Skip to content

Commit dd4ef38

Browse files
objectstack-fleet[bot]claude
objectstack-fleet[bot]
and
claude
authored
docs(adr): ADR-0090 D12 status line and ADR-0086 row — the binding and env-set authoring rights retired (#23488) (#23602)
Part of #23488 Ruling of record 6181988435 on #23488 (letter A), item 5: the ADR-0090 D12 status line and the ADR-0086 row go as one Tier H docs PR for the maintainer's merge. The code half (the two tombstones, the D2 conversion, the containment change, the docs and showcase text) is the main PR, #23601. #23488 remains open until that main PR lands; this PR only records the decision in the ADRs. ## What changes - **ADR-0090, Status block:** one new `Amended` line. D12's position-to-set binding right and its environment-set authoring right are retired (`AdminScope.manageBindings` and `AdminScope.authorEnvironmentSets`, ADR-0049 enforce-or-remove). A position's sets and a permission set's body are environment definitions, and the definition write is `manage_metadata`'s per ADR-0131 D3, never a delegate scope's. D12's *what* is user-to-position assignments (and direct set grants) inside the subtree; the line tells the reader to take D12's bindings and authoring clauses as superseded. - **ADR-0086, the `adminScope` row of the metadata/config table (line 446):** the clause "`authorEnvironmentSets` keeps package-managed rows publish-only per this ADR" becomes: the scope assigns and grants and never authors a set; `authorEnvironmentSets` is retired (2026-10-15, this ruling) because a permission set is an environment definition whose write is `manage_metadata`'s (ADR-0131 D3); package-managed sets stay publish-only per ADR-0086. D9 needs no new carrier (ADR-0138 D3 item 5 and its pinned absence), as the ruling states, so ADR-0138 is untouched. ## Verification Diff: 2 files, +2 / -1, both under `docs/adr/`. Gate families derived with `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` at `c45ec439d` (merge base `32e03d2fd`): 19 commands, each run with its exit code captured before any pipe. All 19 exit 0. `pnpm --filter @objectstack/lint run check:doc-formula-expressions` first exited 3 (PREREQUISITE NOT MET: `@objectstack/formula` not built in this worktree, so nothing was measured); after `turbo run build --filter=@objectstack/formula --filter=@objectstack/lint` it exited 0. Tier H: every path is `docs/adr/**`. This PR stays draft and is landed by the maintainer. It carries `skip-changeset`: nothing under `docs/adr/` is published. ## 维护者速读(草稿) **改了什么** 两份 ADR 各改一处文字,不动任何代码。ADR-0090 的状态区加一行「已修订」:委派管理范围里的两项权限「管理岗位与权限集的绑定」和「编写环境权限集」退役。ADR-0086 权限归属表里 `adminScope` 那一行,删掉「`authorEnvironmentSets` 保持包内权限集只能发布」的说法,改为:委派范围只负责分配和授予,从不编写权限集。 **为什么改** 这两项权限早已没有任何入口在执行:它们管的「绑定行」和「权限集行」已随 ADR-0131 D3 退役,现在岗位包含哪些权限集、权限集里写什么,都是环境元数据定义,只有持有 `manage_metadata` 的管理员能改,委派范围根本读不到。管理员勾上这两个开关,被委派的人什么也得不到。您已批准裁决 A(退役);代码那半在主 PR 里,这份 PR 只是把决定写进 ADR,让以后读 ADR 的人不再以为分公司管理员可以改岗位定义。 **风险与代价(含回滚)** 纯文字,零运行风险。如果主 PR 最终没有落地,这两行就会和代码不一致,所以最好在主 PR 落地前后合并。回滚就是 revert 这一个提交。 **席位意见** **你要做的** 看一眼这两行措辞是否准确;没问题就批准并合并(Tier H,只能由您落地)。建议与主 PR 同一批次处理。 --- _Generated by [Claude Code](https://claude.ai/code/session_01LFqdRsuM5nkqoJdHd5ztVk)_ Co-authored-by: Claude <noreply@anthropic.com>
1 parent 8d05456 commit dd4ef38

2 files changed

Lines changed: 2 additions & 1 deletion

File tree

‎docs/adr/0086-authz-metadata-config-boundary-and-cross-package-composition.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -443,7 +443,7 @@ except where noted:
443443
| RLS policy / Sharing rule / OWD `sharingModel` | metadata / hybrid / metadata | Unchanged in class. `sharingModel` default flipped to `private` for custom objects (ADR-0090 D1) and gained `externalSharingModel` (D11). `sys_sharing_rule` is **record-authoritative** (seed-not-clobber), per the ADR-0094 addendum. |
444444
| **`everyone` / `guest`** built-in positions | **config** (admin-confirmed) | NEW default-grant mechanism (ADR-0090 D5/D9) that replaces the `member_default` fallback + ADR-0056 D7 default-profile. Packages *suggest* bindings; admins confirm. High-privilege bits on `everyone`/`guest` are lint-blocked. |
445445
| **Assignment** `sys_user_position` / `sys_position_permission_set` (was `sys_user_permission_set` / `sys_role_permission_set`) | **config / data** | Tables renamed (ADR-0090 D3); still the universal DEFINITION↔ASSIGNMENT line. ADR-0091 adds `valid_from`/`valid_until` — assignment is now *time-boxed* config. |
446-
| Delegated-admin **`adminScope`** on a set | **metadata (definition) + config (grant)** | NEW (ADR-0090 D12): admin capability itself is scoped (BU subtree + assignable-set allowlist + no self-escalation); `authorEnvironmentSets` keeps package-managed rows publish-only per this ADR. |
446+
| Delegated-admin **`adminScope`** on a set | **metadata (definition) + config (grant)** | NEW (ADR-0090 D12): admin capability itself is scoped (BU subtree + assignable-set allowlist + no self-escalation). The scope assigns and grants; it never authors a set: `authorEnvironmentSets` is retired (2026-10-15, ruling of record 6181988435 on #23488), because a permission set is an environment definition whose write is `manage_metadata`'s ([ADR-0131](./0131-total-organization-ownership-no-null-organization-id.md) D3), and package-managed sets stay publish-only per this ADR. |
447447
| Organization / tenancy / actual users & teams | **config / data** | Unchanged. Tenancy is now an explicit kernel service (ADR-0093) and tenant isolation an always-first Layer 0 (ADR-0095). Teams *receive* sharing, never carry capability (ADR-0090 D8). |
448448

449449
> **Note (2026-10-14) — the position → permission-set binding is a definition now.**

‎docs/adr/0090-permission-model-v2-concept-convergence.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
· **Amended** (2026-10-13, ADR-0138 D3/D4) — D9's `guest` anchor bindings resolve for anonymous requests, in the organization ADR-0138 D4 resolves; an empty set denies all.
55
· **Amended** (2026-10-14, [ADR-0131](./0131-total-organization-ownership-no-null-organization-id.md) D3/D13) — two of the row objects D3 renames into, `sys_position` and `sys_position_permission_set`, and the `sys_capability` D5 names, are retired by #15204 stage 8 (`66949b7729`, 2026-10-13): a position is a metadata-registry definition that names its sets in `PositionSchema.permissionSets`; `sys_user_position` stays. See the notes under D3, D5 and D8.
66
· **Amended** (2026-10-14, ruling of record 6159300530 on #23268, letter A) — D11's external org-wide default is retired: external visibility is the [ADR-0095](./0095-authz-kernel-tenant-layer-and-posture-ladder.md) `EXTERNAL` rung, explicitly shared rows only. See the note under D11.
7+
· **Amended** (2026-10-15, ruling of record 6181988435 on #23488, letter A) — D12's position↔set binding right and its environment-set authoring right are retired (`AdminScope.manageBindings` and `AdminScope.authorEnvironmentSets`, ADR-0049 enforce-or-remove): a position's sets and a permission set's body are environment definitions, and the definition write is `manage_metadata`'s per [ADR-0131](./0131-total-organization-ownership-no-null-organization-id.md) D3, never a delegate scope's. D12's *what* is user↔position assignments (and direct set grants) inside the subtree; read its bindings and authoring clauses as superseded by this line.
78
**Deciders**: ObjectStack Protocol Architects
89
**Builds on**: [ADR-0049](./0049-no-unenforced-security-properties.md) (enforce-or-remove),
910
[ADR-0056](./0056-permission-model-landing-verification.md) (permission-model landing verification),

0 commit comments

Comments
 (0)