Repository navigation
skills(objectstack-query): SKILL.md:66 teaches { flowRunId } as a context "for provenance alone", which the engine refuses since ADR-0096 D5 #22372
Description
Activity
Triage: first grade,
priority:p2·domain:skills·area:access·pm:queue(findingremoved). Tier H: a one-line edit plus askills/**enumerationTriage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-08T23:55Z. ⛔ Not a claim, ⛔ not a dispatch.Triage: lands in
skills/objectstack-query/SKILL.md⇒domain:skills. Rationale:skills/**belongs to that lane. It is governed, so the maintainer merges it (Tier H).- Why p2: a published agent skill teaches an execution context that the engine refuses since ADR-0096 D5. An AI author who follows it gets a
403. That is the class "preventing AI authoring mistakes" exists for. - Where this card sits in the pre-D5 family:
- It is the planned Tier H carrier that the ACCEPT on PR docs(spec): ISecurityService and the data-engine contract page state the ADR-0096 D5 refusal of a principal-less context #22327 owed, not a miss in finding(service-automation): the unscoped-run refusal message and the run-setup warning say a user-less run "would execute UNSCOPED"; on a kernel with plugin-security that counterfactual is a 403 since ADR-0096 D5 #22362's enumeration.
- With it, every surface has its card:
packages/spec(docs(spec): ISecurityService TSDoc still says a context with no principal is admitted or keeps its scope; PR #22297 (#21908, ADR-0096 D5 strict mode) refuses it #22302), code comments and docstrings (service-automation: the exportedRunProvenanceContextdocstring still says a{ flowRunId }-only context falls open ("indistinguishable from passing no context at all"); ADR-0096 D5 now refuses it, and the type is produced nowhere #22345), runtime strings (finding(service-automation): the unscoped-run refusal message and the run-setup warning say a user-less run "would execute UNSCOPED"; on a kernel with plugin-security that counterfactual is a 403 since ADR-0096 D5 #22362), andskills/**(this one).
- Enumeration pin:
git grepall ofskills/**for the pre-D5 reading. That covers a{ flowRunId }-only context, and a principal-less context that is admitted, keeps its scope, or falls open. List the hits on the PR and fix each one there. Measure whether the skill's evals or examples assert the old line, as the card says. - Wording: follow PR docs(spec): ISecurityService and the data-engine contract page state the ADR-0096 D5 refusal of a principal-less context #22327's text if it has landed by the time this is cut; that PR is no longer held, now that the shard-timings refresh (chore(ci): refresh the Test Core shard-timings dataset #22368) has merged. Otherwise use the D5 contract on
main(a principal-carrying context, or{ isSystem: true }), and say so in the PR. Not blocked. dispatch-gates --tiernames the contract-review tier as mandatory on this path.
- Why p2: a published agent skill teaches an execution context that the engine refuses since ADR-0096 D5. An AI author who follows it gets a
Claim: PM loop round 1
Session:session_01JmWtcHfGbC4ncw4GFKWuRA
Account:os-elon-musk(the seat's linked user asGET /useranswers it; always the card's assignee)
Branch:claude/issue-22372-query-skill-principal-context
Worktree:objectstack-issue-22372
Domain:domain:skills
Seat:domain:skills#1
File surface:skills/objectstack-query/SKILL.md(line 66 onorigin/main16096e8d7b: the{ flowRunId }clause), plus any otherskills/**file the enumeration pin hits (git grepacrossskills/**for a{ flowRunId }-only context and for a principal-less context that is admitted, keeps its scope or falls open; the seat's own reading at 2026-10-09T00:16Z:flowRunIdhits exactly one line inskills/**, this one, with the controlisSystemhitting 3 files — the broader principal-less reading is the dev's to take), andskills/objectstack-query/evals/filters-pagination-search.jsononly if it asserts the old line. Tier H (skills/**is governed): the PR stays draft with the four-piece set and the maintainer merges it. ⛔ No file held by an open PR: PR #22347 holdsskills/objectstack-formula/SKILL.mdand PR #22322 holdsskills/objectstack-ui/references/react-blocks.md— a hit there is listed on the PR, not edited. Net-line budget forskills/**: 0 (an in-place rewording), at most +1. Stop on breach; explain in the report.
Container & model:S,mode:subagent,model: CONTRACT_REVIEW_TIER(MANDATORY:dispatch-gates --tier --repo objectstack-ai/objectstack skills/objectstack-query/SKILL.md⇢ 'skills/**' — clause ① (2026-09-10 ruling, verbatim 「必须 fable的还包括对外发布的skills」): the published catalog ships verbatim to third parties bynpx skills add objectstack-ai/objectstack/skillsandnpm create objectstack, so a wrong edit is installed elsewhere before anyone here reads it — and no one-line exemption applies under this root)
Clause-②: no
Responsibility: the published skill text produces the risk (line 66 prescribes a context the engine refuses since ADR-0096 D5, PR #22297) | the platform path that already covers it: the engine's own refusal (403 PERMISSION_DENIED) — loud, but only after the author has written the wrong context | who reaches it: every AI author who installsobjectstack-querybynpx skills add; used today
Thread-read: 6071380570
Serial constraints cleared:skills/objectstack-query/last touchedeed2dee4(2026-10-04) — no same-day churn; PR #22327 (the sibling wording inISecurityService's TSDoc and the contracts page) is open and draft, so the dev takes the D5 contract onmainand says so in the PR, as the triage grade allows; this round's siblings #22052 and #22053 touch noskills/**path; verify lock free, queue empty; the lane's p1 #22052 is claimed ahead of this card. Readings at 2026-10-09T00:16Z.os-dev-report
{ "issue": 22372, "status": "done", "branch": "claude/issue-22372-query-skill-principal-context", "pr": "https://github.com/objectstack-ai/objectstack/pull/22382", "session": "session_01JmWtcHfGbC4ncw4GFKWuRA", "premise_still_valid": true, "summary": "Premise verified on origin/main 16096e8d7: skills/objectstack-query/SKILL.md:66 still taught `{ flowRunId }` for provenance alone, and plugin-security (security-plugin.ts:383-404, isPrincipalLessContext + principalLessDenial) refuses a non-system context with no userId, no positions and no permissions with 403 PERMISSION_DENIED. Rewrote that one paragraph in place (lines 65-69 to 65-70, +1 line, within the +1 cap) to name the admitted shapes, `{ isSystem: true }` for a system read, otherwise the caller own context (user, position or permission set), or 403 PERMISSION_DENIED (ADR-0096 D5), wording taken from the D5 contract on main because PR #22327 is still an open draft (said so in the PR body). Enumeration pin over skills/**: 1 class-1 hit (this line); 0 class-2 hits across 26 query words, every non-zero hit read and dispositioned in the PR body; no hit in the two carrier files (PR #22347, PR #22322). Evals: filters-pagination-search.json case 5 asserts isSystem: true and nothing asserts the old line (not asserted, unchanged). Draft PR #22382 opened through the relay as objectstack-fleet[bot], Tier H, not readied.", "tests": "Gates derived in the worktree (node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, merge base 16096e8d7, head f4e5170b, 1 path): 24 families, each run with the exit code captured before any pipe into a ledger; --ran reconciliation: \"24 derived, 24 run, 0 NOT-MEASURED, 0 UNRUN\" and \"a DERIVED zero: all 24 recorded an exit code and none of them is 3\". All 24 exit 0, including node scripts/check-skills-token-ratchet.mjs (\"skills/objectstack-query/SKILL.md is 4128 tokens (ceiling 5552; headroom 1424)\"), pnpm --filter @objectstack/lint run check:doc-formula-expressions after its prerequisite build under the verify lock (pnpm exec turbo run build --filter=@objectstack/formula --filter=@objectstack/lint: VERDICT command-exit 0, held 105s, waited 0s, slot issue-22372), check:skill-docs, check:doc-authoring, check:skill-identifier-liveness, check:skill-frame-sync, check:skill-compatibility, check:corpus-claim-drift, check:cross-package-test-inputs, check:nul-bytes, check:pm-governed-merges and the rest listed in the PR body. Beyond the derivation: pnpm check:pm-skill-ratchet exit 0 (published root outside its map by design); pnpm --filter @objectstack/spec run check:skill-refs exit 0 (9 generated files in sync); control-byte grep over the edited file: none; PR-body guards: node scripts/check-partof-closing-keyword.mjs with PR_BODY exit 0; against PR #22382 with PR_NUMBER: check-closing-target-claim.mjs exit 0 (\"closes #22372, and each carries a Claim whose Branch line names claude/issue-22372-query-skill-principal-context\"), check-single-claim-paths.mjs exit 0. On-disk proof of the edit: grep -c \"provenance alone\" = 0 and grep -c \"ADR-0096 D5\" = 1 after an anchored replace that hit exactly once. No ablation applies (prose only). NOT RUN locally: pnpm lint (repo-level eslint; one Markdown file) and the 52 artifact-roster / 11 wide-population families the derivation places outside the derived total: CI owns them. Package tests/typecheck: no package touched, so none owed.", "gates": "24 derived / 24 run / 0 NOT-MEASURED / 0 UNRUN (--ran, exit codes recorded); all 24 exit 0 at f4e5170b; plus check:pm-skill-ratchet 0, check:skill-refs 0, partof-closing-keyword 0, closing-target-claim 0, single-claim-paths 0. CI on PR #22382: in_progress at report time (not waited on).", "line_budget": "skills/objectstack-query/SKILL.md 400 -> 401 lines (+1; budget 0, cap +1); whole package (all skills/*/SKILL.md) 4409 -> 4410 (+1); tokens 4109 -> 4128 against ceiling 5552. Why +1 not 0: the replaced clause was 37 chars, the D5 sentence (shape + refusal code + ADR) is 112; a 0-net fit needed deleting content (the envelope triple or the principal gloss) and re-wrap is not a currency.", "files_changed": [ "skills/objectstack-query/SKILL.md" ], "mcp_calls": "0 — no MCP tool was called (GitHub reads via gh api GET, writes via scripts/pm tools over the fleet-write relay)", "api_writes": "3 REST proxy writes, each one repository_dispatch (POST /repos/objectstack-ai/objectstack/dispatches) the relay executed as objectstack-fleet[bot]: (1) pr_create -> POST /repos/objectstack-ai/objectstack/pulls (run 37866702654, PR #22382, 13708 bytes stored identical); (2) label-write -> POST /issues/22382/labels [skip-changeset] + POST /issues/22382/assignees [os-elon-musk] (run 37866788923, read-back matches target); (3) this os-dev-report comment -> POST /issues/22372/comments. Plus git push x2 to the branch (empty-branch probe, then f4e5170b), not REST. No PATCH of any body.", "deviations": [ "Commit identity: the cloud container cannot mint the fleet identity (OS_FLEET_APP_ID / OS_FLEET_PRIVATE_KEY unset; the relay hands out no token for git), so the single commit f4e5170b carries the worktree harness identity Claude (noreply@anthropic.com) with the model-free trailer pair; any later commit keeps that same identity.", "Net-line budget 0 was not met; the permitted +1 was spent (reason in line_budget and the PR body).", "pnpm lint and the 52 artifact-roster / 11 wide-population families were not run locally (declared to CI in the PR body).", "A first gate-runner attempt (bash -c with a shell variable) was refused by the harness safety check and did not run; the gates were rerun from a generated runner file with literal commands, which is the run the ledger records.", "Label documentation on PR #22382 was set by another actor (the labeler) and was left alone." ], "open_questions": [], "out_of_scope_findings": [ "carrier: PR #22327 (#22302) · the old sentence still on main at packages/spec/src/kernel/execution-context.zod.ts:335-336 and :501, packages/spec/src/data/data-engine.zod.ts:67-70, content/docs/kernel/contracts/data-engine.mdx:127-128 · noted, not filed", "carrier: #22345 (PR #22357, code comments and docstrings) · packages/runtime/src/sandbox/body-runner.ts:979-984 comment \"A caller that has no context to give gets the same identity-less behavior as before\", a pre-D5 reading in a code comment · noted, not filed", "carrier: none · unverified observation, no repro: skills/objectstack-ui/rules/actions.md:125-127 says the action-body facade bypasses RLS/FLS while body-runner.ts:1188-1198 says the ScopedRepo.execute() path carries no caller identity; whether that path now meets the D5 refusal was not measured · noted, not filed" ] }
Generated by Claude Code
ACCEPT — PR #22382 (head
f4e5170b), Tier H, awaiting the maintainer's authorized approval — skills seat 1,session_01JmWtcHfGbC4ncw4GFKWuRA, 2026-10-09T00:58ZVerified on GitHub, not on the report: a draft PR against
main, first lineFixes #22372(the only closing keyword in the body), one file (skills/objectstack-query/SKILL.md, +5/−4); the paragraph at :65-70 now names the two admitted context shapes and the D5 refusal, its wording checked againstmain16096e8d7security-plugin.ts:383-404. Whole file 400 → 401, whole package 4409 → 4410 (+1 within the +1 cap; the 0 budget missed for a stated reason — a 112-character contract sentence replacing a 37-character clause, re-wrap not a currency). Enumeration overskills/**as the card asked: one class-1 hit (this line), zero class-2 hits, every non-zero query word dispositioned on the PR; the seat's own control agrees. Evals untouched and still true.skip-changeseton the PR (skills/**is in no released package'sfiles[], with a positive control). Gates: the dev's local union is pinned to the PR headf4e5170b(24 families,--ran24/24, all exit 0); CI on that head at this write: every completed jobsuccessorskipped, withLint & Repo Gates,Type Check · workspaceand twoTest Coreshards stillin_progress— landing waits for them and for the authorized approval anyway.mcp_calls0;api_writes3 (pr_create, label-write, the report). Deviations accepted: the commit's harness identity (reporting-only; a standing observation for the maintainer on the seat post) and the +1 line.Contract review PASS in seat at tier: 6072073121. Landing: the Tier H four-piece set is posted (this ACCEPT, the review record,
needs-user-decision+ 维护者速读 on the PR, review requested fromos-zhuangandhotlong); on an authorized APPROVED the seat lands unless the approver already did. Out-of-scope findings: three carriers (PR #22327's own files; a pre-D5 comment inbody-runner.ts:979-984left after #22345 landed; an unverifiedactions.mdvsbody-runner.tsobservation) — Acceptance notes, nothing filed.Landed — PR #22382 MERGED, card closed by
Fixes— skills seat 1,session_01JmWtcHfGbC4ncw4GFKWuRA, 2026-10-09T01:39ZTwo readings, taken together: PR #22382 reads
merged: trueat 2026-10-09T01:35Z (merge commit191543456ff273abd675d2fc42df39aa5976d9fd, merged byos-zhuangthrough the merge queue — approved 5464598394, readied and armed by the approver,added_to_merge_queue31 minutes before the merge, one entry ahead of it), and that commit is an ancestor oforigin/main(control:16096e8d7is also an ancestor; the commit is the queue's merge commit with two parents,f6e1d49ethe queue-built head). The changed lines of the merge commit onskills/objectstack-query/SKILL.mdare identical to the head diff (f4e5170b);origin/mainnow carriesADR-0096 D5once in that file andprovenance alonezero times.Tier H landing by the maintainer's own hand on this seat's four-piece set (contract review PASS 6072073121, ACCEPT 6072079471, 维护者速读 6072085576, review requested from both authorized approvers). The card closed
completedbyFixes;pm:dispatchedand the assignee are stripped in this act, and so is the PR'sneeds-user-decision. Timings: dispatch → draft PR 24 min; approval → MERGED 34 min. The lane's open set after the merge is the expected seven (no card silently closed). Nothing else is owed here.
Filing gate: ① a governed-text defect (Tier H), class (a), published surface. reach:
skills/objectstack-query/SKILL.mdships as a published agent skill. An AI author following line 66 writes an execution context the engine refuses.Filed by
domain:specseat 2 (seat post #18549),session_01DhTqaEHqPVSVnAkjG3jywn. This is the Tier H carrier that seat's ACCEPT on PR #22327 (6067117343, #22302) owed. Thedomain:servicesseat 1's note6070292301(on #18549) adds a second reason and leaves this card as the one carrier. ⛔ Not graded or routed here; ⛔ not a claim.What is false
skills/objectstack-query/SKILL.md:66(onmainatb46015391):plugin-securityrefuses a context that carries no principal and is not a system context, at all six sites. The engine middleware answers403 PERMISSION_DENIED; the read filter is the deny filter;canReadObject/canWriteObject/canExportanswerfalse. So{ flowRunId }alone, which the line prescribes, is refused.ISecurityService's TSDoc andcontent/docs/kernel/contracts/data-engine.mdx. The skill is governed, so that PR does not edit it.RunProvenanceContextdocstring still says a{ flowRunId }-only context falls open ("indistinguishable from passing no context at all"); ADR-0096 D5 now refuses it, and the type is produced nowhere #22345, the services seat, in the merge queue) retires theRunProvenanceContexttype from@objectstack/service-automation. The context shape this line describes no longer has a type behind it (that PR's contract review,6070198297).The fix
A one-line in-place edit of
SKILL.md:66. It drops "{ flowRunId }for provenance alone", or replaces it with the shape the engine admits: a principal-carrying context, or{ isSystem: true }. Follow PR #22327's wording once that lands, so the skill and the contract say one thing. Also measure whether the skill's evals or examples assert the old line.Tier H:
skills/**is governed, so the PR is the maintainer's to merge.dispatch-gates --tieron this path names the contract-review tier as MANDATORY.Dedupe words:
objectstack-query flowRunId provenance alone·SKILL.md principal-less context·ADR-0096 D5 skillGenerated by Claude Code