Repository navigation
docs(skills): objectstack-data's security rules name the risk of renaming or removing a shipped access item in a later version - #25429
Merged
Conversation
…ming or removing a shipped access item Co-authored-by: Claude <noreply@anthropic.com>
…ling — rewritten shorter and paid for by deleting in-file restatements The section the previous commit appended put `skills/objectstack-data/rules/security.md` at 2837 tokens against its 2543 ceiling. It is now a short risk note, "Renaming or removing a shipped access item": administrators act on a package's access items by name (switch-off, clone, references from their own sets); a rename re-enables the item under its new name, a removal leaves a customer's clone or own set naming nothing, an added field deny is not carried into a clone; keep shipped names stable and, when a change is genuinely needed, say in the release notes what changed and what an administrator should re-check. Guidance only, as ruled (「提示风险就行」). The rest of the price is paid by deleting text that restated the same file: - the "Stack key: `permissions`" bullet repeated the code sample's own comment; its refusal text and schema pointer stay; - the `permission_set` warning repeated "the set's machine `name`" from the sentence above; "never a record id" and the refusal codes stay; - the assignment call's payload repeated the row's columns listed two sentences earlier; the endpoint and who may write it stay; - the `view_pii` code comment repeated "masked on read and denied on write"; - the `viewAllRecords` corollary sentence repeated "never crosses the Layer 0 wall", "on one of those same postures" and the first bullet's "denied — the list renders empty"; - the callout's "wall keeps denying … platform admin sees nothing" repeated the Layer 0 bullets, "the pair is the correct combo" repeated its own first line, the AND-gate parenthetical repeated the recipe comment, and ADR-0095 D1 was already cited in the first bullet. No rule changes meaning. File: 2541 / 2543 tokens. Co-authored-by: Claude <noreply@anthropic.com>
os-zhuang
approved these changes
Oct 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clause-②: no
Metadata-protocol: none
What this does
It adds a risk note to
skills/objectstack-data/rules/security.md, the access-control rules of the published data-modelling skill: renaming or removing a shipped access item in a later package version can quietly undo an administrator's choice on upgrade.Administrators act on a package's permission sets, positions, sharing rules and capabilities by name. They switch items off, clone sets, and reference the package's objects and fields from their own sets. So in a later version:
The note asks authors to keep shipped names stable and, when such a change is genuinely needed, to say in the release notes what an administrator should re-check. It is guidance only: no gate and no behaviour change. This is the maintainer's ruling of 2026-10-23: 「这种应该写到元数据应用的开发规范中」「提示风险就行」.
Why here
This came out of objectstack-ai/cloud#3173 (ADR-0126 wall 3 on cloud's install paths). The only package on the cloud marketplace is first-party (HotCRM), so the maintainer chose a development-convention note over a runtime check or a publish gate.
The token budget
The file sat at its ratchet ceiling, so the new text is paid for by deleting restatements in the same file. No rule changes meaning. Each deletion:
permissions, notpermissionSets" fact is the code sample's own comment just above it.name". This repeats the sentence above it.view_piisample's comment. It repeats the sentence directly above it.viewAllRecordscorollary. It follows from "it never crosses the Layer 0 wall" in the same bullet.The changes were written at the tier that
dispatch-gates.mjsmandates forskills/**.Verification
Run on head
3d46b7b8:check-skills-token-ratchet:security.mdis 2541 / 2543 tokens;--self-testpasses.check:doc-authoring,check:agent-test-spelling,check:role-word,check:skill-compatibility,check:skill-frame-sync,check:skill-identifier-liveness,check:pm-skill-id-lint,check:corpus-claim-driftandcheck-doc-route-spelling --advisory: each exits 0.Noticed, not touched: the assignment paragraph still says an
organization_idofnullmeans every organization context. Since #24583 step 7, an organization-less grant confers nothing, so that clause looks stale. Fixing it changes a rule, so it is left for its own change.🤖 Generated with Claude Code