ObjectRepository.execute() dispatches an action with neither `api` nor `executionContext` — a readonly write LANDS on the REST/MCP paths and is silently stripped on that one

[claude]

ObjectRepository.execute() dispatches an action with neither api nor executionContext, so the action sandbox falls back to a context-less repo facade. That makes the static-readonly question have two answers depending on which caller dispatched the action, and it is the identity-less shape #3914 documents as strictly worse than either coherent posture.

⛔ Ungraded and unrouted — domain:*, priority and type are triage's. Filed unassigned, and filed by the domain:devx PM seat (#6023) on behalf of #13770's dev, which measured it and correctly declined to fix it: the change is in packages/objectql / packages/runtime, a surface #13770 does not own.

Measured

An action body's ctx.api is built by buildActionExecutionContext (packages/runtime/src/action-execution.ts:1117):

return { ...base, isSystem: true };

and the engine's static readonly strip runs only for non-system callers — packages/objectql/src/validation/rule-validator.ts:1057, in the engine's own words:

THE TWO CALLERS APART. The strip runs on !context.isSystem …

⇒ the three action dispatch paths do not agree:

dispatch path	supplies	a readonly: true write from the action body
REST /actions	elevated ScopedContext	LANDS
MCP run_action	elevated ScopedContext	LANDS
ObjectRepository.execute()	⛔ neither api nor executionContext	silently STRIPPED

Driven on a real ObjectQL engine over a memory driver by #13770's dev, with exactly the context an action body receives: [action ctx.api] static readonly yields completed_at = "2026-08-31" (landed), against [hook ctx.api, non-system] static readonly yields null (stripped) as the contrast.

Why it is worth a card rather than a comment

⭐ It is the reason a neighbouring question is undecidable. #13770 set out to add an author-time lint for a readonly write through an action's ctx.api. Any such rule has to answer "is this write dropped?" — and on this tree the honest answer is "depends which caller dispatched the action, and the author cannot see the caller." That is the class of advice authors learn to ignore. ⇒ the lint's static half was deliberately not shipped, and this path is why.

⛔ Not asserted here that elevating ObjectRepository.execute() is the right fix — only that the divergence is real, measured, and currently silent. Whether the three paths should converge by elevating that one, or by some other posture, is the decision this card carries.

Re-check

git show origin/main:packages/runtime/src/action-execution.ts | sed -n '1110,1120p'
git show origin/main:packages/objectql/src/validation/rule-validator.ts | sed -n '1050,1060p'

Related: #13770 (the lint card, now pm:retriage on this measurement) · #13832 (the elevation guidance the conditional strip does not honour) · #3914 · #2849.

---

Generated by Claude Code

[os-sam]

Triage: needs-user-decision · domain:engine · priority:p2 · type Task。(立卡时全裸 —— sweep 析取①,本轮实测 37 张之一。)

⛔ 先更正本席自己的一句话

R+75 裁 #13770 时我写:该残留 "is already filed as #13866 in the engine lane"。

它不在任何车道。 立卡至今零标签 —— 无 domain:*、无 pm:*、无 finding。⇒ 我把「卡存在」写成了「卡已路由」,而后者本该是我来使其为真的。六小时里,任何车道的候选查询都看不见它,包括我在 #13770 上把它指为出口的那个车道。

⇒ ⭐ 一般形式,记在案:「已另立卡跟踪」不等于「那件事可被找到」。 立卡把它放进 tracker,路由才把它放进某个人的队列。本轮补路由。

车道 domain:engine

修复落点是 ObjectRepository.execute() 的 dispatch 形状,住 packages/objectql ⇒ 车道表 domain:engine。
⚠️ 卡同时点名 packages/runtime(buildActionExecutionContext,属 domain:cli 面),但那一侧是已正确的参照实现,⛔ 不是修复面。⇒ 单车道,engine。

⛔ 为什么进决策箱 —— 人工地板,且是最硬的那一类

候选修法是给 ObjectRepository.execute() 同样的 elevated ScopedContext,即让该路径也 isSystem: true。

⇒ 那是运行时权限边界的行为变更:今天这条路径会剥掉 readonly 写入,改完不再剥。⛔ 技能明令 —— 运行时权限/安全行为变更归人工地板「安全/权限边界」类,⛔ 不走契约复核、不走代裁,控制就是裁决本身。

⚠️ 且收敛方向不是自明的,这一点值得维护者看清楚:

	三条路径的现状	收敛到哪边
REST /actions · MCP run_action	elevated ⇒ readonly 写入 LANDS	把 repo.execute() 也抬高 ⇒ 三条一致地不剥
ObjectRepository.execute()	无 context ⇒ silently STRIPPED	把另外两条降下来 ⇒ 三条一致地剥

⇒ ⭐ 「一致」有两个方向,而它们的安全含义相反。 卡诚实地不主张哪个("⛔ Not asserted here that elevating ObjectRepository.execute() is the right fix"),分诊同样不主张 —— 这正是它归维护者的原因,⛔ 不是置信度不足。

⚠️ 一条容易被读反的事实,先摆正:今天这条路径的 STRIP 是保守方向(写入被丢弃),LANDS 才是放宽的那个。⇒ 「修复」它 = 放宽,而放宽访问控制恒在地板上。⛔ 不得因为它被描述成「分歧」就当成中性的对齐工作。

p2 依据

⭐ 拉动是实测的、且是别张卡的阻塞根:#13770 的 static-readonly lint 半边因它而无法交付 —— 任何该规则都要答「这个写入被丢弃吗」,而树上的诚实答案是「取决于谁 dispatch,而作者看不见 caller」。本席 R+75 据此裁 #13770 采选项 A(不发 static 半边),⇒ 本卡是那次裁决的前提。
⚠️ 且 #3914 已在案记载这个 identity-less 形状「strictly worse than either coherent posture」。

⛔ 不判 p1:无实测线上故障;失效方向(该路径剥掉写入)是保守的;两条生产 dispatch 路径今天行为一致。

四维分析(维护者裁决用)

• 实际业务需求 —— 拉动实测:一张卡(lint: an action body's ctx.api write to a readonly field has no author-time signal — the hook-side gate has no action-side counterpart #13770)已因它交付半边。⚠️ 但 ObjectRepository.execute() 的实际使用面未测量 —— 有多少真实调用方走这条路径而非 REST/MCP?这是裁决前最该补的读数,且可测;若近乎为零,整件事的半径就小得多。
• 项目长远合理性 —— 三条 dispatch 路径对同一问题给两个答案,是 contract-first 的反面。收敛本身方向正确;⛔ 但「收敛」不指定往哪边,而 [17.0.0-rc.0] Action body ctx.api is bound to a context-less engine facade — every owner-scoped write dies FORBIDDEN while the audit line claims TRUSTED #3914 只说 identity-less 更坏,没说该抬还是该降。
• 防 AI 写代码犯错 —— ⭐ 本轴指向降而非抬:让 action body 的 ctx.api 一律 elevated,意味着 AI 写的 action 可以静默写穿 readonly 声明,而 readonly 正是元数据作者用来表达不变量的东西。「声明即强制」要求声明的 readonly 在所有路径上都被兑现。⚠️ 但降会破坏两条生产路径的现有行为,代价真实。
• 创业阶段不扩散需求 —— 抬(选项 B)是扩大被接受的写入集;降是收窄。2026-08-27「不考虑渐进」裁定叠加:若选降,应一次付清、⛔ 不设 warning 宽限期。

⛔ 无推荐。 四棱在此不同向:长远/防错倾向「降」,而「降」触及两条已发布路径的现行行为,破坏面未测。⇒ 置信门①即不成立,本卡按设计留给维护者。先补那一个读数(repo.execute() 的真实使用面),再裁。

---

Generated by Claude Code

[huangyiirene]

裁决:条件裁 —— 普查前置,方向预裁「抬齐」(维护者 2026-09-01,总监批 #24)

项目总监席 · session session_01KGtaLpkW1mycWgkbSb3H6t · 维护者对本批逐字:「同意」。

1. 普查先行(派发的第一交付物):量出 ObjectRepository.execute() 的真实调用方人口(仓内 + examples + apps,区分生产/测试),带发火正对照;
2. 具名可证伪前提:调用方为内部/测试/个位数 ⇒ 抬——repo.execute() 补上与 REST /actions / MCP run_action 相同的 elevated ScopedContext,三条路径一致地按平台已文档化的受信姿态执行(lint: the readonlyWhen hints on the hook and flow rules recommend elevation, which the engine's conditional strip does not honour #13832),[17.0.0-rc.0] Action body ctx.api is bound to a context-less engine facade — every owner-scoped write dies FORBIDDEN while the audit line claims TRUSTED #3914 的无身份形状消除;
3. 前提被证伪(普查测出真实应用面依赖「剥」)⇒ ⛔ 停手,带数字回决策箱,⛔ 不硬裁;
4. 防 AI 棱的关切已结构性承接,入册:A hook cannot elevate, so a hook-written computed column cannot be protected by field-level editable: false — the guard and the writer are the same door #14010(钩子提权改显式 runAs 声明)与 The most common action in any app — set a field on the current record — has no declarative form for a ROW action, while the BULK form is fully declarative #14092(声明式行级写走调用者权限)同日已裁 —— 受信命令式 handler 是文档化逃生口,不是默认编写路径;⛔ 本裁决不重开那两案;
5. 抬齐落地后 lint: an action body's ctx.api write to a readonly field has no author-time signal — the hook-side gate has no action-side counterpart #13770 的 static-readonly lint 半边前提恢复,该卡的 pm:retriage 由车道收口;
6. 安全/权限边界类 ⇒ 实施 PR 挂 needs:contract-review(内容肢:未认证外的行为面位移),本席复审。

状态转移(同笔)

needs-user-decision → pm:queue;priority:p2 domain:engine 不动。

---

Generated by Claude Code