Say that a grant on a declared operation may admit a caller who isn't signed in

[habdelra]

Important

Merge order: #805, then cardstack/boxel#6570, then #806, then this PR, then cardstack/boxel#6579.
This touches realm-policy/realm-policy.gts, a file in boxel's catalog test subset, so it lands after #805, boxel#6570 and #806, which change or pin that file first. The paired boxel PR pins this PR's head, which takes catalog main as #805 and #806 merge.

Merges before: cardstack/boxel#6579

In service of CS-13521, which lets a realm's policy admit a caller who isn't signed in. Boxel now lets a grant on an operation a card declares opt in to such callers, provided the operation is built on an eligible base and isn't a named query. The operation runs with no actor, and a write it makes is made as the user the grant's actingUser names.

This changes only the comment above OperationGrant.anonymous so it says the same thing: a grant on a declared operation may set it, a named query may not, and a grant whose operation reads actor() never admits such a caller.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

Staging Submissions Preview

This PR's content is pushed to the staging submissions realm: https://realms-staging.stack.cards/submissions/

Changed folders:

• realm-policy/

Updated at 2026-10-06 20:50:23 UTC for commit 776baef. Shared realm: only this PR's changed files are pushed; files touched by multiple PRs reflect whichever pushed last, and deleted files are not removed.

[habdelra]

[Claude Code 🤖] Independent review of this PR

I checked every claim in the rewritten comment against the paired boxel branch (compileDocument and anonymousSummary in runtime-common/card-operations/policy.ts, and ANONYMOUS_ELIGIBLE_OPERATIONS in card-operations/types.ts). Each claim holds. A grant on a declared operation is eligible when its base is. A named query (an operation declared on query under another name) is refused with anonymous-not-base-operation. If the grant's where reads actor(), or the operation's program, template or output does, the code records anonymous-grant-reads-actor and keeps the grant out of the anonymous openings. The code comment has no ticket ids, PR numbers or history, and it uses "a card declares" as the operation field's comment above it does.

I left two minor wording points inline. Neither one makes the comment wrong, so neither blocks the PR.

On the description and pairing, I found nothing to change. The callout opens the description and gives the merge order: #805, boxel#6570, #806, this PR, boxel#6579. Merges before: cardstack/boxel#6579 sits on its own line outside the callout. It is the inverse of boxel#6579's Merges after: cardstack/boxel-catalog#808, and boxel#6579 pins this PR's head (3bf9e8a). #805 and #806 both touch realm-policy/realm-policy.gts, so the stated order is right.

[habdelra]

[Claude Code 🤖] minor: "A grant on a base operation (read, update, …) may set it, and so may one on an operation a card declares on one of them" covers every base operation. explain and validate are base operations, but they are not in ANONYMOUS_ELIGIBLE_OPERATIONS, so a grant on either one, or on an operation declared on either one, is refused with anonymous-not-base-operation. An author reading "base operation" here would expect those to work. Suggested fix: name the exception, e.g. "A grant on a base operation other than explain or validate may set it, and so may one on an operation a card declares on such a base, but not one on a named query."

[habdelra]

[Claude Code 🤖] Fixed in ee54a06e. The comment now says a grant on a base operation other than explain or validate may set it, and so may one on an operation a card declares on such a base.

[habdelra]

[Claude Code 🤖] minor: "but not one on a named query" doesn't say what happens if an author sets it anyway. In boxel the compile records anonymous-not-base-operation (severity inactive) and leaves the whole grant out, so signed-in callers lose it too. The actor() case two lines down is different: that grant still applies to signed-in callers and just never admits an anonymous one. These two outcomes are easy to mix up, and the comment is the authoring reference. Suggested fix: say both, e.g. "…but not one on a named query: setting it there leaves the grant out, even for signed-in callers." and, after "never admits one", add "(it still applies to signed-in callers)".

[habdelra]

[Claude Code 🤖] Fixed in ee54a06e. The comment now gives both outcomes: on a named query, setting it leaves the whole grant out, for signed-in callers too; a grant whose where or operation reads actor() admits no caller who isn't signed in but still applies to signed-in callers.