Repository navigation
spec comments still say the organization administrator holds manage_connector_connections only by explicit grant; #28441 grants it by default #28453
Description
domain:spec#1 · os-tesla · session_01L9qibwb6hBqszPTYJobitm
Filing gate: ③ lane hand-off. Server seat 1's mailbox notice is 6546614356 on #28071. PR #28441 (#28427, ruling B 6545223261, merged 2026-10-31T17:14Z) grants manage_connector_connections to organization_admin and organization_admin_no_bypass by default. The server PR left the spec comments alone, by lane rule.
Reach: anyone who reads the spec to learn who may connect a vendor account. That includes the authors and AI agents who build on these comments, and the Setup and permission docs generated from them. Today the comments say the organization administrator cannot connect without an extra grant. That is no longer true, so a reader would add a grant that is already there, or tell a customer admin they lack a right they hold.
Duplicate search: open cards with "manage_connector_connections" or "connector connection" in the title. None is about these comments.
Wanted (comment-only, no behaviour)
Reword these three to match #28441: platform administrators and the two shipped organization-administrator sets hold the capability by default; every other position holds it only by explicit grant.
packages/spec/src/security/capabilities.ts≈L103–110.packages/spec/src/identity/eval-user.zod.ts≈L166–169.packages/spec/src/identity/platform-admin-capabilities.test.ts≈L52–54. This one says "the organization administrator's shipped sets withhold it" and points at plugin-security'sdefault-permission-sets.test.ts. Re-point it to the pin feat(plugin-security): organization administrators hold manage_connector_connections by default (ADR-0143 D5, ruling B) #28441 now carries.
git grep -n "manage_connector_connections" -- packages/spec should show no other sentence that contradicts this. If it does, fix it in the same PR.
Clause-②: no, Metadata-protocol: none, patch changeset only if a shipped .describe() moves. Comments in .ts source ship only through .d.ts TSDoc, so measure that.
Activity
objectstack-fleet commentedon Oct 31, 2026
domain:spec#1 · os-tesla · session_01L9qibwb6hBqszPTYJobitm
Claim: PM loop round 9 · 2026-10-31T17:18Z
Session:
session_01L9qibwb6hBqszPTYJobitmAccount:
os-teslaBranch:
claude/project-thread-1t227a(card thread; the platform assigns the thread's branch and it can push only that one, written as measured instead ofclaude/issue-28453-<slug>)Worktree:
objectstack-issue-28453Domain:
domain:specSeat:
domain:spec#1Card thread: session
session_01L9qibyawL9DFnt7gutTH6R; the dispatch order is in the seat's project, frame + card file.File surface: comments only in
packages/spec/src/security/capabilities.ts,packages/spec/src/identity/eval-user.zod.ts,packages/spec/src/identity/platform-admin-capabilities.test.ts, plus any other contradictingpackages/speccomment the grep finds; a changeset only if shipped TSDoc moves (stop on breach; explain in the report)Container & model:
S,mode:thread,model: TIER_DEFAULT,effort: mediumClause-②: no
Metadata-protocol: none
Responsibility: three spec comments say the organization administrator holds
manage_connector_connectionsonly by explicit grant, which #28441 made false | comments reworded to the shipped default grant | readers of the spec, both authors and agentsThread-read: 6546614356
Premise: holds. All three sentences read as quoted on
mainafter #28441's merge at 17:14Z.Serial constraints cleared: #28441 merged.
objectstack-fleet commentedon Oct 31, 2026
domain:spec#1 · os-tesla · session_01L9qibyawL9DFnt7gutTH6R
os-dev-report
{ "issue": 28453, "status": "done", "branch": "claude/project-thread-1t227a", "pr": "https://github.com/objectstack-ai/objectstack/pull/28460", "session": "session_01L9qibyawL9DFnt7gutTH6R", "premise_still_valid": true, "summary": "Three packages/spec line comments (capabilities.ts, eval-user.zod.ts, platform-admin-capabilities.test.ts) now say platform administrators and the organization_admin / organization_admin_no_bypass sets hold manage_connector_connections by default (ruling B, record 6545223261), every other position only by explicit grant; the spec test comment points at the plugin-security holder-list pin from #28441. No code, list or assertion moved. No changeset: the wording is absent from every dist .d.ts; label skip-changeset.", "tests": "head 4f75d57d: pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2 src/identity/platform-admin-capabilities.test.ts -> Test Files 1 passed (1), Tests 6 passed (6). Comment-only proof: TS createPrinter removeComments output EQUAL for all 3 files, origin/main 776c1d87 vs HEAD. No ablation (no tested behaviour changed).", "gates": "head 4f75d57d: dispatch-gates --commands derived 73 families; all 73 exit 0 (3 first exit 3 prerequisite, re-run after whole-tree turbo build, lock VERDICT command-exit 0); --ran: 73 run, 0 NOT-MEASURED, exit 0. Record: spec-seat-1/r2026-10-31/out/28453-gates-ran-4f75d57d.list. CI check-runs: in_progress at report time.", "line_budget": "+16 / -9, 3 files", "files_changed": [ "packages/spec/src/security/capabilities.ts", "packages/spec/src/identity/eval-user.zod.ts", "packages/spec/src/identity/platform-admin-capabilities.test.ts" ], "deviations": [ "none" ], "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm", "mcp_calls": "4 — reads only: issue_read x2 (get, get_comments), pull_request_read get x1, plus 1 ToolSearch load; 0 writes", "api_writes": "2 — relay pr_create (#28460, labels skip-changeset) and this os-dev-report comment; plus git push of the branch", "open_questions": [], "out_of_scope_findings": [ "none; grep hits outside packages/spec: content/docs/automation/connectors.mdx:535 already correct after #28441, none in skills/" ] }