[objectstack-fleet]

Fixes #25574

Clause-②: yes (widening)
Metadata-protocol: added
Ruling-ref: 6377889413

Implements ADR-0138 D5 as ruling B on #25447 (6377889413, the governing record per reconciliation 6377958424) decides it, verbatim: 「公共表单发布时绑定一个组织（URL 携带组织，授予通道按 #23224 解析 D4 的方式解析它），访客锚点的绑定在该组织下求值，ADR-0138 其余不变」. One cross-domain PR under triage answer A (6382869387); the ADR-0138 dated note rides its own Tier H docs PR (claude/issue-25574-adr-0138-d5-note), so no docs/adr/** path is in this diff.

What changes

• The binding (spec). SharingConfigSchema (packages/spec/src/ui/sharing.zod.ts, carried by FormViewSchema.sharing, the one declaration of a form's public publication) gains organizations: a non-empty list of organization slugs the form is published to. organization / orgs / tenants are refused and pointed at it. anonymousFormIntakeOrganizations(sharing) (packages/spec/src/ui/anonymous-form-intake.ts, re-exported by @objectstack/metadata-core) reads it, beside the candidates half of the intake rule.
• The decision (core). resolvePublicFormOrganization (packages/core/src/security/public-form-organization.ts, beside guest-organization.ts): unbound (the form lists none and the link names none: ADR-0138 D4 decides, unchanged), bound (the link names a listed slug and exactly one organization carries it), or refuse (every other case). The organization id is the server's own read of the listed slug, as the system; the client only selects among the slugs the author published to (D4 item 1).
• The doors (rest). Both GET /forms/:slug and POST /forms/:slug/submit read ?organization=SLUG once, in resolveFormBySlug. A refusal is answered exactly as an unpublished form, 404 FORM_NOT_FOUND, so an anonymous caller learns nothing about which organizations exist or which a form lists. On a bound link the submit context carries tenantId = that organization: the engine's write target, so the row lands there and its autonumber counts there. The form grant (publicFormGrant, permissions: ['guest_portal']) is unchanged.
• The posture predicate (metadata-core). anonymousFormIntakeUnavailability takes the form's binding as an optional fourth argument: a bound form is never withheld on a walled posture, because the reason it states (an anonymous submission carries no organization) does not hold. Omitted, the form is judged unbound, which fails closed. Its three readers pass it: the door, the administrator's read of the view (rest-server.ts) and the save/publish advisory (metadata-protocol runtime-authoring-gate.ts), so none of them states that a bound form is not offered.
• Unchanged. The unbound form keeps D4 exactly: no URL change, the engine derives the single organization or refuses. ADR-0138's doors, grants channel and anonymous default-deny are untouched.

Booted measurement (the card's acceptance)

examples/app-showcase, built at this branch, booted with OS_TENANCY_POSTURE=isolated OS_PLATFORM_OWNER_EMAIL=admin@objectos.ai OS_AUTH_MEMBERSHIP_POLICY=invite-only pnpm dev -- --fresh -p 38517 (the multi-organization runtime present, the wall standing). Measurement-only edits, not committed: showcase_inquiry gained inquiry_number: Field.autonumber({ autonumberFormat: 'INQ-{0000}' }), and the contact-us form's sharing gained organizations: ['acme', 'globex']. Signed in as the seeded admin, three organizations were created through POST /api/v1/auth/organization/create: acme, globex (listed) and initech (not listed). Every form call below is anonymous (no cookie). Submissions were interleaved acme, acme, globex, acme, globex.

$ curl 'http://localhost:38517/api/v1/forms/contact-us?organization=acme' (anonymous)
  -> HTTP 200
$ curl 'http://localhost:38517/api/v1/forms/contact-us?organization=globex' (anonymous)
  -> HTTP 200
$ curl -X POST 'http://localhost:38517/api/v1/forms/contact-us/submit?organization=acme' (anonymous)
{"id":"woCBvr3EckjEfSma"}  -> HTTP 201
$ curl -X POST 'http://localhost:38517/api/v1/forms/contact-us/submit?organization=acme' (anonymous)
{"id":"_KGn9ByUZN9kjkt3"}  -> HTTP 201
$ curl -X POST 'http://localhost:38517/api/v1/forms/contact-us/submit?organization=globex' (anonymous)
{"id":"oXEejpYFiWZk_i0i"}  -> HTTP 201
$ curl -X POST 'http://localhost:38517/api/v1/forms/contact-us/submit?organization=acme' (anonymous)
{"id":"744_CWxhRR0Gy44I"}  -> HTTP 201
$ curl -X POST 'http://localhost:38517/api/v1/forms/contact-us/submit?organization=globex' (anonymous)
{"id":"Cdmtw-BnfoUNUxdF"}  -> HTTP 201
--- refusals
$ curl 'http://localhost:38517/api/v1/forms/contact-us' (anonymous)
  -> HTTP 404
$ curl 'http://localhost:38517/api/v1/forms/contact-us?organization=initech' (anonymous)
  -> HTTP 404
$ curl 'http://localhost:38517/api/v1/forms/contact-us?organization=nosuch' (anonymous)
  -> HTTP 404
$ curl -X POST 'http://localhost:38517/api/v1/forms/contact-us/submit' (anonymous)
{"code":"FORM_NOT_FOUND","error":"No public form configured at /forms/contact-us"}  -> HTTP 404
$ curl -X POST 'http://localhost:38517/api/v1/forms/contact-us/submit?organization=initech' (anonymous)
{"code":"FORM_NOT_FOUND","error":"No public form configured at /forms/contact-us"}  -> HTTP 404
$ curl -X POST 'http://localhost:38517/api/v1/forms/contact-us/submit?organization=ACME' (anonymous)
{"code":"FORM_NOT_FOUND","error":"No public form configured at /forms/contact-us"}  -> HTTP 404
$ curl -X POST 'http://localhost:38517/api/v1/forms/contact-us/submit?organization=acme&organization=globex' (anonymous)
{"code":"FORM_NOT_FOUND","error":"No public form configured at /forms/contact-us"}  -> HTTP 404
$ curl -X POST 'http://localhost:38517/api/v1/forms/contact-us/submit?organization=nosuch' (anonymous)
{"code":"FORM_NOT_FOUND","error":"No public form configured at /forms/contact-us"}  -> HTTP 404
--- where the rows landed: GET /data/showcase_inquiry?fields=name,inquiry_number,organization_id (signed in as the platform admin, who reads every organization), grouped by organization_id
  acme (fzmferbvGd1rtSTN7JnwRcLwdBLjP1ye): INQ-0001 Priya Raman, INQ-0002 Tom Okafor, INQ-0003 Lena Fischer, INQ-0004 Acme supplier 1, INQ-0005 Acme supplier 2, INQ-0006 Acme supplier 3
  globex (1OfHk5SXSdHMSRaYjPhVdxtTrhhNKKxf): INQ-0001 Priya Raman, INQ-0002 Tom Okafor, INQ-0003 Lena Fischer, INQ-0004 Globex supplier 1, INQ-0005 Globex supplier 2
  initech (9IlPD4jOTuUqbEeP90K5Clzs1SL5vcye): INQ-0001 Priya Raman, INQ-0002 Tom Okafor, INQ-0003 Lena Fischer
  default organization (org_mvmbtv1iac5394ep): INQ-0001 Priya Raman, INQ-0002 Tom Okafor, INQ-0003 Lena Fischer

Each organization's seed holds INQ-0001..0003; the anonymous submissions continued each organization's own sequence (acme INQ-0004..0006, globex INQ-0004..0005, interleaved), and nothing landed in initech or the default organization.

Tests

Read at head c990aed37 (after merging origin/main); the gate reconciliation below was taken on that tree.

• packages/spec: src/ui/sharing.test.ts, src/ui/anonymous-form-intake.test.ts (2 files, 46 tests); src/ui 153 files / 5623 tests passed.
• packages/core: new src/security/public-form-organization.test.ts (15 tests: unbound, bound per slug, each refusal reason with "the database is never asked", unknown and duplicated slug, exact match, outage propagates); src/security 55 files / 1118 tests passed.
• packages/metadata-core: anonymous-form-intake.test.ts (the bound form is available on both walled postures without reading the object; the binding omitted fails closed); package 19 files / 800 tests passed.
• packages/metadata-protocol: package 263 files / 21473 tests passed (3 files skipped).
• packages/rest: new src/public-form-organization.test.ts (15 tests: each listed organization's link writes tenantId = that organization on isolated and single; every refused link equals the unpublished form's answer byte for byte with nothing written and no organization read; the admin read raises no warning for a bound form; the unbound form keeps D4 and refuses a link naming an organization). Package 321 files / 6412 tests passed; after merging origin/main (which brought feat(spec,cli,lint): translate a form section entry's label, placeholder and helpText from _sections.SECTION.fields.FIELD #25620's public-form-section-i18n.test.ts pin), the nine public-form* files 127/127 passed.
• packages/qa/dogfood: no public-form dogfood test reads sharing.organizations; not run locally, declared to CI.
• Typecheck: spec, core, metadata-core, metadata-protocol, rest all tsc --noEmit clean.
• Ablation (each leg through scripts/ablation-replace.mjs, restored to a byte-identical blob): deleting the door's tenantId threading turns 4 of 15 rest tests red; deleting the door's refusal return turns 7 of 15 red.

Gates

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at c990aed37 derived 119 commands; all 119 run, each exit captured before any pipe, all exit 0, and --ran reconciles: "119 derived famil(ies) accounted for — 119 run, 0 NOT-MEASURED (a DERIVED zero)". One needed a second run: check-plugin-teardown-shape.mjs --self-test first exited 3 because this shallow clone could not reach its pinned positive-control commit; after fetching that one commit it exited 0. packages/spec check:generated: all 14 generated artifacts up to date after the merge. check:dev-prereqs (local only): exit 0. The full farm is CI's.

Acceptance notes

• Slug, not id. The binding names organization slugs: they are what a public notice link carries and what an administrator sees (sys_organization.highlightFields), and they are globally unique. An organization whose slug changes stops matching its links, which fails closed (404).
• The console page. The REST door is the contract. /_console/f/:slug (objectui) must forward ?organization= to the API for a bound form to render there; that is objectui's side and not in this repository.
• No closed query set on these two routes. The doors now read req.query.organization; they are existing routes, and converting them to refuseUnknownQueryParams would be a narrowing outside this card. An unbound form's link that names an organization is refused rather than ignored, so a stray parameter cannot land a row in an organization the link did not ask for.
• The guest anchor. The form doors run under the form grant, not the D3 guest envelope; on a bound link every set resolution and the result masker run under the bound organization because the context carries it. No guest anchor binding is read at these doors, before or after.
• Mechanism readings. The multi-organization refusal a form submission met was not guest-organization.ts (that is the class 4/5 endpoint doors' refusal, unchanged here) but two others: on a walled posture, the door's 404 from anonymousFormIntakeUnavailability; on single with several organizations, the engine's SystemWriteOrganizationRequiredError (ADR-0131 D9). A bound form clears both. metadata-core's predicate and its two non-door readers are therefore in this diff, beyond the claim's declared file surface; the alternative left the admin read and the save/publish advisory telling the author a bound form is not offered while the doors serve it.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 5 package(s): @objectstack/core, @objectstack/metadata-core, @objectstack/metadata-protocol, @objectstack/rest, @objectstack/spec, touching 10 documentable anchor(s). ⚠️ 4 changed file(s) yielded no anchor (packages/spec/api-surface/ui.json, packages/spec/authorable-surface/ui.json, packages/spec/export-origins/ui.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/ui/forms.mdx (via /forms/:slug (route, a path literal in SharingConfigSchema))
• content/docs/ui/public-data-collection.mdx (via /forms/:slug (route, a path literal in SharingConfigSchema))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-6.mdx (via /forms/:slug (route, a path literal in SharingConfigSchema))
• content/docs/releases/v17/17-7.mdx (via /forms/:slug (route, a path literal in SharingConfigSchema))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 4 changed file(s) yielded no anchor (packages/spec/api-surface/ui.json, packages/spec/authorable-surface/ui.json, packages/spec/export-origins/ui.json, …) — pages documenting those are invisible to this run
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 153 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 49653f91812815c72eb9194bf0a6cc451cf711f2 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 1cd6747cdc62e19ef97f486ca25cd2781ede626b — the merge of head 08b020c9d3757fcfa719256d02775d961cc906ed into base 49653f91812815c72eb9194bf0a6cc451cf711f2, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 1cd6747cdc62e19ef97f486ca25cd2781ede626b && git checkout 1cd6747cdc62e19ef97f486ca25cd2781ede626b
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 49653f91812815c72eb9194bf0a6cc451cf711f2 08b020c9d3757fcfa719256d02775d961cc906ed && git checkout -B drift-repro 49653f91812815c72eb9194bf0a6cc451cf711f2 && git merge --no-ff 08b020c9d3757fcfa719256d02775d961cc906ed

node scripts/docs-audit/affected-docs.mjs --json 49653f91812815c72eb9194bf0a6cc451cf711f2

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 49653f91812815c72eb9194bf0a6cc451cf711f2 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

席位核对

ACCEPT · #25574 · domain:spec seat 2 (seat post #18549) · sunhaolin · session session_01PC4NPXPgPmpDRG9DdDnyXT · 2026-10-24T13:47Z · head 08b020c9d3 · reports 6384293192 (round 1) and 6384796585 (round 2) · seat review at TIER_DEFAULT. Both clause-② limbs hit (path: packages/spec/src/ui/sharing.zod.ts; declaration: Clause-②: yes), so a same-shape ## Contract review PASS at CONTRACT_REVIEW_TIER on the landing head is owed. That review also reads the Tier H note PR #25644 in the same pass. needs:contract-review is added in this stroke. The tier is behind its quota wall (HTTP 429, re-probed at this record), so this PR stays draft.

1. Shape. Draft, base main, first line Fixes #25574. Clause-②: yes (widening), Metadata-protocol: added and Ruling-ref: 6377889413 are line-initial. The changeset is minor on spec, core, metadata-core, metadata-protocol and rest, with both declarations. 22 files, +657/−20. Not governed (check-governed-merges --pr 25641: 677 lines). The claim surface was amended (6384437072). Round 2 added only rest-server-canonical-query-ast.test.ts (named there) and content/docs/ui/forms.mdx (the seat's addendum).
2. The ruling, measured on the diff. Ruling B, verbatim: 「公共表单发布时绑定一个组织（URL 携带组织，授予通道按 ADR-0138 E1: the grants channel — the guest entry resolves D4's organization, then the guest anchor's bindings (D3, D4) #23224 解析 D4 的方式解析它），访客锚点的绑定在该组织下求值，ADR-0138 其余不变」.
   • The binding: SharingConfigSchema.organizations, a non-empty list of slugs.
   • The decision: resolvePublicFormOrganization, with three arms (unbound, bound, refuse). The server reads sys_organization by slug as the system, limit: 2, so a duplicated slug refuses.
   • The doors: both read ?organization= once in resolveFormBySlug. Every refusal returns null, which is the unpublished form's 404 FORM_NOT_FOUND. The submit context carries tenantId = the bound organization.
   • The posture predicate takes the binding as an optional fourth argument, failing closed. Its two non-door readers pass it.
   • An unbound form keeps D4.
   • The booted measurement in the PR body (showcase, isolated, three organizations) shows each listed organization's own INQ sequence, and 404 with nothing written for every refused link.
3. Changeset and docs, checked line by line against the diff.
   • The changeset's six bullets match the doors (the repeated parameter is in the booted measurement), the posture predicate, the readers' warnings, the refused aliases and the exports.
   • forms.mdx (08b020c9d3): the walled-posture exception, the new subsection, and the 404 row each match form-routes.ts. public-data-collection.mdx :51 still holds.
4. Gates. Check-runs on 08b020c9d3 at this record: 40 in all; 34 completed, none failed; 6 in progress. Local, per round 2 (on 39d31d67b; the docs commit after it touches no code):
   • rest test:repo was red before the fix (expected 5 to be 4) and 5 files / 280 passed after it; core test:repo 6/82; spec test:repo 79/1269.
   • 119/119 derived, --ran DERIVED zero.
   • Round 1's suite readings stand. Ablations: tenantId 4/15 red, the refusal 7/15 red.
   • Landing waits for every check green and the contract-review PASS.
5. Deviations accepted.
   • (a) The surface beyond the claim (addendum 6384437072).
   • (b) The PM's guest-organization.ts lead was disproved by measurement.
   • (c) The primary checkout was detached inside the dev's own container.
   • (d) Round 1's rest count was the local project only, which is how the census red reached CI. Round 2 ran test:repo for rest, core and spec.
   • (e) The PR body's Tests and Gates sections still cite c990aed37. This record carries the round-2 readings.
   • mcp_calls 0; relay writes 4.
6. Open questions, boundary flags and out-of-scope outcomes.
   • Slug rather than id; the ?organization= query parameter rather than a path segment; the optional fourth argument. All are implementation choices inside the ruling, recorded as trade-offs. The contract review answers them as boundary flags.
   • For the contract review: on an unbound form, a link that names an organization is now refused with 404 where it was served before (the parameter had no meaning). The PR declares (widening). The review judges whether this one refusal is a narrowing that needs declaring. No producer sends the parameter today.
   • For the contract review: an anonymous caller triggers a system-context read of sys_organization by a slug it chooses, with only id projected and the answer folded into the unpublished-form 404.
   • objectui's /_console/f/:slug must forward ?organization= for a bound form to render there. The seat files the objectui follow-up at merge.
   • The two form routes read req.query without a closed set: Acceptance notes (converting existing routes is a narrowing outside this card).
7. Landing. Not governed, 677 changed lines. Once a CONTRACT_REVIEW_TIER PASS is on record and every check on the then-current head is green, the seat sends pr_ready + automerge_enable through the relay. The Tier H note PR docs(adr): ADR-0138 dated note — D5 is built for the public form doors #25644 follows, on a human merge.

---

Generated by Claude Code

[os-elon-musk]

Ruling: #25574 re-ruled A · maintainer 「25447 A」 2026-10-24T16:06:19Z · record #25574 comment 6386464761

多组织托管环境不提供公共表单，维持 ADR-0138 D4；⛔ 不建包声明式的 sharing.organizations 绑定。本 PR 不合并：请 spec 席经 relay 关闭（分支 claude/issue-25574-public-form-organization 保留，不删），并撤回认领 6383098358。维护者原话：「ADR-0138 不现实啊，我开发元数据应用的时候，根本不知道哪个组织用啊」「如果 多组织托管环境里 不支持公共表单是不是最简单？」

---

Generated by Claude Code

[objectstack-fleet]

Closed unmerged · domain:spec seat 2 · 2026-10-24T16:12Z · ruling A 6386464761 on #25574 (the maintainer's 「25447 A」), and the maintainer's word in the seat's session 「25447 决定不支持，可以关卡 25644 作废」: ADR-0138 D5 is not built. The branch is kept. The record is on #25574.

---

Generated by Claude Code