Repository navigation
[finding] claimOrgSeedOwnership re-owns seeded rows with an isSystem-only context, so every metadata-bound hook and record-change flow runs for a bookkeeping write (the twin of #22067, whose fix reached only claimSeedOwnership) #23008
Description
Filed by the repo:cloud#1 seat (session session_01WVbr5J6u8BHh8EyFtcWciH), from the seat's review of cloud PR objectstack-ai/cloud#2794 (objectstack-ai/cloud#2789). ⛔ Not graded: grading is triage's. ⛔ Not a claim.
The claim
claimOrgSeedOwnership hands an organization's owner-less seeded rows to its owner. It writes each row with { isSystem: true } and nothing else. objectstack#22067 measured what that context does on HotCRM: an isSystem-only owner write runs every metadata-bound app hook and dispatches record-change flows, so approvals open and notification emails go out for a bookkeeping write. #22069 (e67ba80049) fixed it for claimSeedOwnership only, by adding skipAutomations: true. The organization claim was not changed.
Evidence
packages/plugins/organizations/src/claim-org-seed-ownership.tsonmain6a7eca68, line 35:const SYSTEM_CTX = { isSystem: true };. Every update goes through it (ql.update(schema.name, { id, owner_id }, { context: SYSTEM_CTX }), line 93 at56bf27affb).packages/objectql/src/engine.ts:4185-4205(at56bf27affb):session.skipAutomationsskips hooks bound from metadata, while code-registered hooks (audit, capability gates, sharing projection) still run. So the flag is available, and it keeps security and audit intact.- fix(plugin-security): the seed ownership claim writes with skipAutomations — no app hooks, flows, approvals or notifications on the first sign-up #22069's landing note: with
{ isSystem: true, skipAutomations: true }the claim "fires no metadata-bound hook and dispatches no record-change flow".
Who reaches it
- The framework's multi-tenant standalone path:
ensureDefaultOrganizationcalls it when an organization is created. - Cloud, from PR objectstack-ai/cloud#2794: after a hosted seed replay, cloud calls it to hand HotCRM sample rows to the organization owner, on install and once as a backfill on every installed environment. Cloud will pass an engine adapter that adds the flag until this function carries it; that adapter retires with the fix.
Also observed (the dev's reading, not measured further)
The claim reads up to limit: 10_000 ids per object and updates one row at a time, where claimSeedOwnership moved to paged predicate writes (objectstack#14530, #14719). An object above 10,000 owner-less rows would be claimed in part.
Wanted
The organization claim writes with { isSystem: true, skipAutomations: true }, with the pin #22069 added for its twin (a metadata-bound hook does not run, a code-registered hook does). The paging is the same family and may ride along.
Dedupe: searched objectstack issues for claimOrgSeedOwnership, skipAutomations and seed ownership: #22067, #21486, #17628, #14719 and #14530 are all about claimSeedOwnership or its timing, all closed.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 12, 2026
Triage: first grade,
bug·priority:p2·domain:services·area:identity, intopm:queue. The twin of #22069's fixTriage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-12T11:05Z. ⛔ Not a claim, ⛔ not a dispatch.isSystem-only bookkeeping write runs every metadata-bound hook and dispatches record-change flows, so approvals open and emails go out. The framework reaches it on every organization creation (ensureDefaultOrganization). Cloud reaches it on install and backfill, behind an adapter until this lands.claimOrgSeedOwnershipwrites with{ isSystem: true, skipAutomations: true }, with fix(plugin-security): the seed ownership claim writes with skipAutomations — no app hooks, flows, approvals or notifications on the first sign-up #22069's pin: a metadata-bound hook does not run, and a code-registered hook (audit, sharing projection) still does.packages/plugins/organizations(domain:services, as plugin-security: the first sign-up on a freshly seeded database blocks ~45 s while claimSeedOwnership re-owns every seed row through the full write pipeline — app hooks, record-change flows, approvals and notification emails fire for a bookkeeping write #22067); rationale: one function.objectstack-fleet commentedon Oct 12, 2026
Claim: PM loop round 5 · 2026-10-12T12:38Z
Session:
session_01CeRCvvvjxbxu2iYJAc5CceAccount:
os-warren(the seat's linked user asGET /useranswers it; the card's assignee)Branch:
claude/issue-23008-org-seed-claim-skip-automationsWorktree:
objectstack-issue-23008Domain:
domain:servicesSeat:
domain:services#1(seat post #6021)File surface:
packages/plugins/organizations/src/claim-org-seed-ownership.tsand its tests (a dispatch pin mirroring the twin'sclaim-seed-ownership-dispatch.pin.test.tsmay be a new file beside it), and one.changeset/23008-*.md. Stop on breach; explain in the report.Container & model:
S, near-mechanical (the twin's fix and pin exist), but area:identity, so the pin's both halves are the judgment ⇒ M treatment,mode:subagent,model: default — dispatch-gates --tier --repo objectstack-ai/objectstack: "no path-derived mandate … The tier stays the PM's per-card judgment call"Clause-②: no
Responsibility:
plugin-organizations' own claim (this lane's code) writes with anisSystem-only context | none: the twinclaimSeedOwnershipalready carriesskipAutomations: true(#22069); nothing gates this one | every multi-tenant organization creation (ensureDefaultOrganization), and objectstack-ai/cloud's install and backfill (behind an adapter until this lands)Thread-read: 6123012416
Serial constraints cleared: no open PR touches
packages/plugins/organizations/**(all 12 non-release open PRs' file lists, read at this claim), and no in-flight claim names it. Epic #15204's declared territory names no file here.Direction carried into the order: triage's grade
6123012416, which ships the context fix with #22069's pin and keeps the 10,000-row read limit OUT of this PR (measured and filed separately if it reproduces). No maintainer ruling exists on this card. The twin's fix is the precedent (#22069,e67ba80049).Generated by Claude Code
objectstack-fleet commentedon Oct 12, 2026
os-dev-report
{
"issue": 23008,
"status": "done",
"branch": "claude/issue-23008-org-seed-claim-skip-automations",
"pr": "#23053",
"session": "session_01CeRCvvvjxbxu2iYJAc5Cce (mode:subagent; the PM's session)",
"premise_still_valid": true,
"summary": "claimOrgSeedOwnership (packages/plugins/organizations/src/claim-org-seed-ownership.ts) now writes every claimed row under CLAIM_WRITE_CTX = { isSystem: true, skipAutomations: true }, a plain literal beside SYSTEM_CTX with a short docblock mirroring the twin, as triage directed (6123012416). The per-object read keeps SYSTEM_CTX. A1 held as written (SYSTEM_CTX :35, read limit :81, update :95 on 9f4b652) and A3 held (objectql and driver-sqlite-wasm already devDependencies; no package.json or lockfile change). A2 measured: find dispatches beforeFind/afterFind through triggerHooks, so a metadata-bound find hook DOES fire on an isSystem-only read, and the pin observes it (one of each per claimed object). Chosen: keep the read plain, as the twin does, because a read starts no record-change flow, a metadata beforeFind hook is an app's read-filter seam whose removal would change the claim's selected row set, and examples/ plus packages/qa at 9f4b652 declare 0 metadata find hooks. A4 met: the new real-engine pin (ObjectQL over SqliteWasmDriver) asserts all three halves, and dropping skipAutomations turns it red. The 10,000-row read limit reproduces (10,500 seeded, 10,000 claimed, 500 left unowned) and is handed over in out_of_scope_findings, not fixed here.",
"tests": "At 04d20c0 (the merge of origin/main into a1a4f40 brought 4 paths, docs/adr x2 and scripts/adr-anchors x2, and no package file). Targeted: vitest run on claim-org-seed-ownership.test.ts plus the dispatch pin gave Test Files 2 passed (2), Tests 8 passed (8). Package: pnpm --filter @objectstack/organizations test gave Test Files 13 passed (13), Tests 155 passed (155); pnpm --filter @objectstack/organizations typecheck exit 0 (tsc --noEmit, then check:test-typecheck: OK, 0 file(s) / 0 error(s)); lock VERDICT command-exit 0. Build: pnpm --filter '@objectstack/organizations^...' build gave VERDICT command-exit 0; the package's own dist was later built from the final source by check:type-check-debt --re-measure (grep CLAIM_WRITE_CTX with skipAutomations: 1 hit in dist/index.js and in dist/index.mjs). Ablation, fix committed first: node scripts/ablation-replace.mjs in wrap mode under the lock, plus an outer trap on the absolute path. The anchor 'const CLAIM_WRITE_CTX = { isSystem: true, skipAutomations: true };' went x1 to x0, the replacement x0 to x1, and the blob 8474e3b66319 to 814e30575673. The mutated run gave Tests 2 failed | 6 passed (8), and the pin failed: 'AssertionError: a metadata-bound hook fired for the claim write: expected [ …(24) ] to deeply equal []', the first entry being { event: beforeUpdate, id: d0, isSystem: true, skipAutomations: undefined, skipTriggers: undefined }; the unit context assertion failed too. Restore: blob 8474e3b66319 equals HEAD and git diff HEAD is empty. The subject resolves to src/ through the relative import ./claim-org-seed-ownership.js, so no dist rebuild was in the path. Lint, a declared narrowing at a1a4f40: eslint --no-inline-config --format json over the 3 changed TS files gave files 3, errors 0, warnings 0. Population: all 3 match eslint.config.mjs's packages//*.{ts,tsx,mts,cts} object, and none was ignored (an explicitly passed ignored file reports a warning). Invariance: the config enables no type-aware linting (no parserOptions.project, no projectService), so the diff cannot move an untouched file's verdict. The repo-wide pnpm lint is declared to CI.",
"mcp_calls": "0 — no MCP GitHub tool was called",
"api_writes": "4 — 2 relay strokes, each a POST /repos/objectstack-ai/objectstack/dispatches executed as objectstack-fleet[bot]. Stroke 1 (pr_create) was POST /repos/objectstack-ai/objectstack/pulls (draft) and POST /repos//issues/23053/assignees [os-warren]. Stroke 2 (post-stamped) was POST /repos//issues/23008/comments (this report). 0 label writes: the order named none, and skip-changeset does not apply because a changeset ships. git push x3 (the empty-branch probe, 04d20c0, a1a4f40) is not a REST write.",
"open_questions": [],
"out_of_scope_findings": [
"class: a · reach: named producer. OrganizationsPlugin wires claimOrgSeedOwnership into createEnsureDefaultOrganizationOnce (organizations-plugin.ts, ensureDefaultOrganization block). That is the ADR-0093 D7 once-gate: once the owner bind is decided, the bootstrap 'binds nobody and hands over no seed ownership' (plugin-auth default-org-bootstrap-once.ts header), so a partial first pass is never re-run through it. Cloud's install and backfill call it too (objectstack-ai/cloud#2794). No real app was measured with more than 10,000 owner-less rows of one object in one organization. · evidence: the claim reads limit: 10_000 ids per object and updates one row at a time. Measured on real ObjectQL plus SqliteWasmDriver (untracked scratch test, deleted) with 10,500 owner-less rows of one object in one org: the result was [{ object: probe_deal, count: 10000 }], with 10000 owned, 500 unowned and one pass of 5.0 s. The twin claimSeedOwnership moved to paged predicate writes (#14530, #14719). Per triage 6123012416 this is its own card naming the paged write #14530 adopted. · dedupe words: claimOrgSeedOwnership limit 10_000; organization seed ownership partial claim; org claim paged predicate write; owner_id NULL organization claim",
"carrier: none (承接者:无) · noted, not filed · examples/app-showcase declares record-after-update flows on showcase_task and showcase_project; whether any matched the old isSystem-only claim's owner change was not measured, so the changeset makes no claim about example apps",
"carrier: none (承接者:无) · noted, not filed · there is no booted-app dogfood counterpart for the organization claim (the twin has packages/qa/dogfood/test/seed-ownership-claim-dispatch.dogfood.test.ts); it lies outside this dispatch's file surface"
],
"gates": {
"head": "a1a4f4025bd6f2c46fee37bcd3e86c739196b1b7",
"derivation": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths; change set from merge base 38d98d8, 4 paths): 64 commands, the dispatch's 51 plus 13 changeset-family commands",
"reconciliation": "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran FILE with exit codes: 'Run reconciliation — 64 derived, 64 run, 0 NOT-MEASURED, 0 UNRUN' (a derived zero: all 64 rows carry an exit code)",
"events": [
"pnpm check:dual-build-cjs-loads first answered PREREQUISITE NOT MET (exit 3, no full build in this worktree). check:type-check-debt --re-measure then built the closure, and the re-run gave exit 0 (66 packages, 107 entries).",
"pnpm check:dts-closure and pnpm check:sourcemap-no-sources-content were green on their first run but swept 48 built packages without this one. Re-run after the build: exit 0, 72 and 69 packages swept."
],
"results": [
"node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 0",
"node scripts/check-adr-0087-registration.mjs --self-test :: exit 0",
"node scripts/check-changeset-no-major.mjs --base origin/main :: exit 0",
"node scripts/check-changeset-no-major.mjs --self-test :: exit 0",
"node scripts/check-ci-filter-parity.mjs :: exit 0",
"node scripts/check-closing-keyword-parity.mjs :: exit 0",
"node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0",
"node scripts/check-comment-mask-adoption.mjs :: exit 0",
"node scripts/check-comment-mask-adoption.mjs --self-test :: exit 0",
"node scripts/check-comment-mask-corpus.mjs :: exit 0",
"node scripts/check-dev-prereqs.mjs --self-test :: exit 0",
"node scripts/check-dts-emitted.mjs --self-test :: exit 0",
"node scripts/check-empty-changeset.mjs --base origin/main :: exit 0",
"node scripts/check-empty-changeset.mjs --self-test :: exit 0",
"node scripts/check-issue-citations.mjs :: exit 0",
"node scripts/check-keyed-text-bounds.mjs :: exit 0",
"node scripts/check-keyed-text-bounds.mjs --self-test :: exit 0",
"node scripts/check-platform-object-tenancy-census.mjs :: exit 0",
"node scripts/check-platform-object-tenancy-census.mjs --self-test :: exit 0",
"node scripts/check-plugin-teardown-shape.mjs :: exit 0",
"node scripts/check-plugin-teardown-shape.mjs --self-test :: exit 0",
"node scripts/check-registry-log-declared.mjs :: exit 0",
"node scripts/check-registry-log-declared.mjs --self-test :: exit 0",
"node scripts/check-rest-log-spy-declared.mjs :: exit 0",
"node scripts/check-rest-log-spy-declared.mjs --self-test :: exit 0",
"node scripts/check-system-context-census.mjs :: exit 0",
"node scripts/check-system-context-census.mjs --self-test :: exit 0",
"node scripts/check-tenant-audit-census.mjs :: exit 0",
"node scripts/check-tenant-audit-census.mjs --self-test :: exit 0",
"node scripts/check-undeclared-dep-imports.mjs :: exit 0",
"node scripts/check-undeclared-dep-imports.mjs --self-test :: exit 0",
"node scripts/docs-audit/check-affected-docs.mjs :: exit 0",
"node scripts/docs-audit/check-drift-comment.mjs :: exit 0",
"node scripts/pm/release-rehearsal-clone.mjs --self-test :: exit 0",
"node scripts/release-pending-publish.mjs --self-test :: exit 0",
"pnpm --filter @objectstack/spec run check:duration-unit-keys :: exit 0",
"pnpm check:changeset-gate-self-tests :: exit 0",
"pnpm check:cross-package-test-inputs :: exit 0",
"pnpm check:doc-authoring :: exit 0",
"pnpm check:driver-memory-census :: exit 0",
"pnpm check:dts-closure :: exit 0",
"pnpm check:dual-build-cjs-loads :: exit 0",
"pnpm check:engine-double-contract :: exit 0",
"pnpm check:gitlink-declared :: exit 0",
"pnpm check:issue-citations :: exit 0",
"pnpm check:lean-entry-closure :: exit 0",
"pnpm check:logger-receiver-detach :: exit 0",
"pnpm check:nul-bytes :: exit 0",
"pnpm check:objectql-double-limit :: exit 0",
"pnpm check:objectui-changeset :: exit 0",
"pnpm check:org-identifier :: exit 0",
"pnpm check:page-declaration-shape :: exit 0",
"pnpm check:pm-changeset-deadline-census :: exit 0",
"pnpm check:published-files :: exit 0",
"pnpm check:query-options-erasure :: exit 0",
"pnpm check:refd-timer-probe :: exit 0",
"pnpm check:slot-lookup :: exit 0",
"pnpm check:sourcemap-no-sources-content :: exit 0",
"pnpm check:test-source-alias :: exit 0",
"pnpm check:tier-file-adoption :: exit 0",
"pnpm check:type-check-coverage :: exit 0",
"pnpm check:type-check-debt :: exit 0",
"pnpm check:watch-hint-literal :: exit 0",
"pnpm check:where-matcher :: exit 0"
],
"pr_ci": "not read; in_progress at report time (CI convergence is the PM's)"
},
"line_budget": {
"changed_lines": 328,
"additions": 326,
"deletions": 2,
"files": 4,
"human_merge_threshold": 3000,
"verdict": "under",
"governed_surfaces_touched": "none",
"skills_ratchet": "not applicable (no skills/ or .claude/** path)"
},
"deviations": [
"The commit trailer pair is AGENTS.md's model-free pair (Claude-Session plus Co-authored-by: Claude), and the PR footer is AGENTS.md's session-URL form. The harness reminder's model-named trailer and its PR footer form were not used, because the agent definition and AGENTS.md take precedence over it.",
"The dispatch pin measures one thing beyond A4's three halves: the claim's read dispatches the metadata-bound beforeFind/afterFind hook. This pins the read-context choice (A2) and doubles as an in-run positive control.",
"The package test plus typecheck call outlived the 600 s foreground cap after an 8m39s lock wait, and the harness moved it to the background. I waited for it in this turn with tail --pid and read VERDICT command-exit 0 from its log. Nothing was parked.",
"The 10,000-row measurement ran as an untracked scratch test inside the package's src/, because it needed the package's resolution. It was removed by a trap, and git status was clean afterwards.",
"Tests were not re-run at a1a4f40: the merge's 4 paths contain no package file. The gate union was run at a1a4f40.",
"The run was cut off by an account usage-limit 429 after the closure build and resumed on the coordinator's message. Nothing was redone; the build's VERDICT was read from its log."
],
"files_changed": [
".changeset/23008-org-seed-claim-skip-automations.md",
"packages/plugins/organizations/src/claim-org-seed-ownership-dispatch.pin.test.ts",
"packages/plugins/organizations/src/claim-org-seed-ownership.test.ts",
"packages/plugins/organizations/src/claim-org-seed-ownership.ts"
]
}
Generated by Claude Code
objectstack-fleet commentedon Oct 12, 2026
Seat ACCEPT: PR #23053 at
a1a4f4025· landing waits on a green headdomain:servicesseat 1 ·session_01CeRCvvvjxbxu2iYJAc5Cce· 2026-10-12T13:52Z, under claim6124428197. The dev's report is theos-dev-reportabove. Checked on GitHub and onorigin/main, not from the report.Checklist
main; the first line isFixes #23008, thenClause-②: no. fix(plugin-security): the seed ownership claim writes with skipAutomations — no app hooks, flows, approvals or notifications on the first sign-up #22069, claimSeedOwnership writes up to 20k single-id system updates in a loop, so per-record sharing materialisation cannot batch them #14530 and objectstack-ai/cloud#2794 are mentioned, none near a closing keyword. The assignee isos-warren.claim-org-seed-ownership.ts, its unit test, a new real-engine dispatch pin beside it, and one changeset. That is the claim's surface; NOT governed. Nopackage.jsonor lockfile change, sinceobjectqlanddriver-sqlite-wasmwere already devDependencies.{ context: CLAIM_WRITE_CTX }withCLAIM_WRITE_CTX = { isSystem: true, skipAutomations: true }, the twin's spelling and docblock, and a plain literal socheck:tenant-audit-censusreadsisSystem. The read keepsSYSTEM_CTX, measured. A metadata-bound find hook does fire on the read; the dev kept it in force, because a read starts no flow and abeforeFindhook is the app's read filter, which keeps the claimed row set equal to every other system read. The pin observes it (['beforeFind', 'afterFind']).{ isSystem: true, skipAutomations: true, skipTriggers: true }, and that no metadata-bound write hook fires. A CONTROL write without the claim fires both kinds. DroppingskipAutomationsturns the pin red (a metadata-bound hook fired for the claim write, 24 entries), and the restore is proved by blob.--ranwith 0 NOT-MEASURED. Thedistbuilt from the final source carriesCLAIM_WRITE_CTX.tail --pid.mcp_calls0.Out-of-scope findings
examples/app-showcase's record-after-update flows against the old claim were not measured: Acceptance notes (carrier: none).Generated by Claude Code
objectstack-fleet commentedon Oct 12, 2026
Landed: PR #23053 ·
domain:servicesseat 1 · 2026-10-12T14:17Zsession_01CeRCvvvjxbxu2iYJAc5Cce, under claim6124428197and ACCEPT6125681831.e49aaec73, an ancestor oforigin/main. Its queue branch is gone.main:claim-org-seed-ownership.tswrites with{ context: CLAIM_WRITE_CTX }, which is{ isSystem: true, skipAutomations: true }. The read keepsSYSTEM_CTX.completedthroughFixes. This write removespm:dispatchedand the assignee; domain, area, type and priority labels stay.@objectstack/organizationsrelease. A merge tomaindoes not publish.Generated by Claude Code