[os-warren]

Requested by Warren · project thread

Fixes #180

What was wrong (measured on main 358c2ca, 18.2.0, live pnpm demo)

• duly_member, duly_manager and duly_admin all got 403 on sys_business_unit. ?expand=business_unit silently returned the raw id. A member's own task and duty pages showed BUSINESS UNIT ⓘ Pda7prUARyl9pj4e.
• A duly_admin who is not a platform admin imported samples/duties.csv with 0/19 rows: Business unit: no record matches "Northgate Quality". The Import resolves the unit by name under the importer's own read.

The change

• src/security/permission-sets.ts: sys_business_unit: { allowRead: true } in MEMBER_OBJECTS. Manager and admin inherit it through the existing spread. There is no write bit, no scope key and no fields map. The note says what the read discloses: every unit, every column, external_ref included, read only. It also says why there is no name-only mask (fix(plugin-security): an app permission set's readable:false on a sys_* field also masks platform admins who hold that set objectstack#29106): FLS readable:false also binds every admin who holds a Duly set. Measured: Setup → Business Units lost Kind, Head and Active, and the org chart went flat.
• test/security.test.ts: the "five duly objects" and "nothing outside the duly namespace" invariants each get one named exception, PLATFORM_READS. The grant is pinned exactly as parsed: read only, every other bit false.
• test/business-unit-read.test.ts (new) runs with real holders (buildContextForUser + SecurityPlugin + SharingServicePlugin): a member, a member + manager, and a member + duly_admin. For each it checks:
  • they list every unit and read their own unit by id;
  • they resolve a unit by name under their own read (the Import's lookup);
  • an expanded lookup on their own hand-made duty returns the unit's name;
  • create, edit and delete on a unit are refused;
  • no Duly set declares a field permission on sys_business_unit.
    Negative control: with the grant reverted, 13/26 fail (every read). The refusals still pass.
• docs/deployment/security.md: one row in the model table.

Step 0 report with the prototype measurements: project file duly-180-unit-name/step0.md.

Gates

pnpm validate ✓ · pnpm typecheck ✓ · pnpm test 46 files / 1316 tests ✓ · pnpm build ✓

Browser pass in en-US and zh-CN will follow in a comment.

---

Generated by Claude Code

[os-warren]

Browser pass on head e6c77d7: fresh pnpm demo (en-US) and pnpm demo:zh (zh-CN), each on its own database. CI verify is green.

check	en-US	zh-CN
member list / get units	200, 6 / 200	200, 6 / 200
member create / edit / delete unit	403 / 403 / 403	403 / 403 / 403
manager list / get / create / edit / delete	200 / 200 / 403 / 403 / 403	same
member's task and duty pages, Business unit / 部门	"Central Office" (link)	"集团总部" (link)
manager's task and duty pages	"Northgate Operations"	"北门生产部"
platform admin, Setup → Business Units	Kind, Head, Active filled, unchanged from main	same (公司 / 陈志远 …)
Import duties as a non-platform duly_admin (member + duly_admin)	19/19 created (main: 0/19)	19/19 created (zh copy of the sample, names translated through ZH_CN)

After the run the admin re-read all 6 units in each locale: none had changed.

---

Generated by Claude Code

[objectstack-fleet]

席位核对

ACCEPT — PR #183 at head e6c77d76ff8542b6d9fe29e2577fbebee46bfdc7 (duly lane seat, session session_011HyoSXGRy6L13mYq1Hp4n1, 2026-11-02T07:41Z). Implemented by the #180 card thread session_01JQwxba8DtH3fgAAexeLs8H under the #180 Claim.

• Shape: based on main 358c2ca. Fixes #180. Clause-②: no. Metadata-protocol: none.
• Files (API list): src/security/permission-sets.ts, test/security.test.ts, test/business-unit-read.test.ts (new), docs/deployment/security.md. This is exactly the claimed surface. No governed path.
• Gate: check-run verify is success on e6c77d7. mergeable_state is clean. A local git merge-tree is clean against main and against Give an applied duty its owner's business unit, and say when there is none #184's head; the two PRs share no file.
• Seat ruling, as applied: proposal A. sys_business_unit: { allowRead: true } sits in MEMBER_OBJECTS and is inherited by manager and admin. It has no fields map, no scope keys and no write bit.
• Read in the diff:
  • The note names every disclosed column, including external_ref.
  • The note cites fix(plugin-security): an app permission set's readable:false on a sys_* field also masks platform admins who hold that set objectstack#29106 as the reason there is no name-only mask.
  • security.test.ts pins the parsed grant exactly (every other bit false) in all three sets, as PLATFORM_READS. The namespace invariant skips only the named platform reads.
• Measured by the thread (fresh demo, en-US and zh-CN):
  • Member and manager: list 200 (6 units) and get 200; create, edit and delete all 403.
  • Unit names render on the task and duty pages.
  • Platform admin's Setup → Business Units is unchanged.
  • Import of samples/duties.csv as a non-platform duly_admin creates 19 of 19 (0 of 19 on main).
  • Negative control: with the grant reverted, the 13 read tests fail.
• Routed elsewhere:
  • F1 (an app set's readable: false binds platform admins) is fix(plugin-security): an app permission set's readable:false on a sys_* field also masks platform admins who hold that set objectstack#29106.
  • The seeded-task owner_id observation is on Decision: an imported duty is invisible to the person it names — which way to make a record visible to its owner? #143.
• Landing: direct-merge repo. The seat flips the PR ready and squash-merges it with expected_head_sha pinned.

---

Generated by Claude Code

[objectstack-fleet]

Landed

Seat landing at 2026-11-02T07:42Z (duly lane seat, session session_011HyoSXGRy6L13mYq1Hp4n1). The seat flipped the PR ready through the relay, then squash-merged it with expected_head_sha e6c77d7 pinned.

probe	reading
PR object	merged: true, merge_commit_sha 7e98661
origin/main by content	7e98661, single parent 358c2ca. MEMBER_OBJECTS carries sys_business_unit: { allowRead: true }, and docs/deployment/security.md has the new row

State: #180 is closed completed by Fixes #180, and pm:dispatched is removed. #184 (#179) shares no file with this PR and is still under review.

---

Generated by Claude Code