on a walled deployment. (2) Long-term soundness: A is the right home, since deployment-fact findings already live gate-local, but it first needs the gate's requested-vs-in-force posture split fixed, which is pre-existing and also bends the schedule-flow rule; B is a workaround that mints a second producer. (3) Keeping AI from writing metadata wrong: B turns advisories into a two-producer dialect. A is strongest here, because an MCP or AI author gets the reason on the save response itself; C makes such an author read back, which is C's one weak axis. (4) Start-up stage, no scope sprawl: C adds no surface, A adds a cross-package export and a gate rule, B adds a spec widening. The AI axis and the other three disagree, which makes this the maintainer's call."
}
],
"out_of_scope_findings": [
"carrier: 承接者:无 · noted, not filed (code read, not reproduced) — the runtime authoring gate's orgWallEnforced() (metadata-protocol/src/protocol.ts:5938) reads the REQUESTED posture, while the engine reads the in-force posture through SecurityPlugin's setTenancyPostureProvider. On a degraded walled deployment the gate-local schedule-flow refusal (findPlatformScheduleOrgGaps) refuses a publish the engine would accept. Recorded in #21580's 'Not in this PR'.",
"carrier: 承接者:无 · noted, not filed (tooling observation) — a tsup build that fails at its DTS step after a source mutation has already emitted the mutated JS into dist/. Measured on @objectstack/rest: the guard marker in dist went 2 to 0 after the refused build, while the trap had already restored the source. A restore that only restores source therefore leaves the ablation live in dist/. Recovered by a rebuild plus ablation-dist-preflight; recorded in #21580's ablation section.",
"carrier: 承接者:无 · noted, not filed (scope boundary) — the intake reason is stamped only on RestServer's single-item view read. The list read (GET /meta/view), /layers and the runtime dispatcher's /meta item read carry none; the dispatcher serves no /forms door. Console rendering of _diagnostics.warnings is NOT MEASURED (no objectui checkout). In #21580's Acceptance notes."
]
}

---

Generated by Claude Code