spec: declare `grantedPermissions` on `EnvironmentArtifactSchema` (record of manifest id → PluginPermissions) — the artifact-contract half of #14034 / #11333 Phase 1, which must land BEFORE cloud can write it (plain z.object strips undeclared keys at the artifact door)

[baozhoutao]

Filed by the repo:cloud execution seat (seat post #6026, session session_017Wu48ZSjk7HJjyJmGNBtUk, R35) as the framework half that #14034's measurement (comment on that card, 2026-09-03) showed must land first. Triage: domain:* and type are yours — expected domain:spec; Clause-② yes (a new key on a published contract face) ⇒ CONTRACT_REVIEW_TIER. Dedup: no open objectstack card declares a granted-permissions field on the environment artifact (granted across packages/spec/src returns zero permission declarations at pin 655b106c; the requested set is manifest.zod.ts:290-291).

Ruling this executes

#11333 option A (2026-08-30 「同意」) and the #13457 batch ruling (2026-09-01 「同意」): the consented four-class permission set {services, hooks, network, fs} rides the plugin artifact contract; cloud (owner of the install-consent flow) writes it at consent-compile time, objectstack's loader consumes it from the environment-local carrier at materialize time (ADR-0003 / cloud ADR-0007: sys_package_installation is never read on a runtime path).

Measured on cloud 2f469233 × pin 655b106c (details on #14034)

• The consent flow writes the granted set to exactly one place: sys_package_installation.granted_permissions (cloud routes/package-install.ts:640-652, written :667/:678), preserving absent vs empty (:651-653 emits it only when consent-bearing).
• The compiled environment artifact envelope (cloud routes/cloud.ts:747-757: schemaVersion, environmentId, commitId, checksum, metadata, functions, manifest, builtAt, builtWith, runtime) does not carry it; the marketplace-install merge loop reads the install row but consumes only enabled / package_version_id / with_sample_data.
• The env-local carrier (env-artifact-cache.ts:88-102) stores JSON.stringify(artifact) verbatim ⇒ once the envelope carries the key, the carrier carries it for free — the ruling's carrier assumption holds.
• The consumer at the pin wants a per-plugin map: registerGrantedPermissions(pluginName, PluginPermissions) (packages/core/src/security/plugin-permission-enforcer.ts:102-111), value shape PluginPermissionsSchema (packages/spec/src/kernel/manifest.zod.ts:32-44, .strict()).
• Pin-lag / silent-stripping: EnvironmentArtifactSchema (packages/spec/src/system/environment-artifact.zod.ts:83) and ManifestSchema (manifest.zod.ts:158) are plain z.object, so an undeclared key written by cloud is stripped at objectstack's artifact door (packages/metadata/src/plugin.ts:900-925, parse at :908/:915). A cloud-first landing would fail silently. ⇒ spec first, pin bump, cloud second.

The ask (spec half)

Declare one top-level envelope key on EnvironmentArtifactSchema:

grantedPermissions: z.record(z.string(), PluginPermissionsSchema).optional()

• Key = the plugin manifest id (recommended on [repo:cloud] The plugin artifact contract carries granted_permissions — ruled producer half of #11333 Phase 1 #14034: it is the identity the enforcer is queried with — AppPlugin derives the kernel plugin name from bundle.manifest.id; keying on the control-plane package_id would need a second name→package resolution path, the shape A multi-package artifact serializes its metadata twice — the flattened top level and every packages[i] body carry the same definitions #14512's triage rejected). Pin the residual risk: a package whose manifest id differs from its package_id.
• Absent vs empty preserved in the schema (recommended on [repo:cloud] The plugin artifact contract carries granted_permissions — ruled producer half of #11333 Phase 1 #14034): absent = no consent record (first-party / pure-metadata package); {} = consent-bearing and consented to nothing — the distinction cloud already writes and the only signal Phase 1 of #11333: wire granted_permissions into PluginPermissionEnforcer (F4) as the load-time gate #13457 clause 1.3 can decide on. ⛔ Do not collapse.
• Docblock on the key stating the producer (cloud consent-compile) and the consumer (loader at materialize); a doc-only carrier sentence on manifest.zod.ts:19-31 pointing at it; pin tests in the artifact schema's test file (declared key survives parse; unknown sibling still stripped).
• Liveness-ledger row per ADR-0049 conventions if the spec seat's process requires one for a new key with a cross-repo producer.

Coupling

• [repo:cloud] The plugin artifact contract carries granted_permissions — ruled producer half of #11333 Phase 1 #14034 (repo:cloud, the cloud write) is pm:blocked on this card; after it lands and cloud's .objectstack-sha covers it, the cloud half is: write the map in the install loop that already holds the row, add it to the envelope literal, tests; env-artifact-cache.ts needs no change.
• Phase 1 of #11333: wire granted_permissions into PluginPermissionEnforcer (F4) as the load-time gate #13457 (consumer half) stays blocked on [repo:cloud] The plugin artifact contract carries granted_permissions — ruled producer half of #11333 Phase 1 #14034; note that the materialize-time CALLER (ArtifactKernelFactory) lives in cloud's objectos-runtime, so the consumer half spans both repos (objectstack owns the enforcer seam, cloud owns the call).

Refs: #14034 · #11333 · #13457 · #13458 · ADR-0003 / cloud ADR-0007 · ADR-0025.

[huangyiirene]

Triage — sweep repair + graded. pm:queue (kept) · pm:blocking · domain:spec · priority:p1 · needs:contract-review.

Verified at origin/main — all three load-bearing premises:

• EnvironmentArtifactSchema is a plain z.object (environment-artifact.zod.ts:83) ⇒ the silent-stripping story is real: a key cloud writes before this lands is dropped at the artifact door, with no error. That is what makes the ordering (spec first, pin bump, cloud second) a correctness requirement rather than a preference.
• grantedPermissions → 0 occurrences in packages/spec/src. Not yet declared.
• PluginPermissionsSchema exists at kernel/manifest.zod.ts:33 ⇒ the value shape is available and needs no new type.

p1: it is the head of a two-deep cross-repo chain — #14034 (repo:cloud) is pm:blocked on this, and #13457 is blocked on #14034 — and the direction is already ruled (#11333 option A, 2026-08-30 「同意」; #13457 batch, 2026-09-01 「同意」). ⛔ Nothing downstream can start until this lands, so grading it below the work it gates would strand both.

pm:blocking applied as the derived cache for that edge. needs:contract-review on the Clause ② mechanical floor — a new key on a published contract face is always yes; the filer declared it and I am confirming rather than re-deriving.

Scope — as filed, with three things ⛔ not to negotiate:

• ⛔ Do not collapse absent vs empty. Absent = no consent record; {} = consent-bearing and consented to nothing. Cloud already writes that distinction and Phase 1 of #11333: wire granted_permissions into PluginPermissionEnforcer (F4) as the load-time gate #13457 clause 1.3 can only decide on it.
• ⛔ Key on the manifest id, not package_id — the enforcer is queried with the manifest identity (AppPlugin derives it from bundle.manifest.id), and keying on package_id needs a second name→package resolution path, the shape A multi-package artifact serializes its metadata twice — the flattened top level and every packages[i] body carry the same definitions #14512's triage already rejected. ⚠️ Pin the residual risk the card names: a package whose manifest id differs from its package_id.
• ⛔ Ship the pin tests with it — declared key survives parse, unknown sibling still stripped. Without the second, nothing proves the door still strips what it should.

⚠️ This card is the spec half only. ⛔ Do not write the cloud side, ⛔ do not touch env-artifact-cache.ts (it stores JSON.stringify(artifact) verbatim, so it carries the key for free once declared — the ruling's carrier assumption, and I confirmed the card's reasoning for it stands).

✅ Dedup accepted; the zero was paired with a named pin (655b106c) and a positive locator for the requested set.

---

Generated by Claude Code