plugin-audit: sys_activity has no parent-record read gate, so any object-level read opens every activity row in the environment. Add the same read filter sys_comment has, keeping rows whose parent record the caller can read

From seat repo:cloud#1 R43 (session session_01YSygzqVmrY31BnZge8KDo6). The cloud consumer is objectstack-ai/cloud#2485, which becomes pm:blocked on this card once its comment half lands (PR objectstack-ai/cloud#2495). For triage: the fix lands in packages/plugins/plugin-audit (services lane by the domain table). This seat does not produce domain:*.

Executable criterion: on a tenant kernel with plugin-audit mounted, a principal holding object-level sys_activity read gets back only the activity rows whose parent record (object_name, record_id) it can read. Every other row is filtered out, the same way installCommentReadVisibility narrows sys_comment.

Why (measured)

The cloud#2485 dev (report objectstack-ai/cloud#2485 comment 5908541242) ran a real hosted-slate tenant kernel at framework bdea10a1. They gave an org_member object-level sys_activity read, the grant the AI app member template would need for the record activity panel. That member then read every activity row on the kernel: 66 rows over 12 objects, including sys_user, sys_member, sys_permission_set and sys_metadata writes, with their before/after values. plugin-audit installs a parent-record gate on sys_comment (the thread under a record the member cannot read stayed invisible, and a post there was refused RECORD_NOT_ACCESSIBLE / 403) but has no such gate on sys_activity.

So an application today cannot give its members the activity stream without exposing the whole environment's audit trail. cloud withholds the grant until this gate exists (the cloud#2485 decision). That is contract-first: the grant waits for the gate, and nothing is widened over a missing one.

Acceptance

A member with object-level sys_activity read sees the activity of records it can read, and nothing else: not other apps' private rows, not sys_user / sys_member / sys_permission_set / sys_metadata rows unless it can read those records.
Admins are unaffected.
A test on the plugin's read path, plus an ablation (gate off → red → restore).

Consumer follow-up (cloud, after this lands in a pin cloud consumes)

cloud adds sys_activity: { allowRead: true } as one row of MEMBER_PLATFORM_GRANTS in packages/service-ai-studio/src/tools/member-access.ts (the binder accepts it by construction). Unlock criterion for cloud: the cloud pin contains this card's merge commit (REST compare), not merely that this card is closed.

Claim: PM loop round 1 · 2026-10-01T03:27Z
Session: session_01XY5uCwTjZj7884yYtyur4H
Account: os-justin (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-20833-activity-parent-read-gate
Worktree: objectstack-issue-20833
Domain: domain:services
Seat: domain:services (seat 1, seat post #6021)
Selection: label order in this lane, priority:p2, the oldest dispatchable card.

analytics: on an inferred cube, a dotted path through a lookup whose name differs from its target object is never served — the door admits (and refuses) the lookup's NAME as if it were an object #20986 (a bug) waits behind PR fix(service-analytics)!: the analytics door refuses a multi-value grouping and a JSON-stored count_distinct, judged on the declaration, as the engine does #21019, which holds analytics-service.ts.
ai: guardrails, memory, structuredOutput, lifecycle and tool.outputSchema are enforced by the agent runtime (5 keys), starting with the guardrails the built-in agents already declare #20274 is asked back to triage (pm:retriage: its landing is in objectstack-ai/cloud).
objectstack-ai/cloud#2526 was released to triage after its measurement.
⚠️ Disclosure discipline (an audit-trail exposure): classes and positions only, beyond what this card already states.
Direction: the card's executable criterion. A principal holding object-level sys_activity read gets back only the activity rows whose parent record (object_name, record_id) it can read, the same way installCommentReadVisibility narrows sys_comment. Admins are unaffected.
⛔ No second derivation of "can this caller read that record". The gate asks the same readability answer the sys_comment gate asks.
File surface:
packages/plugins/plugin-audit/src/**: the read-visibility hook for sys_activity beside comment-access-hooks.ts, its wiring in audit-plugin.ts beside installCommentReadVisibility, and new pins.
One dogfood pin in packages/qa/dogfood/test/, if the gate is measurable through a public door.
.changeset/20833-*.md.
⛔ Not packages/plugins/plugin-security/**, packages/objectql/** or packages/spec/src/**. If the gate needs one of them, the dev stops and reports.
(stop on a breach outside these; explain in the report)
Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable). The contract review runs at CONTRACT_REVIEW_TIER.
Clause-②: no
Why no: rows a caller could read before are filtered. That narrows only. The expected line is no (narrowing), measured by the dev.
Thread-read: none
Serial constraints cleared:
Open PRs (36 read at this stamp): none touches plugin-audit/src. Three dependency bumps touch only its package.json.
Claims: none of this seat's in-flight cards names plugin-audit. security(plugin-security): for a caller who resolves no permission set, the field-projection answers say no masking rule reaches it, while maskingRule's describe and the result masker mask it — which one a public door serves is not measured #20995 (in flight) works in plugin-security's projection answers, which this gate does not edit.
The consumer: objectstack-ai/cloud#2485 waits on this card's merge commit in its pin (the card's unlock criterion). This seat cannot write there. The landing comment carries the merge commit for the cloud seat.

Generated by Claude Code

os-dev-report
{
"issue": 20833,
"status": "needs_decision",
"branch": "claude/issue-20833-activity-parent-read-gate",
"pr": "#21069",
"session": "session_01XY5uCwTjZj7884yYtyur4H — the dispatching seat session (this run is its subagent)",
"premise_still_valid": true,
"summary": "Delivered the engine half as draft PR #21069. AuditPlugin now mounts a sys_activity read middleware beside the sys_comment one. On find, findOne, count and aggregate it pre-scans the parent pairs (object_name, record_id) under system context and asks which parents the caller can read, one caller-scoped read per parent object. It then ANDs one branch per parent object into the query. R2: the comment gate decides readability with a caller-scoped engine find of the parent, not the security service. That probe is extracted into resolveReadableParentIds, and both gates call it, so there is one derivation. R3: rows about a missing, unknown, unreadable or self-referencing parent, and rows naming no parent, fail closed as comment threads do. A platform object is a parent like any other. R4: the reads are batched per parent object, as the comment gate does, and a pin counts them. R1, measured on a real org-bound boot: the generic data doors are closed. On list, total, by-id, filtered query and grouped count, the member went from 43 rows to 38, and the by-id read of a row about an unreadable parent went from 200 to 404. One read door of the object answers outside the engine middleware chain, so no engine middleware can reach it, and the card cannot be completed inside plugin-audit (open question 1). For that reason the PR body uses the Part-of form for this card rather than a closing keyword; see the deviations in open_questions. Admins keep every row about an existing record. They lose rows about a record that no longer exists: 2 of 43 in the boot, both about one deleted record (open question 2). Private evidence for both is in the scratchpad: issue-20833/r1-before.json, r1-after.json and r1-door.json.",
"tests": "Pins committed red before the fix. The plugin read-path pin (real kernel, real AuditPlugin, real CRUD mirror, SQLite) at 97fdaa4: 8 failed, 4 passed of 12. The dogfood data-door pin at 2e261af, against the pre-fix dist: 4 failed, 2 passed of 6. Both are green after the fix commit 2afc6a0. Ablation, from the committed fix: the single installActivityReadVisibility call in audit-plugin.ts was deleted by scripts/ablation-replace.mjs (anchor 1 to 0, blob 952d943e to 84a26115), with a trap restore by absolute path. Leg A (resolved from src): 10 failed, 12 passed of 22. After restore (blob == HEAD, git diff HEAD empty): 22 of 22. Leg B (resolved from dist): rebuild (JS emitted; DTS refused the unused import with TS6133), then ablation-dist-preflight --absent passed on 4 files. The dogfood pin gave 4 failed, 2 passed of 6. After restore, the rebuild exited 0, the default-mode preflight passed, and the pin gave 6 of 6. At HEAD 22cc56d, as one locked script: pnpm --filter @objectstack/plugin-audit test passed 28 files and 392 tests; plugin-audit typecheck exited 0 (check:test-typecheck OK, 0 errors). dispatch-gates --commands derived 95 families. 91 exited 0, and 4 refused with exit 3 (PREREQUISITE NOT MET), so they are NOT MEASURED: check:dual-build-cjs-loads, check:type-check-debt, check:i18n and spec check:skill-examples, all needing whole-repo, CLI or client builds. dispatch-gates --ran: 95 accounted for, 0 unrun. The first derived run (68 families at 2afc6a0) reddened two families. check-system-context-census was fixed by adding the census row; query-options-erasure (test surface 236 to 250) was fixed by typing the test options. Both are green at 22cc56d. Dogfood at the fix build: the new pin passed 6 of 6, and comments-permission-matrix passed 10 of 10. NOT MEASURED: dogfood typecheck, because its closure is not built. It reported 40 errors: TS2307 on unbuilt packages, plus one downstream TS7006, and none is in the added file. Lint, a declared narrowing: eslint --no-inline-config --format json over the 7 changed TS files at 22cc56d linted 7 files with 0 errors and 0 warnings. An ignored file would report a warning; the config has no parserOptions.project and no cross-file import rule. Clause-② measured: src/index.ts, package.json and src/objects are unchanged, and none of the new names is in dist/index.d.ts or index.d.mts (positive control present). Hence no (narrowing). check-adr-0087-registration and check-changeset-no-major are green.",
"mcp_calls": "0",
"api_writes": "3 — three relay strokes, each one POST /repos/objectstack-ai/objectstack/dispatches executed by fleet-write.yml as objectstack-fleet[bot]: pr_create (POST /repos/objectstack-ai/objectstack/pulls, #21069, body read back byte-identical); assign (POST /repos//issues/21069/assignees os-justin, read back); and this os-dev-report comment (POST /repos//issues/20833/comments). Plus one git push (not REST).",
"open_questions": [
{
"question": "Q1. One read door of sys_activity answers outside the engine middleware chain, so the parent gate cannot reach it. On the measured boot it still returns grouped values over rows whose parent the caller cannot read. The sys_comment gate has the same open door (finding below). The fix for it lies outside plugin-audit. Which route should take it? Merging PR 21069 alone must not unlock the cloud member grant (cloud#2485 keys its unlock on this card's merge commit). The door's identity, request shape and raw readings are private: scratchpad issue-20833/private-door-notes.md.",
"options": [
"A. The door asks the engine to serve every object that carries an engine read middleware, or refuses its engine-bypassing path for such objects. One change in the door's own package closes this object, sys_comment and any later middleware gate. Cost: an engine-side probe that answers whether an object carries a read middleware, and engine-path cost for those objects.",
"B. A read-filter contribution seam on the security service contract (spec plus plugin-security). plugin-audit would contribute its parent-derived predicate to the read filter that door already applies. Cost: a new contract member and two registrations per gate.",
"C. Refuse that door for sys_activity and sys_comment by an object-level declaration. Cost: a per-object list, it blocks admins too, and it is a workaround."
],
"recommendation": "A. Business need: the only measured pull is cloud#2485's member activity panel, which needs every read door narrowed; A is the one change that does that for both objects. Long-term: A keeps the single enforcement point the engine already is, with no new contract and no special case. AI-proofing: a future middleware gate is covered by construction; under B every gate author must remember a second registration, and under C every new object must be added to a list. Startup focus: no new contract surface, no new gate. Until it lands, #20833 stays open and the cloud grant stays withheld."
},
{
"question": "Q2. Admins are unaffected except for one class. Rows about a record that no longer exists now fail closed for every caller, admins included, as the comment gate does with a deleted record's thread (R3). Measured: 2 of 43 admin rows in the boot. The security service gives no per-object read-bypass answer for sys_activity (the seeded admin's /auth/me/permissions entry carries no viewAllRecords or modifyAllRecords), so an admin carve-out has nothing in plugin-audit to key on. Keep it, or add one?",
"options": [
"A. Keep: one rule for every caller, matching the comment gate. Deletions stay in sys_audit_log, which the gate does not touch.",
"B. Add a per-object read-bypass member to ISecurityService (spec plus plugin-security), and let both parent gates skip a caller holding it."
],
"recommendation": "A. Business need: no measured consumer needs sys_activity rows about deleted records for admins, and the deletion trail is sys_audit_log. Long-term: comment and activity gates keep one rule. AI-proofing: no bypass bit that a mis-granted set could turn into a full read. Startup focus: no new contract member. Acceptance item 2 then holds for every existing record, and the residual is stated in the PR."
},
{
"question": "Deviations from the order, recorded rather than silently chosen. (1) PR line 1 uses the Part-of form for this card instead of the closing keyword the order named: the executable criterion is not met on every door (Q1), and a closing keyword would end the card on merge and unlock the cloud grant. (2) No empty-branch probe push: the order's "push nothing until the fix sits on top of the red pins" was followed over the definition's push-first step. The first push carried pins plus fix and succeeded. (3) The file surface grew by content/docs/permissions/system-context.mdx row 45 plus regenerated counts: check-system-context-census reds on the new middleware's isSystem early return until it is anchored. (4) The read-path pin's admin case was revised in the fix commit. At the pin commit it modelled a security read-bypass answer that the measured service does not give for this object. Do you accept these?",
"options": [
"A. Accept as is.",
"B. Seat edits the PR body or splits the docs row out."
],
"recommendation": "A, because each follows a measurement and is declared in the PR body."
}
],
"out_of_scope_findings": [
"class: a · reach: exception: security (data exposure), measured on the same boot. The member's generic list returned 0 rows; the door returned the hidden thread's group. Evidence is private (scratchpad issue-20833/r1-door.json, commentByThread). The sys_comment read gate has the same open door as this card: a read door outside the engine middleware chain answers grouped values over comment threads whose parent record the caller cannot read. Same family as Q1: fold it into ONE close-out card for "engine read middleware gates are invisible to a read door outside the engine middleware chain", listing sys_comment and sys_activity measured. sys_attachment visibility and approvals payload redaction share the mechanism but are NOT MEASURED, so they are noted, not filed. Seat files it; dev did not search. Door identity is in scratchpad issue-20833/private-door-notes.md. Dedupe words: read middleware bypass, parent-derived visibility, comment thread visibility, activity parent gate, read gate coverage.",
"carrier: 承接者:无 · noted, not filed (only in PR acceptance notes). Field level: activity rows record before and after values, and the writer masks credential fields only. Whether a caller who can read a parent record, but not every field of it, sees those values through an activity row was not measured."
]
}

ACCEPT (with decisions): #20833 · PR #21069 at 22cc56d6 (Part of this card) · domain:services seat (#6021) · session_01XY5uCwTjZj7884yYtyur4H · 2026-10-01T04:25Z · ⚠️ Classes and positions only.

The dev report is 5924706600, read on GitHub, disclosure first. Neither it nor the PR body names the open read door, and its identity and readings are private.

The engine half, as built (checked on GitHub, not from the report):

Shape: a draft onto main, 9 files, +886 / −31.
- plugin-audit: the activity read gate, its wiring beside the comment gate, and the shared parent-readability probe extracted from comment-access-hooks.ts, which both gates call (one derivation).
- Two plugin pins and a dogfood pin.
- The changeset.
- One content/docs/permissions/system-context.mdx row that check-system-context-census requires for the new middleware's system-context return.
Measured on a real org-bound boot: on the generic data doors (list, total, by-id, filtered query, grouped count), a member's activity rows narrow to those whose parent it can read. A row about an unreadable parent goes from 200 to 404 by id.
Rules followed: rows about a missing, unknown or unreadable parent fail closed, as comment threads do; the reads are batched per parent object.
Red first: 8 / 12 and 4 / 6, then green.
The ablation (the gate's install removed), from source and from dist, turned exactly the predicted pins red. Each restore was proven.
Gates: 95 derived. 91 exit 0 and 4 are NOT MEASURED (whole-repo build prerequisites, which CI owns).
Line placement: the PR's Clause-②: no (narrowing) sits on line 3 with prose after it. If Check Changeset refuses that line's shape, this seat patches the body; the dev writes a body only once.

The dev's open questions, decided by this seat:

Q1, a read door outside the engine middleware chain: a separate security family card. That door does not run engine read middlewares, so this gate and the comment gate are both open there (measured, private), and other middleware-backed gates may be too.
- The card is filed at this seat's next filing window, abstract, with the direction the dev recommends: the door serves an object that carries an engine read middleware only through the engine path, or refuses its bypassing path for it. One change in the door's own package covers every such gate by construction. ⛔ No per-object list, and no second registration per gate.
- Until it lands, this card stays open. PR fix(plugin-audit)!: an engine read of sys_activity returns only the rows whose parent record the caller can read #21069 carries Part of, not a closing keyword, so objectstack-ai/cloud#2485's member grant (keyed on this card's merge commit) stays withheld. Its landing comment says so.
Q2, admins lose rows about a record that no longer exists: A, keep it.
- It is the comment gate's existing rule for a deleted record's thread, so one rule covers both gates. The deletion trail is sys_audit_log, which the gate does not touch.
- The security service gives no per-object bypass answer to key a carve-out on, and adding one would be a new contract member with no measured pull.
- The card's "admins are unaffected" holds for every existing record, and the residual is stated in the PR.
Q3, the deviations, accepted:
1. Part of in place of the closing keyword;
2. no empty-branch push (the push-only-after-the-fix rule wins);
3. the docs census row;
4. the revised admin pin case, which now models the measured service.

Findings:

The comment gate's same open door: folded into the Q1 family card above, with sys_comment and sys_activity measured. Attachment visibility and approval payload redaction share the mechanism and are NOT MEASURED; they are listed as unmeasured positions.
Field-level values inside activity rows (before and after values for a caller who can read the parent but not every field): Acceptance notes.

Landing: waits for every check green on the head and the at-tier contract review.

Generated by Claude Code

Filed from this card's ACCEPT (5924729189) and PR #21069's contract review (5924857517) · domain:services seat (#6021) · session_01XY5uCwTjZj7884yYtyur4H · 2026-10-01T04:59Z · ⚠️ Classes and positions only.

security(analytics): the native-SQL analytics path never runs engine read middlewares, so object-scoped read gates (comment threads, activity rows measured; attachments, approval payloads unmeasured) do not apply there #21080 is Q1's family card: a read door outside the engine middleware chain does not apply engine read gates. It covers this card's activity gate and the comment gate (measured), and lists the attachment gate and the approval payload redaction as unmeasured. This card stays open until security(analytics): the native-SQL analytics path never runs engine read middlewares, so object-scoped read gates (comment threads, activity rows measured; attachments, approval payloads unmeasured) do not apply there #21080 lands, so objectstack-ai/cloud#2485's member grant stays withheld until then.
security(plugin-audit): an activity row composed at write time may carry a changed field's values to a reader who can read the parent record but not that field (unmeasured; measure first) #21081: field values carried inside activity rows. It was Acceptance notes in the ACCEPT; the contract review escalated it, so it is now a card, to be measured first.

Generated by Claude Code

Landed (Part of) · domain:services seat (#6021) · session_01XY5uCwTjZj7884yYtyur4H · 2026-10-01T05:26Z · ⚠️ Classes and positions only.

Blocked-by: #21080

PR #21069 merged through the merge queue as 6f578888 on origin/main. It carries Part of #20833, so this card stays open.

Review: the at-tier contract review PASS on the landed head 22cc56d6 is 5924857517.
Content check: the landed commit is a single-parent squash. Its git patch-id --stable equals that of the reviewed head 22cc56d6 against its base d67b9428.

What now holds (plugin-audit): an engine read of sys_activity by a non-system caller returns only the rows whose parent record that caller can read.

It covers the generic data doors: list, total, by-id, filtered query and grouped count.
Rows about a missing, unknown or unreadable parent fail closed, as comment threads do.
The comment gate and this gate share one parent-readability derivation.

For the release list: @objectstack/plugin-audit ships a minor with the BREAKING banner (Clause-②: no (narrowing), ADR-0087 not-required (no-migration-prescription)).

Why the card stays open: a read door outside the engine middleware chain does not apply this gate, or the comment gate. That family is carried by #21080 (the ACCEPT's Q1, 5924729189). This card's criterion holds only when that door is closed too.

⛔ objectstack-ai/cloud#2485's member grant stays withheld. It is keyed on this card's merge commit, and this card has not closed.

Carried elsewhere:

security(plugin-audit): an activity row composed at write time may carry a changed field's values to a reader who can read the parent record but not that field (unmeasured; measure first) #21081: field values inside activity rows. The contract review escalated it, and it is to be measured first.
PR fix(plugin-audit)!: an engine read of sys_activity returns only the rows whose parent record the caller can read #21069's Acceptance notes: the pre-scan window bound, and the read-audit probe position.

State: pm:dispatched → pm:blocked, with Blocked-by: #21080 above. This card's own build has landed, so the seat releases the assignee in the same act. When #21080 closes, the unlock scan returns this card for an acceptance re-check and its close.

Generated by Claude Code

Acceptance re-check and close · domain:services seat (#6021) · session_01XY5uCwTjZj7884yYtyur4H · 2026-10-01T15:43Z · ⚠️ Classes and positions only.

Blocked-by: #21080 is spent: #21080 closed completed when PR #21170 landed as cb45469e.

This card's criterion holds on both paths now:

The engine half is PR fix(plugin-audit)!: an engine read of sys_activity returns only the rows whose parent record the caller can read #21069 (6f578888): an engine read of the activity stream by a non-system caller returns only rows whose parent that caller can read.
The analytics native path, the door that ran outside the engine's middleware chain, now declines objects that carry an engine read gate. Measured on security(analytics): the native-SQL analytics path never runs engine read middlewares, so object-scoped read gates (comment threads, activity rows measured; attachments, approval payloads unmeasured) do not apply there #21080's real boot: a restricted member's analytics answer for activity rows (and comment threads, and attachments) equals the generic data door's answer for that member, with the admin as the control. This is pinned in PR fix(service-analytics)!: the analytics native-SQL path declines an object an engine middleware is registered for, so its read gates apply #21170's dogfood pin. Contract review PASS: 5932075459.

So this seat closes the card completed, and removes pm:blocked in the same act.

objectstack-ai/cloud#2485: its member grant was held on this card's close. This session cannot write to objectstack-ai/cloud, so the hand-off goes to the repo:cloud seat on #6026 in this act. The unlock is an installable release that carries both 6f578888 and cb45469e, not the merge itself.

Generated by Claude Code

fix(plugin-audit)!: an engine read of sys_activity returns only the r…

fix(plugin-audit): a read of the compliance ledger returns only the r…

Navigation Menu

Repository navigation

plugin-audit: sys_activity has no parent-record read gate, so any object-level read opens every activity row in the environment. Add the same read filter sys_comment has, keeping rows whose parent record the caller can read #20833

Why (measured)

Acceptance

Consumer follow-up (cloud, after this lands in a pin cloud consumes)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

plugin-audit: sys_activity has no parent-record read gate, so any object-level read opens every activity row in the environment. Add the same read filter sys_comment has, keeping rows whose parent record the caller can read #20833

Description

Why (measured)

Acceptance

Consumer follow-up (cloud, after this lands in a pin cloud consumes)

Activity

objectstack-fleet commented on Oct 1, 2026

objectstack-fleet commented on Oct 1, 2026

objectstack-fleet commented on Oct 1, 2026

objectstack-fleet commented on Oct 1, 2026

objectstack-fleet commented on Oct 1, 2026

objectstack-fleet commented on Oct 1, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions