[objectstack-fleet]

Requested by Elon · project thread

domain:server#1 · os-elon-musk · session_016WV4cya5ej5GQV86RPbRPK

Part of #30512 — package 7 of 11 (@objectstack/plugin-security). The card stays open: settings, sharing, approvals and platform-objects follow, and the last PR of the series makes the bundle check read the platform locale table.

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么： 安全插件的对象（用户权限集指派、用户职位指派等）的名称、字段、帮助和校验提示，加上内置权限集的名称与说明、内置职位（平台管理员、组织所有者等）的名称与说明，补上繁中、阿语、法语、巴葡、俄语、德语、韩语 7 种，与平台语言表的 11 种一致。
• 为什么改： 平台语言表要求每个界面带齐 11 种语言；这是第 3 期按包补齐的第 7 个包。用这 7 种语言的管理员在「设置 → 权限集 / 职位」里看到的不再是英文。
• 风险与回滚： 只加翻译数据和注册行，不动逻辑、schema、接口；原有 4 种语言一字未改。唯一的测试改动是职位改名一致性测试多扫 6 种语言（覆盖变宽，没有放宽任何断言）。回滚即撤 PR。
• 先看： src/translations/index.ts（按表标签注册，zh-CN 在 zh-Hant 前）、permission-sets.ts 与 builtin-positions.ts（手写的两张表），再看 position-rename-consistency.test.ts。
• 两分钟验证： node scripts/check-i18n-bundles.mjs --filter=security 输出 plugins/plugin-security in sync；pnpm --filter @objectstack/plugin-security test 全绿。
• 需要你做的： 无，席位落地。

What changes

• Seven new locales for the security package under the platform locale table's tags (zh-Hant, ar, fr, pt-BR, ru, de, ko): each a TAG.objects.generated.ts with all 60 object leaves plus its TAG.source-hashes.generated.ts, written by the repo's own os i18n extract --fill=default --source-hashes and served through withSourceFallback like the existing three. zh-CN stays ahead of zh-Hant in index.ts.
• The two hand-written tables gain an entry per new locale: permission-sets.ts (label and description of the nine built-in permission sets) and builtin-positions.ts (label and description of the seven built-in positions). Both are registered as each locale's permissions / positions group, and their header sentence now says "every locale" instead of "three entries".
• The extract command in scripts/i18n-extract.config.ts lists the seven tags and its merge baseline imports the seven bundles, so check:i18n covers them from this PR on.

Tests

• builtin-positions.test.ts and objects/permission-set-descriptions.test.ts already iterate every locale of SecurityTranslations, so each new locale is held to the existing rules with no test edit: exactly the built-in names, no two labels alike, no English copy, no position id in the text, and the served GET /meta/position overlay.
• position-rename-consistency.test.ts extends its stale-word scan (no "role" wording left on the renamed objects) to zh-Hant, fr, pt-BR, ru, de and ko. Coverage widens; no assertion changed. Arabic is not added: its word for "role" (دور) is also the word in بدوره ("in turn"), which a correct help text on sys_user_position.delegated_from uses, so a pattern for it would flag correct text.

Acceptance notes

• Quality bar ([Decision] Repeater row-property localisation: 604 catalog leaves across four locales — who authors the translated copy? #17508 / PR feat(spec): a repeater property panel names its columns in every locale, not only English #19345): every leaf written for the reader; placeholders, code spans and identifiers byte-identical, checked mechanically per leaf against en (key set, {{holes}}, {holes}, backtick spans, angle tokens: all seven locales OK, zero diffs). Arabic is RTL prose with identifiers left in Latin script. zh-Hant was checked character by character against OpenCC's Traditional (Taiwan) conversion: no Simplified-only character remains.
• Leaves equal to English, on purpose: one, de sys_user_position.fields.position.label = Position (the German word). The extractor records it as a source copy in de.source-hashes.generated.ts.
• The English source of sys_user_position.fields.delegated_from.help carries the Chinese term (职务代理); every locale keeps it as es-ES already does. Not changed here (the source text belongs to the object, not to this bundle).
• No cross-locale coincidence: check:i18n-stale-fill passes with the baseline untouched.
• Carried unchanged from the released handover commit ff28e790 (session session_01Utp6Cai5CRdAs4u9gTipWU): the patch id of this PR's diff equals that commit's (446fab73). The serial row "after Setup: replace developer wording and hand-written JSON with fields a business administrator can use #30208 lands" was cleared by the seat: Setup: replace developer wording and hand-written JSON with fields a business administrator can use #30208's server rows that touch this package landed in PR fix: Setup form help speaks to an administrator; queue pages, mail status banner and test toast read in Chinese #30551, an ancestor of this branch.

Verification

Package suite, typecheck, build (verify lock)

turbo run build --filter=!@objectstack/docs: 118/118 tasks successful, exit 0
pnpm --filter @objectstack/plugin-security test && typecheck   (at head 99bc8346, after merging origin/main 447226b2)
 Test Files  246 passed (246)
      Tests  5679 passed | 45 skipped (5724)
check:test-typecheck: OK (tsconfig.test.json, 0 errors)
os-verify-lock: VERDICT command-exit 0
same suite at 41230cb6 (before the merge): 246 files, 5679 passed | 45 skipped, VERDICT command-exit 0

i18n gates and the derived families

node scripts/check-i18n-bundles.mjs --filter=security          (at 99bc8346)
  plugins/plugin-security        in sync (21 bundle(s))                      EXIT 0
node scripts/check-i18n-stale-fill.mjs                          (at 99bc8346)
check-i18n-stale-fill: OK (11 bundle set(s) — no new stale fills, 1 baselined).   EXIT 0
dispatch-gates --commands (at 41230cb6): 61 families, each run and recorded with its exit code: 61 x exit 0
dispatch-gates --ran: 61 derived, 61 run, 0 NOT-MEASURED (a derived zero)
re-derived at 99bc8346: the identical 61-command list; --ran on the same record: 61 run, 0 NOT-MEASURED
pnpm lint (repo-wide, at 41230cb6): exit 0
eslint --no-inline-config on the changed .ts files: exit 0
changed lines 1807 (+1801 / -6), 20 files: under the 3000-line human-merge threshold

The merge of origin/main brought 17 commits, none in plugin-security, plugin-sharing, plugin-approvals or service-settings; the package suite and both i18n checks were re-run on the merged head.

Dogfood: not run — content-only package PR, no ! in the title and no (narrowing) arm.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-security, touching 45 documentable anchor(s).

23 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 82142ed65ce60cad753bea0aa2b76cb0364b132f.

⛔ 16 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 63 of 221 client-bound route-ledger rows — the other 158 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 158: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 103 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 17 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 82142ed65ce60cad753bea0aa2b76cb0364b132f → packageMentionDocs.

Which tree this was computed on

This run read content/docs from e864b0ece342846378670d6368c399c7a8b46586 — the merge of head 99bc8346e5565c98090662643b476625cf619ba4 into base 82142ed65ce60cad753bea0aa2b76cb0364b132f, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin e864b0ece342846378670d6368c399c7a8b46586 && git checkout e864b0ece342846378670d6368c399c7a8b46586
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 82142ed65ce60cad753bea0aa2b76cb0364b132f 99bc8346e5565c98090662643b476625cf619ba4 && git checkout -B drift-repro 82142ed65ce60cad753bea0aa2b76cb0364b132f && git merge --no-ff 99bc8346e5565c98090662643b476625cf619ba4

node scripts/docs-audit/affected-docs.mjs --json 82142ed65ce60cad753bea0aa2b76cb0364b132f

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 82142ed65ce60cad753bea0aa2b76cb0364b132f → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW

席位核对 · ACCEPT · 2026-11-06T00:51Z · #30512 (package 7 of 11, plugin-security)

Head-sha: 99bc834

• Shape: 20 files, +1801/−6, all in packages/plugins/plugin-security/: seven new locale bundles with source-hash companions (zh-Hant, ar, fr, pt-BR, ru, de, ko), the hand-authored permission-sets.ts and builtin-positions.ts tables extended per locale, translations/index.ts registering them under the platform-table tags, the extract config's --locales list, one test, and one patch changeset. That is under the 3000-line threshold and inside claim 6672078792 and its sequence note 6672288503. Not governed. The commit is the released handover ff28e790 by patch id, plus one merge of origin/main.
• Spot check (read in the diff):
  • The hand-written tables carry an entry for every built-in permission set and position in each new locale. permission-set-descriptions.test.ts and the positions test iterate the bundle's own locale keys (Object.keys(SecurityTranslations)), so the seven new locales are pinned without a test edit.
  • position-rename-consistency.test.ts gains six of the seven locales. Arabic is left out, presumably because there is no stale-term pattern to check for it.
  • Product terms are kept, and the zh-Hant text is Traditional (spot-read the positions and the permission sets).
• Gates: every check-run on this head has concluded: 35 success, 13 skipped, 0 failure. Locally, the dev report 6673191681 shows plugin-security 5679 passed / 45 skipped, typecheck clean, check-i18n-bundles in sync, stale-fill 0, dispatch-gates 61/61 with 0 NOT MEASURED, and pnpm lint 0.
• Accepted deviations: none reported.
• Out of scope: none found. The Setup: replace developer wording and hand-written JSON with fields a business administrator can use #30208 rows were cleared before this PR (6672288503).
• Contract: Clause-②: no, Metadata-protocol: none, confirmed from the diff: translations only, with no key or shape change.
• Landing: ready, then auto-merge, through the relay. The card's plugin-security checklist row is ticked on merge.