feat(plugin-security)!: the boot writes no sys_permission_set row (#15204 stage 6b-2)

[objectstack-fleet]

Part of #15204
Clause-②: yes (narrowing)

Stage 6b-2: the boot writes no sys_permission_set row. The declared-permission seeder, the platform-default materialization, the permission publish materializer, the metadata:reloaded re-seed and the organization-creation hook are deleted, with drift, the seed refusal diagnostics and the managed_by normalizer ("only delete, never fix", batch #310 item 4). This PR leaves #15204 open: stages 7a, 7b, 8, 8-post, C7b and 6c remain.

Landing — draft until all of these land

• Gates first, per the seat (6110777865, 6111348289): the user-page pickers ([Decision] 用户页「分配岗位」「授予权限集」两个选择器改读注册表：加规范字段（A/A'）、去掉用户页入口（B1），还是给授权的名称字段配注册表选择控件（B2） #22865), objectui PR-3 (grant by name), stage CD (feat(runtime): POST /security/permission-sets/:name/clone, the permission-set clone door (#15204 stage CD) #22881) and objectui PR-4 (the clone client). This PR does not wait for them to build.
• Then land back to back: T1 (test(plugin-security): retire the declared-permission seeder suites (#15204 stage 6b-2, T1) #22897) → T2 (test(dogfood): fixtures read permission sets from the security catalog (#15204 stage 6b-2, T2) #22898) → this PR. T1 and T2 stay drafts until then, so the publish materializer and the seeders are never live on main with their pins gone. 6b-2a (feat(cli)!: delete os meta resync and the example position binders (#15204 stage 6b-2a) #22899: os meta resync and the example binders, Tier H) is independent and goes to the maintainer separately.
• Size. T1 and T2 (and 6b-2a) were split off so this diff falls under 3,000 lines. This branch carries their bytes. Measured residual once all three are on main: 2,994 changed lines (34 files, +439 / −2,555). That is close to the line, so any growth here needs re-measuring. Until then GitHub shows the whole branch.
• Merge notes for when main is merged in after the precursors:
  • inert-wirings.test.ts and schema-migrate.lazy-driver-import.test.ts conflict with feat(cli)!: delete os meta resync and the example position binders (#15204 stage 6b-2a) #22899's later comment fixes; take feat(cli)!: delete os meta resync and the example position binders (#15204 stage 6b-2a) #22899's side.
  • scripts/engine-double-contract.pinned.json: regenerate with node scripts/check-engine-double-contract.mjs --write.
  • The two *.baseline.json ledgers: drop every entry for a deleted suite.
• Tier H while the 6b-2a content rides here (skills/objectstack-platform/references/operations.md). After feat(cli)!: delete os meta resync and the example position binders (#15204 stage 6b-2a) #22899 lands and main is merged, this diff touches no governed path, and size alone decides the terminal.

What changes

Surface	Before	Now
bootstrap-declared-permissions.ts (522 lines)	seeded every declared set as a managed_by:'package' row, once per organization under a wall	deleted
bootstrap-platform-admin.ts	seeded the platform defaults insert-once; resync reconciled them	writes no catalog row. It reads the legacy admin_full_access row only for leg C (a grant written before the name column; restrict-only). A refused read withholds the promotion and says so once. No resync option, no seeded / resynced / resyncSkipped
permission publish materializer (SP)	upserted a package-door publish into a row; ran the suggestion reconcile and everyone's re-derivation only when it materialized and the body carried isDefault	deleted. The reconcile and the re-derivation hang off onMetadataMutation: every landed permission publish, direct save or delete, unconditionally. Drafts and other types do nothing (closes U2 contract flag A, 6109964380)
metadata:reloaded re-seed, organization-creation hook (SP)	re-seeded rows after a hot install and per new organization	deleted
permission-set-drift.ts, normalize-managed-by.ts, seed-refusal-diagnostics.ts	boot diagnostics over the seeded rows	deleted; their public exports go (listed in the changeset)
warnOrganizationLessRows, catalogIsPerOrganization, listSeedOrganizationIds (organization-scope.ts, internal)	the per-organization sweep and the organization-less row guard; the seeder was their one caller	deleted (re-measured: no live caller, no test)
sys_permission_set.drift_status / drift_detail and the Needs Attention view	written by drift	removed with their writer (translations regenerated). The packaged-overlay report still names a shadowed set at boot
readDeclared	exported by the seeder	re-homed into declared-capability-context.ts (its two readers: the capability context and the managed-object write denies). It is a read of the registry, the catalog's one home, never of a row, so not a transition piece. createSecurityCatalogReader does not fit: it refuses the object type, and switching the capability read to it would change a fail-closed answer into a throw on the ADR-0090 D5 gate

Who still needed the rows: measured, and answered before this stage

Every grant writer and the user-page grant picker write the name since 6b-2-pre (#22863). The remaining row readers on this head:

• The restrict-only legacy reaches (the leg-C id read, org-admin revoke, uninstall sweep). An existing database keeps its rows until C7b.
• Setup's grant picker still lists rows. A fresh database now lists none there. That is the [Decision] 用户页「分配岗位」「授予权限集」两个选择器改读注册表：加规范字段（A/A'）、去掉用户页入口（B1），还是给授权的名称字段配注册表选择控件（B2） #22865 gate above.
• 7a's projector and write-through (data-door edits of existing rows). 7a deletes them.

Pins

• builtin-positions.boot.test.ts (real plugin boot, real SQLite, every scenario): zero sys_permission_set rows after boot, with a positive census control. The first platform administrator (single) and the organization administrator are still granted. The grant golden is unchanged, with no row at all.
• grant-permission-set-name.writers.test.ts: the promotion leaves zero rows and the holder reads by name. The 6b-2-pre pins stay green: organization admins under a wall and under single on zero rows; self-registration and the verify persona in their packages.
• everyone-rederivation-on-permission-mutation.test.ts: one listener even across a bootstrap re-run. Publish and delete of a permission re-derive; a draft or another type does not.
• U2's suggested-binding-acceptance.dogfood.test.ts stays green.
• showcase-permission-seeding.dogfood.test.ts (the declarative-permission-seeding authz row, rewritten): the showcase's sets are served by the catalog with their package, and the boot writes no row.
• bootstrap-platform-admin-refused-existence-read.test.ts: a refused legacy read withholds the promotion and writes nothing; an empty answer goes on.

Also in this PR

• Liveness ledger. permission.packageId re-points to its surviving reader (the CLI's compile-time collision door). permission.managedBy is corrected to dead: the retired seeder stamped the column and never read the authored key, so the old live verdict was already wrong (see Acceptance notes).
• Tenant-audit census regenerated: the normalizer's two write sites leave, 232 → 230. The hand-written figures on tenant-audit-census.mdx are updated.
• Docs: permission-sets.mdx (built-in sets, provenance, the drift section reduced to overlay shadow) and authorization.mdx.
• Test fixtures that model an existing database write the legacy platform-bucket rows themselves (__tests__/legacy-catalog-rows.testkit.ts, dogfood ensureLegacyPermissionSetRow).
• Gate ledgers: the double-contract ledgers drop the retired suites and pin the new one.

Changesets

• @objectstack/plugin-security minor, BREAKING, Clause-②: yes (narrowing), ADR-0087 not-required (no-migration-prescription).
• 6b-2a's own file (@objectstack/cli minor BREAKING; plugin-security, driver-sql, runtime patch) rides here until it lands.

Verification (local, at the head this PR opens with)

• Build: turbo run build, 74/74.
• plugin-security full: 189 files, 3,884 passed (45 skipped).
• cli unit tier: 282 files, 4,233 passed.
• example-crm and example-showcase: green.
• Typecheck green: plugin-security, cli, dogfood, example-crm, example-showcase.
• Dogfood, in full: 248 files passed, 1 skipped; 2,009 tests passed, 9 skipped (U2's acceptance pin included).
• The census pins (authz-conformance, authz-probe-blind-spot) are in that run.
• dispatch-gates --commands: 134 derived families, all run, each recorded with its exit code; reconciled by --ran, 0 not measured. Red: check:platform-checklist only, with the same 8 absent-symbol anchors on T1 (which touches no checklist file), so they come from main.

Acceptance notes

• permission.managedBy is an authored key with no reader (pre-existing; the ledger now says dead). Retiring it is an enforce-or-remove item for the spec seat. It is not done here.
• The name-fold census instrument (scripts/measure-position-name-fold-census.mjs, not a CI gate) refuses to report once 6b-2a deletes the binders: its controls read binder tuples. Carrier: whoever next runs it re-aims its junction scan at PositionSchema.permissionSets.
• Two dogfood suites (two-doors-permission, showcase-permission-projection) keep their data-door cases on an existing database (the fixture writes the legacy row), because the gate still guards such rows until 7a / stage 8. 块1 (a publish materializes a row) is deleted with the materializer.
• check:platform-checklist reds on main (anonymous-form-intake and other symbol anchors) are pre-existing and outside this diff.

维护者速读（草稿）

改了什么：启动过程不再向 sys_permission_set 表写任何行。删除了：包声明权限集的播种器、平台默认权限集的物化（含 os meta resync 命令，见 6b-2a）、包发布时的物化器、热安装后的重播种、新建组织时的播种，以及基于这些行的漂移诊断、managed_by 归一化和播种拒绝诊断。sys_permission_set 上的 drift_status/drift_detail 两个字段及「需要关注」视图随写入者一并删除。U2 的「接受包默认权限集后重新推导 everyone」从被删的发布物化器挪到元数据变更信号上，且改为对每次权限集发布/保存/删除都执行（不再要求请求体带 isDefault）。

为什么改：ADR-0131 D3 规定权限集只有一个家——注册表。鉴权解析器从阶段 1 起已从注册表读定义，授权从 6b-2-pre 起按名称写入，这些行已不再决定任何权限。

风险与代价（含回滚）：全新数据库上 Setup 的「授予权限集」选择器仍列表行，因此会是空的——这就是本 PR 等 #22865 选择器决定再合并的原因。已有数据库保留旧行（直到 C7b）。删除了若干公开导出和 bootstrapPlatformAdmin 的 resync 选项，changeset 已逐项列出。回滚：直接 revert，无数据迁移。本 PR 需先合入 T1、T2、6b-2a 三个前置 PR，之后合并 main，差异约 2,870 行。

席位意见：

你要做的：等 #22865、objectui PR-3、CD（#22881）、objectui PR-4 落地后批准合并；在 6b-2a 落地前，本 PR 因含 skills 文件为 Tier H。

---

🤖 Generated with Claude Code

https://claude.ai/code/session_013XKtmoR5QCUSTMjiQ3os49

[github-actions]

📓 Docs Drift Check

This PR changes 5 package(s): @objectstack/cli, @objectstack/driver-sql, @objectstack/plugin-security, @objectstack/runtime, @objectstack/spec, touching 118 documentable anchor(s). ⚠️ 5 changed file(s) yielded no anchor (packages/cli/src/utils/format.ts, packages/plugins/plugin-security/src/index.ts, packages/plugins/plugin-security/src/write-refusals.ts, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

65 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 63739521d854d49dbb08dbc5370c99fde8a7555c.

⛔ 16 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 5 changed file(s) yielded no anchor (packages/cli/src/utils/format.ts, packages/plugins/plugin-security/src/index.ts, packages/plugins/plugin-security/src/write-refusals.ts, …) — pages documenting those are invisible to this run
• 11 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 152 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 63739521d854d49dbb08dbc5370c99fde8a7555c → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 6c1f4a9bb8d33f6f930655c0155c368b7778699d — the merge of head fcaedfdaa187e10c35234ad11ef564fb3c916781 into base 63739521d854d49dbb08dbc5370c99fde8a7555c, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 6c1f4a9bb8d33f6f930655c0155c368b7778699d && git checkout 6c1f4a9bb8d33f6f930655c0155c368b7778699d
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 63739521d854d49dbb08dbc5370c99fde8a7555c fcaedfdaa187e10c35234ad11ef564fb3c916781 && git checkout -B drift-repro 63739521d854d49dbb08dbc5370c99fde8a7555c && git merge --no-ff fcaedfdaa187e10c35234ad11ef564fb3c916781

node scripts/docs-audit/affected-docs.mjs --json 63739521d854d49dbb08dbc5370c99fde8a7555c

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 63739521d854d49dbb08dbc5370c99fde8a7555c → pass the list as
args.docs, on the commit named under Which tree this was computed on.