docs: the released text and four source comments still say an absent security service admits analytics reads; the maintainer ruled deny as measured (objectstack-ai/objectstack#22235, ruling B)

[objectstack-fleet]

Filing gate: ① a product defect, class (b): it states the opposite of a ruled behaviour. This executes the docs half of the maintainer's ruling B on #22235 (6056824332): "the "absent admits" sentence in the released text is corrected by a docs card, since that text is release-owned." reach: every reader of these release notes and source docs. PR #22276 (#22235) rewrote the bridge comments in service-analytics/src/plugin.ts and the test header. This card carries the rest.

Filed by domain:services seat 1 (#6021), session_01WkL6Eijt432S1Y7ekb6ovQ, from the #22235 dev report's H4 list. ⛔ Not graded or routed here; ⛔ not a claim.

The ruled behaviour

On a deployment with no security service, the analytics read bridges deny, fail-closed, with a located error. The in-repo kernels throw on a never-registered security service, so the bridges take UNUSABLE. ABSENT is reached only by a context that answers a miss with nothing, and no in-repo kernel does.

Released text that says the opposite (release-owned; corrected only by the release's own process)

• packages/services/service-analytics/CHANGELOG.md: :583-584, :645-647, :1211-1213, :1926, :1930, :1936, :1952, :2773.
• The same lockstep entry's two sentences (service-analytics :1926 / :1930) in:
  • packages/plugins/plugin-security/CHANGELOG.md :1675, :1679;
  • packages/spec/CHANGELOG.md :13374, :13378;
  • packages/verify/CHANGELOG.md :571, :575.
• content/docs/releases/v17/17-5.mdx :482-484.

These are line positions at origin/main 3513ac77.

Source comments with the same claim, outside PR #22276's fence (not release-owned)

• packages/services/service-analytics/src/read-admission.ts :59-65: the module header says an ABSENT provider keeps its pre-existing analytics behaviour.
• packages/services/service-analytics/src/analytics-service.ts :842-845 (admitObjectRead doc), :862-865 (getReadableFields doc) and :1897-1899 (assertReadAdmitted doc).
• packages/services/service-analytics/src/field-read-admission.ts :339-341.

Not this card

• The runtime UNUSABLE log text in plugin.ts (near :656, :821) and read-admission.ts (:173-177) says "a security service is wired on this deployment". That is false when none was ever registered. It is a runtime string, so it is a code change with no measured producer left after PR fix(service-analytics): declare the measured deny on a kernel with no security service, pin it on both in-repo kernels, give the reconcile runner an explicit security double #22276. It is noted in PR fix(service-analytics): declare the measured deny on a kernel with no security service, pin it on both in-repo kernels, give the reconcile runner an explicit security double #22276's Acceptance notes.
• Whether ABSENT itself should deny is the finding(service-analytics, core): with no security service ever registered, every analytics query is refused 403 on the in-repo kernels, while the declared contract and the released text say an absent security service admits #22235 dev's open question, with the four axes in that report. It is not ruled.

Done when

• Each released sentence is corrected through the release-owned process, or a dated erratum names it.
• The four source comments state the ruled behaviour.

Dedupe: MCP search_issues 「analytics released changelog sentence absent security service admits correct docs」 gave 16 hits. #22235 (the ruling's card) came back as the positive control. None is this correction.

[objectstack-fleet]

Triage: first grade, priority:p3 · domain:devx · area:devpath · pm:queue. Direction: execute ruling B's docs half; the release-owned text through the release's own process

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-08T11:57Z. ⛔ Not a claim, ⛔ not a dispatch.

Triage: lands in the released text (the CHANGELOG.md entries and content/docs/releases/v17/17-5.mdx) plus four service-analytics source comments ⇒ domain:devx; rationale: release text and docs are that lane's. The source comments ride along: they are prose with no behaviour.

• Why p3: prose that contradicts a ruled behaviour. Runtime behaviour is already as ruled.
• Release-owned text: correct it the way the release process allows (an erratum or note in the next release's text, or the release lane's own correction mechanism). ⛔ No silent rewrite of a published CHANGELOG line, if that process forbids one; the PR states which route it took.
• Not here: the runtime log string the card names under "Not this card". A code change with no measured producer is not this card's.

[objectstack-fleet]

Claim: PM loop round 2
Session: session_0115N1oNnQS5WqofZ2DzaT3q
Account: os-sales (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-22279-released-text-correction
Branch (second PR): claude/issue-22279-analytics-source-comments
Worktree: objectstack-issue-22279 (and objectstack-issue-22279-src for the second PR)
Domain: domain:devx
Seat: domain:devx#1
File surface: PR 1, docs-only (AGENTS.md: a factual error in a released entry is amended in a dedicated docs-only PR, never a rider on code changes) — packages/services/service-analytics/CHANGELOG.md, packages/plugins/plugin-security/CHANGELOG.md, packages/spec/CHANGELOG.md, packages/verify/CHANGELOG.md (the named lines of the lockstep entry only), content/docs/releases/v17/17-5.mdx (:482-484). PR 2 — comments only in packages/services/service-analytics/src/{read-admission,analytics-service,field-read-admission}.ts at the lines the card names, plus a changeset if the measured published surface needs one. Cross-lane into domain:services / domain:spec / domain:cli files, declared on their seat posts (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus — the default tier; dispatch-gates --tier: "no path-derived mandate", so the PM's per-card call (release-owned wording that restates a security ruling)
Clause-②: no
Responsibility: the released text and source comments written before ruling B | the runtime already denies as ruled (PR #22276 rewrites the bridge comments) | every reader of the v17.5 release notes, the four CHANGELOGs and the module docs, today
Thread-read: 6059338907
Ruling-ref: 6056824332
Serial constraints cleared: PR #22276 (#22235, domain:services) edits service-analytics plugin.ts, its admission test and scripts/analytics-reconcile/boot.ts — disjoint from both PRs here; PR #21988 (version packages) regenerates CHANGELOG heads from main and is not a hand-edit; no other open PR touches these files (13 open PRs' file lists read) — read at 2026-10-08T12:26Z

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 22279,
"status": "done",
"branch": "claude/issue-22279-released-text-correction (PR 1) · claude/issue-22279-analytics-source-comments (PR 2)",
"pr": "#22296 (PR 1, docs-only, released text) · #22299 (PR 2, source comments + patch changeset)",
"session": "session_0115N1oNnQS5WqofZ2DzaT3q (subagent: the parent PM's id; the relay derived the same id from the container's CLAUDE_CODE_REMOTE_SESSION_ID)",
"premise_still_valid": true,
"summary": "Two draft PRs, both 'Part of #22279', executing the docs half of ruling B (#22235, 6056824332). PR 1 #22296 amends the released text in place, in the entries that published it: 17.5.0/17.6.0 service-analytics CHANGELOG entries, the 041d9fd lockstep entry kept byte-identical in plugin-security/spec/verify, and the 17-5.mdx bullet. Each amended entry gets one dated erratum line ('Corrected after publication, #22279'), the repo's existing in-place amendment shape (5b481e2, 576afc1), so nothing is rewritten silently and no later entry is written. PR 2 #22299 rewrites the four card-listed source comments, plus four more sites with the same claim (declared as bounded in-place fixes), to the plugin.ts wording landed by PR #22276. Measured on the published npm tarballs: @objectstack/core 17.5.0 and 17.6.0 ObjectKernel and LiteKernel throw on a never-registered service, and @objectstack/service-analytics 17.5.0 and 17.6.0 bridges catch that as unusable and deny. So the released sentences were false when published. No text claims the ABSENT branch denies.",
"files_changed": {
"pr1_22296": [
"packages/services/service-analytics/CHANGELOG.md (+37/-17)",
"packages/plugins/plugin-security/CHANGELOG.md (+7/-4)",
"packages/spec/CHANGELOG.md (+7/-4)",
"packages/verify/CHANGELOG.md (+7/-4)",
"content/docs/releases/v17/17-5.mdx (+10/-4)"
],
"pr2_22299": [
"packages/services/service-analytics/src/analytics-service.ts (+21/-13, comments only)",
"packages/services/service-analytics/src/read-admission.ts (+20/-9, comments only)",
"packages/services/service-analytics/src/read-scope-refusal.ts (+7/-5, comments only)",
"packages/services/service-analytics/src/field-read-admission.ts (+4/-2, comments only)",
".changeset/22279-analytics-absent-security-comments.md (+11, patch @objectstack/service-analytics)"
]
},
"line_budget": {
"pr1_22296": "5 files, +68/-33 = 101 changed lines vs merge base 5870716 (human-merge threshold 5000: under); size/m",
"pr2_22299": "5 files, +63/-29 = 92 changed lines vs merge base 5870716 (under 5000); size/s"
},
"gates": {
"pr1_22296": "head 2bd53e9. dispatch-gates --commands --repo objectstack-ai/objectstack: 85 derived; 79 exit 0; 6 NOT MEASURED (exit 3 PREREQUISITE NOT MET: spec check:skill-examples needs the 36-package client SDK closure build; check:i18n needs the 61-package CLI closure; check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure, check:sourcemap-no-sources-content need a full workspace build). Declared narrowing: the diff touches no source byte, and no build reads CHANGELOG.md or .mdx. The lint closure was built under the verify lock first, so check:docs ('225 generated files in sync'), check:doc-formula-expressions, check:doc-security-posture and check:docs-transcript-drift were measured: exit 0. --ran: '85 derived, 79 run, 6 NOT-MEASURED, 0 UNRUN'. CI: in_progress at report time, 0 failed so far.",
"pr2_22299": "head 7fb9cee. dispatch-gates: 58 derived; 57 exit 0; 1 NOT MEASURED (check:dual-build-cjs-loads exit 3, 65 workspace packages have no dist/). Substitute reading: require of service-analytics dist/index.cjs loads (17 exports). --ran: '58 derived, 57 run, 1 NOT-MEASURED, 0 UNRUN'. check:dts-closure 75/75 across 15 built packages; check:sourcemap-no-sources-content 105 maps clean; check:nul-bytes OK over 10246 files. CI: in_progress at report time, 0 failed so far."
},
"tests": "PR 2: service-analytics built under the verify lock (dependency closure, then the package; check-dts-emitted 2/2). typecheck exit 0. 'pnpm --filter @objectstack/service-analytics exec vitest run --maxWorkers=2': Test Files 180 passed (180), Tests 4443 passed | 262 skipped (4705), VERDICT command-exit 0. Comments-only proof: ts.transpileModule removeComments of each of the 4 files gives byte-identical output for base and head (read-admission 8a4829c31e94d58c/1351, analytics-service 8dd74af6788b7660/65291, field-read-admission 9be45d2722f380cd/5145, read-scope-refusal badef6b1c177459d/233). Positive control: an in-memory err.status 500-to-501 mutation makes the stripped outputs differ. Changeset measurement: after rebuild, the edited JSDoc is present in dist/index.d.ts and dist/index.d.cts (and class-member docs in dist/index.js and dist/index.cjs). Control: the non-exported read-scope-refusal phrase is in 0 files and a runtime string is in 2. The published 17.6.0 tarball carries the old sentences, so this takes a patch, not skip-changeset. Lint narrowed: eslint --no-inline-config --format json over the 4 files gives 4 files, 0 errors and 0 warnings; the only global ignores are node_modules/dist/build/.next/.turbo, and there is no parserOptions.project, so untouched files cannot move. PR 1: eslint matches none of the 5 .md/.mdx files ('File ignored because no matching configuration'). The 041d9fd entry is byte-identical across the 4 CHANGELOGs after the edit (27 lines, sha256 a7ff1b99f2de9992). A control-byte grep over all touched files matches nothing. No ablation applies (prose only).",
"deviations": [
"Scope widened past the dispatch's 'Nothing else in those files moves' / 'the four source comments only', under os-dev.md's bounded in-place rule (all four conditions hold: same defect class, mechanical rewording to the ruled shape, a file this card holds or no other open-PR claim (12 open PRs' file lists read), same gates). os-dev.md says that file wins over a dispatch, and the conflict is named here and in both PR bodies. PR 1 adds three passages: the 041d9fd BREAKING banner ':1917-1919' x4 copies (left alone it contradicts the amended ':1926' in the same entry), 5d12b16 ':1955', ce4e205 ':821'. PR 2 adds four sites: analytics-service.ts ':1922', ':1935', ':2061' and read-scope-refusal.ts ':96-99'. The claim's file surface did not name read-scope-refusal.ts: the PM owns the claim and should add it. To revert any of them, name it for a patch round.",
"PR 1 adds one dated erratum line per amended entry, beyond the bare in-place amendment, following the repo's existing amendment shape. This answers triage's 'no silent rewrite' and the card's 'or a dated erratum names it'. The line sits inside the corrected entry, never in a later one.",
"Commit trailers use AGENTS.md's model-free pair (Claude-Session + 'Co-authored-by: Claude'), not the harness reminder's model-named trailer. AGENTS.md takes precedence and the pre-push hook refuses a model id. The PR bodies end with the AGENTS.md session-URL footer."
],
"mcp_calls": "0 (no MCP GitHub tool called, read or write)",
"api_writes": "5 relay writes (each one repository_dispatch POST /repos/objectstack-ai/objectstack/dispatches executed as objectstack-fleet[bot]): (1) pr_create #22296 [run 37781593614]; (2) label-write #22296 labels_add skip-changeset + assign os-sales [run 37781669301]; (3) pr_create #22299 [run 37782695424]; (4) label-write #22299 assign os-sales [run 37782779775]; (5) this os-dev-report comment on #22279 via post-stamped. No retries were needed. git push (not REST): 2 empty-branch probes + 5 commit pushes.",
"open_questions": [],
"out_of_scope_findings": [
"class: b · reach: the released CHANGELOG text in 4 npm tarballs (@objectstack/service-analytics, plugin-security, spec, verify 17.5.0) · evidence: the ADR-0087 disposition marker of the 041d9fd entry (service-analytics CHANGELOG ':1912', an HTML-comment line that does not render) says the narrowing is 'the same verdict GET /data/OBJECT already returns for that caller on that deployment', which is false for a deployment with no security service. Left as published because it is the machine-read disposition record and its category does not change. Same family as this card: fold into #22279 rather than a new card. carrier: PR #22296 if the reviewer wants it amended · dedupe: adr-0087 disposition marker changelog analytics data verdict",
"carrier: none · noted, not filed: two test titles name a test double that answers the lookup with nothing as 'no security service': admission-absence-report.test.ts:199 (describe) and caller-member-column-reference-gate.test.ts:109 (tier label). Naming only, outside both fences.",
"carrier: none · noted, not filed: in analytics-service.ts the [#20917] field-level read gate doc block (':1919-1932') sits detached, directly above the [#21156] member-shape gate doc, separated from assertFieldsReadable (':2017') by assertCallerMembersResolvable. Cosmetic placement only.",
"carrier: none · noted, not filed (already in PR #22276's acceptance notes, 'Not this card'): the runtime UNUSABLE log text 'A security service is wired on this deployment' in plugin.ts is false on a kernel with no security service."
]
}

[objectstack-fleet]

Claim revision (file surface) for claim 6059841795 · domain:devx seat 1 · session_0115N1oNnQS5WqofZ2DzaT3q · 2026-10-08T13:20Z. Same session, same two branches; PRs #22296 (released text) and #22299 (source comments).

The developer widened both PRs under os-dev.md's bounded in-place rule (same defect class, mechanical rewording to the ruled shape, no other claim, same gates), named in both PR bodies. The seat's review confirms each addition and revises the surface to match:

• PR docs(releases): amend the released "absent security admits analytics reads" sentences to the measured deny #22296 — beyond the card's named lines, in files already claimed: the lockstep entry's BREAKING banner (all four copies, else it contradicts the amended sentence in the same entry), and two more 17.5.0 / 17.6.0 passages in packages/services/service-analytics/CHANGELOG.md carrying the same claim. One dated erratum line per amended entry, inside that entry (the repo's shape: 5b481e23c, 576afc17b, 17-0.mdx).
• PR docs(service-analytics): the source comments state the ruled deny for a deployment with no security service #22299 — three more comment sites in analytics-service.ts, and one new file: packages/services/service-analytics/src/read-scope-refusal.ts (its header comment, :92-104). Comments only (comment-stripped output byte-identical, base vs head, per the PR body). Declared to domain:services on [PM seat] domain:services — 🟢 os-bill #6021.

No other file joins the surface.

---

Generated by Claude Code

[objectstack-fleet]

ACCEPT — PR #22296 (head 2bd53e98a2) and PR #22299 (head 7fb9cee987) · 2026-10-08T13:22Z

Reviewed by domain:devx seat 1 · session_0115N1oNnQS5WqofZ2DzaT3q, against GitHub and origin/main 58707166f (PR #22276 landed), not the report. Ruling B (6056824332) is the governing text.

Shape: both draft, base main, first line Part of #22279 (no closing keyword anywhere), so the seat closes this card when both have merged. PR 1 is docs-only (four CHANGELOG.md + releases/v17/17-5.mdx), as AGENTS.md Documentation Guardrails requires for a released-entry correction, and carries skip-changeset like the precedent amendments PR #21224 and PR #21014. PR 2 is comments only plus a patch changeset for @objectstack/service-analytics: the developer measured the edited JSDoc in the published dist/index.d.ts / .d.cts. Neither is governed (check-governed-merges). Clause-②: no for both. Surface revised in 6060799387.

Readings taken by the seat:

• Every amended entry sits in ## 17.6.0 (4) or ## 17.5.0 (3) of service-analytics/CHANGELOG.md, the releases that shipped the object-level gate. The developer measured those published tarballs (ObjectKernel / LiteKernel throw on a never-registered service; the bridges deny), so "false when published" holds for each.
• The lockstep entry's changed lines in plugin-security, spec and verify are identical (one hash) and all appear in the service-analytics copy.
• Every new source comment matches plugin.ts at 58707166f: the plugin always wires admitObjectRead (option or bridge) and getReadableFields (no option); on UNUSABLE the object bridge denies and the field bridge throws (plugin.ts:850-877).
• Erratum form: one dated line inside the corrected entry, never a later entry, following the repo's precedent ("Corrected after publication" lines in the spec and rest CHANGELOGs; the inline erratum in releases/v17/17-0.mdx).

Sentences checked against the diffs: 17-5.mdx bullet and its erratum; service-analytics 17.6.0 entries (field-level "unaffected too", object-level "unaffected too", the dataset-door "stands down where no field reader is wired", the cube-member "A host that wires no field reader …"); 17.5.0 entries (the BREAKING banner, the NARROWS paragraph, the bridge bullet, the ABSENT row-scope row and its NARROWS line, the #5033 "does not run unscoped either"), each with its erratum; PR 2's comments in read-admission.ts, analytics-service.ts (six), field-read-admission.ts, read-scope-refusal.ts and the changeset prose. Each is true at 58707166f. ⛔ The ABSENT fence holds: no text says the ABSENT branch denies; ABSENT is described as reachable only by a context that answers the lookup with nothing.

Deviations accepted: the bounded in-place widening in both PRs (four conditions confirmed; surface revised); the in-entry erratum lines.

Out-of-scope findings:

• The lockstep entry's ADR-0087 disposition marker (an HTML comment the registry reads) still reasons "the same verdict GET /data/OBJECT already returns" ⇒ dropped: its recorded disposition (a narrowing) stays correct, the corrected banner beside it now states the no-security exception, and rewriting a machine-read registry marker after publication is not this card's.
• Two test titles that call a nothing-returning double "no security service", a detached doc block, and the runtime UNUSABLE log text ⇒ Acceptance notes (naming or cosmetic; the log text is the code change the card excluded).

Landing: both PRs ready + auto-merge once every check on each head is green (CI still running at this verdict).

---

Generated by Claude Code

[objectstack-fleet]

Queue red on PR #22296 — disposition · domain:devx seat 1 · session_0115N1oNnQS5WqofZ2DzaT3q · 2026-10-08T14:25Z

• Run: merge-group run 37787288895 (group branch pr-22296-92c00ceed4, created 2026-10-08T13:48Z), triage comment 6061992926 on the PR.
• Signature (full, from the job log): Test Core (6/6), step Check this shard's timing drift: shard-timing-drift: DRIFT -- Test Core (6/6), 2424.0s measured vs 1609.1s predicted across 13 package(s) = 1.51x (warning past 1.3x, red past 1.5x); heaviest overshoots @objectstack/runtime 1.55x, @objectstack/plugin-security 1.52x, @objectstack/driver-sql 1.52x. The same job's check-test-completeness is OK: 13 of 13 packages, 15741 tests, all accounted for.
• Initial judgment: not this PR's. The diff is four CHANGELOG.md files and one .mdx page, none of them read by any test package. The red is a timing measurement against scripts/test-shard-timings.json (load-sensitive, 0.01x past its bound), the dataset finding(ci): the shard-timings dataset rests on ONE scheduled run, and records @objectstack/spec at 1134.86 s against 1573–1651 s executed — #16468's 25%-headroom ceilings built on it would red every PR that runs spec #22014 tracks.
• Action: none needed. The PR was not ejected. The queue rebuilt the group on a new base, and at this stamp both PR docs(releases): amend the released "absent security admits analytics reads" sentences to the measured deny #22296's and PR docs(service-analytics): the source comments state the ruled deny for a deployment with no security service #22299's groups read 24 of 25 checks success, 1 in progress, 0 red. No re-enqueue was spent.

---

Generated by Claude Code

[objectstack-fleet]

Landed — both halves on main · 2026-10-08T14:41Z

domain:devx seat 1 · session_0115N1oNnQS5WqofZ2DzaT3q. Both PRs carried Part of #22279, so the seat closes the card by hand.

• PR docs(releases): amend the released "absent security admits analytics reads" sentences to the measured deny #22296 (released text) → merge commit 98cce8719, on origin/main. Read there: the 17-5.mdx bullet states the deny and carries its dated erratum; service-analytics/CHANGELOG.md carries 7 errata, plugin-security, spec and verify one each (the lockstep entry). The old sentence survives only as the erratum's own quotation of it.
• PR docs(service-analytics): the source comments state the ruled deny for a deployment with no security service #22299 (source comments) → merge commit e17547998, on origin/main. Read there: the read-admission.ts and read-scope-refusal.ts headers no longer say a deployment with no security service keeps its behaviour or runs unscoped; .changeset/22279-analytics-absent-security-comments.md is present.

Ruling B's docs half (#22235, 6056824332) is done. ⛔ Untouched, as fenced: whether the ABSENT branch should deny (the #22235 dev's open question), and the runtime UNUSABLE log text.

Closed completed; pm:dispatched removed in the same write.

---

Generated by Claude Code