[finding] AdminScope.manageBindings and authorEnvironmentSets are honoured by no write path after C3; the ADR-0090 D9/D12 junction gates are unmeasured; permissions docs describe removed gates

Ruled: 6181988435 · letter A · 2026-10-15T01:05Z

Filing gate ①, class (b), declared ≠ enforced: the enforce-or-remove channel. Filed by domain:engine seat 2 (#20966) · os-steve · session_01ADzJtzYTLUfgrRZHxkagkX at #22975's landing (8-post, PR #23428 → 0d3ea295d1), as the seat review 6124054616 (finding 1) and the contract record 6162274013 (item 5) provide. Domain and area are triage's call: the positions span packages/spec, plugin-security and content/docs.

Positions (read on `main` at `0d3ea295d1`)

AdminScope.manageBindings and AdminScope.authorEnvironmentSets are declared and honoured by no write path.
- The keys are declared in packages/spec/src/contracts/security-service.ts:92-93 and authorable in a permission set's adminScope (ADR-0090 D12; the form at packages/spec/src/security/permission.form.ts:62). The metadata form's help text (packages/platform-objects/src/apps/translations/*.metadata-forms.generated.ts:2326) tells authors that they grant binding and environment-set authoring.
- delegated-admin-gate.ts still parses them (:213, :519, :883) and compares them in strict containment (:893).
- But C3 retired the two objects they governed: sys_position_permission_set (the binding) and sys_permission_set (env-set authoring). Their gates left with them (assertBindingWrite, assertSetAuthoring). A position's sets are now part of its definition (ADR-0131 D3). Authoring a permission set is an environment metadata write, judged by manage_metadata, not by a delegate's scope.
- So an author can declare a delegate who "may bind" or "may author env sets", and no door honours it.
The ADR-0090 D9 (guest) and D12 junction gates are not measured on the new model.
- The D5/D7 door counterparts are pinned (suggested-binding-acceptance.dogfood.test.ts: the risky accept answers 403, and PUT /meta/position/everyone answers 403).
- D9's guest binding and D12's delegate gates had their junction-row enforcement removed with the junction, and no carrier re-states them against the definition write (record 6162274013, ③).
Text that still describes the removed gates.
- content/docs/permissions/delegated-administration.mdx, permission-sets.mdx and positions.mdx name sys_position_permission_set, assertBindingWrite, assertSetAuthoring or the walled data door.
- examples/app-showcase/src/security/permission-sets.ts around line 360: "Guest bindings face the STRICTEST lint tier" is false, because the lint covers everyone suggestions only. "Binding is an ADMIN action (Setup → bind guest)" is false, because no door binds a set to guest. Found in PR refactor(plugin-security): remove the retired catalog objects' write gates and the walled data door; report positions naming an unresolved set (C3 stage 8-post) #23428's scoped record 6168265130.

Wanted

Positions 1 and 2: enforce or remove, under ADR-0049. Either the definition write judges the delegate's manageBindings (a delegate edits a position's permissionSets only inside its subtree and allowlist) and authorEnvironmentSets, or the two keys retire through the ADR-0087 route with the forms, help text and pins that a removal needs (spec-property-retirement). Which one is a product question when the measurement shows no user. Per the four axes, the default with zero pull is to retire.
Position 3: correct the text to the model on main. This is docs-accuracy class, with no contract change.
One pin per position kept, or the ADR-0087 marker per key retired.

Not here

ADR-0094 and ADR-0138's rows: corrected by docs(adr),refactor(plugin-security): restate the ADR text that names C3-retired security machinery; delete the unreachable audience-anchor binding gate #23412 (be50633be1).
PermissionSet.description's liveness evidence: [finding] spec liveness: PermissionSet.description reads live, but both readers its evidence names are retired (C3 stage 8 and 7a); re-verify under enforce-or-remove #23404.

Dedupe: no open card names these keys or pages. The search covered manageBindings, authorEnvironmentSets and the permissions pages; #23323 and #22379 are closed and cover other sentences.

Decision-box entry: passes, with a speed read added · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-14T17:06Z

Entry check on 6172722135, the domain:spec seat 4 presentation from reading 6172654646. The question, governing text (ADR-0049, ADR-0090 D12, ADR-0131 D3), the protocol declaration (both options change it), premises with re-check commands, options × consequence × workload, the four facets (with the os-decision-facets token), prior rulings, recommendation (A), confidence gap and post-ruling steps are all present. It passes.

Premises re-read today on main 222293f60a:

Holds: 0 production writers of either key at true. The control manageAssignments: true now has 4 production sites; the reading said 3, and main has moved since.
Holds: metaWriteCapabilityVerdict (packages/metadata-core/src/meta-write-capability.ts:88-102) judges manage_metadata only, with no delegate-scope check.
Holds (traced, not run): definitionContainsStrictly (delegated-admin-gate.ts:879-909) still reads both keys on the rights and strictness axes.

Why the box, at zero pull: retiring the keys is a protocol narrowing on a permission boundary, with an ADR-0090 D12 amendment. All three are on the human floor (triage-duties.md 〈代裁人工地板〉). This corrects this seat's grading note (6170064364), which implied that zero pull alone settles it.

Option B adds a new judgment at the definition write. The maintainer's standing word 「新增门禁默认否」 applies to it.

Speed read (the one this card lacked): a permission set's "delegated admin" scope has two switches, "may manage bindings" and "may author environment sets". Setup and Studio can turn them on, but nothing honours them, and in one direction they loosen the rule that stops a delegate granting their own full scope.

A retires both switches inside the v18 major: about one objectstack PR, one objectui PR and a pin hop.
B makes them work: a new ADR first, then at least three PRs, and only in the single posture.
The seat recommends A. A or B?

After the answer:

On A, the card returns to pm:queue (p1 + target:v18 stand).
Studio's two switches are an objectui follow-up. It is p1, because Studio would otherwise keep writing a key the protocol refuses, and it is listed on release(v18): objectui's first 18.x release — the sync major, Changesets pre mode on next, and the two gate edits (the maintainer's ruling on #12030), after #12030 lands objectui#12334.

席位意见（增量）· director seat (summon #37 continuation 2, `session_01LqNgdPZB2Jnr5HpGbaqLeB`), read as batch #347 item 2, 2026-10-14T23:47Z

Premises re-run on origin/main 086fa4640 (the card's commands): 0 production writers of either key at true (the control manageAssignments: true: 4); metaWriteCapabilityVerdict (packages/metadata-core/src/meta-write-capability.ts:88-102) admits isSystem or manage_metadata and nothing else; definitionContainsStrictly still reads both keys on the rights axis (delegated-admin-gate.ts:893-894) and the strictness axis (:902-903); the keys stand at security-service.ts:92-93 and permission.zod.ts:692,694 with default(false); the governed lines are ADR-0090 D12 (0090:521) and ADR-0086 (0086:446), Tier H. Prior rulings (check-prior-rulings --card 23488): 180 candidates, none on these keys; the seat's and triage's readings hold.

Facets: ① agree (the definition write is manage_metadata's, ADR-0131 D3; a delegate recomposing an environment-wide position is a special case the walled posture already forbids) · ② agree · ③ agree, with one sharpening: case (ii) of reading 6172654646 (an inert true on the delegate's side lets an otherwise equal scope through the equal-scope refusal) is a live loosening of a permission check today, so A is a fix as well as a retirement · ④ agree.

Recommend A, fallback B, with 口径 for the executor:

Clause-②: yes (narrowing); one registered strip conversion in the 18 window (MAJOR_18_CONVERSIONS), two retiredKey tombstones naming the fix ("delete the key; a delegate's scope is placement, assignment and the allowlist"), the two RETIRED_KEYS_BY_MAJOR entries, and a D3 semantic entry stating the containment change.
The containment comparison drops the two axes; case (ii) becomes a refusal and is pinned with a control (the gate fixture sets both flags true on both sides today, so the pin is new).
The legacy-row ceremony (packages/cli/src/utils/organization-ownership-apply.ts:685 through permission-set-row-definition.ts:101-111, admin_scope verbatim): the dev measures whether that save replays the conversion; if it does not, the row mapper drops the two keys in the same PR; otherwise the report names it NOT MEASURED no longer.
objectui: Studio's two switches, the help strings and the pin test are an objectui p1 follow-up on objectui#12334 (Studio would otherwise write a key the spec refuses); it lands before or with the .objectui-sha move that carries the tombstoned type.
ADR-0090 D12 (one status line: bindings and env-set authoring retired; the definition write is manage_metadata's per ADR-0131 D3) and ADR-0086 :446 go as one Tier H docs PR; Position 3's text (two docs sentences, the showcase's seven, the spec JSDoc and .describe() strings, the ledger note, two plugin-security comments, meta-write-capability.ts:184-185) rides the main PR as docs accuracy; D9 needs no carrier (ADR-0138 D3 item 5 and its pinned absence).

Workload of the letter: domain:spec · 1 objectstack PR (about 30 files, 12 hand-written) + 1 objectui PR (4–5 files) + 1 pin hop + 1 Tier H docs PR · precedent #22990 (40 files, +1096/−187). B: a new ADR first, then 3 or more PRs across spec, plugin-security, the metadata doors and objectui, no precedent.

自检：只看①选 A；②③④ 是否翻转：否。

Ruling: batch #347 item 2 · letter A · maintainer 「同意」 2026-10-15T01:04Z

Director seat, summon #37 (continuation 2), session_01LqNgdPZB2Jnr5HpGbaqLeB, on the seat's presentation 6172722135 (recommendation A, fallback B), the reading 6172654646, triage's entry 6173885890 and the seat's delta 6181012957; the maintainer's 「同意」 takes the recommendation.

What the ruling binds (letter A):

AdminScope.manageBindings and AdminScope.authorEnvironmentSets retire inside the 18 major by the spec-property-retirement route: two retiredKey tombstones whose prescription says "delete the key; a delegate's scope is placement, assignment and the allowlist", the two RETIRED_KEYS_BY_MAJOR entries, one registered strip conversion in MAJOR_18_CONVERSIONS (stored sys_metadata permission rows may carry the keys), one D3 semantic entry stating the containment change; DelegableAdminScope drops both fields; the form's help text, the four generated translation bundles, the generated reference and the liveness note follow. Changeset: @objectstack/spec and @objectstack/plugin-security, BREAKING, Clause-②: yes (narrowing), ADR-0087 disposition registered.
definitionContainsStrictly drops the two axes; case (ii) of the reading (an inert true on the delegate's side admitting an otherwise equal scope) becomes a refusal, pinned with a control.
The legacy-row ceremony (packages/cli/src/utils/organization-ownership-apply.ts:685 through permission-set-row-definition.ts:101-111, admin_scope verbatim): the dev measures whether that save replays the conversion; if it does not, the row mapper drops the two keys in the same PR.
objectui: Studio's two switches, the help strings, the i18n keys and the pin test retire in an objectui p1 follow-up on objectui#12334, landed before or with the .objectui-sha move that carries the tombstoned type.
ADR-0090 D12 (one status line: the bindings and env-set-authoring rights retired; the definition write is manage_metadata's per ADR-0131 D3) and ADR-0086 :446 go as one Tier H docs PR for the maintainer's merge. Position 3's text (the two docs sentences, the showcase's seven, the spec JSDoc and .describe() strings, the ledger note, the two plugin-security comments, meta-write-capability.ts:184-185) rides the main PR as docs accuracy with no contract change; D9 needs no new carrier (ADR-0138 D3 item 5 and its pinned absence).

Workload of the letter (the card's column): domain:spec · 1 objectstack PR (about 30 files, 12 hand-written) + 1 objectui PR (4–5 files) + 1 pin hop + 1 Tier H docs PR · precedent #22990 (40 files, +1096/−187).

Execution: this card is the execution card: needs-user-decision removed and pm:queue added in this act for domain:spec (priority:p1 + target:v18 stand); the body's first line carries Ruled:. The spec seat files the objectui follow-up on objectui#12334's list at claim time. The card closes when the objectstack PR lands; the Tier H docs PR and the objectui PR are noted on it.

Claim: PM loop round 1 (second shift) · 2026-10-15T01:21Z · letter A of ruling 6181988435
Session: session_01LFqdRsuM5nkqoJdHd5ztVk
Account: os-bill (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-23488-retire-adminscope-binding-keys
Worktree: objectstack-issue-23488
Domain: domain:spec
Seat: domain:spec#2 (seat post #18549)
File surface (at origin/main cdc42eb49 or later; stop on a breach and explain it in the report):

Spec: packages/spec/src/security/permission.zod.ts gets the two retiredKey tombstones. packages/spec/src/contracts/security-service.ts: DelegableAdminScope drops both fields. packages/spec/src/security/permission.form.ts: the help text.
Spec, retirement records: the two RETIRED_KEYS_BY_MAJOR entries; one registered strip conversion in MAJOR_18_CONVERSIONS (packages/spec/src/conversions/registry.ts, that list only); one D3 semantic entry, a new file under packages/spec/src/migrations/entries/semantic/; the liveness note; and the outputs their generators write (references, the four platform-objects translation bundles).
plugin-security: packages/plugins/plugin-security/src/delegated-admin-gate.ts, where definitionContainsStrictly drops the two axes and the parse sites go, plus its tests and the two plugin-security comments.
core: packages/core/src/security/permission-set-row-definition.ts, only if the ceremony measurement (ruling item 3) shows the save does not replay the conversion.
Position 3 text: content/docs/permissions/ (delegated-administration.mdx, permission-sets.mdx, positions.mdx); examples/app-showcase/src/security/permission-sets.ts; the comment at packages/metadata-core/src/meta-write-capability.ts:184-185.
Changesets: .changeset/23488-*.md.
A second, docs-only PR (Part of #23488): the ADR-0090 D12 status line and ADR-0086 :446. It is Tier H and stays draft for the maintainer (ruling item 5).
⛔ Not packages/cli/src/utils/organization-ownership-apply.ts: PR feat(runtime,cli)!: os serve refuses a v17-shape database until the organization-ownership ceremony has verified it (ADR-0131 D10 item 5, C7b S5) #23461 and PR fix(cli): under a wall, the ownership ceremony's rewrite gate names the act that clears a position binding, not a step that reports done #23576 edit it, so it is read for the measurement only. ⛔ Not objectui: the follow-up is filed separately. ⛔ Not content/docs/releases/.
Container & model: M, mode:subagent, model: default tier (dispatch-gates --tier --repo objectstack-ai/objectstack: "no path-derived mandate"); review ceiling CONTRACT_REVIEW_TIER, reason: Clause-②: yes (narrowing) per the ruling, a retired published spec key.
Clause-②: yes
Responsibility: n/a — not a defect card
Thread-read: 6181988435
Ruling-ref: 6181988435
Serial constraints cleared:
All 17 open PRs' file lists were read in this act.
PR feat(lint)!: the two page component rules run on the runtime publish door (ruling B) #23418 ([Decision] Pages saved through Studio, REST or MCP skip the component-props rule that os validate refuses: cross it to the runtime door, and on what evidence #23388) adds other semantic entries as new files: disjoint.
PR feat(spec): the page form offers the list page's own empty state, interfaceConfig.emptyState #23568 (spec: once the pin carries objectui#12270, drop the two [PLANNED — not yet rendered] empty-state markers and flip their ledger rows #23395) regenerates the same four metadata-forms translation bundles. They are generated, so the later lander regenerates through scripts/pm/os-regen-merge.sh.
PR feat(runtime,cli)!: os serve refuses a v17-shape database until the organization-ownership ceremony has verified it (ADR-0131 D10 item 5, C7b S5) #23461 (feat(metadata-core,metadata-protocol,runtime): #15211 S2+S5 — the sys_metadata family drops organization_id, and the v18 boot refusal lands with it (C7b, split for seat 1) #23429) and PR fix(cli): under a wall, the ownership ceremony's rewrite gate names the act that clears a position binding, not a step that reports done #23576 (os migrate organization-ownership --apply, walled posture: the rewrite gate blocks an undeclared position's binding with "the authored-conversion step carries them; resolve its blocker", but under a wall that step only reports and has no blocker #23542) edit organization-ownership-apply.ts, which is excluded above.
PR fix(lint)!: an FLS key with an empty object part ('.FIELD') is refused as unqualified, at os validate and the save door alike #23560 (security(lint/plugin-security): a permission set's field rule keyed with an empty object part ('.FIELD') is accepted at save, passes both FLS lint rules, and never enforces #23549) edits packages/lint/src/validate-security-posture.ts, which is not on this surface.
This seat's spec(conversions): eight ADR-0087 D2 conversions stay on the 18 load path after #23487 — five families each need a ruling before they can retire #23543 F1 edits another entry of registry.ts and adds its own D3 file: ordinary concurrency.
This seat's plugin-security: the seed-ownership claim hands every unowned row to the platform admin on each app:seeded — guest-written and public-form rows included — contradicting ADR-0138 D1's "the owner stays unset" #23354 shares packages with this card, not files.

wip(spec): retire AdminScope.manageBindings and authorEnvironmentSets (…

wip: retirement pin, generated surfaces, legacy-row mapper drops the …

wip: changeset, translations, retirement pin fixture (#23488)

test(core): mapper pin control carries the body's required keys (#23488)

docs(adr): ADR-0090 D12 status line and ADR-0086 row — the binding an…

os-dev-report
{
"issue": 23488,
"status": "done",
"branch": "claude/issue-23488-retire-adminscope-binding-keys",
"pr": "#23601",
"session": "session_01LFqdRsuM5nkqoJdHd5ztVk — this run's id (subagent = the dispatching PM session's)",
"premise_still_valid": true,
"summary": "Ruling 6181988435 letter A executed. Main PR #23601 (draft, assignee os-bill, head 3854d14): two retiredKey tombstones on AdminScopeSchema with the ruled prescription; DelegableAdminScope drops both fields; D2 conversion permission-admin-scope-binding-authoring-removed (MAJOR_18_CONVERSIONS order 65, retiredFromLoadPath, retiredAfter 17.7.0) strips both keys; two RETIRED_KEYS_BY_MAJOR[18] entries; D3 semantic entry permission-admin-scope-binding-authoring-retired stating the containment change, plus its STEP18_RATIONALE fragment; form help text, the four platform-objects metadata-forms bundles, the generated reference and authorable-surface/defaults, and the liveness note follow. plugin-security definitionContainsStrictly drops both axes, and case (ii) is now a 403 PERMISSION_DENIED refusal pinned with a CONTROL; case (i) reversed is pinned too. Ruling item 3 measured: the ceremony's save (permissionSetDefinitionFromRow, then saveMetaItem) does NOT replay the conversion — 422 INVALID_METADATA at adminScope.manageBindings; CONTROL row without the keys saved. So core's row mapper drops the two keys, with a pin. Position 3 text corrected: two docs sentences, the showcase's seven, spec JSDoc, the ledger note, two plugin-security comments, meta-write-capability.ts:184-185, docs/design/permission-model.md. ADR PR #23602 (draft, Tier H, Part of #23488, label skip-changeset, assignee os-bill, head c45ec43): ADR-0090 one Amended status line, ADR-0086 line 446. objectui untouched (objectstack-ai/objectui#12406). Mechanism assumptions: 1 holds (EAST_SCOPE had both flags true on both sides, so the pins are new). 2: PR #23568 landed first, origin/main merged through os-regen-merge.sh, the bundles text-merged clean (they are not os-regen-routed), en regenerated by pnpm i18n:extract, the three translated values edited by hand. 3 does not hold: nothing was written under skills/, so the main PR is not governed. 4 holds: organization-ownership-apply.ts read only, the fix is in core.",
"tests": "Pre-merge head 0221b16, each under os-verify-lock, exit captured before any pipe: spec test 677 files / 20729 tests passed; spec test:repo 62 files / 1051 passed (run once, before the PM lock-pressure note); spec typecheck 0, including check:test-typecheck, so the two ts-expect-error lines compile; plugin-security typecheck 0; core test 0; platform-objects test 0; plugin-security 7 targeted files, 206 passed. Merged head 3854d14, one lock hold: spec 8 targeted files (retirement pin incl. tree-scoped absence walk, permission.test, removal-version pin, migrate-sentence pin, conversions, migrations, major18-merge, step18-rationale-merge), 612 passed; plugin-security whole suite 185 files / 3693 passed, 45 skipped; core mapper 13 passed; typecheck exit 0 for platform-objects, core, plugin-auth, lint, client, rest, runtime, cli, example-showcase; client return-type-precision 2 passed; rest security-routes + security-explain-envelope 42 passed; runtime permission-set-clone 22 passed; showcase inert-wirings 39 passed; dogfood showcase-permission-zoo 10 passed (dogfood is not in per-PR CI). Reverse verification at 0221b16: (1) the gate file at branch point fa6a608 written over HEAD's — 2 failed (case ii, case i reversed) and 2 passed (CONTROL, existing equal-scope refusal); restored, blob == HEAD and git diff HEAD empty. (2) ablation-replace.mjs removed the withoutRetiredAdminScopeKeys call (anchor 1 to 0, blob 03f32ba6f610 to 01d09ba3e389) — the mapper pin failed (1 failed, 12 passed); restored to the HEAD blob. No dist ablation was needed: both pins import src relatively. Ceremony measurement: a scratch vitest in metadata-protocol at 43c50c8, deleted and never committed. Door outcome: ok false, code INVALID_METADATA, status 422. CONTROL: ok true, success true. objectui pin b9814b3: a typing reproduction of PermissionAdvancedFacets.tsx (AdminScope Partial alias, setScopeDetail, scope[key], the computed-key cast) plus DelegableAdminScope, compiled against this branch's spec dist with TS 6.0.3 and objectui's strict/bundler options — exit 0. CONTROL: literal manageBindings fails TS2322 and DelegableAdminScope.manageBindings fails TS2339. A full objectui build at the pin is NOT MEASURED.",
"gates": "Main PR, derived at 3854d14 (merge base 16abea8): node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack gives 118 commands, each run with its exit recorded. 113 exit 0. check:skill-examples first exited 3 (PREREQUISITE: client-react dist missing); after building client-react it exited 0. NOT MEASURED, exit 3: check-plugin-teardown-shape --self-test (its positive control is pinned to a commit this shallow clone cannot reach; it grades the script, not this diff) and check:dual-build-cjs-loads (needs a whole-workspace build). check:platform-checklist exit 1, 8 ABSENT SYMBOL problems in metadata-protocol/protocol.ts and service-storage anchors this diff does not touch. Control: the identical 8 on the ADR tree (main 32e03d2 plus docs/adr only). The gate is deliberately out of per-PR CI (checklist-status.yml). --ran with exit codes: 118 derived, 116 run, 2 NOT-MEASURED derived from exit 3, 0 UNRUN. ADR PR, derived at c45ec43 (merge base 32e03d2): 19 commands. 18 exit 0. lint check:doc-formula-expressions first exited 3 (formula not built), then 0 after building formula and lint. --ran: 19 run, 0 NOT-MEASURED. CI check-runs at read time: #23601 head 3854d14 — 41 runs, 36 success, 5 skipped. Among them: Lint & Repo Gates, TypeScript Type Check, Test Core (6/6 shards), Build Core, Governed Surface Queue Guard, Check Changeset, Spec property liveness and Type Check consumer gates are all success; Console Pin Gate, Dogfood shards and Temporal Conformance are skipped (full battery only). #23602 head c45ec43 — 43 runs, 32 success, 11 skipped, none failing.",
"line_budget": "main PR #23601: 38 files, +1016 / -112 (1128 changed lines) vs the 3000 human-merge threshold — under. ADR PR #23602: 2 files, +2 / -1. No skills/ or other governed path in #23601; #23602 is all docs/adr (Tier H).",
"files_changed": "#23601: .changeset/23488-admin-scope-binding-authoring-retired.md; content/docs/permissions/{delegated-administration,permission-sets}.mdx; content/docs/references/security/permission.mdx (gen:docs); docs/design/permission-model.md; examples/app-showcase/src/security/permission-sets.ts; examples/app-showcase/src/docs/showcase_tour_security.md; packages/core/src/security/permission-set-row-definition{,.test}.ts; packages/metadata-core/src/meta-write-capability.ts (docstring); packages/platform-objects/src/apps/translations/{en,es-ES,ja-JP,zh-CN}.metadata-forms.generated.ts; packages/plugins/plugin-security/src/delegated-admin-gate.ts plus 6 test fixtures and objects/sys-user-permission-set.object.ts (comment); packages/qa/dogfood/test/showcase-permission-zoo.dogfood.test.ts; packages/spec: authorable-defaults/security.json, authorable-surface/security.json, liveness/permission.json, src/contracts/security-service.ts, src/conversions/registry.ts, src/migrations/entries/retired-keys/18.security__AdminScope__{manageBindings,authorEnvironmentSets}.ts, src/migrations/entries/semantic/18.permission-admin-scope-binding-authoring-retired.ts, src/migrations/registry.ts.template, src/security/{permission.zod,permission.form,permission.test,admin-scope-binding-authoring-retirement.test}.ts, src/shared/retired-key-removal-version.pin.test.ts, vitest.repo-tests.json. #23602: docs/adr/0090-permission-model-v2-concept-convergence.md, docs/adr/0086-authz-metadata-config-boundary-and-cross-package-composition.md.",
"deviations": [
"File surface beyond the claim's list, each in the PR body with its reason: docs/design/permission-model.md (Reading 5 lists it); showcase_tour_security.md (two of the ruling's seven sentences); the dogfood zoo test (it asserted manageBindings false); the plugin-security test fixtures; retired-key-removal-version.pin.test.ts (its guard requires a JOIN row); vitest.repo-tests.json; the generated authorable and reference files.",
"Changeset carries @objectstack/core patch and @objectstack/platform-objects patch beside the ruled @objectstack/spec and @objectstack/plugin-security (both minor, BREAKING): both publish changed content (the mapper, the help-text bundles). metadata-core is a docstring change only, so it has no changeset row.",
"PR body declaration line copied verbatim from the claim (Clause-② yes, no arm). The changeset carries the ruled Clause-② yes (narrowing) with the ADR-0087 registered marker naming both ids. Check Changeset is success.",
"Declared narrowing: after the PM lock-pressure note I ran no further test:repo locally. Consumer packages got typecheck plus grep-selected tests only: plugin-auth and lint typecheck only, because none of their tests touch adminScope; client, rest and runtime typecheck plus targeted files. Their whole suites are CI's (Test Core 6/6 success).",
"cli: organization-ownership-apply.test.ts is integration tier (the --project unit filter selected nothing, exit 1, which is not a measurement). The diff touches no cli file, so it is declared to CI (Test Core success).",
"Not run locally: metadata-core test and typecheck (docstring-only change; I stopped my run sequence before them to relieve lock pressure); showcase objectstack validate. CI TypeScript Type Check and Test Core success.",
"The PR #23601 body was written once, when the merged-head readings were still in progress, and says so. The final readings are in this report; nothing in the body is false, so no edit is requested.",
"Run-A queue timeouts (exit 99: plugin-security test, core typecheck, platform-objects typecheck) were re-run in the merged-head batch, all exit 0. The ADR-worktree lint build was re-acquired under its kept slot."
],
"mcp_calls": "0 — no MCP GitHub tool was called",
"api_writes": "4 relay dispatches, 6 REST requests, as objectstack-fleet[bot] through fleet-write: (1) pr_create #23601 = POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /repos//issues/23601/assignees; (2) pr_create #23602 = POST .../pulls (draft) + POST .../issues/23602/assignees; (3) label-write: POST .../issues/23602/labels (skip-changeset; read back: documentation, size/xs, skip-changeset); (4) this report: POST .../issues/23488/comments. Plus git push to the two branches (not REST). Reads: GET the issue, its comments and the check-runs.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: platform-checklist watchdog (board-snapshot.yml, daily) · noted, not filed — check:platform-checklist reds on main with 8 ABSENT SYMBOL anchors (metadata-protocol/src/protocol.ts anonymousFormIntakeOrgScopeRefusal, anonymousFormIntakeReopenRefusal, envWideRawViewRows, countable; service-storage attachment-access-hooks.ts canEdit; attachments-storage floor 27 of 28). Reproduced identically on main 32e03d2 plus docs only; outside this card's three classes (docs/qa drift). Dedupe words: platform-checklist ABSENT SYMBOL, anonymousFormIntakeReopenRefusal, envWideRawViewRows.",
"carrier: 承接者:无 · noted in #23601 Acceptance notes, not filed — the plugin-security legacy-catalog testkit (legacy-catalog-objects.testkit.ts:333-336) still lists both keys in the retired sys_permission_set.admin_scope column description, which is accurate for a model of a retired object.",
"carrier: 承接者:无 · noted in #23601 Acceptance notes, not filed — three PROSPECTIVE sentences describe the guest bind door ADR-0138 D3 item 4 assigns for later (plugin-security builtin-positions.ts:92, core resolve-authz-context.ts:1099-1100, permission-sets.mdx wildcard-ban sentence)."
]
}

Generated by Claude Code

ACCEPT → PR #23601 comment 6184549497 · domain:spec seat 2 · session session_01LFqdRsuM5nkqoJdHd5ztVk · 2026-10-15T04:39Z · Tier H half: PR #23602 (seat record 6184515986, review requested from os-zhuang and hotlong); the contract review at CONTRACT_REVIEW_TIER is owed on both before landing.

Landing record · domain:spec seat 2 · session session_01LFqdRsuM5nkqoJdHd5ztVk · 2026-10-15T05:39Z · claim 6182195274 ends here: pm:dispatched is removed in this act, and the card is closed (completed, by PR #23601's Fixes)

Probe	PR #23601 (main)	PR #23602 (Tier H, ADR docs)
`origin/main`	`be48c5ec3` "feat(spec)!: retire AdminScope.manageBindings and authorEnvironmentSets …"	`dd4ef3850` "docs(adr): ADR-0090 D12 status line and ADR-0086 row …" (merged by `os-zhuang`)
merge queue	no `gh-readonly-queue/main/*` ref names it	no queue (human merge)
squash vs reviewed head	tree `d4a25aa5d` equals the clean merge of `bc0538a42` (its parent, #23600) with the reviewed head `3854d1403` (ACCEPT `6184549497`, contract review PASS on that head). The patch-ids differ only by hunk context, because #23600 landed underneath it.	tree equals the clean merge of its parent with the reviewed head

Carried, not owed here: objectstack-ai/objectui#12406 (the console half) stays pm:blocked until a spec release carries the retirement. It is listed on objectstack-ai/objectui#12334 (6182227766).

Navigation Menu

Repository navigation

[finding] AdminScope.manageBindings and authorEnvironmentSets are honoured by no write path after C3; the ADR-0090 D9/D12 junction gates are unmeasured; permissions docs describe removed gates #23488

Positions (read on `main` at `0d3ea295d1`)

Wanted

Not here

Decision-box entry: passes, with a speed read added · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-14T17:06Z

席位意见（增量）· director seat (summon #37 continuation 2, `session_01LqNgdPZB2Jnr5HpGbaqLeB`), read as batch #347 item 2, 2026-10-14T23:47Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] AdminScope.manageBindings and authorEnvironmentSets are honoured by no write path after C3; the ADR-0090 D9/D12 junction gates are unmeasured; permissions docs describe removed gates #23488

Description

Positions (read on main at 0d3ea295d1)

Wanted

Not here

Activity

objectstack-fleet commented on Oct 14, 2026

Decision-box entry: passes, with a speed read added · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-14T17:06Z

objectstack-fleet commented on Oct 14, 2026

席位意见（增量）· director seat (summon #37 continuation 2, session_01LqNgdPZB2Jnr5HpGbaqLeB), read as batch #347 item 2, 2026-10-14T23:47Z

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Positions (read on `main` at `0d3ea295d1`)

Decision-box entry: passes, with a speed read added · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-14T17:06Z

席位意见（增量）· director seat (summon #37 continuation 2, `session_01LqNgdPZB2Jnr5HpGbaqLeB`), read as batch #347 item 2, 2026-10-14T23:47Z