+ "_note": "SharingRuleSchema (packages/spec/src/security/sharing.zod.ts) — `SharingRuleSchema = CriteriaSharingRuleSchema`, the one authorable rule form. Seeded 2026-09-17 (#18582): the SECOND of the three PENDING_GOVERNANCE debts #18133 declared when PR #18581 widened the governance denominator from the registered kinds to `authorableTypes()`; `connector` and `analytics_cube` are still owed on that card. NOT a registered metadata KIND — it is bound in `UNREGISTERED_KIND_SCHEMAS` (#6245) and reaches this walk through `getMetadataTypeSchema`'s unregistered-kind fallback, so the ledger governs it while `listMetadataTypeSchemaTypes()` still does not enumerate it. THE SHAPE FACT THAT DECIDES EVERY ROW BELOW: the authoring shape is not the enforced shape. ADR-0057 D6 makes the RUNTIME row canonical (`sys_sharing_rule`: `object_name` + `criteria_json` + `recipient_type`/`recipient_id` + `access_level`) and `bootstrapDeclaredSharingRules` TRANSLATES each authored key into it at boot — nothing re-parses `SharingRuleSchema` at enforcement time. So every consumer cited below reads a COLUMN that a producer had to populate, and every row therefore carries a `producer` (#4837) naming the threading site: a consumer citation alone would be the `seed.env` shape, where the mechanism was right and nobody supplied the input. PREVIEW READ POINTS ENUMERATED (the #7131 mechanical rule, objectui @dda8f381): `registerBuiltinPreviews()` in packages/app-shell/src/views/metadata-admin/previews/index.ts registers twenty types and `sharing_rule` is NOT one of them — this type has no registered metadata-admin preview. Recorded rather than skipped, because \"the type has no registered preview\" is the sentence a later sweep needs. What objectui DOES consume is the whole SHAPE: `clientValidation.ts`'s `AUTHOR_SHAPE_ONLY_TYPES` gates the metadata-admin CREATE door on `SharingRuleSchema` itself (the EDIT door is deliberately not gated — a served body carries the `_diagnostics` read decoration this `.strict()` schema rejects), so an authored rule that fails this schema is refused before it is written. DECOY, do not cite it as a consumer: objectui's own `SharingRuleConfig` (objectui packages/types/src/permissions.ts) is a DIFFERENT shape — `{ type: 'role'|'user'|'group'|'public', entity, actions, filter }` — re-exported twice and read by nothing. It matches this type by name only. RUNTIME PROOF THAT ALREADY EXISTS, unbound: packages/qa/dogfood/test/showcase-declarative-rbac-seeding.dogfood.test.ts authors `sharingRules[]` on the showcase stack and asserts the seeded row's `object_name`, `recipient_type`, `recipient_id` and translated `criteria_json` — i.e. it exercises `name`/`object`/`sharedWith.type`/`sharedWith.value`/`condition` end to end. It is registered in ../scripts/liveness/proof-registry.mts as `declarative-rbac-seeding` with `bound: false`; grep that id there for the entry’s current reason — ⛔ it is deliberately NOT quoted here. This note used to quote that reason VERBATIM, #18797 rewrote it, and the quoted string stopped existing in the very file the note sends you to: the id is the durable anchor, the prose is not. The substance is unchanged and now sits on the entry itself — this seeding falsifies the entry’s original premise, that it acted only on the stack-level collections and reached no authorable key of a governed type (#18587 having supplied the per-type coordinate that premise said was missing) — so the registry records the class as a REAL ADR-0054 §3 binding candidate, held back by the adoption act alone. ⛔ No `proof` is claimed on any row here: binding a high-risk class is a separate ADR-0054 §3 act, one class at a time, and it is filed rather than slipped in.",
0 commit comments