[objectstack-fleet]

Requested by Sam · project thread
Fixes #28368

Clause-②: no
Metadata-protocol: none

domain:server#4 · os-zhuang · os-dev for claim 6541181717 · Ruling-ref: 6540309323 (#27900, 「其他同意」)
Tier: H (docs/adr/0011-actions-as-ai-tools.md): a contract review, then an authorised approval by a GOVERNED_APPROVER, before the queue.

维护者速读

• 改了什么：两个 enable_two_factor 动作(sys_user 与 sys_two_factor)删掉 ai 块，从 E 档移到 H 档;sys_invitation.copy_invitation_link 评为 H 档，保持不写 ai 块。ADR-0011 附记更新三档名单(H23 / C17 / E19,共 36 个 ai 块、59 个动作)，并加一行:sys_approval_request 的 9 个动作未评估，评估前一律仅限人工。
• 为什么改：执行您在 [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 上的裁决「其他同意」。启用双因素要用户密码、返回新的登录因子;邀请链接本身就是凭据。两者都不该让 agent 拿到。
• 风险与回滚：只收窄 agent 能看到的动作，Console 里登录用户的操作不变。回滚即还原这一个提交。
• 先看:docs/adr/0011-actions-as-ai-tools.md 的修订注记与名单;packages/platform-objects/src/identity/sys-user.object.ts 的 enable_two_factor。
• 两分钟验证:grep -c "ai: {" packages/platform-objects/src/identity/*.object.ts 合计应为 36,且 enable_two_factor 下不再有 ai:。
• 需要你做的：本 PR 触及 ADR(Tier H),合同复审通过后需 os-zhuang 或 hotlong 批准。

What changes

• sys_user.enable_two_factor, sys_two_factor.enable_two_factor (E → H). Each drops its ai: { exposed: true, description } block; a one-line comment names bucket H in its place. Over MCP neither is listed any more, and run_action refuses both by name (the existing per-action opt-in, systemObjectActionExposureError). A signed-in person runs both exactly as before.
• sys_invitation.copy_invitation_link (assessed H). No ai block, as before; a one-line comment names bucket H and why (the accept link is a bearer credential). No behaviour change.
• ADR-0011, the 2026-10-30 identity addendum. A dated amendment note (ruling of record 6540309323), the H list gains the three names (23), the E list loses two (19), the count paragraph reads 59 actions / 36 ai blocks, the "Not assessed" paragraph now records sys_approval_request's 9 actions as unassessed and human-only, and the two "38 / 37" counts in the MCP paragraphs read 36 / 35.
• Changesets. New 28368-identity-two-factor-invite-link-human-only.md (@objectstack/platform-objects patch). The unreleased 27900-identity-actions-ai-exposure.md is corrected to the final lists (19 / 17 / 23, 59 assessed, 36 declared) so the release does not ship a sentence saying two-factor enabling is exposed.

Reading of the card's item 1

The card says copy_invitation_link "gets an ai block, tier H". The ruling of record (6540309323) says "→ H (human-only)", the ADR's H row says "no ai block", and the ruled total, 36 ai blocks = C17 + E19, leaves no room for a 37th. So H here means no ai block; the action keeps today's declaration, and the change is its entry in the H list plus the code comment.

Tests

• pnpm --filter @objectstack/platform-objects test: 104 files, 1474 / 1474 passed.
• pnpm --filter @objectstack/platform-objects typecheck: exit 0.
• Build of the dependency closure (pnpm --filter '@objectstack/platform-objects...' build): exit 0.
• git grep of enable_two_factor and copy_invitation_link across packages/runtime, packages/qa, packages/services and content/docs found no test or doc pinning either action as agent-exposed. feat(platform-objects): the identity actions an agent may reach declare it — additive acts exposed, destructive lifecycle acts behind confirmation, credential and ownership acts human-only #28270 added no per-tier name-list pin (the maintainer struck the automatic check), so no pin moves.

Acceptance notes

• Metadata-protocol: none. The claim first read narrowed; the seat amended it to none, since the kind is defined by what a metadata author can write and these are values on an existing key of platform-owned metadata (the same kind feat(platform-objects): the identity actions an agent may reach declare it — additive acts exposed, destructive lifecycle acts behind confirmation, credential and ownership acts human-only #28270 declared). So the changeset is patch and carries no ADR-0087 marker.
• check-empty-changeset is red on purpose. This PR corrects the still-unreleased .changeset/27900-identity-actions-ai-exposure.md (feat(platform-objects): the identity actions an agent may reach declare it — additive acts exposed, destructive lifecycle acts behind confirmation, credential and ownership acts human-only #28270's note) to the final lists: exposed 19 (enabling two-factor removed), human-only 23 (enabling two-factor and copying an invitation link added), 59 assessed / 36 declared. Without it, the release would ship a sentence saying enabling two-factor is agent-exposed. The gate puts this DELIBERATE CORRECTION in front of a person by staying red; please confirm it at landing.
• The ruling also asked for one note line on sys_approval_request; its 9 actions (plugin-approvals) were measured to declare no ai block, so the note matches the code.

Verification

Head cbd23194, merge base fc5d5093 (origin/main).

Local gates: 61 derived, 61 run, 60 exit 0, 1 red by design

• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack: 61 commands from 6 paths (69 changed lines).
• All 61 run on head cbd23194 after a full pnpm build (116/116, exit 0). 60 exit 0.
• node scripts/check-empty-changeset.mjs --base origin/main: exit 1, the DELIBERATE CORRECTION of .changeset/27900-identity-actions-ai-exposure.md described under Acceptance notes. It stays red until a person confirms.
• dispatch-gates --ran with exit codes recorded: 61 derived, 61 run, 0 NOT-MEASURED (a derived zero), exit 0.
• pnpm lint: exit 0.
• The first pass, before the full build, gave exit 3 (PREREQUISITE NOT MET) on check:dual-build-cjs-loads, check:i18n, check:lean-entry-closure and check-plugin-teardown-shape.mjs --self-test (shallow clone). All four exit 0 on the final pass.

Not measured locally

• The CI-only families dispatch-gates names outside its derived total (artifact rosters, wide-population families, the Build Core and Type Check lanes) are left to this PR's check-runs.
• The dogfood battery is not owed: there is no ! in the title and no (narrowing) arm.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 2 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 3ba52069197858607f27ffd8a63b8921e06fd6cc → packageMentionDocs.

[objectstack-fleet]

domain:server#4 · os-zhuang · session_01QUs3BtyH9zgxKzYrJiH18J

Contract-review-claim: session_01QUs3BtyH9zgxKzYrJiH18J · head cbd2319 · 2026-10-31T09:29Z

[objectstack-fleet]

domain:server#4 · os-zhuang · session_01QUs3BtyH9zgxKzYrJiH18J

Contract-review-handoff: triage — CONTRACT_REVIEW_TIER unavailable (HTTP 429 rate_limit, request req_011Cga5gPg2uE7VRPve6wDjK, 2026-10-31T09:31Z) · head cbd2319

• The seat's at-tier reviewer was refused by quota before it rendered a record; ⛔ no lower-tier review stands in (contract-review.md). needs:contract-review is added. The review is owed on this head: the ADR-0011 addendum (scope docs/adr/0011-actions-as-ai-tools.md + the three identity object files and systemObjectActionExposureError it cites), and, since the diff also changes code, the sentence-by-sentence judgment of the check-empty-changeset DELIBERATE CORRECTION to .changeset/27900-identity-actions-ai-exposure.md.
• The seat's own TIER_DEFAULT review of the remainder follows as ## 席位核对 once the head's check-runs settle. Tier H: the maintainer's approval is owed after a PASS.

[objectstack-fleet]

domain:server#4 · os-tesla · session_01L9qibw58ehQ2gRHP2h2Puz

Contract-review-claim: session_01L9qibw58ehQ2gRHP2h2Puz · head cbd231941209c68ff5881ba988b77222e7b5976c · 2026-10-31T11:44Z

[objectstack-fleet]

domain:server#4 · os-tesla · session_01L9qibw58ehQ2gRHP2h2Puz

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: cbd231941209c68ff5881ba988b77222e7b5976c
Local-runs: none
Scope: packages/platform-objects/src/identity/sys-user.object.ts and sys-two-factor.object.ts (the enable_two_factor action of each loses its ai block), sys-invitation.object.ts (copy_invitation_link keeps none, now with the bucket comment), docs/adr/0011-actions-as-ai-tools.md (the 2026-10-31 amendment note, the H/C/E name lists, the counts, the "not assessed" paragraph, the MCP paragraphs), .changeset/28368-identity-two-factor-invite-link-human-only.md (new, platform-objects patch) and the DELIBERATE CORRECTION of .changeset/27900-identity-actions-ai-exposure.md (the pending #27900 changeset's counts and name lists)

Inputs: card #28368 (the three items of ruling 6540309323 on #27900, the maintainer's 「其他同意」 of 2026-10-31T06:53Z: copy_invitation_link assessed H, both enable_two_factor moved E to H, sys_approval_request's 9 actions noted unassessed and human-only), PR #28386 (body with the three items, the amended counts and the two changesets, the Metadata-protocol amendment 6541378586 to none, the seat's hand-off 6541730064; 6 files, +40/−28, the diff read whole), the 54 check-runs on this head (read 2026-10-31T11:50Z: 54 runs on this head, 35 success, 17 skipped, 2 failure; the 2 failures are both runs of Check Changeset, the designed check-empty-changeset DELIBERATE CORRECTION refusal of .changeset/27900-identity-actions-ai-exposure.md, red until a person confirms the correction at landing; every other latest run per name is green: Build Core, Check Documentation Links, Dogfood Regression Gate, Flag docs affected by code changes, Governed Surface Queue Guard, Lint & Repo Gates, Lint · CI, release & engine gates, Lint · ESLint, Lint · PM dispatch-gates, Lint · docs & code guards, Lint · repo & tooling gates, Lint · scoped · query-options erasure, Lint · scoped · slot lookup & corpus, Lint · scoped · tooling self-tests, Live E2E UI, PR-body guards (claim · duplicate · Part-of · single-writer path), Plan Test Core shards, Test Core, Test Core (all 8), Test UI, Type Check · consumer gates, Type Check · debt ledger, Type Check · source gates, Type Check · workspace, TypeScript Type Check, filter; skipped: 18.x upgrade harness (opt-in), Auto Label, Build & E2E UI, Build Docs, Build UI Deps, Check PR Size, Dogfood Regression Gate (matrix shard/3), Dogfood Verify CLI, Lint UI, Packed-tarball smoke (opt-in), Schedule gate · skip when a green push run covers the commit, Temporal Conformance (live PG + MySQL), Test UI (matrix shard/16), Type Check UI, UI Published Artifacts), the job log of the red Check Changeset run (124502062205: check-empty-changeset refuses .changeset/27900-identity-actions-ai-exposure.md because it exists on the merge base and was not added by this PR; check-adr-0087-registration and the no-major check in the same job passed), and the tree at this head for the counts: the three ADR name lists hold 23, 17 and 19 unique names (59), and ai: { occurs 36 times across the identity objects (sys-user 7, sys-two-factor 0, sys-invitation 5, the rest unchanged). No file of this PR moved on main since the merge-base; the head is mergeable.

① Derived judgments

• The ruling is applied exactly, nothing more - right. Item 2: the two enable_two_factor declarations drop ai: { exposed: true, description } and carry the bucket-H comment, so systemObjectActionExposureError (ADR-0066 D4) no longer lists them over MCP and run_action refuses them by name; the Console runs them as before, since the ai block never gated a signed-in person. Item 1: copy_invitation_link was already undeclared; the PR adds the comment only, which is what bucket H means in the ADR table (no ai block). The card's item 1 wording 「gets an ai block, tier H」 reads as shorthand for "assessed into bucket H"; the ruling text and the ADR's H row both say no block, and the diff follows them. Item 3: the "Not assessed" paragraph now names sys_approval_request's 9 actions, with the prior copy_invitation_link sentence retired since it is assessed. No action gains exposure, so no new MCP surface opens.
• The ADR addendum is the amended record and its arithmetic holds - right. The amendment note cites the ruling by id and date, the H list adds the three names (20 → 23), the E list loses the two (21 → 19), C is untouched (17), and 23 + 17 + 19 = 59 = the 58 of the 2026-10-30 assessment plus copy_invitation_link. Declared blocks 36 = C 17 + E 19, which matches the tree's 36 ai: { occurrences; the MCP paragraphs' 38 → 36 and 37 → 35 (36 less the one REST-route forward, revoke_api_key) follow. The paragraph keeping the 2026-10-30 figures (58 / 38, the card's H 19 / E 22 headers) is kept as history, not as the current count.
• The DELIBERATE CORRECTION of the [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 changeset is accurate sentence by sentence - right. [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900's changeset is pending (unreleased), so its text is what the release notes will say; the correction changes the header counts (58/38 → 59/36), drops "enabling two-factor authentication" from the Exposed (19) sentence, adds "enabling two-factor authentication" and "copying an invitation's accept link" to the Human-only (23) sentence, and removes the sentence that said copy_invitation_link "was not part of the assessment", which would now be false. Every other sentence is byte-identical. The new changeset carries the same three facts as a fix on @objectstack/platform-objects at patch.
• Clause-② no and Metadata-protocol: none - accepted. The ai block is a platform-object declaration, not a spec key; the schema of ActionSchema.ai is untouched; what changes is which shipped actions declare it. The symmetric [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 (feat(platform-objects): the identity actions an agent may reach declare it — additive acts exposed, destructive lifecycle acts behind confirmation, credential and ownership acts human-only #28270) declared no for the additions, so the removals declare no too; the amendment 6541378586 from narrowed to none is the right reading (nothing an author writes changes). The behaviour change for an MCP agent (two actions no longer listed) is the declared fix and is why this review is served at CONTRACT_REVIEW_TIER.
• Check-runs as gate verdicts - read as above. Every latest run per name on this head is green or skipped except Check Changeset, which is red on both of its runs for one reason: check-empty-changeset refuses a PR that edits a changeset it did not add. That refusal is the gate's designed DELIBERATE CORRECTION door (a correction of another PR's pending changeset stays red until a person confirms it at landing); the correction here is the whole point of the PR and is judged accurate above. The rest of that job passed. This record does not clear that door; the human approver does.

② Semver level

• @objectstack/platform-objects patch - accepted. Two actions lose a declaration and nothing else moves; the fix title names the behaviour change for an agent. The corrected [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 changeset keeps its own patch.

③ Boundary flags

• Tier H, human approval owed - docs/adr/0011-actions-as-ai-tools.md is a GOVERNED surface, so this PR lands only with a GOVERNED_APPROVER's approval (os-zhuang or hotlong); no reviewer is requested on the PR yet, and Tesla's routing asks for os-zhuang to be requested when he is the approver. That approval is also where the DELIBERATE CORRECTION of .changeset/27900-identity-actions-ai-exposure.md is confirmed, so the red Check Changeset leg is expected to stay red until then; it is not a defect of this head.
• Ordering against [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 - this PR edits the changeset [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 (feat(platform-objects): the identity actions an agent may reach declare it — additive acts exposed, destructive lifecycle acts behind confirmation, credential and ownership acts human-only #28270, merged) added, so it lands after it, which the merge-base already satisfies. If [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900's changeset were consumed by a release before this lands, the correction would need to move into this PR's own changeset instead; nothing suggests that today.
• sys_approval_request - the 9 actions are now recorded unassessed and human-only; a later assessment is a ruling, not a code change, and no card exists for it.

④ Design judgment

• Tried: whether dropping ai on sys_user.enable_two_factor leaves sys_user.disable_two_factor consistent (it was H already, so the pair is now H/H, which reads right: both sides of a sign-in factor are human-only); whether any test pinned the 38 or 21 counts (none in the tree; the ADR says no automatic check by the maintainer's choice); whether the two identical enable_two_factor descriptions were referenced elsewhere (no). Nothing to add.

Verdict reasoning. The three items of ruling 6540309323 are applied exactly, the ADR's amended lists and counts are arithmetically and textually consistent with the tree, the correction of the pending #27900 changeset is accurate in every sentence it touches, the levels and declarations are right, and the one red check is the designed deliberate-correction door that only the Tier H approver clears at landing.

Implemented-by: claude/project-thread-nsguxo
Reviewed-by: session_01L9qibw58ehQ2gRHP2h2Puz

VERDICT: PASS

[objectstack-fleet]

domain:server#4 · os-tesla · session_01L9qibw58ehQ2gRHP2h2Puz

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: cbd231941209c68ff5881ba988b77222e7b5976c
Local-runs: none
Scope: packages/platform-objects/src/identity/sys-user.object.ts and sys-two-factor.object.ts (the enable_two_factor action of each loses its ai block), sys-invitation.object.ts (copy_invitation_link keeps none, now with the bucket comment), docs/adr/0011-actions-as-ai-tools.md (the 2026-10-31 amendment note, the H/C/E name lists, the counts, the "not assessed" paragraph, the MCP paragraphs), .changeset/28368-identity-two-factor-invite-link-human-only.md (new, platform-objects patch) and the DELIBERATE CORRECTION of .changeset/27900-identity-actions-ai-exposure.md (the pending #27900 changeset's counts and name lists)

Inputs: card #28368 (the three items of ruling 6540309323 on #27900, the maintainer's 「其他同意」 of 2026-10-31T06:53Z: copy_invitation_link assessed H, both enable_two_factor moved E to H, sys_approval_request's 9 actions noted unassessed and human-only), PR #28386 (body with the three items, the amended counts and the two changesets, the Metadata-protocol amendment 6541378586 to none, the seat's hand-off 6541730064; 6 files, +40/−28, the diff read whole), the 54 check-runs on this head (read 2026-10-31T11:51Z: 54 runs on this head, 35 success, 17 skipped, 2 failure; the 2 failures are both runs of Check Changeset, the designed check-empty-changeset DELIBERATE CORRECTION refusal of .changeset/27900-identity-actions-ai-exposure.md, red until a person confirms the correction at landing; every other latest run per name is green: Build Core, Check Documentation Links, Dogfood Regression Gate, Flag docs affected by code changes, Governed Surface Queue Guard, Lint & Repo Gates, Lint · CI, release & engine gates, Lint · ESLint, Lint · PM dispatch-gates, Lint · docs & code guards, Lint · repo & tooling gates, Lint · scoped · query-options erasure, Lint · scoped · slot lookup & corpus, Lint · scoped · tooling self-tests, Live E2E UI, PR-body guards (claim · duplicate · Part-of · single-writer path), Plan Test Core shards, Test Core, Test Core (all 8), Test UI, Type Check · consumer gates, Type Check · debt ledger, Type Check · source gates, Type Check · workspace, TypeScript Type Check, filter; skipped: 18.x upgrade harness (opt-in), Auto Label, Build & E2E UI, Build Docs, Build UI Deps, Check PR Size, Dogfood Regression Gate (matrix shard/3), Dogfood Verify CLI, Lint UI, Packed-tarball smoke (opt-in), Schedule gate · skip when a green push run covers the commit, Temporal Conformance (live PG + MySQL), Test UI (matrix shard/16), Type Check UI, UI Published Artifacts), the job log of the red Check Changeset run (124502062205: check-empty-changeset refuses .changeset/27900-identity-actions-ai-exposure.md because it exists on the merge base and was not added by this PR; check-adr-0087-registration and the no-major check in the same job passed), and the tree at this head for the counts: the three ADR name lists hold 23, 17 and 19 unique names (59), and ai: { occurs 36 times across the identity objects (sys-user 7, sys-two-factor 0, sys-invitation 5, the rest unchanged). No file of this PR moved on main since the merge-base; the head is mergeable.

① Derived judgments

• The ruling is applied exactly, nothing more - right. Item 2: the two enable_two_factor declarations drop ai: { exposed: true, description } and carry the bucket-H comment, so systemObjectActionExposureError (ADR-0066 D4) no longer lists them over MCP and run_action refuses them by name; the Console runs them as before, since the ai block never gated a signed-in person. Item 1: copy_invitation_link was already undeclared; the PR adds the comment only, which is what bucket H means in the ADR table (no ai block). The card's item 1 wording 「gets an ai block, tier H」 reads as shorthand for "assessed into bucket H"; the ruling text and the ADR's H row both say no block, and the diff follows them. Item 3: the "Not assessed" paragraph now names sys_approval_request's 9 actions, with the prior copy_invitation_link sentence retired since it is assessed. No action gains exposure, so no new MCP surface opens.
• The ADR addendum is the amended record and its arithmetic holds - right. The amendment note cites the ruling by id and date, the H list adds the three names (20 → 23), the E list loses the two (21 → 19), C is untouched (17), and 23 + 17 + 19 = 59 = the 58 of the 2026-10-30 assessment plus copy_invitation_link. Declared blocks 36 = C 17 + E 19, which matches the tree's 36 ai: { occurrences; the MCP paragraphs' 38 → 36 and 37 → 35 (36 less the one REST-route forward, revoke_api_key) follow. The paragraph keeping the 2026-10-30 figures (58 / 38, the card's H 19 / E 22 headers) is kept as history, not as the current count.
• The DELIBERATE CORRECTION of the [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 changeset is accurate sentence by sentence - right. [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900's changeset is pending (unreleased), so its text is what the release notes will say; the correction changes the header counts (58/38 → 59/36), drops "enabling two-factor authentication" from the Exposed (19) sentence, adds "enabling two-factor authentication" and "copying an invitation's accept link" to the Human-only (23) sentence, and removes the sentence that said copy_invitation_link "was not part of the assessment", which would now be false. Every other sentence is byte-identical. The new changeset carries the same three facts as a fix on @objectstack/platform-objects at patch.
• Clause-② no and Metadata-protocol: none - accepted. The ai block is a platform-object declaration, not a spec key; the schema of ActionSchema.ai is untouched; what changes is which shipped actions declare it. The symmetric [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 (feat(platform-objects): the identity actions an agent may reach declare it — additive acts exposed, destructive lifecycle acts behind confirmation, credential and ownership acts human-only #28270) declared no for the additions, so the removals declare no too; the amendment 6541378586 from narrowed to none is the right reading (nothing an author writes changes). The behaviour change for an MCP agent (two actions no longer listed) is the declared fix and is why this review is served at CONTRACT_REVIEW_TIER.
• Check-runs as gate verdicts - read as above. Every latest run per name on this head is green or skipped except Check Changeset, which is red on both of its runs for one reason: check-empty-changeset refuses a PR that edits a changeset it did not add. That refusal is the gate's designed DELIBERATE CORRECTION door (a correction of another PR's pending changeset stays red until a person confirms it at landing); the correction here is the whole point of the PR and is judged accurate above. The rest of that job passed. This record does not clear that door; the human approver does.

② Semver level

• @objectstack/platform-objects patch - accepted. Two actions lose a declaration and nothing else moves; the fix title names the behaviour change for an agent. The corrected [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 changeset keeps its own patch.

③ Boundary flags

• Tier H, human approval owed - docs/adr/0011-actions-as-ai-tools.md is a GOVERNED surface, so this PR lands only with a GOVERNED_APPROVER's approval (os-zhuang or hotlong); no reviewer is requested on the PR yet, and Tesla's routing asks for os-zhuang to be requested when he is the approver. That approval is also where the DELIBERATE CORRECTION of .changeset/27900-identity-actions-ai-exposure.md is confirmed, so the red Check Changeset leg is expected to stay red until then; it is not a defect of this head.
• Ordering against [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 - this PR edits the changeset [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 (feat(platform-objects): the identity actions an agent may reach declare it — additive acts exposed, destructive lifecycle acts behind confirmation, credential and ownership acts human-only #28270, merged) added, so it lands after it, which the merge-base already satisfies. If [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900's changeset were consumed by a release before this lands, the correction would need to move into this PR's own changeset instead; nothing suggests that today.
• sys_approval_request - the 9 actions are now recorded unassessed and human-only; a later assessment is a ruling, not a code change, and no card exists for it.

④ Design judgment

• Tried: whether dropping ai on sys_user.enable_two_factor leaves sys_user.disable_two_factor consistent (it was H already, so the pair is now H/H, which reads right: both sides of a sign-in factor are human-only); whether any test pinned the 38 or 21 counts (none in the tree; the ADR says no automatic check by the maintainer's choice); whether the two identical enable_two_factor descriptions were referenced elsewhere (no). Nothing to add.

Verdict reasoning. The three items of ruling 6540309323 are applied exactly, the ADR's amended lists and counts are arithmetically and textually consistent with the tree, the correction of the pending #27900 changeset is accurate in every sentence it touches, the levels and declarations are right, and the one red check is the designed deliberate-correction door that only the Tier H approver clears at landing.

Implemented-by: claude/project-thread-nsguxo
Reviewed-by: session_01L9qibw58ehQ2gRHP2h2Puz

VERDICT: PASS

[objectstack-fleet]

domain:server#4 · os-zhuang · session_01QUs3BtyH9zgxKzYrJiH18J

ACCEPT · PR #28386 · Head-sha cbd231941209c68ff5881ba988b77222e7b5976c · 2026-10-31T11:52Z · Tier H, approval owed

维护者速读

• 改了什么： 两个 enable_two_factor 动作（sys_user 与 sys_two_factor）删掉 ai 块，从 E 档移到 H 档；sys_invitation.copy_invitation_link 评为 H 档，保持不写 ai 块。ADR-0011 附记更新三档名单（H23 / C17 / E19，共 36 个 ai 块、59 个动作），并加一行：sys_approval_request 的 9 个动作未评估，评估前一律仅限人工。同时更正尚未发布的 [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 changeset 里的计数与名单。
• 为什么改： 执行您在 [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 上的裁决「其他同意」。启用双因素要用户密码、返回新的登录因子；邀请链接本身就是凭据。两者都不该让 agent 拿到。
• 风险与回滚： 只收窄 agent 能看到的动作，Console 里登录用户的操作不变。回滚即 revert 本 PR。
• 先看： docs/adr/0011-actions-as-ai-tools.md 的修订注记与名单；packages/platform-objects/src/identity/sys-user.object.ts 的 enable_two_factor。
• 两分钟验证： grep -c "ai: {" packages/platform-objects/src/identity/*.object.ts 合计应为 36，且 enable_two_factor 下不再有 ai:。
• 需要你做的： 批准本 PR（触及 ADR，Tier H）。达档合约审查 PASS：comment 6542995471，Head-sha cbd231941209c68ff5881ba988b77222e7b5976c。批准后席位落地。

席位意见：三条裁决逐字落实，ADR 计数与代码树一致，#27900 changeset 的更正逐句核过；唯一的红是有意设计的"更正他人待发 changeset"门，可带红入队。

席位核对

• Form: 6 files, +40/−28. check-governed-merges.mjs --pr 28386: 1 of 6 paths governed (docs/adr/**), so Tier H: maintainer approval from GOVERNED_APPROVERS before landing. Clause-②: no; Metadata-protocol: none (amendment 6541378586); the contract review accepts both.
• Premise measured: ruling 6540309323 on [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 (the maintainer's 「其他同意」). Contract review 6542995471 (Served-tier CONTRACT_REVIEW_TIER, same head, VERDICT: PASS) checks the three items against the tree: 36 ai: { blocks, lists of 23/17/19 = 59.
• Gates (check-runs at the pinned head): 54 runs: 35 success, 17 skipped, 2 failure. Both failures are Check Changeset, the designed check-empty-changeset DELIBERATE CORRECTION refusal of .changeset/27900-identity-actions-ai-exposure.md. Its confirmation is on record: the same-head at-tier PASS (6542995471, ① third bullet) judges each rewritten sentence of that note. Three conditions for entering the queue red, all met: the script states the red is by design (scripts/check-empty-changeset.mjs "Past a designed red"); pr-automation.yml (which runs Check Changeset) has no merge_group trigger; this comment records the gate and its cause.
• Accepted deviations: card item 1's wording 「gets an ai block, tier H」 is read as "assessed into bucket H", which per the ruling and the ADR's H row means no block. The diff follows the ruling.
• Out of scope and where it goes: the assessment of sys_approval_request's 9 actions is a later ruling with no card yet. Skills-docs: none.
• Landing clause: Tier H endgame. needs-user-decision goes on this PR and the approver review is requested now. Once an authorized approver approves, the seat removes the label, flips ready, enables auto-merge, then confirms MERGED and closes out #27900 follow-up: copy_invitation_link and both enable_two_factor identity actions become human-only (H), and ADR-0011 notes sys_approval_request's 9 actions as unassessed #28368.