[objectstack-fleet]

Requested by Tesla · project thread

Fixes #28427

Clause-②: no
Metadata-protocol: none

Tier H. The diff touches docs/adr/** only, a governed surface (CODEOWNERS @os-zhuang @hotlong). It lands only on an authorized approval; no seat merges, queues or arms it before that.

维护者速读

• 改了什么：ADR-0143 D5 加一条记录：manage_connector_connections 的默认持有者是平台管理员和两个组织管理员权限集（organization_admin，以及经派生得到的 organization_admin_no_bypass），其余岗位只能显式授予。
• 为什么改：卡 security: grant manage_connector_connections to organization_admin (and its no-bypass variant) by default, before ADR-0143 S4's Console Connect (ruling B on #28327) #28427 第 4 项要求把裁决 B 记进 ADR。代码已由 feat(plugin-security): organization administrators hold manage_connector_connections by default (ADR-0143 D5, ruling B) #28441 落地（8e874038），本 PR 只补这条决策记录，让读 ADR 的人看到默认持有者。
• 风险与回滚：只改文档 4 行，不改任何代码路径，记录的是已落地的行为。回滚即 revert 本 PR。
• 先看：docs/adr/0143-outbound-connector-auth-is-open-tier.md 的 D5 节新增的一条。
• 两分钟验证：打开该文件 D5 节，读新增的那一条，应与 feat(plugin-security): organization administrators hold manage_connector_connections by default (ADR-0143 D5, ruling B) #28441 的默认授予一致。
• 需要你做的：os-zhuang 审批本 PR（Tier H），之后席位落地。

What changes

ADR-0143 D5 already said who may connect is "a capability check the server slice declares". It now records that capability and its default holders, per ruling B (record 6545223261 on #28327): manage_connector_connections, organization-scoped, held by default by platform administrators and both organization-administrator sets (organization_admin, and organization_admin_no_bypass through its derivation). Every other position holds it only by explicit grant. The behaviour shipped in #28441 (squash 8e87403); this line is its record.

Acceptance notes

• Split from feat(plugin-security): organization administrators hold manage_connector_connections by default (ADR-0143 D5, ruling B) #28441 so that PR was not held as Tier H, as the card allows. This PR closes the card.
• No changeset: docs/adr/** publishes nothing (skip-changeset).
• The branch is the card thread's platform-assigned branch. After feat(plugin-security): organization administrators hold manage_connector_connections by default (ADR-0143 D5, ruling B) #28441's squash merge the remote branch was gone; this head merges origin/main into the old tip and adds one commit, so the diff against main is the ADR file alone.

Verification

Local, on the PR head: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 21 families for the 1-path change set. Each was run with stdin from /dev/null, and its exit was captured by redirect before any pipe. All 21 exit 0, including check:adr-links, check:adr-index, check:adr-anchors, check:adr-symbol-anchors, check:doc-authoring and check:pm-governed-merges. --ran: 21 derived famil(ies) accounted for — 21 run, 0 NOT-MEASURED.

---

Generated by Claude Code

[objectstack-fleet]

triage#1 · os-tesla · session_01L9qibw58ehQ2gRHP2h2Puz

Contract-review-claim: session_01L9qibw58ehQ2gRHP2h2Puz · head 94355f4ffc090cdcc439643aef7c7b21a4197fb8 · 2026-10-31T17:48Z

[objectstack-fleet]

triage#1 · os-tesla · session_01L9qibw58ehQ2gRHP2h2Puz

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 94355f4ffc090cdcc439643aef7c7b21a4197fb8
Local-runs: none
Scope: docs/adr/0143-outbound-connector-auth-is-open-tier.md, one four-line bullet under D5 naming manage_connector_connections and its default holders. 1 file, +4/−0. Fixes #28427 item 4 (ruling B 6545223261 on #28327; claim 6545275282; code half PR #28441 merged 8e874038, landing record 6546606809). Tier H by path (docs/adr/**), skip-changeset.
Inputs: card #28427 body, claim, dev report 6545987804 and landing record, the PR body, the whole PR diff, the ruling record 6545223261 and this lane's own PASS on #28441 (6546313449: organization_admin gains the capability in default-permission-sets.ts, organization_admin_no_bypass through deriveWallLessOrgAdmin, admin_full_access already held it; member_default / viewer_readonly withheld), check-runs (read 2026-10-31T17:52Z: all 41 latest-per-name check-runs completed, 23 success + 18 skipped, none failed, none running) — 41 checks. Nothing built or run here; the seat's 21 derived gates are the PR body's.

① Derived judgments

• The line records what shipped. The bullet names the capability (manage_connector_connections, organization-scoped), the three default holders (platform administrators, organization_admin, and organization_admin_no_bypass through its derivation) and the rule that every other position holds it only by explicit grant. That is exactly the set feat(plugin-security): organization administrators hold manage_connector_connections by default (ADR-0143 D5, ruling B) #28441's pins assert and the set the ruling B record names; nothing wider, nothing narrower.
• Placement. It sits under D5 directly after the sentence it completes ("Who may connect, reconnect or revoke is a capability check the server slice declares"), before D6; the existing anchor link in the previous bullet is untouched. The ADR's status block is not amended: this is a decision record filled in, not a reversal of any D5 clause.
• Declarations. Clause-②: no, Metadata-protocol: none, skip-changeset: a docs-only diff, nothing published, nothing served. Correct.
• Card closure. Fixes #28427 is right here: items 1–3 landed with feat(plugin-security): organization administrators hold manage_connector_connections by default (ADR-0143 D5, ruling B) #28441 (Part of), item 4 is this line, so the merge closes the card.

② Rulings cited

• 6545223261 (director, Tesla 「同意」 batch [WIP] Update action run status for job #432, letter B on security: a dedicated org-scoped manage_connector_connections capability for connecting OAuth2 connector instances (before ADR-0143 S4's Console flow) #28327): default grant to both organization-admin sets before S4 — recorded as ruled. No open ruling.

③ Narrowing / widening

• None; prose only.

④ Behaviour / flags

• Tier H: docs/adr/** — os-zhuang (or hotlong) approval owed before landing; the seat requests it.
• The agent-acting-for-an-admin question (feat(plugin-security): organization administrators hold manage_connector_connections by default (ADR-0143 D5, ruling B) #28441's out-of-scope finding) is on the maintainer's list (batch [WIP] Update all package versions to 0.7 #435) and is not touched by this line.

Implemented-by: claude/project-thread-jtzyzv
Reviewed-by: session_01L9qibw58ehQ2gRHP2h2Puz
VERDICT: PASS

[objectstack-fleet]

domain:server#1 · os-tesla · session_01L9qibz3ZUbZ8Qcn1rDw9yc

维护者速读

• 改了什么：ADR-0143 的 D5 下补一条记录：「管理连接器连接」是组织范围的能力，默认由平台管理员和两套组织管理员权限集持有，其他角色只能显式授予。只改文档，共 4 行。
• 为什么改：你对 security: a dedicated org-scoped manage_connector_connections capability for connecting OAuth2 connector instances (before ADR-0143 S4's Console flow) #28327 的裁定 B（批次 [WIP] Update action run status for job #432 的「同意」）。代码那半已经在 feat(plugin-security): organization administrators hold manage_connector_connections by default (ADR-0143 D5, ruling B) #28441 合并（8e874038），这里补上 ADR 记录。
• 风险与回滚：只是文字，不影响运行。回滚即 revert。
• 先看：docs/adr/0143-outbound-connector-auth-is-open-tier.md 的 D5 最后一条。
• 两分钟验证：读那一条，对照 feat(plugin-security): organization administrators hold manage_connector_connections by default (ADR-0143 D5, ruling B) #28441 的持有者测试（admin_full_access 加两套组织管理员权限集）。
• 需要你做的：Tier H，需要 os-zhuang（或 hotlong）批准。合并后 security: grant manage_connector_connections to organization_admin (and its no-bypass variant) by default, before ADR-0143 S4's Console Connect (ruling B on #28327) #28427 自动关闭。

席位意见：契约复审 PASS，记录的内容与已上线的代码一致。可以批准。

席位核对

ACCEPT · seat domain:server#1 · head 94355f4f · 2026-10-31T17:53Z

1. Shape: Fixes #28427 (item 4; items 1–3 landed with feat(plugin-security): organization administrators hold manage_connector_connections by default (ADR-0143 D5, ruling B) #28441). Draft, base main, 1 file, +4/−0, skip-changeset. No packages/spec path.
2. Ruling: B 6545223261. The bullet names manage_connector_connections, its three default holders and the explicit-grant rule for everyone else. That is the set feat(plugin-security): organization administrators hold manage_connector_connections by default (ADR-0143 D5, ruling B) #28441's pins assert.
3. Contract review: lane PASS 6547038977 at this head.
4. Gates / check-runs: the PR body reports 21/21 derived gates exit 0 and --ran with 0 NOT-MEASURED. On head 94355f4f, all 41 check-runs completed: 23 success, 18 skipped, 0 failed.
5. Accepted deviation: the head is the old jtzyzv tip, plus a merge of main, plus the ADR commit. A restart from main was not possible because the remote branch had been auto-deleted and the lease push was refused. The diff against main is the ADR file alone, and the PR squashes to one commit.
6. Landing: GOVERNED, Tier H (docs/adr/**). The seat readies the PR, and the relay requests os-zhuang and hotlong. No auto-merge is armed by the seat. After an authorized approval, the seat lands it, or the maintainer enqueues it.