Repository navigation
docs(adr): ADR-0131 D6 charts sharing_rule under regime O, guarded, and reads the activation ledger one way (ruling B′ on #24378) #24420
Description
Filing gate ③: a task the maintainer directed. Decision #24378 was ruled B′: 「同意」 then 「B′」, recorded verbatim by the director seat at 6257388265. Reader who acts: the epic seat (epic:#15194) dispatches it; the maintainer merges (Tier H, governed ADR text). Dedupe: semantic search on objectstack, "sharing rule regime O overlay guard … reconcile shadowed grants" → 24 results, none a carrier: the nearest are the decision card itself and stage 9, both closed.
What the ruling binds (verbatim items 1 and 5 of 6257388265)
The chart. ADR-0131 D6 lists
sharing_ruleunder regime O (overlay): a storedsys_sharing_rulerow of the declared rule's name, in its scope, replaces the declared rule whole;active: falseon that row is the switch-off; the ownership ceremony deletes only uncustomised mirrors (the #2909 promise,sharing-plugin.ts:852–:857, stands). One dated line, Tier H (the maintainer merges). The same PR resolves ADR-0131's own contradiction on the activation ledger (D7:491against D6:419–:420and D13:699–:700) so the record reads one way.
Nothing else: no activation-ledger type for sharing rules (A), no blanket refusal of same-name rows (C), nothing left as is (D).
Wanted
One docs PR on docs/adr/0131-total-organization-ownership-no-null-organization-id.md:
- D6 gains one dated line charting
sharing_ruleunder regime O, guarded. It names the guard and the immediate reconcile; both are built by the companion code card. - The activation-ledger contradiction gets one reading. D7 at about
:491disagrees with D6 at about:419–:420and with D13 at about:699–:700. The PR resolves it with dated notes, ⛔ never by rewriting the ruled text. - No code. ⛔ Nothing under
content/docs/releases/.
Acceptance
- The ADR states one reading of each point, with the ruling cited by its comment id.
- The PR carries an at-tier
## Contract reviewrecord (governed rules text) and is merged by the maintainer.
Activity
objectstack-fleet commentedon Oct 19, 2026
Claim: PM loop round 5 · 2026-10-19T01:13Z
Session:
session_01Y5583bs2RDd53MH6kM1ca3Account:
os-steve(the seat's linked user asGET /useranswers it; the card's assignee)Branch:
claude/issue-24420-adr-0131-d6-sharing-rule-overlayWorktree: the cloud session's own checkout (
mode:cloud)Domain:
domain:specSeat:
epic:#15194(the epic lane; ruling B′ 6257388265 hands the stage and the ADR PR to this seat)File surface:
docs/adr/0131-total-organization-ownership-no-null-organization-id.mdonly (stop on breach; explain in the report)Container & model:
S,mode:cloud,model: TIER_DEFAULT(dispatch-gates --tier: no path-derived mandate). The path is governed, so the review is atCONTRACT_REVIEW_TIERand the PR lands as Tier H, merged by the maintainer.Clause-②: no
Responsibility: n/a — not a defect card
Thread-read: none
Serial constraints cleared: no open PR touches ADR-0131 (scan of every open PR's file list on
origin/main71fa166e). The companion code card #24421 is dispatched in parallel and touches no ADR file.objectstack-fleet commentedon Oct 19, 2026
Claim amendment · epic PM
session_01Y5583bs2RDd53MH6kM1ca3(os-steve) · 2026-10-19T01:25Z. It amends claim 6257558991 and changes nothing else.sys_emailwith no organization column; [finding] sys_inbox_message/sys_notification/sys_email 等平台表从不写 organization_id(存量与新增行 100% null)——请确认多组织语义是否设计如此 #11303 decision 2 keeps tenant mail stamped;sys_secrethas no organization column, and ownership follows the referencing row;sys_setting_audit's global rung goes to a deployment-level sibling, while its tenant and user rows stay.docs/adr/0131-…only).Fixes #24420andPart of #24343(the D7 lines for [Decision] C8 under a wall: four framework writes that have no organization to name — self-registration grant, identity mail, activity, deployment-level secrets #24377's Q2 and Q4).objectstack-fleet commentedon Oct 19, 2026
os-dev-report
{ "issue": 24420, "status": "done", "branch": "claude/issue-24420-adr-0131-d6-sharing-rule-overlay", "pr": "https://github.com/objectstack-ai/objectstack/pull/24422", "session": "session_01TvNEqnkE9Lfbp3N2zvaqHQ — this run's harness-stamped id (commit Claude-Session trailer); dispatched by epic seat session_01Y5583bs2RDd53MH6kM1ca3", "premise_still_valid": true, "summary": "Claim 6257558991 verified as the newest Claim and it names this branch. The draft PR #24422 adds two dated notes to ADR-0131 (+24/-0, one file), in the existing 'Note (YYYY-MM-DD, ruling of record ...)' form, and rewrites no ruled sentence. (1) Under D6, after the install-mode bullets, sharing_rule is charted under regime O. A same-name sys_sharing_rule row in its scope replaces the declared rule whole, active: false on it is the switch-off, and the D10 ceremony deletes only uncustomised mirrors. The note names the guard and the immediate reconcile, which #24421 builds, and states ruling item 5's exclusions. (2) Under D7, after its first paragraph, the note on the activation ledger says the clause 'reverted before 17.3 and does not return' is left over from the draft before the standard-package reversal. Section 7 of the ADR itself says card #15024 was 're-scoped from a revert'. The note states the reading that D6, D13, D14 and C0 hold and that the code follows: sys_metadata_activation is kept and tenant-less (systemFields.tenant: false; read for flows, actions, positions and permission sets). A2 held, and A3's stop condition did not fire because no new decision was needed. PR assignee os-steve; label skip-changeset; Tier H, so the maintainer merges after a CONTRACT_REVIEW_TIER record.", "tests": "Docs-only: no package touched, so no build-closure, unit or typecheck legs (local verification scope section 1/2 is empty); no ablation because no tested behaviour changed. Evidence for the reading in the D7 note was measured on origin/main 71fa166e: packages/platform-objects/src/system/sys-metadata-activation.object.ts declares systemFields: { tenant: false }; FlowActivationStore (service-automation engine.ts), objectql/src/action-activation.ts, core resolve-authz-context.ts and runtime catalog-activation.ts consume the ledger; organization-ownership-inventory.ts cites 'D7, D6, D14 (C0): the tenant-less activation ledger'; #15024 is closed.", "gates": "Derived with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (the --repo assertion held; merge base 71fa166e9; 1 path, +24/-0). All 74 commands (19 derived + 55 artifact-roster rows from STDERR) ran on commit 7b9b0c0. Each exit code was written to a file before any pipe. The pushed head a41ddd96 has the identical tree; only the co-author trailer was reworded to the model-free pair after the pre-push check:commit-card-trailers refused it. DERIVED 19/19 exit 0. --ran verdict: '19 derived famil(ies) accounted for — 19 run, 0 NOT-MEASURED (a DERIVED zero — all 19 recorded an exit code and none of them is 3)'. check:doc-formula-expressions first exited 3 (PREREQUISITE NOT MET: no @objectstack/formula dist); after os-verify-lock 'turbo run build --filter=@objectstack/formula --filter=@objectstack/lint' (VERDICT command-exit 0, 184s) it exited 0. ROSTER: 49/55 exit 0. Six are NOT MEASURED and none is a finding: check-closing-target-claim, check-partof-closing-keyword and check-single-claim-paths exit 2 (no PR_NUMBER/PR_BODY), check-governed-queue-guard exits 1 (no GITHUB_EVENT_PATH), and check:dts-closure and check:published-readme-exports exit 3 (they need a whole-tree build). CI owns all six. Also NOT MEASURED locally, as the tool lists: the Test Core shard job, the 4 type-check lanes, and 2 workflow-valued families; CI runs them. PR check-runs at report time on a41ddd96: 2 success, 5 skipped, 19 in_progress, 0 failure. Convergence belongs to the seat.", "mcp_calls": "0 — no MCP GitHub tool called (reads used gh api through the REST proxy)", "api_writes": "2 relay strokes plus 1 git push — (1) fleet-write pr_create: POST /repos/objectstack-ai/objectstack/dispatches -> relay run 39186065437 executed POST /pulls, POST /issues/24422/assignees and POST /issues/24422/labels; read-back identical (5723 bytes), assignees os-steve, labels skip-changeset; (2) fleet-write comment: POST /dispatches -> POST /issues/24420/comments (this report). git push: the empty-branch probe, then a41ddd96. Writes to the card's assignee or labels: 0.", "open_questions": [ { "question": "Decided by the ruling, recorded for review: the D6 note carries ruling item 4's scope (under a wall an organization's overlay is its own; under single the one overlay answers everywhere). This makes sharing_rule the one regime-O type whose overlay follows D3 organization ownership instead of D6's 'environment-level, never per organization' heading.", "options": ["A keep it in the note — the ruling's item 4 and D3 (sharing rules an organization writes are its rows) say so", "B drop the sentence and leave the scope implicit in 'in its scope'"], "recommendation": "A. Without it the record reads two ways (D6's heading against D3 and today's holder key); stating it is a recorded ruling, not a new decision. Four axes: (business) matches today's measured holder key; (long-term) one reading; (AI-error) an explicit scope beats an inferred one; (startup) zero new surface." }, { "question": "Decided under A2/A3: the ledger contradiction was resolved as a reading note, not escalated, because ADR section 7 itself records #15024 as 're-scoped from a revert after the standard-package reversal' and the code ships the kept, tenant-less ledger. Does the seat agree that no new decision was needed?", "options": ["A accept the D7 note as written", "B escalate to the maintainer"], "recommendation": "A. The record already decided it (D6, D13, D14, C0, section 7) and the merged code follows it. D7's clause is an unedited draft remnant, and escalating would reopen a settled point with zero pull." }, { "question": "Deviation: the dispatch named the cloud checkout as the worktree, but the guard-main-checkout hook refused edits there. Work moved to a dedicated worktree on the same branch (/home/user/objectstack-issue-24420), which was removed after the PR opened. The primary checkout is back on the branch.", "options": ["A none needed"], "recommendation": "A — noted for the seat only." } ], "out_of_scope_findings": [] }Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
os-dev-report
{ "issue": 24420, "status": "done", "branch": "claude/issue-24420-adr-0131-d6-sharing-rule-overlay", "pr": "https://github.com/objectstack-ai/objectstack/pull/24422", "session": "session_01TvNEqnkE9Lfbp3N2zvaqHQ — this run's harness-stamped id (commit Claude-Session trailer); dispatched by epic seat session_01Y5583bs2RDd53MH6kM1ca3", "premise_still_valid": true, "summary": "Supersedes report 6257808694 and carries out claim amendment 6257685312. The amendment and ruling 6257510973 on #24377 (items 2 and 4) were both read on GitHub before editing. New commit 2261458d adds three dated D7 notes after the 'Membership in this list is decided by the writer' paragraph, each citing ruling of record 6257510973. (Q2 A) Identity mail (verify, reset, magic link, email change, and an account invitation to a person with no organization) goes to a sibling of sys_email with no organization column and the same row shape, served by the same outbox, status and attachment pipeline. Tenant mail stays in sys_email with its organization NOT NULL, and #11303 decision 2 keeps it stamped. Neither a nullable column nor unpersisted mail. (Q4 A) sys_secret has no organization column; its ownership follows the referencing row (sys_setting / sys_platform_setting, webhook, flow credential, field's record, datasource), and every read stays by id under privilege. (Q4 A) sys_setting_audit's global rung moves to a deployment-level sibling, the same departure sys_setting's global rung already makes, while its tenant and user rows stay NOT NULL. Each of the three notes says the decision is ruled and that a C8 stage builds it; none says it has shipped. The earlier D6 and D7 notes for ruling B′ are unchanged. PR total: +44/-0 in one file. PR BODY EDIT OWED BY THE SEAT (a dev writes the body only once): (1) insert 'Part of #24343' as line 2, between 'Fixes #24420' and 'Clause-②: no' (this exact head was tested with PR_BODY and check-partof-closing-keyword returned exit 0, 'no Part-of/closing-keyword contradiction'); (2) under 'What this changes', add item 3: 'D7, after the writer-membership paragraph: three dated notes for ruling 6257510973 on #24377 (Q2 A identity mail to a deployment-level sibling of sys_email; Q4 A sys_secret has no organization column; Q4 A sys_setting_audit's global rung to a deployment-level sibling), stated as ruled, not shipped'; (3) change '+24 / −0' to '+44 / −0' and the gated head to 2261458d; (4) in 维护者速读, add ③ for those three D7 lines and change 24 行 to 44 行.", "tests": "Docs-only: no package touched, so no closure, unit or typecheck legs and no ablation. The D7 notes record ruled decisions as not shipped, so there is no code claim to measure. The one present-tense claim is 'the same departure sys_setting's global rung already makes', and it rests on organization-ownership-inventory.ts on origin/main: sys_platform_setting is 'the settings global rung's tenant-less holder (C6)'.", "gates": "Re-derived on head 2261458d with dispatch-gates --commands --repo objectstack-ai/objectstack (the --repo assertion held; 1 path, +44/-0). The command set is identical to the first round's: 74 = 19 derived + 55 roster rows. All 74 ran, with exit codes written to a file before any pipe. DERIVED 19/19 exit 0; --ran: '19 derived famil(ies) accounted for — 19 run, 0 NOT-MEASURED (a DERIVED zero — all 19 recorded an exit code and none of them is 3)'. check:doc-formula-expressions ran after the os-verify-lock build of formula and lint (VERDICT command-exit 0). ROSTER 50/55 exit 0. Five are NOT MEASURED and none is a finding: check-closing-target-claim, check-partof-closing-keyword and check-single-claim-paths exit 2 (no PR context; check-partof-closing-keyword was also run with the intended new body head and exited 0), check-governed-queue-guard exits 1 (no GITHUB_EVENT_PATH), and check:published-readme-exports exits 3 (it needs a whole-tree build). CI owns them. check:dts-closure exited 0 this round. The pre-push check:commit-card-trailers passed (model-free trailer). PR check-runs on 2261458d at report time: 1 success, 2 skipped, 19 in_progress, 0 failure; convergence belongs to the seat.", "mcp_calls": "0 — no MCP GitHub tool called (reads used gh api through the REST proxy)", "api_writes": "Cumulative: 3 relay strokes plus git pushes — (1) fleet-write pr_create (earlier round): POST /dispatches -> POST /pulls, POST /issues/24422/assignees, POST /issues/24422/labels; (2) fleet-write comment 6257808694 (earlier report); (3) fleet-write comment: POST /dispatches -> POST /issues/24420/comments (this report). git push of 2261458d. No PATCH of the PR body. Writes to the card's assignee or labels: 0. Cross-session reply: none sent; this report is the answer.", "open_questions": [ { "question": "Carried from the first report: the D6 note includes ruling B′ item 4's scope (under a wall an organization's overlay is its own; under single the one overlay answers everywhere).", "options": ["A keep it", "B drop it"], "recommendation": "A — it is the ruling's own item and D3's ownership; without it the record reads two ways." }, { "question": "Carried from the first report: the ledger contradiction was settled by a reading note rather than escalated, because ADR section 7 and the merged code already decide it.", "options": ["A accept", "B escalate"], "recommendation": "A — no new decision is involved." }, { "question": "Decided: the Q2/Q4 lines are three separate dated notes, each carrying the comment id, rather than one note with three items, because the amendment asked for the id in each dated line. The notes name no stage numbers (8b-0d, 8b-0e) and say 'a C8 stage builds' it, because stage numbering belongs to the epic plan and the ADR cites decisions.", "options": ["A keep as written", "B name the stages"], "recommendation": "A — stage ids would date the ADR; the seat can ask for them if wanted." } ], "out_of_scope_findings": [] }Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
Ruling-pointer · #24378 re-ruled A at 6258883445 (batch #368 item 1, the maintainer's 「24378 同意 A」; supersedes B′ 6257388265, under which this card was cut) · director seat (summon #43 continuation 5,
session_01QJC7i981TSs9L1CGJK59Ax) · 2026-10-19T03:18ZThis card's D6 note charts B′ (regime O, guarded); the ruling is now A: ADR-0131 D6 charts
sharing_ruleunder regime C — read-only, clonable, switched throughsys_metadata_activation(deployment-level, operator-gated under a wall), every same-name row refused, the ceremony migrating customised copies to clone + base-off. The note is rewritten in PR #24422 before that PR merges; the three D7 notes for #24377 (6257510973) stay; the D7 reading of the ledger as kept stays and now carries one more type.objectstack-fleet commentedon Oct 19, 2026
Claim amendment · epic PM
session_01Y5583bs2RDd53MH6kM1ca3(os-steve) · 2026-10-19T03:26Z. It amends claim 6257558991 and its amendment 6257685312. The branch and session are unchanged:claude/issue-24420-adr-0131-d6-sharing-rule-overlay,session_01TvNEqnkE9Lfbp3N2zvaqHQ.Why. Ruling A on #24378 (6258883445; the maintainer's 「24378 同意 A」) supersedes B′. Ruling item 4 says the D6 note in PR #24422 is rewritten to regime C before that PR merges.
The rework (PR #24422):
sharing_ruleis charted under regime C. Managed declared rules are read-only and clonable.activebit of asys_metadata_activationrow of typesharing_rule. That bit is deployment-level and operator-gated under a wall. There is no per-organization switch-off, and organizations still author their own rules (D3).sys_flow_credential) and boot-seeded declared webhooks (sys_webhook) #24435 (flow credentials and declared webhooks) is pending. If it is ruled before the maintainer merges, its D7 lines ride this PR too, and the seat says so in a later amendment. Do not add them unasked.The PR body is the seat's to correct after the push. The dev reports the owed body edits.
objectstack-fleet commentedon Oct 19, 2026
Claim amendment · epic PM
session_01Y5583bs2RDd53MH6kM1ca3(os-steve) · 2026-10-19T03:41Z. It amends 6258989827. The branch and session are unchanged.Why. Decision #24435 is ruled Q1 A · Q2 A (6259141885; the maintainer's 「同意」). Its item 1 folds one dated D7 line into PR #24422 while that PR is open.
Add to PR #24422, in the same rework round:
sys_flow_credentialis deployment-level: it declaressystemFields: { tenant: false }, so it has no organization column. A credential's ownership follows the flow it belongs to, and a flow is environment metadata (D2/D6). This is in step with [Decision] C8 under a wall: four framework writes that have no organization to name — self-registration grant, identity mail, activity, deployment-level secrets #24377 Q4 forsys_secret.Not added: Q2 A (declared webhooks are read from the registry; the seeder retires) orders no ADR line. D2's sentence 「No seeder writes them into any table」 already says it.
objectstack-fleet commentedon Oct 19, 2026
os-dev-report
{ "issue": 24420, "status": "done", "branch": "claude/issue-24420-adr-0131-d6-sharing-rule-overlay", "pr": "https://github.com/objectstack-ai/objectstack/pull/24422", "session": "session_01TvNEqnkE9Lfbp3N2zvaqHQ — this run's harness-stamped id (commit Claude-Session trailer); dispatched by epic seat session_01Y5583bs2RDd53MH6kM1ca3", "premise_still_valid": true, "summary": "Rework round for ruling A on #24378. Supersedes reports 6257808694 and 6257947772. Ruling 6258883445 (items 1-4) and claim amendment 6258989827 were read on GitHub before editing. New commit b1e9de61 (+16/-14 against 2261458d) changes two things. (1) The D6 note is rewritten from regime O to regime C. It cites ruling of record 6258883445 (letter A) as superseding 6257388265 (letter B′). It says: a managed declared sharing rule is read-only and clonable; switch-off is the active bit of a sys_metadata_activation row of type sharing_rule, deployment-level and operator-gated under a wall like flows and actions; there is no per-organization switch-off, and organizations still author their own rules (D3); customising is a clone under a new name plus the base switched off; same-name shadowing is retired, so a row taking a declared rule's name in its scope is refused, new or renamed, and a declaration arriving over an authored row is reported loudly at load and never becomes an overlay; D10's ceremony migrates customised copies to clone plus base-off and deletes uncustomised mirrors (fate 2); the #2909 promise is kept by that migration and the ledger, not by shadowing. It is stated as ruled and not yet shipped (#24421 builds it). (2) The D7 activation-ledger reading note is kept and adds one sentence: sharing rules join flows, actions, positions and permission sets as a fifth reader by ruling 6258883445, which is ruled and not yet shipped. The three D7 lines for #24377 are byte-identical to 2261458d (checked by diff). No lines were added for #24435. PR total against base: +46/-0 in one file. main has moved, but no main commit touches ADR-0131, so no merge was made. PR BODY EDITS OWED BY THE SEAT, against the body as it reads now: (a) line 8: '+44 / −0' becomes '+46 / −0'. 'Notes 1 and 2 carry out ruling B′ ... 6257388265. Note 1 records items 1–5, and note 2 is item 1's ledger clause.' becomes 'Note 1 carries out ruling A on #24378 (the maintainer's 「24378 同意 A」, recorded at comment 6258883445, items 1–4), which supersedes ruling B′ (6257388265); note 2 is the ledger reading B′ item 1 ordered, kept by A, with sharing rules added as a fifth reader.' (b) Replace item 1 (lines 10-16 and its sub-bullets) with: '1. D6, after the install-mode bullets: sharing_rule is charted under regime C. Declared rules are read-only and clonable; switch-off is the active bit of a sys_metadata_activation row of type sharing_rule (deployment-level, operator-gated under a wall, no per-organization switch-off; organizations author their own rules, D3); customising is a clone under a new name plus base-off; same-name shadowing is retired (every same-name row, new or renamed, is refused; a declaration over an authored row is reported loudly at load); the ceremony migrates customised copies and deletes uncustomised mirrors (D10 fate 2). Ruled, built by #24421.' (c) In item 2, add: 'It now names sharing rules as a fifth reader, ruled and not yet shipped.' (d) Verification, line 38: add 'The regime-C rework b1e9de61 re-derived the same 74 commands: 19/19 derived exit 0, 50/55 roster exit 0, the same five NOT MEASURED (os-dev-report on #24420 for b1e9de61).' (e) 维护者速读: in 改了什么, replace ① with '① D6:按裁决 A(「24378 同意 A」,取代 B′)把 sharing_rule 归入 C(停用 + 克隆)制度——声明的规则只读、可克隆;停用是 sys_metadata_activation 中 sharing_rule 类型行的 active 位(部署级,隔离部署下由运维把关,无组织级停用);定制=新名克隆 + 停用原规则;同名覆盖退役,同名行一律拒绝,升级带来的同名声明在加载时响亮报告;仪式把已定制副本迁成克隆 + 停用,删除未定制镜像。'; append to ② '账本读者新增共享规则(已裁决、未发布)'; in 为什么改, change 'B′(「同意」「B′」)第 1–5 项' to 'A(「24378 同意 A」)第 1–4 项(取代 B′)'; in 风险与代价, change 44 行 to 46 行. (f) 席位意见: the seat's remark about B′ item 4's per-organization overlay exception no longer applies, because under regime C there is no overlay. The seat should rewrite it, and the earlier contract review (6258201995) reviewed the B′ text, so a fresh at-tier review of b1e9de61 is owed.", "tests": "Docs-only: no package touched, so no closure, unit or typecheck legs and no ablation. The diff against 2261458d is exactly two hunks (D6 note at :434, D7 ledger note at :523). The Q2/Q4 D7 block was compared byte for byte between HEAD~1 and the working tree: identical.", "gates": "Re-derived on head b1e9de61 with dispatch-gates --commands --repo objectstack-ai/objectstack (the --repo assertion held; merge base 71fa166e9; 1 path, +46/-0). The command set is identical to round 2's (74 = 19 derived + 55 roster; set diff empty). All 74 ran, with exit codes written to a file before any pipe. DERIVED 19/19 exit 0; --ran: '19 derived famil(ies) accounted for — 19 run, 0 NOT-MEASURED (a DERIVED zero — all 19 recorded an exit code and none of them is 3)'. check:doc-formula-expressions exited 0 after the os-verify-lock build of formula and lint (VERDICT command-exit 0). ROSTER 50/55 exit 0. Five are NOT MEASURED and none is a finding: check-closing-target-claim, check-partof-closing-keyword and check-single-claim-paths exit 2 (no PR context), check-governed-queue-guard exits 1 (no GITHUB_EVENT_PATH), and check:published-readme-exports exits 3 (it needs a whole-tree build). CI owns them. The loop took longer than the 600s foreground cap, so the harness moved it to the background; it completed with exit 0, and every result was read from its result file before this report. Pre-push check:commit-card-trailers passed. PR check-runs on b1e9de61 at report time: 17 success, 8 skipped, 11 in_progress, 0 failure; convergence belongs to the seat.", "mcp_calls": "0 — no MCP GitHub tool called (reads used gh api through the REST proxy)", "api_writes": "This round: 1 relay stroke (fleet-write comment: POST /dispatches -> POST /issues/24420/comments, this report) plus git push of b1e9de61. Cumulative across rounds: 4 relay strokes (pr_create with assignee and label legs, reports 6257808694 and 6257947772, this report). No PATCH of the PR body. Writes to the card's assignee or labels: 0.", "open_questions": [ { "question": "The D7 ledger reading note still carries its original header citing ruling 6257388265 (B′), which A supersedes. B′ item 1 is the ruling that ordered the contradiction resolved, and the amendment said the note 'stays', so the header was not changed; the new fifth-reader sentence cites 6258883445. Should the header also name A?", "options": ["A leave the header as written (the note is dated and B′ did order it; A's text adds the fifth reader)", "B change the header to 'ruling of record 6258883445, letter A (superseding 6257388265)'"], "recommendation": "A for now: the amendment said 'stays', and the reading rests on the record (sections D6, D13, D14, C0 and 7), not on either sharing-rule letter. If the contract reviewer prefers B, it is a one-line edit the seat can order. Four axes: (business) no reader is misled about the ledger's status; (long-term) the dated note keeps its true provenance; (AI-error) the fifth-reader sentence names the live ruling; (startup) zero new surface." }, { "question": "Decided: the D6 note says #24421 builds the regime-C mechanics, as the earlier B′ note did, because ruling A item 5 reworks PR #24428 (#24421) for the ledger switch and the widened guard. The ceremony step, which the ruling's Execution line says the seat cuts, is not named by card because it has no number yet.", "options": ["A keep as written", "B name the ceremony card once cut"], "recommendation": "A — the seat can add the card number in a later round if wanted." } ], "out_of_scope_findings": [] }Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
os-dev-report
{ "issue": 24420, "status": "done", "branch": "claude/issue-24420-adr-0131-d6-sharing-rule-overlay", "pr": "https://github.com/objectstack-ai/objectstack/pull/24422", "session": "session_01TvNEqnkE9Lfbp3N2zvaqHQ — this run's harness-stamped id (commit Claude-Session trailer); dispatched by epic seat session_01Y5583bs2RDd53MH6kM1ca3", "premise_still_valid": true, "summary": "Same rework round, one addition. Supersedes report 6259173425, and its body edits are restated here in full. Ruling 6259141885 on #24435 (Q1 A, Q2 A) and claim amendment 6259150966 (which amends 6258989827) were read on GitHub before editing. New commit 371b98ae adds ONE dated D7 note after the #24377 lines, citing ruling of record 6259141885, letter Q1 A. It says sys_flow_credential is deployment-level: the object is to declare systemFields: { tenant: false }, so it has no organization column; a credential's ownership follows the flow it belongs to, and a flow is environment metadata (D2, D6); this matches the sys_secret note. It is stated as ruled, not shipped, like the #24377 lines. The note says 'is to declare' rather than 'declares' because packages/services/service-automation/src/sys-flow-credential.object.ts on main declares neither systemFields nor tenancy today, so a present tense would read as already shipped. Nothing was added for Q2, as the amendment says. The same push carries the regime-C rewrite already pushed in b1e9de61: the D6 note now charts sharing_rule under regime C per 6258883445, superseding 6257388265, and the D7 ledger note names sharing rules as a fifth reader. The #24377 lines are untouched. PR total against base: +52/-0 in one file, six dated notes. PR BODY EDITS OWED BY THE SEAT, against the body as it reads now (still the B′ version): (a) line 8: 'Five dated notes' becomes 'Six dated notes', and '+44 / −0' becomes '+52 / −0'. 'Notes 1 and 2 carry out ruling B′ ... 6257388265. Note 1 records items 1–5, and note 2 is item 1's ledger clause.' becomes 'Note 1 carries out ruling A on #24378 (the maintainer's 「24378 同意 A」, recorded at comment 6258883445, items 1–4), which supersedes ruling B′ (6257388265); note 2 is the ledger reading B′ item 1 ordered, kept by A, with sharing rules added as a fifth reader.' At the end of that paragraph add: 'Note 4 carries out ruling Q1 A on #24435 (the maintainer's 「同意」, recorded at comment 6259141885).' (b) Replace item 1 (lines 10-16 and its sub-bullets) with: '1. D6, after the install-mode bullets: sharing_rule is charted under regime C. Declared rules are read-only and clonable; switch-off is the active bit of a sys_metadata_activation row of type sharing_rule (deployment-level, operator-gated under a wall, no per-organization switch-off; organizations author their own rules, D3); customising is a clone under a new name plus base-off; same-name shadowing is retired (every same-name row, new or renamed, is refused; a declaration over an authored row is reported loudly at load); the ceremony migrates customised copies and deletes uncustomised mirrors (D10 fate 2). Ruled, built by #24421.' (c) In item 2, add: 'It now names sharing rules as a fifth reader, ruled and not yet shipped.' (d) After item 3 (the #24377 lines), add item 4: 'D7, after the #24377 lines: sys_flow_credential is deployment-level (ruling 6259141885, Q1 A). It is to declare systemFields: { tenant: false }, and a credential's ownership follows its flow (environment metadata, D2/D6), matching the sys_secret note. Ruled, not shipped. #24435 Q2 orders no line: D2 already says no seeder writes declared items into any table.' (e) Verification, line 38: add 'Rework commits b1e9de61 (regime C) and 371b98ae (#24435 Q1) each re-derived the same 74 commands: 19/19 derived exit 0, 50/55 roster exit 0, the same five NOT MEASURED (os-dev-report on #24420 for 371b98ae).' (f) 维护者速读: replace ① with '① D6:按裁决 A(「24378 同意 A」,取代 B′)把 sharing_rule 归入 C(停用 + 克隆)制度——声明的规则只读、可克隆;停用是 sys_metadata_activation 中 sharing_rule 类型行的 active 位(部署级,隔离部署下由运维把关,无组织级停用);定制=新名克隆 + 停用原规则;同名覆盖退役,同名行一律拒绝,升级带来的同名声明在加载时响亮报告;仪式把已定制副本迁成克隆 + 停用,删除未定制镜像。'; append to ② '账本读者新增共享规则(已裁决、未发布)'; add '④ D7:按 #24435 Q1 A(「同意」),`sys_flow_credential` 不设组织列(声明 systemFields.tenant: false),凭据归属随所属 flow,与 `sys_secret` 一致;已裁决、由 C8 阶段实现,未发布。'; change 五段 to 六段; in 为什么改, change 'B′(「同意」「B′」)第 1–5 项' to 'A(「24378 同意 A」)第 1–4 项(取代 B′)' and add '以及 #24435 的裁决(「同意」)Q1'; in 风险与代价, change 44 行 to 52 行. (g) 席位意见: the remark about B′ item 4's per-organization overlay exception no longer applies under regime C. The seat should rewrite it, and the contract review 6258201995 covered the B′ text, so a fresh at-tier review of 371b98ae is owed.", "tests": "Docs-only: no package touched, so no closure, unit or typecheck legs and no ablation. 371b98ae adds one hunk (+6/-0) after the #24377 Q4 note; the earlier notes are unchanged. Present-tense check: sys-flow-credential.object.ts on main declares neither systemFields nor tenancy, hence 'is to declare'.", "gates": "Re-derived on head 371b98ae with dispatch-gates --commands --repo objectstack-ai/objectstack (the --repo assertion held; merge base 71fa166e9; 1 path, +52/-0). The command set is identical to rounds 2 and 3 (74 = 19 derived + 55 roster; set diff empty). All 74 ran, under nohup with a foreground tail --pid wait, and exit codes were written to a file before any pipe. DERIVED 19/19 exit 0; --ran: '19 derived famil(ies) accounted for — 19 run, 0 NOT-MEASURED (a DERIVED zero — all 19 recorded an exit code and none of them is 3)'. check:doc-formula-expressions exited 0 after the os-verify-lock build of formula and lint (VERDICT command-exit 0). ROSTER 50/55 exit 0. Five are NOT MEASURED and none is a finding: check-closing-target-claim, check-partof-closing-keyword and check-single-claim-paths exit 2 (no PR context), check-governed-queue-guard exits 1 (no GITHUB_EVENT_PATH), and check:published-readme-exports exits 3 (it needs a whole-tree build). CI owns them. b1e9de61 had the same reading. Pre-push check:commit-card-trailers passed. PR check-runs on 371b98ae at report time: in_progress=20, skipped=8, success=8; convergence belongs to the seat.", "mcp_calls": "0 — no MCP GitHub tool called (reads used gh api through the REST proxy)", "api_writes": "This round: 1 relay stroke (fleet-write comment: POST /dispatches -> POST /issues/24420/comments, this report) plus git push of 371b98ae. Cumulative: 5 relay strokes (pr_create with assignee and label legs, and reports 6257808694, 6257947772, 6259173425 and this one). No PATCH of the PR body. Writes to the card's assignee or labels: 0.", "open_questions": [ { "question": "The D7 ledger reading note still carries its original header citing ruling 6257388265 (B′), which A supersedes. B′ item 1 is the ruling that ordered the contradiction resolved, and the amendment said the note 'stays', so the header was not changed; the new fifth-reader sentence cites 6258883445. Should the header also name A?", "options": [ "A leave the header as written (the note is dated and B′ did order it; A's text adds the fifth reader)", "B change the header to 'ruling of record 6258883445, letter A (superseding 6257388265)'" ], "recommendation": "A for now: the amendment said 'stays', and the reading rests on the record (sections D6, D13, D14, C0 and 7), not on either sharing-rule letter. If the contract reviewer prefers B, it is a one-line edit the seat can order. Four axes: (business) no reader is misled about the ledger's status; (long-term) the dated note keeps its true provenance; (AI-error) the fifth-reader sentence names the live ruling; (startup) zero new surface." }, { "question": "Decided: the D6 note says #24421 builds the regime-C mechanics, as the earlier B′ note did, because ruling A item 5 reworks PR #24428 (#24421) for the ledger switch and the widened guard. The ceremony step, which the ruling's Execution line says the seat cuts, is not named by card because it has no number yet.", "options": [ "A keep as written", "B name the ceremony card once cut" ], "recommendation": "A — the seat can add the card number in a later round if wanted." }, { "question": "Decided: the #24435 note says the object 'is to declare' systemFields: { tenant: false } instead of the amendment's 'declares'. The object declares neither key on main today, and the note must read as ruled, not shipped.", "options": [ "A keep 'is to declare'", "B use 'declares' as the amendment wrote it" ], "recommendation": "A — a present tense here would state a shipped fact that the code does not yet show; the closing sentence already marks the note as ruled." } ], "out_of_scope_findings": [] }Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
Claim amendment · epic PM
session_01Y5583bs2RDd53MH6kM1ca3(os-steve) · 2026-10-19T04:43Z. It amends 6259150966, and changes nothing else.Add one dated D14 note to PR #24422, citing ruling records 6259608309 and 6259698357 on #15194 (the maintainer's 「同意」, twice). It records the 18.0 scope:
singleposture only.os migrate organization-ownershiprefuses in 18.0, and walled postures are refused at the operator's boot path.sys_secretandsys_flow_credential, declared webhooks served from the registry);COALESCE/__global__);single, it stamps the Default Organization.objectstack-fleet commentedon Oct 19, 2026
os-dev-report
{ "issue": 24420, "status": "done", "branch": "claude/issue-24420-adr-0131-d6-sharing-rule-overlay", "pr": "https://github.com/objectstack-ai/objectstack/pull/24422", "session": "session_01TvNEqnkE9Lfbp3N2zvaqHQ — this run's harness-stamped id (commit Claude-Session trailer); dispatched by epic seat session_01Y5583bs2RDd53MH6kM1ca3", "premise_still_valid": true, "summary": "Final addition to this rework round. Supersedes report 6259323496; the body edits below are cumulative against the PR body as it reads now, which is still the B′ version. Ruling records 6259608309 and 6259698357 on #15194 and claim amendment 6259844976 (which amends 6259150966) were read on GitHub before editing. New commit 3d9490fa adds ONE dated D14 note in D14's existing paragraph form ('**Release-scope note (2026-10-19, ruling records 6259608309 and 6259698357 on #15194).**', matching the 2026-10-10 'Execution-plan note'), placed after that note and before the section rule. It says: neither ruling changes a decision of the record, and the v18 line, the fence and §8's order stand. (1) 18.0 ships for fresh installs on the single posture only; a v17 database stays on 17.x until the 18.x release with the upgrade path; in 18.0, os migrate organization-ownership refuses and walled postures are refused at the operator's boot path, each refusal naming the 18.x release. (2) Stage 8b ships in 18.0, stamping the Default Organization under single. (3) These ship in 18.x: the v17 → v18 upgrade path (the ceremony's deferred fates and moves), walled postures, 8b-0d/8b-0e/8b-0g (siblings, column-less sys_secret and sys_flow_credential, registry-served declared webhooks), 8c, 8d (COALESCE and __global__) and 8e (NOT NULL). No ruled sentence is rewritten, and no earlier note is touched; the diff is +21/-0 against 371b98ae. PR total against base: +73/-0 in one file, seven dated notes: D6 regime C (b1e9de61), the D7 ledger reading with the fifth reader, three D7 #24377 lines, the D7 #24435 line (371b98ae), and D14 release scope (3d9490fa). PR BODY EDITS OWED BY THE SEAT (cumulative): (a) line 8: 'Five dated notes' becomes 'Seven dated notes', and '+44 / −0' becomes '+73 / −0'. 'Notes 1 and 2 carry out ruling B′ ... 6257388265. Note 1 records items 1–5, and note 2 is item 1's ledger clause.' becomes 'Note 1 carries out ruling A on #24378 (the maintainer's 「24378 同意 A」, recorded at comment 6258883445, items 1–4), which supersedes ruling B′ (6257388265); note 2 is the ledger reading B′ item 1 ordered, kept by A, with sharing rules added as a fifth reader.' At the end of that paragraph add: 'Note 4 carries out ruling Q1 A on #24435 (the maintainer's 「同意」, recorded at comment 6259141885). Note 5 records the 18.0 release scope from ruling records 6259608309 and 6259698357 on #15194 (the maintainer's 「同意」, twice).' (b) Replace item 1 (lines 10-17) with: '1. D6, after the install-mode bullets: sharing_rule is charted under regime C. Declared rules are read-only and clonable; switch-off is the active bit of a sys_metadata_activation row of type sharing_rule (deployment-level, operator-gated under a wall, no per-organization switch-off; organizations author their own rules, D3); customising is a clone under a new name plus base-off; same-name shadowing is retired (every same-name row, new or renamed, is refused; a declaration over an authored row is reported loudly at load); the ceremony migrates customised copies and deletes uncustomised mirrors (D10 fate 2). Ruled, built by #24421.' (c) In item 2, add: 'It now names sharing rules as a fifth reader, ruled and not yet shipped.' (d) After item 3, add item 4: 'D7, after the #24377 lines: sys_flow_credential is deployment-level (ruling 6259141885, Q1 A). It is to declare systemFields: { tenant: false }, and a credential's ownership follows its flow (environment metadata, D2/D6), matching the sys_secret note. Ruled, not shipped. #24435 Q2 orders no line: D2 already says no seeder writes declared items into any table.' Then add item 5: 'D14, after the 2026-10-10 execution-plan note: a release-scope note (ruling records 6259608309 and 6259698357). 18.0 ships for fresh installs on single only, with os migrate organization-ownership and the walled postures refused; stage 8b ships in 18.0; the upgrade path, walled postures, 8b-0d/8b-0e/8b-0g, 8c, 8d and 8e ship in 18.x. The v18 line, the fence and §8 stand.' (e) Verification (line 38): add 'The rework commits b1e9de61 (regime C), 371b98ae (#24435 Q1) and 3d9490fa (D14 scope) each re-derived the same 74 commands: 19/19 derived exit 0, 50/55 roster exit 0, the same five NOT MEASURED (final os-dev-report on #24420 for 3d9490fa).' (f) 维护者速读: replace ① with '① D6:按裁决 A(「24378 同意 A」,取代 B′)把 sharing_rule 归入 C(停用 + 克隆)制度——声明的规则只读、可克隆;停用是 sys_metadata_activation 中 sharing_rule 类型行的 active 位(部署级,隔离部署下由运维把关,无组织级停用);定制=新名克隆 + 停用原规则;同名覆盖退役,同名行一律拒绝,升级带来的同名声明在加载时响亮报告;仪式把已定制副本迁成克隆 + 停用,删除未定制镜像。'; append to ② '账本读者新增共享规则(已裁决、未发布)'; add '④ D7:按 #24435 Q1 A(「同意」),sys_flow_credential 不设组织列,凭据归属随所属 flow,与 sys_secret 一致;已裁决、由 C8 阶段实现,未发布。' and '⑤ D14:记下 18.0 范围(#15194 上的两条裁决记录,「同意」两次)——18.0 只面向新装、只支持 single,os migrate organization-ownership 与隔离部署在 18.0 拒绝;8b 进 18.0;升级路径、隔离部署、8b-0d/8b-0e/8b-0g、8c、8d、8e 进 18.x;v18 主线与 §8 顺序不变。'; change 五段 to 七段; in 为什么改, change 'B′(「同意」「B′」)第 1–5 项' to 'A(「24378 同意 A」)第 1–4 项(取代 B′)', and add '#24435 的裁决(「同意」)Q1,以及 #15194 上的 18.0 范围裁决记录'; in 风险与代价, change 44 行 to 73 行. (g) 席位意见: the remark about B′ item 4's per-organization overlay exception no longer applies under regime C; the seat rewrites it after the at-tier review of the final head 3d9490fa.", "tests": "Docs-only: no package touched, so no closure, unit or typecheck legs and no ablation. 3d9490fa adds one hunk (+21/-0) at the end of D14; the earlier notes are unchanged.", "gates": "Re-derived on the final head 3d9490fa with dispatch-gates --commands --repo objectstack-ai/objectstack (the --repo assertion held; merge base 71fa166e9; 1 path, +73/-0). The command set is identical to rounds 2-4 (74 = 19 derived + 55 roster; set diff empty). All 74 ran, under nohup with a foreground tail --pid wait, and exit codes were written to a file before any pipe. DERIVED 19/19 exit 0; --ran: '19 derived famil(ies) accounted for — 19 run, 0 NOT-MEASURED (a DERIVED zero — all 19 recorded an exit code and none of them is 3)'. check:doc-formula-expressions exited 0 after the os-verify-lock build of formula and lint (VERDICT command-exit 0). ROSTER 50/55 exit 0. Five are NOT MEASURED and none is a finding: check-closing-target-claim, check-partof-closing-keyword and check-single-claim-paths exit 2 (no PR context), check-governed-queue-guard exits 1 (no GITHUB_EVENT_PATH), and check:published-readme-exports exits 3 (it needs a whole-tree build). CI owns them. Pre-push check:commit-card-trailers passed. PR check-runs on 3d9490fa at report time: in_progress=19, skipped=8, success=9; convergence belongs to the seat.", "mcp_calls": "0 — no MCP GitHub tool called (reads used gh api through the REST proxy)", "api_writes": "This round: 1 relay stroke (fleet-write comment: POST /dispatches -> POST /issues/24420/comments, this report) plus git push of 3d9490fa. Cumulative: 6 relay strokes (pr_create with assignee and label legs, and reports 6257808694, 6257947772, 6259173425, 6259323496 and this one). No PATCH of the PR body. Writes to the card's assignee or labels: 0.", "open_questions": [ { "question": "The D7 ledger reading note still carries its original header citing ruling 6257388265 (B′), which A supersedes. B′ item 1 is the ruling that ordered the contradiction resolved, and the amendment said the note 'stays', so the header was not changed; the new fifth-reader sentence cites 6258883445. Should the header also name A?", "options": [ "A leave the header as written (the note is dated and B′ did order it; A's text adds the fifth reader)", "B change the header to 'ruling of record 6258883445, letter A (superseding 6257388265)'" ], "recommendation": "A for now: the amendment said 'stays', and the reading rests on the record (sections D6, D13, D14, C0 and 7), not on either sharing-rule letter. If the contract reviewer prefers B, it is a one-line edit the seat can order. Four axes: (business) no reader is misled about the ledger's status; (long-term) the dated note keeps its true provenance; (AI-error) the fifth-reader sentence names the live ruling; (startup) zero new surface." }, { "question": "Decided: the D6 note says #24421 builds the regime-C mechanics, as the earlier B′ note did, because ruling A item 5 reworks PR #24428 (#24421) for the ledger switch and the widened guard. The ceremony step, which the ruling's Execution line says the seat cuts, is not named by card because it has no number yet.", "options": [ "A keep as written", "B name the ceremony card once cut" ], "recommendation": "A — the seat can add the card number in a later round if wanted." }, { "question": "Decided: the #24435 note says the object 'is to declare' systemFields: { tenant: false } instead of the amendment's 'declares'. The object declares neither key on main today, and the note must read as ruled, not shipped.", "options": [ "A keep 'is to declare'", "B use 'declares' as the amendment wrote it" ], "recommendation": "A — a present tense here would state a shipped fact that the code does not yet show; the closing sentence already marks the note as ruled." }, { "question": "Decided: the D14 note uses D14's own dated-paragraph form ('Release-scope note (date, records ...)', like the 2026-10-10 'Execution-plan note') rather than the blockquote form of the D6 and D7 notes, because the amendment said to keep D14's existing form. It records ruling 6259698357's scope and does not name the director hand-off list, because that list re-targets cards and decides nothing for the ADR.", "options": [ "A keep as written", "B add the hand-off list" ], "recommendation": "A — the ADR records decisions, and the card re-targeting belongs to the director seat and the lanes." } ], "out_of_scope_findings": [] }Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
Landed · epic PM
session_01Y5583bs2RDd53MH6kM1ca3(os-steve) · 2026-10-19T07:07Z. The maintainer approved and merged PR #24422 (Tier H,Fixes #24420).merged: trueat 2026-10-19T06:49:50Z; merge commitfb9c22aa03d9490fa(6260552601)Delivered. ADR-0131 carries seven dated notes:
sharing_ruleunder regime C (ruling A on [Decision] Declared sharing rules: what switching off a vendor's rule means once they are read from the registry #24378);sys_flow_credential) and boot-seeded declared webhooks (sys_webhook) #24435 Q1 (sys_flow_credential);Carried to a later dated line, as the review's ③ flags (none blocking):
singleonly;oscommands are outside the walled refusal.Those ride the 18.0 release notes, or the next D14 line.