chore: the vouched-reference census gate leaves this change for its own

The census script, its root alias, the core repo pin, the Test Core input
wiring and the lint workflow step move to a separate change. The attach on
upload completion, the one-shot vouch and their pins stay.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L9qibvynRbCtMndW8EHNGc

Author: claude

.changeset/sec-r17-attach-on-upload-complete.md

@@ -16,7 +16,7 @@ A signed-in member who may attach files, and holds no read of `sys_file`, can at
 
 The rule now: the upload-complete door (`POST /api/v1/storage/upload/complete`) takes an optional `attachTo: { parentObject, parentId }`. With it, the door runs every gate it already asked — the session, the upload ownership rule, the starting organization, the held bytes — and then hands the upload to the file-attachments service's `attachUploadAs`, which runs as the caller. That verb vouches for one `sys_file` only: a `pending` upload in the `attachments` scope that the caller uploaded, that no record holds yet, in the caller's write reach and in the parent's organization. It asks the attach authorization first (the permission to create an attachment, the parent-edit attach rule, `enable.files`), then writes the `sys_attachment` row and commits the file as one unit. The answer is the committed file with its new `attachmentId`. Another user's upload id, an id that names no file, a committed or already attached upload, and a record the caller may not attach to are refused, and the upload stays `pending`.
 
-The vouch is spent on that one write: a hook that runs under it — as the user or as the system — writes without the mark (`withoutVouchedReferences`, `@objectstack/core`), so a hook naming the same `file_id` is judged through the caller's read door. A repo gate (`check:vouch-for-reference-callers`) pins the code that sets the mark to an allowlist of the file-attachments service.
+The vouch is spent on that one write: a hook that runs under it — as the user or as the system — writes without the mark (`withoutVouchedReferences`, `@objectstack/core`), so a hook naming the same `file_id` is judged through the caller's read door.
 
 Unchanged: no caller gains a read of `sys_file` or of anything else. The generic data door keeps its rule — a `sys_attachment` create through `POST /api/v1/data/sys_attachment` naming a `sys_file` the caller cannot read is still refused `reference_not_found`. A completion without `attachTo` commits exactly as before. A mount with no file-attachments service bound refuses `attachTo` with `501 NOT_IMPLEMENTED`.
 

.github/workflows/lint.yml

@@ -2550,20 +2550,10 @@ jobs:
       # @objectstack/core). Guards against a duplicate resolver copy drifting on a
       # security path (the REST-vs-dispatcher sys_user_role drift) and against an
       # entry point silently dropping the delegation.
-      #
-      # The second command is the same kind of guard on the write-time reference
-      # check: the code that may set the vouched-reference mark (a service verb
-      # vouching, on its own write, for the one record it proved) is pinned to an
-      # allowlist, so a new caller is a reviewed edit and never a quiet one. Its
-      # alias runs the census's `--self-test` first, which is what
-      # `check:self-test-wired` requires. Folded into this step rather than a step
-      # of its own: no new check context and no new required-status entry.
       - name: Single authz resolver guard
         id: single-authz-resolver-guard
         continue-on-error: true
-        run: |
-          pnpm check:authz-resolver
-          pnpm check:vouch-for-reference-callers
+        run: pnpm check:authz-resolver
 
       # #11352. Product code may not read a test-RUNNER variable (`TEST`,
       # `VITEST*`, `JEST_WORKER_ID`). Runner variables are INHERITED by every

package.json

@@ -206,7 +206,6 @@
     "check:stall-guard-headroom": "node scripts/measure-stall-guard-headroom.mjs --self-test",
     "check:swallow-census-controls": "node scripts/measure-durability-swallow-family.mjs --self-test=gated",
     "check:system-context-census": "node scripts/check-system-context-census.mjs --self-test && node scripts/check-system-context-census.mjs",
-    "check:vouch-for-reference-callers": "node scripts/check-vouch-for-reference-callers.mjs --self-test && node scripts/check-vouch-for-reference-callers.mjs",
     "gen:platform-object-tenancy-census": "node scripts/platform-object-tenancy-census.mjs --write",
     "check:platform-object-tenancy-census": "node scripts/check-platform-object-tenancy-census.mjs --self-test && node scripts/check-platform-object-tenancy-census.mjs"
   },

packages/core/src/security/vouched-reference-callers.pin.test.ts

@@ -4,6 +4,5 @@
   "src/security/operation-private-keys.pin.test.ts",
   "src/security/row-serving-door-exposure.pin.test.ts",
   "src/security/second-object-read-exposure.pin.test.ts",
-  "src/security/vouched-reference-callers.pin.test.ts",
   "src/utils/import-runner-sandbox-fault-row.test.ts"
 ]