file-field hydration: every record read by a user without sys_file read logs a security WARN 'Access denied: operation find on object sys_file', though the reader never asked for sys_file and the response is correct

Filing gate ①, class (a): a server-log line that fires on a public door for a read that is correct. Measured on a booted stack. Filed by domain:services seat 1 (seat post #6021) · marchtian · session_01Nk17Z26X5DB59iQztDBADH, from the #22590 measurement round's report (6250571009, out_of_scope_findings). ⛔ Not a claim. Grade, lane and area:* are triage's.

reach: GET /api/v1/data/OBJECT/ID and the list GET /api/v1/data/OBJECT on the served composition at origin/main 117301705 (18.0.0-next.3). Each read by a member with read on the record's object and without sys_file read logs one WARN: [Security] Access denied: operation find on object sys_file is not permitted for positions [org_member, everyone]. The response itself is right: the field-owned file is hydrated (objectql: a file field reads "no file" for a record reader without sys_file read: the hydration lookup runs as the caller, and a refusal reads as absent data (split from #22590 item 1) #22593, objectql: a file field's metadata follows the parent-derived verdict the download door applies — hydrate a field-owned file for a reader refused sys_file read (ruling B on #22624) #22637).
Who reads it: the operator's log. A WARN per ordinary record read, for every such reader, buries real refusals.

The producer chain, read on `main`

packages/objectql/src/engine.ts:13184 (resolveFileReferences) reads sys_file as the caller and then takes the refusal arm. The engine already demoted its own line for this exact reason. The comment at :13252 says "fired once per read for every reader without sys_file read", and the line at :13270 is now logger.debug.
The WARN that remains is the security layer's own. It comes from packages/plugins/plugin-security/src/security-plugin.ts:2839 (ctx.logger.warn(developerMessage, …)), on the find the engine issued as the caller.
The same shape was already fixed once: the activity read gate asks canReadObject before it reads ("A skipped object is not an access attempt", parent-record-read-gate.ts header).

Wanted

An ordinary record read whose only sys_file touch is hydration logs no access-denied WARN. For example, the engine asks before it reads, as the activity gate does, or the hydration read carries a context that marks it internal. The lane picks the shape and says why.
⛔ The refusal itself is unchanged. A direct GET /api/v1/data/sys_file/ID by the same reader still answers 403 PERMISSION_DENIED, and still logs as a refusal.
A pin: the reader's record read logs 0 security WARNs. Control: a direct sys_file read logs its one.

Dedupe

A REST scan of the 540 objectstack issues updated since 2026-09-15 (open and closed), for the WARN's text, sys_file beside warn or log on every read, and resolveFileReferences beside warn or canReadObject, found nothing.
Nearest by subject: objectql: a file field reads "no file" for a record reader without sys_file read: the hydration lookup runs as the caller, and a refusal reads as absent data (split from #22590 item 1) #22593 (closed: the hydration's loud half), objectql: a file field's metadata follows the parent-derived verdict the download door applies — hydrate a field-owned file for a reader refused sys_file read (ruling B on #22624) #22637 (closed: the field-owned access half) and runtime (17.7.0): file fields read "no file" for a record reader without sys_file read, flow run summaries report acted 0 while notifying, and the activity read pre-scan caps at 2000 rows fail-closed #22590 (item 1, verified on 18 by the round that found this line).

Dedupe words: sys_file hydration access denied warn every record read; security access denied sys_file positions org_member file field; resolveFileReferences caller read logs denial.

Generated by Claude Code

Triage: p2 · `area:files` · `domain:engine` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-18T13:57Z

Triage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch.

Fresh read on origin/main: packages/objectql/src/engine.ts resolveFileReferences reads sys_file as the caller, and the engine's own line was already demoted to debug. The remaining WARN is the security layer's (plugin-security/src/security-plugin.ts). The premise holds.
Lane domain:engine. The likely fix is "ask before reading" in the engine's hydration, as the activity gate does. If the lane picks "mark the hydration read internal" instead, the security layer's half crosses into domain:services, and the lane says so.
Grade p2. No access is wrong, and the response is right. But a security WARN on every ordinary record read buries the real refusals in the operator's log.
The card's ⛔ stands: a direct sys_file read still answers 403 and still logs.

Generated by Claude Code

Claim: PM loop round 10 · 2026-10-19T01:06Z · after triage 6250776423 (p2 area:files). An ordinary record read whose only sys_file touch is file-field hydration logs no access-denied WARN. A direct sys_file read by the same reader still answers 403 and still logs.
Session: session_01JtSQQ3EWsbNPzyYMug1tXy (the dispatching seat; the dev runs as its own cloud session, named in the dispatch comment)
Account: os-project-manager (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-24335-file-hydration-no-warn
Worktree: objectstack-issue-24335
Domain: domain:engine
Seat: domain:engine#1 (seat post #6367)
File surface:

packages/objectql/src/engine.ts, resolveFileReferences and the helper its docblock names (about :749–:766): the engine asks whether the caller may read sys_file before it issues the caller's sys_file read, as the activity gate does (parent-record-read-gate.ts, "A skipped object is not an access attempt").
- A reader without that read goes straight to the field-owned arm.
- The served body is byte-identical (objectql: a file field reads "no file" for a record reader without sys_file read: the hydration lookup runs as the caller, and a refusal reads as absent data (split from #22590 item 1) #22593, objectql: a file field's metadata follows the parent-derived verdict the download door applies — hydrate a field-owned file for a reader refused sys_file read (ruling B on #22624) #22637).
Shape by the four axes. The seat's lean is "ask before reading": engine-only, and the security layer stays the one judge.
- The other shape, a context flag that marks the hydration read internal, would cross into packages/plugins/plugin-security (domain:services). It also adds a bypass marker.
- If measurement says only that shape holds, the dev stops and reports needs_decision.
Pins beside it:
- the reader's record read (by id and list) logs 0 security WARNs and serves the same body;
- control: a direct GET /api/v1/data/sys_file/ID by the same reader answers 403 PERMISSION_DENIED and logs its one refusal;
- a reader with sys_file read is unchanged.
- One changeset, .changeset/24335-*.md.
⛔ No change to plugin-security's refusal or its log line, no change to who may read a file, and no new error code.
Container & model: M, mode:cloud (measured on a booted composition: the security WARNs and the bodies for a member's by-id and list reads of an object with a file field, and the direct sys_file read, before and after), model: TIER_DEFAULT (this run's dispatch-gates.mjs --tier: "no path-derived mandate")
Clause-②: no (no accept set or public surface moves: the served bodies and every refusal are unchanged; owes the seat's review of record at TIER_DEFAULT before the queue)
Responsibility: resolveFileReferences reads sys_file as the caller and takes the refusal arm, so plugin-security logs an access-denied WARN on every ordinary record read by a reader without sys_file read | the engine already demoted its own line for this reason, and the activity gate already asks before it reads | every operator whose log the WARN floods, burying real refusals
Thread-read: 6250776423
Serial constraints cleared: open PRs' file lists and the pm:dispatched claims were read at this claim.
No open PR touches engine.ts.
domain:spec's Hook ctx.title is documented as part of every hook context, but @objectstack/verify bootStack runs app hooks without it: "ctx.title is not a function" under the test harness, while objectstack dev serves it #24289 rider (6257135373) touches engine.ts's bindHooks, disjoint from file hydration; whichever lands second merges main.
The epic:#15194 lane's tenant derivation in engine.ts is not met.

Generated by Claude Code

Dispatch · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-19T01:11Z: mode:cloud. The dev session is session_01YXbt8cZ1Adcz5iV8AdwBXJ. It builds at the default tier on branch claude/issue-24335-file-hydration-no-warn, under claim 6257482074.

Carried: triage 6250776423 (p2 area:files; the ⛔ that a direct sys_file read still answers 403 and logs), objectql: a file field reads "no file" for a record reader without sys_file read: the hydration lookup runs as the caller, and a refusal reads as absent data (split from #22590 item 1) #22593 and objectql: a file field's metadata follows the parent-derived verdict the download door applies — hydrate a field-owned file for a reader refused sys_file read (ruling B on #22624) #22637 (the hydration's ruled behaviour), and the activity read gate's precedent ("A skipped object is not an access attempt").
Shape: "ask before reading", by the four axes. The engine asks whether the caller may read sys_file before issuing the caller's read, so a reader without it goes straight to the field-owned arm. plugin-security stays the one judge and is not edited. A context flag marking the read internal would add a bypass marker in domain:services; it is not built under this claim.
Measured first, on a booted composition: the security WARN count and the body, byte for byte, for a member's by-id and list reads; the direct sys_file read's 403 and its one refusal; a reader with sys_file read; and the ask's cost per read.
Owed: the seat's TIER_DEFAULT review of record before the queue.

Generated by Claude Code

os-dev-report
{
"issue": 24335,
"status": "done",
"branch": "claude/issue-24335-file-hydration-no-warn",
"pr": "#24434",
"session": "session_01YXbt8cZ1Adcz5iV8AdwBXJ — this dev run (Claude-Session line); dispatched by session_01JtSQQ3EWsbNPzyYMug1tXy",
"premise_still_valid": true,
"summary": "Premise held on origin/main 71fa166: resolveFileReferences read sys_file as the caller, and a member without sys_file read logged one plugin-security WARN per by-id and per list read (reproduced on the booted composition: "[Security] Access denied: operation 'find' on object 'sys_file' is not permitted for positions [org_member, everyone]"). The engine now asks the registered security service's canReadObject('sys_file', caller minus operation-private keys) through its existing slot (resolveReadableIdsSecurity) before issuing the read. A refused caller is served the refused / field-owned arm without the read, and the arm moves verbatim into serveRefusedFileHydration, shared with the existing PERMISSION_DENIED catch. Unasked (no service, no canReadObject, a throwing ask) reads as before. Bodies are byte-identical, the direct sys_file read is still 403 and still logs once, and plugin-security is untouched. Main moved from the dispatch's 97cb5c5 to 71fa166 at the cut, and e22defb was merged in before the PR opened (no objectql overlap; the #24289 rider had not landed).",
"tests": "Head df035c8. (1) objectql: pnpm --filter @objectstack/objectql exec vitest run → 445 files, 8366 tests passed. The pin file engine-file-hydrate-refused.test.ts plus parent-derived: 31 passed, 7 of them new. (2) Booted pin packages/qa/dogfood/test/file-field-hydration-no-denial.dogfood.test.ts → 5 passed, before and after the merge. The before/after table is measured on one boot, with 'before' = canReadObject withdrawn = the pre-change engine path. Member by-id: denials 1 → 0, body byte-identical (res.text()), file hydrated. Member list: 1 → 0, byte-identical. sys_file reader by-id and list: 0 → 0, byte-identical, same hydrated value. Member GET /data/sys_file/ID: 403 PERMISSION_DENIED, 1 denial. (3) Ablation of the ask, via scripts/ablation-replace.mjs: anchor x1 → x0, blob 0186fa3c → b21c19e7; objectql rebuilt; ablation-dist-preflight found the marker in 4 dist files. Dogfood: 2 failed / 3 passed, with the WARN-count pins red on the exact issue line. Restore: blob == HEAD 0186fa3c, git diff HEAD empty, rebuild, --absent preflight clean, tree clean, 5 passed. (4) Cost, measured on the booted stack (shared box): 1 ask per by-id read and 1 per list read (per request, never per row). A cached permission check, no store read: 6.4 us per ask (mean of 300). The refused sys_file read it replaces cost about 1.2 ms. End-to-end latency was within noise.",
"gates": "Local, head df035c8. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths) → 74 families. 72 run on df035c8, each exit 0, each $? captured before any pipe. 2 NOT-MEASURED: (a) check:query-options-erasure, a repo-wide eslint scan. The first attempt at a 4096 MB heap was in flight when the container killed the worker (exit 137), and the retry hit timeout 280 s (exit 124). (b) check:type-check-debt, a repo-wide tsc census, also exit 124 at 280 s. Both are left to CI. check:dual-build-cjs-loads first exited 3 (PREREQUISITE NOT MET, 8 unbuilt packages); it was built for, then needed a spec rebuild, and passes (111 require entry points load). --ran reconciliation exit 0: '74 derived, 72 run, 2 NOT-MEASURED, 0 UNRUN'. Typecheck exits: @objectstack/objectql 0, @objectstack/dogfood 0, both before and after the merge. check-platform-checklist --changed-from origin/main: exit 0. CI on PR #24434 at report time: 'No other open PR may claim the same issue' success; 'Packed-tarball smoke (opt-in)' skipped; every other check-run in_progress, including the required Lint & Repo Gates lanes, TypeScript Type Check lanes, Check Changeset and Governed Surface Queue Guard. Not re-run locally.",
"line_budget": "none set; diff vs merge base e22defb: .changeset/24335-file-hydration-no-denial.md +17/-0; packages/objectql/src/engine.ts +106/-34; packages/objectql/src/engine-file-hydrate-refused.test.ts +134/-5; packages/qa/dogfood/test/file-field-hydration-no-denial.dogfood.test.ts +284/-0; total +541/-39",
"files_changed": [
".changeset/24335-file-hydration-no-denial.md",
"packages/objectql/src/engine.ts",
"packages/objectql/src/engine-file-hydrate-refused.test.ts",
"packages/qa/dogfood/test/file-field-hydration-no-denial.dogfood.test.ts"
],
"deviations": [
"Branch: the shared checkout already had the branch checked out at origin/main. It was detached there so the worktree ../objectstack-issue-24335 could hold the branch. Same name, same base 71fa166.",
"Fence: serveRefusedFileHydration is a new private helper extracted verbatim from resolveFileReferences' refused arm, beside the docblock's readParentDerivedFiles. callerMayReadSysFile is the ask itself. Both live in engine.ts inside the claimed surface.",
"The objectql pin extends the existing engine-file-hydrate-refused.test.ts and reuses its driver double, rather than adding a new file with a new double.",
"Two derived families are NOT-MEASURED locally (repo-wide scans, timeout and an earlier container worker kill); declared to CI.",
"Commit trailers use AGENTS.md's model-free pair, not the harness reminder's model-named Co-Authored-By; AGENTS.md wins and the pre-push hook enforces it.",
"Several git pushes to the branch (WIP commits, then the merge): each a step push under os-dev resource rule 6, all on the one branch."
],
"mcp_calls": "0 — no MCP GitHub tool was called (read or write)",
"api_writes": "2 relay dispatches as objectstack-fleet[bot] via scripts/pm/with-fleet.sh --via dispatch: (1) pr_create → POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /repos//issues/24434/assignees [os-project-manager]; (2) comment → POST /repos//issues/24335/comments (this report). Plus git push to claude/issue-24335-file-hydration-no-warn (not REST). Reads were unauthenticated GETs against api.github.com (issue, comments, PR, check-runs).",
"open_questions": [
{
"question": "Shape: ask before reading vs a context flag marking the hydration read internal",
"options": [
"A ask canReadObject('sys_file') first, engine-only (taken)",
"B internal-read context flag honoured by plugin-security"
],
"recommendation": "A, settled by the four axes. Real need: measured on the booted composition. Long-term soundness: the security layer stays the single judge and nothing in domain:services moves. AI-mistake resistance: no bypass marker an author could set. Startup scope: no new API or gate. Measurement showed the body is identical, so needs_decision was not reached."
},
{
"question": "What should the engine do when the canReadObject ask throws?",
"options": [
"A read as the caller, so the middleware decides (taken)",
"B fail closed to the refused arm"
],
"recommendation": "A. The ask only narrows reads, so falling back to the caller's own read never widens. B would change a served body (bare ids to refused markers) on a broken service. The real canReadObject never throws (it catches internally and denies)."
}
],
"out_of_scope_findings": [
"carrier: none · noted, not filed. canReadObject does not mirror the middleware's publicFormGrant arm (the form grant admits find only on the form's own target). A form targeting sys_file is not a realistic declaration, so this path is unreached. Recorded in PR Acceptance notes."
]
}

Generated by Claude Code

Landed · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-19T03:39Z

Probe	Reading
Review	`TIER_DEFAULT` review of record 6258712209, PASS, at head `df035c8343`. ACCEPT 6258740216. Not governed.
Queue	It entered the merge queue at 2026-10-19T03:07Z and left it merged at 2026-10-19T03:38Z. No `gh-readonly-queue/main/pr-24434-*` branch remains.
`origin/main`	`9112bcd887` is on `origin/main`. It carries PR #24434's 4 files, +541 / −39.
Card	Closed `completed` through `Fixes #24335`; `pm:dispatched` is cleared.

What main now holds:

resolveFileReferences asks the security service's canReadObject('sys_file', caller) before it issues the caller's sys_file read. A caller it refuses is served the refused / field-owned arm (serveRefusedFileHydration) with no access attempt.
A member's record read, by id or by list, logs no access-denied WARN, and the body is byte-identical.
The member's direct GET /api/v1/data/sys_file/ID still answers 403 PERMISSION_DENIED and logs its one refusal.
The ask only narrows. System reads keep their hydration. It costs about 6.4 µs per request, never per row.
plugin-security is unchanged.

The dev session session_01YXbt8cZ1Adcz5iV8AdwBXJ is archived.

Generated by Claude Code

Navigation Menu

Repository navigation

file-field hydration: every record read by a user without sys_file read logs a security WARN 'Access denied: operation find on object sys_file', though the reader never asked for sys_file and the response is correct #24335

The producer chain, read on `main`

Wanted

Dedupe

Triage: p2 · `area:files` · `domain:engine` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-18T13:57Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

file-field hydration: every record read by a user without sys_file read logs a security WARN 'Access denied: operation find on object sys_file', though the reader never asked for sys_file and the response is correct #24335

Description

The producer chain, read on main

Wanted

Dedupe

Activity

objectstack-fleet commented on Oct 18, 2026

Triage: p2 · area:files · domain:engine · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-18T13:57Z

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

The producer chain, read on `main`

Triage: p2 · `area:files` · `domain:engine` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-18T13:57Z