QA run · access-security (31/35) · ba4afcc2 · 2026-10-19 · 26 PASS / 3 PARTIAL / 2 FAIL / 0 BLOCKED / 4 NOT-RUN #24601

Round 2 of the 18.0 release sweep for access-security: re-judges on ba4afcc2 the clauses round 1 (#24559, subject 5b14b7f3) left unjudged and that this environment can drive (A class); every other verdict is carried forward from #24559 below. Supersedes #24559 under checklist-test SKILL §5. Wave anchor: #24579.

Environment fingerprint

• framework ba4afcc2391922a86678bf5e47b1a0e4d2c87ff1 (pinned; one commit after round 1's 5b14b7f3, a release-script fix — git diff 5b14b7f3 ba4afcc2 -- docs/qa/platform-checklist/ is empty, so every item revision is unchanged and carried verdicts stay revision-valid)
• console .objectui-sha 4016370af3c9c9dafec2bc5299afd8e8079701b8, built with pnpm objectui:build (deps --concurrency=2); packages/console/dist/.objectui-sha stamp equals the pin
• app: showcase, canonical boot OS_PORT=PORT pnpm -C examples/app-showcase exec objectstack dev --ui --seed-admin -p PORT -d file:/tmp/qa2/LABEL/ITEM.db; own port + file DB per runner/item; scratch app copies for metadata-writing items; seed --seed-admin + showcase seed
• browser: Playwright, executablePath /opt/pw-browsers/chromium, one context per runner, form sign-in
• timestamps 2026-10-19: environment prep 14:12–14:44 UTC (cold tree: install 39 s, pnpm build 10m20s, console build ~25 min); testing 14:34–14:50 UTC
• execution: one API runner sub-agent on :47512, two cold restarts on the same file DB

Scope

• selector access-security — 35 items (resolver-runnable set; planned/blocked items as in QA run · access-security (31/35) · 5b14b7f3 · 2026-10-19 · 25 PASS / 4 PARTIAL / 2 FAIL / 0 BLOCKED / 4 NOT-RUN #24559). Revisions per item are those recorded in QA run · access-security (31/35) · 5b14b7f3 · 2026-10-19 · 25 PASS / 4 PARTIAL / 2 FAIL / 0 BLOCKED / 4 NOT-RUN #24559 (unchanged at ba4afcc).
• Re-judged this round (A class):
  • access-security.sharing-rules-widen — acceptance[4] (§A13), driven on the activation switch across restarts per qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579 §3
• Not driven (B class — no fixture in this environment; stays parked on qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579 §4):
  • access-security.rls-both-sides acceptance[5] — blocked(dependency): maintainer's private write-up
  • access-security.crud-permission-matrix acceptance[5] — blocked(fixture): guest anchor asymmetry
  • access-security.walled-environment-metadata-operator-only acceptance[1], acceptance[2] walled half, negative[0] — blocked(environment): 18.0 refuses the walled posture

Round-2 per-clause verdicts (ba4afcc)

Each line: item revN · clause · verdict · text oracle evidence.

• access-security.sharing-rules-widen rev2 · acceptance[4] (§A13, re-pointed to the activation switch per the anchor) · pass — the audience member (get-session qa-aud-r2@verify.test, in bu_west_coast) and the outsider (qa-out-r2@verify.test) were checked at each stage:
  • Baseline: the audience member's list shows only the new inquiry, and its by-id read answers 200. sys_record_share holds one row with source: 'rule' and source_id: share_new_inquiries_with_field_ops. sys_metadata_activation is empty.
  • Switched off: admin POST /api/v1/security/_activation/sharing_rule/share_new_inquiries_with_field_ops {"enabled":false} answers 200 {enabled:false}. The audience member's list is empty and the by-id read answers 404. The share row is gone. The activation row reads {metadata_type: sharing_rule, active: false}.
  • First cold restart (same b.db, off): the state is unchanged. The member is still denied, there is still no share row, the activation row still reads active: false with the same updated_at, and the declared-rules bootstrap did not re-materialize the grant.
  • Switched back on: the response is 200, the grant is restored (a new rule-sourced share row, and the member reads the inquiry again).
  • Second cold restart (on): still on, with exactly one share row (the same id, not duplicated). The outsider was denied at every stage.

Reproduction rules (fails)

No round-2 clause scored fail.

Carried forward from #24559 (verdicts valid for 5b14b7f3, same item revisions)

Carried-forward: #24559 · access-security.rls-both-sides · PARTIAL
Carried-forward: #24559 · access-security.write-path-guards · PASS
Carried-forward: #24559 · access-security.record-access-explain · PASS
Carried-forward: #24559 · access-security.readonly-package-locks-studio · NOT-RUN
Carried-forward: #24559 · access-security.crud-permission-matrix · PARTIAL
Carried-forward: #24559 · access-security.owd-sharing-matrix · PASS
Carried-forward: #24559 · access-security.fls-mask-and-strip · PASS
Carried-forward: #24559 · access-security.scope-depth-asymmetry · PASS
Carried-forward: #24559 · access-security.anonymous-deny-surfaces · PASS
Carried-forward: #24559 · access-security.sharing-rules-widen · PARTIAL at 5b14b7f3 for every clause except those re-judged above
Carried-forward: #24559 · access-security.record-share-grant-revoke · PASS
Carried-forward: #24559 · access-security.audit-log-browser · PASS
Carried-forward: #24559 · access-security.owd-save-gate · PASS
Carried-forward: #24559 · access-security.public-form-intake · PASS
Carried-forward: #24559 · access-security.public-form-withdrawal-layers · PASS
Carried-forward: #24559 · access-security.share-link-capability-tokens · NOT-RUN
Carried-forward: #24559 · access-security.suggested-binding-loop · NOT-RUN
Carried-forward: #24559 · access-security.sharing-rule-authoring-ui · NOT-RUN
Carried-forward: #24559 · access-security.permission-matrix-edit-loop · PASS
Carried-forward: #24559 · access-security.capability-declaration-lifecycle · PASS
Carried-forward: #24559 · access-security.activation-write-operator-gate · PASS
Carried-forward: #24559 · access-security.packaged-flow-write-door-parity · PASS
Carried-forward: #24559 · access-security.platform-owner-email-anchor · PASS
Carried-forward: #24559 · access-security.me-permissions-aggregation-parity · PASS
Carried-forward: #24559 · access-security.record-view-read-audit · PASS
Carried-forward: #24559 · access-security.share-link-landing-page · PASS
Carried-forward: #24559 · access-security.anonymous-floor-v18-doors · PASS
Carried-forward: #24559 · access-security.walled-environment-metadata-operator-only · PARTIAL
Carried-forward: #24559 · access-security.meta-authoring-trail-and-audience-gates · PASS
Carried-forward: #24559 · access-security.security-catalog-activation-and-clone-doors · PASS
Carried-forward: #24559 · access-security.security-catalog-one-holder-and-boot-report · FAIL
Carried-forward: #24559 · access-security.grant-table-write-contract · PASS
Carried-forward: #24559 · access-security.parent-and-organization-write-guards · PASS
Carried-forward: #24559 · access-security.deployment-tables-platform-only · PASS
Carried-forward: #24559 · access-security.share-link-combined-gates · FAIL

FAIL items carried forward keep their round-1 disposition and extraction lines on #24559 (re-point rows on #24579 §1, defect cards as listed there).

Derived item verdicts (round-2 clauses + carried clauses)

• access-security.rls-both-sides — PARTIAL
• access-security.write-path-guards — PASS
• access-security.record-access-explain — PASS
• access-security.readonly-package-locks-studio — NOT-RUN
• access-security.crud-permission-matrix — PARTIAL
• access-security.owd-sharing-matrix — PASS
• access-security.fls-mask-and-strip — PASS
• access-security.scope-depth-asymmetry — PASS
• access-security.anonymous-deny-surfaces — PASS
• access-security.sharing-rules-widen — PASS (changed: was PARTIAL)
• access-security.record-share-grant-revoke — PASS
• access-security.audit-log-browser — PASS
• access-security.owd-save-gate — PASS
• access-security.public-form-intake — PASS
• access-security.public-form-withdrawal-layers — PASS
• access-security.share-link-capability-tokens — NOT-RUN
• access-security.suggested-binding-loop — NOT-RUN
• access-security.sharing-rule-authoring-ui — NOT-RUN
• access-security.permission-matrix-edit-loop — PASS
• access-security.capability-declaration-lifecycle — PASS
• access-security.activation-write-operator-gate — PASS
• access-security.packaged-flow-write-door-parity — PASS
• access-security.platform-owner-email-anchor — PASS
• access-security.me-permissions-aggregation-parity — PASS
• access-security.record-view-read-audit — PASS
• access-security.share-link-landing-page — PASS
• access-security.anonymous-floor-v18-doors — PASS
• access-security.walled-environment-metadata-operator-only — PARTIAL
• access-security.meta-authoring-trail-and-audience-gates — PASS
• access-security.security-catalog-activation-and-clone-doors — PASS
• access-security.security-catalog-one-holder-and-boot-report — FAIL
• access-security.grant-table-write-contract — PASS
• access-security.parent-and-organization-write-guards — PASS
• access-security.deployment-tables-platform-only — PASS
• access-security.share-link-combined-gates — FAIL

Product defects (extraction)

None extracted from this round.

Checklist-accuracy findings / fixture gaps

For the wave anchor #24579 (not extracted).

• access-security.sharing-rules-widen · step 7 / acceptance[4]: the round-1 finding is confirmed. GET /data/sys_sharing_rule answers total 0, and declared rules are served from the registry. The re-pointed recipe that passed here is: POST /api/v1/security/_activation/sharing_rule/NAME {"enabled":false|true}, then a cold restart on the same DB, then re-read three things: the member's reads, sys_record_share (rule-sourced row absent or present), and sys_metadata_activation (active false/true, updated_at unchanged). Note that GET /api/v1/meta/sharing_rule/NAME keeps answering active: true while the activation ledger has the rule switched off. The declared value and the effective state are separate, so step 7 should name the ledger row or the member's reads as the oracle, not the metadata read.

Handover (not judged on ba4afcc)

• access-security.readonly-package-locks-studio — NOT-RUN, Tier 3 deferred by the 18.0 sweep plan (carried from QA run · access-security (31/35) · 5b14b7f3 · 2026-10-19 · 25 PASS / 4 PARTIAL / 2 FAIL / 0 BLOCKED / 4 NOT-RUN #24559)
• access-security.share-link-capability-tokens — NOT-RUN, Tier 3 deferred by the 18.0 sweep plan (carried from QA run · access-security (31/35) · 5b14b7f3 · 2026-10-19 · 25 PASS / 4 PARTIAL / 2 FAIL / 0 BLOCKED / 4 NOT-RUN #24559)
• access-security.suggested-binding-loop — NOT-RUN, Tier 3 deferred by the 18.0 sweep plan (carried from QA run · access-security (31/35) · 5b14b7f3 · 2026-10-19 · 25 PASS / 4 PARTIAL / 2 FAIL / 0 BLOCKED / 4 NOT-RUN #24559)
• access-security.sharing-rule-authoring-ui — NOT-RUN, Tier 3 deferred by the 18.0 sweep plan (carried from QA run · access-security (31/35) · 5b14b7f3 · 2026-10-19 · 25 PASS / 4 PARTIAL / 2 FAIL / 0 BLOCKED / 4 NOT-RUN #24559)
• access-security.rls-both-sides acceptance[5] — blocked(dependency): maintainer's private write-up — B class, parked on qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579 §4
• access-security.crud-permission-matrix acceptance[5] — blocked(fixture): guest anchor asymmetry — B class, parked on qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579 §4
• access-security.walled-environment-metadata-operator-only acceptance[1], acceptance[2] walled half, negative[0] — blocked(environment): 18.0 refuses the walled posture — B class, parked on qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579 §4

Generated by Claude Code