Repository navigation
docs: close out the #13564 family under ADR-0131; supersede #13636; the tenancy docs state the three sentences #15214
Description
Dispatched in parallel to the 18.0 release, which it does not gate. This is the open-source docs half. Ruling record 6261853191 on #15194 takes C11 off the 18.0 release gate. The cloud half stays with objectstack-ai/cloud#1979 (intake 6251201392).
History: until 2026-10-19T07:19Z this card was pm:blocked on #15193, #15212 and objectstack-ai/cloud#1979. #15193 is closed. Ruling 6261853191 releases the docs half from #15212. The cloud dependency belongs to the cloud half (epic seat session_01Y5583bs2RDd53MH6kM1ca3).
Part of #15194 (ADR-0131 execution tree).
In one sentence. Close the card family that produced ADR-0131, and make the tenancy documentation say the record's three sentences instead of describing the mechanism it replaced.
Scope. Rule #13564 by pointer to ADR-0131 — the two read-side ledgers stay as the inventory's provenance, they are not deleted. Close #13636 as superseded, with a comment pointing at ADR-0131 §1.6, and leave PR #14923 unmerged with the same pointer (the "declare an organization-less write" alternative is rejected in §5). Answer #11611 in the tenancy documentation. Record #10103's warn-not-reap posture as superseded by C7's ceremony. Update the content/docs tenancy and permissions pages and the driver docblock to state the three sentences:
- A managed package's metadata is not in the database; its definitions are sealed; customization is environment-level state.
- A row with an organization column was written by that organization; the column is
NOT NULL; references to declared items are by machine name. - A table with no organization column is deployment-level or code-level, protected by permissions rather than by the wall.
⛔ content/docs/releases/ is not touched by this card. Release notes are written centrally at release time; the v18 upgrade ceremony's prominence there (D10) is the release writer's input, delivered as this line's changesets — not as a row appended per PR.
Refs: ADR-0131 (all decisions) · #13564 · #13636 · PR #14923 · #11611 · #10103.
Activity
os-steve commentedon Sep 5, 2026
Patrol row H19 (UNJUDGED) judged by hand — the block stands. No state change.
domain:devx @ objectstackseat (#6023), sessionsession_01PU9zBGbH2s2ZtxSyu963M3, round 1, 2026-09-05T23:0xZ. Half-state patrol #9857 (sweep 2026-09-05T19:51:14Z) could not resolve 1 of this card's 3Blocked-by:targets and correctly refused to call the block healthy:The row is explicit that nothing in a later sweep resolves it on its own and that the target must be judged by hand. Judged:
The unreadable target does not change the verdict, because the block does not rest on it
Blocked-by: #15193, #15212, objectstack-ai/cloud#1979— and this card's own body names which one gates it:Read at 2026-09-05T23:0xZ: #15193 is OPEN (
[gate] the v18 development line is not open — ADR-0131 execution cards are blocked on this card,priority:p1·tracking·target:v18). #15212 is also OPEN (pm:blocked). Both in-repo targets resolve and both are still running.⇒ The block is sound on an in-repo, readable, positively confirmed target.
objectstack-ai/cloud#1979is unreadable to this seat too —objectstack-ai/cloudis outside this session's repository scope, exactly as it is outside the patrol's credential — but its state is not load-bearing: even if it had closed an hour ago, #15193 alone holds this card blocked by the card's own instruction. ⛔ Nothing is released here, and ⛔ no attempt was made to "fix" the unreadable target on the card, per the row's own instruction.cloud#1979remains unknown to this lane. What is established is only that it cannot be the deciding target while #15193 is open. When #15193 closes,cloud#1979must be judged before this card moves — by a seat withcloudaccess, or by the credential change the patrol row names as routing/security's call. This card istarget:v18and the whole ADR-0131 execution tree (#15194) is blocked behind the same gate, so that judgement is not due today.Row discharged for this sweep: UNJUDGED → judged, block confirmed, no label written.
Generated by Claude Code
claude commentedon Sep 14, 2026
巡查锚 H19 的人工判定 —— 本卡阻塞成立,⛔ 无需
cloud#1979的读数domain:devx执行席session_017ef78bLdybu3AffehKkhfk· 判定读数 2026-09-14T10:12Z · 处置半状态巡查锚 #9857 点名本车道的 H19 行锚 #9857 把本卡列为 H19:
pm:blocked,而 3 个Blocked-by:目标里有 1 个(objectstack-ai/cloud#1979)对巡查凭据回 HTTP 404(该仓对这次 sweep 不可读)。锚自己写明:⛔ 重跑无用,须人工判。本评论即那次人工判。判定:阻塞成立,且不依赖那个读不到的目标
本卡正文的
Blocked-by: #15193, #15212, objectstack-ai/cloud#1979,逐个现读:[gate] the v18 development line is not open — ADR-0131 executionfeat(spec,drivers,objectql,plugin-security),本身也是pm:blockedobjectstack-ai/cloud#1979⇒ 两个本仓可读的目标都是 open,其中 #15193 正是那道 v18 门本身。
Blocked-by:是合取:只要有一个未关,卡就该留在pm:blocked。⇒ 结论与cloud#1979的状态无关,那个读不到的目标今天不承重。这条 H19 行的处置
pm:blocked。本判定确认现状正确,⛔ 不是状态变更。cloud#1979才可能成为唯一未关目标,届时才真正需要一次跨仓读数。⇒ 解锁扫描在 [gate] the v18 development line is not open — ADR-0131 execution cards are blocked on this card #15193 关闭时,必须先取得cloud#1979的现状再放行,⛔ 不得因为"上次判过"就放行。target:v18板上项;它不可派发这一点不变。⇒ 锚上的 H19 行按上述处置完毕。⛔ 本判定不声称
cloud#1979已关或未关 —— 本席没有读过它,只声称它今天不影响结论。Generated by Claude Code
fix(pm): H19 judges a `Blocked-by:` block against the body's target s…
hotlong commentedon Sep 18, 2026
H19 reading served from the
repo:cloudseat (the sweep's credential cannot readobjectstack-ai/cloud; this seat can).GET /repos/objectstack-ai/cloud/issues/1979at 2026-09-18T03:58Z:stateopenstate_reasonclosed_atassigneesecurity,pm:blockedSo the target is open, unassigned, and itself
pm:blocked— a live dependency, not an instrument gap. This card stays blocked on it.Blocked-by:line wrapped in backticks. A strict^Blocked-by:anchor misses it and mis-reports the card; the parse has to tolerate decoration (backticks, bold, quote prefixes).Generated by Claude Code
pm(half-states): H19 founds every verdict on the set it judges (objec…
objectstack-fleet commentedon Oct 18, 2026
Intake into the epic lane
epic:#15194· epic PMsession_01Y5583bs2RDd53MH6kM1ca3(os-steve) · 2026-10-18T14:40Z. ⛔ Not a claim.pm:epicis added after this comment; the state label stays as it is. The maintainer handed this tree's whole remaining development to the epic seat (delegation record: #15194's body; seat record 6251069534 there).organization_idNOT NULL per cleared table; one predicate for Layer 0 and every driver; bothorWhereNullarms, the__global__sentinel and the #13491 ledger retire (ADR-0131 D1/D8/D9) — protocol 18 #15212); the cloud half stays with objectstack-ai/cloud#1979.objectstack-fleet commentedon Oct 19, 2026
Claim: PM loop round 9 · 2026-10-19T07:20Z
Session:
session_01Y5583bs2RDd53MH6kM1ca3Account:
os-steve(the seat's linked user asGET /useranswers it; the card's assignee)Branch:
claude/issue-15214-c11-fresh-install-docs(docs and riders). The ADR-0131 D14 dated note goes on a second branch,claude/issue-15214-c11-d14-note, as its own PR.docs/adr/**is governed (Tier H), so it must not hold the docs PR.Worktree: the cloud session's own checkout (
mode:cloud)Domain:
domain:devxSeat:
epic:#15194(the epic lane)File surface, read on
origin/mainae6bd1a69. Stop on a breach and explain it in the report.content/docs/**tenancy, permissions, deployment and getting-started pages, and the SQL driver's tenancy docblock: the card's three sentences, plus the 18.0 fresh-install /single-only statement.packages/runtime/src/organization-ownership-boot-guard.ts,organizationOwnershipRefusalMessage: one sentence;packages/cli/src/utils/tenancy-posture-hints.ts,TENANCY_POSTURE_FIX_HINTS;os doctorposture line.docs/adr/0131-total-organization-ownership-no-null-organization-id.mdonly.content/docs/releases/.content/docsfiles open PR fix(client,platform-objects,docs): in-system copy says "this system", not "this environment" (cloud#3002 ruling A) #24482 touches.claude/issue-15212-8b-stamp-or-refusetouches. That meanspackages/objectql,packages/core/src/security,plugin-securityandplugin-auth; the dev re-measures this.Container & model:
S,mode:cloud,model: TIER_DEFAULTClause-②: no — docs, a dated ADR note and three operator-facing message strings; no API, schema, rule or permission face
Responsibility: n/a — a ruled scope stage (ruling records 6259698357 and 6261853191 on [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194)
Thread-read: 6261853191
Serial constraints cleared:
content/docs/api/client-sdk.mdx,api/plugin-endpoints.mdx,permissions/authentication.mdxandpermissions/permission-sets.mdx; these are fenced out above.organization_idNOT NULL per cleared table; one predicate for Layer 0 and every driver; bothorWhereNullarms, the__global__sentinel and the #13491 ledger retire (ADR-0131 D1/D8/D9) — protocol 18 #15212) is in flight with no PR yet; its packages are fenced out above.ae6bd1a69, so its six docs sentences are on the base.objectstack-fleet commentedon Oct 19, 2026
os-dev-report
{
"issue": 15214,
"status": "done",
"branch": "claude/issue-15214-c11-fresh-install-docs",
"pr": "#24506 (docs + riders, head 77a7a78); #24507 (ADR-0131 D14 dated note only, branch claude/issue-15214-c11-d14-note, head c6c8dd6, Tier H: the maintainer merges)",
"session": "session_01L9ZWcgyzEyyKR2nnDzto54 (dispatched by the epic seat session_01Y5583bs2RDd53MH6kM1ca3; the newest Claim on #15214 is 6261901354 and names this branch, verified before work)",
"premise_still_valid": true,
"summary": "PR 24506 has the docs and the riders. The tenancy page gains 'Who owns a row': ADR-0131's three rules, 18.0 single stamping under 8b's ruling (stamped with the Default Organization, or refused for zero or several organizations), and a callout answering the platform-tables question of 11611. The existing 18.0 callout gains two facts: 18.0 databases take the 18.x path, and the walled refusal covers the os boot path only (one-shot boots and embedded hosts are not refused and are not supported walled deployments). The posture table's single cell 'filled in on write: no' is corrected. NULL-as-global wording is reworded in sharing-rules, permissions-matrix, rls and system-context row 23d, and in the SQL driver's applyTenantScope docblock (comment only). The riders: one sentence in organizationOwnershipRefusalMessage; TENANCY_POSTURE_FIX_HINTS keeps group and isolated but suffixes '; refused at boot in 18.0, which supports single only'; os doctor adds a 'Tenancy posture' warning row under a walled posture. The changeset is .changeset/15214-c11-fresh-install-messages.md, patch for cli and runtime. PR 24507 adds the D14 dated note (sprint 6259899486, 18.0 databases on the 18.x path, the walled refusal on the os boot path only, C11 off the gate per 6261853191), with maintainer quotes verbatim. No file of 8b's branch (36 files, fetched at af977a6), of open PR 24482, of serve.ts or of migrate/organization-ownership.ts is touched, so no rider was dropped. No card close-out, comment or label write was made on 13564, 13636, PR 14923, 11611 or 10103.",
"tests": "At 77a7a78, whose tree is byte-identical to the measured tree. Lock: pnpm --filter '@objectstack/cli^...' build gave VERDICT command-exit 0. cli unit (vitest --project unit): 308/312 files passed in the first run. The 4 others are outside the diff: boot-preparation-parity and hook-timeout-override-refusal hit 'Test timed out in 5000ms' under gate-sweep load; published-subpath-console and published-subpath-hook-body said 'packages/cli is not built'. After pnpm --filter @objectstack/cli build they were rerun: the 2 published-subpath files passed, and the 2 timeout files passed (2/2 files, 41/41 tests, VERDICT 0). cli typecheck: exit 0. runtime test: 421/421 files, 6643 passed, 19 skipped. runtime typecheck: exit 0. Pins moved: serve site 6 and doctor leg (i) and the CONTROL carry the 18.0 suffix. The doctor-tenancy-posture-report and doctor-env-provenance controls moved from isolated to single, because 'a posture that can start' is false for isolated in 18.0. New: a walledPostureFinding sweep and an in-process os doctor run under group (warning, exit 0). The boot-guard test asserts the 18.0/17.x answer appears ahead of the command. No ablation: only message strings and a new advisory row changed. cli integration tier: declared to CI (no integration-tier or spawn-entry file touched).",
"gates": "PR 24506: dispatch-gates --commands named 102 families, plus 48 roster commands on stderr. All 150 were run, exit codes captured before any pipe. --ran: '102 derived famil(ies) accounted for — 102 run, 0 NOT-MEASURED (a DERIVED zero — all 102 recorded an exit code and none of them is 3)'. Seven first answered exit 3 (PREREQUISITE NOT MET: missing dist, or a shallow fixture). After building client-react, studio and 6 packages, and fetching 621a487, all seven exit 0. Four roster gates need PR or workflow context: closing-target-claim, partof-closing-keyword, single-claim-paths, governed-queue-guard (exit 2/1, NOT WIRED). partof-closing-keyword with this PR body as PR_BODY exits 0. PR 24507: 19 derived plus 55 roster, all run; --ran 19/19, 0 NOT-MEASURED. check:doc-formula-expressions is 0 after building lint. check:dts-closure and check:published-readme-exports are NOT MEASURED there (prerequisite, no builds in that worktree). partof-closing-keyword with the body: exit 0. CI at report time: 24506 head 77a7a78 has 38 check-runs: 5 success, 5 skipped, 27 in_progress, 1 queued, 0 failed. 24507 head c6c8dd6 has 22: 1 success, 1 skipped, 20 in_progress, 0 failed. Conclusions are in_progress; the seat reads CI convergence. NOT MEASURED locally, CI's: Build Docs, Build Core, the Test Core shards, the type-check lanes.",
"mcp_calls": "0 — every GitHub read was an unauthenticated REST GET to api.github.com; no MCP tool was called",
"api_writes": "3 relay strokes (POST /repos/objectstack-ai/objectstack/dispatches). Stroke 1 (run 39227453121): POST /pulls x2 (24506, 24507) and POST /issues/{n}/assignees x2 (os-steve), both read back byte-identical. Stroke 2 (run 39227687975): this report, POST /issues/15214/comments x1 (comment 6263677182). Stroke 3: PATCH /issues/comments/6263677182, correcting this field, which first said 3 strokes when 2 had been sent. git push is not counted: 2 branches, plus one --force-with-lease on the docs branch to squash its own WIP commits before any PR existed (all five §3 criteria held; the tree was byte-identical)",
"open_questions": [
{
"question": "os doctor: warning or error for a walled posture in 18.0?",
"options": [
"A warning (taken): exit code unchanged, the row names the os serve refusal; one-shot commands doctor fronts still boot walled",
"B error: mirrors the unrecognized-posture finding's rule that doctor must not call an environment serve refuses 'functional'; changes doctor's exit code for walled environments"
],
"recommendation": "A, taken. The row is temporary (the 18.x restore deletes it, with the serve refusal). serve's refusal is already loud and fatal. An exit-code change is a bigger operator-facing face than this rider's 'add the 18.0 sentence'. B is a one-word change if the seat prefers it."
},
{
"question": "Card sentence 2 says 'the column is NOT NULL'. 8e (NOT NULL) moved to 18.x per 6259698357 item 3. How should the docs word it?",
"options": [
"A (taken): 'every such row carries its organization; NULL is not an owner', without claiming the DDL constraint",
"B: state NOT NULL now, which is false for an 18.0 database"
],
"recommendation": "A, taken. The 18.x docs pass can add the constraint wording when 8e lands."
},
{
"question": "TENANCY_POSTURE_FIX_HINTS: drop group and isolated from the fix list, or say they are refused?",
"options": [
"A (taken): keep them, with the suffix '; refused at boot in 18.0, which supports single only' (one constant, WALLED_POSTURE_RELEASE_NOTE, that the 18.x restore deletes)",
"B: drop them from the list in 18.0"
],
"recommendation": "A, taken. It is the smaller truthful change: the list enumerates the posture vocabulary, and two pins assert every posture is listed."
},
{
"question": "A dispatch-word conflict about the boot-guard pins",
"options": [
"The dispatch said 'update its test pins'; os-dev.md says message prose is not pinned beyond named subjects"
],
"recommendation": "os-dev.md followed. The new assertion checks the named subjects (the '18.0 does not upgrade a v17 database' clause and '17.x release until the 18.x release') and their order ahead of the command, not the full prose."
}
],
"out_of_scope_findings": [
"class: none (noted, not filed) · docs outside the tenancy and permissions pages still describe the COALESCE(organization_id, 'global') index key and the NULL partition (data-modeling/indexing.mdx, protocol/objectql/schema.mdx, deployment/seed-tenancy-repair.mdx, deployment/cli.mdx). The mechanism is live in 18.0 (8d moved to 18.x), so the pages are true today · carrier: none · noted in PR 24506 Acceptance notes",
"class: none (noted, not filed) · system-context.mdx row 62 (the organizations plugin's elevated insert landing NULL under a wall) is walled-posture text, left as is because 18.0 refuses walled boots · carrier: none · noted in PR 24506 Acceptance notes",
"deviation: an unquoted shell heredoc in this session expanded backtick spans while editing the PR 2 body draft. It ran one read-only dispatch-gates derivation in the primary checkout, which found nothing to derive; the other fragments failed as command-not-found. Nothing was written to the repository, and the body was rewritten before the PR was created"
]
}
objectstack-fleet commentedon Oct 19, 2026
Landed and closed · epic PM
session_01Y5583bs2RDd53MH6kM1ca3(os-steve) · 2026-10-19T12:15Z. The open-source half of C11 is done. The cloud half stays with objectstack-ai/cloud#1979, per the split in intake 6251201392.TENANCY_POSTURE_FIX_HINTS, theos doctorwalled rowTIER_DEFAULT); not governed5b14b7f3a(held until 8b landed)246aba0b3The card's close-outs.
completedandnot_plannedrespectively.GET /pulls/14923→ 404), so no pointer can be posted there.content/docs/deployment/tenancy-modes.mdx, in "Platform tables with no organization". A pointer comment has been posted there.Carried to 18.x (in #24489, the restore): delete
WALLED_POSTURE_RELEASE_NOTE,walledPostureFindingand the boot-guard 18.0 sentence, together with the rest of the guards.