fix(docs): the shipped admin sets no longer carry the export wildcard - #235

Fixes #154

content/docs/configure/permissions/permission-sets.mdx, under Export is its own grant, told operators that package-shipped sets are re-seeded on upgrade so admin_full_access and organization_admin carry allowExport: true for you — i.e. that they need do nothing. That was true on 17.0.0. 17.1.0 withdrew the objects['*'].allowExport wildcard from the shipped admin sets (objectstack-ai/objectstack#8681), and there is deliberately no automatic replacement.

The failure this caused is silent at both ends: nothing fails at parse time on upgrade, and this is the page that told the operator not to act. An operator who followed it ships an upgrade in which administrators have quietly lost export on every object no app permission set names, and the page they consulted is the reason they did not look.

The change

One bullet, in one file. The replacement wording is aligned to the ratified correction this corpus already carries at content/docs/resources/changelog.mdx:87-94, and to the upstream 17.1.0 upgrade checklist — no third phrasing was coined. It now carries the four facts an operator acts on: the shipped admin sets (including the derived organization_admin_no_bypass) no longer grant export on the * wildcard; the re-seed is what takes it away rather than supplying it; there is deliberately no automatic replacement, so the grant must be authored per object in a set the operator authors; and nothing fails at parse time, so silence is not success.

Premise re-verified before writing — the PM's assumption held

The dispatch flagged a live question: the published CLI is 17.2.0, past the 17.1.0 this card was written against, so a later release could have restored the wildcard or added an automatic replacement — which would have inverted the advice. Verified against objectstack origin/main @ e452ad5:

• content/docs/releases/v17.mdx Highlights — 17.2.0 does not touch the export axis at all.
• packages/spec/src/identity/eval-user.zod.ts:96 — ADMIN_FULL_ACCESS_CAPABILITIES carries an explicit "[#8681] NO allowExport HERE, and it is not an oversight". allowExport appears in that file only in that comment.
• packages/plugins/plugin-security/src/objects/default-permission-sets.ts:141 — "no allowExport on the wildcard, and do not restore a narrower one". The shipped-set definitions carry no allowExport at all.
• The ADR-0087 semantic migration packages/spec/src/migrations/entries/semantic/18.admin-export-wildcard-removed.ts states the posture directly: "Nothing replaces the grant in the platform sets themselves", and "It cannot be mechanically converted, in either direction".

So the 17.1.0 ratification is still current on the 17.2 series, and the honest advice remains that the operator must act.

Anchor trap: heading kept, no inbound link touched

### Export is its own grant (line 49) is unchanged byte-for-byte, so the generated #export-is-its-own-grant anchor still resolves and no inbound link needed editing. A repo-wide sweep for that anchor found two inbound deep links, not one — configure/permissions/managing-access.mdx:147 (named in the dispatch) and configure/permissions/index.mdx:111 (not named). Both keep landing. Only the bullet body changed; the section's heading, table, code block and its other two bullets are untouched.

Deliberately not touched

• content/docs/resources/changelog.mdx:169-175 also says the admin sets "keep exporting" — that sits in the dated 17.0 changelog section and is a true statement about what 17.0 did. Changing it would falsify a historical record.
• permission-sets.mdx:60 ("Unset used to mean 'inherit read'. Since ObjectStack 17.0 it means denied…") is historical. Stays.
• configure/permissions/index.mdx:104 states the grant rule generically and is not false.
• The member_default bullet and the high-privilege/audience-anchor bullet are unaffected by the 17.1.0 change.
• Locale siblings are not swept — translations are not a dev agent's output here.
• Out of scope: [finding] No page defines the org-membership tier vocabulary — delegated_admin is addressable in two places and explained in none #153 is queued on this same file and its work is not done here; it remains open.

Rework — the one clause that coined a phrasing

Review caught that platform sets are not overridable was the single clause here with no source behind it: the ratified 17.1.0 wording says only that export is granted per object in an app's own permission set and that there is deliberately no automatic replacement. It never says that. It also collided with the established sense of the word in the platform tree, where packages/plugins/plugin-security/src/objects/default-permission-sets.ts:121 uses "override" for precedence within permission evaluation ("per-object entries fully override the wildcard for that object") — blurring the two invites the false and alarming reading that admins cannot be granted export at all.

dc33caf deletes the clause rather than rewording it: "in a set you author" already carries the intent, and the re-seed sentence already supports the point that editing the shipped set is futile. The word now appears nowhere in the page (grep -ci override = 0). The bullet's four operative facts are unchanged, and no other line in the file moved.

Verification

All three gates re-run from the repo root on the final commit dc33caf, with --force so the shared turbo cache could not replay a sibling's green. Exit codes captured by redirecting to a file before any pipe.

The locale-surface oracle is unchanged at 79 logical pages over 8 locales = 397 docs entries, with 0 unexpected / 0 missing on all three artifacts, confirming this edit adds no page and drops none. A control-character scan of the edited file is clean. No changeset: this repo has no changeset flow and no packages/.

Generated by Claude Code

Generated by Claude Code