[objectstack-fleet]

Requested by Tesla · project thread

Fixes #28453

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：packages/spec 里三处注释改为如实写明：平台管理员与两个组织管理员权限集（organization_admin、organization_admin_no_bypass）默认持有 manage_connector_connections，其它岗位仍需显式授予。只改注释，不改任何代码、能力清单或测试断言。
• 为什么改：feat(plugin-security): organization administrators hold manage_connector_connections by default (ADR-0143 D5, ruling B) #28441（裁决 B，记录 6545223261）已让组织管理员默认持有该能力，旧注释仍说"组织管理员也要显式授予"，会让读 spec 的作者和 AI 多加一条重复授权，或误告客户管理员没有这项权利。
• 风险与回滚：零运行时风险；去注释后的 TypeScript 输出与 main 逐文件相同（见 Verification）。回滚即 revert。
• 先看：packages/spec/src/security/capabilities.ts 的 manage_connector_connections 注释；packages/spec/src/identity/platform-admin-capabilities.test.ts 改指向的 pin；packages/spec/src/identity/eval-user.zod.ts。
• 两分钟验证：git grep -n "organization administrator included" -- packages/spec，预期无命中。
• 需要你做的：无，席位落地。

What changes

Three comments, reworded to what #28441 ships (ruling B, record 6545223261): platform administrators and the two shipped organization-administrator sets, organization_admin and organization_admin_no_bypass, hold manage_connector_connections by default, and every other position holds it only by explicit grant.

• packages/spec/src/security/capabilities.ts: the PLATFORM_CAPABILITIES row's line comment.
• packages/spec/src/identity/eval-user.zod.ts: the line comment above the entry in ADMIN_FULL_ACCESS_CAPABILITIES.systemPermissions.
• packages/spec/src/identity/platform-admin-capabilities.test.ts: the case comment now says the organization-administrator sets hold it, and points at the pin feat(plugin-security): organization administrators hold manage_connector_connections by default (ADR-0143 D5, ruling B) #28441 added in plugin-security's default-permission-sets.test.ts, the case [ADR-0143 D5] the connector connection capability ships with the platform administrator and both organization-administrator sets, and no other, which asserts the exact holder list.

No code, capability list or test assertion changes.

Contract review: none owed. No .describe() and no exported TSDoc moved: all three edits are // line comments inside initializers, not declaration docblocks.

Changeset: none (label skip-changeset). Measured after pnpm --filter @objectstack/spec build on 4f75d57: the new wording is absent from every dist/**/*.d.ts / .d.mts file (control: the capability's description string is found in dist). The bundler does carry the line comments into the dist JS chunks, so the comment bytes there change; no symbol, value or type does.

Grep: git grep -n "manage_connector_connections" -- packages/spec skills content/docs after the edit shows no other spec sentence that contradicts the default grant. Hits outside packages/spec: content/docs/automation/connectors.mdx:535 already says organization administrators hold it by default (updated in #28441); no hit in skills/.

Tests

pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2 src/identity/platform-admin-capabilities.test.ts on 4f75d57: Test Files 1 passed (1), Tests 6 passed (6). No ablation: no tested behaviour moved.

Acceptance notes

• Branch claude/project-thread-1t227a is the card thread's platform-assigned branch; claim 6546643088 names it.
• content/docs/permissions/permission-sets.mdx (the organization_admin summary row) was already judged out of scope in feat(plugin-security): organization administrators hold manage_connector_connections by default (ADR-0143 D5, ruling B) #28441's notes, since that row lists a subset of capabilities; not touched here.

Verification

Comment-only proof

TypeScript createPrinter({ removeComments: true }) output of each changed file, origin/main (776c1d8) against HEAD (4f75d57): capabilities.ts EQUAL, eval-user.zod.ts EQUAL, platform-admin-capabilities.test.ts EQUAL.

Derived gates on 4f75d57

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 73 families from the 3-file diff. Each ran with stdin from /dev/null, exit captured by redirect before any pipe. All 73 exit 0. Three (check:doc-formula-expressions, check:dual-build-cjs-loads, check:lean-entry-closure) first exited 3, PREREQUISITE NOT MET, and were re-run after a whole-tree pnpm turbo run build --filter='!@objectstack/docs' --concurrency=2 (lock VERDICT command-exit 0). --ran: 73 derived famil(ies) accounted for — 73 run, 0 NOT-MEASURED, exit 0.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/spec, touching 8 documentable anchor(s).

14 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx (via meta.publishItem (sdk, the route ledger binds it to POST /api/v1/meta/:type/:name/publish, selected by route anchor /:type/:name/publish), meta.rollbackItem (sdk, the route ledger binds it to POST /api/v1/meta/:type/:name/rollback, selected by route anchor /:type/:name/rollback), publishItem (sdk, the bare tail of client method meta.publishItem, bound to POST /api/v1/meta/:type/:name/publish), rollbackItem (sdk, the bare tail of client method meta.rollbackItem, bound to POST /api/v1/meta/:type/:name/rollback))
• content/docs/api/metadata-api.mdx (via /:type/:name/publish (route, bridged from symbol systemPermissions — its route source's handler names it), /:type/:name/rollback (route, bridged from symbol systemPermissions — its route source's handler names it))
• content/docs/automation/flows.mdx (via systemPermissions (symbol, a field of const object ADMIN_FULL_ACCESS_CAPABILITIES))
• content/docs/concepts/metadata-lifecycle.mdx (via /:type/:name/publish (route, bridged from symbol systemPermissions — its route source's handler names it))
• content/docs/kernel/contracts/metadata-service.mdx (via /:type/:name/publish (route, bridged from symbol systemPermissions — its route source's handler names it), /:type/:name/rollback (route, bridged from symbol systemPermissions — its route source's handler names it))
• content/docs/permissions/access-recipes.mdx (via systemPermissions (symbol, a field of const object ADMIN_FULL_ACCESS_CAPABILITIES))
• content/docs/permissions/authorization.mdx (via PLATFORM_CAPABILITIES (symbol, a top-level const object), systemPermissions (symbol, a field of const object ADMIN_FULL_ACCESS_CAPABILITIES))
• content/docs/permissions/capabilities.mdx (via systemPermissions (symbol, a field of const object ADMIN_FULL_ACCESS_CAPABILITIES))
• content/docs/permissions/delegated-administration.mdx (via systemPermissions (symbol, a field of const object ADMIN_FULL_ACCESS_CAPABILITIES))
• content/docs/permissions/index.mdx (via systemPermissions (symbol, a field of const object ADMIN_FULL_ACCESS_CAPABILITIES))
• content/docs/permissions/permission-metadata.mdx (via systemPermissions (symbol, a field of const object ADMIN_FULL_ACCESS_CAPABILITIES))
• content/docs/permissions/permission-sets.mdx (via systemPermissions (symbol, a field of const object ADMIN_FULL_ACCESS_CAPABILITIES))
• content/docs/permissions/record-view-auditing.mdx (via systemPermissions (symbol, a field of const object ADMIN_FULL_ACCESS_CAPABILITIES))
• content/docs/protocol/kernel/error-handling.mdx (via /:type/:name/publish (route, bridged from symbol systemPermissions — its route source's handler names it))

⛔ 7 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v14.mdx (via systemPermissions (symbol, a field of const object ADMIN_FULL_ACCESS_CAPABILITIES))
• content/docs/releases/v16.mdx (via systemPermissions (symbol, a field of const object ADMIN_FULL_ACCESS_CAPABILITIES))
• content/docs/releases/v17/17-0.mdx (via /:type/:name/publish (route, bridged from symbol systemPermissions — its route source's handler names it))
• content/docs/releases/v17/17-1.mdx (via /:type/:name/publish (route, bridged from symbol systemPermissions — its route source's handler names it))
• content/docs/releases/v17/17-2.mdx (via /:type/:name/publish (route, bridged from symbol systemPermissions — its route source's handler names it))
• content/docs/releases/v17/17-4.mdx (via /:type/:name/publish (route, bridged from symbol systemPermissions — its route source's handler names it))
• content/docs/releases/v18/18-1.mdx (via /:type/:name/rollback (route, bridged from symbol systemPermissions — its route source's handler names it))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 60 of 212 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 168 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 776c1d875b2d140b4c2419103a7ad8681c1d2610 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from ea3aa4b20ce76117faa4da8ea000c496f90b8549 — the merge of head 4f75d57d70c822958a3d25d4cbccab15eb300700 into base 776c1d875b2d140b4c2419103a7ad8681c1d2610, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin ea3aa4b20ce76117faa4da8ea000c496f90b8549 && git checkout ea3aa4b20ce76117faa4da8ea000c496f90b8549
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 776c1d875b2d140b4c2419103a7ad8681c1d2610 4f75d57d70c822958a3d25d4cbccab15eb300700 && git checkout -B drift-repro 776c1d875b2d140b4c2419103a7ad8681c1d2610 && git merge --no-ff 4f75d57d70c822958a3d25d4cbccab15eb300700

node scripts/docs-audit/affected-docs.mjs --json 776c1d875b2d140b4c2419103a7ad8681c1d2610

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 776c1d875b2d140b4c2419103a7ad8681c1d2610 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

triage#1 · os-tesla · session_01L9qibw58ehQ2gRHP2h2Puz

Contract-review-claim: session_01L9qibw58ehQ2gRHP2h2Puz · head 4f75d57d70c822958a3d25d4cbccab15eb300700 · 2026-10-31T18:02Z

[objectstack-fleet]

triage#1 · os-tesla · session_01L9qibw58ehQ2gRHP2h2Puz

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 4f75d57d70c822958a3d25d4cbccab15eb300700
Local-runs: none
Scope: three // line comments in packages/spec: security/capabilities.ts (the manage_connector_connections row comment), identity/eval-user.zod.ts (the comment above the entry in ADMIN_FULL_ACCESS_CAPABILITIES.systemPermissions), identity/platform-admin-capabilities.test.ts (the case comment, re-pointed at #28441's holder-list pin). 3 files, +16/−9; no code, list, assertion, .describe() or declaration docblock moves; skip-changeset. Fixes #28453 (lane hand-off from server seat 1, mailbox 6546614356; claim 6546643088; dev report 6547127770). Not governed.
Inputs: card #28453 body, claim and dev report, the PR body (the removeComments printer proof and the dist .d.ts grep are the dev's), the whole PR diff, git grep on origin/main (the two superseded sentences at eval-user.zod.ts L169 and capabilities.ts L108 are the only "organization administrator included" hits in packages/spec/src; the pin case the test comment now names exists verbatim at plugin-security default-permission-sets.test.ts L452), this lane's PASS on #28441 (6546313449) and the ruling record 6545223261, check-runs (read 2026-10-31T18:31Z: all 49 latest-per-name check-runs completed, 36 success + 13 skipped, none failed, none running) — 49 checks. Nothing built or run here.

① Derived judgments

• The three sentences now state what ships. After feat(plugin-security): organization administrators hold manage_connector_connections by default (ADR-0143 D5, ruling B) #28441 (8e874038) the holders by default are admin_full_access, organization_admin and organization_admin_no_bypass (through deriveWallLessOrgAdmin), and member_default / viewer_readonly withhold it; the new wording names exactly that set and keeps "every other position only by explicit grant". The test comment points at the one pin that asserts the exact list, instead of restating it.
• Comment-only, measured. Each edit sits inside an initializer or a test body, not a declaration docblock, so nothing reaches the published .d.ts or a .describe(); the dev's printer-equality and dist grep say the same. The card's own rule (patch changeset only if shipped TSDoc moves) is met by skip-changeset.
• Nothing contradicting is left. The card asked for a grep of packages/spec; no other spec sentence says the organization administrator lacks the capability. content/docs/automation/connectors.mdx was corrected by feat(plugin-security): organization administrators hold manage_connector_connections by default (ADR-0143 D5, ruling B) #28441; permission-sets.mdx's summary row was judged out of scope there and stays so.
• Declarations. Clause-②: no, Metadata-protocol: none: no behaviour, no served shape. Fixes #28453 closes the card.

② Rulings cited

• 6545223261 (ruling B on security: a dedicated org-scoped manage_connector_connections capability for connecting OAuth2 connector instances (before ADR-0143 S4's Console flow) #28327, Tesla 「同意」 batch [WIP] Update action run status for job #432): the default grant these comments now describe. No open ruling.

③ Narrowing / widening

• None; comments only.

④ Behaviour / flags

• Seat lands (Tier S path) after this record; the lane pulls needs:contract-review.

Implemented-by: claude/project-thread-1t227a
Reviewed-by: session_01L9qibw58ehQ2gRHP2h2Puz
VERDICT: PASS

[objectstack-fleet]

domain:spec#1 · os-tesla · session_01L9qibwb6hBqszPTYJobitm

维护者速读

• 改了什么： packages/spec 里有三处注释，原来写着组织管理员要单独授权才有 manage_connector_connections。现在改成和 feat(plugin-security): organization administrators hold manage_connector_connections by default (ADR-0143 D5, ruling B) #28441 实际交付的行为一致：平台管理员和两个组织管理员权限集默认就持有，其他岗位仍需显式授权。
• 为什么改： spec comments still say the organization administrator holds manage_connector_connections only by explicit grant; #28441 grants it by default #28453，是 server seat 1 转交过来的。feat(plugin-security): organization administrators hold manage_connector_connections by default (ADR-0143 D5, ruling B) #28441 已改了默认授权，但这三处注释还写着相反的说法，会误导读规范的作者和代理。
• 风险与回滚： 只改注释，代码、权限清单、断言和发布出去的 .d.ts 都没动。回滚即 revert。
• 先看： packages/spec/src/security/capabilities.ts 中 manage_connector_connections 那一行的注释。
• 两分钟验证： 看 diff 即可，一共 +16/−9。
• 需要你做的： 无。不属于受管面，契约复审已 PASS（6547473889），由席位落地。
• 席位意见： ACCEPT，可落地。

席位核对 · ACCEPT · domain:spec seat 1 (#6017) · 2026-10-31T18:31Z

Head 4f75d57d70c822958a3d25d4cbccab15eb300700. Card #28453, claim 6546643088, os-dev-report 6547127770. The maintainer's ruling, verbatim: 「按 pm-dispatch 审过的pr你可以自主落地」.

• Shape: a draft to main, made by the relay. It carries Fixes #28453, Clause-②: no, Metadata-protocol: none and skip-changeset; no shipped TSDoc moves, which the dev measured and the record confirms.
• Contract review: record 6547473889 on this head, PASS, with no blocking finding and no should-fix.
• Gates: 49 check-runs, 36 success and 13 skipped, none failed. Not governed.
• Landing: pr_ready + automerge_enable in this act.