Repository navigation
[Decision] Two more framework writers land organization-less rows under a wall before C8 stage 8b: flow credentials (sys_flow_credential) and boot-seeded declared webhooks (sys_webhook) #24435
Description
Ruled: 6259141885 · letters Q1 A · Q2 A · 2026-10-19T03:40Z
Filing gate ②: a decision only the maintainer can make. The maintainer asked for this card in the epic seat's chat: 「用决策卡。24378 也重开，带上你的新意见和我们的讨论」. Reader who acts: the maintainer rules; the epic PM (epic:#15194, session_01Y5583bs2RDd53MH6kM1ca3) executes.
Dedupe. Semantic search on objectstack-ai/objectstack:
- "sys_flow_credential organization column deployment-level env-wide flow credential tenant": 4 hits, none asking this;
- "bootstrapDeclaredWebhooks seeder declared webhooks registry retire sys_webhook rows boot": 5 hits, all closed, none asking this.
Blocks: C8 stage 8b (#15212). After 8b, the engine refuses an organization-less system insert under a wall, so both writers would start failing there.
Source. A read-only writer census the epic seat ran on origin/main e22defb13, before dispatching 8b. It was run so that #24377's late discovery does not repeat.
- It covered the 44 in-reach platform objects, less the 9 admitted ones and the 5 [Decision] C8 under a wall: four framework writes that have no organization to name — self-registration grant, identity mail, activity, deployment-level secrets #24377 already ruled, leaving 30 candidates.
- 2 candidates need a decision. 1 needs only a stamp. The rest always derive an organization, or have no framework writer.
维护者速读
一句话问题： 8b 落地后，隔离部署下凡是"写入时推不出组织"的系统写入都会被拒。普查又找到两处这样的写入：流程凭据、启动时自动复制的软件包 webhook。每处要定一个去向。
| 今天 | 选项 A(席位推荐) | 选项 B | 选项 C | |
|---|---|---|---|---|
Q1 流程凭据 sys_flow_credential |
保存/发布带签名密钥的流程时写,不带组织。对象注释自称「整个环境一份」(sys-flow-credential.object.ts:33,unique: 'global' :117),表却带组织列,仪式又按组织数据处理(organization-ownership-inventory.ts:599)—— 三处矛盾 |
改为部署级(去组织列,systemFields: { tenant: false }),归属跟流程走(流程本是环境元数据,D2/D6);与 #24377 Q4「sys_secret 归属跟引用行走」一致;D7 加一行;随 8b-0de 做 |
保留组织列,隔离下拒绝带密钥的流程保存 —— 隔离部署无法用签名 webhook/http 流程 | 保留组织列,按发布者会话的组织盖章 —— 流程是全环境的,凭据却分组织,另一个组织运行同一流程时找不到凭据 |
Q2 声明的 webhook sys_webhook |
每次启动把包里声明的 webhook 复制成无组织的行(bootstrap-declared-webhooks.ts:256,webhook-outbox-plugin.ts:322)。D2 原文「No seeder writes them into any table」,但退役清单漏了它;8c-0 后这些行在隔离下已让认证挡住 |
退役种子程序,声明的 webhook 从注册表读取(与 stage 9 对共享规则的做法相同);仪式删除镜像行(D10 fate 2) | 定为部署级:声明 webhook 进无组织列的同构表,保留种子程序 —— 与 D2「声明不落表」相悖 | 不处理:8b 后隔离部署下声明的 webhook 静默消失(拒写被 :258-276 捕获只记 warning) |
你要做的： 各回一个字母，例如「Q1 A Q2 A」。
工作量与位置：
- Q1 A 约 0.3–0.6k 行，并进 8b-0de(同批改仪式清单与 D7)。
- Q2 A 约 0.8–1.5k 行，作新阶段 8b-0g：排在 8b-0de 之后、8b 之前(都改仪式文件，只能串行)。关键路径约 +0.5–1 天。
- D7 那一行: 若在您合并 PR docs(adr): ADR-0131 D6 charts sharing_rule under regime C; D7 ledger reading and lines for #24377 and #24435; D14 records the 18.0 scope #24422 之前裁决，就并进 docs(adr): ADR-0131 D6 charts sharing_rule under regime C; D7 ledger reading and lines for #24377 and #24435; D14 records the 18.0 scope #24422，省一次 Tier H 审批。docs(adr): ADR-0131 D6 charts sharing_rule under regime C; D7 ledger reading and lines for #24377 and #24435; D14 records the 18.0 scope #24422 正因 [Decision] Declared sharing rules: what switching off a vendor's rule means once they are read from the registry #24378 重开而暂缓。
无需决定、照做： sys_share_link 在用户生成分享链接时写入，不带组织(share-link-service.ts:665)。但组织推得出来(记录和会话都在手上)，在 8b 前补上盖章即可，是一个小阶段。
Measured (all at origin/main e22defb13)
- The exemption today.
resolveSystemInsertOrganization(packages/objectql/src/engine.ts:7165) runs on every insert. Any in-reachsys_/cloud_/ai_object that is not on the 9-entry admit list (platform-object-tenancy.ts:124-229) returns at:7183, before the posture is read, so it lands NULL in every posture. 8b retires that exit. - Q1.
- The writer is
service-automation/src/flow-credential-channel.ts:341, under{isSystem:true}(:85). - It is called from the metadata save door (
metadata-protocol/src/protocol.ts:23987) and from the one-time migration (flow-credential-migration.ts:222). - No organization is threaded.
- The inventory row reads
fate: 'attribution', "under single the Default Organization; otherwise reported" (:599).
- The writer is
- Q2.
- The writer is
plugin-webhooks/src/bootstrap-declared-webhooks.ts:256underSYSTEM_CTX(:109). It runs on every boot (webhook-outbox-plugin.ts:322). - The inventory keeps the rows with a label only (
:529, "not named by D10 fate 2, so they stay"). - Their
sys_http_deliverytail follows the webhook's organization (auto-enqueuer.ts:887,:1228-1235).
- The writer is
- Lean compositions change no answer under a wall. A walled posture is refused before the organization object is checked (
core/src/security/system-write-organization.ts:115-117). - Latent, no decision. None of these has a live caller or path, so 8b's refusal is acceptable for each:
sys_scim_connection_credential: its mint has no caller and is not exported.sys_setting's user rung for a walled user with no active organization: no built-in user-scope key exists.sys_import_jobby an operator with no organization: a narrow case.
Recommendation: Q1 A · Q2 A
- ① Long-term soundness.
- Q1 A makes the object say one thing in three places. A flow is environment metadata, so its credential is too.
- Q2 A completes D2's own sentence. Stage 9 already did the same for sharing rules, so the pattern exists.
- ② Business need. Both writers are live: signed webhook and http flows, and declared webhooks in packages. Under a wall, 8b would break them, and Q2's failure would be silent.
- ③ AI error-proofing.
- Q1 A removes a tenant column that no writer can fill.
- Q2 A removes a boot-time mirror whose rows block certification.
- Q2 C would turn a refusal into a warning-only disappearance.
- ④ Startup focus. Q1 A is the smaller change. Q2 A reuses stage 9's shape. Neither adds a capability.
os-decision-facets
- ① 项目长远合理性:Q1 A 让对象三处说法一致(流程是环境元数据,凭据随之);Q2 A 补全 D2「声明不落表」,复用 stage 9 的形状。
- ② 实际业务拉动:两处都是活写入(签名 webhook/http 流程、包内声明的 webhook);隔离部署下 8b 会让它们失效,Q2 还是静默失效。
- ③ 防 AI 犯错:Q1 A 去掉一个无人能填的租户列;Q2 A 去掉启动时的镜像;Q2 C 把拒写变成只记 warning 的消失。
- ④ 创业阶段不扩散:Q1 A 改动更小;Q2 A 复用既有形状;都不新增能力。
自检：只看①选 Q1 A、Q2 A；②③④ 是否翻转：否。
Confidence gap. Whether cloud's control plane relies on declared webhooks under a wall is unknown. This session cannot read the cloud repo.
Related: #15212 (the C8 plan), #24377 (the first four walled fates), #24422 (the D7 PR, held), #23952 (stage 9, the registry pattern).
Activity
objectstack-fleet commentedon Oct 19, 2026
席位意见(增量)· director seat (summon #43 continuation 5,
session_01QJC7i981TSs9L1CGJK59Ax), read as batch #368 item 2, 2026-10-19T02:59ZOn the epic PM's decision card (Q1 A · Q2 A recommended: flow credentials become deployment-level; the boot seeder for declared webhooks retires and the registry serves them), filed from the writer census the epic seat ran before dispatching stage 8b, at the maintainer's word 「用决策卡」. The maintainer's words in this session's chat: 「开始决裁」.
Premises re-run in this act — objectstack
origin/maindb1f1fd20fba, cloudorigin/main(fetched this act):sys_flow_credentialcalls itself environment-wide (packages/services/service-automation/src/sys-flow-credential.object.ts:33–:34: 「every metadata row is env-wide (ADR-0131 D6), a flow's stored rows included」) while carrying the injected organisation column; its writer runs under{ isSystem: true }(flow-credential-channel.ts:85) and threads no organisation; the inventory lists itfate: 'attribution'with no anchors (organization-ownership-inventory.ts:599). Holds — three readings of one object.bootstrapDeclaredWebhooksinserts declared webhooks as rows underSYSTEM_CTX(plugin-webhooks/src/bootstrap-declared-webhooks.ts:109,:256) on every boot (webhook-outbox-plugin.ts:322); ADR-0131 D2:251says of declared items 「No seeder writes them into any table」. Holds — the seeder contradicts D2's sentence.platform-object-tenancy.ts;engine.tsreturning before the posture is read). Holds.webhooks:arrays,defineWebhook: 0 hits outside tests); the control plane's webhooks are inbound (billing), not declared outbound subscriptions. So Q2 changes nothing cloud relies on.Facets: ① agree with A · A — Q1 A makes the object say one thing in three places and matches #24377 Q4 (a secret's ownership follows the referencing row; a flow is environment metadata); Q2 A completes D2's own sentence with stage 9's shape (declared items served from the registry, mirrors deleted by the ceremony, D10 fate 2) · ② both writers are live (signed webhook and http flows; declared webhooks in packages); under a wall 8b would refuse the first and lose the second silently (the refusal is caught and logged as a warning,
:258–:276) · ③ Q1 A removes a tenant column no writer can fill; Q2 A removes a boot mirror that already blocks certification since 8c-0; Q2 C would turn a refusal into a warning-only disappearance · ④ Q1 A about 0.3–0.6k lines inside 8b-0de; Q2 A about 0.8–1.5k as a new stage 8b-0g, serial after 8b-0de on the ceremony files (about half a day to a day on the critical path); neither adds a capability.Recommend Q1 A · Q2 A. 口径 with the letters: (1) Q1 —
sys_flow_credentialdeclaressystemFields: { tenant: false }, the organisation column goes, ownership follows the flow; one D7 line, folded into PR #24422 if that PR is still open at the letter (it is held on #24378), else its own Tier H line; (2) Q2 — the boot seeder retires; declared webhooks are read from the registry (stage 9's read path as the pattern), the ceremony deletes the mirror rows and renames theirsys_http_deliverytails' source as stage 9 did for grants; (3)sys_share_linkgets its stamp before 8b as the card says, no letter needed. Not taken: Q1 B (walled deployments lose signed flows), Q1 C (a per-organisation credential for an environment-wide flow), Q2 B (declared items in a table, against D2), Q2 C (silent loss). Workload: as the card states.os-decision-facets
自检:只看①选 Q1 A · Q2 A;②③④ 是否翻转:否。
objectstack-fleet commentedon Oct 19, 2026
Ruling: batch #368 item 2 · letters Q1 A · Q2 A · maintainer 「同意」 2026-10-19T03:40Z
Director seat, summon #43 continuation 5,
session_01QJC7i981TSs9L1CGJK59Ax, on the epic PM's decision card (Q1 A · Q2 A recommended by the seat; the director's delta, 6258689007, agreed and closed the card's confidence gap by reading cloud) (opening marker #12708, comment 6247058702). The maintainer's words in this session's chat, after the director's business reading of both questions: 「同意」.What the ruling binds:
sys_flow_credentialis deployment-level. The object declaressystemFields: { tenant: false }; its organisation column goes; a credential's ownership follows the flow it belongs to, which is environment metadata (ADR-0131 D2/D6), in step with [Decision] C8 under a wall: four framework writes that have no organization to name — self-registration grant, identity mail, activity, deployment-level secrets #24377 Q4 forsys_secret. One dated D7 line, folded into PR docs(adr): ADR-0131 D6 charts sharing_rule under regime C; D7 ledger reading and lines for #24377 and #24435; D14 records the 18.0 scope #24422 while that PR is open (it is: held for the D6 rewrite under [Decision] Declared sharing rules: what switching off a vendor's rule means once they are read from the registry #24378's ruling A, 6258883445), else its own Tier H line. Built inside 8b-0de. Not taken: Q1 B (walled deployments lose signed hook and http flows), Q1 C (a per-organisation credential for an environment-wide flow).bootstrapDeclaredWebhooksno longer runs; the dispatcher reads declared webhooks from the registry (stage 9's read path for declared sharing rules is the pattern); the ownership ceremony deletes the mirror rows (D10 fate 2) and re-sources theirsys_http_deliverytails as stage 9 did for grants. D2's sentence 「No seeder writes them into any table」 becomes true of webhooks. Customising a declared webhook (activating one shipped inactive, pointing it at a real endpoint) follows D6's regime C for behavioural types — asys_metadata_activationrow of typewebhookfor the switch, a clone under a new name for the change — the shape [Decision] Declared sharing rules: what switching off a vendor's rule means once they are read from the registry #24378 ruled A for sharing rules; the mirror-row edit path (customized: true, the showcase docblock) goes with the mirrors. A new stage 8b-0g, serial after 8b-0de on the ceremony files, before 8b. Not taken: Q2 B (declared items in a table, against D2), Q2 C (silent loss under a wall).sys_share_linkgets its organisation stamp before 8b, as the card says.Workload of the letters: Q1 about 0.3–0.6k lines inside 8b-0de; Q2 about 0.8–1.5k lines as 8b-0g; about half a day to a day on C8's critical path.
Execution: the epic seat (
epic:#15194) folds Q1 into 8b-0de and the D7 line into PR #24422, and cuts 8b-0g for Q2; pointers on #15212, #15194 and PR #24422; this card leavesneeds-user-decisionand closescompleted.objectstack-fleet commentedon Oct 19, 2026
Closed
completed· ruled Q1 A · Q2 A at 6259141885 (batch #368 item 2, the maintainer's 「同意」) · director seat (summon #43 continuation 5,session_01QJC7i981TSs9L1CGJK59Ax) · 2026-10-19T03:44ZThe close itself landed at 2026-10-19T03:43Z from another seat's write as the fleet bot, one second before this seat's own close read the card (which then skipped it as not open); this note is the director's closing record. Flow credentials become deployment-level (8b-0de; D7 line on PR #24422); the declared-webhook boot seeder retires for the registry read, mirrors deleted by the ceremony, D6 regime C for customising (8b-0g). The epic seat executes (pointer 6259157414 on #15212).