Repository navigation
security(forms): access-security.public-form-intake clause 7 (withdrawing a public form from anonymous intake) fails on 17.6.0 — detail withheld pending maintainer #21331
Description
Activity
Triage: first grade —
bug·security·priority:p1·domain:services·area:access·pm:queue. Withdrawing a public form closes its anonymous intake; detail stays withheldTriage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-02T05:54Z. ⛔ Not a claim, ⛔ not a dispatch.⛔ Classes and positions only.
Why p1. It is the verifier's grade, reproduced four times: an anonymous write path that an administrator is shown as closed. It is bounded by the form's whitelist (create-only on its fields, no read-back), which keeps it below p0.
Routing. The authorization (
plugin-security's declaration-derived public-form grant) isdomain:services. The public-form routes inpackages/rest(domain:cli) are a declared cross-lane surface if the withheld mechanism sits there.The withheld detail. Under RUNNER rule 2 the reproduction is held in the runner session. The claiming seat obtains it through the maintainer before building. It is ⛔ never restated on this card or its PR.
Direction (class-level): withdrawal is one state that every intake door reads. ⛔ No door keeps its own copy of "is this form public". Pins: a withdrawn form refuses anonymous intake on every door, and a published form still accepts it (the control). The checklist clause (
access-security.public-form-intakeclause 7) passes on a showcase boot.
Generated by Claude Code
Seat note: next free slot; waiting on the maintainer for the withheld detail ·
domain:servicesseat 2 (#21118) ·session_01DiCSbmJrkzNhuEAier4VoJ· 2026-10-02T06:39Z · ⛔ Classes and positions only- This card (p1) takes this seat's next free slot. All three are in flight now: security(flows): move a flow's inbound-hook secret out of flow metadata into the write-only secret seam #7799 established — no read, the generic data door included, returns it #20790, analytics: the ObjectQL face never applies a query's order, limit or offset (every bucketed time-dimension query lands there), while its echoed SQL and /analytics/sql render ORDER BY and LIMIT #21316, plugin-security: security.explain answers a record visible under a row-level policy that aims a JSON-column-incompatible operator at a declared JSON-stored field, while find refuses the same read with INVALID_FILTER / 400 #21319.
- As triage directs (
5946387983), the seat has asked the maintainer, in the seat's own session, for the withheld reproduction before any build. ⛔ It will not be restated here or on the PR. The dispatch carries it privately. - Routing as triage set it:
plugin-security's public-form grant (this lane).packages/rest's public-form routes (domain:cli) are a declared cross-lane surface only if the mechanism sits there.
Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ
Claim: PM loop round 1 (single-card dispatch on the maintainer's direct order)
Session:session_018zT8d8NpiQ1ExhuNd5TxY6
Account:hotlong(the seat's linked user asGET /useranswers it; always the card's assignee)
Branch:claude/issue-21331-public-form-withdrawal
Worktree:objectstack-issue-21331
Domain:domain:services(card label); the fix is expected inpackages/rest's public-form routes, the declared cross-lane surface (domain:cli) named in the triage comment5946387983
File surface:packages/rest/src(public-form routes and their tests),packages/qa/dogfood/test(a pin),.changeset/;packages/plugins/plugin-securityonly if the grant is the mechanism (stop on breach; explain in the report)
Container & model:M,mode:subagent,model: opus(default tier;dispatch-gates --tierreports no path-derived mandate)
Clause-②: no
Thread-read: 5946844217
Serial constraints cleared: noneProvenance (dispatch on another seat's queue card; this session is the QA-run session that holds the withheld reproduction, not a lane seat, so no
Seat:line): the maintainer, in Claude Code sessionsession_018zT8d8NpiQ1ExhuNd5TxY6, 2026-10-02, verbatim: 「21331 你直接派发吧 ，services 项目经理不知道细节」. This session ran #21330 and holds the reproduction, so the dispatch carries it privately.domain:servicesseat 2 (comment5946844217): this card is taken; no action needed from the seat. The withheld detail stays off this card and off the PR.
Generated by Claude Code
os-dev-report
{ "issue": 21331, "status": "done", "branch": "claude/issue-21331-public-form-withdrawal", "pr": "https://github.com/objectstack-ai/objectstack/pull/21420", "session": "session_018zT8d8NpiQ1ExhuNd5TxY6 (subagent; the parent's id)", "premise_still_valid": true, "summary": "Withdrawing a public form from anonymous intake now takes effect on every intake door. Both anonymous form routes resolve the form through one shared resolution that reads the same state the administrator's editor shows. That resolution fails closed when a service it depends on is registered but unreachable. Pinned both sides by a packages/rest unit file and a live showcase dogfood file. Checklist access-security.public-form-intake acceptance[6] (clause 7) fails on origin/main 6d67ad5e and passes on this branch. The specifics stay off GitHub per RUNNER rule 2 and went to the dispatching seat privately.", "tests": "At HEAD 4d4d342a. (1) pnpm --filter @objectstack/rest typecheck: green (tsc + check:test-typecheck OK). (2) rest full vitest: 260 files, 4988 passed / 317 skipped. (3) New unit file public-form-withdrawal.test.ts: 6/6. (4) Dogfood: showcase-public-form-withdrawal + showcase-public-form + public-form-read-back-masking + form-self-auth + showcase-anonymous-deny + authz-conformance: 6 files / 72 tests passed. (5) Ablation from the committed fix, run through ablation-replace.mjs --hold. The mutation landed (anchor 1 -> 0, blob d9839fb3 -> 98dcafa3); pnpm --filter @objectstack/rest build; ablation-dist-preflight showed the marker in dist/index.js and dist/index.cjs. Unit result: 3 failed / 3 passed. Dogfood result: 1 failed / 3 passed. Restore: git checkout HEAD, hash-object equal to the HEAD blob, git diff HEAD empty, rebuilt, --absent preflight clean (working tree clean). The first attempt's marker was constant-folded out of dist/ and its preflight failed (exit 1), so that run is void. (6) Clause 7 by hand on objectstack dev --seed-admin: FAIL on main, PASS on the branch; the result also holds after a restart. (7) dispatch-gates --commands derived 68 families; all 68 recorded with exit codes, and --ran reconciles. 66 exit 0 (check:type-check-debt timed out at 240s unlocked, then exited 0 under the lock: 1 ledger entry re-measured, 26 errors, none above its record). 2 are NOT MEASURED because the prerequisite was not met (exit 3): check-plugin-teardown-shape --self-test needs an unshallow clone; check:dual-build-cjs-loads needs every package's dist/. (8) ESLint ran on the 3 touched TS files only: 0/0. Population: the 3 files named. Count: 3 entries in the --format json output. Invariance: the config enables no type-aware linting. pnpm lint itself is CI-owned. Integration of the merge with main is left to CI.", "mcp_calls": "0", "api_writes": "2 — git push (branch, 6 pushes); POST /repos/objectstack-ai/objectstack/pulls (draft, via the fleet-write relay, request fw-20261002T135805Z-4d882d); plus this os-dev-report comment. The PR-assignee write (label-write --issue 21420 --assign hotlong) was refused by the session's auto-mode classifier (External System Writes) before any request was sent; it was not retried by another route. Handed to the seat.", "open_questions": [ { "question": "A deployment shape outside this card's reproduction has no single owner for an anonymous request. This PR leaves that shape's behaviour unchanged. Should a withdrawal there be honoured on the anonymous doors, and how?", "options": ["A: leave unchanged (env-wide state governs those doors)", "B: both anonymous doors refuse on that shape", "C: refuse the scoped withdrawal at authoring time on that shape, loudly"], "recommendation": "C. The editor stops showing a state the doors cannot honour, and no deployment's working intake is closed by surprise. The details went to the dispatching seat privately." } ], "out_of_scope_findings": [ "carrier: the dispatching seat. On an unreachable dependency, GET /forms/:slug answers its pre-existing 500 FORM_RESOLVE_FAILED with the thrown message, while the submit answers 503 SERVICE_UNAVAILABLE. Two dialects for one fail-closed outcome. Noted, not filed (a pre-existing envelope of that route)." ], "deviations": [ "The PR assignee (card assignee hotlong) is not set. The classifier refused label-write; the seat should set it.", "Labels: zero writes. The dispatch named no labels, and skip-changeset does not apply because a changeset is present." ] }
Generated by Claude Code
Review: ACCEPT — PR #21420
Reviewing seat: the dispatching session
session_018zT8d8NpiQ1ExhuNd5TxY6(class-level only; the withheld detail stays off GitHub).- Diff read (
get_files, head4d4d342a): 4 files —packages/rest/src/rest-server.ts, apackages/restunit pin, apackages/qa/dogfoodlive pin, one patch changeset. No governed surface, nopackages/spec, 409 changed lines. - Contract: both anonymous intake doors read the form through one resolution; fails closed when a registered dependency is unreachable; the no-tenancy composition is unchanged. Matches the triage direction (one state every intake door reads).
- Pins both sides: withdrawn → both doors
404 FORM_NOT_FOUND, nothing written; published → accepted (control). Ablation reds both pins; restore clean. - Acceptance: checklist
access-security.public-form-intakeacceptance[6] fails onmain, passes on the branch (by hand, showcase boot, survives restart). - CI: every check on the head green or an expected skip.
- Out of scope, routed: one deployment shape the fix deliberately leaves unchanged is carried by a follow-up card (linked when filed). The maintainer chose the direction in session (verbatim): 「按照你的建议继续，开发完整就进队列合并」.
Landing: ready + auto-merge through the merge queue, on that instruction.
Generated by Claude Code
- Diff read (
- added 3 commits that reference this issue
on Oct 7, 2026
QA-source: #21330 · access-security.public-form-intake · acceptance[6]
The 17.6.0 release-verification run #21330 (subject
617f25f8, Console31971ff1e28f) failed clause 7 ofaccess-security.public-form-intake(rev 2): the both-sides contract for withdrawing a public form from anonymous intake does not hold on a stock showcase boot.session_018zT8d8NpiQ1ExhuNd5TxY6) and reported to the maintainer there.objectstack.Full run evidence (per-clause table; this clause's row carries the same withholding): #21330.
Generated by Claude Code