qa(checklist): record access-security.crud-permission-matrix A1's red as a knownGap pointing at #21057 (ADR-0131 C1, target:v18), so 17.x release runs read it as known

Filed by the triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U, as the follow-up of the maintainer's ruling on #21057 (「21057 等 v18 你应该打上标签」, recorded in 5980557328). ⛔ Not a claim, ⛔ not a dispatch.

What

docs/qa/platform-checklist/areas/access-security.json, item access-security.crud-permission-matrix (a P0 item): clause A1 is red on every 17.x run.

It was red in QA run · priority:P0 (19/19) · ef1ed17f · 2026-10-01 · 13 PASS / 0 PARTIAL / 6 FAIL / 0 BLOCKED / 0 NOT-RUN #21056, and red again at 251a7dd4 in the 17.7 pre-release run QA run · surface:api (89/89) · 251a7dd4 · 2026-10-04 · 68 PASS / 7 PARTIAL / 14 FAIL / 0 BLOCKED / 0 NOT-RUN #21720.
The cause is [finding] The delegated-admin gate resolves an EMPTY subtree on a stock objectstack dev boot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057: the seeded business units carry no organization.
The fix is ADR-0131 C1's business-unit leg, which the maintainer has ruled waits for v18 (target:v18, gated by [gate] the v18 development line is not open — ADR-0131 execution cards are blocked on this card #15193).

Until v18 the clause is red by decision, not by surprise. Each release run currently spends a runner and a verifier re-deriving that.

Change

Add a knownGaps entry to the item, the field this file already uses (for example about :429).
- It names A1, [finding] The delegated-admin gate resolves an EMPTY subtree on a stock objectstack dev boot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057, ADR-0131 C1 and target:v18.
- It records the measured discriminator: stamping the organization on the seeded units flips the in-subtree create to 201, while out-of-subtree stays 403.
Add a history entry citing this card and the ruling.
⛔ The clause's assertion is not weakened, and the item is not deprioritised. A1 stays a FAIL in the run table, read as known. It turns green when the v18 C1 leg lands, which is the signal that the gap closes.

Acceptance

The next release run reports A1 as FAIL (known, [finding] The delegated-admin gate resolves an EMPTY subtree on a stock objectstack dev boot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057) without re-derivation.
The checklist's own validators stay green.

documentation · priority:p2 (the release's own instrument, as #21735) · domain:devx · area:devpath.

Generated by Claude Code

Claim: PM loop round 54
Session: session_01VDtqoecgES7ScQYGbFVDRv
Branch: claude/issue-21747-crud-matrix-knowngap, cut from origin/main once PR #21741 has landed there. At the claim, origin/main is 72b6333cd8 and #21741 is in the merge queue.
Worktree: objectstack-issue-21747
Domain: domain:devx
Seat: domain:devx#1
File surface:

docs/qa/platform-checklist/areas/access-security.json, item access-security.crud-permission-matrix only:
- one knownGaps entry naming A1, [finding] The delegated-admin gate resolves an EMPTY subtree on a stock objectstack dev boot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057, ADR-0131 C1 and target:v18, with the measured discriminator (seeded units stamped with the organization flip the in-subtree create to 201; out-of-subtree stays 403), in the form that field already uses in this file;
- one revision bump;
- one history entry citing this card and the maintainer's ruling on [finding] The delegated-admin gate resolves an EMPTY subtree on a stock objectstack dev boot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057.
⛔ A1's assertion is not weakened, the item is not deprioritised, and no other item is touched.
The checklist's own validators stay green.
⛔ No product change, no run record, and no write to [finding] The delegated-admin gate resolves an EMPTY subtree on a stock objectstack dev boot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057, QA run · surface:api (89/89) · 251a7dd4 · 2026-10-04 · 68 PASS / 7 PARTIAL / 14 FAIL / 0 BLOCKED / 0 NOT-RUN #21720 or [gate] the v18 development line is not open — ADR-0131 execution cards are blocked on this card #15193.

Stop on a breach and explain it in the report.
Container & model: S (one knownGap, one history entry), mode:subagent, model: sonnet
Clause-②: no
Thread-read: none
Serial constraints cleared: board read at 2026-10-04T13:50Z. PR #21741 (#21735) edits a different item in the same file. It is in the merge queue, and this branch is cut only from a main that carries it, so the two never conflict. No other open PR touches the file.

Priority rule 3 reading: domain:devx has no open P0/P1. This is the release's own instrument, like #21735. docs/qa/** is not a contract-review face, and nothing publishes, so the PR carries skip-changeset.

Generated by Claude Code

os-dev-report

{
  "issue": 21747,
  "status": "done",
  "branch": "claude/issue-21747-crud-matrix-knowngap",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/21749",
  "session": "session_01VDtqoecgES7ScQYGbFVDRv",
  "premise_still_valid": true,
  "summary": "Added one knownGaps entry to access-security.crud-permission-matrix (A1 known FAIL until the v18 ADR-0131 C1 business-unit leg, #21057, target:v18, with the stamping discriminator read from #21057 comments 5927366808 and 5979438043), bumped revision 4 to 5 and added one history entry citing #21747 and the ruling (comment 5980557328). Assertion, priority and other items untouched. Branch cut from origin/main ff29410ed2 after #21741 merged.",
  "tests": "pnpm check:platform-checklist exit 0 (15 areas, 270 items OK); dispatch-gates --commands (13 commands) all exit 0 at head 824208e64d; check:doc-formula-expressions needed lint and formula built first, then exit 0. NOT MEASURED: CI-only shard steps and type-check lanes (no TS touched).",
  "mcp_calls": "0",
  "api_writes": "2 - fleet-write dispatch: pr_create (PR 21749), comment on 21747",
  "open_questions": [
    {
      "question": "PR carries no skip-changeset label and no PR assignee (brief said no labels).",
      "options": [
        "seat applies skip-changeset and assignee",
        "leave"
      ],
      "recommendation": "seat applies, since docs/qa publishes nothing"
    }
  ],
  "out_of_scope_findings": []
}

Landed: PR #21749 → 8cbba54491, verified on origin/main by content at 2026-10-04T14:37Z.

docs/qa/platform-checklist/areas/access-security.json on main is blob-identical to the landing head 824208e64d (8ce7a6aca4). Only item access-security.crud-permission-matrix changed (+9 −2).
The knownGap:
- A1 (acceptance[0], "every allowed cell succeeds") is a known FAIL on 17.x until the v18 ADR-0131 C1 business-unit leg lands ([finding] The delegated-admin gate resolves an EMPTY subtree on a stock objectstack dev boot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057, target:v18, gated by [gate] the v18 development line is not open — ADR-0131 execution cards are blocked on this card #15193).
- It records the measured discriminator: stamping the organization on the seeded units flips the in-subtree create to 201, while the out-of-subtree create stays 403. The dev read this from [finding] The delegated-admin gate resolves an EMPTY subtree on a stock objectstack dev boot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057's own measurements, 5927366808 and 5979438043; the card body agrees.
- It says to score A1 FAIL and read it as known, not to weaken the clause, and not to stamp the units to make it pass. When the v18 leg lands and A1 turns green, the entry is removed.
The revision went from 4 to 5, with one history entry citing qa(checklist): record access-security.crud-permission-matrix A1's red as a knownGap pointing at #21057 (ADR-0131 C1, target:v18), so 17.x release runs read it as known #21747 and the maintainer's ruling on [finding] The delegated-admin gate resolves an EMPTY subtree on a stock objectstack dev boot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057 (5980557328). A1's assertion and the item's priority are unchanged.
The branch was cut from ff29410ed2, which already carried docs(qa): re-point 17 platform-checklist clauses the 17.7 pre-release runs proved stale or mis-asserted #21741's edit to the same file, so there was no conflict.
pnpm check:platform-checklist is green (270 items), and the 13 derived gate families exited 0. CI was green, and the merge queue passed.
Changeset: none. docs/qa/** publishes nothing, so the PR carries skip-changeset. No contract-review face is touched.

pm:dispatched removed.

Seat domain:devx#1 · session_01VDtqoecgES7ScQYGbFVDRv

Generated by Claude Code

docs(qa): record A1 of crud-permission-matrix as a known v18 gap (obj…

Navigation Menu

qa(checklist): record `access-security.crud-permission-matrix` A1's red as a knownGap pointing at #21057 (ADR-0131 C1, `target:v18`), so 17.x release runs read it as known #21747

What

Change

Acceptance

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

qa(checklist): record access-security.crud-permission-matrix A1's red as a knownGap pointing at #21057 (ADR-0131 C1, target:v18), so 17.x release runs read it as known #21747

Description

What

Change

Acceptance

Activity

objectstack-fleet commented on Oct 4, 2026

objectstack-fleet commented on Oct 4, 2026

objectstack-fleet commented on Oct 4, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

qa(checklist): record `access-security.crud-permission-matrix` A1's red as a knownGap pointing at #21057 (ADR-0131 C1, `target:v18`), so 17.x release runs read it as known #21747