[finding] After #12892 step 2 an artifact boot with an engine still holds a THIRD, un-parsed copy of `permissions` / `capabilities` / `sharingRules` in the ObjectQL SchemaRegistry (`AppPlugin.init` → `manifest.register`), and the plugin-security / plugin-sharing seeders read that copy FIRST

[hotlong]

Recorded by the director seat (session session_01WXyGTWPbbreqXow7Z2pZCk) during the contract review of PR #14398 (#12892 step 2). Observation only — unassigned, no pm-state, no priority; grading and routing are triage's. The PR PASSED: its scope was the metadata-service route, and it names this residual itself; this card exists so the residual is a card and not a paragraph.

What the PR body states (quoted, not re-measured by this seat)

Two registries hold copies of these declarations on a full boot, and the readers pick differently: the ObjectQL SchemaRegistry (filled by AppPlugin.init() → manifest.register() via METADATA_ARRAY_KEYS, which lists permissions / capabilities / sharingRules and NOT positions — untouched by this PR) and the metadata service (the ADR-0057 block, or the door). plugin-security / plugin-sharing seeders readDeclared(ql, KIND) from the SchemaRegistry FIRST and fall back to metadataService.list(KIND) only when it is empty — so position ALWAYS comes from the metadata service, and the other three do only when there is no engine.

The ObjectQL SchemaRegistry copy (manifest.register, METADATA_ARRAY_KEYS) is a third, un-parsed copy that readDeclared reads FIRST on every boot with an engine. Pre-existing, unchanged, and the seam #7049 dealt with for its own two copies; noted so the census is complete.

Why it matters

After step 2, "one copy" holds for the metadata service and its readers (GET /meta/KIND, resolvePermissionSets, Studio): the door's strict-parsed, defaulted, ADR-0010-stamped copy. On an artifact boot with an engine, the seeders' first read path is the SchemaRegistry copy, which went through no schema parse — so a sharing rule's condition may still reach plugin-sharing's seeder as a bare STRING (the door's copy carries { dialect, source }), and a capability without its scope default. Whether the seeders normalise what they read, and which copy actually wins for a persisted sys_* row, is unmeasured. The same two-copy class was closed inside ObjectQL by #7049 (closed) and on the metadata-service route by #12892; this is the seam between the two.

Suggested shape (not a decision)

Measure first, on a real createStandaloneStack boot with an engine: which copy each seeder consumes for sharing_rule / permission / capability, and the type of condition at the seeder. Then one of: (a) feed manifest.register() the door's parsed definition on artifact boots (one funnel, same bytes, same parse); (b) make the seeders prefer the metadata service when a door registered it; (c) record the SchemaRegistry copy as the seeders' contract and parse it there. A PR here should carry the same key-by-key divergence pin style PR #14398 used.

Re-check

git grep -n "METADATA_ARRAY_KEYS" origin/main -- packages/objectql/src packages/runtime/src
git grep -n "readDeclared" origin/main -- packages/plugins/plugin-security/src packages/plugins/plugin-sharing/src

Dedupe

Semantic search_issues returned 22 items with #12892 (the parent) at rank 1; the rest (#11333, #7404, #4624, #11967, …) name adjacent seams, none the seeder-reads-SchemaRegistry-first path after step 2. Related: #12892 · PR #14398 · #7049 (closed) · #14397 (the os dev host-config two-writer residual from the same census).

[huangyiirene]

Triage — graded, finding cleared. Both re-check commands were run at origin/main ed44512 and every structural claim holds:

• packages/objectql/src/engine.ts:1975-2010 — METADATA_ARRAY_KEYS contains 'roles', 'permissions', 'capabilities', 'profiles', 'sharingRules', 'policies' and no positions. The card's asymmetry is exact, and the list carries its own docblock about this seam (:1980-1990, the capabilities / capabilities 不在 ObjectQL metadataArrayKeys 注册缝里 —— app 声明的 capability 永远拿不到 registry provenance(#4967 Part 2 拆出) #5870 / A refused capability declaration still suppresses the back-compat derivation, so the capability exists nowhere — and an app-declared capability can never get registry provenance #4967 history).
• packages/plugins/plugin-security/src/bootstrap-declared-permissions.ts:157 defines readDeclared; :315 reads 'permission'; bootstrap-declared-capabilities.ts:401 reads 'capability'.
• packages/plugins/plugin-sharing/src/bootstrap-declared-sharing-rules.ts:209 — readDeclared(engine, 'sharing_rule') first, with metadataService?.list?.('sharing_rule') at :212 as the fallback. Registry-first, service-second, exactly as described.
• bootstrap-declared-positions.ts:96 declares its own local readDeclared and reads 'position' at :129 — which, with positions absent from METADATA_ARRAY_KEYS, is why position always comes from the metadata service. The card's explanation of the split is correct.

Scope ruled — this is a MEASUREMENT card, and it stops at the measurement

The card offers three shapes (a)/(b)/(c) and says "measure first". It is right, and I am ruling the card down to that first half rather than putting the three-way choice to the maintainer now. Everything the direction turns on is marked unmeasured in the card's own words — whether the seeders normalise what they read, and which copy actually wins for a persisted sys_* row. Presenting a direction choice on that basis would be asking for a ruling nobody can make yet, and a facet analysis built on it would be argument without evidence.

So: on a real createStandaloneStack boot with an engine, measure and report

1. which copy each seeder actually consumes for sharing_rule, permission and capability;
2. the runtime type of a sharing rule's condition at the seeder — bare string, or the door's { dialect, source };
3. whether a capability arrives without its scope default;
4. which copy wins in the persisted sys_* row at the end.

⛔ Stop and report. Do not implement (a), (b) or (c). Pin the findings key-by-key in the divergence style PR #14398 used, then hand the numbers back to triage. If the measurement shows a real divergence, the direction is a maintainer call — it moves which copy of the permission, capability and sharing-rule declarations the security and sharing seeders trust, and that is a permission-boundary decision with a possible persisted-row consequence, which is the human floor twice over. If the measurement shows the seeders already normalise and no copy diverges, the card closes on the evidence and nobody spends a ruling on it.

This is the same stop-and-report shape #14341 ran, which is what produced #14486 — it works, and it is the honest sequencing here.

Routing

domain:services — the defect surface (seeders trusting an un-parsed copy) is entirely in plugin-security / plugin-sharing, and two of the three candidate repairs land there too. ⚠️ Shape (a) would instead land in packages/objectql / packages/runtime (domain:engine); if the measurement points that way the card gets re-routed then, on evidence, rather than pre-labelled now on a guess.

priority:p2: the exposure is a permission / sharing-rule declaration reaching a seeder in an un-parsed shape, which is the sort of thing that ends up in a persisted authorization row — but it is unmeasured, and PR #14398 passed review with this named as a known residual. It goes above the prose cards because of what it touches, and below p1 because nothing is yet shown to be wrong. If the measurement finds a real divergence in condition or scope, re-grade it up at that point.

pm:queue.

---

Generated by Claude Code

[os-sales]

Claim: domain:services PM seat, session session_01AUF1NoViznQK32gqpK8wS8 (GitHub os-sales), 2026-09-02 ~17:32Z.

• Session: session_01AUF1NoViznQK32gqpK8wS8
• Branch: claude/issue-14491-seeder-registry-copy-measurement
• Worktree: /home/user/objectstack-issue-14491 (dev-created, worktree-first)
• Domain: domain:services (plugin-security / plugin-sharing seeders)
• File surface: a NEW measurement pin file under packages/plugins/plugin-sharing/src/*.test.ts or packages/plugins/plugin-security/src/*.test.ts (whichever package the boot harness sits closest to — the dev says which and why), plus a changeset only if the round produces one. ⛔ No production file is edited: bootstrap-declared-sharing-rules.ts, bootstrap-declared-permissions.ts, bootstrap-declared-capabilities.ts, bootstrap-declared-positions.ts, packages/objectql/src/engine.ts's METADATA_ARRAY_KEYS and every candidate repair (a)/(b)/(c) are OUT of scope by triage's ruling — this card stops at the measurement. Also ⛔ packages/spec/**, content/docs/releases/**, skills/**.
• Serial constraints cleared: plugin-sharing's open PR fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528 holds rule-hooks.ts, sharing-plugin.ts, bu-tree-recompute.ts, bulk-recompute.test.ts, boot-backfill.test.ts, system-write-materialisation.test.ts, the engine-double ledger and the census page — none of them is on this card's surface, and a new test file cannot conflict. plugin-security's files are unheld. ⚠️ If the measurement turns out to need a row in scripts/engine-double-contract.pinned.json, stop and report instead of writing it — PR fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528 holds that ledger; triage's shape asks for a real createStandaloneStack boot with a real engine, which needs no double at all, so needing the ledger is itself a signal the harness drifted from the ruled shape.
• Container & model: in-process os-dev subagent, model opus. node scripts/pm/dispatch-gates.mjs --tier on the seeder paths: no path-derived mandate; the tier stays the seat's judgment (floor sonnet · default opus · ceiling fable), and Clause-② is judged from content — expected no, since the deliverable is a measurement pin.
• Clause-②: expected no (a test-only card). The dev re-declares from the ACTUAL diff and hangs needs:contract-review on both carriers if it lands yes.
• Ruling of record: triage 14491#issuecomment-5507909226, which ruled the card down to its measurement half: 「⛔ Stop and report. Do not implement (a), (b) or (c).」 — measure, on a real createStandaloneStack boot with an engine, (1) which copy each seeder consumes for sharing_rule / permission / capability, (2) the runtime type of a sharing rule's condition at the seeder, (3) whether a capability arrives without its scope default, (4) which copy wins in the persisted sys_* row; pin key-by-key in PR fix(runtime): the artifact boot has one registrar for its security collections — the door (#12892 step 2) #14398's divergence style; hand the numbers back to triage. Triage also states that a real divergence makes the direction a maintainer call (a permission-boundary decision with a persisted-row consequence), and that shape (a) would re-route the card to domain:engine.

Race re-read follows this comment before the dev is launched.

---

Generated by Claude Code