[objectstack-fleet]

Requested by Elon · project thread

Fixes #27694
Fixes #27956

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：ADR-0066 D4 的 2026-10-29 修订下面加一条带日期的注记（2026-10-30），记录三件已落地的事：sys_* 对象上的动作经 MCP 的缺口已由 fix(mcp): an action on a sys_* object whose author exposed it to AI is listed and run over MCP, behind every gate #27940 关闭（按动作逐条看 ai.exposed: true，存储元数据表照旧在读开关前就拒绝，后面各闸不变）；第 2 步 fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649 已落地；第 3 步 Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611（PR fix(console): a declared same-origin type: 'api' click goes through the action door #27793）已落地。原句不改，标为「按当日读，被本注记取代」。Status 行补一句落地记录。requiredPermissions 文档注释里的「Landing, as of 2026-10-29」整段删掉。
• 为什么改：ADR 还写着「sys_* 动作留在 MCP 之外、mcp: run_action refuses every action on a sys_* object, so an agent cannot reach the identity actions (ban_user, impersonate_user, set_user_password) that REST POST /actions serves #27681 承接」和「控制台仍直接请求 target」，两句在 main 上都已不成立；随 @objectstack/spec 的 .d.ts 发出的注释还在说控制台条款和「docs(adr): after the api-action door lands, rewrite ADR-0066 D4's isSameOriginApiTarget citation into a symbol anchor and drop the requiredPermissions docblock's "Landing" door clause #27694 会删掉本段」。治理文本说错，等于给作者和 agent 讲错规则。
• 风险与回滚：两个文件 +3/−6，只动 ADR 正文和一段 JSDoc 注释；不改 .describe()、不改代码、无生成物变化、不发布（skip-changeset）。回滚即 revert 这一个提交。
• 先看：docs/adr/0066-unified-authorization-model.md D4 修订段下面新加的 > **Note (2026-10-30, #27956, #27694)** 那一段，再看第 3 行 Status 末尾新加的「Landed: …」一句。
• 两分钟验证：pnpm check:adr-symbol-anchors，预期 exit 0，符号锚 623 个（597 个声明锚），main 上是 614（588）；多出的 9 个就是注记里引用的 9 个符号，以后改名或挪走会转红。
• 需要你做的：暂无。contract review owed（契约复审未完成，席位复审后再求批）；落地档以登记表在 PR 上的读数为准，预期 Tier H，需受管批准人（os-zhuang 或 hotlong）批准。

What changes

Two files, +3 / −6, one commit on origin/main 6b125a7a.

• docs/adr/0066-unified-authorization-model.md, D4. A dated note, Note (2026-10-30, #27956, #27694), goes under the 2026-10-29 amendment paragraph, in the ADR's own note style (Prime Directive [WIP] Add Chinese version of the documentation #13: the recorded sentence stays and a note goes under it). It says the amendment reads as of its date, and that two of its clauses are superseded by the note, not deleted: the closing "Until step 2 lands …" sentence, and "stay off MCP … card mcp: run_action refuses every action on a sys_* object, so an agent cannot reach the identity actions (ban_user, impersonate_user, set_user_password) that REST POST /actions serves #27681 carries it". Then it records:
  • (a) the sys_* MCP gap is closed by PR fix(mcp): an action on a sys_* object whose author exposed it to AI is listed and run over MCP, behind every gate #27940 (mcp: run_action refuses every action on a sys_* object, so an agent cannot reach the identity actions (ban_user, impersonate_user, set_user_password) that REST POST /actions serves #27681, ruling 6513869839, letter B). The rule is per action: a sys_* action is listed and run over MCP only when it declares ai.exposed: true itself. One predicate (systemObjectActionExposureError) answers for run_action, the list_actions filter and the resume_run admission, and the tool layer's filter yields only to the bridge's attestation (isListableAction). The stored-metadata family is refused before the flag is read (isStoredMetadataBodyObject). Every gate after admission is unchanged;
  • (b) step 2 landed (PR fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649, 2026-10-29);
  • (c) step 3 landed (PR fix(console): a declared same-origin type: 'api' click goes through the action door #27793 for Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611, 2026-10-30). The off-origin and undeclared/object-less clicks still fetch target directly.
• ADR-0066, Status line. After the recorded "The server half lands under Packaged action activation: switching off an api-type packaged action (Ban User) does not stop it, because the activation consult runs only at action dispatch #27506; see the note under D4.", one sentence records the landings: server half PR fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649 (2026-10-29), step 3 PR fix(console): a declared same-origin type: 'api' click goes through the action door #27793 for Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611 (2026-10-30), the sys_* follow-up PR fix(mcp): an action on a sys_* object whose author exposed it to AI is listed and run over MCP, behind every gate #27940 for mcp: run_action refuses every action on a sys_* object, so an agent cannot reach the identity actions (ban_user, impersonate_user, set_user_password) that REST POST /actions serves #27681 (2026-10-30, ruling 6513869839). This is should-fix 1 of the first-pass review 6515866455.
• packages/spec/src/ui/action.zod.ts, the requiredPermissions docblock. The "Landing, as of 2026-10-29" paragraph is removed. Once the console clause and the self-removal sentence go, what is left ("ADR-0066 records the decision; the server half … is on main") is a landing status with nothing pending. The paragraph above it already cites ADR-0066 D4 as amended 2026-10-29. No .describe() change.

Why

The amendment's present-tense clauses are false on main:

• invokeBusinessAction, the list_actions bridge (buildMcpBridge) and resumeAdmissionRefusal all call systemObjectActionExposureError (bc496bf). It returns null for a sys_* action that declares ai.exposed: true. It refuses sys_metadata / sys_metadata_history before reading the flag. isSystemObjectName is still its first test, so the amendment's citation of it still resolves and stays true as the "which objects" test.
• useConsoleActionRuntime and RecordDetailView send a declared same-origin api click to POST /api/v1/actions/:object/:action through ui/packages/app-shell/src/utils/apiActionDoor.ts (b00e3f4). An off-origin target, an inline button that names no declared action, and an object-less action keep the direct fetch, as that module's header says.

Verification

• check:adr-symbol-anchors: exit 0. Head: 623 symbol anchors (597 declaration, 26 literal), 2163 file-level. Base 6b125a7a: 614 (588, 26), 2163. The +9 declaration anchors are the nine new citations; every one resolves.
• node scripts/pm/dispatch-gates.mjs --commands: 74 families derived after the commit. All 74 exit 0. --ran reconcile: 74 run, 0 NOT-MEASURED, 0 UNRUN. That is after a whole-tree turbo run build (116/116), because 15 families exit 3 or miss generated inputs in a fresh worktree.
• pnpm --filter @objectstack/spec run typecheck: exit 0. pnpm --filter @objectstack/spec run test: 756 files, 22510 passed, 1 todo.
• Generated outputs: check:docs, check:authorable-surface and check:api-surface exit 0, and the tree is clean after the build. git grep "Landing, as of 2026-10-29" on base hits only the source file, so no generated file carries this JSDoc.
• Changeset: none. JSDoc and ADR prose only; the label is skip-changeset, as on the first pass (docs(adr): ADR-0066 D4 cites isSameOriginApiTarget by symbol anchor, and the requiredPermissions docblock drops its door clause #27965).

Out of scope, as #27956 says: the action-invocation audit row (#27908) and the platform ai declarations (#27900).

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (No schema change.)
• 2. Every name I added uses the casing for its kind. (No names added.)
• 3. No formatter ran; pnpm lint was not run locally (no code changed; CI's ESLint job judges it).
• 4. One issue, one branch off an up-to-date main, one pull request. (Two cards that edit the same ADR-0066 D4 note, by the seat's dispatch.)
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset. (Publishes nothing: skip-changeset.)
• 6. packages/spec touched: its generated artifacts are regenerated and committed. (None changes; check:docs exit 0 on a clean tree.)
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English. (Except the Chinese maintainer brief.)
• The Before Submitting list in CONTRIBUTING.md is done.

🤖 Generated with Claude Code

https://claude.ai/code/session_016WV4cw9gAhrah1Mtf9tSZ7

[github-actions]

📓 Docs Drift Check

1 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• the SDK route bridge reached 58 of 210 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 168 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 91a423ef6b94a86be8874f1ac6449b406a8971c8 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from a12372a2ad1f45fb40b32e31501c23a22e44a620 — the merge of head 6aa5ec3ea71f1a8baa7a6f977c64790fd8f26ab0 into base 91a423ef6b94a86be8874f1ac6449b406a8971c8, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin a12372a2ad1f45fb40b32e31501c23a22e44a620 && git checkout a12372a2ad1f45fb40b32e31501c23a22e44a620
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 91a423ef6b94a86be8874f1ac6449b406a8971c8 6aa5ec3ea71f1a8baa7a6f977c64790fd8f26ab0 && git checkout -B drift-repro 91a423ef6b94a86be8874f1ac6449b406a8971c8 && git merge --no-ff 6aa5ec3ea71f1a8baa7a6f977c64790fd8f26ab0

node scripts/docs-audit/affected-docs.mjs --json 91a423ef6b94a86be8874f1ac6449b406a8971c8

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

Contract-review-claim: session_016WV4d1QkPVVzNz3FJqb2iS · head 6aa5ec3 · 2026-10-30T13:12Z

[objectstack-fleet]

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

Contract review

Head-sha: 6aa5ec3ea71f1a8baa7a6f977c64790fd8f26ab0
Served-tier: CONTRACT_REVIEW_TIER
Local-runs: probe — node scripts/check-adr-symbol-anchors.mjs on the head worktree and on a detached worktree at the base 6b125a7ab, node scripts/adr-index.mjs on the head (porcelain empty after it), node scripts/pm/check-governed-merges.mjs --pr 28119, and in the head worktree after pnpm install --frozen-lockfile --ignore-scripts the dev's two spec commands pnpm --filter @objectstack/spec run typecheck and pnpm --filter @objectstack/spec run test, were executed locally, because the one gate this diff can turn red (the anchor count, 614 to 623) is a head-versus-base reading no check-run prints as a number, and the spec package's own typecheck and tests are the dispatch's named evidence for the docblock cut; nothing else was built or run.
Scope: docs/adr/0066-unified-authorization-model.md (the register's one hit, Tier H) + packages/spec/src/ui/action.zod.ts (the requiredPermissions docblock, not on the register, read as the same change), packages/runtime/src/action-execution.ts (isSystemObjectName, systemObjectActionExposureError, invokeBusinessAction, actionAiExposureError, actionPermissionError, isHeadlessInvokableAction), packages/runtime/src/domains/mcp.ts (buildMcpBridge list filter, resumeAdmissionRefusal), packages/mcp/src/mcp-http-tools.ts (isListableAction, allowSystemObjects, the run_action pre-check), packages/spec/src/kernel/stored-metadata-body-objects.ts (isStoredMetadataBodyObject), ui/packages/app-shell/src/utils/apiActionDoor.ts and the two console apiHandlers (read for the (c) clause), scripts/check-adr-symbol-anchors.mjs (the gate that holds the nine anchors), docs/adr/README.md (the generated index, for the Status line)

Inputs: git diff 6b125a7ab..6aa5ec3ea (2 files, +3 / −6, one commit; git merge-tree against origin/main 91a423ef6 clean; origin/main has not moved either touched file or any cited file since the base), the PR body and its two comments (6523681013 docs-drift bot, 6523685761 the claim naming this session and this head), card #27694 (body and the nine comments, among them first-pass review 6515866455 with its should-fix 1 and first-pass landing 6516611621), card #27956 (body, triage 6516085668, claim 6522718393), card #27681 (body and all thirteen comments, the ruling 6513869839 and its parameter-2 amendment 6513938013 read in full), card #27611 (body), PR #27940 (body; merge bc496bf7d, merged 2026-10-30T10:36Z), PR #27793 (body; merge b00e3f496, merged 2026-10-30T09:20Z, closes #27611), PR #27649 (body; merge 481ade61c, merged 2026-10-29T21:32Z), the dispatch order and the dev report at /mnt/project-files/skills-lane-seat2/, the first-pass record for PR #27965, the code at origin/main for every symbol the note cites, and the head's check-runs (three polls, last at 2026-10-30T13:19Z).

① Derived judgments

1. Accept set: unchanged — correct. The only hunk in packages/spec/src/ui/action.zod.ts deletes five comment lines inside the JSDoc above requiredPermissions; the z.array(z.string()).optional().describe(...) line is a context line and git diff | grep -c "^[-+].*describe(" is 0. No key, value, default, refinement or export moves. Clause-②: no and Metadata-protocol: none hold; this record answers the path leg on packages/spec/src/**.
2. The sys_* rule, as the note states it, is what the code at bc496bf7d (and at origin/main) implements. Read, not taken from the card: systemObjectActionExposureError (action-execution.ts :129) tests isSystemObjectName(objectName) first and returns null for a non-system object; then refuses when isStoredMetadataBodyObject(objectName) (:136) BEFORE reading the flag; then returns null iff action?.ai?.exposed === true (:143), else the refusal naming the author's opt-in. So the rule is per action, keyed on ai.exposed; the stored-metadata family (STORED_METADATA_BODY_OBJECTS = sys_metadata, sys_metadata_history, packages/spec/src/kernel/stored-metadata-body-objects.ts :51-54) is refused before the flag; and isSystemObjectName still decides which objects the rule applies to. The predicate reads no option, so "no deployment switch opens one" is true at the runtime.
3. The three MCP sites and the tool layer, as named. invokeBusinessAction calls the predicate at :3375 and throws; buildMcpBridge's list_actions loop skips on it at domains/mcp.ts :834; resumeAdmissionRefusal (module-private function, :1170) answers 403 on it at :1178. The tool layer: isListableAction (mcp-http-tools.ts :349, module-private) admits a summary when it names no object, a non-sys_* object, or aiExposed === true; list_actions applies it when allowSystemObjects is not true (:1397) and run_action on an explicit sys_* objectName re-reads the bridge's listing through it before running (:1498-1503). "Admits a sys_* action only on the bridge's attestation of that opt-in" is exactly that. allowSystemObjects defaults to off (:185, :326) and, per its docblock, opens the tool layer's filter only.
4. Every gate after admission, in order, unchanged. invokeBusinessAction after the predicate: isHeadlessInvokableAction (:3378), actionAiExposureError (ai.exposed, :1009), actionPermissionError (D4, :895), disabledActionRefusal (the ADR-0126 §8 activation consult), enforceActionParams (the ADR-0104 D2 param contract), actionConfirmationRefusal (ai.requiresConfirmation), loadActionSubjectRecord (the subject load under RLS). resumeAdmissionRefusal asks exposure, permission, disabled and confirmation in that order after the predicate. The note's list matches; it omits the type admission (isHeadlessInvokableAction), which is not a gate on the caller and is named in the 2026-10-29 paragraph above it.
5. Anchors: nine added, all resolve, and the gate holds them. The added lines carry exactly nine path#symbol anchors: systemObjectActionExposureError, invokeBusinessAction, isSystemObjectName, actionAiExposureError, actionPermissionError (action-execution.ts), buildMcpBridge, resumeAdmissionRefusal (domains/mcp.ts), isListableAction (mcp-http-tools.ts), isStoredMetadataBodyObject (stored-metadata-body-objects.ts). Local probe: head 623 symbol anchors (597 declaration, 26 literal), 2163 file-level, exit 0; base 6b125a7ab 614 (588, 26), 2163, exit 0. +9 declaration, matching the PR body and the dev report. The two module-private declarations resolve as declarations (the gate reads function as well as export function). The Lint · repo & tooling gates check-run, which runs this gate, is success on the head.
6. (b) and (c), with their PR numbers and dates, are true. PR fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649 merged 2026-10-29T21:32Z (481ade61c, an ancestor of the base), and the D4 paragraph above the note already records the door dispatching a declared same-origin api action. PR fix(console): a declared same-origin type: 'api' click goes through the action door #27793 merged 2026-10-30T09:20Z (b00e3f496, closes Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611; ancestor of the base): ui/packages/app-shell/src/utils/apiActionDoor.ts (new in that PR) is imported by both useConsoleActionRuntime.tsx (:61) and RecordDetailView.tsx (:51); its header states the two roads exactly as the note does — the action door for a click whose object and name resolve to a declared type: 'api' action with a same-origin target, the target itself for an off-origin target, an inline page button that names no declared action, and an object-less or standalone declared action absent from the object metadata the host holds. The note's parenthetical "(an inline page button that names none, an object-less action)" is that module's own list.
7. (a)'s provenance is right. PR fix(mcp): an action on a sys_* object whose author exposed it to AI is listed and run over MCP, behind every gate #27940 merged 2026-10-30T10:36Z (bc496bf7d, closes mcp: run_action refuses every action on a sys_* object, so an agent cannot reach the identity actions (ban_user, impersonate_user, set_user_password) that REST POST /actions serves #27681); the ruling of record is 6513869839, letter B, by the maintainer's 「同意」 at 2026-10-30T02:59Z; ADR-0011 (docs/adr/0011-actions-as-ai-tools.md) is the ai.exposed record the ruling names. The note does not state ruling parameters 2 and 3 (the declarations on [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900, the audit row on audit: an action run through MCP leaves no audit row naming its surface; ruling 6513869839 parameter 3 (#27681) needs an execution-context surface key, the audit writer and the forward headers #27908); docs(adr-0066): D4's 2026-10-29 amendment still says api actions on sys_* objects stay off MCP; close it with a dated note once #27940 lands #27956 scopes both out, and [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900's own PR carries an ADR-0011 dated note. See should-fix 1.
8. Status line. The 2026-10-29 amendment's recorded sentence "The server half lands under Packaged action activation: switching off an api-type packaged action (Ban User) does not stop it, because the activation consult runs only at action dispatch #27506; see the note under D4." is kept verbatim and one sentence is appended: server half PR fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649 (2026-10-29), step 3 PR fix(console): a declared same-origin type: 'api' click goes through the action door #27793 for Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611 (2026-10-30), the sys_* follow-up PR fix(mcp): an action on a sys_* object whose author exposed it to AI is listed and run over MCP, behind every gate #27940 for mcp: run_action refuses every action on a sys_* object, so an agent cannot reach the identity actions (ban_user, impersonate_user, set_user_password) that REST POST /actions serves #27681 (2026-10-30, ruling 6513869839), pointing at the 2026-10-30 note. All three pairs and dates match the merges above. This is should-fix 1 of the first-pass review 6515866455, carried as that record asked. node scripts/adr-index.mjs on the head leaves docs/adr/README.md unchanged (the index truncates the Status cell before the new sentence), so no regeneration is owed and the lint index warning cannot fire.
9. The docblock cut is complete and nothing pending is lost. On the head, action.zod.ts carries no Landing, #27694, #27611, #27506 or step 3 text in the requiredPermissions block (the two remaining hits in the file, :870 and :1422, are other members' unrelated prose). The paragraph above the cut already says "per ADR-0066 D4 as amended 2026-10-29", describes the door dispatching a same-origin api action, and keeps the off-origin clause ("MCP does not list it", still true: buildMcpBridge filters through isHeadlessInvokableAction, which refuses an off-origin target). The sentence the dispatch would have left standing — "ADR-0066 records the decision; the server half, the ruling's step 2 (Packaged action activation: switching off an api-type packaged action (Ban User) does not stop it, because the activation consult runs only at action dispatch #27506), is on main (fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649)" — is a landing status with no condition attached, already implied by the paragraph above, and dated; in a shipped .d.ts it would go stale with no reader needing it, while the ADR Status line now holds the same fact with its date. The dispatch's "if nothing is left, drop the paragraph" is met in substance: nothing a reader of the shipped .d.ts needs is left. The declared deviation is accepted.
10. No generated artifact is owed. git grep for "Landing, as of 2026-10-29" and "card docs(adr): after the api-action door lands, rewrite ADR-0066 D4's isSameOriginApiTarget citation into a symbol anchor and drop the requiredPermissions docblock's "Landing" door clause #27694 removes" on the head tree returns nothing; on origin/main the only hits are the three source lines this PR removes. No api-surface JSON, .d.ts snapshot, content/docs/references/ page or docs snapshot carries the docblock. The dev's check:docs, check:authorable-surface and check:api-surface exit 0 with a clean tree after a whole-tree build are consistent with that reading and are not re-run here. Local: pnpm --filter @objectstack/spec run typecheck exit 0 (tsc, scripts typecheck and the test-layer typecheck); pnpm --filter @objectstack/spec run test exit 0 — Test Files 755 passed, 1 skipped (756); Tests 22508 passed, 1 skipped, 1 todo (22510), 285 s (the dev reported 756 files and 22510 passed; the one skipped file here is a vitest --project local skip, not a failure); porcelain empty after both.
11. PR body declarations. Fixes #27694 and Fixes #27956 on their own lines: docs(adr): after the api-action door lands, rewrite ADR-0066 D4's isSameOriginApiTarget citation into a symbol anchor and drop the requiredPermissions docblock's "Landing" door clause #27694's first-pass landing 6516611621 says the second pass closes the card with Fixes, and docs(adr-0066): D4's 2026-10-29 amendment still says api actions on sys_* objects stay off MCP; close it with a dated note once #27940 lands #27956's body wants exactly this note; no closing keyword sits beside any other open card number (mcp: run_action refuses every action on a sys_* object, so an agent cannot reach the identity actions (ban_user, impersonate_user, set_user_password) that REST POST /actions serves #27681, Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611 are closed; audit: an action run through MCP leaves no audit row naming its surface; ruling 6513869839 parameter 3 (#27681) needs an execution-context surface key, the audit writer and the forward headers #27908 and [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 appear without a keyword). Clause-②: no, Metadata-protocol: none; labels documentation, size/xs, skip-changeset, protocol:ui; author objectstack-fleet[bot]; assignee os-elon-musk; draft, mergeable_state: blocked. The ## 维护者速读 six lines are present and say contract review is owed and the tier is the register's.
12. Register. check-governed-merges.mjs --pr 28119: 1 of 2 paths hits (docs/adr/**), Tier H, packages/spec/src/ui/action.zod.ts not on the register, 9 changed lines under the human-merge threshold. The register reading is the dev's.

② Semver level

No release. skip-changeset is consistent with the repo's practice for this class: the diff changes ADR prose and a JSDoc paragraph only; the .describe() text (the published description and the generated references) is byte-identical; no runtime behaviour, type or export moves. The @objectstack/spec shipped bytes change in a comment only, which the review rules class as shipped bytes rather than the published accept set, and the first pass of this card (PR #27965, record 6515866455, merged by the maintainer at Tier H) landed the same class under skip-changeset. AGENTS.md's strict reading ("publishes nothing from any released package") could be argued the other way for a comment inside files[]; the precedent and the Check Changeset success on this head settle it for this PR. Clause-②: no is right; no narrowing is declared or present.

③ Boundary flags

• Dev flags: open_questions empty. Three declared deviations: (1) the whole Landing paragraph removed, not only two clauses — accepted, ①.9; (2) the diff was drafted on the seat's dispatched model while dispatch-gates --tier prints a MANDATORY tier for docs/adr/** — this record is the compensating CONTRACT_REVIEW_TIER review; (3) pnpm lint not run locally — the Lint · ESLint check-run on this head is success.
• Independence: the diff was produced by session_016WV4cw9gAhrah1Mtf9tSZ7 on claude/project-thread-tuxcaq; this record is rendered by session_016WV4d1QkPVVzNz3FJqb2iS, which did not draft it. The claim 6523685761 names this session and this head; no competing claim, hold or hand-off; no reviews on the PR.
• Author: PR user.login is objectstack-fleet[bot]; no non-bot login to record.
• Cross-domain: the packages/spec docblock edit rides the domain:skills card under the exception triage 6513910736 admitted and both claims declare.
• Tier: H by the register (docs/adr/**); the maintainer or a GOVERNED_APPROVERS review lands it. Draft PR.
• CI (53 check-runs on the head, last poll at 2026-10-30T13:24Z): 30 success, 15 skipped, 8 in progress, 0 failure. Success includes both required jobs, Lint & Repo Gates and the Type Check sub-jobs that have finished (Type Check · source gates, · debt ledger, · consumer gates), plus Lint · ESLint, Lint · repo & tooling gates (the job that runs check:adr-symbol-anchors), Lint · docs & code guards, Lint · CI release & engine gates, Lint · PM dispatch-gates, the three Lint · scoped jobs, Test UI, Test Core 7/8 and 8/8, Spec property liveness, Plan Test Core shards, PR-body guards, Governed Surface Queue Guard, Flag docs affected by code changes, Dogfood Regression Gate, Check PR Size, Check Documentation Links, Check Changeset, Build Core, Build UI Deps, Build & E2E UI, Live E2E UI, Auto Label, filter. Still in progress: Type Check · workspace (the required aggregate), Type Check UI, Test Core 1/8 to 6/8. Skipped by path or design: UI Published Artifacts, Test UI shards, Temporal Conformance, Lint UI, Dogfood Verify CLI and its shards, Build Docs, the opt-in harnesses, the schedule gate. The all-green condition for landing was not yet met when this record was written; the local probe covers the one gate this diff can turn red and the spec package's own typecheck and tests.
• The docs-drift bot comment 6523681013 lists nothing and says so is not a clean bill; the one derived anchor is the @objectstack/spec package mention, and the diff names nothing a hand-written page restates.
• Not re-run here: the dev's 74 dispatch-gates families (read from the report; the Lint · PM dispatch-gates and Lint · repo & tooling gates check-runs are success), check:docs, check:authorable-surface, check:api-surface (read from the report, consistent with ①.10).

④ Design judgment

Rules face, docs/adr/0066-unified-authorization-model.md, against its first consumer and its execution plan:

• Amendment style under Prime Directive [WIP] Add Chinese version of the documentation #13 — holds. The recorded sentences stay: line 76 (the 2026-10-29 amendment) is a context line in the diff, byte for byte. The note is a dated Note (2026-10-30, #27956, #27694) — title. blockquote paragraph directly under it, the form this ADR already uses three times (the 2026-10-14 notes) and the corpus uses 49 times (card numbers in the parenthesis as in ADR-0085's Note (2026-10-28, #27069)). It opens by saying the amendment reads as of its date and that it changes no decision, names the two superseded clauses by quotation ("Until step 2 lands …" and "stay off MCP … card mcp: run_action refuses every action on a sys_* object, so an agent cannot reach the identity actions (ban_user, impersonate_user, set_user_password) that REST POST /actions serves #27681 carries it") and says "superseded by this note, not deleted" — the same words the 2026-10-29 amendment used for the 2026-07 clause. The present-tense "Until step 2 lands" sentence is therefore marked as history, not silently rewritten, which is what the first-pass record left for this pass. Steps 2 and 3 are recorded as landed with the right PR numbers and dates (①.6).
• First consumer. The reader deciding whether a sys_* action is reachable over MCP — an author declaring ai, an agent integrator, the next dev on [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 — now reads a rule that is true against origin/main, anchored to the predicate and the three sites that ask it, with the family exception and the gate order the code carries. The nine anchors bind the prose to the symbols: a rename or move of any of them turns check:adr-symbol-anchors red, which is what docs(adr-0066): D4's 2026-10-29 amendment still says api actions on sys_* objects stay off MCP; close it with a dated note once #27940 lands #27956 asked for ("name the symbols as they are at the merge commit"). The citation of isSystemObjectName in the 2026-10-29 paragraph still resolves and is still true as the "which objects" test, so no re-anchor was needed there.
• Execution plan. The three-step plan of the 2026-10-29 amendment is complete and the note says so; the sys_* gap that amendment recorded is closed by the mechanism and the note names the closing PR and ruling. What the plan does not say, and need not for this record: the declarations ([Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900) and the audit surface (audit: an action run through MCP leaves no audit row naming its surface; ruling 6513869839 parameter 3 (#27681) needs an execution-context surface key, the audit writer and the forward headers #27908) are the ruling's open parameters, carried on their own cards; the note's "only when the action itself declares ai.exposed: true" is true today with zero such declarations on platform sys_* objects (ruling parameter 2, amendment 6513938013). Should-fix 1 asks the carrier of [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900 to say so where it lands.
• The docblock against the ruling it implements. The published description already states the door rule in the present tense and is unchanged; the JSDoc above it keeps the amended D4 and the off-origin clause and drops the landing diary. A spec docblock that ships in .d.ts is the wrong place for a dated status with a self-removal clause; the ADR's Status line is the right one, and this PR moves the fact there. Holds.
• Cited code was read to judge the prose, not reviewed.

Implemented-by: claude/project-thread-tuxcaq
Reviewed-by: session_016WV4d1QkPVVzNz3FJqb2iS

VERDICT: PASS

Must-fix: none.

Should-fix:

1. (carrier: [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900's PR, not this one) When the sys_* declarations land under [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900, its ADR-0011 dated note should also point back at ADR-0066 D4's 2026-10-30 note, or that note gain one clause, recording that at bc496bf7d zero platform sys_* actions declared an ai block (ruling parameter 2, amendment 6513938013), so a reader of the mechanism sentence does not infer that the identity actions were reachable over MCP on the day the rule changed.
2. (carrier: landing, not a code change) Landing waits for the in-progress check-runs: Type Check · workspace (a required job), Type Check UI and Test Core 1/8 to 6/8 were still running at the last poll (13:24Z), with 0 failures so far; the Tier H approval should follow their convergence.

[objectstack-fleet]

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

维护者速读

• 改了什么：ADR-0066 补了两处收尾。

  • D4 的 2026-10-29 修订下面加一段带日期的注（2026-10-30），原文一字不改。注里记录三件事：

    1. sys_* 对象上的 MCP 缺口已由 PR fix(mcp): an action on a sys_* object whose author exposed it to AI is listed and run over MCP, behind every gate #27940 关闭（裁决 6513869839）。现在按动作判断：只有动作自己声明 ai.exposed: true 才会在 MCP 上列出和执行；存储元数据那一族（sys_metadata、sys_metadata_history）在读这个旗标之前就被拒；准入之后的各道门禁不变。
    2. 第二步已落地（fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649）。
    3. 第三步已落地（Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611，PR fix(console): a declared same-origin type: 'api' click goes through the action door #27793）。

    原文里两句现在时的句子标为「被本注取代，未删除」。

  • Status 行补一句落地记录。

  另外，action.zod.ts 里 requiredPermissions 文档注释的「Landing, as of 2026-10-29」整段删除。共 2 个文件，+3/−6。

• 为什么改：PR fix(mcp): an action on a sys_* object whose author exposed it to AI is listed and run over MCP, behind every gate #27940 和 fix(console): a declared same-origin type: 'api' click goes through the action door #27793 合并后，ADR 里「api 动作留在 MCP 之外」「控制台仍直接请求 target」这两句已经不成立；文档注释还写着「等第三步落地后本卡删除此段」。

• 风险与回滚：只改文本。.describe() 一字未变，没有代码改动，生成文件里也没有这段注释。ADR 新增的 9 个符号锚点全部能解析（614 → 623）。回滚 = revert。

• 先看：ADR-0066 第 76 行之后的新注，再看第 3 行的 Status。

• 两分钟验证：pnpm check:adr-symbol-anchors exit 0；spec 的 typecheck 和测试都通过（755 个文件，22508 例）。

• 需要你做的：登记册判为 Tier H（docs/adr/**），需要 os-zhuang 或 hotlong 批准。契约复核 PASS，记录就在本评论前面，Head-sha: 6aa5ec3ea71f1a8baa7a6f977c64790fd8f26ab0。批准后由批准人或本席转 ready、入队。

席位意见：ACCEPT。契约复核 PASS，没有 must-fix。复核逐句对过代码：

• systemObjectActionExposureError 先判 isSystemObjectName，再在读 ai.exposed 之前拒绝存储元数据族；
• 这个判定在执行、MCP 列表和恢复准入三处都会用到；
• 准入之后各道门禁的顺序和注里写的一致。

dev 声明的偏差（整段删除，而不是只删两句）本席接受：删完两句后剩下的只是一条带日期、没有待办的落地状态，这件事现在已经连同日期记在 ADR 的 Status 行里。

should-fix 1 的载体是 #27900 的 PR：等 sys_* 声明落地时，要回指本注，并写明在 bc496bf7d 时平台 sys_* 动作一个都没有声明 ai 块。已在 #27900 留言。should-fix 2 是等 CI 跑完再落地。

席位核对

• 形态: one PR carrying Fixes #27694 (second pass) and Fixes #27956, two files: docs/adr/0066-unified-authorization-model.md (+3 −1) and packages/spec/src/ui/action.zod.ts (+0 −5, comment lines only). skip-changeset; precedent is PR docs(adr): ADR-0066 D4 cites isSameOriginApiTarget by symbol anchor, and the requiredPermissions docblock drops its door clause #27965, the first pass of the same card. check-governed-merges.mjs --pr 28119: Tier H (docs/adr/** ×1; action.zod.ts is not on the register).
• 前提实测: PR fix(mcp): an action on a sys_* object whose author exposed it to AI is listed and run over MCP, behind every gate #27940 merged as bc496bf7d (2026-10-30T10:36Z). PR fix(console): a declared same-origin type: 'api' click goes through the action door #27793 merged as b00e3f496 (2026-10-30T09:20Z) and closed Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611. PR fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649 merged 2026-10-29T21:32Z. Line 76 of the ADR, the recorded 2026-10-29 amendment, is a byte-for-byte context line in the diff. Symbol anchors: head 623 vs base 614, and the +9 are exactly the anchors the note adds. adr-index.mjs leaves the README unchanged.
• 门禁 check-runs: head 6aa5ec3ea71f1a8baa7a6f977c64790fd8f26ab0: 54 check-runs, 32 success, 15 skipped, 0 failed, 7 still running (the Type Check and Test Core shards). Lint & Repo Gates, ESLint, Governed Surface Queue Guard and Check Changeset are success. Locally, spec typecheck and spec tests exit 0. The dev report shows 74 of 74 derived gate families exit 0.
• 接受的偏差: the whole "Landing, as of 2026-10-29" paragraph is removed rather than only its console clause, because nothing pending remained in it (review ①4).
• 范围外去向: review should-fix 1 goes to [Decision] sys_* kernel objects, assessed as one set: which of the 58 platform identity actions may an agent ever reach (plain declaration / declaration + confirmation / human-only), executing #27681 B parameter 2 in one ruling #27900, where the carrier PR is (comment on that card). There is no new card.
• 落地条款: Tier H. The seat posts the record and this ACCEPT, adds needs-user-decision, and requests os-zhuang and hotlong. After a governed approver's APPROVED review on this head and green CI, the PR goes ready and into the queue, and the seat clears needs-user-decision. Maintainer's landing grant for this term: seat thread, 2026-10-29 22:04Z.