Setup → Sharing Rules lists only stored rules once declared rules leave sys_sharing_rule (objectstack C3 stage 9)

Filing gate ④: a coordination node, the objectui half of objectstack-ai/objectstack C3 stage 9 (objectstack-ai/objectstack#23952, PR objectstack-ai/objectstack#24376), filed by the objectstack epic seat (epic:#15194, session_01Y5583bs2RDd53MH6kM1ca3) as its cross-repo follow-up. ⛔ Not a claim. Reader who acts: the epic seat dispatches it once stage 9 has merged. Dedupe: semantic search on objectstack-ai/objectui, "Setup sharing rules list declared rules package rules not shown registry" → 0 hits.

_{Unblocked by the epic seat at 2026-10-19T12:11Z: objectstack-ai/objectstack#24421's guard and ledger switch landed in PR objectstack-ai/objectstack#24428 (merged 964a2370). #24421 stays open only for 9c (the 18.x ceremony), which this page does not need. Dispatched in parallel to the 18.x line (ruling record 6266750393 on objectstack-ai/objectstack#15194); ships in 18.1.}

_{Re-pointed by the epic seat when objectstack-ai/objectstack#23952 closed (PR objectstack-ai/objectstack#24376 merged 5e979073): stage 9's half is done. Re-pointed again when C9's PR #12998 merged (78b07f4): that file-surface serialization is cleared, and #7611 stays open only for its objectstack-side remainder. This card now waits on objectstack-ai/objectstack#24421, the server's guard and ledger switch under ruling A (below). Setup's New and Edit on a sharing rule exercise both, and building the page before they land would mean building it twice.}

Ruling A on objectstack-ai/objectstack#24378 (6258883445) sets this card's shape — it supersedes B′

The maintainer re-ruled the card 「24378 同意 A」: sharing_rule moves to regime C, read-only and clonable, and switched through the activation ledger. The B′ section this card carried before is withdrawn. The original Wanted and Acceptance below ("declared rules read-only") stand again, with these additions:

Declared (vendor) rules are listed read-only with their provenance and carry two actions:
- Disable / Enable. The rule's sys_metadata_activation active bit is deployment-level and operator-gated under a wall. Show the server's refusal to a caller who is not allowed.
- Clone. Pre-fill New from the declared rule under a new name. The page then offers to disable the base.
Organization-authored rules stay editable as before.
New never offers a declared rule's name. If the server refuses one (409 RESOURCE_CONFLICT, naming the vendor rule; plugin-sharing: refuse a new or renamed sys_sharing_rule row that takes a declared rule's name, and reconcile the shadowed declaration's grants on a same-name write (ruling B′ on #24378) objectstack#24421), the page shows that refusal.
The one-list rule and 「There is no merged two-source list.」 still bind. Measure which server read answers "declared, and is it switched off" for each row. If none does, report the gap to the server; the client does not merge two sources to fill it.

_{Re-pointed by the epic seat at 2026-10-19T03:3xZ under ruling A. It still waits on objectstack-ai/objectstack#24421 (PR objectstack-ai/objectstack#24428, reworked to regime C).}

What changes on the objectstack side

Stage 9 retires bootstrapDeclaredSharingRules. A sharing rule a package declares is read from the registry at enforcement, and the ownership ceremony deletes the sys_sharing_rule rows that mirrored it. A fresh boot writes zero sys_sharing_rule rows for declared rules. Organization-authored rules stay rows.

The objectstack dev and the contract reviewer both measured the consequence (os-dev-report on objectstack-ai/objectstack#23952, out_of_scope_findings; record 6253094552 on PR objectstack-ai/objectstack#24376):

Setup's Sharing Rules page is the generic sys_sharing_rule object view. Once the PR lands, it lists organization-authored rules only, and a package's declared rules disappear from Setup while they still grant access.
GET /api/v1/sharing/rules (the sharing service) lists both declared and stored rules.
Reach: every deployment whose packages declare sharing rules (showcase 2; the maintainer's hotcrm 11).

Wanted

Setup shows the declared rules again, without a client-side merge of two sources. objectui#7611's rule binds here too: 「There is no merged two-source list.」. The two shapes that rule leaves:

A. The Sharing Rules page reads one server list, GET /api/v1/sharing/rules, which already answers both kinds. Declared rules render read-only with a provenance badge; stored rules stay editable. Search, sort and paging are the server's.
B. Declared rules get their own read-only catalog page from /api/v1/meta/sharing_rule, as C9 built for positions and permission sets. The data page stays the sys_sharing_rule view for organization rules.

Measure first which shape the existing console code supports with the least new surface, and say why in the PR. The pick has to keep native search, sort and paging.

Acceptance

On a showcase boot that carries stage 9 and plugin-sharing: refuse a new or renamed sys_sharing_rule row that takes a declared rule's name, and reconcile the shadowed declaration's grants on a same-name write (ruling B′ on #24378) objectstack#24421, Setup lists the showcase's two declared sharing rules read-only, with their provenance and with Disable and Clone, and lists any organization-authored rule as editable. Disable switches the vendor rule off through the ledger, and Clone creates a new-named rule. New with a declared rule's name shows the server's refusal.
No request fetches and merges two lists in the client.
objectstack's .objectui-sha pin moves after this lands; the objectstack epic seat dispatches that.

Ruling-pointer · objectstack-ai/objectstack#24378 re-ruled A at 6258883445 (batch #368 item 1, the maintainer's 「24378 同意 A」; supersedes B′) · director seat (summon #43 continuation 5, session_01QJC7i981TSs9L1CGJK59Ax) · 2026-10-19T03:20Z

For this card's scope: declared rules are read-only in Setup → Sharing Rules, with two actions — Disable (a sys_metadata_activation row of type sharing_rule, deployment-level, operator-gated under a wall) and Clone (a new stored rule under a new name). No in-place edit of a declared rule; a stored rule may not take a declared rule's name (the platform refuses it, 409). The platform side lands first (objectstack-ai/objectstack#24421's rework of PR #24428); this card stays pm:blocked on it.

Claim: PM loop round 10 · 2026-10-19T12:09Z
Session: session_01Y5583bs2RDd53MH6kM1ca3 (the objectstack epic seat, epic:objectstack-ai/objectstack#15194)
Account: os-steve (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-12982-setup-sharing-regime-c
Worktree: the cloud session's own checkout (mode:cloud)
Domain: domain:ui
Seat: epic:objectstack-ai/objectstack#15194 (the epic lane)
File surface, read on objectui main. Stop on a breach and explain it in the report.

The console's Setup sharing-rule page and the code it needs: apps/console and packages/app-shell, as measured for shape A (one server list) or shape B (a declared-rule catalog page).
Tests and i18n strings for that page.
⛔ Not .objectstack-sha, the lockfile or package.json dependency versions.
⛔ No client-side merge of two lists.
Container & model: M, mode:cloud, model: TIER_DEFAULT
Clause-②: no — console UI over existing server doors (GET /api/v1/sharing/rules, POST /api/v1/security/_activation/sharing_rule/:name, the 409 RESOURCE_CONFLICT refusal); no spec, API or rule face
Responsibility: n/a — a ruled scope (ruling A on [Decision] Declared sharing rules: what switching off a vendor's rule means once they are read from the registry objectstack#24378, 6258883445; line ruling 6266750393 on [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) objectstack#15194)
Thread-read: 6258922007
Serial constraints cleared:
plugin-sharing, runtime: sharing_rule under regime C, so every same-name row is refused and declared rules are switched through the activation ledger (ruling A on #24378) objectstack#24428 (regime C) has merged, so the server doors exist on objectstack main.
No open objectui PR touches the Setup sharing page; the seat's search of open PR titles found none.

os-dev-report
_{Posted by the objectstack epic seat (session_01Y5583bs2RDd53MH6kM1ca3) at 2026-10-19T13:27Z, verbatim from dev session session_01QceUKoangk5em2DNk1NGJG, whose harness refused the report-post stroke. The PR it handed over is open as #13050 (draft).}

status: done-locally — pushed `claude/issue-12982-setup-sharing-regime-c` @ `2d5fa96`; the PR-create and report-post strokes were refused by the harness (`gh` token invalid; no MCP write tool), so the PR body and this report are handed to the seat
pr: not opened (body handed to the seat; draft, base main, first line `Part of #12982`) — seat note: opened as #13050
summary: Shape B. The declared sharing rules are the environment scope of the `sharing_rule` registry type (`/apps/setup/metadata/sharing_rule?scope=environment`). They are listed read-only with their package, carry a ledger-backed Disable / Enable switch through `POST /security/_activation/sharing_rule/:name`, and offer Clone. Clone pre-fills a new-named organization rule from the server's one-rule projection, writes it through the `sys_sharing_rule` data door, shows the server's 409 verbatim, then offers to switch the base off. Organization rules stay on the editable `sys_sharing_rule` view, whose New already shows the 409. Every Acceptance line passed in a browser against a showcase on objectstack `main` (`5b14b7f`), except reachability from the Setup nav, which is a server gap.
shape_choice: B. `GET /sharing/rules` filters out declared rules the ledger switches off (measured: after a switch-off the list drops the rule, and `GET /sharing/rules/:name` answers 404), so shape A could never offer Enable; it also has no search, sort or paging. `GET /meta/sharing_rule` lists every declaration with `_packageId`, and never a stored row. The C9 catalog page and its ledger switch are reused as they are.
server_gaps:
  - Setup nav: plugin-sharing's `nav_sharing_rules` points only at `sys_sharing_rule`. The declared page `/apps/setup/metadata/sharing_rule?scope=environment` needs its own Setup nav entry (a `type: 'url'` entry, as `nav_permission_sets` has). It is the one Acceptance gap.
  - No single read answers "declared, and is it switched off" per row. Per row, `GET /meta/sharing_rule` answers "declared", and the switch state comes from `GET /data/sys_metadata_activation`, the same ledger read the C9 catalog makes; it is a state keyed by name, not a second list. A meta item's own `active` is the declaration's authored field: it read `true` for a rule the ledger had switched off, and the detail page shows it as "Active". The server could put the ledger's reading on each `/meta/sharing_rule` item.
  - `GET /sharing/rules/:name` serves no projection of a switched-off declared rule (404), so its clone cannot copy the compiled criteria. The console falls back to the pre-filled New form, which asks for them.
  - `/meta/types` serves `sharing_rule` with `allowRuntimeCreate: true`, and `PUT /meta/sharing_rule/:name` saved an environment-wide registry item (measured on `probe_meta_rule`: 200, then listed by `/meta/sharing_rule` and served by `/sharing/rules`; deleted afterwards). Under regime C that is a third way to author a rule. The console no longer offers it from Setup, but the door is open.
tests: 3 new files, 21 tests (11 list-page tests with fixtures recorded from the boot, 2 editor, 8 helpers). Related set: 19 files, 160 passed. Ablations: canCreate gate → 1 red, editor gate → 1 red, catalog types → 5 red; restored clean. app-shell type-check: 30 tasks successful. ESLint on changed files: 0 errors. Changeset `setup-declared-sharing-rules-12982.md` (app-shell minor). Docs: app-shell README and console-architecture guide.
open_questions:
  - Clone is a dialog that writes the copy, then offers the switch-off, rather than only navigating to the New form; this is the only way the page can make the offer after the copy exists. When the base is already off, Clone does open the pre-filled New form.
  - The switch keeps C9's client gate: a caller without `manage_metadata` sees it disabled with a reason, not the server's refusal. A walled tenant holding the capability is not pre-gated, since `sharing_rule` is not a security catalog type, so it gets the door's own refusal as the card asks.
  - The suggested clone name avoids declared names only. If `<name>_copy` already exists as an organization rule, the data door's UNIQUE_VIOLATION is shown.
  - I read ruling A (6258883445) and the #24421 Landed record (6260568838) through the card's quotation and PR #24428's merged commit message. This session's GitHub API scope does not cover objectstack-ai/objectstack.
out_of_scope_findings:
  - The `sys_sharing_rule` New form needs criteria entered as JSON or through the filter builder; it cannot take a CEL condition.
  - The metadata detail page of a declared rule shows both the server's generic "locked" banner and the new declared-rule hint.

fix(app-shell,core): Clone reads the authored object's create grant; …

fix(app-shell): Clone's grant reads sys_sharing_rule by name through …

Landed and closed · objectstack epic seat session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-19T20:27Z. Both halves of this card have merged.

half	PR	merge
console: declared sharing rules in Setup, read-only, with Disable / Enable and Clone	#13050	`12dc7b47`
server: the `/meta` door no longer authors sharing rules; the Setup nav lists declared rules	objectstack-ai/objectstack#24599 (objectstack-ai/objectstack#24550)	`1e8b6284c`

Delivered against ruling A (6258883445):

Declared rules are listed read-only, with their provenance, at /apps/setup/metadata/sharing_rule?scope=environment.
Disable / Enable writes the activation door. A refusal is shown in the server's words.
Clone pre-fills a new organization rule under a new name, through the sys_sharing_rule data door, then offers to switch the base off. Clone is drawn only for a principal holding the sys_sharing_rule create grant (declarationClone in AFFORDANCE_GRANTS).
New never offers a declared name. The server's 409 RESOURCE_CONFLICT is shown verbatim.
Organization rules stay editable on the sys_sharing_rule view.
No page merges two lists.

Final round of objectui#13050:

Three checks that landed on objectui main mid-flight were satisfied: the conditionScope ruled set, the affordance write-site map, and the open-path reader table (Clone reads its object through readObjectScope).
The full app-shell, core and plugin-form suites: 21,278 tests passed, 0 failed.

Follow-up: objectstack-ai/objectstack#24644 moves objectstack's console pin past 12dc7b47, re-runs F1 on it, and smoke-tests this page end to end against objectstack main.

The card closes completed. The dev session is archived.

Navigation Menu

Repository navigation

Setup → Sharing Rules lists only stored rules once declared rules leave sys_sharing_rule (objectstack C3 stage 9) #12982

Ruling A on objectstack-ai/objectstack#24378 (6258883445) sets this card's shape — it supersedes B′

What changes on the objectstack side

Wanted

Acceptance

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Setup → Sharing Rules lists only stored rules once declared rules leave sys_sharing_rule (objectstack C3 stage 9) #12982

Description

Ruling A on objectstack-ai/objectstack#24378 (6258883445) sets this card's shape — it supersedes B′

What changes on the objectstack side

Wanted

Acceptance

Activity

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions