Repository navigation
[3 of #7891] Flip the registration: runtimeTypes gains object + permission/book — whole rule families cross the publish door #8310
Description
Activity
pm:blockingcache applied by the triage sweep — this card has an open downstream dependent: #8547 (pm:blocked, itsBlocked-by: #8310line is in that card's body; the corrected test prose there must be restated in terms of whateverobjectdecision is taken here). Derived from the reverse index at read time, per the cache rule; remove together with the dependency when this card's decision lands. — triage seat Routine.
Generated by Claude Code
Maintainer ruling recorded — Q1 answered: option A. Authored-OWD-required at the runtime object door. Provenance: maintainer live session, 2026-08-13 ~23:50Z, verbatim 「接受你的全部建议」, accepting this seat's four-prism briefing of the full decision box (this card's briefed recommendation was A, matching both the dev report and the spec seat's escalation block).
The ruling, spelled out for dispatch (per the accepted recommendation):
- Rule that an authored OWD is required at the runtime object door — a no-OWD write silently defaulting to
privateis a decision the author never made; the runtime door stops being permanently weaker than the CLI. - Repair the ~16 objectql/rest test files honestly (add authored
sharingModel), re-pinmeta-object-owd-gateto the new door order (422 lint answers first). - ADR-0094 R2's external-wider half is retired as duplicate of the lint door in the same change; R1 (env-tighten-only) stays. The ADR text amendment rides the implementation PR —
docs/adr/**touched ⇒ that PR is maintainer-merged per the standing guardrail. - Then declare
objectinruntimeTypes— as its own card per the accepted plan; the spec seat files it (or converts this card's remainder) with the crossing pins the parent programme requires.
Housekeeping:
needs-user-decision→pm:queue; assignee cleared — the prior claim's deliverable (PR #8546, partial flip) was reviewed, ACCEPTED and MERGED, so the claim is spent; the remainder is fresh work under this ruling.pm:blockingretained: #8547's corrected test prose is now writable in terms of this ruling and unblocks when theobjectdeclaration lands.Dispatch note: acceptance-surface change at the publish door ⇒
claude-fable-5mandatory (clause ②), as the card's own constraints section already states.Recorded by the triage seat on the maintainer's direct channel.
Generated by Claude Code
- Rule that an authored OWD is required at the runtime object door — a no-OWD write silently defaulting to
- added 6 commits that reference this issue
on Aug 17, 2026
Programme slice of #7891 (split by the
domain:specseat, sessionsession_01Euoy6wyfzgiWtgCg4s6JK2). Final slice — the actual strictness flip.Blocked-by: #8308
Blocked-by: #8309
Scope
With blocker A repaired (#8308) and the
permission/bookwiring in place (#8309), flip thevalidateSecurityPostureregistration so the remaining rule families enforce at the runtime publish door (runtimeTypesgainsobject,permission,book), with pins recording each family's crossing. The ADR-0091 seed pair will already have crossed via #8307.Constraints (inherited from the parent, binding)
security-role-wordwiring — it judges six collections; it crosses whole or stays behind, stated explicitly either way (the [finding] The fourviews[]visibility-predicate rules are CLI-only — a Studio/REST/MCPviewwrite bypasses all of them; if they move to runtime-publish, they must move together #7220 failure shape is one rule id split across the wall).packages/lint/src/validate-security-posture.runtime-surface.test.tsis the executable measurement to extend.claude-fable-5clause applies at dispatch.Re-price on unblock (standard)
When #8308/#8309 close, re-verify this card's file surface on the merged ref before dispatch — the upstream landings are the most likely thing to have absorbed or reshaped this slice.
Part of #7891.