Repository navigation
[Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900
Description
director#1 · os-bill · session_01Utp6CbQLcy8yg6vhJVXXi8
Ruled: 6523087116 · letter A+ (declarations written now; no automatic check) · 2026-10-30T12:41Z
Ruling-ref: 6523087116
Blocked-by: #27681
Filing gate ②: the maintainer, in the director summon right after ruling #27681 B (2026-10-30), verbatim: 「但是对于系统内核对象，是否应该统一评估一下。」 — one assessment of every system kernel object's actions instead of per-action rulings. This card is that assessment and the execution of #27681 ruling 6513869839's parameter 2. Filed by the director seat (summon #54 continuation 1, ledger objectstack#12708). ⛔ Not a claim. No domain:*: triage sets it (domain:server expected; the declarations live in packages/platform-objects).
维护者速读
- 范围： 全仓声明了动作的
sys_*内核对象只有 12 个，全在packages/platform-objects/src/identity/，共 58 个具名动作（审批、队列、作业、通知等sys_*对象今天不声明动作）。它们全是type: 'api'，今天没有一个声明ai:块，即对 agent 全部不暴露；mcp: run_action refuses every action on a sys_* object, so an agent cannot reach the identity actions (ban_user, impersonate_user, set_user_password) that REST POST /actions serves #27681 裁 B 后机制打开，但每个动作仍要作者声明才可达。 - 本卡问什么： 一次裁清 58 个动作各属哪一档，之后作者按档声明，不再逐动作上决策箱。
- 三档： H 人工专属（铸造凭据或会话、改变所有权与登录因子、销毁账号或组织；不得声明
ai.exposed，除非您点名）；C 可暴露但必须人工确认（破坏性生命周期动作：封禁、吊销、移除、禁用；ai.requiresConfirmation不得为 false）；E 可凭普通声明暴露（加法类：邀请、添加、创建团队、启用、改自己的资料）。 - 席位初判： H 19 个 · C 17 个 · E 22 个，逐条见下表。裁定后零个动作当天变化：暴露仍由作者在各动作上写
ai: { exposed: true, description }时才发生。 - 请回：
A / B / C，席位推荐 A。
Governing text
- mcp: run_action refuses every action on a sys_* object, so an agent cannot reach the identity actions (ban_user, impersonate_user, set_user_password) that REST POST /actions serves #27681 ruling 6513869839 (letter B; parameter 2: credential- or session-minting actions never declared exposed without a ruling naming the action;
ai.requiresConfirmationneverfalseon them). This card replaces "one ruling per action" with one ruling per bucket, as the maintainer asked. - ADR-0011: exposure opt-in, default off;
ai.descriptionrequired; confirmation parity (ai.requiresConfirmation, default on for destructive-looking actions); permission parity. - ADR-0066 D4 as amended 2026-10-29 (6499781492): one gate, two surfaces; the design goal 「agent 和人类使用同一套系统」.
- ADR-0126: the packaged-action activation switch is the operator's layer and is unchanged by this card.
Protocol statement. Metadata-protocol: none — no key is added; the card assigns values an author may write to an existing key (ai.exposed, ai.requiresConfirmation) on platform-owned actions. Clause-②: no.
Premises (read at origin/main ded67bfb)
- The population: 12 objects, 58 named actions, all
type: 'api', 0 with anai:block. Re-check:git grep -l -E "^\s+actions:\s*\[" origin/main -- 'packages/**/*.object.ts'→ the 12 identity files;git grep -c -E "^\s+ai:\s*\{" origin/main -- 'packages/platform-objects/src/identity/*.object.ts'→ 0. - No non-identity
sys_*object declares actions. Re-check: the same grep overpackages/plugins/plugin-approvals/src/**/*.object.tsandpackages/platform-objects/src/audit/*.object.ts→ 0 files. - Confirmation today is a
confirmTexton 20 of the 58 (the console dialog), not the ADR-0011ai.requiresConfirmationkey; the HITL path for MCP is the dev's first measurement under mcp: run_action refuses every action on a sys_* object, so an agent cannot reach the identity actions (ban_user, impersonate_user, set_user_password) that REST POST /actions serves #27681 B.
The rubric
| Bucket | Test | What an author may write |
|---|---|---|
| H human-only | the action mints a credential or a session, changes who owns or who can log in, or destroys an account / organization | no ai.exposed without a maintainer ruling naming the action |
| C confirm | destructive or privilege-changing lifecycle act that is reversible or bounded (ban, revoke, remove, disable, leave) | ai.exposed: true allowed with ai.description; ai.requiresConfirmation must stay true |
| E eligible | additive or self-scoped act with no credential and no privilege escalation | ai.exposed: true allowed with ai.description; confirmation at the author's choice |
The assessment (58 actions)
H — human-only (19): sys_user.impersonate_user · sys_user.set_user_password · sys_user.create_user (creates a login, optional password) · sys_user.delete_my_account · sys_user.change_my_password · sys_user.change_my_email · sys_user.disable_two_factor · sys_user.generate_backup_codes · sys_two_factor.disable_two_factor · sys_two_factor.regenerate_backup_codes · sys_api_key.create_api_key · sys_api_key.restore_api_key · sys_oauth_application.create_oauth_application · sys_oauth_application.rotate_client_secret · sys_sso_provider.register_sso_provider · sys_sso_provider.register_saml_provider · sys_sso_provider.verify_domain · sys_member.transfer_ownership · sys_member.update_member_role · sys_organization.delete_organization. (The last two role / ownership acts are privilege escalation, not lifecycle.)
C — exposable with confirmation (17): sys_user.ban_user · sys_user.unban_user · sys_user.unlock_user · sys_user.set_user_manager · sys_api_key.revoke_api_key · sys_session.revoke_session · sys_session.revoke_my_other_sessions · sys_invitation.cancel_invitation · sys_invitation.reject_invitation · sys_member.remove_member · sys_team_member.remove_team_member · sys_team.remove_team · sys_oauth_application.disable_oauth_application · sys_oauth_application.delete_oauth_application · sys_sso_provider.delete_sso_provider · sys_organization.leave_organization · sys_account.unlink_account.
E — eligible by plain declaration (22): sys_user.invite_user · sys_invitation.invite_user · sys_organization.invite_user · sys_member.invite_user (text mirror) · sys_invitation.resend_invitation · sys_invitation.accept_invitation · sys_member.add_member · sys_team_member.add_team_member · sys_team.add_team_member · sys_team.create_team · sys_team.update_team · sys_organization.create_organization · sys_organization.update_organization · sys_organization.rename_organization · sys_organization.set_active_organization · sys_oauth_application.enable_oauth_application · sys_user.enable_two_factor · sys_two_factor.enable_two_factor · sys_user.update_my_profile · sys_user.resend_verification_email · sys_sso_provider.request_domain_verification.
(Count: 19 + 17 + 22 = 58. Two spread entries in sys_user's array carry no own name and are not actions.)
Options
| What it does | What the team sees | Workload | |
|---|---|---|---|
| A adopt the table | The three buckets and the 58 assignments become the standing policy, recorded as a dated note under ADR-0011 (governed, Tier H) and pinned by one test in packages/platform-objects that refuses ai.exposed on an H action and ai.requiresConfirmation: false on a C action. Declarations for E / C actions land on pull, each with its ai.description. |
One ruling, no per-action rounds; an AI author who declares exposure on an H action is refused at test time, loudly. Day one: no exposure changes. | server · 1 PR (ADR note + pin test) · S · the declarations later, per pull |
| B everything human-only now | All 58 stay unexposed; the table is recorded for a later re-assessment on pull. | Agents reach no sys_* action until a second ruling. |
docs · XS |
| C E only | Only the 22 E actions become eligible; C and H both human-only. | Revocation / ban / remove stay click-only for agents. | server · 1 PR · S |
业务含义直译：A 是「钥匙柜分三格：机器人永远不碰的、要人点头才能碰的、可以自己拿的，一次贴好标签」；B 是「柜子先全锁，以后再说」；C 是「只开最轻的那一格」。
四维分析
- ① 项目长远合理性（领起）。 两年后 agent 替管理员做日常运维（吊销被盗会话、移除离职成员、取消过期邀请）是主流形态（Agentforce、Entra Agent ID、ServiceNow Now Assist 都按能力逐项启用），而铸造凭据与改变所有权永远留给人。一张按风险分档的表，比逐动作上决策箱更稳：规则写一次，作者按表声明，评审只看档位对不对。B 把问题推迟到每一次拉动；C 把可逆的破坏性动作一刀切成人工专属，与「同一系统」目标只兑现一半。
- ② 实际业务拉动。 板上无客户点名；拉动是您的设计目标与 fix(runtime)!: a same-origin
type: 'api'action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649 已开放的 REST 身份动作。A 落地当天零暴露变化，所以不是投机扩张，是把边界写清。 - ③ 防 AI 犯错。 风险集中在 H 档：被注入的指令若能让 agent 模拟登录或设密码，即账号接管。A 用 pin 测试在作者写下
ai.exposed的那一刻响亮拒绝，而不是靠评审记得；C 档强制 HITL 确认，agent 的每个破坏性调用都要有人点头。 - ④ 创业阶段不扩散。 不加键、不加部署开关；新增的是一条 ADR 注记和一个 pin 测试（测试，不是 CI 门禁的新零件；若您不要测试，划掉即可，表仍成立）。
os-decision-facets
① 长远：按风险分三档一次写清，作者按表声明，评审只看档位；比逐动作裁更稳
② 拉动：设计目标 + REST 已开放的身份动作；A 当天零暴露变化
③ 防错：H 档在声明处被 pin 响亮拒绝；C 档强制人工确认
④ 不扩散：不加键不加开关；一条 ADR 注记 + 一个 pin 测试
Prior rulings read: sys_, ai.exposed, impersonate, ban_user, MCP → #27681 B (6513869839), ADR-0011, ADR-0066 D4 amended (6499781492), ADR-0126; thread: none; repo: objectstack-ai/objectstack
Recommendation
A. 只看①选 A；②③④ 是否翻转：否。Not B: it re-opens the per-action round the maintainer asked to avoid. Not C: it leaves half the design goal unmet for acts that are reversible and already confirmed in the console. Confidence gaps: the bucket of four self-scoped acts (change_my_password, change_my_email, delete_my_account, update_my_profile) was placed by their credential effect, not by a measured agent use case — the maintainer may move any row with one word; whether ai.requiresConfirmation's HITL path reaches MCP end to end is #27681 B's first measurement, and this card's C bucket depends on it.
After the ruling
- A: the server lane files nothing new — this card is the execution card:
needs-user-decision→pm:queue; one PR adds the dated ADR-0011 note (Tier H) and the pin test; E / C declarations arrive on pull as ordinary cards citing this ruling. - B: record the table in the ADR note only; close this card
completed. - C: as A with the C bucket folded into H.
Related
#27681 (ruling 6513869839) · #27506 · #27649 · ADR-0011 · ADR-0066 · ADR-0126 · packages/platform-objects/src/identity/*.object.ts · packages/mcp/src/mcp-http-tools.ts · packages/runtime/src/action-execution.ts
Dedupe
Open needs-user-decision box read 2026-10-30T03:00Z: #27681 (the mechanism, ruled B), #27401 (connector tool pins), #27884, #27881 — none assesses the sys_* action set. #27506 / #27649 (the REST door) do not classify actions.
Activity
objectstack-fleet commentedon Oct 30, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: 真挡得住的权限 | none | P②
Triage: p1 ·
domain:server·area:automation· decision · 2026-10-30T03:57Z⛔ Not a claim. This is the maintainer's ruling: it executes #27681 B parameter 2 as one ruling per bucket, as the maintainer asked. The declarations live in
packages/platform-objects, sodomain:server.Ruled:line appears.Generated by Claude Code
objectstack-fleet commentedon Oct 30, 2026
director#1 · os-bill · session_01Utp6CbQLcy8yg6vhJVXXi8
Ruling: batch #430 item 2 · letter A+ · maintainer 「所以我说评估标准对象的意思，就是允许放开的动作，是不是就应该把申明加上」 2026-10-30T12:40Z
Director seat, summon #54 continuation 1 (ledger objectstack#12708, opening mark 6493929869). In the summon chat the maintainer first asked what A would build (「从业务的角度给我具体解释你要开发什么」), struck the pin test (「自动检查 有必要吗？每一个元数据应用都有类似的问题，后续都要检查吗」 — the seat agreed: a repo-local test guards nothing in customer apps; the platform's own mechanisms are the per-action opt-in, the default confirmation and the ADR-0126 activation switch), then settled the shape, verbatim: 「所以我说评估标准对象的意思，就是允许放开的动作，是不是就应该把申明加上」. The seat reads that as A+ and records it so; the maintainer corrects with one word if the reading is wrong.
What the ruling binds (letter A+): the three-bucket assessment of the 58
sys_*actions in this card's body stands, and the declarations are written now, in one PR:ai: { exposed: true, description: … }(a description written for the model, ≥ 40 chars per ADR-0011); confirmation at the author's choice.ai: { exposed: true, description: …, requiresConfirmation: true }; the confirmation is never relaxed.aiblock; the dated note under ADR-0011 records the list and the rule: noai.exposedon these without a maintainer ruling naming the action.packages/platform-objects/src/identity/**read it. Customer apps govern their own actions with the same metadata key and the platform's defaults (opt-in, default confirmation, the ADR-0126 switch); the platform checks nothing per app.Not taken: A (table only, no declarations), B (all human-only), C (E only).
Governing text: ADR-0011 (opt-in,
ai.description, confirmation parity); ADR-0066 D4 as amended (one gate, two surfaces); #27681 ruling 6513869839 with amendment 6513938013 (parameter 2 executed here); ADR-0126 (the operator's switch, unchanged).Workload of the letter:
domain:server· 1 PR · M (39aiblocks with model-facing descriptions across the 12 identity object files; the ADR-0011 dated note —docs/adr/**, Tier H, so the PR is Tier H and waits for an authorised approval after contract review; one dogfood case per bucket over MCP: an E action listed and run, a C action refused until confirmed, an H action absent from the listing) ·Clause-②: no,Metadata-protocol: none(values on an existing key, platform-owned metadata) · precedent: none for a platform-wide declaration pass.Execution:
needs-user-decision→pm:blockedin this act,Blocked-by: #27681(the door mechanism; the declarations are inert until both guards yield to the flag, and the dogfood cases need the door),domain:server,priority:p1(inherited from #27681 / #27506). When #27681 closes, the unlock scan returns this card topm:queueand the server lane dispatches withRuling-ref:naming this comment.os-decision-facets
① 长远：评估结果直接落为元数据声明，门一通 AI 助手当天可用；H 档只靠 ADR 注记与评审，平台不逐应用检查
② 拉动：维护者设计目标；39 个动作一次声明到位，不再逐卡
③ 防错：C 档写死确认；H 档零声明；客户应用靠平台默认关闭与默认确认
④ 不扩散：不加键、不加门禁、不加检查；只写既有键的值
objectstack-fleet commentedon Oct 30, 2026
domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS
Note for whichever PR carries this card's
sys_*declarations. It comes from the contract review of PR #28119 (#27694 / #27956), should-fix 1. ⛔ Not a claim.PR #28119 adds a dated note (2026-10-30) under ADR-0066 D4's 2026-10-29 amendment. The note records that PR #27940 closed the
sys_*MCP gap: an action on asys_*object is listed and run over MCP only when the action itself declaresai.exposed: true, and the stored-metadata family is refused before the flag is read. Atbc496bf7d, zero platformsys_*actions declare anaiblock (ruling parameter 2, amendment 6513938013). So the mechanism exists, but no identity action is reachable over MCP yet.When this card's declarations land, the carrier PR should keep ADR-0011's dated note and ADR-0066 D4's 2026-10-30 note consistent. It can point one at the other, or add a clause recording which
sys_*actions now declareai.exposed: true. Then the mechanism sentence is not read as "identity actions reachable over MCP from day one".objectstack-fleet commentedon Oct 30, 2026
domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia
Unblocked · 2026-10-30T21:22Z
Blocker #27681 closed at 2026-10-30T10:36Z (PR #27940). The maintainer ruled A+ (Ruling-ref 6523087116).
pm:blocked→pm:queue. ⛔ Not a claim.Ruling-ref: 6523087116 (letter A+: declarations for buckets E and C, H human-only, the ADR-0011 dated note, no automatic check; Tier H because of
docs/adr/**)Dispatch note (carried into any claim):
type: 'api'with identity (better-auth) targets. Measured onmain(runtime(mcp): an OAuth-token agent's api action forward carries a bearer the target door does not accept (acceptOAuthAccessToken matches /mcp paths only), so the target likely resolves the caller as anonymous #28178, runtime: an api action that forwards to an identity (better-auth) route fails for an API-key caller, and nothing pins it #28217): such a target accepts a signed-in session only, so an OAuth agent's or an API-key caller's run of one does not reach it. An API-key caller is now refused by name before the forward (runtime: an api action that forwards to an identity (better-auth) route fails for an API-key caller, and nothing pins it #28217, PR fix(runtime): an API-key caller of an api action whose target is an identity route is refused by name, before the forward #28263).mainat the time.objectstack-fleet commentedon Oct 30, 2026
domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia
Claim: PM loop round 2 · 2026-10-30T21:25Z
Session:
session_016WV4czk9umSFBVoz5cijzX(card thread; seatsession_016WV4czuTWNgKR22fKv7jia)Account:
os-elon-muskBranch:
claude/project-thread-qkb7g0(the card thread's platform-assigned branch — the recorded platform exception; amended by the seat when the thread reported it)Worktree:
objectstack-issue-27900Domain:
domain:serverSeat:
domain:server#3File surface: the 12 identity object files under
packages/platform-objects/src/identity/(aiblocks on the 39 E and C actions only; H actions untouched),docs/adr/0011-actions-as-ai-tools.md(the dated note: the three-bucket table and the H rule), the MCP dogfood (one case per bucket),.changeset/*. No new key, gate or check (ruling: values on an existing key). Amended from the thread (test-only, no runtime code):packages/runtime/src/action-execution-destructive.test.tsandpackages/platform-objects/src/identity/action-confirm-one-dialog.test.ts(both pinned "no platform identity action declares ai"), and one bullet incontent/docs/ai/connect-mcp.mdx(Skills-docs).Container & model:
M,mode:thread,model: opus (TIER_DEFAULT),effort: xhigh(p1)Clause-②: no (ruling 6523087116: values on an existing key, platform-owned metadata)
Metadata-protocol: none
Responsibility: the ruled A+ declarations: E actions exposed with a model-facing description, C actions exposed with confirmation required, H actions with no
aiblock, the table recorded only as the ADR-0011 dated note.Thread-read: 6533749995
Ruling-ref: 6523087116 (letter A+)
Premise: blocker #27681 closed 2026-10-30 10:36Z (PR #27940); the dev re-reads the 58 actions and the door on
main@916531a8first and stops on any drift from the card's table.Serial constraints cleared: no open PR touches
packages/platform-objects/src/identity/or ADR-0011 (checked against the open PR list).Dispatch-note: p1, Tier H (
docs/adr/**):CONTRACT_REVIEW_TIERreview, then an authorised approval (GOVERNED_APPROVER) before the queue. The E-action MCP run is driven by an OAuth agent; ⛔ no widening of which credentials an identity route or the REST face accepts (pending #28178 ruling). Claimed with the coordinator's go under the project-wide cap of 10 (2026-10-30 21:24Z).objectstack-fleet commentedon Oct 30, 2026
domain:server#3 · os-elon-musk · session_016WV4czk9umSFBVoz5cijzX
os-dev-report
{ "issue": 27900, "status": "done", "branch": "claude/project-thread-qkb7g0", "pr": "https://github.com/objectstack-ai/objectstack/pull/28270", "session": "session_016WV4czk9umSFBVoz5cijzX", "premise_still_valid": true, "summary": "Ruling 6523087116 (A+) executed: 38 ai blocks on the identity actions (E 21 with ai.exposed + a model-facing description; C 17 also requiresConfirmation: true), H 20 untouched, the ADR-0011 2026-10-30 addendum with the three name lists and the H rule, one bullet in content/docs/ai/connect-mcp.mdx, a platform-objects patch changeset. Premise re-read on main: all 58 named actions exist unchanged; two differences reported to the seat before code and ruled there: sys_invitation.copy_invitation_link (added after the assessment, not in the table) keeps no ai block and the addendum names it not assessed; the card's headers (H 19, E 22) disagree with its name lists (H 20, E 21), so 38 blocks, not 39. The MCP dogfood is rewritten to read the platform declarations and drive one action per bucket with a real OAuth-connected agent; the E run is answered 401 at the identity route today and is pinned as such, waiting on #28178 (no credential boundary touched). Two tests whose premise was 'no platform identity action declares ai' follow the declarations (test-only; seat amended the surface).", "tests": "mcp-system-object-action-exposure.dogfood.test.ts 11/11 at head 0bd14911 (with api-action-door-forward + two-factor-backup-code-reveal: 3 files 25/25). OAuth agent: update_my_profile (E) listed aiExposed/requiresConfirmation false, run -> 401 UNAUTHORIZED from /api/v1/auth/update-user, name unchanged; admin session same run -> ok:true, name changed; ban_user (C) unconfirmed -> 428 ACTION_CONFIRMATION_REQUIRED, confirmed -> 401 UNAUTHENTICATED 'Sign in first', nobody banned; impersonate_user (H) absent from listing, refused by name. Ablation (WIP-committed, platform-objects dist rebuilt): ban_user requiresConfirmation removed + ai block on impersonate_user, premise checks removed -> 8/11 red (5 direct, 3 cascades); restored + rebuilt -> 11/11. platform-objects suite 104 files 1474/1474; runtime suite 490 files 8854 passed 19 skipped (action-execution-destructive.test.ts 57/57); mcp suite 47 files 603/603. Typecheck: platform-objects and runtime exit 0; dogfood tsc --noEmit (8 GB heap) exit 0.", "gates": "pnpm build 115/115 exit 0; dispatch-gates --commands --changed derived 94; all 94 ran and exited 0 (check-plugin-teardown-shape.mjs --self-test exited 3 first on the shallow clone's missing pinned fixture commit 621a4876, exit 0 after fetching it); dispatch-gates --ran: 94 run, 0 NOT-MEASURED, exit 0. pnpm lint exit 0. CI on the PR: pending at report time.", "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm", "mcp_calls": "4 — mcp__github__issue_read (get, get_comments) on #27900, mcp__github__pull_request_read (get) on #28263 and #28270; no write tool", "api_writes": "2 — fleet-write relay pr_create (POST /repos/objectstack-ai/objectstack/dispatches -> PR #28270), this comment via post-stamped (relay comment op)", "open_questions": [ { "question": "Should sys_user.enable_two_factor and sys_two_factor.enable_two_factor stay in bucket E? Both take the user's current password and answer the TOTP URI and one-time backup codes.", "options": ["A keep E as the card lists them", "B move both to H: remove two ai blocks and one ADR line"], "recommendation": "seat has taken it to the maintainer; landed as A meanwhile" }, { "question": "Which bucket for sys_invitation.copy_invitation_link (added after the assessment; answers the invitation accept URL, a bearer credential)?", "options": ["A H (no ai block, today's state)", "B C"], "recommendation": "A, by the rubric's credential test; seat has taken it to the maintainer" } ], "out_of_scope_findings": [ "class: none (premise miss, not a defect) · sys_approval_request (plugin-approvals) declares 9 actions, none ai-exposed; the card's premise 2 said no non-identity sys_* object declares actions, already false at ded67bfb · carrier: seat 3 (taking it to the maintainer) · noted, not filed" ] }