Scaffold: a new project has no wired place for permission sets or datasets, and os generate has no type for them

epic:#26676#1 · zhuangjianguo · session_cdb7a717def74e719988f089fbaa18ff

From a real-user walkthrough of the development flow, filed on the maintainer's word: 「第一组：会卡住人或误导人，立卡」 (2026-11-04). Measured on main 987ff33b88 unless a line says otherwise. Test project scaffolded with create-objectstack@18.3.0.

What a customer sees

A developer scaffolds a project. An app that real users sign in to needs permission sets. The generated project has no src/security, the config has no key for it, and os g cannot make one. Datasets for a dashboard are the same. Both work once wired by hand, which is what this walkthrough did.

Measured

packages/create-objectstack/src/templates/blank/objectstack.config.ts imports objects, views, actions, flows, dashboards, apps, skills and picklists. It has no permissions or datasets.
packages/create-objectstack/src/templates/AGENTS.md:76 says these "are exactly the directories objectstack.config.ts wires" and tells the reader a new directory needs its barrel and its stack key. So the docs are honest, and the gap is the starting point.
GENERATORS in packages/cli/src/commands/generate.ts has object, view, action, flow, dashboard, app, skill, picklist and more, with no permission set and no dataset.
templates/AGENTS.md writes npm run … throughout, and the generated file keeps it in a pnpm project (7 occurrences, published 18.3.0). npm run still works there, so this is a small mismatch only.
A plain dataset object needs as const to pass the type check (published 18.3.0).

Expected

The scaffold ships a wired, empty src/security (and datasets, if the seat's reading of need holds in review), os g covers them, and the generated AGENTS.md names the package manager the project was created with.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: first-touch audit · p2 · `domain:server` · `pm:queue` · 2026-11-04T16:30Z

⛔ Not a claim.

Read fresh. The scaffold (create-objectstack blank template) has no wired place for permission sets or datasets, and os generate has no type for them. templates/AGENTS.md also says npm run in a pnpm project. p2.

Generated by Claude Code

domain:server#4 · os-bill · session_01Utp6CZMkHvuDeVYgTD73qF

Claim: PM loop round 1
Session: session_01Utp6CZMkHvuDeVYgTD73qF (seat) · dev card thread session_01Utp6CaSDwi65gmZEL5wiWy
Account: os-bill
Branch: claude/project-thread-qk8494 (the card thread's designated push branch, the recorded platform exception to claude/issue-<n>-<slug>)
Worktree: objectstack-issue-30123
Domain: domain:server
Seat: domain:server#4
File surface: packages/create-objectstack/src/templates/** (blank template config, new empty src/security / src/datasets, generated AGENTS.md) and the create step that knows the package manager, packages/cli/src/commands/generate* (new permission-set / dataset generator types) and their tests, one changeset; amended 2026-11-05 after the dev's report 6649293531: the docs that name these commands (content/docs/deployment/cli.mdx, packages/cli/README.md, packages/create-objectstack/README.md, the blank template's README.md). ⛔ packages/spec/**, docs/adr/**, .claude/**, repo-root AGENTS.md, ui/**, skills/** beyond a one-line pointer (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default judgment tier (opus) — dispatch-gates --tier: no path-derived mandate, effort: high
Clause-②: yes (widening) — os generate accepts two new type values, permission and dataset; nothing removed or narrowed (amended from no per the dispatch order's rule)
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: 6636088019
Premise: holds
Serial constraints cleared: none — no in-flight claim or open PR names create-objectstack/src/templates/** or cli/src/commands/generate*; seat 3's #30106 claims packages/cli/src/commands/package/**, a different command tree.

Dispatch order: /mnt/project-files/server-seat4/dispatch-30123.md (project shared folder). Ruling section: the card's origin 「第一组：会卡住人或误导人，立卡」 (maintainer, 2026-11-04) and triage audit 6636088019. If a new os g type adds a public export or flag value, the dev declares yes (widening) and the seat amends this line.

Posted 2026-11-05T03:12Z.

domain:server#4 · os-bill · session_01Utp6CZMkHvuDeVYgTD73qF

os-dev-report

Dev card thread session_01Utp6CaSDwi65gmZEL5wiWy, PR #30258, head c45f7cb0.

{
  "issue": 30123,
  "status": "done",
  "branch": "claude/project-thread-qk8494",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/30258",
  "session": "session_01Utp6CaSDwi65gmZEL5wiWy",
  "premise_still_valid": true,
  "summary": "The blank starter ships empty src/security and src/datasets barrels wired to the existing permissions and datasets stack keys (no spec change). os g gains two roster types, permission (src/security/NAME.permission.ts, definePermissionSet granting read/create/edit on the bound object with readScope 'own') and dataset (src/datasets/NAME.dataset.ts, defineDataset with a record_count measure, grouped by the title field), so os init wires them too and every derived pin measures them. The generated AGENTS.md and copilot-instructions.md fill the detected package manager into all eight run commands. Type keys are the registry's (permission, dataset), not the order's suggested permission-set, because the key names the file infix and the stack key.",
  "tests": "create-objectstack vitest: 23/23 files, 362/362 tests (on ce2e6f6f and again on merged head c45f7cb0); new AGENTS.md describe, ablation of the PM fill in index.ts via ablation-replace: 2 failed, restored blob == HEAD, git diff HEAD empty. cli unit project on ce2e6f6f: 384 files, 5394 passed, 29 skipped (2 published-subpath files first refused 'packages/cli is not built', then 29/29 after pnpm --filter @objectstack/cli build). Zero-findings pin first went red for permission (security-private-no-readscope info at validate/build/lint); fixed by declaring readScope 'own'. cli integration create-objectstack-stack-reach + picklist pin: 9 passed. OS_TEST_TIERS=nightly generate-scaffolds-reach-stack.e2e + generate-scaffold-gates.e2e: 58 passed. Post-merge c45f7cb0: spec+cli rebuilt, 7 targeted unit files 169 passed.",
  "gates": "dispatch-gates --commands --repo objectstack-ai/objectstack: 93 derived; --ran: 89 run exit 0, 4 NOT MEASURED exit 3 prerequisite (check-plugin-teardown-shape --self-test shallow clone; spec check:skill-examples needs client builds; check:dual-build-cjs-loads and check:i18n-coverage need packages outside the build closure) - left to CI. pnpm lint :: exit 0. pnpm --filter @objectstack/cli --filter create-objectstack run typecheck :: exit 0. PR check-runs: in_progress at report time.",
  "line_budget": "13 files, +397 -19 (origin/main...c45f7cb0)",
  "files_changed": [".changeset/30123-scaffold-security-datasets.md", "content/docs/deployment/cli.mdx", "packages/cli/README.md", "packages/cli/src/commands/generate-permission-dataset.pin.test.ts", "packages/cli/src/commands/generate.ts", "packages/create-objectstack/README.md", "packages/create-objectstack/src/index.ts", "packages/create-objectstack/src/scaffold-next-steps-pm.test.ts", "packages/create-objectstack/src/templates/AGENTS.md", "packages/create-objectstack/src/templates/blank/README.md", "packages/create-objectstack/src/templates/blank/objectstack.config.ts", "packages/create-objectstack/src/templates/blank/src/datasets/index.ts", "packages/create-objectstack/src/templates/blank/src/security/index.ts"],
  "deviations": ["Clause-②: declared yes (widening) in PR body and changeset, the claim says no: os generate accepts two new type values; the order says the seat amends the claim line.", "Type keys permission/dataset instead of the suggested permission-set: registry type key drives file infix and stack key.", "File surface beyond the claim: content/docs/deployment/cli.mdx, packages/cli/README.md, packages/create-objectstack/README.md and the blank README list the two new types/directories (none is a forbidden path).", "pnpm lint run per the order although os-dev assigns repo scans to CI.", "Session-context MCP assignee/reviewer step skipped: the order forbids MCP writes; pr_create carried no assignees."],
  "dogfood_battery": "n/a - no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "0 GitHub MCP calls",
  "api_writes": "3 - git push (branch, not REST); relay pr_create POST /repos/objectstack-ai/objectstack/pulls (#30258, read-back identical 8080 bytes); post-stamped POST /repos/objectstack-ai/objectstack/issues/30123/comments (this report)",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": ["carrier: none · noted, not filed - src/security feeds only the permissions key; positions and sharing rules still need their own barrel and key (PR acceptance note)."]
}

Report taken 2026-11-05T03:58Z.

Generated by Claude Code

domain:server#4 · os-bill · session_01Utp6CZMkHvuDeVYgTD73qF

Landed · PR #30258

Reading	Value
PR #30258	MERGED 2026-11-05T04:45Z, merge commit `959c26be1`; `Fixes #30123` closed this card
`main` source	`packages/cli/src/commands/generate.ts:746` the `permission` scaffold type (the `dataset` type follows it)

State change: pm:dispatched removed, assignee cleared. #30119 (serial behind this PR on the template's AGENTS.md) is now unblocked.

Navigation Menu

Repository navigation

Scaffold: a new project has no wired place for permission sets or datasets, and os generate has no type for them #30123

What a customer sees

Measured

Expected

Triage: first-touch audit · p2 · `domain:server` · `pm:queue` · 2026-11-04T16:30Z

Landed · PR #30258

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Scaffold: a new project has no wired place for permission sets or datasets, and os generate has no type for them #30123

Description

What a customer sees

Measured

Expected

Activity

objectstack-fleet commented on Nov 4, 2026

Triage: first-touch audit · p2 · domain:server · pm:queue · 2026-11-04T16:30Z

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

Landed · PR #30258

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first-touch audit · p2 · `domain:server` · `pm:queue` · 2026-11-04T16:30Z