[objectstack-fleet]

Requested by Elon · project thread

Part of #27694

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：ADR-0066 D4 对 isSameOriginApiTarget 的裸名引用改成符号锚 packages/runtime/src/action-execution.ts#isSameOriginApiTarget，由 check:adr-symbol-anchors 守住；同时删掉那句「符号上 main 后由 docs(adr): after the api-action door lands, rewrite ADR-0066 D4's isSameOriginApiTarget citation into a symbol anchor and drop the requiredPermissions docblock's "Landing" door clause #27694 改写」的待办。requiredPermissions 文档注释的「Landing」段删掉「门禁仍拒收 type: 'api'」这一条款，控制台条款保留。
• 为什么改：fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649 已合并，平台动作门禁现在会派发同源 type: 'api' 动作。随 @objectstack/spec 的 .d.ts 发出去的注释还说门禁拒收，这对作者和 agent 是错话；ADR 用裸名引用，代码改名也没有门禁会发现。
• 风险与回滚：两个文件 +5/−7，只动 ADR 正文和一段 JSDoc 注释，不改 .describe()、不改代码、不发布（skip-changeset）；回滚即 revert 这一个提交。
• 先看：packages/spec/src/ui/action.zod.ts 的 requiredPermissions 注释末段（Landing 段），再看 docs/adr/0066-unified-authorization-model.md D4 第二段的那处引用。
• 两分钟验证：pnpm check:adr-symbol-anchors，预期 exit 0，计数为 611 个符号锚（585 个声明锚），比 main 上的 610 多一个，多出的就是这条锚，此后符号改名或挪走会转红。
• 需要你做的：暂无。contract review owed（契约复审未完成，席位复审后再求批）；本 PR 改 ADR 与 packages/spec/src，落地为 Tier H，由受管批准人批准。

What changes

Two files, +5 / −7, on base ca54eaca.

• docs/adr/0066-unified-authorization-model.md, D4 "Scope of the server half". The same-origin definition cited the predicate by bare name, "as the server card's isSameOriginApiTarget judges it", followed by a parenthetical that scheduled this very rewrite ("once the symbol is on main, card docs(adr): after the api-action door lands, rewrite ADR-0066 D4's isSameOriginApiTarget citation into a symbol anchor and drop the requiredPermissions docblock's "Landing" door clause #27694 rewrites this citation into a symbol anchor…"). The citation is now the symbol anchor packages/runtime/src/action-execution.ts#isSameOriginApiTarget, and the scheduling clause is gone. The rest of the parenthetical stays: "PR fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649; the door holds the interpolated path to the same test before it forwards".
• packages/spec/src/ui/action.zod.ts, the requiredPermissions docblock, paragraph "Landing, as of 2026-10-29". The door clause goes: "Until it lands the door still refuses type: 'api' (isHeadlessInvokableAction admits script, flow and the declarative update only)". It is false since fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649. The paragraph now says the server half (step 2, Packaged action activation: switching off an api-type packaged action (Ban User) does not stop it, because the activation consult runs only at action dispatch #27506) is on main (fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649). The console clause stays, because Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611 is still open: "Until step 3 (Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611) lands the console fetches target directly; card docs(adr): after the api-action door lands, rewrite ADR-0066 D4's isSameOriginApiTarget citation into a symbol anchor and drop the requiredPermissions docblock's "Landing" door clause #27694 removes this paragraph when it does."

No .describe() changes, no code, no generated file.

Why

• The door clause is false on main. isHeadlessInvokableAction admits type: 'api' when isSameOriginApiTarget(action?.target) holds, and headlessActionTypeError answers null for a same-origin api action. Both are in packages/runtime/src/action-execution.ts, and fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649 (481ade61c, an ancestor of the base) put them there. The docblock ships in @objectstack/spec's .d.ts, so authors and agents were told the door refuses a call it now runs.
• The console clause is still true. apiHandler in ui/packages/app-shell/src/hooks/useConsoleActionRuntime.tsx still authFetches the resolved target, and Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611 is open.
• The ADR prose around the anchor still reads true. isSameOriginApiTarget returns false for a non-string, for a string shorter than 2, for one not starting with /, and when the second character is / or a backslash. That is the ADR's "starts with exactly one / and goes on past it (/ alone, //host and /\host are not)". The forward re-tests the interpolated path (if (!isSameOriginApiTarget(path)) in buildApiActionRequest, which assembles the request the forward sends), which is "the door holds the interpolated path to the same test before it forwards".

Deviations from the dispatch order

• The Landing paragraph is reworded around the deleted clause, not only cut. Its door and console clauses shared one sentence ("Until it lands the door still refuses … and the console fetches target directly"), where "it" was the server half. Deleting the door half alone would leave "Until it [the server half] lands the console fetches target directly". That is false: the server half has landed and the console still fetches. The last sentence scheduled two removals, and one of them is this PR. So the paragraph keeps the console clause, ties it to step 3, and keeps the pointer to docs(adr): after the api-action door lands, rewrite ADR-0066 D4's isSameOriginApiTarget citation into a symbol anchor and drop the requiredPermissions docblock's "Landing" door clause #27694 for the second pass. The date "as of 2026-10-29" is kept: fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649 merged 2026-10-29T21:32Z, so every statement in the paragraph was already true on that date.
• No dated amendment note in the ADR. House form, measured: 53 ADRs carry path#symbol anchors after the [finding] ADR line anchors into sql-driver.ts have rotted — 4 of 4 sampled resolve to unrelated code, and the ADRs read as if they still point at the mechanism they name #13556 line→symbol migration, and only one carries an "Anchor note" (ADR-0113). That note exists because its re-anchoring dropped to file level and the row it anchors is stale. ADR-0097's and ADR-0099's dated notes record changes of meaning. This rewrite changes no meaning. It also carries out a step the 2026-10-29 amendment itself scheduled, under the paragraph's existing "api clause amended 2026-10-29, Ruling-ref: 6499781492" label. So it follows the no-note precedent of the anchor migration.

Acceptance notes

These go stale with #27649 but are outside this card's file surface or its ruling, so they are left as is:

• ADR-0066's Status line still ends "The server half lands under Packaged action activation: switching off an api-type packaged action (Ban User) does not stop it, because the activation consult runs only at action dispatch #27506; see the note under D4." It is present tense, and the server half has landed (fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649).
• The D4 amendment note (dated 2026-10-29) ends "Until step 2 lands the door still refuses type: 'api' … so no agent can invoke a type: 'api' action today". It is a dated record and its condition ("until step 2 lands") is spent. It is not edited: an amendment note is a record of its date. Carrier: docs(adr): after the api-action door lands, rewrite ADR-0066 D4's isSameOriginApiTarget citation into a symbol anchor and drop the requiredPermissions docblock's "Landing" door clause #27694's second pass, which the maintainer can widen if wanted.

Verification

All readings are on head 701d5499 (base ca54eaca).

dispatch-gates: 74 derived families, 74 exit 0

node scripts/pm/dispatch-gates.mjs --commands was run with no paths, on the committed diff against merge base ca54eaca. It derives 74 families, and all 74 were run with exit codes captured before any pipe. Prerequisites were pnpm install --frozen-lockfile --ignore-scripts and turbo run build --filter=@objectstack/spec --filter=@objectstack/formula --filter=@objectstack/lint. Two families first exited 3 (PREREQUISITE NOT MET: check:dual-build-cjs-loads, check:lean-entry-closure, both needing built dist outside spec). After a whole-tree turbo run build (lock VERDICT command-exit 0), both exited 0: 113 published require entry points across 70 packages load, and the objectql/core admitted set holds exactly. check:dts-closure, check:sourcemap-no-sources-content and check:published-files were re-run over the whole built tree: exit 0, 115 / 108 / 74 packages swept. --ran: 74 derived famil(ies) accounted for — 74 run, 0 NOT-MEASURED. Re-derived after the run, the list was identical.

The ADR gates in the list: check:adr-symbol-anchors, check:adr-anchors, check:adr-index, check-adr-links.mjs (+ --self-test), check-adr-0087-registration.mjs, all exit 0. check:adr-symbol-anchors counts 611 symbol anchors (585 declaration) and 2161 file-level on this head, against 610 (584) and 2162 on ca54eaca. The bare-path citation of action-execution.ts became a declaration anchor, so the new anchor is in the gated population. Spec-docblock gates: check:spec-docblock-symbol-anchors, check:docs, check:api-surface, check:authorable-surface, all exit 0. check:nul-bytes exit 0.

@objectstack/spec typecheck and tests

• pnpm --filter @objectstack/spec run typecheck: lock VERDICT command-exit 0.
• pnpm --filter @objectstack/spec run test: Test Files 756 passed (756), Tests 22481 passed | 1 todo (22482), lock VERDICT command-exit 0.
• No ablation: the diff changes prose and a comment, not tested behaviour.

git merge-tree against origin/main bacb3e6a is clean, and no commit since the base touched either file. --tier answers MANDATORY claude-fable-5-1 for docs/adr/**. The claim records the proactive low-headroom downgrade, compensated by the contract-tier review. Changed lines: 12 (+5 / −7), under the 3000 threshold.

Contract review owed: governed docs/adr/** and packages/spec/src/**, at CONTRACT_REVIEW_TIER. That review also answers the Clause-② path leg on packages/spec/src/**. Landing is Tier H.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (a JSDoc comment only)
• 2. Every name I added uses the casing for its kind. (no names added)
• 3. No formatter ran; pnpm lint passes (prose only; the full run is CI's).
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset. It changes a comment only, no .describe() and no code, so skip-changeset. Both declaration lines are above.
• 6. packages/spec touched: nothing to regenerate. The change is a JSDoc comment. After the spec build and all 74 gate runs, the tree was clean (git status empty), and check:docs exited 0.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English (the 维护者速读 is the sanctioned Chinese channel).
• The Before Submitting list in CONTRIBUTING.md is done.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

1 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• the SDK route bridge reached 58 of 210 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 168 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json bacb3e6a0ff6e8bfdeade49d6830e34fb5522589 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 510bb6c38b02f541462074cef35b143897a7192e — the merge of head 701d54993ffd1e89db86dfb21d385bc933e0c8ad into base bacb3e6a0ff6e8bfdeade49d6830e34fb5522589, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 510bb6c38b02f541462074cef35b143897a7192e && git checkout 510bb6c38b02f541462074cef35b143897a7192e
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin bacb3e6a0ff6e8bfdeade49d6830e34fb5522589 701d54993ffd1e89db86dfb21d385bc933e0c8ad && git checkout -B drift-repro bacb3e6a0ff6e8bfdeade49d6830e34fb5522589 && git merge --no-ff 701d54993ffd1e89db86dfb21d385bc933e0c8ad

node scripts/docs-audit/affected-docs.mjs --json bacb3e6a0ff6e8bfdeade49d6830e34fb5522589

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

Contract-review-claim: session_016WV4d1QkPVVzNz3FJqb2iS · head 701d549 · 2026-10-30T05:33Z

[objectstack-fleet]

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 701d54993ffd1e89db86dfb21d385bc933e0c8ad
Local-runs: probe — node scripts/check-adr-symbol-anchors.mjs (self-test, then the gate) on head 701d5499 and on base ca54eaca in two detached worktrees, removed afterwards, to confirm the new anchor is in the gated population; nothing else was built or run.
Scope: packages/spec/src/ui/action.zod.ts, docs/adr/0066-unified-authorization-model.md + packages/runtime/src/action-execution.ts (isSameOriginApiTarget, isHeadlessInvokableAction, headlessActionTypeError, SERVER_DISPATCHED_ACTION_TYPES, buildApiActionRequest, invokeBusinessAction), packages/runtime/src/domains/actions.ts (the REST door's forward), packages/runtime/src/domains/mcp.ts (the bridge's isHeadlessInvokableAction filter), ui/packages/app-shell/src/hooks/useConsoleActionRuntime.tsx and ui/packages/app-shell/src/views/RecordDetailView.tsx (the console's apiHandler), scripts/check-adr-symbol-anchors.mjs (the gate that holds the anchor), .changeset/27610-adr-0066-d4-api-actions-door.md (read only for the stale-landing-note question)

Inputs: git diff origin/main...FETCH_HEAD (2 files, +5 / −7, one commit on base ca54eaca, merge base clean against origin/main bacb3e6a), the PR body and its two comments (6515776463 docs-drift bot, 6515788043 the claim), card #27694 and its five comments (6506768233, 6513062223, 6513910736, 6514960778, 6515779258), card #27611 (open, with PR #27793 open against it), the dev report at /mnt/project-files/skills-lane-seat2/report-27694.json, and the head's check-runs.

① Derived judgments

1. Accept set: unchanged — correct. The only hunk in packages/spec/src/ui/action.zod.ts is inside the JSDoc block above requiredPermissions. The z.array(z.string()).optional().describe(...) line is a context line in the diff; git diff ... | grep -c "^[-+].*describe(" is 0. No key, value, default or refinement moves, so no published accept set changes and no content/docs/references/ page regenerates. Clause-② no holds; this record answers the path leg on packages/spec/src/**.
2. Door clause: fully removed and was false — correct. On head, packages/runtime/src/action-execution.ts#isHeadlessInvokableAction (line 1026) returns isSameOriginApiTarget(action?.target) for type === 'api', and headlessActionTypeError (line 1562) answers null when type === 'api' && isSameOriginApiTarget(action?.target). Both come from fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649 (481ade61c), which git merge-base --is-ancestor confirms is an ancestor of both origin/main and the head. The removed sentence ("the door still refuses type: 'api' (isHeadlessInvokableAction admits script, flow and the declarative update only)") was therefore false on main; no fragment of it survives in the new paragraph.
3. Rewording around the cut: every remaining sentence is true. "ADR-0066 records the decision" — the dated D4 amendment is in the file. "The server half, the ruling's step 2 (Packaged action activation: switching off an api-type packaged action (Ban User) does not stop it, because the activation consult runs only at action dispatch #27506), is on main (fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649)" — fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649's title names Packaged action activation: switching off an api-type packaged action (Ban User) does not stop it, because the activation consult runs only at action dispatch #27506 and the commit is on main. "Until step 3 (Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611) lands the console fetches target directly" — Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611 is open; useConsoleActionRuntime.tsx apiHandler (lines 411–499) builds url = resolvedTarget.startsWith('http') ? resolvedTarget : baseUrl + resolvedTarget and calls authFetch(url, init); RecordDetailView.tsx apiHandler (lines 1422–1537) mirrors it. Neither posts to /api/v1/actions/:object/:action for an api action. PR fix(console): a declared same-origin type: 'api' click goes through the action door #27793 is open against Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611 but not merged, so the clause stays true on main. "Card docs(adr): after the api-action door lands, rewrite ADR-0066 D4's isSameOriginApiTarget citation into a symbol anchor and drop the requiredPermissions docblock's "Landing" door clause #27694 removes this paragraph when it does" — matches seat 1's note 6506768233 (second pass drops the console clause and closes the card). The deviation is justified: a bare cut would have left "Until it [the server half] lands the console fetches target directly", which is false. The retained date "as of 2026-10-29" is consistent with fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649's merge on that date.
4. ADR anchor: resolves, and the sentence around it reads true. isSameOriginApiTarget is export function at packages/runtime/src/action-execution.ts:1083. Its body — non-string or length under 2 false, must start with /, second char must be neither / nor backslash — is exactly the ADR's "starts with exactly one / and goes on past it (/ alone, //host and /\host are not)". "The door holds the interpolated path to the same test before it forwards" — buildApiActionRequest re-tests isSameOriginApiTarget(path) after interpolation (line 1257) and answers 400 otherwise; the REST door calls buildApiActionRequest then forwardApiAction (domains/actions.ts:839-843) and the MCP bridge goes through invokeBusinessAction (domains/mcp.ts:871), which calls buildApiActionRequest at line 3348. "The route and the bridge" — both consume isHeadlessInvokableAction (mcp.ts:832, action-execution.ts:3216). The scheduling clause "once the symbol is on main, card docs(adr): after the api-action door lands, rewrite ADR-0066 D4's isSameOriginApiTarget citation into a symbol anchor and drop the requiredPermissions docblock's "Landing" door clause #27694 rewrites this citation" is gone; grep "card #27694" on the head ADR returns nothing. The kept parenthetical "(PR fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649; the door holds the interpolated path ...)" is unchanged in meaning.
5. Gate population: the anchor is held. Local probe: head 611 symbol anchors (585 declaration, 26 literal), 2161 file-level; base 610 (584, 26), 2162 file-level; self-test and gate exit 0 on both. The +1 declaration / −1 file-level pair is exactly this citation (the bare action-execution.ts path became a declaration anchor). This matches the PR body's numbers.
6. No generated artifact is owed. git grep "Landing, as of 2026-10-29" on the head tree hits only the source file; no api-surface/*.json, api-surface-signatures.json, declaration-map, docs/ snapshot or content/docs/references/ page carries the docblock paragraph. The dev report records a clean tree after a whole-tree build and check:docs exit 0, consistent with that reading.
7. PR body declarations present and correct. Part of #27694 (not Fixes, per 6506768233); Clause-②: no; Metadata-protocol: none; label skip-changeset on the PR; Check Changeset skipped by the label. Author is objectstack-fleet[bot].

② Semver level

No release. skip-changeset is right: the diff changes a JSDoc paragraph and ADR prose; the .describe() text (the published description and the generated references) is byte-identical, and no runtime behaviour or type moves. The shipped .d.ts bytes of @objectstack/spec change in a comment only, which the review rules class as shipped bytes, not the published accept set. The prior #27664 changeset (.changeset/27610-adr-0066-d4-api-actions-door.md) already carries the Metadata-protocol: semantic record of the meaning change; this PR adds no meaning. Consistent.

③ Boundary flags

• Dev flags: open_questions is empty. Three declared deviations: (1) rewording around the cut — accepted, see ① item 3; (2) no dated amendment note — accepted, see ④; (3) skip-changeset via pr_create and no assignees — procedural, not a contract matter.
• Independence: the diff was produced by session_016WV4d1LtiXudcBaRgY2xRg on branch claude/project-thread-vovpce; this record is rendered by session_016WV4d1QkPVVzNz3FJqb2iS, which did not draft the diff. The claim 6515788043 names this head.
• Cross-domain: the packages/spec docblock edit rides the domain:skills card under the exception declared in claim 6514960778 and admitted by triage 6513910736.
• Tier: Tier H (docs/adr/**, packages/spec/src/**); the maintainer merges. Draft PR, mergeable_state: blocked.
• CI (check-runs on head at 2026-10-30T05:36Z): 0 failed. Green: Lint · ESLint, Lint · PM dispatch-gates, Lint · scoped · tooling self-tests, Auto Label, Dogfood Regression Gate, Plan Test Core shards. Still in progress: Lint · repo and tooling gates (this is the job that runs check:adr-symbol-anchors), Build Core, Build UI Deps, Live E2E UI, Test Core 1/8–8/8. Skipped by design: Check Changeset, Check PR Size, Build Docs, UI Published Artifacts, Temporal Conformance, Dogfood Verify CLI, the opt-in harnesses. The all-green condition for landing is not yet met at the time of this record; the local probe covers the one gate this diff can turn red.
• The docs-drift bot comment 6515776463 lists nothing and says so is not a clean bill; the diff names no derived anchor, so nothing is expected there.

④ Design judgment

• docs/adr/0066-unified-authorization-model.md against its first consumer and execution plan. The first consumer of the D4 same-origin definition is the door itself (isSameOriginApiTarget and the forward), and the anchor now binds the prose to that symbol: a rename or move turns check:adr-symbol-anchors red, which is what the card asked for. The three-step execution plan in the amendment note is untouched and still accurate as a dated record (step 1 this record, step 2 Packaged action activation: switching off an api-type packaged action (Ban User) does not stop it, because the activation consult runs only at action dispatch #27506/fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649 landed, step 3 Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611 open).
• No dated amendment note — right call. docs/adr/README.md and AGENTS.md reserve the amended-status-line / new-ADR form for a reversed or changed decision (Prime Directive 13). Replacing a bare name with an anchor changes no decision. The [finding] ADR line anchors into sql-driver.ts have rotted — 4 of 4 sampled resolve to unrelated code, and the ADRs read as if they still point at the mechanism they name #13556 migration (the gate's own header, scripts/check-adr-symbol-anchors.mjs) moved 300+ anchors across 35 ADRs without per-ADR notes; the single "Anchor note ([finding] ADR line anchors into sql-driver.ts have rotted — 4 of 4 sampled resolve to unrelated code, and the ADRs read as if they still point at the mechanism they name #13556)" is ADR-0113's, written because its re-anchor dropped to file level over a row known to be stale, and it explicitly says it did not repair the prose. Sampled on head: ADR-0066 (3 path#symbol anchors), ADR-0126 (3), ADR-0131 (4) carry no anchor note. My own count of ADRs with packages/...ts#symbol anchors is 52 (the thread says 53; the one-off is regex width, not a dispute). The rewrite also executes a step the 2026-10-29 amendment itself scheduled, under the paragraph's existing dated label, so provenance is already recorded.
• packages/spec/src/ui/action.zod.ts against the ruling it implements. The ruling (6513910736 and the card) says drop the door clause only and keep the console clause; the paragraph does that and nothing more. The published description still says "on every call the platform action door ... dispatches", which was written to stay true across the landing, and it does.
• The two noted findings. Both are real and neither belongs in this PR. (a) The Status line "The server half lands under Packaged action activation: switching off an api-type packaged action (Ban User) does not stop it, because the activation consult runs only at action dispatch #27506; see the note under D4." is present-tense and the half has landed; it is outside the card's D4 hunk and the ruling's file surface, and the status line is the single fact the README guards, so it should move with the second pass as a status amendment, not ride a first pass that the ruling scoped to one citation. Should-fix, carrier second pass. (b) The amendment note's "Until step 2 lands the door still refuses type: 'api' ... so no agent can invoke a type: 'api' action today, and the console still fetches target directly" is a dated record whose condition has resolved; the ADR house form keeps dated notes as written (ADR-0113 is the precedent for not repairing prose under an anchor change). Leave it. One additional observation, not a finding: the pending .changeset/27610-adr-0066-d4-api-actions-door.md Landing bullet reads "Until it lands the door still refuses type: 'api'"; it is a conditional that has resolved and a release-owned record once versioned, so it is not owed here.
• Cited code was read to judge the prose, not reviewed.

Implemented-by: claude/project-thread-vovpce
Reviewed-by: session_016WV4d1QkPVVzNz3FJqb2iS

VERDICT: PASS

Must-fix: none.

Should-fix:

1. (carrier: docs(adr): after the api-action door lands, rewrite ADR-0066 D4's isSameOriginApiTarget citation into a symbol anchor and drop the requiredPermissions docblock's "Landing" door clause #27694 second pass, not this PR) ADR-0066 Status line: amend "The server half lands under Packaged action activation: switching off an api-type packaged action (Ban User) does not stop it, because the activation consult runs only at action dispatch #27506; see the note under D4." to record that it landed (fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649, 2026-10-29), in the same pass that drops the console clause once Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611 is on main.
2. (carrier: landing, not a code change) Landing waits for the in-progress check-runs: Lint · repo and tooling gates, Build Core, Build UI Deps, Live E2E UI and the 8 Test Core shards were still running when this record was written; the maintainer's Tier H approval should follow their convergence.

[objectstack-fleet]

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

维护者速读

• 改了什么：ADR-0066 的 D4 段改用符号锚点 packages/runtime/src/action-execution.ts#isSameOriginApiTarget 引用同源判定，不再写裸文件名；删掉「卡 docs(adr): after the api-action door lands, rewrite ADR-0066 D4's isSameOriginApiTarget citation into a symbol anchor and drop the requiredPermissions docblock's "Landing" door clause #27694 落地后改写本引用」的排期句。packages/spec/src/ui/action.zod.ts 中 requiredPermissions 的 JSDoc 去掉一句已不成立的「门还拒收 type: 'api'」（fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649 已在 main 上放行同源 api 动作），保留「Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611 落地前控制台仍直接请求 target」。2 个文件，+5/−7，skip-changeset。
• 为什么改：卡 docs(adr): after the api-action door lands, rewrite ADR-0066 D4's isSameOriginApiTarget citation into a symbol anchor and drop the requiredPermissions docblock's "Landing" door clause #27694 的第一遍。fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649 合入后，那句门子句变成假话；ADR 用符号锚点引用后，一旦重命名或移动，check:adr-symbol-anchors 会转红。
• 风险与回滚：只改注释和 ADR 散文。.describe() 文本、类型、行为都不变，生成的 references 页逐字节相同，revert 即回滚。
• 先看：ADR-0066 D4 段那一处锚点，再看 action.zod.ts 中 requiredPermissions 的 JSDoc。
• 两分钟验证：node scripts/check-adr-symbol-anchors.mjs exit 0（锚点数 611，比 base 多 1 条声明锚点，少 1 条文件级锚点）。
• 需要你做的：登记册判 Tier H（docs/adr/**）。请批准本 PR（契约复核 PASS 6515866455，Head-sha: 701d54993ffd1e89db86dfb21d385bc933e0c8ad）。

席位意见：ACCEPT。契约复核 PASS，没有 must-fix。should-fix 1：ADR-0066 的 Status 行仍是现在时（"The server half lands under #27506"），转到 #27694 第二遍，与删控制台子句一起改，因此本 PR 写 Part of #27694，卡保持打开。should-fix 2（等 CI 收敛）已满足：现在全绿。

席位核对

• 形态: one PR, Part of #27694 (not Fixes; the second pass removes the console clause after Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611 lands), two files: docs/adr/0066-unified-authorization-model.md, packages/spec/src/ui/action.zod.ts (JSDoc only, no .describe() byte moves). Clause-②: no, Metadata-protocol: none, skip-changeset. check-governed-merges.mjs --pr 27965: Tier H (docs/adr/** ×1), 12 changed lines.
• 前提实测: isHeadlessInvokableAction and headlessActionTypeError admit a same-origin type: 'api' on main (fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649, an ancestor of the head), so the removed door clause was false. Both console apiHandlers (useConsoleActionRuntime.tsx, RecordDetailView.tsx) still fetch target directly, so the kept clause is true. isSameOriginApiTarget is exported at action-execution.ts:1083 and matches the ADR's definition (review ①2–4).
• 门禁 check-runs: head 701d54993ffd1e89db86dfb21d385bc933e0c8ad: 55 check-runs, 40 success, 15 skipped, 0 failed, 0 pending; mergeable_state clean. This includes Lint · repo and tooling gates, which runs check:adr-symbol-anchors.
• 接受的偏差: the sentence around the cut is reworded so it doesn't say the server half is still pending (a bare cut would have left a false "Until it lands"). There is no dated amendment note: an anchor change alters no decision, and that follows the [finding] ADR line anchors into sql-driver.ts have rotted — 4 of 4 sampled resolve to unrelated code, and the ADRs read as if they still point at the mechanism they name #13556 migration's form (review ④).
• 范围外去向: ADR-0066 Status line → docs(adr): after the api-action door lands, rewrite ADR-0066 D4's isSameOriginApiTarget citation into a symbol anchor and drop the requiredPermissions docblock's "Landing" door clause #27694 second pass. The amendment note's dated "Until step 2 lands" stays as a dated record (ADR-0113 precedent).
• 落地条款: Tier H: after a GOVERNED_APPROVERS approval, the seat lands it under the maintainer's landing grant for this term (seat thread, 2026-10-29 22:04Z).