test kits: since 17.7.0 refuses unregistered object names, every reduced kernel without plugin-auth fails on sys_user, and plugin-security's own authz store fails on sys_member — each app re-implements identity-object registration; publish a preset #22074

Activity

1. objectstack-fleet commented on Oct 7, 2026

   

   objectstack-fleetbot

   on Oct 7, 2026

   ContributorAuthor

   More actions

   Path: the road — verify: an app's own test suite boots a reduced kernel | 缺项 | P2

   Triage: first grade, bug · priority:p2 · domain:services · area:devpath · pm:queue. Direction: plugin-security names its identity-object dependency at boot, and plugin-auth exports the identity-object registration it composes itself

   Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-07T12:58Z. ⛔ Not a claim, ⛔ not a dispatch.

   Triage: lands in packages/plugins/plugin-security (its boot, where the authz store's reads are known) and packages/plugins/plugin-auth (the identity objects' registration) ⇒ domain:services; rationale: the lane table puts both plugins there.

   • Why p2: every app test suite built on the reduced-kernel pattern fails on its 17.7.0 upgrade. This is measured on hotcrm: nine files, green on 17.6.0. Each app then hand-copies plugin-auth's internal manifest id and object list, which will drift.
   • Direction (ruled here):
     1. plugin-security declares what its authz store reads. A kernel with plugin-security but without the identity objects fails at boot, with an error naming the missing objects and the plugin that registers them. Today it fails at request time with AuthzStoreUnavailableError, which reads as an outage. The objects are plugin-auth's, so plugin-security declares them; ⛔ it does not register them.
     2. plugin-auth exports the identity-object registration as a plugin that plugin-auth composes itself. A reduced kernel mounts that one plugin, not a copy, so the list cannot drift.
   • Pins:
     • a kernel of ObjectQL plus AppPlugin plus the new identity plugin inserts a sys_user fixture;
     • adding SecurityPlugin resolves permissions;
     • SecurityPlugin without the identity objects fails at boot, with the named error;
     • a full kernel is unchanged (control).
   • Clause-②: yes (a new export on plugin-auth). A contract review is owed at the PR.
   • Measure first: whether @objectstack/verify's in-process handle already mounts the identity objects. If it does, the PR documents that path as the sanctioned kit, and the export still lands for kits that do not use it.
2. objectstack-fleet

   added

   area:devpathThe road — create, dev, verify, publish/install, connect an agent, iterateThe road — create, dev, verify, publish/install, connect an agent, iterate

   bugSomething isn't workingSomething isn't working

   domain:services

   pm:queue

   priority:p2Medium: important, M3Medium: important, M3

   pm:dispatched

   and removed

   pm:queue

   on Oct 7, 2026
3. objectstack-fleet

   assigned

   os-bill

   on Oct 8, 2026
4. objectstack-fleet commented on Oct 8, 2026

   

   objectstack-fleetbot

   on Oct 8, 2026

   Last edited by objectstack-fleet

   ContributorAuthor

   More actions

   Claim: PM loop round 1 · 2026-10-08T02:24Z
   Session: session_01WkL6Eijt432S1Y7ekb6ovQ
   Account: os-bill (the seat's linked user as GET /user answers it; the card's assignee)
   Branch: claude/issue-22074-identity-objects-preset
   Worktree: objectstack-issue-22074
   Domain: domain:services
   Seat: domain:services#1 (seat post #6021)
   File surface (at origin/main 033e5c53), per triage's direction 6038422460:

   • Measure first, read only: whether @objectstack/verify's in-process handle already mounts the identity objects.
   • packages/plugins/plugin-auth/src/: one new module exporting the identity-object registration as a plugin, built from manifest.ts's authIdentityObjects list so the list has one source; its export from index.ts; and auth-plugin.ts's manifest registration (near :645, region only), which composes the same list.
   • packages/plugins/plugin-security/src/security-plugin.ts: a boot-time declaration of the identity objects its authz store reads, so a kernel without them fails at boot with an error naming the missing objects and the plugin that registers them. Region: the plugin's dependency declaration (near :1081) or its init/start. ⛔ Not the manifest registration region (near :1448, :1622) or :4812. plugin-security declares the objects and ⛔ does not register them.
   • Tests in both packages (the card's four pins: the reduced kernel with the new plugin inserts a sys_user; adding SecurityPlugin resolves permissions; SecurityPlugin without the identity objects fails at boot with the named error; a full kernel is unchanged), and changesets for both packages.
     ⛔ No packages/spec, no packages/platform-objects, no packages/verify edit. Stop on breach; explain in the report.
     Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate; default-tier build)
     Clause-②: yes (narrowing)
   • Widening: a new published export on @objectstack/plugin-auth. Narrowing: a kernel that mounts SecurityPlugin without the identity objects, which boots today and fails only at its first permission read, is refused at boot. Both are read; an at-tier contract review is owed at the PR. (Corrected in place before the dev was dispatched; the first spelling named only the widening.)
     Responsibility: this repository's own code: plugin-security's authz store reads sys_member, which only plugin-auth registers, and no published plugin registers the identity objects on their own | none: createPlatformObjectsPlugin does not register them (measured on the card) | every app or plugin test suite that boots a reduced kernel without plugin-auth; measured on hotcrm's nine files at 17.7.0
     Thread-read: 6038422460
     Serial constraints cleared (hunk regions read from each branch against origin/main):
   • auth-plugin.ts: PR feat(plugin-email,plugin-auth)!: close the sys_email_template organization door; retire the provenance stamp and the auth SMS seed (ADR-0131 C4, stage 1) #22087 (refactor(plugin-email): templates resolve the registry; the seed and the provenance stamp retire; organization-level editing is closed (ADR-0131 D6/D10) #15205, domain:services seat 2) edits near :959; feat(objectql,plugin-auth): the Default Organization is load-bearing under single; an unstamped write is derived there and refused everywhere else (ADR-0131 D3/D9/D11) #15195's branch (domain:engine seat 1, no PR) edits near :43, :192, :366, :730, :1180. This claim's region is near :645.
   • security-plugin.ts: feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196's stage branches (seat 2) edit near :39, :96, :169, :1622 (S2) and :4812 (S4b). This claim stays out of those regions.
   • PR feat(spec)!: refuse bare unique: true on a declared index at protocol 18 — stated scope, zero-drift conversion (ADR-0120 D2/D5a/D7) #22103 (ADR-0120 协议 18 项:D2 conversion(声明索引 unique: true → 'global')+ 裸 true 硬拒 + synonym pin 退役 —— 挂 18 列车,现在勿动工 #5082) edits plugin-auth's account-identity-preflight.ts, which this claim does not touch.
   • The regions are disjoint; whichever lands later merges main.
5. objectstack-fleet commented on Oct 8, 2026

   

   objectstack-fleetbot

   on Oct 8, 2026

   ContributorAuthor

   More actions

   os-dev-report
   {
   "issue": 22074,
   "status": "done",
   "branch": "claude/issue-22074-identity-objects-preset",
   "pr": "#22173",
   "session": "session_01WkL6Eijt432S1Y7ekb6ovQ — subagent of the dispatching PM; the container reads CLAUDE_CODE_REMOTE_SESSION_ID=cse_01WkL6Eijt432S1Y7ekb6ovQ",
   "premise_still_valid": true,
   "summary": "plugin-auth now exports createIdentityObjectsPlugin() (IdentityObjectsPlugin, IdentityObjectsPluginOptions, IDENTITY_OBJECTS_PLUGIN_NAME), which registers authIdentityManifest() (manifest.ts:147: header + authIdentityObjects + authObjectExtensions) under AUTH_PLUGIN_ID; AuthPlugin spreads the same builder into its one registration (auth-plugin.ts:656), so one list, registered once on a full kernel. SecurityPlugin declares sys_user + sys_member (security-plugin.ts:1088) and, from a kernel:ready handler subscribed at the head of start() (:1654), throws AuthzIdentityObjectsMissingError naming the missing objects, @objectstack/plugin-auth, AuthPlugin and createIdentityObjectsPlugin(); it registers neither object. Measure-first: @objectstack/verify bootStack mounts AuthPlugin unconditionally (harness.ts ~:569), so it already provides the objects; documented in the module header and PR as the sanctioned app-suite kit, export still lands. Hypotheses: H1 confirmed and pinned; H2 measured: the authz store (core resolveUserAuthzGrants, resolve-authz-context.ts:757/:794/:796) reads sys_user and sys_member from plugin-auth, not sys_member alone; H3: no kernel mechanism names objects, the kernel-documented kernel:ready boot gate is used, kept in plugin-security, armed in start() not init() because os migrate composes host plugins for init() only and still fires kernel:ready (schema-migrate.host-composition.integration.test.ts stays green); H4: 3 harnesses outside the two packages went red and now mount the preset (6 cross-lane files incl. service-automation package.json, vitest alias, pnpm-lock.yaml), 3 plugin-security doubles fixed in-package; H5: manifest id com.objectstack.plugin-auth (ADR-0029 D3 one owner per object), kernel name com.objectstack.auth.identity-objects, provenance @objectstack/plugin-auth. IdentityObjectsPlugin also refuses co-mount with AuthPlugin (optionalDependencies orders AuthPlugin ahead).",
   "files_changed": [
   ".changeset/22074-auth-identity-objects-plugin.md (plugin-auth minor, Clause-②: yes (widening))",
   ".changeset/22074-security-identity-objects-boot-refusal.md (plugin-security minor, BREAKING, Clause-②: yes (narrowing), adr-0087 not-required (no-migration-prescription))",
   "packages/plugins/plugin-auth/src/identity-objects-plugin.ts (new)",
   "packages/plugins/plugin-auth/src/identity-objects-plugin.test.ts (new)",
   "packages/plugins/plugin-auth/src/index.ts",
   "packages/plugins/plugin-auth/src/manifest.ts",
   "packages/plugins/plugin-auth/src/auth-plugin.ts (import block :72 and manifest registration :641-656 only)",
   "packages/plugins/plugin-security/src/security-plugin.ts (module scope before the class :1072-1123, start() head :1646-1656)",
   "packages/plugins/plugin-security/src/authz-identity-objects-boot-refusal.test.ts (new)",
   "packages/plugins/plugin-security/src/security-plugin.test.ts, declared-permission-reload-projection.test.ts, claim-seed-ownership-seed-settle-rerun.test.ts (doubles answer sys_user/sys_member)",
   "CROSS-LANE packages/runtime/src/standalone-stack-seeder-declaration-copy.test.ts",
   "CROSS-LANE packages/services/service-automation/src/builtin/write-nodes-stored-metadata-family-refusal.integration.test.ts",
   "CROSS-LANE packages/services/service-automation/src/runas-system-stamping.integration.test.ts",
   "CROSS-LANE packages/services/service-automation/package.json (devDependency @objectstack/plugin-auth)",
   "CROSS-LANE packages/services/service-automation/vitest.config.ts (anchored alias @objectstack/plugin-auth to src)",
   "CROSS-LANE pnpm-lock.yaml (+3)"
   ],
   "tests": "All at HEAD 90bb654 unless noted. New pins: plugin-security authz-identity-objects-boot-refusal.test.ts 3/3 pass (real ObjectKernel+ObjectQLPlugin+SQLite: refused naming both; names only sys_member when sys_user registered; boots when a test package registers both); plugin-auth identity-objects-plugin.test.ts 9/9 pass (pin1 preset+app stand-in inserts sys_user, registered set == authIdentityObjects under AUTH_PLUGIN_ID; control without preset: insert refused {code OBJECT_NOT_FOUND, status 404}; pin2 +SecurityPlugin boots, resolveUserAuthzGrants → positions contain org_admin, accessible_org_ids [org_kit]; pin3 refused, err.name AuthzIdentityObjectsMissingError naming createIdentityObjectsPlugin(); pin4 real AuthPlugin+SecurityPlugin kernel boots, AuthPlugin.init registers one manifest, objects toBe authIdentityObjects, toMatchObject authIdentityManifest(); datasource override; ordering edge; co-mount refusal). Full suites at 1a50789 (only later commit re-spells optionalDependencies as a literal; pin file re-run at 90bb654: 9 passed): pnpm --filter @objectstack/plugin-security exec vitest run --maxWorkers=2 → Test Files 173 passed, Tests 3666 passed | 45 skipped; plugin-auth → 127 passed, 2633 passed | 10 skipped; service-automation → 175 passed, 2120 passed; runtime edited file 13 passed. H4 measurement against the built change (before harness fixes): runtime 7 candidate files → 1 file FAIL; service-automation 2 files → 3 cases FAIL; rest 9 files 120 passed; organizations 1 file pass; plugin-auth sys-user-self-service-route pass; plugin-dev full suite 86 passed; cli 3 files 33 passed (incl. schema-migrate.host-composition); dogfood platform-app-object-entry-views 56 passed; every FAIL was AuthzIdentityObjectsMissingError. Typecheck: pnpm --filter plugin-auth / plugin-security / service-automation / runtime typecheck all exit 0, check:test-typecheck OK with debt unchanged (plugin-auth 10 files/94 errors, runtime 27/190, plugin-security 0, service-automation 0). Gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 80 commands at 90bb654; all 80 exit 0; --ran with exit codes: Run reconciliation — 80 derived, 80 run, 0 NOT-MEASURED, 0 UNRUN. Added as implicated: check:startup-registry-verdict (45 seams, none recording a verdict) exit 0, check:init-service-contract exit 0 (it first caught optionalDependencies spelled via a constant; fixed in 90bb654), check:durability-log-level exit 0. Verdict lines: check-adr-0087-registration 1 declared-breaking changeset with disposition; check-changeset-no-major no major; check:test-source-alias OK; check:nul-bytes OK; check:engine-double-contract OK 980 pinned; check:dual-build-cjs-loads 106 entry points load; check:i18n 9 packages in sync; check:published-files OK; check:dts-closure 169/169. First battery had 3 PREREQUISITE NOT MET (exit 3: teardown self-test control commit absent in shallow clone, dual-build and i18n missing dist) — cleared by git fetch of 621a487 and the gate-named turbo build, then exit 0. No check:api-surface family is derived for plugin packages (spec-only gate). ESLint narrowed: node node_modules/eslint/bin/eslint.js --no-inline-config --format json over the 14 changed .ts files → 14 files linted, 0 errors, 0 warnings; population from eslint.config.mjs files globs (:971, :1103); invariance: the config enables no type-aware linting (no parserOptions.project), so untouched files cannot move. ABLATION (boot-refusal pin), run on committed HEAD dbcaa27 (security-plugin.ts blob b90b3e0f, unchanged through 90bb654): node scripts/ablation-replace.mjs replaced the kernel:ready subscription line (anchor x1→x0, marker ABLATION-22074 x0→x1, blob b90b3e0f→e8696819, on-disk grep 1/0); subjects resolve plugin-security from src (relative import; plugin-auth vitest alias), so no build leg. Direction red as expected: boot-refusal file 2 failed | 1 passed (boots-when-registered stays green), plugin-auth pin3 1 failed | 8 passed; scratch probe in the ablated state: boot passes, resolveUserAuthzGrants → {name AuthzStoreUnavailableError, code SERVICE_UNAVAILABLE, status 503, object sys_member}; scratch file deleted. Restore: blob after restore b90b3e0f == HEAD, git diff HEAD empty.",
   "mcp_calls": "0",
   "api_writes": "3 — each through the fleet-write relay (one POST /repos/objectstack-ai/objectstack/dispatches per write, executed as objectstack-fleet[bot]): pr_create POST /repos/objectstack-ai/objectstack/pulls → #22173 draft (relay run 37725031595, body read back identical, 11773 bytes); label-write --assign os-bill POST /repos//issues/22173/assignees (relay run 37725087702, read-back MATCHES, labels untouched); this os-dev-report POST /repos//issues/22074/comments. git push is a git op (8 commits + the empty-branch probe).",
   "deviations": [
   "Pin 1 names AppPlugin; AppPlugin lives in @objectstack/runtime, which depends on plugin-auth and plugin-security, so neither package can import it without a workspace cycle. The pin uses an app plugin that registers its manifest through the manifest service in init(), which is what AppPlugin.init() does.",
   "The boot gate is armed in start(), not init(): an init() subscription would refuse os migrate, whose declarations-only boot fires kernel:ready with start() suppressed. Both regions are in the fence; the start() hunk sits at origin/main :1590-1593, 29 lines above seat 2 S2 near :1622.",
   "auth-plugin.ts: besides the :645 registration region, its import block from ./manifest.js (:72-76) changed to import authIdentityManifest, which composing the builder requires. No other region touched.",
   "Cross-lane: 6 files outside the two packages (3 test harnesses, service-automation package.json + vitest.config.ts, pnpm-lock.yaml), under the 10-file stop line; the alias is required because check:test-source-alias refuses a new unaliased artifact import.",
   "plugin-security changeset: the gate refused no-migration-prescription beside a FROM-TO table, so the remedy is prose; nothing authorable is renamed or removed and no spec ledger edit is allowed on this card.",
   "Branch not merged with origin/main: 4 commits landed after BASE 033e5c5 (#22103, #22129, #22094, #22134), none touching a file in this diff; dispatch-gates printed STALE TREE for 5 adr-anchor files of lint/spec families outside this diff. CI merge ref carries the joint check.",
   "Commit trailers are the model-free pair AGENTS.md requires (pre-push hook), not the harness reminder line with a model name."
   ],
   "open_questions": [],
   "out_of_scope_findings": [
   "carrier: none · noted, not filed — DevPlugin with services.auth:false (or plugin-auth absent) and security on is now refused at boot (code reading at 90bb654: DevPlugin.start() hands the real ctx to SecurityPlugin.start(), dev-plugin.ts:1032; not run). DevPlugin could compose createIdentityObjectsPlugin() in that branch; a plugin-dev change. Also in the changeset and PR body for the contract review.",
   "carrier: none · noted, not filed — a kit loading createIdentityObjectsPlugin() goes through plugin-auth root entry, which evaluates better-auth; a light subpath entry needs package.json exports + tsup entry edits outside this fence.",
   "carrier: PM seat (dispatch-gates owner) · noted, not filed — for a diff that edits plugin init()/start() and declarations, the derivation listed neither check:init-service-contract nor check:startup-registry-verdict; run by hand, init-service-contract went red on a real declaration (optionalDependencies via a constant identifier) before the literal fix."
   ]
   }

   ---

   Generated by Claude Code
6. objectstack-fleet commented on Oct 8, 2026

   

   objectstack-fleetbot

   on Oct 8, 2026

   ContributorAuthor

   More actions

   Seat ACCEPT: PR #22173 at 90bb6549 · seat domain:services#1 (#6021) · session_01WkL6Eijt432S1Y7ekb6ovQ · 2026-10-08T04:16Z

   Checked against GitHub and the branch, not the report's prose (os-dev-report on this card).

   • Form: draft, base main, first line Fixes #22074, line-start Clause-②: yes (narrowing), the claim's corrected line (6050889097). The PR assignee is os-bill.
   • Contract review: the at-tier record on the PR (6052075615, Served-tier: CONTRACT_REVIEW_TIER, head 90bb6549, Local-runs: none) is a PASS. The seat adopts it. It names each new public export, the one-list/one-owner registration under com.objectstack.plugin-auth, the boot gate's moment (kernel:ready, from start(), so os migrate still boots) and every non-test composition of SecurityPlugin (os serve pairs it with AuthPlugin; @objectstack/verify's bootStack mounts AuthPlugin). It also confirms both changesets' semver and arms.
   • Seat reading of the diff: the refusal names the missing objects and both remedies; the gate is subscribed through the file's existing kernel:ready idiom; plugin-security registers neither object and gains no plugin-auth dependency.
   • File surface: the claim's regions, plus six files the claim allowed (three harnesses that boot SecurityPlugin without AuthPlugin, service-automation's devDependency and alias, 3 lockfile lines of one workspace link). The one packages/runtime file is declared on the domain:cli seat post [PM seat] domain:cli — 🟢 marchtian · session_01B5CHJNXuuqzChM4w6hkTN4 #6024. service-automation is this lane's.
   • Not governed (no .claude/**, skills/**, docs/adr/** or root rule file); 690 changed lines.
   • Flags carried, none blocking:
     • DevPlugin with services: { auth: false } and security on is newly refused at boot. This is within the ruling and comes from a code reading, not a run. Its carrier is the domain:cli seat, told on [PM seat] domain:cli — 🟢 marchtian · session_01B5CHJNXuuqzChM4w6hkTN4 #6024 at declaration: having DevPlugin compose the preset in that branch is a plugin-dev change. No card is filed (no measured reach).
     • A light subpath entry for the preset, and AuthzIdentityObjectsMissingError not being re-exported: follow-ups only if a consumer needs them. Noted, not filed.
     • dispatch-gates did not derive check:init-service-contract / check:startup-registry-verdict for an init()/start() edit, and one of them caught a real defect when run by hand. CI's Lint & Repo Gates runs every check:* family, so the gap costs at most one CI round. It goes to the round report for the gate's owner. Not filed.

   CI at the review's reading: every completed check green except Validate Package Dependencies, the base's OSV red (#22148). PR #22138 has since landed, so the seat merges main into this branch next. The PASS carries across a merge only if the PR's net diff against the new main is the reviewed one, which the seat checks before pushing. Ready and auto-merge follow once every check on the new head is green.
7. objectstack-fleet

   closed this as completedin #22173on Oct 8, 2026
8. objectstack-fleet commented on Oct 8, 2026

   

   objectstack-fleetbot

   on Oct 8, 2026

   ContributorAuthor

   More actions

   Landed · domain:services seat 1 (#6021) · session_01WkL6Eijt432S1Y7ekb6ovQ · 2026-10-08T05:35Z.

   PR #22173 merged through the merge queue as c6fe02d7. On origin/main:

   • createIdentityObjectsPlugin() is in plugin-auth's identity-objects-plugin.ts.
   • SecurityPlugin's kernel:ready refusal (AuthzIdentityObjectsMissingError) is in plugin-security's security-plugin.ts.

   The PR's Fixes line closed the card completed. This note also removes pm:dispatched and the assignee.

   • Carried to the domain:cli seat: a DevPlugin stack with services: { auth: false } and security on is now refused at boot. This comes from reading the code; it has not been run. The seat told [PM seat] domain:cli — 🟢 marchtian · session_01B5CHJNXuuqzChM4w6hkTN4 #6024 about it before landing (6051955802), and no objection came back. Having DevPlugin compose the preset is a plugin-dev change, so it belongs to that seat. No card is filed.
   • Noted, not filed: a light subpath entry for the preset, and re-exporting AuthzIdentityObjectsMissingError. Each waits for a consumer that needs it. The dispatch-gates derivation gap goes to the round report, per the seat's ACCEPT (6052092672).
9. objectstack-fleet

   removed

   pm:dispatched

   on Oct 8, 2026
10. objectstack-fleet

    unassigned

    os-bill

    on Oct 8, 2026
11. akarma-synetal

    added a commit that references this issue on Oct 9, 2026

    feat(plugin-auth, plugin-security): createIdentityObjectsPlugin() pre…

    ...

    This issue will close once commit c6fe02d is merged into the 'main' branch.

    c6fe02d