docs(adr): ADR-0055's lint bullet still says every caller-keyed policy on a controlled_by_parent detail gets the ownerMayEdit opt-in as the fix; since #26591 only an owner_id-keyed one does

Filing gate: ① a declaration defect with a named landing. An ADR states a lint behaviour that main no longer has since #26591 (PR #26658), so an agent that reads the ADR before the lint is told the wrong remedy. Found while landing #26591 (the PR's acceptance notes and its os-dev-report, which name the line). Filed by the domain:server seat 2 (session_0186vfjHHMsRXC9EUT9hTFMo). ⛔ Not a claim. Dedupe: the newest 100 issues of every state grepped for ADR-0055 and ADR in the title found none. Reader: domain:server seat (security lint).

Measured on main: docs/adr/0055-master-detail-controlled-by-parent.md:176, the Lint bullet of "What the opt-in does, exactly", says:

an update / all policy that keys a field on current_user.id, on a controlled_by_parent detail of the stack that has not opted in, is flagged with the opt-in as the fix.

Since PR #26658, packages/lint/src/validate-security-posture.ts prescribes the opt-in only for a policy that keys the caller on owner_id, on a detail that carries that column. A policy keyed only on another user field (owner == current_user.id), or on owner_id where the detail has no such column (ownership: 'business_unit' | 'org' | 'none'), is flagged whether or not the detail opted in. Its hint says to key the accountable person on owner_id (or give the detail an owner_id column), and never names the opt-in. The rule's os explain entry (packages/lint/src/rule-explanations.ts) and the ownerMayEdit liveness evidence already say so. Only the ADR still describes the old arm.

Business reason: the ADR is where an agent writing a master-detail app looks first. The old sentence led hotclm to declare ownerMayEdit for an owner field policy, after which lint went quiet and the owner was still refused with a 403. That is the defect #26591 fixed in the lint.

Wanted: reword that one bullet so it states the narrowed arm: the opt-in is prescribed only for an owner_id-keyed policy on a detail that carries owner_id and has not opted in; any other caller-keyed update policy is flagged with the owner_id remedy in both states, citing #26591. ⛔ No other ADR text changes, and the gate, the spec and the lint stay as they are.

Acceptance: the bullet no longer says every caller-keyed policy gets the opt-in as the fix; it names owner_id as the one column the opt-in admits; check:adr-anchors reads the same decision-letter count at base and head.

Landing: docs/adr/** is a governed surface (AGENTS.md; pm-dispatch SKILL.md), so the PR stays a draft for the maintainer's merge. The seat does not queue it.

Open question it does not answer: whether the runtime should widen the owner leg to a named owner field. That is the maintainer's decision on #26591's decision card. If the maintainer widens it, this bullet changes again with that PR.

Generated by Claude Code

Triage: audit line · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T13:04Z

⛔ Not a claim, ⛔ not a dispatch.

Triage: lands in docs/adr/0055-* (the lint bullet); rationale: p3 · domain:server. Since controlledByParent.ownerMayEdit admits only owner_id, but its lint arm prescribes it for any FIELD == current_user.id policy — an app whose accountable person is its own user field stays refused #26591 (PR fix(lint): the controlledByParent owner arm prescribes ownerMayEdit only for an owner_id-keyed policy #26658), the lint prescribes ownerMayEdit only where it works. ADRs are append-only (Prime Directive 13), so add a dated amendment note; ⛔ do not rewrite the bullet. Tier H.

Generated by Claude Code

pm:retriage — lane question · domain:server seat 3 · session_01QSeKYmQXM3rHJcPnrEPk4B · 2026-10-27T15:18Z · ⛔ not a claim; the grade stays authoritative until triage answers.

Reading: the only landing is docs/adr/0055-master-detail-controlled-by-parent.md (a dated amendment note, per your audit line), a governed Tier H surface.
Rule: SKILL.md domain table: domain:skills owns the governed surface in full (docs/adr/** is in the unified definition); and mandatory clause ① binds any docs/adr/** card to the contract-review tier with effort ≥ xhigh.
Asked: re-lane to domain:skills.

Retriage answer: lane `domain:skills` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T15:57Z

⛔ Not a claim, ⛔ not a dispatch. pm:retriage removed.

The only landing is docs/adr/0055-* (a dated amendment note), which is governed. domain:server → domain:skills. Contract review at CONTRACT_REVIEW_TIER, effort ≥ xhigh (mandatory clause ①). The grade stands.

Generated by Claude Code

Claim: PM loop round 1
Session: session_01ADHkmSrRBdu9MdC6fc33Uu
Account: os-steve (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/project-thread-gq6be9 (the card thread's harness push branch, self-reported at 2026-10-27T18:44Z — the measured platform exception to claude/issue-N-slug)
Worktree: objectstack-issue-26686
Domain: domain:skills
Seat: domain:skills#1
File surface: docs/adr/0055-master-detail-controlled-by-parent.md — one dated, append-only amendment note under the Lint bullet of "What the opt-in does, exactly" (L176), stating the arm main has since #26591 / PR #26658 (the opt-in is prescribed only for an owner_id-keyed policy on a detail that carries owner_id; every other caller-keyed update policy is flagged with the owner_id remedy in both states), plus an Amended header line only if the file's own convention has one; Prime Directive 13 wins over the body's "reword": the bullet's text is not rewritten. No gate, spec or lint change; nothing else (stop on breach; explain in the report)
Container & model: XS, mode:thread, model: CONTRACT_REVIEW_TIER (dispatch-gates --tier: MANDATORY — docs/adr/**, clause ①, no one-line exit), effort: xhigh (retriage answer 6446775539). Tier H (docs/adr/**): draft PR; ⛔ the dev never readies, arms or enqueues it.
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (a declaration left stale by landed lint work, #26591)
Thread-read: 6446775539
Premise: holds (seat re-measure on origin/main 8eef9a8db4: ADR-0055:176 still says a caller-keyed update / all policy "is flagged with the opt-in as the fix")
Serial constraints cleared: no open PR names docs/adr/0055* (read over every open PR's files at 18:40Z)

os-dev-report

{
  "issue": 26686,
  "status": "done",
  "branch": "claude/project-thread-gq6be9",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/26862",
  "session": "session_01ADHkmPxbS3CePBs6PrwdLc",
  "premise_still_valid": true,
  "summary": "ADR-0055's Lint bullet (the 2026-10-26 amendment, 'What the opt-in does, exactly') is kept byte-for-byte and gains a dated note directly under it, in the file's own in-place form, stating the arm main carries since #26591 / PR #26658: the opt-in is prescribed only for an update/all policy keyed on owner_id on a controlled_by_parent detail that carries owner_id and has not opted in; every other caller-keyed update policy is flagged in both states with the owner_id remedy, never the opt-in; the open question (widening the runtime leg to a named owner field) is named as the maintainer's on #26591 and not decided. The Status line gains the matching Amended entry, as every in-place note in this file has one. Premise re-verified on origin/main 8eef9a8d (the delta's 0ea90c7a moved on; L176 unchanged). Draft PR, Tier H (docs/adr/**), two inserted lines, no deletions, no gate/spec/lint change, no changeset (skip-changeset sent with the create and read back).",
  "tests": "none owed: docs-only diff under docs/adr/, no package touched, no tested behaviour changed, no ablation. Acceptance reading: ADR-0055 declares 0 machine-readable decision letters at base (origin/main 8eef9a8d) and at head a7fbcca4 by the four grammars check-adr-anchors.mjs reads (headings, bold leads, table cells: 0/0/0 both sides).",
  "gates": "local subset at head a7fbcca4, after the only commit: build closure `pnpm turbo run build --filter='@objectstack/lint...' --concurrency=2` under os-verify-lock (VERDICT command-exit 0, held 102s); `dispatch-gates --commands --repo objectstack-ai/objectstack` derived 21 commands (1 path vs merge base 8eef9a8d), each run serially with stdin closed, all exit 0 (check-adr-links + self-test, check-closing-keyword-parity + self-test, check-comment-mask-corpus, ci/plan-test-core-shards --self-test, lint check:doc-formula-expressions, check:adr-anchors, check:adr-index, check:adr-symbol-anchors, check:ci-filter-parity, check:closed-ceremony-text, check:cross-package-test-inputs, check:doc-authoring, check:driver-memory-census, check:gitlink-declared, check:nul-bytes, check:pm-governed-merges, check:pm-prior-rulings, check:refd-timer-probe, check:watch-hint-literal); `--ran`: 21 derived, 21 run, 0 NOT-MEASURED, 0 UNRUN (derived zero). `--tier`: MANDATORY docs/adr/** (clause ①, no one-line exit), changed lines 2 (+2/-0). CI families: the PR's check-runs (in_progress at report time, not re-run locally).",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "0 — no MCP GitHub calls; card, #26591, PR #26658 and the PR read-back were unauthenticated REST GET reads (curl), plus the harness subscribe_pr_activity on #26862",
  "api_writes": "3 — git push origin claude/project-thread-gq6be9 (a7fbcca4); relay pr_create (fleet-write run 40564652337: POST /repos/objectstack-ai/objectstack/pulls, then /issues/26862/assignees [os-steve], /issues/26862/labels [skip-changeset], and the relay's own Tier H follow-up requesting hotlong, os-zhuang); this os-dev-report comment via post-stamped.mjs",
  "line_budget": "n/a — no skills/** or .claude/skills/pm-dispatch/** path in the diff",
  "deviations": "none. The Status-line entry is the second inserted line: the delta allows it 'only if the file's own convention has one', and every in-place note in this file (2026-09-07, 2026-10-22 x2, 2026-10-26) is paired with one there.",
  "files_changed": ["docs/adr/0055-master-detail-controlled-by-parent.md (+2/-0: line 7 Status entry, line 178 note under the Lint bullet)"],
  "open_questions": [],
  "out_of_scope_findings": []
}

ACCEPT → PR #26862 · domain:skills#1 · 2026-10-27T19:01Z · Tier H; draft until a GOVERNED_APPROVERS approval; contract review (≥ xhigh) requested from the director seat.

Landed · domain:skills#1 · session_01ADHkmSrRBdu9MdC6fc33Uu · 2026-10-27T23:47Z — PR #26862 merged through the queue (merge commit eac28c35e7) on the os-zhuang approval, after the director's PASS 6451068016; ADR-0055's Lint bullet carries the dated note stating the narrowed opt-in arm. The card closed by its Fixes line; pm:dispatched stripped in this act. The widening question stays the maintainer's on #26591.

Navigation Menu

Repository navigation

docs(adr): ADR-0055's lint bullet still says every caller-keyed policy on a controlled_by_parent detail gets the ownerMayEdit opt-in as the fix; since #26591 only an owner_id-keyed one does #26686

Triage: audit line · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T13:04Z

Retriage answer: lane `domain:skills` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T15:57Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

docs(adr): ADR-0055's lint bullet still says every caller-keyed policy on a controlled_by_parent detail gets the ownerMayEdit opt-in as the fix; since #26591 only an owner_id-keyed one does #26686

Description

Activity

objectstack-fleet commented on Oct 27, 2026

Triage: audit line · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-27T13:04Z

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

Retriage answer: lane domain:skills · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-27T15:57Z

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: audit line · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T13:04Z

Retriage answer: lane `domain:skills` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T15:57Z