[objectstack-fleet]

Requested by Tesla · project thread

Part of #25554

The ADR half of ruling 6354966423 (letter B) on #25251, the follow-up of card #25554. #25483 made a runAs: 'system' flow's governed writes to the four identity-assignment objects refused, and #25564 put that into the FlowSchema.runAs description and the ADR-0087 D3 ledger. Two ADRs still describe system flows as unconditionally elevated. docs/adr/** is a governed path, so these edits come as their own PR for a maintainer merge.

维护者速读(草稿)

• 改了什么: 只改两份 ADR 的文字。ADR-0073 新增一节带日期的 Amendment(2026-10-24),写明 runAs:'system' 流程对岗位持有、权限集授予、邀请、成员这四张表的写入会被拒绝(PERMISSION_DENIED),M2 里「system 始终是 god-mode」一句按这个例外来读;The #1888 user-less fail-open is wider than the lint that guards it — record-change flows fired by a system write run UNSCOPED, unlinted #3760 那节里的 sys_user_position 例子补一句指向新 Amendment。ADR-0096 的执行面表格里 system 流程那一行补上这个例外。
• 为什么改: 运行时(feat(plugin-security)!: a flow that runs as system writes no identity assignment #25483)和 spec 描述(docs(spec): the runAs description names a system run's refused identity-assignment writes, with its ADR-0087 D3 entry #25564)已经落地这条规则,ADR 还写着 system 流程不受限,三处说法不一致,AI 作者读 ADR 会被误导。
• 风险与代价(含回滚): 纯文档,不改代码、不发包,无运行时影响。回滚就是 revert 本 PR。
• 席位意见:
• 你要做的: 看一下 Amendment 的措辞是否准确,没问题就合并。

What changed

• ADR-0073: a dated ## Amendment: section (2026-10-24, Security: a runAs system flow writes identity-assignment rows (sys_user_position, sys_invitation) past the delegated-administration gate #25251), placed above the The #1888 user-less fail-open is wider than the lint that guards it — record-change flows fired by a system write run UNSCOPED, unlinted #3760 amendment, following that section's form. It names what is refused (the six governed verbs on sys_user_position, sys_user_permission_set, sys_invitation, sys_member, from a context with isSystem and a flowRunId), what is unchanged (reads, other objects, runAs:'user', flow-less platform writers), and the remedies. The The #1888 user-less fail-open is wider than the lint that guards it — record-change flows fired by a system write run UNSCOPED, unlinted #3760 amendment's note, whose example is "letting them write sys_user_position", gains one trailing clause pointing at it.
• ADR-0096: the surface table row Flow (runAs:'system') now reads "explicit elevation, except identity assignment", naming the four objects and the ADR-0073 amendment.

Verification

node scripts/pm/dispatch-gates.mjs --commands derived 20 families for this diff. All 20 exit 0, among them check-adr-links, check-adr-symbol-anchors, check:adr-anchors, check:doc-authoring and check:pm-governed-merges. dispatch-gates --ran: 20 run, 0 NOT-MEASURED. No changeset: docs/adr/** ships in no package.

🤖 Generated with Claude Code

https://claude.ai/code/session_013yig39ZouqWBxABRfM5FN4

---

Generated by Claude Code

[objectstack-fleet]

维护者速读

• 改了什么: Security: a runAs system flow writes identity-assignment rows (sys_user_position, sys_invitation) past the delegated-administration gate #25251 第二个 PR(docs(spec): the runAs description names a system run's refused identity-assignment writes, with its ADR-0087 D3 entry #25564)已合并，这个 PR 把文档补齐：ADR-0073 加一段带日期的修订，原 2026-07-28 修订末句补一个从句；ADR-0096 执行面表里 runAs:'system' 那一行写明例外。共 2 个文件，+16 / −2。
• 为什么改: ADR-0073 M2 还写着 runAs:'system' 全程无限制，但 feat(plugin-security)!: a flow that runs as system writes no identity assignment #25483 / docs(spec): the runAs description names a system run's refused identity-assignment writes, with its ADR-0087 D3 entry #25564 已经拒绝 system 流程写身份分配的四张表(sys_user_position、sys_user_permission_set、sys_invitation、sys_member)。文档不改，作者会照旧规则写流程。
• 风险与代价(含回滚): 只改文档，不碰运行时，不需要迁移，不影响 18.1 发版。回滚就是 revert 这一个提交。
• 席位意见: 建议合并。内容已对照已合并的代码核过。头提交上 46 项检查：32 成功，13 跳过，1 项取消(被新运行取代的 Governed Surface Queue Guard)，无红。
• 你要做的: 无。os-zhuang 已 Approve 并在 02:22Z 入队。

席位核对 · ACCEPT · domain:spec seat 1 (seat post #6017) · os-tesla · session session_013odhA26dvzy7pQmevdTTvy · 2026-10-24T02:23Z

Head aab896300b · Part of card #25554 (closed by #25564) · ruling 6354966423 (letter B) on #25251 · contract review on #25564 6377874212, whose ADR follow-up this PR carries.

• Shape: base main, 2 governed ADR files, +16 / −2, skip-changeset (docs only, releases nothing).
• Content checked against the merged code: the four refused objects, the isSystem + flowRunId context (resolveRunDataContext), refusal ahead of the isSystem short-circuit with PERMISSION_DENIED, what is unchanged (reads, other objects, runAs:'user' under the ADR-0090 D12 gate, flow-less platform writers), and the named remedies. They match feat(plugin-security)!: a flow that runs as system writes no identity assignment #25483 and docs(spec): the runAs description names a system run's refused identity-assignment writes, with its ADR-0087 D3 entry #25564, including the D3 entry flow-run-as-system-identity-assignment-write-refused. The ADR-0096 row cites the Amendment and Security: a runAs system flow writes identity-assignment rows (sys_user_position, sys_invitation) past the delegated-administration gate #25251 / feat(plugin-security)!: a flow that runs as system writes no identity assignment #25483.
• Landing: approved by os-zhuang (a human, on the governed path) and queued by them. The seat takes no merge action.

---

Generated by Claude Code