Eval row 44 (out/harness-eval/agent/agent-allies__gpt-oss-32k-20b__20260904T121804Z.report.md).
After ALTER ENTITY AgencyAndProgram.Program ADD ATTRIBUTE "IsArchived": Boolean DEFAULT false;
the compiler reported ONE error: [CE0066] "Entity access is out of date …" at Domain model of module 'AgencyAndProgram' (the entity's access rules lack the new member — expected). The agent
then ran mxcli -p App.mpr -c "UPDATE SECURITY", which reported success; the compiler went from
1 error to 15: CE0066 at the domain models of Common, Reports, ExcelImporter, ReportExport,
Approvals, Email_Connector, DatabaseReplication, ProgramAgreement, Employees, CountyAndRegions
(and more, 15 total). The scoped form UPDATE SECURITY AgencyAndProgram failed with failed to reconcile security for module System: unit not found 00000000-0000-0000-0000-000000000002.
So the verb that exists to clear CE0066 multiplies it on an app with marketplace modules, and its
scoped form cannot run. The marcus-side fixer (npm run fix-ce0066 -- --module <Mod>) dry-ran
"+0 added, −74 removed" on the damaged copy — its measurement on a fresh copy is
our repo — MEASURED 17:15Z on a fresh copy: exec → 1 × CE0066 → fix-ce0066 --module AgencyAndProgram → 0 errors, by REMOVING 74 spurious System.owner/System.changedBy members and adding nothing. So the root cause of row 44's CE0066 is the Issue 45 family — the ALTER ENTITY … ADD ATTRIBUTE writer on 0.20.0 injects System.owner/System.changedBy member accesses across the module's access rules — and UPDATE SECURITY compounds it instead of clearing it. Two asks: stop the injection; make UPDATE SECURITY <Module> work (it fails on System) and never touch modules it was not asked about.
mxcli 0.20.0, Mendix 11.12.x, Windows 11. Found while evaluating a self-hosted agent loop that drives check → check --references → exec → mx check; each item above was reproduced on a fresh copy of the fixture or app named.
Eval row 44 (
out/harness-eval/agent/agent-allies__gpt-oss-32k-20b__20260904T121804Z.report.md).After
ALTER ENTITY AgencyAndProgram.Program ADD ATTRIBUTE "IsArchived": Boolean DEFAULT false;the compiler reported ONE error:
[CE0066] "Entity access is out of date …" at Domain model of module 'AgencyAndProgram'(the entity's access rules lack the new member — expected). The agentthen ran
mxcli -p App.mpr -c "UPDATE SECURITY", which reported success; the compiler went from1 error to 15: CE0066 at the domain models of Common, Reports, ExcelImporter, ReportExport,
Approvals, Email_Connector, DatabaseReplication, ProgramAgreement, Employees, CountyAndRegions
(and more, 15 total). The scoped form
UPDATE SECURITY AgencyAndProgramfailed withfailed to reconcile security for module System: unit not found 00000000-0000-0000-0000-000000000002.So the verb that exists to clear CE0066 multiplies it on an app with marketplace modules, and its
scoped form cannot run. The marcus-side fixer (
npm run fix-ce0066 -- --module <Mod>) dry-ran"+0 added, −74 removed" on the damaged copy — its measurement on a fresh copy is
our repo — MEASURED 17:15Z on a fresh copy: exec → 1 × CE0066 →
fix-ce0066 --module AgencyAndProgram→ 0 errors, by REMOVING 74 spuriousSystem.owner/System.changedBymembers and adding nothing. So the root cause of row 44's CE0066 is the Issue 45 family — theALTER ENTITY … ADD ATTRIBUTEwriter on 0.20.0 injectsSystem.owner/System.changedBymember accesses across the module's access rules — andUPDATE SECURITYcompounds it instead of clearing it. Two asks: stop the injection; makeUPDATE SECURITY <Module>work (it fails on System) and never touch modules it was not asked about.mxcli 0.20.0, Mendix 11.12.x, Windows 11. Found while evaluating a self-hosted agent loop that drives
check → check --references → exec → mx check; each item above was reproduced on a fresh copy of the fixture or app named.