security(forms): a public-form setting at one metadata layer can re-open intake that another layer withdrew — 17.7 regression, detail withheld pending maintainer

[objectstack-fleet]

Found while verifying an authorization-class candidate from the 17.7 pre-release console run #21784 (access-security.public-form-intake area, outside the item's clauses), by an independent verifier (RUNNER rule 7) on current main.

• Class: authorization. A public form's anonymous intake can be re-opened by a metadata layer below the one that withdrew it, so a withdrawal does not hold. Reproduced twice. Under RUNNER rule 2 the reproduction and the mechanism are withheld pending maintainer; they are held in the PM session (Claude Code session session_018zT8d8NpiQ1ExhuNd5TxY6).
• Ruled: a withdrawal is a kill switch. Any layer that withdraws a public form's intake (or its anonymous access) closes it; layering may only narrow intake, never re-open it. Recorded by the PM seat from the maintainer's answer in that session, 2026-10-05, choosing 「全局关闭是总开关」.
• 17.7 regression: not present at 17.6.0 (617f25f8a); it arrived with a change merged after 17.6.0 (fix(rest): withdrawing a public form takes effect on every anonymous intake door #21420). It should be fixed before 17.7.0 is cut.
• Severity: p1 (a security control that does not hold).
• Owning repo: objectstack. Related, closed: security(forms): access-security.public-form-intake clause 7 (withdrawing a public form from anonymous intake) fails on 17.6.0 — detail withheld pending maintainer #21331, security(forms): withdrawing a public form from anonymous intake on a walled (and degraded walled) tenancy posture — follow-up to #21331, detail withheld pending maintainer #21468, security(forms): a second way of withdrawing a public form from anonymous intake is not honoured by the anonymous doors — sibling of #21331, detail withheld pending maintainer #21475. No open card covers it.

---

Generated by Claude Code

[objectstack-fleet]

Path: permissions that actually hold — small public doors that can be withdrawn | access-security.public-form-intake | P2

Triage: first grade — bug · security · priority:p1 · domain:services · area:access · pm:queue. A 17.7 regression in a security control: it lands before 17.7.0 is cut

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-05T07:53Z. ⛔ Not a claim, ⛔ not a dispatch. ⛔ Classes and positions only. The withheld detail stays withheld (RUNNER rule 2); this seat does not hold it.

Triage: lands in the public-form intake family (by class, the family of #21331, #21468 and #21475) ⇒ domain:services; rationale: the withdrawal state is the services lane's ruled single state, and the regression arrived with #21420.

• Ruled already (recorded on this card from the maintainer's answer, 「全局关闭是总开关」): any layer that withdraws a public form's intake closes it, and layering may only narrow intake, never re-open it. No decision is owed.
• Why p1, and why first. A security control does not hold, and it is a regression since 17.6.0 (via fix(rest): withdrawing a public form takes effect on every anonymous intake door #21420). The release-first rule makes it p1. 17.7.0 should not be cut while it is open: the version PR chore: version packages #21352 already carries fix(rest): withdrawing a public form takes effect on every anonymous intake door #21420.
• Pins: in both directions, on every tenancy posture. A withdrawal at any layer refuses at every anonymous door, and a lower layer cannot re-open it. A form published at every layer still accepts.
• The withheld detail goes to the claiming seat from the holding session (session_018zT8d8NpiQ1ExhuNd5TxY6) on the maintainer's word. ⛔ It is never restated on this card or its PR.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1 (17.7 pre-release follow-up, dispatched on the maintainer's direct order)
Session: session_018zT8d8NpiQ1ExhuNd5TxY6
Account: hotlong (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-21835-form-withdrawal-kill-switch
Worktree: objectstack-issue-21835
Domain: domain:services (card label, as triage set it)
File surface: packages/rest/src, packages/metadata-protocol/src, packages/qa/dogfood/test, .changeset/
Container & model: M, mode:subagent, model: opus (default tier; no path-derived mandate)
Clause-②: no
Thread-read: 5990373244
Serial constraints cleared: none named

Provenance: the maintainer, in Claude Code session session_018zT8d8NpiQ1ExhuNd5TxY6, 2026-10-05, verbatim: 「都开单派发」, with the ruling 「全局关闭是总开关」 recorded on the card; landing per the standing order 「开发完整就进队列合并」. Dispatched one at a time within the session's load cap. Where the card withholds detail, this session holds it and the dispatch carries it privately.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 21835,
  "status": "done",
  "branch": "claude/issue-21835-form-withdrawal-kill-switch",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/21864",
  "session": "session_018zT8d8NpiQ1ExhuNd5TxY6",
  "premise_still_valid": true,
  "summary": "Resumed after a container restart. The branch already implemented the ruling: a withdrawal is a kill switch, and layering can only narrow intake. Read time: GET /forms/:slug and POST /forms/:slug/submit share one resolver (resolveFormBySlug). When an organization is resolved, it reads the env-wide view layer beside the organization's, and a candidate is served only when no layer withdraws it (anonymousFormIntakeWithdrawnIn, new in metadata-core; the layers are ANDed). Write time: an org-scoped view save that would re-open a slug the env-wide layer withdrew is refused with 403 NOT_OVERRIDABLE and a userMessage naming the remedy. Saves that keep the form withdrawn, or leave intake unchanged, are still accepted. I found no gap, so I added no code. I merged origin/main (5 commits, clean, protocol.ts auto-merged), rebuilt the closure, ran the suites, the ablation and the dogfoods, and opened draft PR #21864 assigned to hotlong. The PR says the bug is a regression introduced after 17.6.0 (with #21420) and should land before 17.7.0. The #21420 org-only intake, the #21473 anchors and the #21566 field allowlist keep their behaviour: the full rest and metadata-protocol suites are green. Note for the seat: the claim's file surface omits packages/metadata-core/src, which the branch edits (it holds the shared predicate). Please add it to the claim.",
  "tests": "All at head 3730a51e5d. Build: pnpm --filter '@objectstack/rest...' --filter '@objectstack/metadata-protocol...' build, lock VERDICT command-exit 0. metadata-core test: 18 files / 394 tests passed, VERDICT command-exit 0. metadata-protocol test: 214 passed, 3 skipped files; 27749 tests passed, 19 skipped; VERDICT command-exit 0. rest test: 260 files passed; 4905 tests passed, 326 skipped; REST-EXIT=0. An earlier rest run showed 21 red files with 'Cannot read properties of undefined (reading fields)'. That was not this diff: platform-objects dist had been zeroed by a concurrent unlocked check:type-check-debt re-measure that I started and cut short with a 240s timeout. I rebuilt platform-objects, and the rerun is the green one above. Typecheck for rest, metadata-protocol and metadata-core: Done for all three (rest includes check:test-typecheck OK). Dogfood: rebuilt '@objectstack/dogfood^...', then showcase-public-form-withdrawal-layers.dogfood.test.ts passed 5/5 (VERDICT command-exit 0). The five sibling public-form dogfoods (read-back-masking, withdrawal-walled, walled-intake, withdrawal, showcase-public-form) passed 20/20 across 5 files. The first dogfood attempt failed with a DTS build error in plugin-sharing, caused by the same concurrent dist rewrite; the clean rerun is the one quoted. Ablation (committed state, trap restore): scripts/ablation-replace.mjs replaced the read-time layer check in rest-server.ts (anchor x1 -> x0, blob 3f30cb5229 -> 4533e4508f). Then src/public-form-withdrawal.test.ts went red: 5 failed / 18 passed. The red tests were every env-wide-withdrawn re-open case plus the cross-view slug withdrawal. The organization-withdrawn case stayed green, as expected, because the org read alone sees it. Restore: blob == HEAD 3f30cb5229, git diff HEAD empty, then 23/23 passed. No build was needed because the test imports ./rest-server from src. Gates: node scripts/pm/dispatch-gates.mjs --commands derived 70 commands, and I ran all 70. 67 exited 0 on the first pass. query-options-erasure and type-check-debt hit my 240s cap (exit 124) and exited 0 when rerun without the cap. check:dual-build-cjs-loads gave PREREQUISITE NOT MET (exit 3; packages outside the closure have no dist), so it is NOT MEASURED: dual-build-cjs-loads, reason: whole-tree build absent. Ran with nul-bytes, engine-double-contract, published-files, dts-closure, adr-0087-registration and changeset gates all green. --ran reconciliation: 70 derived, 70 run, 0 UNRUN. CI-owned (NOT MEASURED locally): repo-wide lint, the workspace type-check lanes, and the Test Core, Dogfood, Build Core and Temporal shards.",
  "mcp_calls": "0",
  "api_writes": "3 relay dispatches via scripts/pm/fleet-write (fleet-write.yml workflow_dispatch): pr_create POST /repos/objectstack-ai/objectstack/pulls (draft, #21864, read-back 3338/3338 bytes identical); label-write --assign hotlong on #21864 (POST /issues/21864/assignees, read-back MATCHES); os-dev-report comment POST /issues/21835/comments. Plus one git push (merge commit afb150b5bc..3730a51e5d). The single-card REST reads (issue 21835 comments) were reads only.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none (承接者:无) · noted, not filed: check:type-check-debt (its --re-measure built-closure step) appears to rewrite package dist/ while it runs and is not under os-verify-lock. When it ran beside a locked build or test in the same worktree, the platform-objects dist was left as zero-byte files, or rewritten in the middle of a dependent DTS build. This is inferred from mtimes matching the gate's run window, not proven by a probe. Dedupe words: type-check-debt re-measure dist rewrite, unlocked gate build race, zero-byte dist"
  ]
}

---

Generated by Claude Code

[objectstack-fleet]

Claim correction (PM seat), superseding the claim's Clause-②: no and file surface:

Clause-②: yes (widening)

File surface: packages/rest/src, packages/metadata-protocol/src, packages/metadata-core/src, packages/qa/dogfood/test, .changeset/

PR #21864 adds two public exports to @objectstack/metadata-core (the shared withdrawal judgement both doors and the save path read); its changeset declares minor for that package and patch for the others. A contract-tier review record is owed on the PR head before landing.

---

Generated by Claude Code

[objectstack-fleet]

Rulings recorded by the PM seat from the maintainer's answers in Claude Code session session_018zT8d8NpiQ1ExhuNd5TxY6, 2026-10-05, refining the kill-switch ruling above:

• Ruled: a withdrawal closes the same form (the same view across its metadata layers), not every view that happens to share its public slug; two different views publishing the same slug do not close each other (a slug collision is a separate concern). Chosen option 「只关同一个表单」.
• Ruled: only an explicit withdrawal closes — the link kept with enabled: false or allowAnonymous: false. Removing the sharing block, clearing the public link or deleting the view at a layer is not a withdrawal; the docs say so. Chosen option 「不算，写进文档」.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 21835,
  "status": "done",
  "branch": "claude/issue-21835-form-withdrawal-kill-switch",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/21864",
  "session": "session_018zT8d8NpiQ1ExhuNd5TxY6",
  "premise_still_valid": true,
  "summary": "Applied the two new rulings and the security-review fixes at head e8778acb96. Final design: (1) Identity. A withdrawal closes only the same form: the same view (by name), at the same slot (nested form, the same formViews key, or the flattened config), across its metadata layers. Other views that share the public slug, whether in the same read or in another layer, never close each other. The anonymous doors now read only the env-wide layer beneath an organization read; the found-in read is no longer a layer, because under identity matching it holds only the open view itself. (2) Explicit only. A layer withdraws a form when its body of the same view, at the same slot, names the same slug in publicLink and does not open it (enabled or allowAnonymous not true, so a raw body and its schema-parsed defaults agree). These are not withdrawals: a sharing with no link (raw, or parsed with false defaults), a cleared or changed link, a removed sharing block, or no body of the view at that layer. (3) Write door. An org-scoped view save in the organization the doors read is refused with 403 NOT_OVERRIDABLE when it would leave open any form the env-wide layer explicitly withdraws. This is judged by the doors' own predicate, with no diff against the org's current slugs, so re-saving an overlay that was open before the env-wide withdrawal is refused. A container-shaped body is first expanded the way the list read serves it (the protocol's runtime view-container expansion), then judged. The message names both remedies: save the overlay withdrawn, or publish env-wide. (4) Public surface. metadata-core now exports one new function, anonymousFormIntakeWithdrawnIn. The other new export from the earlier round, anonymousFormWithdrawnSlugs, was never released and is removed, because nothing reads it under identity matching. The changeset says what counts and what does not count as a withdrawal, and says that the earlier org-overlay-re-publishes-a-package-withdrawn-form behaviour is intentionally reversed. The public data collection docs page gains a Withdraw a public form section with the same rules. Rollback and commit-revert are NOT gated at write time (the changeset says so). The doors still keep such a form closed at read time. See open_questions. Do not edit the PR body yourself: it still describes the earlier round (any-view slug kill, the opening-only write diff, two exports) and needs a PM rewrite from this report.",
  "tests": "All at head e8778acb96, unless noted (source last changed at 1d6bdd5fad; later commits touch only docs, changeset and the dogfood). BUILD: pnpm --workspace-concurrency=2 --filter '@objectstack/rest...' --filter '@objectstack/metadata-protocol...' build, VERDICT command-exit 0. Then the '@objectstack/dogfood^...' closure build, VERDICT command-exit 0. SUITES: metadata-core test: 18 files, 394 tests passed. rest full test: 260 files passed; 4906 passed, 326 skipped; VERDICT 0. metadata-protocol full test: 214 files passed, 3 skipped; 27752 passed, 19 skipped; VERDICT 0. Targeted files: rest public-form-withdrawal + public-form-intake-availability, 2 files, 40 tests passed; metadata-protocol protocol.org-scoped-write-refused, 30 tests passed. TYPECHECK for metadata-core, metadata-protocol, rest (including check:test-typecheck) and dogfood: all Done, VERDICT 0. DOGFOOD, run with maxWorkers=1 so one boot at a time: showcase-public-form-withdrawal-layers 5/5 passed. It now also pins that re-saving the org overlay as it is gets a 403. The five sibling public-form dogfoods passed 20/20 across 5 files. CHANGESET: check-changeset-fixed exit 0; check-changeset-no-major --base origin/main exit 0; check-empty-changeset --base origin/main exit 0; check-adr-0087-registration exit 0. GATES: dispatch-gates --commands derived 95 commands; 94 were run, each with its exit code captured before any pipe. 92 exited 0, including check:nul-bytes, check:doc-anchors, check:doc-authoring, check:docs-single-h1, check:issue-citations, check:published-files, check:test-source-alias and docs-audit check-affected-docs. 2 exited 3 (PREREQUISITE NOT MET, so NOT MEASURED): spec check:skill-examples and check:dual-build-cjs-loads. Both need workspace-wide dist, which this box does not have; declared to CI. NOT MEASURED: check:type-check-debt. Reason: its --re-measure is workspace-wide and rewrote shared dist on this box in an earlier round; declared to CI. dispatch-gates --ran reconciliation: 95 derived, 92 run, 2 NOT-MEASURED, 1 UNRUN (that same family). NOT MEASURED: eslint repo-wide scan, which CI owns. ABLATION, from the committed state with a trap restore: the three source files were set to the BASE blobs (hash-object equal to the BASE blob for each), then the three packages were rebuilt. dist preflight passed: core marker absent, protocol marker absent, the base rest marker present in dist. Results: metadata-core 3 failed / 30 passed (two views sharing a slug; not a withdrawal; parsed linkless sharing). rest 4 failed / 20 passed (two views in one read, under both tenancy org and no-org; another view env-wide; link cleared env-wide). metadata-protocol 4 failed / 26 passed (re-save of an already-open overlay [F3]; container-shaped save [F6]; linkless env-wide sharing [F5]; plus the re-open test, which is red only because its message regex changed with the new wording). Restore: git diff HEAD empty, rebuilt, every marker read back in its restored state.",
  "mcp_calls": "0",
  "api_writes": "1 — POST /repos/objectstack-ai/objectstack/issues/21835/comments (this report, via scripts/pm/fleet-write relay); git push is not a REST write; no PR body edit, no label write this round",
  "open_questions": [
    { "question": "Should rollbackMetaItem and revertCommit refuse an org-scoped restore that would leave a form open that the env-wide layer withdrew?", "options": ["A leave them ungated: the doors already keep the form closed at read time, so the cost is an accepted write that is never honoured", "B gate them: they need the restored body before repo.restoreVersion writes, which today happens inside the repository (deriveRestoredBody), so this needs a history read up front"], "recommendation": "A for this PR, with B as a follow-up if wanted: there is no exposure (read-time enforcement holds), and B touches the restore path's write ordering, which is beyond this card's surface" }
  ],
  "out_of_scope_findings": [
    "carrier: 承接者:无 · noted, not filed — when two installed apps each ship a view publishing the same public slug, the doors serve whichever open candidate the list read returns first. The maintainer named slug collision a separate concern in the ruling; it is recorded here as an observation only. dedupe words: public form slug collision, duplicate publicLink, forms slug uniqueness"
  ]
}

---

Generated by Claude Code