[objectstack-fleet]

Requested by Tesla · project thread

Refs #25233 (closed by #25541). This is the Tier H ADR text for the ruling of record 6355206139, letter B, item 2. It stays a draft for the maintainer to merge (docs/adr/** is a governed surface).

Clause-②: no
Metadata-protocol: none

What this does

The ADRs now say what #25515 and #25541 enforce. An EXTERNAL principal is a member of the organization's member pool who holds the external organization role. It reaches rows through explicit grants only: shares and share links, sharing rules, and the position and permission-set grants it holds, with their RLS evaluated. It never reaches the OWD baseline.

ADR	Clause	Change
ADR-0095	header, TL;DR item 2, D2	A dated Amended line. The enum comment and the EXTERNAL bullet carry the channel list, the owner-only OWD and write floors, the controlled_by_parent exemption, and the named limit: an ownerless object with a public effective model is under no OWD for any principal. The original wording is quoted.
ADR-0095	D3	One bullet: EXTERNAL derives from the reserved org_external position, which the resolver projects from sys_member.role = external. As with role='admin', the role is the source of a position, and enforcement reads the posture.
ADR-0099	header, D2 table, D3, I3, I7	The EXTERNAL column is rewritten, with a dated note superseding the 2026-07-18 note's "EXTERNAL rows stand as written" and quoting the original cells. D3 gains a head note: sharing rules apply, item 1 shipped, the ownerless-object limit, and explain's guest → EXTERNAL debugger mapping. I3 gains a dated note: EXTERNAL is the one exception to "only from capability grants", derived from the reserved org_external position by the resolver alone. I7 reads through the floor.
ADR-0090	header, D11	A Re-amended line and a second note under D11. "drawn from an identity pool separate from members" is replaced by the population inside the member pool, by role. The "D6 access matrix gains an external-audience column" sentence is retired, because it rode externalSharingModel and audience is a property of the principal.
ADR-0135	after D4	A dated objectstack note: a third population, members of either D2 source who hold the external role, marked by role on sys_member and not by sys_user.source. D4's markings are unchanged, and cloud ADR-0024's text is not amended.

One source line rides along: packages/core/src/security/external-owd-floor.ts's docblock no longer lists controlled_by_parent among the models the floor closes (the seat's carry note on #25541). It takes a patch changeset on @objectstack/core, comment only.

Acceptance notes

• The text matches the code on main at 45f9962: owdForAudience and owdForPrincipal (the cbp exemption), holdsExternalIdentity and derivePosture, external_default's owner-only write floor, and the authz-matrix EXTERNAL column.
• The notes from contract review 6375883728 are folded in: the D11 column sentence retired explicitly, the ownerless-object limit named, and the guest debugger mapping noted.
• Cloud ADR-0024's mirror text is not ours and is not touched.

Notes for review:

• ADR-0095 D3 and ADR-0099 I3 said posture derives "only from capability grants". EXTERNAL is the one rung whose evidence is an identity position. The new D3 bullet and a dated note on I3 record that exception; the resolver stays the only deriver, and no enforcement site reads the role.
• sharing: a share or sharing rule to an external member is refused as inert on a public_read_write or model-less system object, though the external OWD floor would consult it #25549 (share creation and sharing-rule materialisation refused as inert on effective-public objects) is still awaiting a ruling. Whatever the ruling, its ADR-0111 D7 line rides a later Tier H PR, not this one.

Verification: all 69 derived gates were run and reconciled with dispatch-gates --ran (0 not measured), including check-adr-links, check:adr-anchors, check-adr-symbol-anchors and check:doc-authoring. The diff is 6 files. The I3 note (f653505) re-derives the same 69, and the ADR, citation and doc-authoring gates re-pass on it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AZbN6PU5Xz4WTi6NKmyKhN

[github-actions]

📓 Docs Drift Check

⚠️ 1 changed file(s) yielded no anchor (packages/core/src/security/external-owd-floor.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/core/src/security/external-owd-floor.ts) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 28 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 45f996231ea46fe24f6e865fa781629dae33f3f1 → packageMentionDocs.

[objectstack-fleet]

维护者速读

• 改了什么: 外部组织角色(Security: an external organisation role whose members do not see the member directory and reach data only through explicit grants (portal users on hosted environments) #25233)两个代码 PR 都已合并，这个 PR 把对应的架构决策记录(ADR)改成和代码一致：ADR-0095、ADR-0099、ADR-0090、ADR-0135 四份，共 +106 / −22 行。另外顺手修了 core 里一处过时注释(不改行为)。
• 为什么改: ADR 里还写着外部用户不在成员池、"外部受众列"、"姿态只来自能力授予"等旧说法，和已上线的代码相反。AI 作者和维护者都会读这些文档，不改就会照着错的规则写代码。
• 风险与代价(含回滚): 只改文档和一行注释，不碰运行时，不需要迁移。回滚就是 revert 这一个提交。
• 席位意见: 建议合并。CI 全绿(48 项：39 成功，9 跳过)。补充：ADR-0099 I3 原来写着"姿态只来自能力授予"，本 PR 用带日期的注明写清 EXTERNAL 是唯一例外：它来自保留职位 org_external，判定者仍只有解析器一处。
• 你要做的: ADR 是治理路径，需要人合并。请 os-zhuang 或 hotlong 中一位在 PR 上点 Approve，之后席位入队合并。

席位核对 · ACCEPT(待人批) · domain:spec seat 1 (seat post #6017) · os-tesla · session session_013odhA26dvzy7pQmevdTTvy · 2026-10-24T00:55Z

Head f653505bee · card #25233 (closed by #25541) · ruling 6355206139 (letter B, item 2: the Tier H docs PR) · contract reviews on #25541 6375883728 and 6376653249, whose ADR notes this PR carries.

• Shape: draft, base main, 6 files, +106 / −22. check-governed-merges: 4 governed ADR paths ⇒ human merge or an authorized approval from GOVERNED_APPROVERS.
• Content checked against the merged code: ADR-0095 D2/D3, the ADR-0099 D2 column, D3/I7 and the dated I3 exception, the ADR-0090 D11 re-amendment (the external-audience-column sentence retired), and a dated note after ADR-0135 D4. external-owd-floor.ts: the docblock no longer lists controlled_by_parent among the floored models, matching fix 225d5bc02. Patch changeset on @objectstack/core, Clause-②: no, Metadata-protocol: none.
• Gates pinned to the head: 48 check-runs on f653505bee, 39 success + 9 skipped, 0 red.
• Landing: stays draft, needs-user-decision on the PR, review requested from os-zhuang and hotlong. On an authorized APPROVED the seat runs pr_ready + automerge_enable.

---

Generated by Claude Code