…nswered nothing, per site (objectstack-ai#15840) (objectstack-ai#17156) * fix(plugin-security): tell a read that did not answer from one that answered nothing, per site (objectstack-ai#15840) `reconcileOrgAdminGrant`'s `sys_member` read swallowed a fault into `[]`, and `[]` is what that function reads as "this user is not an admin of this organization" — the input to a DELETE. A transient read fault therefore revoked a sitting admin's standing grant and the store kept it withdrawn after the fault cleared; only a `debug` line separated that run from a healthy one. That read now reports at `error` and returns `{ action: 'skipped', reason: 'membership_unreadable' }`, performing no write at all for the pair. `normalizeManagedByVocab` swallowed a catalog read fault into `[]` too, so an unreadable catalog and an already-canonical one were byte-identical on both channels while the row that needed healing stayed legacy. It now reports at `error` and refuses the pass rather than attesting counts it could not read. The refusal aborts at the first un-answered read — one line per refused boot, not the four the report-and-continue shape measured — and reaches the `kernel:ready` catch that was already declared for it. Per-site, not a sweep (objectstack-ai#15840 ruling, decision batch objectstack-ai#105 item 5, option A). A genuine EMPTY read keeps today's behaviour exactly at both seams, pinned by positive controls. `claim-seed-ownership.ts` is untouched — zero diff: its fault already propagates to a per-predicate handler that reports at `warn` and names the consequence, so the card's third row is falsified. The plugin's other reads keep their best-effort contract, where an unanswered read costs a grant that is not created rather than one that is destroyed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012zTkyNHJ7TkuN2oXtP5x37 * fix(plugin-security): match the platform Logger contract's error() arity at both new report sites (objectstack-ai#15840) `Logger.error` (packages/spec/src/contracts/logger.ts) takes the `Error` in its OWN second argument — `(message, error?, meta?)` — unlike `info`/`warn`/`debug`, which take `(message, meta?)`. Both new optional `error?` members were declared with the sibling two-parameter shape, which made the real `ctx.logger` unassignable: measured as three TS2322s in `security-plugin.ts`, at :3818, :3911 and :3937. Fixed at the declaration rather than by widening the consumer: the producer's spelling is the contract. Both call sites now hand the caught `Error` to the argument built for it, so a platform logger receives a real Error object rather than a message flattened into meta. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012zTkyNHJ7TkuN2oXtP5x37 * docs(permissions): re-tally the isSystem declaration count the new read seam adds (objectstack-ai#15840) `readRows`'s `context: { isSystem: true; tenantId?: string }` parameter is a 23rd `isSystem` declaration site, so `check:system-context-census` went red on its `[declared-count]` clause (table says 22, census says 23). Mechanical repair, applied by the gate's own `pnpm gen:system-context-census --fix`; one number in the decomposition table, no prose and no anchors touched. Attribution was MEASURED, not assumed — a first reading of the census JSON suggested the site was not mine. Reverting only this branch's three source files on top of the same merged tree gives declaration 22 and gate exit 0; restoring them gives 23 and exit 1. It is mine. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012zTkyNHJ7TkuN2oXtP5x37 * fix(plugin-security): guarantee MaybeLogger's `warn` channel now that `error` is optional (objectstack-ai#9754) `check:optional-error-sink` went red the moment this branch added an `error?` member: that put `MaybeLogger` into the gate's population for the first time, and it declared every channel optional. An optional `error` with no declared alternative is a contract that permits silence — a value of this type could carry no channel at all, and the durability report this module owes (a standing capability withdrawn, or a revoke that did not land) would have nowhere to go. The gate's own remedy, taken exactly: `warn` loses its `?`. ⛔ Not by making `error` REQUIRED (objectstack-ai#9754 option C, falsified — hosts inject reduced sinks), and ⛔ not by requiring `info`, which is the level AGENTS.md → "Degradation log levels" calls the reassuring half-truth. Narrowing the type forced NO call-site change: every existing caller already supplied `warn`, measured by tsc over both layers (typecheck exit 0, and check:test-typecheck 0 files / 0 errors), plus 105 files / 1977 tests green. The sibling `normalize-managed-by.ts` sink was checked rather than assumed: its `info`/`warn` were already non-optional, so it sits in the gate's compliant set and is not named. Census moves 33 -> 34 sinks with a guaranteed `warn`, and "permit silence" 2 -> 1, the remaining one being the pre-existing baseline entry. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012zTkyNHJ7TkuN2oXtP5x37 --------- Co-authored-by: Claude <noreply@anthropic.com>

🔗 Broken links detected in documentation #105

Description

Activity

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions