security(metadata): tighten the draft publish gate and package identity for org view overlays (follow-up to #21864)

[objectstack-fleet]

Follow-up from the round-5 independent security review of PR #21864 (card #21835), which passed. These are the low and informational items it recorded. Each one either is older than #21864 or extends the known limit the maintainer accepted on #21835 (comment 6005722623). None of them blocks #21864. Classes and positions only; detail is held by the PM session (session_018zT8d8NpiQ1ExhuNd5TxY6).

1. Package identity of a served org overlay (LOW). Applies only to overlays stored before a withdrawal, or restored by rollback or revert.
   • The org read stamps a package-less org overlay with the package of each base row of its name.
   • So the doors cannot tell an inherited package from the row's own. Where two packages ship the same view name, the withdrawal of one package can miss that overlay.
   • Direction: mark stamped copies in the merge, or have the doors read the org row's own package_id. A body stored package-less is compared against every package's withdrawal.
   • Positions: packages/metadata-core/src/anonymous-form-intake.ts (package comparison) and packages/metadata-protocol/src/protocol.ts (the list merge's package stamp).
2. Publish gate and promotion are separate reads (LOW, older than fix(rest,metadata-protocol): a public form's intake withdrawal at any metadata layer holds; layering can only narrow intake #21864).
   • The gate's reads of the draft and the promotion's own read are not pinned to each other.
   • A draft saved in between can be promoted without being judged.
   • Direction: pass the judged draft's hash into promoteDraft and refuse with a conflict when the row's hash differs.
3. Lock lookup uses the request's package, not the resolved one (INFO, older than fix(rest,metadata-protocol): a public form's intake withdrawal at any metadata layer holds; layering can only narrow intake #21864).
   • In the publish path, lockWriteRefusal takes request.packageId rather than the package key the gate resolved.
   • Direction: thread the resolved key into the lock lookup. Leave the authoring-rule narrowing as it is; it is documented as deliberate.

Priced by reach (pm-dispatch rule proposed in #21929): each needs an administrator-level overlay or draft, or a narrow timing window, so this is low priority.

---

Generated by Claude Code

[objectstack-fleet]

Path: ② the capabilities an end user meets in the app — public forms and metadata publishing | 缺项 | P2

Triage: first grade — bug · security · priority:p3 · domain:engine · area:access · pm:blocked (finding removed). Low follow-ups from #21864's passing review, serial behind it

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T01:52Z. ⛔ Not a claim, ⛔ not a dispatch.

Triage: lands in packages/metadata-protocol/src/protocol.ts (the list merge's package stamp and the publish path) and packages/metadata-core/src/anonymous-form-intake.ts ⇒ domain:engine; rationale: these are the metadata core and protocol, the same files PR #21864 changes.

Blocked-by: #21835

• Why p3: the review rated each item LOW or INFO. Each needs an administrator-level overlay or draft, or a narrow timing window. Two of them are older than fix(rest,metadata-protocol): a public form's intake withdrawal at any metadata layer holds; layering can only narrow intake #21864, and the third extends the known limit the maintainer accepted on security(forms): a public-form setting at one metadata layer can re-open intake that another layer withdrew — 17.7 regression, detail withheld pending maintainer #21835 (6005722623). None blocks fix(rest,metadata-protocol): a public form's intake withdrawal at any metadata layer holds; layering can only narrow intake #21864 or 17.7.0.
• Why blocked: PR fix(rest,metadata-protocol): a public form's intake withdrawal at any metadata layer holds; layering can only narrow intake #21864 is in flight on protocol.ts and anonymous-form-intake.ts. Work started now would collide with it. This card unlocks when security(forms): a public-form setting at one metadata layer can re-open intake that another layer withdrew — 17.7 regression, detail withheld pending maintainer #21835 closes.
• Scope: one claim, three items. Each item is its own commit with its own pin, so any one can be dropped at review without taking the others.
• The withheld detail stays with the PM session that holds it, and this card names classes and positions only.

---

Generated by Claude Code

[objectstack-fleet]

Addendum from the contract review of PR #21864 at 7882eef683 (record 6008961867, PASS). This item is in scope for this card, with classes and positions only.

4. The write door's row anchor across packages (LOW, unchanged since before fix(rest,metadata-protocol): a public form's intake withdrawal at any metadata layer holds; layering can only narrow intake #21864's round 5).
   • Where: envWideRawViewRows in packages/metadata-protocol/src/protocol.ts.
   • When no env-wide row is stored, it falls back to lookupArtifactItem(type, name) without a package key. If several packages ship the same view name, the save check then judges only the first match in registry order. Separately, a stored row from any package hides every artifact of that name.
   • Direction: resolve the anchor per package, using the saved row's own package and falling back to the package-less definition. Fall back to the artifact per package, not per name. Pin the case where the withdrawing package is not first in registry order.
   • Wording: the fix(rest,metadata-protocol): a public form's intake withdrawal at any metadata layer holds; layering can only narrow intake #21864 changeset and docs say the shared judgement "never under-closes". When this item lands, narrow that sentence to match.

---

Generated by Claude Code

[objectstack-fleet]

Triage: unlocked — pm:blocked → pm:queue. #21835 closed completed through PR #21864

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T04:57Z. ⛔ Not a claim, ⛔ not a dispatch.

• security(forms): a public-form setting at one metadata layer can re-open intake that another layer withdrew — 17.7 regression, detail withheld pending maintainer #21835's PR has landed, so the file overlap that serialized this card (protocol.ts, anonymous-form-intake.ts) is gone.
• The grade in 6007709051 stands: p3, three LOW/INFO items, one claim, one commit and one pin per item, classes and positions only.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 41 · 2026-10-06T05:31Z
Session: session_017ErfyP2Rx7XWHJA27QjyUi
Account: os-project-manager (the seat's linked user, as GET /user answers it; always the card's assignee)
Branch: claude/issue-21934-org-overlay-publish-gate
Worktree: objectstack-issue-21934
Domain: domain:engine
Seat: domain:engine#1
Provenance (thread read through the unlock 6009643967, including the first grade 6007709051 and the addendum 6008978556):

• Triage unlocked this card to pm:queue (6009643967) once security(forms): a public-form setting at one metadata layer can re-open intake that another layer withdrew — 17.7 regression, detail withheld pending maintainer #21835 closed through PR fix(rest,metadata-protocol): a public form's intake withdrawal at any metadata layer holds; layering can only narrow intake #21864. It is the only eligible pm:queue card in this lane, and the lane runs three concurrent claims (the maintainer, verbatim: 「并发3」).
• The withheld detail (RUNNER rule 2, held in session_018zT8d8NpiQ1ExhuNd5TxY6) is neither requested nor needed. The card's classes, positions and directions are public and name each fix. The PR describes each fix only in the terms already public on this card.
  File surface (at origin/main a3bd157730), one commit and one pin per item, so any item can be dropped at review:
• Item 1 (package identity of a served org overlay). Positions: packages/metadata-protocol/src/protocol.ts (the list merge's package stamp on a package-less org overlay) and packages/metadata-core/src/anonymous-form-intake.ts (the package comparison, about :320–:340, anonymousFormIntakeWithdrawnIn). The card gives two directions: mark stamped copies in the merge, or have the doors read the org row's own package_id. The dev measures which direction holds with the smaller surface.
  • A body stored package-less is compared against every package's withdrawal.
  • If the doors must read the row's own package, packages/rest/src/rest-server.ts's anonymous form door judgement (about :10731–:10744) is touched. That is declared outside the lane, on [PM seat] domain:cli — 🟢 os-warren · session_01RWZbGvPFcRKvUqASZtunCU #6024.
• Item 2 (the publish gate and the promotion are separate reads). Positions: protocol.ts's publishMetaItem → promoteDraftForPublish and packages/metadata-protocol/src/sys-metadata-repository.ts's promoteDraft. The judged draft's hash is passed into the promotion, which refuses with a conflict when the row's hash differs.
• Item 3 (the lock lookup uses the request's package). Position: protocol.ts's publish path, the lockWriteRefusal call (about :21583). It takes the package key the gate resolved, not request.packageId. ⛔ The authoring-rule narrowing stays as it is (documented as deliberate).
• Item 4 (the write door's row anchor across packages; addendum 6008978556 puts it in scope). Position: protocol.ts's envWideRawViewRows (about :16092). The anchor is resolved per package: the saved row's own package, falling back to the package-less definition, and an artifact fallback per package, not per name. The pin covers a withdrawing package that is not first in registry order.
  • The wording that goes with it: content/docs/ui/public-data-collection.mdx:71 (the "Known limit: packages and names" sentence) is narrowed to match what lands. That is declared outside the lane, on [PM seat] domain:devx @ objectstack — 🟢 baozhoutao · session_01VDtqoecgES7ScQYGbFVDRv · R9 · landed 3 · #20004 awaits skip-changeset · in flight 0 #6023.
  • The released fix(rest,metadata-protocol): a public form's intake withdrawal at any metadata layer holds; layering can only narrow intake #21864 changeset is not edited; this card's changeset states the narrowing.
• .changeset/21934-*.md (@objectstack/metadata-protocol, plus @objectstack/metadata-core or @objectstack/rest only if touched).
  Container & model: M, mode:subagent, model: default (dispatch-gates --tier: no path-derived mandate).
  Clause-②: yes (widening)
• Revised by the seat on the dev's measurement (the os-dev-report 6011280365) at 2026-10-06T07:13Z. The claim first read no, provisionally.
• Measured on @objectstack/metadata-protocol's built entry declarations, base a3bd157730 vs head 5297072f13, with comments stripped: SysMetadataRepository.promoteDraft's opts gains expectedDraftHash?: string | null (item 2). That is an optional input field, so the surface widens. The return type is unchanged, and nothing else moves.
• @objectstack/metadata-core's anonymousFormIntakeWithdrawnIn declaration is byte-identical; its edit is docblock only.
• No contract accept set narrows. At least minor for @objectstack/metadata-protocol (item 2's changeset). A contract review at tier is owed before the PR enqueues.
• The file surface also gains the list read's view branch in protocol.ts (item 1's producer, measured there) and metadata-core's anonymous-form-intake.ts docblock. ⛔ rest-server.ts is not touched.
  Thread-read: 6009643967
  Serial constraints cleared: at 2026-10-06T05:31Z:
• Triage's serial security(forms): a public-form setting at one metadata layer can re-open intake that another layer withdrew — 17.7 regression, detail withheld pending maintainer #21835 closed completed through PR fix(rest,metadata-protocol): a public form's intake withdrawal at any metadata layer holds; layering can only narrow intake #21864.
• Open PRs, each file list read by filename, paged: chore(osv): exempt sprintf-js GHSA-hp3w-g68c-fv3c until 2026-11-05 (no fixed release exists) #21952, fix(deps): take the fixes for proxy-addr, source-map-js and katex that turn main's OSV scan red #21951 and fix(services): settings, datasource, webhook and messaging plumbing passes the explicit system opt-in instead of no principal #21940 touch none of protocol.ts, sys-metadata-repository.ts, anonymous-form-intake.ts, rest-server.ts or public-data-collection.mdx.
  • The release PR chore: version packages #21352's paged listing stopped on a proxy redirect. It touches CHANGELOGs and version lines only.
• This lane's other claim, [finding] sys_member.add_member is offered to every organization member, owners and admins included, but its door admits only a platform admin #21886 (sys-member.object.ts's add_member visibility), waits on the decision box. It shares no file with this card.