[finding] permission.form.ts says the form serves `profile` too, and carries a half-edited ADR-0090 D2 sentence with no subject — the registry has no `profile` key and a pin test asserts it

[claude]

Filed unassigned and ungraded by the domain:engine execution seat running #14931, spotted while reading permissionForm to translate its section descriptions. ⛔ domain:*, priority and type are triage's.

What it says

packages/spec/src/security/permission.form.ts:5-16:

/**
 * PermissionSet — canonical FormView layout.
 *
 * Used for both `permission` (additive permission grant bundles) and
 * `profile` (the base permission set assigned to every user). The only
 * flags are minimal (ADR-0090 D2 removed the Profile concept)
 * so admins can see and toggle it explicitly.
 * …
 */

Two separate problems, both in the same paragraph.

1. It claims the form serves a type the registry does not have. METADATA_FORM_REGISTRY (packages/spec/src/system/metadata-form-registry.ts:66-90) registers this form under permission only; there is no profile key. That absence is not incidental — packages/platform-objects/src/apps/translations/metadata-forms-vocabulary.test.ts pins it deliberately, asserting Object.keys(METADATA_FORM_REGISTRY) contains no role and no profile, and that no locale bundle carries a profile form group. A reader of the docstring is told the opposite of what a passing test asserts.

2. The second sentence has lost its subject. "The only flags are minimal (ADR-0090 D2 removed the Profile concept) so admins can see and toggle it explicitly" names no flag, and it refers to nothing. The shape is that of a sentence that once read something like "the only flag is X … so admins can see and toggle it explicitly", from which X was deleted when the key went; the trailing purpose clause survived the edit. The form declares no boolean field at all today — its four sections hold name, label, systemPermissions, objects, fields, tabPermissions, rowLevelSecurity.

Why it is worth a card rather than a silent fix

⚠️ It is not obvious which way it should be repaired, and that is a decision this seat should not take:

• If profile really is retired as a metadata kind, then the docstring's first sentence is simply stale and should go — but the form's own Identity section description, which ships to every locale, still explains the concept in full: "Permission Sets stack on top of a Profile to grant additional access. Profiles are the base set assigned 1:1 to each user." One of the two is wrong, and the shipped one is the section description, not the comment.
• If profile is retired only as a registry key while remaining a kind of permission set that authors still name, then the section description is right, the docstring's first sentence is right in spirit, and only the parenthetical about ADR-0090 D2 misstates the scope of what was removed.

⇒ Deciding that needs ADR-0090 read against the current permission schema, not a guess from the comment.

Not touched here

⛔ No edit is made in PR #16226 — that PR is bounded to zh-CN translation leaf values, and its translation of the Identity section description is deliberately faithful to the shipped English source, whichever way this is settled. If the source sentence changes, the zh-CN, es-ES and ja-JP leaves for permission.sections.identity.description all need re-translating with it.

Refs: #14931 · PR #16226 · packages/spec/src/security/permission.form.ts · packages/spec/src/system/metadata-form-registry.ts · packages/platform-objects/src/apps/translations/metadata-forms-vocabulary.test.ts.

---

Generated by Claude Code