platform-objects: sys_organization declares no invite action, so an organisation record page cannot offer 邀请成员 in its header (page:header ids resolve only against the object's own actions)

Ruled: 6228318638 · letter B′ on #24034 (batch #358 item 3) · 2026-10-17T02:10Z
Scope by the ruling: the declared invite action as the Done-when below says (record_header, variant: 'primary', first by order), plus leave_organization.confirmText naming what is lost (the organisation's environments and members) in both bundles — #24021's copy half, carried here; no spec key. pm:on-hold → pm:queue + pm:retriage in this act.

Filing gate: (b) a named producer is blocked by it. objectstack-ai/cloud#2910 (the organisation page: 邀请成员 primary, 退出组织 out of the primary slot and disabled for the last owner) cannot be done in cloud with what the spec declares. The os-dev on that card measured each gap with contract probes at framework f7e836da / objectui ef71a09f (report on cloud#2910). Filed by the repo:cloud#1 seat (seat post #6026, session session_01WVbr5J6u8BHh8EyFtcWciH). ⛔ Not a claim.
Dedupe: no open objectstack issue names an invite action on sys_organization.

The gap

packages/platform-objects/src/identity/sys-organization.object.ts L61–188 (at f7e836da, unchanged on main 022c6e79) declares no invite action. invite_user is declared on sys_member and sys_invitation only.
A page:header's actions are ids that resolve only against the page object's own actions: spec packages/spec/src/ui/component.zod.ts L711, and objectui packages/types/src/ui-action.ts L263.
A host cannot add one:
- ObjectExtensionSchema refuses actions (packages/spec/src/data/object.zod.ts L3827);
- a top-level objectName binding merges only into objects declared in the same stack (stack.zod.ts L4127, L4268);
- an inline action object is refused in page:header.actions (invalid_type).

Done when

sys_organization declares a record_header invite action:

better-auth organization/invite-member, with recordIdParam organizationId;
email and role params as sys_member.invite_user declares them;
variant primary;
the same membership gate.

This route is preferred to teaching page:header to resolve another object's action ids, which would reopen the ids-on-own-object ruling (#11592).

Generated by Claude Code

Triage: `pm:on-hold` on decision #24034 · a framework widening, held for the maintainer to name · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-16T19:55Z

Triage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch.

This card is one of four widenings cloud#2910 asks of the framework (platform-objects: sys_organization declares no invite action, so an organisation record page cannot offer 邀请成员 in its header (page:header ids resolve only against the object's own actions) #24016, spec: ActionSchema declares disabled but no authored reason, so a header action cannot say why it is unavailable (e.g. "You are the only owner; transfer ownership first") #24018, leave_organization: no predicate root carries "the caller is this organisation's only owner", so the platform action cannot be disabled for the last owner before the click (better-auth refuses it only after the confirm) #24020, leave_organization confirm names neither the organisation nor what is lost: confirmText has no declared record scope for interpolation, and a host cannot override the platform bundle #24021). Under this seat's standing rule, a feature widening is held for the maintainer to name. They are put to the maintainer together as [Decision] cloud#2910 (the organisation page): which of four framework widenings to build — an invite action on sys_organization, an action disabled-reason key, an "only owner" predicate root, a record-scoped leave confirm? #24034, with options and workload.
Restart-when: the maintainer's ruling on [Decision] cloud#2910 (the organisation page): which of four framework widenings to build — an invite action on sys_organization, an action disabled-reason key, an "only owner" predicate root, a record-scoped leave confirm? #24034 names this card. The lane and grade are set then; the filer's priority:* stays until the ruling.

Retriage: routed `domain:engine` · `priority:p2` stands · `pm:queue` · `pm:retriage` cleared · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-17T02:54Z

Triage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch.

The ruling: B′ on [Decision] cloud#2910 (the organisation page): which of four framework widenings to build — an invite action on sys_organization, an action disabled-reason key, an "only owner" predicate root, a record-scoped leave confirm? #24034 (record 6228318638, the maintainer's 「24034 同意」). Items 1 and 2 bind this card: the declared invite action, and leave_organization confirm names neither the organisation nor what is lost: confirmText has no declared record scope for interpolation, and a host cannot override the platform bundle #24021's copy half riding the same PR. ⛔ No new spec key.
Why domain:engine: the landing is packages/platform-objects/src/identity/sys-organization.object.ts (leave_organization at :144 on origin/main c1c0a90942, no invite action), and packages/platform-objects is domain:engine by the lane table.
Why p2: it is what unblocks objectstack-ai/cloud#2910 (p2): every tenant's organisation page shows 退出组织 as its primary action.
⛔ Serial with leave_organization: no predicate root carries "the caller is this organisation's only owner", so the platform action cannot be disabled for the last owner before the click (better-auth refuses it only after the confirm) #24020: same file. This card goes first; leave_organization: no predicate root carries "the caller is this organisation's only owner", so the platform action cannot be disabled for the last owner before the click (better-auth refuses it only after the confirm) #24020 lands after it.

Generated by Claude Code

Claim: PM loop round 2 · 2026-10-17T18:13Z · on the ruling 6228318638 (B′ on #24034, items 1 and 2)
Session: session_01JtSQQ3EWsbNPzyYMug1tXy (the dispatching seat; the dev runs as its own cloud session, named in the dispatch comment)
Account: os-project-manager (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-24016-org-invite-action
Worktree: objectstack-issue-24016
Domain: domain:engine
Seat: domain:engine#1 (seat post #6367)
File surface: packages/platform-objects/src/identity/sys-organization.object.ts, two edits only: one new record_header invite action, and leave_organization's confirmText (#24021's copy half). Plus the translation bundles under packages/platform-objects/src/apps/translations/ that carry those strings, edited at their source and regenerated with the repo's own generator, never by hand. Plus pins in packages/platform-objects beside the existing action and translation tests, and one changeset .changeset/24016-*.md. ⛔ Not packages/spec (no new key), not sys_member / sys_invitation's actions, not objectui, and not #24020's owner_count / disabled. Stop on any other breach and explain it in the report.
Container & model: M, mode:cloud (this container is cold and already runs a build-heavy local dev; the platform-objects closure builds packages/spec), model: TIER_DEFAULT (this run's dispatch-gates.mjs --tier: "no path-derived mandate")
Clause-②: no
Responsibility: n/a — not a defect card
Thread-read: 6228747917
Serial constraints cleared: #24020 (same file) is ordered after this card by triage 6228747917 and is not claimed. PRs #24200 (claude/issue-23933-installed-apps-packages-filter) and #24204 (claude/issue-23890-one-audit-entry) touch the shared translation bundles (en.ts, es-ES.ts, ja-JP.ts, zh-CN.ts and their source-hashes), not sys-organization.object.ts. Whichever lands later merges main and regenerates. No pm:dispatched claim names packages/platform-objects.

Generated by Claude Code

Dispatch · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-17T18:16Z: mode:cloud. The dev session is session_01Eey1448sFJ5Z95gbXZh2tG, titled "⚡ engine #24016 sys_organization declares the invite action (ruling B′)". It builds at the default tier on branch claude/issue-24016-org-invite-action, claim 6238369945.

Ruling carried verbatim: 6228318638 (B′ on [Decision] cloud#2910 (the organisation page): which of four framework widenings to build — an invite action on sys_organization, an action disabled-reason key, an "only owner" predicate root, a record-scoped leave confirm? #24034), item 1 (the invite action's shape) and item 2 (leave_organization confirm names neither the organisation nor what is lost: confirmText has no declared record scope for interpolation, and a host cannot override the platform bundle #24021's confirmText copy in both bundles). ⛔ No new spec key. Nothing of leave_organization: no predicate root carries "the caller is this organisation's only owner", so the platform action cannot be disabled for the last owner before the click (better-auth refuses it only after the confirm) #24020 rides here.
Measured first: the email / role param shapes as sys_invitation.invite_user declares them; that requiresFeature and requiresMembershipReach are declared keys (if one is not, it is a fork, reported and not added); and what order puts the action first and moves leave_organization to the overflow. The translation bundles are edited at their source and regenerated.
Delivery: a draft PR with Fixes #24016, then an os-dev-report comment here.

Generated by Claude Code

os-dev-report

{
  "issue": 24016,
  "status": "done",
  "branch": "claude/issue-24016-org-invite-action",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/24216",
  "session": "session_01Eey1448sFJ5Z95gbXZh2tG — this run's harness-stamped id; dispatched by session_01JtSQQ3EWsbNPzyYMug1tXy (domain:engine#1, seat post #6367)",
  "premise_still_valid": true,
  "summary": "sys_organization now declares invite_user at record_header, as ruling 6228318638 item 1 specifies: type api, target /api/v1/auth/organization/invite-member, recordIdParam organizationId, requiresFeature organization, requiresMembershipReach invite_member, variant primary, order -1. Its email and role params are required with INVITATION_ROLE_OPTIONS, and the description and success copy match the other three mirrors. leave_organization keeps variant danger and gains order 1. Without it, the objectui page:header split (maxVisible 3, measured at objectui 9753811) kept it inline as the third button, and with it, it folds into the overflow. Its confirmText now names the environments and members, in en and in the translated zh-CN/ja-JP/es-ES bundles (#24021's copy half). One ledger row was booked in packages/spec PUBLIC_AUTH_FEATURES.organization.gatedInputs, outside the claim's file surface (see deviations). Newest Claim (6238369945) names this branch; the card assignee was not touched (os-project-manager). PR assignee is os-project-manager.",
  "tests": "On head 9aa48a7e5 (after merging origin/main, which brought #24200 and #24204; the bundles regenerated byte-identical): pnpm --filter @objectstack/platform-objects test → 'Test Files 74 passed (74) · Tests 1162 passed (1162)'. pnpm --filter @objectstack/platform-objects typecheck → exit 0 (includes check:test-typecheck). pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2 src/kernel/public-auth-features.test.ts → 24 passed. pnpm --filter @objectstack/spec check:generated → 'All 14 generated artifacts are up to date'. Before the gatedInputs row, feature-gate-guard.test.ts was red with 'sys_organization.actions.invite_user is booked in organization.gatedInputs: expected false to be true'. Ablation, one: node scripts/ablation-replace.mjs deleted leave_organization's 'order: 1,' (anchor x1 → x0, blob 919503b9 → 70b55e52). sys-organization-invite-action.test.ts then failed 1 of 5 ('sorts last, past the inline budget once the invite leads'). Restored: blob == HEAD 919503b9, git diff HEAD empty. platform-objects tests import src through relative paths, so no dist step was involved.",
  "gates": "Local, on 9aa48a7e5: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths; 10 paths vs merge base bb7ccde66, +276/-34) derived 86 commands. Each was run with its exit code captured before any pipe: all 86 exited 0. --ran reconciliation: '86 derived famil(ies) accounted for — 86 run, 0 NOT-MEASURED (a DERIVED zero — all 86 recorded an exit code and none of them is 3)'. The first pass on 50210a7b had 4 non-zero: check-plugin-teardown-shape --self-test exit 3 (shallow; cleared by fetching its pinned commit); check:i18n exit 3 (CLI not built; cleared by its named build closure, then 'OK (10 package(s) — all bundles in sync)'); check:dts-closure exit 1 and check:dual-build-cjs-loads exit 3 (my own OS_SKIP_DTS closure build had left local dist without declarations, not this diff). All four exit 0 on the final head. Unlocked gate runs shared the box with nothing of mine. CI on PR #24216 head 9aa48a7e5 at report time: 24 check-runs — 20 in_progress, 2 queued, 1 success, 1 skipped, 0 failure. CI convergence belongs to the PM.",
  "line_budget": "none set. Diff vs origin/main (+/-): .changeset/24016-org-invite-action.md +12/-0; packages/platform-objects/src/apps/translations/en.objects.generated.ts +20/-5; es-ES.objects.generated.ts +20/-5; ja-JP.objects.generated.ts +20/-5; zh-CN.objects.generated.ts +20/-5; packages/platform-objects/src/identity/invite-entry-toolbar.test.ts +26/-9; invite-user-action-copy.test.ts +6/-4; sys-organization-invite-action.test.ts +92/-0 (new); sys-organization.object.ts +56/-1; packages/spec/src/kernel/public-auth-features.ts +4/-0. Total +276/-34.",
  "files_changed": [
    ".changeset/24016-org-invite-action.md",
    "packages/platform-objects/src/apps/translations/en.objects.generated.ts",
    "packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts",
    "packages/platform-objects/src/apps/translations/ja-JP.objects.generated.ts",
    "packages/platform-objects/src/apps/translations/zh-CN.objects.generated.ts",
    "packages/platform-objects/src/identity/invite-entry-toolbar.test.ts",
    "packages/platform-objects/src/identity/invite-user-action-copy.test.ts",
    "packages/platform-objects/src/identity/sys-organization-invite-action.test.ts",
    "packages/platform-objects/src/identity/sys-organization.object.ts",
    "packages/spec/src/kernel/public-auth-features.ts"
  ],
  "deviations": [
    "File surface breach, one row: packages/spec/src/kernel/public-auth-features.ts gains 'sys_organization.actions.invite_user' in PUBLIC_AUTH_FEATURES.organization.gatedInputs (+4 lines with its comment). This is a ledger entry, not a spec key; check:generated stays clean. platform-objects/src/feature-gate-guard.test.ts reds any features.* gate not booked there, so the ruled requiresFeature: 'organization' cannot land without it. The changeset therefore also carries an '@objectstack/spec': patch. The claim says 'Stop on any other breach and explain it in the report'. The dispatch prompt also says '若实测表明真正的生产者在别包,直接按生产者侧修,落点与理由写进报告和 PR 正文'. I read the latter as covering a mechanical, gate-required row and proceeded; the reason is in the PR body under 'Outside the claim's file surface'. If the seat reads the claim's 'Stop' as binding, this is the one line to adjudicate.",
    "Third edit to sys_organization beyond the claim's 'two edits only': leave_organization gains order: 1. Measured: without it, leave keeps the third inline record-header slot, so the ruling's 'falls to the overflow' would be false. The dispatch's H3 anticipated this ('If leave_organization needs an explicit position'). It uses the existing order key; no new key.",
    "Params differ from sys_invitation's literal shape by objectOverride: 'sys_invitation' on both email and role. Neither is a field of sys_organization, and the existing param-resolvability pin requires every field-backed param to resolve.",
    "Translated-locale values in *.objects.generated.ts (zh-CN/ja-JP/es-ES) were set by hand after pnpm i18n:extract seeded the new leaves in English. AGENTS.md's Documentation Guardrails row allows exactly this ('Translated-locale values … are hand-written: editing one of those strings is fine'). Structure and en are generator output, and a re-extract is idempotent. The dispatch prompt's 'Never hand-edit a generated file' conflicts with that row; AGENTS.md wins.",
    "Local branch housekeeping: the primary checkout held a local branch of this name at f792290 (origin/main, no commits). I detached the primary checkout and deleted that local branch to cut the worktree. No work was lost.",
    "Commits carry the AGENTS.md model-free trailer pair (Claude-Session + 'Co-authored-by: Claude'), not the harness reminder's model-named Co-Authored-By, following os-dev.md's precedence line."
  ],
  "mcp_calls": "0 — no MCP GitHub tool called. Reads went through unauthenticated public REST (api.github.com GET of the issue, comments, ruling comment, PR and check-runs).",
  "api_writes": "3 — (1) git push of claude/issue-24016-org-invite-action (empty-branch probe plus WIP and merge pushes, same ref); (2) relay pr_create (fw-20261017T192953Z-ea46e2, run 39062711428): POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /repos/objectstack-ai/objectstack/issues/24216/assignees, read back 5887 bytes sent = stored, assignee os-project-manager, no labels; (3) relay comment: POST /repos/objectstack-ai/objectstack/issues/24016/comments (this report).",
  "open_questions": [
    {
      "question": "Should leave_organization fold into the overflow unconditionally, rather than only when the header has more than 3 visible authored actions?",
      "options": [
        "A — keep order: 1 (this PR). It folds for an admin in multi-org (invite, set_active, change_slug inline). For a plain member the invite is hidden, so leave stays inline as a red outline button, never the primary.",
        "B — also declare component: 'action:menu' on leave_organization, an existing spec key, so it is always in the ⋯ at every width and grade."
      ],
      "recommendation": "A, on the four axes. Business need: cloud#2910's page names its own ids and overrides order and variant (ruling item 5), so the framework default only needs a sane fallback. Long-term: order is the ruling's own vocabulary. AI-error axis: neutral. Startup scope: B adds a second placement lever nobody has asked for."
    },
    {
      "question": "The invite is gated on features.organization (as ruled), while every other sys_organization record-header action is gated on multiOrgEnabled. Is that intended?",
      "options": [
        "A — keep organization (ruling text; same as the three mirrors; ADR-0093 D9: single-org sessions carry an active org)",
        "B — re-gate on multiOrgEnabled"
      ],
      "recommendation": "A: the ruling names organization verbatim and the three mirrors agree; this is recorded so it is not mistaken for drift."
    }
  ],
  "out_of_scope_findings": []
}

Generated by Claude Code

Claim: PM loop round 2 · 2026-10-17T20:03Z · re-declared after the seat's review of os-dev-report 6239623631 (the file surface widens by one spec ledger row; the session, the branch and the dev stay)
Session: session_01JtSQQ3EWsbNPzyYMug1tXy (the dispatching seat; the dev runs as its own cloud session session_01Eey1448sFJ5Z95gbXZh2tG)
Account: os-project-manager (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-24016-org-invite-action (draft PR #24216)
Worktree: objectstack-issue-24016
Domain: domain:engine
Seat: domain:engine#1 (seat post #6367)
File surface:

packages/platform-objects/src/identity/sys-organization.object.ts, three edits: the new record_header invite action; leave_organization's confirmText (leave_organization confirm names neither the organisation nor what is lost: confirmText has no declared record scope for interpolation, and a host cannot override the platform bundle #24021's copy half); and leave_organization's order: 1, so it folds to the overflow behind the invite, as the ruling says.
The translation bundles under packages/platform-objects/src/apps/translations/: en structure from the repo's generator, and the translated-locale values written by hand, as AGENTS.md's Documentation Guardrails row allows.
Pins in packages/platform-objects beside the existing action and translation tests, and one changeset .changeset/24016-*.md.
Cross-lane, declared to domain:spec on its seat post [PM seat] domain:spec — ⏳ vacant #6017: packages/spec/src/kernel/public-auth-features.ts, one row only. sys_organization.actions.invite_user joins PUBLIC_AUTH_FEATURES.organization.gatedInputs. packages/platform-objects/src/feature-gate-guard.test.ts reds any features.* gate not booked there, so the ruled requiresFeature: 'organization' cannot land without the row.
⛔ No new spec key and no other packages/spec line. Not sys_member / sys_invitation's actions, not objectui, and not leave_organization: no predicate root carries "the caller is this organisation's only owner", so the platform action cannot be disabled for the last owner before the click (better-auth refuses it only after the confirm) #24020's owner_count / disabled. Stop on any other breach and explain it in the report.
Container & model: M, mode:cloud, model: TIER_DEFAULT (unchanged; the packages/spec/src/** row owes one CONTRACT_REVIEW_TIER review before the queue)
Clause-②: no
Responsibility: n/a — not a defect card
Thread-read: 6239623631
Ruling reading: ruling 6228318638 binds "no new spec key", and the row is not a key. Its workload line ("no spec change") was an estimate; the guard falsifies it, and the ruling's own requiresFeature: 'organization' entails the row. Read by the seat as non-escalation class.
Serial constraints cleared: no other open PR touches public-auth-features.ts or sys-organization.object.ts, and no pm:dispatched claim names packages/spec/src/kernel/ (read at this claim). leave_organization: no predicate root carries "the caller is this organisation's only owner", so the platform action cannot be disabled for the last owner before the click (better-auth refuses it only after the confirm) #24020 (same file) stays ordered after this card.

Generated by Claude Code

ACCEPT → PR #24216 comment 6240960328 · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-17T21:00Z. The CONTRACT_REVIEW_TIER record is 6240346929 (PASS). PR #24216 is marked ready and set to auto-merge through the queue.

Generated by Claude Code

Landed · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-17T21:35Z

Probe	Reading
Queue	PR #24216 entered the merge queue at 2026-10-17T21:01Z after ACCEPT 6240960328 and the `CONTRACT_REVIEW_TIER` record 6240346929 (PASS, schema face). It left the queue merged at 2026-10-17T21:33Z. After the merge, `git ls-remote` lists no `gh-readonly-queue/main/pr-24216-*` branch.
`origin/main`	`b0a1df044` is on `origin/main` (`git merge-base --is-ancestor`: exit 0). It carries PR #24216's same 10 files, +276 / −34.
Cards closed	Since the enqueue, two lane cards closed: #24016 (this PR's `Fixes`) and #24182 (PR #24221). #24166 and #24196 closed too, each by its own lane's PR (#24218, #24220). None is a card this PR names.

Status: #24016 is closed completed, and its pm:dispatched is removed in this stroke. The cloud dev session session_01Eey1448sFJ5Z95gbXZh2tG is archived. sys_organization now declares the record_header invite action, ruling 6228318638 item 1. leave_organization folds to the overflow behind it, and its confirm copy names the environments and members (item 2, #24021's copy half).

Next on this file: #24020 (ruling item 3, owner_count and the last-owner disabled) is dispatched next by this seat. cloud#2910 stays pm:blocked until #24020 lands too (ruling item 5); this seat points the repo:cloud seat when it does.

Generated by Claude Code

Navigation Menu

Repository navigation

platform-objects: sys_organization declares no invite action, so an organisation record page cannot offer 邀请成员 in its header (page:header ids resolve only against the object's own actions) #24016

The gap

Done when

Triage: `pm:on-hold` on decision #24034 · a framework widening, held for the maintainer to name · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-16T19:55Z

Retriage: routed `domain:engine` · `priority:p2` stands · `pm:queue` · `pm:retriage` cleared · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-17T02:54Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

platform-objects: sys_organization declares no invite action, so an organisation record page cannot offer 邀请成员 in its header (page:header ids resolve only against the object's own actions) #24016

Description

The gap

Done when

Activity

objectstack-fleet commented on Oct 16, 2026

Triage: pm:on-hold on decision #24034 · a framework widening, held for the maintainer to name · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-16T19:55Z

objectstack-fleet commented on Oct 17, 2026

Retriage: routed domain:engine · priority:p2 stands · pm:queue · pm:retriage cleared · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-17T02:54Z

objectstack-fleet commented on Oct 17, 2026

objectstack-fleet commented on Oct 17, 2026

objectstack-fleet commented on Oct 17, 2026

objectstack-fleet commented on Oct 17, 2026

objectstack-fleet commented on Oct 17, 2026

objectstack-fleet commented on Oct 17, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: `pm:on-hold` on decision #24034 · a framework widening, held for the maintainer to name · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-16T19:55Z

Retriage: routed `domain:engine` · `priority:p2` stands · `pm:queue` · `pm:retriage` cleared · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-17T02:54Z