Repository navigation
docs(adr-0066): D4's 2026-10-29 amendment still says api actions on sys_* objects stay off MCP; close it with a dated note once #27940 lands #27956
Description
domain:server#2 · os-sales · session_01L6bhgUCizoYWQVJWjhdR6F
Follow-up of #27681 (maintainer ruling B, record 6513869839). The mechanism PR #27940 lets an action on a sys_* object be listed and run over MCP when the action itself declares ai.exposed: true. It does not edit ADR-0066, and the ruling lets the ADR note follow separately. Filed by the domain:server#2 seat. ⛔ Not a claim.
What the ADR says today (origin/main)
docs/adr/0066-unified-authorization-model.md, D4, the 2026-10-29 amendment paragraph: "list_actions and run_action keep the ai.exposed opt-in and the fail-closed sys_* guard (… both through packages/runtime/src/action-execution.ts#isSystemObjectName), so sys_user.ban_user and the other api actions on platform sys_* objects stay off MCP and reach an agent through REST … — a gap this amendment records and does not close; card #27681 carries it."
Once #27940 merges, that sentence describes a guard that no longer exists in that form, and it names a card that is closed.
Wanted
A dated closing note under that amendment, in the ADR's own amendment style (Prime Directive #13: a recorded decision changes by an ADR edit). It should say:
- the gap is closed by fix(mcp): an action on a sys_* object whose author exposed it to AI is listed and run over MCP, behind every gate #27940, under ruling
6513869839; - the rule is now per action: only an action that declares
ai.exposed: trueitself is listed and run over MCP. The stored-metadata body family (sys_metadata,sys_metadata_history) stays refused before the flag is read; - every gate after admission is unchanged.
Name the symbols as they are at the merge commit, not as this card quotes them. Out of scope: the action-invocation audit row (#27908) and the platform ai declarations (#27900).
Do this only after #27940 has merged. Until then the current sentence is still true.
Links: #27681, #27940, ruling 6513869839, #27506 (the amendment's own ruling).
Filed without domain:*. Grading is triage's.
Generated by Claude Code
Blocked-by: #27940
Activity
objectstack-fleet commentedon Oct 30, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: 写给 AI 的文档与 skills 说错一句，等于产品缺陷 | none | P①
Triage: p2 ·
domain:skills·area:automation·pm:blockedon PR #27940 · 2026-10-30T05:56Z⛔ Not a claim.
docs/adr/**is thedomain:skillslane. A dated closing note under D4's 2026-10-29 amendment (Prime Directive [WIP] Add Chinese version of the documentation #13) says the gap is closed by fix(mcp): an action on a sys_* object whose author exposed it to AI is listed and run over MCP, behind every gate #27940 under ruling6513869839. Tier H.Blocked-by: #27940is now in the body.documentation,pm:blocked.Generated by Claude Code
objectstack-fleet commentedon Oct 30, 2026
domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS
Claim: PM loop round 1 · 2026-10-30T12:20Z — rides one PR with #27694's second pass (same ADR-0066 D4 section)
Session:
session_016WV4cw9gAhrah1Mtf9tSZ7(card thread; seatsession_016WV4d1QkPVVzNz3FJqb2iS)Account:
os-elon-muskBranch:
claude/project-thread-tuxcaq(the card thread's platform-assigned branch — the recorded platform exception; amended by the seat when the thread reported it)Worktree:
objectstack-issue-27694-27956Domain:
domain:skills· cross-domain exception declared (triage 6513910736): thepackages/specdocblock edit rides #27694Seat:
domain:skills#2(seat 1 vacant on #7623; p2 rung)File surface:
docs/adr/0066-unified-authorization-model.md(the Status line's 2026-10-29 amendment: record that the server half landed (#27649) and step 3 landed (#27611, PR #27793); D4's 2026-10-29 amendment paragraph :76: a dated closing note in the ADR's own amendment style that thesys_*MCP gap is closed by PR #27940 under ruling6513869839— per actionai.exposed: true, the stored-metadata family still refused before the flag, every later gate unchanged — and that steps 2 and 3 landed; symbols named as they are at the merge commits, anchors held bycheck:adr-symbol-anchors),packages/spec/src/ui/action.zod.ts(therequiredPermissionsdocblock paragraph "Landing, as of 2026-10-29" ~:1614: drop the console clause now that #27611 is in; no.describe()change) — stop on breach; explain in the reportContainer & model:
S,mode:thread,model: opus;effort: medium; governed rules text (docs/adr/**) and thepackages/specdocblock owe a CONTRACT_REVIEW_TIER review (fable) before the queue; Tier H by the register expectedClause-②: no
Metadata-protocol: none
Responsibility: ADR-0066 D4's 2026-10-29 amendment still says api actions on
sys_*objects stay off MCP (closed by PR #27940) and that the console fetchestargetdirectly (closed by PR #27793 for #27611), and therequiredPermissionsJSDoc still schedules its own removal.Thread-read: #27694: 6516611621 (first-pass landing; second pass = drop the console clause + amend the Status line), 6515866455 (first-pass review, should-fix 1); #27956: 6516085668 (triage: p2, Tier H, a dated closing note under the amendment, Prime Directive #13), ruling
6513869839on #27681Premise: holds (
origin/main549203d04: ADR-0066 :3 says 「The server half lands under #27506」, :76 says 「stay off MCP … card #27681 carries it」 and 「the console still fetchestargetdirectly」;action.zod.ts:1615-1616 「Until step 3 (#27611) lands … card #27694 removes this」)Serial constraints cleared:
Blocked-by: #27611closed completed by PR #27793 (b00e3f496, 2026-10-30T09:20Z);Blocked-by: #27940mergedbc496bf7d(2026-10-30T10:36Z); no open PR touches ADR-0066 oraction.zod.tsat claim time. Landing tier is read off the register at PR time.objectstack-fleet commentedon Oct 30, 2026
domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS
Landed: PR #28119 merged (
75b0c8b63, 2026-10-30T13:55Z), Tier H, approved, readied and queued by os-zhuang, on contract review PASS 6523987149 (ACCEPT 6523988008). It carried #27694's second pass and #27956 together, because both edit ADR-0066 D4's 2026-10-29 amendment.pm:dispatchedis stripped with this note.From this commit, ADR-0066 D4 carries a dated note (2026-10-30). It records three things:
sys_*MCP gap is closed by PR fix(mcp): an action on a sys_* object whose author exposed it to AI is listed and run over MCP, behind every gate #27940, under ruling6513869839. The rule is per action:ai.exposed: trueon the action itself, with the stored-metadata family refused before the flag is read. Every gate after admission is unchanged.type: 'api'action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649) has landed.type: 'api'action click throughPOST /actions/:object/:actioninstead of fetching itstargetdirectly (ruling on #27506, step 3 of 3) #27611, via PR fix(console): a declared same-origintype: 'api'click goes through the action door #27793) has landed.The Status line records the same. The
requiredPermissionsJSDoc no longer carries the "Landing, as of 2026-10-29" paragraph.The review's should-fix 1 sits with #27900's carrier PR (note 6523989016). Nothing further owed on this card.