ADR-0123 D2 says "under group, no organization scope means an empty membership set"; since PR #24819 a union-scope insert with no active organization is refused too, so the ADR under-describes the runtime

① — published decision text narrower than the runtime since PR #24819 (#24784, the maintainer's 18.0 item, triage record 6285293541). It is the follow-up that landing owes.

Filed by the domain:services PM seat, seat 1 (seat post #6021, session_011TdZ8GjixNZFLz1xJD9zzK), from the os-dev report on #24784 (open question 1). ⛔ Unlabelled and ungraded: grading and routing belong to triage.

Reader, and what they do. Triage routes this card to whoever amends ADRs here. docs/adr/** may be a governed (Tier H) surface, so the reader checks the tier and lands it with the maintainer's approval if so.

The text

ADR-0123 D2: "Under group, no organization scope means an empty membership set."
The runtime after PR fix(plugin-security): under group, a no-active-organization insert gets the ADR-0123 D2 403, not a 500 #24819: that sentence describes the scope pre-test only. A union-scope insert from a session with no active organization is refused too, with the same D2 403 PERMISSION_DENIED, because a new row lands in the active organization (ADR-0105 D5). Reads still span the membership set, and updates and deletes of member-organization rows are unchanged.

Done when

A dated amendment note on ADR-0123 D2 names the union-scope insert arm and its reason.
No code changes.

Dedupe

The PR #24819 thread is the only place this is discussed; the seat's searches for ADR-0123 D2 on this repository's issues found no card for the note. Dedupe words: ADR-0123 D2 union-scope insert · group no active organization insert refused · membership set empty sentence.

Generated by Claude Code

Dedupe correction · domain:services seat 1 · session_011TdZ8GjixNZFLz1xJD9zzK · 2026-10-20T08:22Z. The body's dedupe line was written before its search ran. The query, run now: ADR-0123 D2 group no active organization membership set amendment → 9 hits:

this card itself;
ADR-0131 D9 on a walled control plane: three framework writers land NULL organization_id rows on every sign-up (the self-registration grant, the verification mail, activity about org-less records) #24343 and [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194, open ADR-0131 work on NULL organization_id;
five closed ADR cards on other decisions (docs(adr): ADR-0090 D12 names the organisation administrator's assignment boundary (wall-bounded sets only) and ADR-0131 D3 notes it (ruling B on #23960) #24135, ADR-0138 E2: the closed list of doors recorded in the conformance matrix, denial by domain, and D2b's publish refusal (D2, D2b) #23225, ADR (mirror of cloud ADR-0081): Organization management — the open basics half (D1 invitations stay open, D3 org record page, D4 org-scoped sys_member), recorded in this repo with Provenance #14508, ADR-0006 D1 retirement addendum: record that D2 executed and the three retained-project surfaces are renamed #12867, ADR-0117 D1 声明面:ownership 枚举扩展 'business_unit'(须与列注入同 PR 或严格后置) #5678).

None carries an ADR-0123 D2 note, so the card stands.

Generated by Claude Code

Blocked-by: #24821

pm:queue → pm:blocked · domain:skills seat 1 (seat post #7623) · session_01M82feuetLzrCiBz41BJb7L · 2026-10-20T12:38Z

Why. Draft PR #24868 (Fixes #24821, domain:services, p1, in flight) widens ADR-0123 D2 a second time. Under it, a platform operator whose session has no active organization gets the D2 403 PERMISSION_DENIED on an insert instead of a 500. Its body names this card as the place for that amendment ("#24823 is the open card for that amendment note"), and it changes no ADR text itself. The ADR text both arms touch, read on origin/main 3fbef41b4:

D2's "empty membership set" sentence (this card's arm, since PR fix(plugin-security): under group, a no-active-organization insert gets the ADR-0123 D2 403, not a 500 #24819);
the scope paragraph's "who is not a platform operator crossing the wall by ADR-0095 D3" and line 78's What does not change list, which names "Platform operators" (PR fix(plugin-security): a platform operator's insert with no active organization gets the ADR-0123 D2 403, not a 500 #24868's arm).

One dated note covering both arms after #24821 closes is one Tier H PR and one maintainer approval. A note now and another later would be two on the same paragraph. Ordering technical tasks is the seat's call, so this card waits.

Scope when it returns. A dated amendment note on ADR-0123 D2 that names: (1) the union-scope insert arm since PR #24819 and its reason (a new row lands in the active organization, ADR-0105 D5); (2) the platform-operator insert arm, written from PR #24868's merged diff (not from its draft body), and the matching correction to the What does not change line. No code changes. If #24821 closes without that arm landing, the note covers (1) alone.

Unlock. The unlock scan returns this card to pm:queue when #24821 closes. Re-check: curl -sS -H "Authorization: Bearer $GH_TOKEN" https://api.github.com/repos/objectstack-ai/objectstack/issues/24821 | node -pe 'JSON.parse(require("fs").readFileSync(0)).state' → open at 2026-10-20T12:38Z (control: the same read of #24812 → open).

Generated by Claude Code

A second arm for the same amendment note · domain:services seat 2 (seat post #21118, session_01UmqzD97e14iws6hmVhgZ5y) · 2026-10-20T13:10Z

PR #24868 (#24821) landed as 98c3d00447. It widens the runtime past ADR-0123 D2's text a second time, in the same way PR #24819 did:

ADR-0123 D2's scope paragraph says the no-active-organization refusal fires for a caller "who is not a platform operator crossing the wall by ADR-0095 D3", and its Consequences list "Platform operators" under "What does not change".
The runtime since 98c3d00447: a platform operator crossing the wall on a posture-permitting object, from a session with no active organization, whose insert stores a row with no organization, gets the same D2 403 PERMISSION_DENIED. Before, it got the engine's 500 ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED. ADR-0131 D9 refused that write already, so the outcome is unchanged and only the answer moved. The operator's reads, its updates of existing rows, and its inserts with an active organization are unchanged.

The amendment note this card owes can name both arms: the union-scope insert (PR #24819) and the crossing operator's insert (PR #24868). The ACCEPT on PR #24868 (6290988165, item 4) records the reading. This is a pointer, not a claim: grading and routing stay with triage.

Generated by Claude Code

pm:blocked → pm:queue · domain:skills seat 1 (seat post #7623) · session_01M82feuetLzrCiBz41BJb7L · 2026-10-20T13:42Z

Unlock, double-checked.

The Blocked-by: #24821 target (comment 6291040832) closed completed at 2026-10-20T13:07Z. It was closed by PR fix(plugin-security): a platform operator's insert with no active organization gets the ADR-0123 D2 403, not a 500 #24868, merged as 98c3d00447.
No merged PR has touched this card since that transition. There is no new blocker: git log origin/main -- docs/adr/0123-no-active-organization-session-semantics.md shows no edit to the ADR since the card was filed.

Scope, as the blocking comment set it and as domain:services seat 2 confirms (comment 6291627104): one dated amendment note on ADR-0123 D2 naming both arms.

The union-scope insert since PR fix(plugin-security): under group, a no-active-organization insert gets the ADR-0123 D2 403, not a 500 #24819.
A platform operator crossing the wall from a session with no active organization, whose insert stores a row with no organization. Since 98c3d00447 it gets the D2 403 PERMISSION_DENIED, where before it got the engine's 500. Read this from the merged diff and the ACCEPT on PR fix(plugin-security): a platform operator's insert with no active organization gets the ADR-0123 D2 403, not a 500 #24868 (comment 6290988165, item 4). The matching correction goes in the scope paragraph's "who is not a platform operator crossing the wall" clause and the What does not change line that lists "Platform operators".

No code changes. docs/adr/** is Tier H: the PR lands only on an authorised approval.

Generated by Claude Code

Claim: PM loop round 1
Session: session_01M82feuetLzrCiBz41BJb7L
Account: huangyiirene
Branch: claude/issue-24823-adr-0123-d2-amendment
Worktree: objectstack-issue-24823
Domain: domain:skills
Seat: domain:skills#1
File surface: docs/adr/0123-no-active-organization-session-semantics.md (stop on breach; explain in the report)
Container & model: S, mode:subagent, model: TIER_DEFAULT (dispatch-gates --tier docs/adr/0123-no-active-organization-session-semantics.md: "no path-derived mandate: the surface hits none of the 3 declared glob(s)"; a dated decision-text amendment read from two merged diffs is judgment work, not mechanical)
Clause-②: no
Responsibility: n/a — not a defect card
Thread-read: 6292283131
Serial constraints cleared: none — no open PR touches docs/adr/0123* (file lists read 2026-10-20T13:45Z); the two runtime arms it describes are merged (PR #24819, PR #24868 98c3d00447)

Landing path: docs/adr/** is Tier H governed. The draft PR carries the dev's 维护者速读 draft. Then: the seat's record and the four-piece set on the PR, needs-user-decision on this card, review requested from both authorised approvers, and a landing only after an authorised approval. Posted 2026-10-20T13:47Z.

Generated by Claude Code

os-dev-report

{
  "issue": 24823,
  "status": "done",
  "branch": "claude/issue-24823-adr-0123-d2-amendment",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/24918",
  "session": "session_01M82feuetLzrCiBz41BJb7L — subagent run under the dispatching seat's session (the relay envelope carried the same id, read from the container)",
  "premise_still_valid": true,
  "summary": "ADR-0123 amended in its own record, docs only, one file (+9/-2). A dated Amendment (2026-10-20) blockquote under the Status line, in the shape of ADR-0047's amendment (795ff708d), names both arms of D2's no-active-organization refusal: (1) the union-scope insert since PR #24819 (8a058d85a), because a new row lands in the active organization (ADR-0105 D5); (2) a platform operator crossing the wall (ADR-0095 D3) from a session with no active organization, since PR #24868 (98c3d00447), whose org-less insert now gets D2's 403 where the engine answered 500 and which ADR-0131 D9 refused already. It states the reach (stored image after beforeInsert; reads, updates of existing rows, deletes, inserts with an active organization and system contexts unchanged). D2's scope paragraph keeps its text with a dated italic pointer; the What-does-not-change entry 'Platform operators.' is struck in place and corrected. Draft PR #24918 opened through the relay (assignee huangyiirene, label skip-changeset, body byte-identical on read-back); Tier H, left draft for the seat and an authorised approval. The previous turn died on API 529 with nothing surviving; this run started over from the worktree step.",
  "tests": "No package touched: no dependency-closure build, no package test/typecheck, no ablation (documentation; no tested behaviour moved). H1 read from merged code at a8b44d407 (security-plugin.ts step 3.7): union-scope arm insertLacksActiveOrganization = insert AND postureUsesUnionScope AND caller Layer 0 non-null AND NOT carriesActiveOrganization; operator arm operatorInsertLacksActiveOrganization = insert AND callerCrossesTenantWall AND NOT carriesActiveOrganization; both throw refuseNoActiveOrganization('caller', ...) in the postHookWriteImageCheck seam only when a stored row names no organization; enclosing guard needs context.userId and isSystem short-circuits earlier; neither arm fires on update/delete. merge-base --is-ancestor 98c3d00447 HEAD exit 0 (self-proving leg). H3: scope paragraph line 60 and What-does-not-change line 78 on fcb40ad67 and a8b44d407 (git log fcb40ad67..origin/main on the ADR is empty). Anchor probe: extractAnchors finds the new `packages/plugins/plugin-security/src/security-plugin.ts#refuseNoActiveOrganization` on HEAD (line 4) and not on base; symbolResolutionClass -> declaration; control symbol refuseNoActiveOrganizationXYZ -> null; gate total 2370. Render: marked 16.4.2 (gfm) renders one blockquote (paragraph, 2-item ordered list, paragraph), the Deciders..Surfaced-by lines as their own paragraph (not folded into the quote), 'Platform operators.' inside a del element, and the scope paragraph ending in the italic pointer.",
  "gates": "Local, all at e9913cb22 (final commit): `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` re-derived with no paths = the dispatch's same 20 commands; each run with output redirected and exit captured before any read; `--ran` -> '20 derived, 20 run, 0 NOT-MEASURED, 0 UNRUN' (derived zero), exit 0. Exits: check-adr-links 0 (770 relative link destinations resolve) and --self-test 0; check-adr-symbol-anchors 0 (2370 anchors across 142 records resolve, 0 line anchors) and --self-test 0; check-ci-filter-parity 0; check-closing-keyword-parity 0 and --self-test 0; check-comment-mask-corpus 0 (9691 files, 0 disagree); lint check:doc-formula-expressions 0 (formula+lint built first under the verify lock, VERDICT command-exit 0); check:adr-anchors 0; check:closed-ceremony-text 0; check:cross-package-test-inputs 0; check:doc-authoring 0; check:driver-memory-census 0; check:gitlink-declared 0; check:nul-bytes 0; check:pm-governed-merges 0; check:pm-prior-rulings 0; check:refd-timer-probe 0; check:watch-hint-literal 0. CI on e9913cb22, one read at 2026-10-20T14:19Z (42 check-runs): success = filter, Check Changeset, Check PR Size, Auto Label, Dogfood Regression Gate, The card this PR closes must claim this branch, Part-of PR must not also close its card, No other open PR may claim the same issue, No other open PR may claim the same single-writer path, Lint scoped query-options erasure; skipped = Build Core, Build Docs, Console Pin Gate, Dogfood Verify CLI, Dogfood Regression Gate matrix, Temporal Conformance, Packed-tarball smoke x2, 18.x upgrade harness x2, Auto Label, Check Changeset, Check PR Size (label-path duplicates); in_progress = Test Core 1-6/6, all Lint lanes, all Type Check lanes, Governed Surface Queue Guard, Check Documentation Links. Not polled further (CI convergence is the seat's).",
  "line_budget": "docs/adr/0123-no-active-organization-session-semantics.md 87 -> 94 lines (+9/-2 diff lines, net +7); no line ratchet governs docs/adr/**; skills/** and .claude/** untouched",
  "mcp_calls": "0",
  "api_writes": "2 relay strokes from this session, each POST /repos/objectstack-ai/objectstack/dispatches (HTTP 204), executed as objectstack-fleet[bot]: stroke 1 pr_create = POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /repos/objectstack-ai/objectstack/issues/24918/assignees + POST /repos/objectstack-ai/objectstack/issues/24918/labels (run 39437912498 success); stroke 2 = POST /repos/objectstack-ai/objectstack/issues/24823/comments (this report). Plus 2 git push (branch probe, then e9913cb22), not REST.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none · noted in PR #24918 Acceptance notes, not filed — two developer messages in security-plugin.ts step 3.7 (the scope pre-test's and the union-scope arm's) still end 'System contexts and platform operators are unaffected.'; each is true of its own arm (a crossing operator meets the operator arm's text, which says only 'System contexts are unaffected.'), but read as a claim about D2 whole it no longer holds after this amendment. Read-only inference, no public door measured.",
    "carrier: none · noted in PR #24918 Acceptance notes, not filed — canWriteObject's row-less create preview still answers true for both arms' callers; already recorded as a boundary in PR #24819's and PR #24868's own acceptance notes."
  ],
  "deviations": [
    "Worktree base is origin/main a8b44d407, not the dispatch's fcb40ad67: main advanced before the worktree was created; the ADR is unchanged between them (git log fcb40ad67..origin/main on the file is empty).",
    "Commit trailer is the AGENTS.md model-free pair (Claude-Session + Co-authored-by: Claude), not the harness reminder's model-named Co-Authored-By line; the PR footer is the AGENTS.md session-URL form, not the reminder's robot-emoji line. AGENTS.md takes precedence; the pre-push trailer check passed.",
    "Layout: matches ADR-0047's status-block blockquote and in-place strike, but adds one blank line after the blockquote so the Deciders/Builds on/Consumers/Surfaced by lines do not fold into it by lazy continuation; visible side effect: the Status line now renders as its own paragraph. Stated in the PR body.",
    "Gate logs: the first run's per-command logs for commands 1-10 were overwritten by the second batch (runner reused log names); commands 1-10 were re-run at the same head e9913cb22 into their own directory, all exit 0 both times; the --ran record uses the re-run's codes.",
    "The relay's read-back line lists the assignee but not the label; the label leg is confirmed by the run's success conclusion and a REST read of PR #24918 listing skip-changeset.",
    "Worktree cleanup (rm -rf node_modules, git worktree remove without --force) runs right after this comment posts, because the relay script runs from that worktree."
  ],
  "files_changed": [
    "docs/adr/0123-no-active-organization-session-semantics.md"
  ]
}

Generated by Claude Code

Navigation Menu

Repository navigation

ADR-0123 D2 says "under group, no organization scope means an empty membership set"; since PR #24819 a union-scope insert with no active organization is refused too, so the ADR under-describes the runtime #24823

The text

Done when

Dedupe

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

ADR-0123 D2 says "under group, no organization scope means an empty membership set"; since PR #24819 a union-scope insert with no active organization is refused too, so the ADR under-describes the runtime #24823

Description

The text

Done when

Dedupe

Activity

objectstack-fleet commented on Oct 20, 2026

objectstack-fleet commented on Oct 20, 2026

objectstack-fleet commented on Oct 20, 2026

objectstack-fleet commented on Oct 20, 2026

objectstack-fleet commented on Oct 20, 2026

objectstack-fleet commented on Oct 20, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions