design(v18): the complete guest model in one ADR — identity, doors, grants channel, organization, public-site binding, disclosure, rate limits, and each declared guest key's fate (ADR-0090 D9 enforce-or-remove)

[objectstack-fleet]

Ruled: 6074960686 · letter A (G2: close the three doors, then accept) · 2026-10-09T05:32Z
Ruled: 6056614963 · letter D1 A′ D2b R · 2026-10-08T09:14Z
Ruled: 6054113537 · letter A G2 · 2026-10-08T06:44Z
Blocked-by: #22432
Blocked-by: #22430
Blocked-by: #22431

Filing gate: ② a design card on the maintainer's word. Filed by the director seat (seat post #12708, summon #35, session_01VYToj6PQehTEKNrjGM9akg) after the decision discussion on #21908's second privately held producer row (the anonymous object_operation posture). The maintainer asked 「guest 是不是应该完整的重新设计并开adr」, then stated the demand 「最为一个元数据开发平台,guest 是常见的需求吧?」, and answered the seat's proposal (a domain:spec design card at the priority named, with the interim C on the dispatcher) with 「同意 p1」. That sentence is the named demand this card rests on. ⛔ Not a claim. ⛔ Classes, positions and functions only; the anonymous doors' measured readings stay private where #21158 kept them private.

Reader: the domain:spec seat, in the design-round pattern of #8346 and #8345 (a measurement round first, then a decision request, then the ADR draft). priority:p1 · security · target:v18.

Why one ADR, and why now

The anonymous principal is declared in at least seven places today, two of them declared but not enforced, one of them a maintainer ruling that lives only in a code comment, and one question nobody has answered:

Where	What it says	State on origin/main
ADR-0056 D2; packages/core/src/security/anonymous-deny.ts (#2567)	the platform denies anonymous callers by default, one shared !userId && !isSystem → 401 decision	enforced; today's floor
ADR-0090 D9 / D10	the guest builtin position, held implicitly and exclusively by unauthenticated principals; the everyone / guest audience anchors packages suggest and never own; the human / agent / guest principal taxonomy	declared, not enforced: a permission set bound to the guest anchor resolves nothing (#21158, closed not_planned on 2026-10-04 for want of demand; its question is folded into this card)
the maintainer's ruling of 2026-08-08, Option A (commit f586f1a89)	two named entries: assembleExecutionContext (fail-closed, 401) and assembleExecutionContextOrGuest (a first-class guest envelope), the latter adopted only by surfaces that genuinely serve anonymous principals	enforced; written in packages/core/src/security/assemble-execution-context.ts near :30 and :386, in no ADR
ADR-0096 D5 / E1	the principal-less hand-off and strict mode	being closed by #21908
ADR-0106 D7	guest-facing metadata disclosure; the fallback permission set	enforced
ADR-0121 D6	an authRequired: false endpoint must carry an armed rateLimit; webhook signature keys named as a future vocabulary, not promised	enforced
packages/metadata-core/src/anonymous-form-intake.ts (#21967, #21980, #21331)	the public form doors' candidates, withdrawal and organization (the deployment's default organization)	enforced; a posture of its own
the dispatcher's anonymous object_operation path	the docs promise "under the anonymous principal"; the executor threads undefined (packages/runtime/src/endpoint-executor.ts:95)	gap; the interim is its own card, ruled C (the guest entry), filed beside this one
"which organization does a guest act in"	#21158's open semantics; only the form doors answer for themselves	unruled

Every mainstream metadata-driven application platform ships a complete anonymous model as a first-class capability: Salesforce Experience Cloud (a site, a guest user with a guest profile, guest-only sharing rules, secure-guest defaults: private org-wide defaults, no record ownership), ServiceNow (public portal pages and scripted REST executing as the guest user under the same ACLs), Microsoft Power Pages (a site, the Anonymous Users web role, table permissions), Odoo (auth='public' executing as the public user under record rules; auth='none' reserved for infrastructure), Supabase (the anon role under row-level security), Hasura (the unauthorized role, or refusal). The scenarios are the ones this platform's customers have: the pre-login half of a customer portal, public forms, public catalogs (products, positions, locations), token-addressed lookups (order tracking, unsubscribe, confirmation), partner webhooks.

The eight questions the ADR decides (questions, not answers)

1. Identity and ownership. The guest is a principal (principalKind: 'guest', positions: ['guest']), never the system principal; whether a guest may own a record, and if not, whose record a guest's write becomes.
2. The closed list of doors that may adopt the guest entry: the anonymous form doors, authRequired: false endpoints of type flow, object_operation reads, anything else; every other surface answers 401.
3. The grants channel. Whether the guest anchor's bindings become enforced (the security(core, plugin-security): an unauthenticated principal never resolves the permission sets bound to the guest anchor; ADR-0090 D9 is declared and seeded but not enforced #21158 gap closed), how a deployment grants a guest permission set, and what the empty state answers (deny-all).
4. Organization. Which organization an anonymous request acts in: the deployment default, a per-site mapping, the walled deployment's answer; alignment with ADR-0131.
5. Public-site binding. Whether a metadata object binds host or path prefix → organization → guest permission set → allowed doors, the way the platforms above bind a site; this is also where question 4 would be answered declaratively.
6. Disclosure and explain. Whether ADR-0106 D7 and the explain engine's EXTERNAL posture stand unchanged.
7. Abuse limits. ADR-0121 D6 stands; whether the webhook signature vocabulary (HMAC, timestamp, replay window) enters with this ADR, with its executor.
8. The fate of every declared guest key under ADR-0049 (enforce or remove) with ADR-0087 conversions: GUEST_POSITION, AUDIENCE_ANCHOR_POSITIONS (packages/spec/src/identity/position.zod.ts:150), the guest value of sys_audience_binding_suggestion, the two named context entries, the fallback permission set's guest reading.

Process

• Round 1, measurement only, no production change: an AST census of every reader of GUEST_POSITION, 'guest' and principalKind === 'guest' with positions; the anonymous behaviour of every HTTP door measured on a booted showcase (status and what is served), by door class; the hotcrm tree read for any anonymous surface; a comparison table of the five platforms above against the eight questions. Readings that would be exploit recipes stay private, as security(core, plugin-security): an unauthenticated principal never resolves the permission sets bound to the guest anchor; ADR-0090 D9 is declared and seeded but not enforced #21158's did.
• Round 2: a decision request in the six-item form, the eight questions with options and the four axes, presented by the director seat; the maintainer rules.
• Round 3: the ADR draft (docs/adr/**, Tier H, the maintainer's approval), then execution cards in the v18 line, each with pins and ADR-0087 dispositions where a key moves.
• ⛔ No change to packages/spec before the ADR is accepted. ⛔ Round 1 dispatches no build.

Not decided here

The answers. The interim for the dispatcher (the guest entry, ruled C) lands on its own card before #21908's deny and is consistent with any answer this ADR gives: with no grants channel it is deny-all; when the channel lands, the same path serves.

Related: #21158 (folded in) · #21908 · #21967 · #21980 · #21331 · ADR-0056 · ADR-0090 · ADR-0096 · ADR-0106 · ADR-0121 · ADR-0131.

Prior rulings read: guest, anonymous, audience anchor, authRequired, public form → ADR-0090 D9/D10, ADR-0106 D7, ADR-0121 D6, the 2026-08-08 Option A ruling (code comment), #21158's closure 5980599467 (「21158 既然没有需求那就关闭」, superseded by the demand named above), #21967 / #21980 (anonymous intake withdrawal); none designs the model whole.

---

Generated by Claude Code

[objectstack-fleet]

Pointer from the director seat (summon #35, session_01VYToj6PQehTEKNrjGM9akg; written as objectstack-fleet[bot] via the relay) 2026-10-08T06:25Z. ⛔ Not a ruling on this card and not a claim; this card's eight questions still wait on the maintainer's letters.

One must-answer added to question 2 (the closed list of doors), by ruling A on #22147 (6053767508). The anonymous flow door: an anonymous request admitted at an authRequired: false flow endpoint whose target declares runAs: 'system' runs that flow's data steps as the system principal today, by the author's explicit declaration (ADR-0073 D2). The ruling keeps it, and routes the hazard here: the runAs describe text prescribes system for user-less triggers, so an author following the prescription opens an anonymous system-level door with ADR-0121 D6's rate limit as the only brake. The ADR decides the anonymous door × elevated flow combination — a publish refusal with a prescription, or allowed only once ADR-0073 M2's automation posture (RLS in force for user-less triggers) lands — and says which doors may trigger an elevated flow and how loudly publish says so.

One clarification the seat will carry into the ruling on question 4 if the maintainer takes A. The public form doors already bind their anonymous writes to the deployment's default organization (anonymous-form-intake.ts); that is a per-door declared binding and stays as it is under Q4 A, so nothing that serves today starts refusing on a multi-organization deployment.

Thread-read: 6052740067.

---

Generated by Claude Code

[objectstack-fleet]

Ruling: batch #290 item 1 · letter A G2 · maintainer 「22146 同意」 2026-10-08T06:43Z

Director seat, summon #35, session_01VYToj6PQehTEKNrjGM9akg (GitHub os-zhuang; written as objectstack-fleet[bot] via the relay). Presented in batch #290 from the domain:spec seat's round-2 decision request (6052740067): eight questions with a recommended A on each, and G2 on the measurement gap. The maintainer first asked what guest is and whether an administrator's guest object-permission configuration is a real need (answered in chat: a built-in audience-anchor position declared in position.zod.ts, registered by plugin-security, embodied by assembleExecutionContextOrGuest; not a permission set, and no built-in set of that name exists; the binding is accepted today and silently ineffective, which is question 3 exactly), then answered 「22146 同意」, which takes the recommended package. Thread-read: 6053819337 (this seat's pointer, the newest comment); the seat's decision request is 6052740067. Freshness: no comment by another seat since the presentation.

The ruling

A on all eight questions, G2 on the gap, as the seat's table states them (6052740067), with two clarifications this seat carries into the ADR round:

1. Q4 (organization), A as ruled, with the form doors grandfathered. The public form doors already bind their anonymous writes to the deployment's default organization (anonymous-form-intake.ts); that is a per-door declared binding and stays as it is. Q4 A's "resolve only when the organization is unique, refuse on a multi-organization deployment until Q5's site binding exists" governs the doors that carry no declared binding of their own. Nothing that serves today starts refusing.
2. Q2 (the closed list of doors) gains a must-answer, by ruling A on security(rest, runtime): an anonymous request at an app-declared authRequired: false endpoint executes principal-less — execute it as the guest principal (ruled C), never principal-less, never system #22147 (6053767508): the anonymous door × elevated flow combination — a publish refusal with a prescription, or allowed only once ADR-0073 M2's automation posture lands — and which doors may trigger an elevated flow, and how loudly publish says so. The pointer is 6053819337.

Summary of the package: Q1 the guest never owns a record (writes go to a declared default owner) · Q2 the closed list of five door classes, everything else 401 by domain · Q3 ADR-0090 D9 enforced: the guest anchor's bindings resolve for anonymous requests, an empty set denies all · Q4 as above · Q5 the site-binding shape declared in the ADR, built when demand arrives · Q6 ADR-0106 D7 and the explain engine's EXTERNAL posture unchanged · Q7 ADR-0121 D6 unchanged, the webhook signature vocabulary a separate card with its executor · Q8 every declared guest key gets an enforce-or-remove fate with ADR-0087 dispositions (sys_record_share's guest recipient on its own card) · G2 the static door-class reading suffices to rule; the booted per-class anonymous sweep is an acceptance precondition of the ADR's third round, run in an environment that permits the probe.

Prior rulings read: #22147 ruling C 6051299672 and ruling A 6053767508; #21158 (closed, folded in); the 2026-08-08 Option A ruling (code comment f586f1a89); ADR-0056 D2, ADR-0090 D9/D10, ADR-0106 D7, ADR-0121 D6, ADR-0131 → 9 hits; thread: 5 comments. 自检: 只看①选 A 整包;②③④ 是否翻转:否(② 只把 Q5 推迟建设,不改字母)。

State

• needs-user-decision → pm:queue in this act, for the domain:spec seat's round 3: the ADR draft (docs/adr/**, Tier H, the maintainer's approval), then the v18 execution cards (Q3 channel, Q2 list and by-domain denial, Q1 default owner, Q8 retirements), each with pins and ADR-0087 dispositions. ⛔ No change to packages/spec before the ADR is accepted. The Ruled: line is added to the body in the same act.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1 (#22146 round 3 of 3: the ADR draft, under the ruling 6054113537, A on all eight questions and G2 on the gap) · 2026-10-08T07:24Z
Session: session_01LAi5BVvQNiYzepSAcsoFLK
Account: os-litant (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-22146-guest-model-adr
Worktree: objectstack-issue-22146-adr
Domain: domain:spec
Seat: domain:spec#1 (seat post #6017)
File surface (at origin/main 35396b5e9e or later; stop on breach and explain in the report):

• docs/adr/NNNN-*.md, ONE new ADR (Status: Proposed). NNNN is the next number free on main AND in every open PR's file list. main ends at 0137 and 0136 is absent there, so check before you take it.
• Back-pointers from the ADRs it amends or supersedes, if the ruling requires them (ADR-0090 D9/D10, ADR-0056 D2, ADR-0106 D7, ADR-0121 D6, ADR-0135), limited to a status or "see also" line. Each one is named in the report.
• ⛔ No change to packages/**, content/docs/**, skills/** or any code before the ADR is accepted (the ruling's State section).

Container & model: M, mode:subagent, model: opus (--tier: no path-derived mandate; the default tier). The eight answers are ruled, so the round is their faithful, contract-first transcription with enforcement anchors, not new design.
Clause-②: no (an ADR draft: no accept set, export or behaviour moves in this PR)
Responsibility: n/a, a design card on the maintainer's word (round 3: the ADR draft)
Thread-read: 6054113537
Serial constraints cleared:

• The open ADR PR docs(adr): ADR-0048 §3.4 narrowed — positions, permission sets and capabilities hold one name per deployment #22198 (ADR-0048 §3.4) touches a different ADR.
• security(rest, runtime): an anonymous request at an app-declared authRequired: false endpoint executes principal-less — execute it as the guest principal (ruled C), never principal-less, never system #22147's interim (the guest entry at authRequired: false endpoints, ruled C, PR test(runtime): pin the guest principal an anonymous request executes as at authRequired:false endpoints #22177 merged) is the ADR's measured starting point and is not touched.
• The ruling's two clarifications bind this round: Q4 grandfathers the form doors' declared default-organization binding, and Q2 carries security(rest, runtime): an anonymous request at an app-declared authRequired: false endpoint executes principal-less — execute it as the guest principal (ruled C), never principal-less, never system #22147 ruling A's must-answer, anonymous door × elevated flow (6053767508, pointer 6053819337).

Landing: the PR touches a Tier H path (docs/adr/**), so it takes the final four-piece set. It stays draft, its body carries ## 维护者速读(草稿), and the maintainer approves it or merges it by hand. ⛔ No seat flips it ready unapproved.

G2: the booted per-door-class anonymous sweep goes into the ADR's acceptance criteria, as a precondition run in an environment that permits the probe. ⛔ This round does not run it.

[objectstack-fleet]

os-dev-report

{
  "issue": 22146,
  "status": "done",
  "branch": "claude/issue-22146-guest-model-adr",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22239",
  "session": "session_01LAi5BVvQNiYzepSAcsoFLK",
  "premise_still_valid": true,
  "summary": "Round 3 delivered as draft PR #22239 (Tier H, stays draft): one new record, docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md, Status Proposed, transcribing ruling 6054113537 (A on all eight questions, G2) into D1-D9, each with contract and enforcement point, plus an enforcement map, acceptance criteria (maintainer approval, the G2 booted per-class sweep run in a permitting environment, the D2b letter, the back-pointer lines) and the post-acceptance plan E1-E4 with pins and ADR-0087 dispositions. Both clarifications are carried: Q4 keeps the form doors' declared default-organization binding (D4.4), and Q2's must-answer is D2b, presented as the record's own open decision on the four axes and NOT decided, because 6053767508 names two answers and decides neither. D9 records the 2026-08-08 Option A ruling (f586f1a89); D5 declares no type; Q7's signature vocabulary is named follow-up F1, not filed. One card-table row moved since filing and is recorded as such: the runtime face's anonymous object_operation path is no gap (guest entry, 403 at the CRUD gate, #22147 ruling C, PR #22177). No code, spec, docs-content or skills change.",
  "tests": "All at HEAD 3d72157a4e (merge of main a87d8be299 into 73f031bdb7; rerun in full after the merge). Claim-time gate list, 19 commands, every exit captured before any pipe: all 0. check-adr-symbol-anchors: '2223 anchors across 141 records resolve' (positive control: 141 = 140 .md at base 7b926f7600 + this record; the shared extractor reads 56 anchors from the new record, 52 symbol, none a line number). check-adr-links: '714 relative link destination(s) under docs/adr/ resolve'. check:adr-anchors: OK (every ADR citation resolves). check:pm-prior-rulings: self-test 155 cases pass; the tool's --card 22146 read: 16 ADR hits, thread 1 ruling (6054113537). check:nul-bytes: OK; separate control-byte grep on the new file: exit 1 (none). check:doc-formula-expressions: first run exit 3 = PREREQUISITE NOT MET (formula/lint not built), not a measurement; built the closure under os-verify-lock (VERDICT command-exit 0, twice: before and after the merge), rerun exit 0. Re-derivation: dispatch-gates --commands --repo objectstack-ai/objectstack at 3d72157a4e = the same 19 families; --ran reconciliation with recorded exit codes: '19 run, 0 NOT-MEASURED (a DERIVED zero)'. No ablation (no code). NOT MEASURED: the G2 booted sweep (ruled an acceptance precondition; no driver or probe written); the platform doc links (proxy answers 403 to CONNECT for those hosts; the URLs are round 1's); the cloud repo's anonymous surfaces.",
  "mcp_calls": "0",
  "api_writes": "3 REST writes from this container, all through scripts/pm tools via the fleet-write relay (each a POST /repos/objectstack-ai/objectstack/dispatches, HTTP 204, executed as objectstack-fleet[bot]): (1) pr_create via with-fleet.sh --via dispatch -> POST /repos/objectstack-ai/objectstack/pulls (draft forced; #22239; body read back byte-identical, 10412 bytes); (2) label-write.mjs --issue 22239 --add skip-changeset --assign os-litant -> POST /issues/22239/labels + POST /issues/22239/assignees (read-back matches; documentation and size/l were added by labelers, preserved); (3) this os-dev-report via post-stamped.mjs -> POST /issues/22146/comments. Plus git push x3 (not REST): the empty-branch claim marker, the ADR commit 73f031bdb7, the merge 3d72157a4e. No MCP write tool. The card's assignee was not written.",
  "gates": "At 3d72157a4e, each :: exit: node scripts/check-adr-links.mjs :: 0 · --self-test :: 0 · node scripts/check-adr-symbol-anchors.mjs :: 0 · --self-test :: 0 · node scripts/check-ci-filter-parity.mjs :: 0 · node scripts/check-closing-keyword-parity.mjs :: 0 · --self-test :: 0 · node scripts/check-comment-mask-corpus.mjs :: 0 · pnpm --filter @objectstack/lint run check:doc-formula-expressions :: 0 (after closure build; first run 3 = prerequisite) · pnpm check:adr-anchors :: 0 · pnpm check:cross-package-test-inputs :: 0 · pnpm check:doc-authoring :: 0 · pnpm check:driver-memory-census :: 0 · pnpm check:gitlink-declared :: 0 · pnpm check:nul-bytes :: 0 · pnpm check:pm-governed-merges :: 0 · pnpm check:pm-prior-rulings :: 0 · pnpm check:refd-timer-probe :: 0 · pnpm check:watch-hint-literal :: 0. Re-derived list identical (19); --ran: 19 run, 0 NOT-MEASURED. CI: in_progress, not awaited.",
  "line_budget": "648 changed lines vs merge base a87d8be29 (+648 / -0, 1 file), as dispatch-gates prints it; under the 5000 human-merge threshold.",
  "files_changed": [
    "docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md"
  ],
  "deviations": [
    "Number 0138, not 0136. main tops out at 0137 with 0136 absent; all 20 open PRs' file lists checked (paged to the end for #22142 at 104 files and #21988 at 229): only #22198 touches docs/adr (0048). 0136 was handed to a decision once: unmerged PR #18480 added 0136-declared-journeys-as-priority-anchor.md and #18985 renumbered its own record to 0137 over it; check-adr-anchors.mjs computes next-free as max+1 = 0138.",
    "No back-pointers written. House practice adds a status-line continuation ('· **Amended** (date, ADR-NNNN Dk) — ...', ADR-0042/0046/0131) when an amendment is in force, and no record carries one pointing at a Proposed record; the exact lines for ADR-0090 (D9) and ADR-0056 (D2) are written into the record's Acceptance criteria to land with the accepting change. ADR-0106 D7, ADR-0121 D6, ADR-0096 and ADR-0135 get none (unchanged; ADR-0135 is a cloud ADR-0024 mirror that adds no clause).",
    "Merged main a87d8be299 mid-round after the derivation flagged a stale tree (5 commits); anchors and all 19 gates re-run on the merged head.",
    "Attribution: commit trailers are the AGENTS.md model-free pair and the PR body ends with the AGENTS.md session-URL footer, not the harness reminder's model-named trailer / footer (os-dev.md: the harness reminder yields).",
    "Label: skip-changeset applied under pr-automation.yml's own criterion (its failure text: 'if it releases nothing ..., apply the skip-changeset label'); this PR adds and changes no .changeset file and docs/adr ships in no files[].",
    "Two readings beyond the ruled letters are named in the record's 'What the ruling did not settle' (and asked below): D1's empty state, and the D8 fate 'remove' for sys_record_share's guest recipient (derived from ADR-0090 D11 and the registered sharing-rule-recipient-reconcile entry; reopens on E4 if its census finds a consumer). The form doors' guest_portal set name, not on the card's Q8 list, was added to D8 with fate keep.",
    "Cleanup: worktree node_modules removed and git worktree remove (no --force) run right after this report is posted."
  ],
  "open_questions": [
    {
      "question": "D2b (the record's open decision; ruling A on #22147, 6053767508, names two answers and decides neither): an anonymous authRequired:false flow door whose target flow declares runAs:'system' — which answer?",
      "options": [
        "R — publish refusal with a prescription, both directions (the endpoint reads its flow's runAs; a flow set to system reads the anonymous endpoints targeting it). Prescription: an authenticated endpoint, the signed inbound-hook channel (ADR-0041), a public form, and runAs:'automation' once ADR-0073 M2 lands. Cost: one cross-item check in the publish path; a narrowing, so E2 carries one ADR-0087 semantic entry; closes any unmeasured external use.",
        "M — allowed only once ADR-0073 M2's automation posture lands: until M2, today's combination stands (ruling A on #22147) with a publish advisory; at M2, system behind an anonymous door becomes a refusal prescribing automation. Cost: two changes, the second waiting on an unscheduled milestone; the interim publish stays green."
      ],
      "recommendation": "R, on the four axes. Real need: at a87d8be299/7b926f7600 examples/ hold zero authRequired:false declarations and the repo's partner-webhook example takes the signed hook channel, which R does not touch. Long-term: R is final for system and M2 only adds automation to its prescription. AI-proofing: the runAs describe text prescribes system for user-less triggers, so R stops an AI at publish while M's advisory leaves publish green. Startup focus: R is one rule in an existing publish path; M is a staged transition with no named external-user evidence. Neither option reaches record-change flows fired by a guest-written row; that is named in the record."
    },
    {
      "question": "D1's empty state (this record's reading, not a ruled letter): with no guest default owner declared, what does a guest insert into an owner-bearing object do?",
      "options": [
        "A — the record's reading: an endpoint insert (a door that takes no guest insert today) is refused naming the missing declaration; the public form doors keep today's owner-unset intake and the form's authoring read states the absence (the Q4 principle 'nothing that serves today starts refusing', applied to Q1)",
        "B — refuse every guest insert without a declared owner, form doors included",
        "C — owner-unset everywhere, advisory only"
      ],
      "recommendation": "A: the form doors serve today (app-crm and app-showcase open public forms), so B breaks serving intake; C leaves the new endpoint doors silent, which axis 3 rejects; A is loud on every door that does not serve yet and breaks nothing that does."
    }
  ],
  "out_of_scope_findings": [
    "carrier: none (card E2, once cut, edits that domain) · noted, not filed — the doc comment above RestServer.registerFormEndpoints (packages/rest/src/rest-server.ts) still says security is delegated to a guest_portal set carried on the context and that the middleware falls open with none registered; the publicFormGrant branch in SecurityPlugin is what admits today. Comment drift, no reach measured; recorded in the PR's Acceptance notes."
  ]
}

---

Generated by Claude Code

[objectstack-fleet]

✅ ACCEPT on the draft: PR #22239 at 3d72157a4e (round 3, ADR-0138, Proposed). Tier H: it waits on the maintainer

domain:spec seat 1 (#6017) · os-litant · session session_01LAi5BVvQNiYzepSAcsoFLK · 2026-10-08T08:13Z · holder of claim 6054856256; the review of record for the report on this card from round 3.

Checklist (read on GitHub and in the PR's own diff):

• Form: draft, base main, assignee os-litant, labels skip-changeset (no .changeset row; docs/adr ships in no package). Line 1 is Part of #22146, line 2 is Clause-②: no.
• Surface: 1 file, docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md, +648 / −0.
  • No packages/**, content/docs/** or skills/** change, as the ruling's State section requires.
  • The number is 0138, not 0136. 0136 was once handed out (unmerged PR docs(adr): ADR-0136 declared journeys as the priority anchor #18480, renumbered over by spec: hold a predicate to what the engine can run; declare its fault semantics (ADR-0136) #18985), and check-adr-anchors computes next-free as max + 1. The dev checked every open PR's file list.
• Faithful to the ruling 6054113537, read section by section:
  • D1–D9 carry Q1–Q8 and the 2026-08-08 Option A ruling, each with a contract and a named enforcer, and the enforcement map leaves no row unenforced (ADR-0049).
  • Q4's clarification is D4.4: the form doors keep their declared default-organization binding.
  • Q2's must-answer is D2b. It is presented OPEN on the four axes and not decided, because 6053767508 names two answers and decides neither.
  • D5 declares no type. Q7's vocabulary is follow-up F1 and is not filed.
  • G2 is acceptance criterion 2, with no driver and no probe written.
• Readings beyond the ruled letters, flagged in the record's "What the ruling did not settle" and put to the maintainer below:
  • D1's empty state;
  • D8's fate remove for sys_record_share's guest recipient, derived from ADR-0090 D11 and the registered sharing-rule-recipient-reconcile entry;
  • the form doors' guest_portal set name, added to D8 as keep.
• No exploit-recipe reading. Classes, positions and functions only.
• Gates: all 19 derived families were run at 3d72157a4e, every exit was 0, and --ran gives 0 NOT-MEASURED.
  • check-adr-symbol-anchors: 2223 anchors across 141 records resolve.
  • check-adr-links: 714 links resolve.
  • check:pm-prior-rulings: OK.
• Out of scope, noted, no carrier until E2: the doc comment above RestServer.registerFormEndpoints still describes a guest_portal-only delegation. That is comment drift, recorded in the PR's Acceptance notes.

The landing shape (Tier H, the final four-piece set):

• This ACCEPT.
• needs-user-decision on the PR, and the final 维护者速读 posted on the PR.
• A review requested from both authorized approvers.

The PR stays draft. The maintainer approves it or merges it by hand. ⛔ No seat flips it ready unapproved. The card stays pm:dispatched with this seat until the PR lands, and E1–E4 are cut only after acceptance.

[objectstack-fleet]

Ruling: batch #290 item 1 · supplement · letters D1 A′ and D2b R · maintainer 「D1 A′ D2b R」 2026-10-08T09:11Z

Director seat, summon #35, session_01VYToj6PQehTEKNrjGM9akg (GitHub os-zhuang; written as objectstack-fleet[bot] via the relay). Round 3's draft, PR #22239 (ADR-0138, Proposed, head 3d72157a4e, seat ACCEPT 6055683775, 维护者速读 6055701071), asked the maintainer for two letters: D2b (R or M) and D1's empty-state reading. The maintainer asked for the record in business terms (given in chat, decision by decision), then challenged D1's organization-level default owner, verbatim: 「访客写进来的记录归本组织声明的一个内部人,这个没必要吧,应该是每个业务场景在元数据级别自己处理吧」. The seat agreed — the record's own Consequences paragraph already names the clash between a platform stamp and an owner-assigning object hook — and put the revised shape as A′; the maintainer answered 「D1 A′ D2b R」. Thread-read: 6055683775. Freshness: no comment since the seat's ACCEPT.

D1 A′ — the invariant stays; the platform declares no default owner

• Kept: the guest is a principal and never an owner; a forged owner is refused; attribution is not ownership (the audit names the guest as the actor; ADR-0073 D3).
• Removed from the draft: D1 points 3, 5 and 6 as written (the per-organization default-owner declaration, its cardinality, and the empty-state refusal), and the "default owner" element of D5's shape.
• Replaced by: the ownership of a guest-written row is the business scenario's own metadata. The door's declaration may name an owner or an assignment target; the object's hooks, record-change flows and assignment rules run as they do for any insert. The platform stamps nothing and declares no organization-level default.
• Empty state: the owner stays unset, as the public form doors' intake is today; hooks and flows may set it; the form's authoring read states the absence on the channel that already carries the intake advisory. No publish refusal: nothing that serves today starts refusing.
• E3 shrinks to the stamp's guest branch — never the guest, never the system principal, a forged owner refused, the owner unset unless the scenario sets it — and its pins. No new key, no ADR-0087 disposition. The Consequences paragraph on owner-assigning hooks is withdrawn: there is nothing left to clash with.

Four axes, in business terms: ① ownership policy is business logic that differs per scenario (territory, queue, round-robin, product line); an organization-level constant is wrong in most deployments and pre-empts the scenario's own hook. ② The mechanism that does the work on Salesforce and ServiceNow is the assignment rule; an organization default is only their fallback. ③ A′ leaves no silent stamp that hides a missing assignment. ④ No new declaration, no empty-state rule, no site-binding element.

D2b R — a publish refusal with a prescription

Publish refuses an authRequired: false endpoint of type: 'flow' whose target flow declares runAs: 'system', in both directions: the endpoint's publish reads its target's runAs, and a flow's publish that sets runAs: 'system' reads the anonymous endpoints that target it. The prescription names what serves each scenario instead: an authenticated endpoint for a partner that can hold a credential; the signed inbound-hook channel (ADR-0041) for a partner webhook; a public form for anonymous intake; and runAs: 'automation' once ADR-0073 M2 lands. Which doors may trigger an elevated flow directly: none. How loudly publish says so: a refusal. Card E2 implements it, with the registered ADR-0087 semantic entry a narrowing of the accept set owes. Until E2 lands, ruling A on #22147 (6053767508) governs. ⛔ Not taken: M — an advisory interim with no date, which an automated authoring loop reads as done. The indirect path (record-change flows fired by a guest-written row) stays as the record states it: outside both options, recorded, not decided.

Prior rulings read: 6054113537 (A on eight questions, G2); #22147 ruling A 6053767508; ADR-0073 D2/D3/M2; ADR-0041; ADR-0087; ADR-0049 → 6 hits; thread: 9 comments. 自检: 只看①选 A′ 与 R;②③④ 是否翻转:否。

State

• The card stays pm:dispatched with the domain:spec seat (claim 6054856256). PR docs(adr): ADR-0138 the guest model (Proposed) — doors, grants channel, organization, ownership, and every guest key's fate #22239 gets one revision round before approval: D1 rewritten to A′; D5's shape without the default owner; D2b closed as R with the enforcement text above and removed from "What the ruling did not settle"; the E2 and E3 rows and the Consequences paragraph updated; then the seat re-posts the 维护者速读 and the maintainer approves (Tier H). ⛔ The maintainer clicks nothing until the revision is up.
• The Ruled: line is added to the body in this act. A pointer is posted on PR docs(adr): ADR-0138 the guest model (Proposed) — doors, grants channel, organization, ownership, and every guest key's fate #22239.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 22146,
  "status": "done",
  "branch": "claude/issue-22146-guest-model-adr",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22239",
  "session": "session_01LAi5BVvQNiYzepSAcsoFLK",
  "premise_still_valid": true,
  "summary": "Revision round on PR #22239 applied at 2d69b2b714 (draft kept; head read back), per ruling supplement 6056614963 (maintainer 「D1 A′ D2b R」) and its State section. D1 is A′: points 1, 2 and 4 kept, the organization-level default owner (draft points 3, 5, 6) replaced by 'ownership of a guest-written row is the business scenario's own metadata; the platform stamps nothing; a forged owner is refused; empty state = owner unset, as the form doors today, authoring advisory, no publish refusal'. D5's shape lost its default-owner row. D2b is closed as R with the enforcement text (publish refusal in both directions, prescription, no door triggers an elevated flow directly, indirect path recorded and undecided); the four-axis table stays as reasoning; M and the first-drafted default owner are under Alternatives considered. TL;DR and enforcement-map rows for D1/D2b, E2 (R with a registered ADR-0087 semantic entry) and E3 (the stamp's guest branch, no new key, no disposition) updated; the owner-assigning-hooks Consequence withdrawn; 'What the ruling did not settle' lost D2b and D1's empty state; acceptance criterion 3 stated as met citing 6056614963; the supplement added to Decided by. The PR body was NOT edited by this run: see deviations; the replacement body is in pr_body_replacement for the seat to write.",
  "tests": "All at HEAD 2d69b2b714 (revision on a merge of main 73a0a6bf1d). Claim-time gate list, 19 commands, every exit captured before any pipe: all 0. check-adr-symbol-anchors: '2225 anchors across 141 records resolve' (141 = 140 at base + this record). check-adr-links: '714 relative link destination(s) under docs/adr/ resolve' (the renamed D2b heading and the new 'D2b on the four axes' heading are intra-file fragments, slugged by hand to GitHub's rule). check:doc-formula-expressions: 0, after rebuilding the formula+lint closure under os-verify-lock post-merge (VERDICT command-exit 0; main brought a packages/lint change). check:nul-bytes: OK; separate control-byte grep on the record: exit 1 (none). Re-derivation at 2d69b2b714 (no stale-tree warning): the same 19 families; --ran with recorded exit codes: '19 run, 0 NOT-MEASURED (a DERIVED zero)'. Residue sweep on the record for 'default owner', 'Option M', 'open', 'choose', the old fragments: the only hits are the verbatim first-ruling quote, the supplement notes, the Alternatives entries and the M column of the reasoning table. NOT MEASURED (unchanged): the G2 booted sweep (acceptance precondition), the platform doc links (proxy 403), the cloud repo's anonymous surfaces.",
  "mcp_calls": "0",
  "api_writes": "1 REST write from this container: this os-dev-report via scripts/pm/post-stamped.mjs through the fleet-write relay (POST /repos/objectstack-ai/objectstack/dispatches -> POST /issues/22146/comments, as objectstack-fleet[bot]). Plus git push x1 (not REST): 3d72157a4e..2d69b2b714 (the merge ddaf31f98f and the revision). The budgeted PR body edit was NOT spent (deviations). No MCP write tool; no label, assignee or draft-state write.",
  "gates": "At 2d69b2b714, each :: exit: node scripts/check-adr-links.mjs :: 0 · --self-test :: 0 · node scripts/check-adr-symbol-anchors.mjs :: 0 · --self-test :: 0 · node scripts/check-ci-filter-parity.mjs :: 0 · node scripts/check-closing-keyword-parity.mjs :: 0 · --self-test :: 0 · node scripts/check-comment-mask-corpus.mjs :: 0 · pnpm --filter @objectstack/lint run check:doc-formula-expressions :: 0 · pnpm check:adr-anchors :: 0 · pnpm check:cross-package-test-inputs :: 0 · pnpm check:doc-authoring :: 0 · pnpm check:driver-memory-census :: 0 · pnpm check:gitlink-declared :: 0 · pnpm check:nul-bytes :: 0 · pnpm check:pm-governed-merges :: 0 · pnpm check:pm-prior-rulings :: 0 · pnpm check:refd-timer-probe :: 0 · pnpm check:watch-hint-literal :: 0. Re-derived list identical (19); --ran: 19 run, 0 NOT-MEASURED. CI: in_progress, not awaited.",
  "line_budget": "640 changed lines vs merge base 73a0a6bf1 (+640 / -0, 1 file), as dispatch-gates prints it; the revision commit itself is +103 / -111 on the record.",
  "files_changed": [
    "docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md"
  ],
  "deviations": [
    "PR body not edited. The dispatch budgeted one PR body edit; os-dev.md's standard clause reads 'PR 正文 dev 只写一次,在开 PR 那一笔,⛔ 不 PATCH;事后要改的报告点名改法,席位代写', and the same file states it outranks dispatch words on conflict and that a conflict is named, not resolved silently. So the edit is the seat's: pr_body_replacement below is the full new body (lines 1-2 and the session-URL footer unchanged; 13219 bytes; no fence, no angle bracket, no closing keyword next to an issue number). It updates the D1/D2b/D5 lines, replaces 'What the record leaves open' with 'What the revision changed' and 'What stays open', moves verification to 2d69b2b714, and rewrites the 维护者速读 in Chinese with 席位意见 empty and one action (approve). The same text is on disk at /tmp/claude-0/-home-user/fc7befed-d8ca-5741-8b80-79a41d4d0410/scratchpad/issue-22146-adr/pr-body-r2.md.",
    "Consistency edits beyond the ten listed items, each forced by a ruled change and named in the replacement body: the Status line (D2b no longer the open item); the Consumers line (the spec change is D2b's refusal, not a D1 key); D4 point 3 (no owner stamp left that needs the organization); D2's class 5 row (inside, never system behind this door); follow-up F3 (M2 now only extends R's prescription); a one-paragraph supplement note after the verbatim first-ruling summary in the TL;DR; the References.",
    "D2b's enforcement point is written as 'the publish path, in both directions; the cross-item read sits where both items are readable at publish, beside the per-endpoint policyGate, which reads one endpoint only' — not claimed to live inside policyGate, which reads a single endpoint.",
    "Merged main 73a0a6bf1d (13 commits, including #22198's ADR-0048 note and a packages/lint change) before editing; no 0138 appeared on main.",
    "PR #22239 now carries a needs-user-decision label set by another actor; not touched.",
    "Cleanup: worktree node_modules removed and git worktree remove (no --force) run right after this report is posted; the fetched ref refs/os-dev/issue-22146-main deleted."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none (card E2, once cut, edits that domain) · noted, not filed — unchanged from round 3: the doc comment above RestServer.registerFormEndpoints (packages/rest/src/rest-server.ts) still describes the pre-publicFormGrant form-door semantics. Comment drift, no reach measured; in the PR's Acceptance notes."
  ],
  "pr_body_replacement": "Part of #22146\nClause-②: no\n\n## What this PR is\n\nRound 3 of #22146: one new decision record, `docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md`, **Status: Proposed**. It transcribes the maintainer's ruling [`6054113537`](https://github.com/objectstack-ai/objectstack/issues/22146#issuecomment-6054113537) (batch #290 item 1, 「22146 同意」: A on all eight questions and G2 on the gap, with the Q4 and Q2 clarifications) into nine decisions. Each one states its contract and its enforcement point. The revision round applies the ruling supplement [`6056614963`](https://github.com/objectstack-ai/objectstack/issues/22146#issuecomment-6056614963) (maintainer 「D1 A′ D2b R」): D1 is revised to A′, and D2b is closed as R.\n\n- **No code changes.** Nothing changes in `packages/**`, `content/docs/**` or `skills/**`. The ruling places every code change after acceptance, as execution cards E1 to E4 (the record's *Execution plan*).\n- **Tier H.** The diff touches `docs/adr/**`, so this PR stays draft and lands only by the maintainer's hand.\n- **The card stays open** for the execution cards, so line 1 is `Part of`.\n\n## What the record says, one line per decision\n\n- **D1, identity and ownership (A′).** The guest is a principal and never owns a record; a forged owner is refused; the audit names the guest as the actor. Who owns a guest-written row is the business scenario's own metadata: the door's declaration, the object's hooks, record-change flows and assignment rules. The platform stamps nothing and declares no default owner. Empty state: the owner stays unset, as the form doors do today, with the existing authoring advisory and no publish refusal. The enforcer is the guest branch of the owner-anchor stamp in `SecurityPlugin` (card E3).\n- **D2, the closed list of doors.** Exactly five door classes serve an unauthenticated request:\n  - the public form doors;\n  - share links;\n  - the public book and doc reads;\n  - `authRequired: false` endpoints of type `object_operation`;\n  - `authRequired: false` endpoints of type `flow`.\n\n  Everything else answers 401, decided once per domain by `shouldDenyAnonymous`. The control-plane allowlist, the signed inbound-hook channel and MCP are credentialed or infrastructure, so they are outside the guest model.\n- **D2b, anonymous door × elevated flow (R).** Publish refuses an `authRequired: false` flow endpoint whose target declares `runAs: 'system'`, in both directions, with a prescription: an authenticated endpoint, the signed inbound-hook channel, a public form, and `runAs: 'automation'` once ADR-0073 M2 lands. No door triggers an elevated flow directly. Card E2 implements it with a registered ADR-0087 semantic entry. Record-change flows fired by a guest-written row stay recorded and undecided.\n- **D3, the grants channel (ADR-0090 D9, enforced).** The `guest` anchor's bindings resolve for the guest, read through the one binding reader every position uses. An empty set denies all. There is no second channel: not the baseline, not `everyone`, and not the position-name fold. The binding tier is unchanged. The row scope runs on one pipeline, and E1 pins it per sharing model.\n- **D4, organization.** The guest's organization is resolved only when the deployment has a unique organization, using the same predicate as ADR-0131 D9. On a multi-organization deployment the request is refused until D5 exists. The question is asked only where the organization is needed.\n  - **Clarification (1), carried into the record:** the form doors' declared default-organization binding stays as it is. Nothing that serves today starts refusing.\n- **D5, site binding.** The record gives the shape only: match, organization, guest grants and allowed doors. ⛔ It declares no metadata type and reserves no key. The binding is built when a named deployment needs it.\n- **D6 and D7.** ADR-0106 D7, explain's `EXTERNAL` floor and ADR-0121 D6 are unchanged. The webhook signature vocabulary goes to a follow-up card, F1. That card is named in the record and not filed.\n- **D8, guest keys.** Every declared guest key gets a fate and an ADR-0087 disposition.\n  - `sys_record_share`'s `guest` recipient is to be **removed** on its own card, E4. The basis is ADR-0090 D11 and the already-registered `sharing-rule-recipient-reconcile` entry.\n  - The form doors' `guest_portal` set name was not on the card's list. It is recorded too, with the fate keep.\n- **D9.** The record now holds the maintainer's ruling of 2026-08-08 (Option A, `f586f1a89`), which until now lived only in the module doc of `assemble-execution-context.ts`.\n\n## What the revision changed (supplement [`6056614963`](https://github.com/objectstack-ai/objectstack/issues/22146#issuecomment-6056614963))\n\n- **D1 → A′.** Points 3, 5 and 6 of the draft (the organization-level default owner, its cardinality, the empty-state refusal) are replaced: ownership is the scenario's own metadata, and the empty state is the owner left unset. Points 1, 2 and 4 are kept.\n- **D5.** The default-owner element is removed from the shape.\n- **D2b → R**, with its enforcement text. The four-axis table stays as the reasoning. M and the first-drafted default owner move to *Alternatives considered*.\n- **Execution plan.** E2 carries R and its registered ADR-0087 semantic entry. E3 shrinks to the stamp's guest branch (never the guest, never the system principal, a forged owner refused, the owner unset unless the scenario sets it): no new key and no disposition.\n- **Elsewhere.** The Consequences paragraph on owner-assigning hooks is withdrawn. *What the ruling did not settle* loses D2b and D1's empty state. Acceptance criterion 3 (D2b chosen) is met. The supplement is added to *Decided by*.\n- **Consistency edits the ruled changes forced:** the Status line, the Consumers line (the spec change is now D2b's refusal, not a D1 key), D4 point 3 (no owner stamp left to need the organization), D2's class 5 row, follow-up F3 (M2 now only extends R's prescription), and the References.\n\n## What stays open\n\n- **The indirect path:** record-change flows fired by a guest-written row are recorded and not decided.\n- **The spelling of D5's binding** belongs to the card that builds it.\n- **The guest's row scope** is stated as a contract; E1 pins its measured outcome.\n\n## How the number was chosen: 0138\n\n- `origin/main` at `73a0a6bf1d`, after this round's merge, tops out at 0137, and 0136 is absent. Still no open PR adds 0136 or 0138; #22198, the one ADR PR at the first count, has landed on ADR-0048.\n- **I checked every open PR's file list.** That is all 20 open PRs, paged to the end for #22142 (104 files) and #21988 (229 files). Only #22198 touches `docs/adr/`, and it touches `0048-cross-package-metadata-collision.md`. No open PR adds 0136 or 0138.\n- **0136 is not reused.** It was handed to a decision once: unmerged PR #18480 added `0136-declared-journeys-as-priority-anchor.md`, and #18985 renumbered its own record from 0136 to 0137 because of it. `scripts/check-adr-anchors.mjs` computes the next free number as the highest number plus one, which gives 0138.\n\n## Back-pointers: none in this PR, by house practice\n\n- **Where the lines go.** The house form for an amended record is a status-line continuation. ADR-0042, ADR-0046 and ADR-0131 carry lines of the form \"· **Amended** (date, ADR-NNNN Dk) — …\". These lines are written when the amendment is in force. No record in the registry carries such a line pointing at a Proposed record. So the exact lines for **ADR-0090** (D9) and **ADR-0056** (D2) are written into the record's *Acceptance criteria*, to land with the accepting change.\n- **Which ADRs get no line.** ADR-0106 D7, ADR-0121 D6 and ADR-0096 D5/E1 are left unchanged by this record, so they get none. **ADR-0135** gets none either: it mirrors cloud ADR-0024 and adds no clause of its own, and this record amends none of its decisions.\n\n## Verification at `2d69b2b714` (the revision, on a merge of main `73a0a6bf1d`)\n\nI ran every command in the claim-time gate list at the revision head. Each exit code was captured before any pipe.\n\n| Command | Exit |\n|:--|:--|\n| `node scripts/check-adr-links.mjs` (and `--self-test`) | 0, 0 |\n| `node scripts/check-adr-symbol-anchors.mjs` (and `--self-test`) | 0, 0 |\n| `node scripts/check-ci-filter-parity.mjs` | 0 |\n| `node scripts/check-closing-keyword-parity.mjs` (and `--self-test`) | 0, 0 |\n| `node scripts/check-comment-mask-corpus.mjs` | 0 |\n| `pnpm --filter @objectstack/lint run check:doc-formula-expressions` | 0 (see note) |\n| `pnpm check:adr-anchors` | 0 |\n| `pnpm check:cross-package-test-inputs` | 0 |\n| `pnpm check:doc-authoring` | 0 |\n| `pnpm check:driver-memory-census` | 0 |\n| `pnpm check:gitlink-declared` | 0 |\n| `pnpm check:nul-bytes` | 0 |\n| `pnpm check:pm-governed-merges` | 0 |\n| `pnpm check:pm-prior-rulings` | 0 |\n| `pnpm check:refd-timer-probe` | 0 |\n| `pnpm check:watch-hint-literal` | 0 |\n\n- **`check-adr-symbol-anchors`.** It reports \"2225 anchors across 141 records resolve\". Positive control: the record count is 141, which is the 140 at base plus this record. No anchor carries a line number.\n- **`check:pm-prior-rulings`.** The self-test passes 155 cases. The tool's `--card 22146` read returns 16 ADR decision hits and 1 ruling on the thread (`6054113537`).\n- **`check:doc-formula-expressions`.** In the first round its first run exited 3 (PREREQUISITE NOT MET: the closure was not built), which measured nothing. I rebuilt the `@objectstack/formula` and `@objectstack/lint` closure under the verify lock after this round's merge (VERDICT command-exit 0), and the gate exited 0.\n- **Re-derivation.** `dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` at `2d69b2b714` gives the same 19 families. The `--ran` reconciliation shows 19 run and 0 NOT-MEASURED, a zero derived from the recorded exit codes. The change set is one file, +640/−0, against merge base `73a0a6bf1`.\n\n## Not measured, and named\n\n- **The G2 sweep (the booted per-door-class anonymous sweep).** I did not run it, by the ruling: it is an acceptance precondition, to be run in an environment that permits the probe. This round wrote no driver and no probe.\n- **The platform documentation links.** I could not re-fetch them, because the container's proxy answers 403 to CONNECT for those hosts. The record carries the URLs that the measurement round recorded.\n- **The cloud repository's anonymous surfaces.** This round did not read them.\n\n## Changeset\n\nI read the Check Changeset job in `pr-automation.yml`. It has two exemptions: the `skip-changeset` label (read live, twice) and the Changesets release PR. Its failure text prescribes: \"if it releases nothing …, apply the 'skip-changeset' label\". This PR adds no `.changeset/*.md` and changes none, and `docs/adr/**` ships in no package's `files[]`. So the label is `skip-changeset`.\n\n## Acceptance notes\n\n- **A doc comment that describes the old form-door semantics.** The comment above `RestServer.registerFormEndpoints` in `packages/rest/src/rest-server.ts` still says that security is delegated to a `guest_portal` set carried on the context, and that the middleware falls open when none is registered. What admits a form submission today is the `publicFormGrant` branch in `SecurityPlugin`.\n  - This is comment drift only, and no reach was measured. It is noted, not filed.\n  - Carrier: none. Card E2, once cut, edits that domain.\n\n## 维护者速读(草稿)\n\n- **改了什么:** 按你「D1 A′ D2b R」的补充裁决修订 ADR-0138 草稿,其余内容不动。\n  - D1:访客永不拥有记录、伪造的 owner 一律拒绝、操作留痕记在访客名下,这三条保留。\"本组织声明一个默认 owner\"整条删掉:访客写进来的记录归谁,由各业务场景在元数据里自己定(入口声明、对象钩子、记录触发流程、分配规则),平台不打任何默认值。没人设置时 owner 就空着,跟今天公开表单一样;表单的作者视图照常提示,发布不拒绝。\n  - D2b:匿名入口不能触发以系统身份运行的流程。发布时直接拒绝,端点和流程两头都检查,并给出替代办法(带凭据的端点、签名 webhook 通道、公开表单,以及 M2 落地后的 automation)。\n  - 站点绑定的形状里去掉\"默认 owner\";执行卡 E3 缩成只校验访客分支,不新增任何键。\n- **为什么改:** 你指出归属是业务场景的事,平台级默认值在多数部署里是错的,还会抢在对象自己的分配逻辑前面。D2b 选 R 之后,AI 照着 `runAs` 的说明写出\"匿名入口 + 系统身份流程\"时,发布就会被拦下。\n- **风险与代价(含回滚):**\n  - 本 PR 仍只改一个文档文件,合并后运行时行为不变;回滚就是删掉这个文件。\n  - D2b 的拒绝会让\"匿名端点指向系统身份流程\"这种写法从此发布不了。仓内没有这样的声明;仓外的部署本轮没有测。\n  - 接受前提还剩一项:在允许探测的环境里做一次启动后的逐类匿名入口实测(G2)。\n- **席位意见:**\n- **你要做的:** 修订版就绪后,批准这份 ADR(Tier H,点 Approve 或亲手合并)。\n\n---\n_Generated by [Claude Code](https://claude.ai/code/session_01LAi5BVvQNiYzepSAcsoFLK)_\n"
}

---

Generated by Claude Code

[objectstack-fleet]

✅ ACCEPT on the revision: PR #22239 at 2d69b2b714 (ADR-0138, Proposed), under the supplement 6056614963

domain:spec seat 1 (#6017) · os-litant · session session_01LAi5BVvQNiYzepSAcsoFLK · 2026-10-08T09:29Z · holder of claim 6054856256; the review of record for the revision report 6056856908. It amends the ACCEPT 6055683775.

Read in the revision's diff (the record alone: +103 / −111; the PR's net diff against main is still the one file, +640 / −0):

• D1 A′. Points 1, 2 and 4 are kept: a principal, never an owner, and attribution is not ownership.
  • Point 3 now says ownership is the scenario's own metadata, the platform stamps nothing, and a forged owner is refused.
  • Point 5 is the empty state: the owner unset, the existing intake advisory, and no publish refusal.
  • The enforcer is the guest branch of SecurityPlugin's owner-anchor stamp.
• D2b R. The decision text matches the supplement: both directions, the four-part prescription, no door triggers an elevated flow directly, and the publish fails. The indirect path is recorded and undecided. M has moved to Alternatives considered.
• D5: the default-owner element is gone.
• E2 carries R with its registered ADR-0087 entry. E3 is the stamp's guest branch, with no new key and no disposition.
• Elsewhere: the owner-assigning-hooks Consequence is withdrawn. "What the ruling did not settle" lost D2b and D1's empty state. Acceptance criterion 3 is stated as met.
• Consistency edits beyond the listed items, each forced by the ruled change and named in the PR body: the Status line, the Consumers line, D4 point 3, D2's class 5 row, F3, and the References. D2b's enforcement point is placed in the publish path, beside policyGate and not inside it, which is accurate.
• Gates at 2d69b2b714: all 19 exits are 0, and --ran shows 0 NOT-MEASURED. check-adr-symbol-anchors: 2225 anchors across 141 records.
• PR body: the dev returned the replacement body rather than editing it (os-dev.md: the dev writes a PR body once; later edits are the seat's). The seat wrote it through the relay, read back identical (13219 bytes).

The PR stays draft, with needs-user-decision, and reviews remain requested from os-zhuang and hotlong. The final 维护者速读 is re-posted on the PR.

[objectstack-fleet]

Landed: round 3, PR #22239 → 8cbe255ef6, ADR-0138 (Proposed). The card stays open for acceptance and the execution cards

domain:spec seat 1 (#6017) · os-litant · session session_01LAi5BVvQNiYzepSAcsoFLK · 2026-10-08T10:48Z · holder of claim 6054856256, which this act releases.

• Landing: PR docs(adr): ADR-0138 the guest model (Proposed) — doors, grants channel, organization, ownership, and every guest key's fate #22239 merged through the merge queue at 2026-10-08T10:47Z as 8cbe255ef6, which has one parent (de1610fc4e) and is an ancestor of origin/main. docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md is blob-equal to the approved head 2d69b2b714.
• The review record:
  • Tier H: an authorized APPROVED review by os-zhuang on 2d69b2b714.
  • The seat's ACCEPTs: 6055683775 (the draft) and 6056900852 (the revision, under the supplement 6056614963, 「D1 A′ D2b R」).
  • The final 维护者速读: 6056913582.
• What now holds on main: ADR-0138, Proposed, which records:
  • D1 A′: the guest never owns a record, and ownership is the scenario's own metadata;
  • D2: the closed list of five door classes, everything else 401 by domain;
  • D2b R: a publish refusal for an anonymous flow door targeting runAs: 'system';
  • D3–D9 as ruled in 6054113537.
  • No code has changed yet.

What acceptance still needs (the record's Acceptance criteria). Criterion 1, approval, and criterion 3, D2b, are met. Two remain:

• Criterion 2, G2: the booted per-door-class anonymous sweep, run in an environment that permits the probe. It covers each of D2's five classes and the everything-else class, and records a class-level result only. The readings stay private, as security(core, plugin-security): an unauthenticated principal never resolves the permission sets bound to the guest anchor; ADR-0090 D9 is declared and seeded but not enforced #21158's did. This container's safety check stopped the round-1 driver, and the seat did not work around it; per the ruling it is not re-routed to another session either. Where it runs is the maintainer's to say.
• Criterion 4, the back-pointers: the ADR-0090 and ADR-0056 status-line continuations, written verbatim in the record. They land with the accepting change, a seat's PR that also moves the Status to Accepted.

After acceptance, the seat cuts the execution cards named in the record's Execution plan:

• E1, the grants channel, with D4;
• E2, the closed list, denial by domain and D2b R, with its registered ADR-0087 entry;
• E3, the stamp's guest branch;
• E4, the retirement of sys_record_share's guest recipient.

⛔ None of them is filed before acceptance.

Maintainer-action: run, or have run in an environment that permits the probe, the G2 booted per-door-class anonymous sweep ADR-0138 criterion 2 names — done when a comment on #22146 records a class-level result for each of D2's five door classes and the everything-else class

Release: session_01LAi5BVvQNiYzepSAcsoFLK · why: round 3 is delivered and landed; what remains before the next seat act (the accepting change, then E1–E4) is an action a seat in this container cannot perform · to: pm:awaiting-maintainer, unassigned

[objectstack-fleet]

Claim: PM loop round 1 (ADR-0138 acceptance criterion 2: the G2 booted per-door-class anonymous sweep) · 2026-10-09T04:17Z
Session: session_01VZqqwTj2wsihZEbfT6yyYN
Account: os-tesla (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-22146-g2-sweep
Worktree: objectstack-issue-22146
Domain: domain:spec
Seat: domain:spec#1
File surface: none. A measurement only: no tracked file is edited, no PR is opened, and the branch carries no commit (it is pushed empty as the claim's marker). The probe lives outside the repository and is not published.
Container & model: M, mode:subagent, model: default tier (dispatch-gates --tier: no path-derived mandate for a surface of no paths; judged from the card: a measurement with no contract edit).
Clause-②: no (a measurement; no accept set or public surface changes)
Responsibility: n/a — not a defect card
Thread-read: 6058198880
Serial constraints cleared: none. The run touches no file; it builds and boots one local reference deployment on a random high port through os-verify-lock.sh, beside the #22130 re-sync round, which writes no file this run reads.

Why the claim, with its source.

• The Maintainer-action: in 6058198880 reads: "run, or have run in an environment that permits the probe, the G2 booted per-door-class anonymous sweep ADR-0138 criterion 2 names". Where it runs was the maintainer's to say.
• The maintainer said it in this session's chat (quoted verbatim): 「前任要求：design(v18): the complete guest model in one ADR — identity, doors, grants channel, organization, public-site binding, disclosure, rate limits, and each declared guest key's fate (ADR-0090 D9 enforce-or-remove) #22146 的 G2 匿名访问实测(6058198880)。 这个你可以处理吗？」 This session runs it.
• Target: only a deployment the dev boots itself, on 127.0.0.1, from this repository's own example app. No other host is probed.
• Publication: per ADR-0138 criterion 2 and the card body, this card records a class-level result only, one line for each of D2's five door classes and one for the everything-else class. Route-level readings stay private and do not go on GitHub.
• Stop rule: if the environment's safety check stops the run again, the dev reports blocked with the refusal as written, and nothing is worked around.
• This act moves the card pm:awaiting-maintainer → pm:dispatched and assigns os-tesla. On the result, the card returns to the seat for the accepting change (criterion 4's back-pointers and the Status line), which is Tier H.

[objectstack-fleet]

os-dev-report

{
  "issue": 22146,
  "status": "done",
  "branch": "claude/issue-22146-g2-sweep",
  "pr": null,
  "session": "session_01VZqqwTj2wsihZEbfT6yyYN",
  "premise_still_valid": true,
  "summary": "ADR-0138 acceptance criterion 2 (G2) was measured on a booted reference deployment, the showcase app, which this session started from origin/main abd254508b on a random high port and stopped itself. Classes 1 to 5 match D2. The everything-else class does NOT match D2. That is a security finding, kept at class level here; its detail is in the private readings file named under tests. Each class was read in both halves: the admitted request, plus a negative control (a declaration absent or not anonymous; a bad, revoked or wrong-audience token; a non-public book; an authRequired: true sibling door), with signed-in controls proving that each refused surface exists. PM mechanism assumption 2 is falsified in part: the showcase declares no authRequired: false endpoint, and neither does any other example app. So classes 4 and 5 were measured on uncommitted fixture declarations in the worktree, alongside a non-anonymous form and an org-audience book used as negative controls. All four files were restored to HEAD before the worktree was removed. The fixture diff is kept in the private scratch directory. Mechanism assumption 1 holds: E1 to E4 are unbuilt. The guest envelope reaches the declared object_operation door and is denied with no grant bound, which is D3's empty state as a side effect. D2b's publish refusal is not built: the boot accepted an anonymous flow door to a runAs: system flow. That door was never invoked. This is the record's own stated interim until E2. Nothing was committed and no PR was opened.",
  "g2_class_results": [
    "1 · the public form doors (resolve and submit) · matches D2: yes · 2xx (404 for a non-anonymous or undeclared form) · the form's whitelisted fields and the one inserted record read back, with forged server-managed keys stripped",
    "2 · share links · matches D2: yes · 2xx (4xx for a wrong-audience, revoked or bogus token) · the one record, with its redacted fields absent",
    "3 · the public book and doc metadata reads · matches D2: yes · 2xx (401 for a non-public book or doc, a write, or a non-read route) · the public book, its tree and its docs only",
    "4 · authRequired: false endpoints of type object_operation · matches D2: yes · 403 at the declared door (401 for the authRequired: true sibling) · nothing: the guest envelope holds no grant, and no write landed",
    "5 · authRequired: false endpoints of type flow · matches D2: yes for admission and narrowness; D2b's publish refusal is not yet built (card E2, the record's own interim) · 2xx (400 when a runAs: user data step meets the guest; 401 for the authRequired: true sibling) · the flow's output only, no record",
    "everything else · matches D2: no"
  ],
  "tests": "Measurement only. No tracked change, so no gate family is owed: dispatch-gates --commands --repo objectstack-ai/objectstack at abd254508b exits 2, printing 'this branch changes nothing against origin/main (merge base abd254508) - nothing to derive'. Build: the showcase dependency closure, then the 8 remaining unbuilt workspace packages, both through os-verify-lock with slot issue-22146-g2, OS_SKIP_DTS=1 and workspace-concurrency 2. Both printed 'VERDICT command-exit 0' (held 68s and 54s, waited 0s). check-dev-prereqs then exited 0 ('67 package build artifacts present'). Boot: the showcase, by the backend-only recipe in AGENTS.md, with an ephemeral tempdir and the seeded dev admin. The boot banner reported 33 flows and 8 APIs, so the fixtures loaded. The probes were three scratch drivers, 126 requests in all, every one to 127.0.0.1 and to this one server only, one request per surface, and the rate limit was never exercised. Route-level readings (method, route, auth state, status, a one-line body summary for every request), the class verdicts with their reasoning, and the D3 and D9 behaviour seen are PRIVATE, in /tmp/claude-0/-home-user/3dc9b449-6dbf-5079-813e-e9191aba6a6a/scratchpad/issue-22146/g2-readings.md. Beside it are the raw JSON readings (g2-readings.json, -2, -3), the drivers (g2-driver*.mjs) and the uncommitted fixture diff (g2-fixture.patch). Teardown: the server's process group, the one this session started, was stopped. The port then had no listener and the fresh tempdir was gone. The fixture files were restored with git checkout HEAD, and git diff HEAD and git status --porcelain were both empty. The remote branch head is abd254508b, its base, with nothing committed.",
  "mcp_calls": "0",
  "api_writes": "1 REST write: this os-dev-report, sent with scripts/pm/post-stamped.mjs through the fleet-write relay (POST /repos/objectstack-ai/objectstack/dispatches, which executes POST /repos/objectstack-ai/objectstack/issues/22146/comments as objectstack-fleet[bot]). Also one git push, which is not REST: the empty claim-marker branch claude/issue-22146-g2-sweep at abd254508b. Reads: the card and all 14 of its comments, through REST GET. No PR, no label, no assignee write, and no MCP write tool.",
  "deviations": [
    "The order asked for a server bound to 127.0.0.1. The CLI dev server has no host flag, and the Hono adapter listens on the wildcard IPv4 address, so the listener was not loopback-only. Every probe went to 127.0.0.1, and no other host was contacted.",
    "The setsid launch forked, so the first recorded PID was the parent that exited. The server's real process group was read from the process table at once and recorded, and the teardown signalled only that group, which this session had started."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "class: a · reach: exception: security · evidence: see private readings file · the everything-else class does not uniformly answer 401: more than one family outside D2's five classes and outside the control-plane allowlist answers an anonymous caller with 2xx · carrier: card E2 (the closed list, denial by domain), not yet cut; the seat files or folds it · dedupe words: ADR-0138 D2 everything else 401, anonymous floor gap, unclassified anonymous surface, G2 sweep finding",
    "carrier: card E2 · noted, not filed. The discovery documents served anonymously were read as the control-plane allowlist's discovery role and were not counted as a mismatch. The allowlist function does not name them literally, and the private file says which ones. E2's conformance-matrix row should name them.",
    "carrier: card E1 · noted, not filed. Behind a flow door, a guest that reaches a runAs: user data step is refused as user-less (it surfaces as 400). The guest's grants are never evaluated, as the director's pointer on this card (fact 2, the AutomationContext gap) already records. E1 will need the flow to see the guest."
  ]
}

---

Generated by Claude Code

[objectstack-fleet]

G2 measured: classes 1–5 match D2; the everything-else class does NOT. Acceptance criterion 2 is not met. Decision request below

domain:spec seat 1 (#6017) · os-tesla · session session_01VZqqwTj2wsihZEbfT6yyYN · 2026-10-09T04:41Z · holder of claim 6074162238, released by this act.

Seat review of the measurement (os-dev-report 6074331185): ACCEPT

• Method checked: one reference deployment (the showcase) booted from origin/main abd254508b by the dev itself; 126 requests, all to 127.0.0.1, one per surface; every class read in both halves (the admitted request and a negative control), with signed-in controls proving each refused surface exists. Classes 4 and 5 needed uncommitted fixture declarations (no example app declares an authRequired: false endpoint); they were restored to HEAD, and git diff HEAD was empty.
• Teardown verified by the seat: the server's process group is empty, the port has no listener, the worktree is removed, and claude/issue-22146-g2-sweep sits at its base abd254508b with nothing committed.
• Deviation recorded: the dev server listens on the wildcard address (no host flag); every probe went to 127.0.0.1.
• Privacy: this thread carries class-level results and function-level names only, as the card body allows. Route-level readings stay in the seat's container; the maintainer has them in the session chat.

The result, per class

class	matches D2
1 · public form doors	yes
2 · share links	yes
3 · public book and doc reads	yes
4 · authRequired: false object_operation	yes (the guest envelope is denied with no grant bound: D3's empty state, as a side effect of E1 being unbuilt)
5 · authRequired: false flow	yes for admission and narrowness; D2b's publish refusal is not built yet (E2, the record's own interim)
everything else	no — three surface families outside the list answer an anonymous caller with 2xx

The three families, function-level only: the /i18n dispatcher domain (packages/runtime/src/domains/i18n.ts#handleI18nRequest makes no shouldDenyAnonymous call, while every other dispatcher domain does); the API-description endpoints (packages/rest/src/rest-server.ts#RestServer.registerOpenApiEndpoints); and storage download for files with no scope and no field owner (packages/services/service-storage/src/storage-routes.ts, whose own docblock calls download gating "a tracked follow-up"). Files declared acl: 'public_read' are also served anonymously, which ADR-0104 rules as an opt-in, but D2's closed list does not name that door.

决策请求(中文)

一句话问题: 实测证明五类开放入口都按 ADR-0138 的规定运作,但"其余一律拒绝匿名访问"这条不成立:未登录的访问者今天仍能读到界面文案与对象字段标签、整份 API 接口文档,并能按文件 id 下载未归属的上传文件。验收条件 2 因此未满足,ADR 不能按现状转为 Accepted。

Governing text: ADR-0138 Acceptance criteria 2("For each of D2's five classes, and for the everything-else class, a booted reference deployment's anonymous answer … matches D2's table");ADR-0138 D2("Everything else answers 401 … A new surface is therefore 401 until this list names it");ADR-0056 D2(Accepted,匿名默认拒绝);ADR-0104(Accepted,"the anonymous capability URL demoted to an opt-in acl: 'public_read'")。本请求不改协议声明。

前提(各带 re-check 命令,阳性对照在后):

• git grep -c shouldDenyAnonymous origin/main -- packages/runtime/src/domains/i18n.ts → 0 个文件;对照 git grep -c handleI18nRequest origin/main -- packages/runtime/src/domains/i18n.ts → 2。
• git grep -n registerOpenApiEndpoints origin/main -- packages/rest/src/rest-server.ts → 2 处(注册与定义),定义处无匿名拒绝(读数在私有文件)。
• git grep -n "tracked follow-up" origin/main -- packages/services/service-storage/src/storage-routes.ts → 1 处。

选项	做什么	客户可感知的后果
A 先关门、再验收	三族中,文案接口与 API 文档按 ADR-0056 D2 补上域级拒绝(401);未归属上传按 ADR-0104 收紧为需登录;同时把 ADR-0104 已裁的 public_read 文件下载作为第六类写进 D2 的封闭列表(记录修订,Tier H)。三张缺陷卡按函数级描述公开立卡,修完重测"其余"一类,再走验收 PR	未登录者不再看到对象模型与字段标签;公开头像/Logo 照常可用;ADR 晚几天转 Accepted
B 先验收、门后补	ADR 按现状转 Accepted,验收条件 2 记为"五类符合,其余类三族不符,由 E2 关闭"	ADR 立刻生效;三扇门在 E2 落地前继续对匿名开着;"Accepted" 与实测不一致
C 同 A,但不公开立卡	三族改走私下安全通道(维护者用 GitHub 私密安全公告处理),本卡只留类级结论	对外不说哪扇门开着;修复不进普通派发队列,进度靠维护者推动

业务含义: A = 门先关好,再宣布"其余一律拒绝"的规则生效;B = 先宣布规则,门以后再补;C = 同 A,但对外不点名哪扇门开着。

四轴论证:

• 实际业务需求: 今天任何人不登录就能拿到整份对象模型(API 文档)和全部对象的字段标签;未归属上传按 id 可取回原文件。登录页的本地化文案需求由已放行的 me/localization 读取承担(未实测,见置信缺口);头像、Logo 这类真要公开的文件已有 ADR-0104 的 public_read 显式声明。
• 项目长远合理性: ADR 是契约,验收条件写的就是"实测符合"。带着已知缺口验收(B),会让 Accepted 失去含义,下一条记录也会照此先例办。A 让 D2 的封闭列表与 ADR-0104 一致:一个已裁的门类写进列表,其余由域级拒绝兜底。
• 防 AI 犯错: 出错时谁看到什么?A 之后,新加的接口默认 401,开发或 AI 漏写一句拒绝时会被一致性矩阵响亮抓住;B 期间,三扇门是"静默泄露",没人报错。
• 创业阶段不扩散: A 不新增门类,只把 ADR-0104 已裁的 public_read 写进列表;其余三族一律收紧,不为它们新开例外。

推荐 A,回退 C。 终态:两年后平台对匿名访问只有一份封闭列表,每一类都有一个声明作为入口,其余一律 401,参照 Salesforce Experience Cloud 的 guest user profile 与 ServiceNow 的 public pages 列表。A 与 C 只差立卡是否公开:代码本身开源,三族都能从源码读出,函数级立卡带来的额外暴露有限;若你更倾向不公开,选 C。
自检:只看①选 A;②③④ 是否翻转:否(C 只改公开方式,不改方向)。
置信缺口:Console 登录页是否读取 /i18n 的匿名接口未测(objectui 侧读者未数);API 文档查看器是否有匿名的真实使用者(如公开的 API 门户)未测;存储收紧对已有"未归属上传"的旧链接的影响未测。

裁后执行: A ⇒ 本席当即立三张缺陷卡(交分诊定车道),起草 ADR-0138 D2 的 public_read 修订(Tier H,另请你批),三卡落地后重跑"其余"一类实测,通过即开验收 PR(含验收条件 4 的两行回指)。B ⇒ 本席开验收 PR,验收条件 2 写明三族与承接卡 E2。C ⇒ 本卡只留本条,三族的细节交你走私密通道,本席等你回传修复点再重测。

os-decision-facets

• ① 项目长远合理性:A 让"其余一律 401"成为实测事实而非声明;列表只多 ADR-0104 已裁的一类,特例不增。
• ② 实际业务拉动:今天任何未登录者即可撞上三族;拉动是安全面,不是功能需求。
• ③ 防 AI 犯错:封闭列表 + 域级拒绝,新面默认拒绝,响亮;B 留着静默泄露。
• ④ 创业阶段不扩散:不为三族开新门类,收紧优于声明并维护例外。

Prior rulings read: anonymous,openapi,i18n,public_read,capability → 67 hits; ADR-0056 D2, ADR-0090 D9, ADR-0104 (public_read opt-in), ADR-0138 D2 / Acceptance criteria 2; thread: 2 rulings (6054113537 A G2, 6056614963 D1 A′ D2b R), neither ruling on these three families.
推荐:A(回退 C)。自检:只看①选 A;②③④ 是否翻转:否。
置信缺口:登录页文案读取路径、API 文档的匿名使用者、旧"未归属上传"链接三项未测。

你要做的: 回一行字母,例如「22146 A」。

Release: session_01VZqqwTj2wsihZEbfT6yyYN · why: the G2 measurement is delivered and reviewed; what comes next is a maintainer decision · to: needs-user-decision, unassigned. This act moves the card pm:dispatched → needs-user-decision and removes the assignee os-tesla.

[objectstack-fleet]

Ruling: batch #300 item 1 · letter A (G2 result: close the three doors, then accept) · maintainer 「同意」 2026-10-09T05:32Z

Director seat, summon #35, session_01VYToj6PQehTEKNrjGM9akg (GitHub os-zhuang; written as objectstack-fleet[bot] via the relay). Presented in batch #300 from the domain:spec seat 1's decision request (6074404262) on the G2 measurement (6074331185, ACCEPTED by the seat): on a booted reference deployment, D2's five classes answer as the ADR-0138 table says, and the everything-else class does not: three surface families answer an anonymous caller with 2xx, so acceptance criterion 2 is not met. A close the three doors, then accept; B accept now and close them under E2; C as A without public cards. The seat recommended A with C as the fallback; this seat recommended A with one added condition; the maintainer answered 「同意」. Thread-read: 6074404262. Freshness: body unchanged since the two earlier Ruled: lines; no comment since the presentation; labels priority:p1, security, needs-user-decision, domain:spec, target:v18, area:access. Premises re-read on origin/main 27a8b33dec: packages/runtime/src/domains/i18n.ts calls shouldDenyAnonymous in 0 files while the other eight dispatcher domains (actions, ai, analytics, auth, automation, meta, packages, security) do; registerOpenApiEndpoints is defined at packages/rest/src/rest-server.ts:5095; packages/services/service-storage/src/storage-routes.ts:226 calls download gating "a tracked follow-up". Added by this seat on objectui main 8f8f760fa4: apps/console/src/main.tsx:158 hands loadLanguage and loadLocales to the I18nProvider at application boot, before sign-in; loadLanguage.ts:19 and loadLocales.ts:23 fetch /api/v1/i18n/translations/:lang and /api/v1/i18n/locales with no Authorization header and degrade to the built-in packs on any failure. That closes the request's first confidence gap: the Console does read the /i18n domain anonymously today.

The ruling

A — close the three doors, then accept. The spec seat files three defect cards, public and at function level, for triage to route:

1. The /i18n dispatcher domain gains the domain-level anonymous refusal every other dispatcher domain has (ADR-0056 D2; 401), with an objectui companion: the Console serves its sign-in page from the built-in packs and loads the application's translations after sign-in. The dev measures first whether the Console re-fetches translations once signed in today, and sizes the companion from that reading; the two land together so no signed-in user sees raw keys.
2. The API-description endpoints refuse an anonymous caller (401).
3. Storage download of a file with no scope and no field owner requires a signed-in caller; a file declared acl: 'public_read' stays anonymous (ADR-0104).

ADR-0138 D2's closed list gains a sixth class, the public_read file download, as a record revision (Tier H; the maintainer approves that PR). When the three cards have landed, the everything-else class is re-measured on a booted reference deployment; when it answers 401 throughout, the acceptance PR opens, with acceptance criterion 4's two back-references. ADR-0138 stays Proposed until then. ⛔ Not taken: B (an Accepted record with a known, measured gap empties the word, and sets the precedent for the next record), C (the code is open source and the three families read from it, so function-level cards add little exposure and keep the fixes in the ordinary queue). Disclosure: the route-level readings stay in the seat's container; this record and the three cards stay at function level, as the card body allows.

Prior rulings read: 6054113537 (A on the eight questions and G2 as the gap) and 6056614963 (D1 A′ D2b R), both on this card, neither ruling on these families; ADR-0138 D2 and acceptance criterion 2; ADR-0056 D2 (default-deny for anonymous) and D9; ADR-0104 (the anonymous capability URL demoted to the opt-in acl: 'public_read'); ADR-0090 D9; ADR-0049. check-prior-rulings over 8 terms → 23 ADR hits (ADR-0056 D1 / D2 / D9, ADR-0023 §1–§5 on the OpenAPI connector, ADR-0029 D8, ADR-0036 §2 among them), none ruling the anonymous answer of these three families; thread: 2 rulings of 16 comments. 自检: 只看①选 A;②③④ 是否翻转:否(C 只改公开方式,不改方向)。置信缺口:Console 登录后是否重拉应用翻译未测(决定 objectui 配套的大小);API 文档是否有匿名的真实使用者(公开 API 门户)未测;旧「未归属上传」链接受影响的范围未测。

State

• needs-user-decision → pm:queue (domain:spec, priority:p1, security, target:v18, area:access) in this act; a third Ruled: line added above the two earlier ones. The spec seat files the three defect cards and drafts the D2 revision; this card stays open for the re-measurement and the acceptance PR. The empty branch claude/issue-22146-g2-sweep may be deleted.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1 (#22146 round 4: the ADR-0138 D2 record revision under the ruling 6074960686, letter A) · 2026-10-09T06:33Z
Session: session_01VZqqwTj2wsihZEbfT6yyYN
Account: os-tesla (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-22146-d2-public-read-class
Worktree: objectstack-issue-22146-d2
Domain: domain:spec
Seat: domain:spec#1
File surface: docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md only (stop on breach and explain in the report). The record stays Proposed.

• D2's closed list gains a sixth class, the acl: 'public_read' file download (ADR-0104), with its admission, what it runs as and its enforcer, and every place the record counts "five" classes or names classes by number (on origin/main 27a8b33dec: the decision table :63, the ruling summary :74, D2 :215 and the adoption rule :244–:245, the enforcement map :487, acceptance criterion 2 :578, the ADR-0090 back-pointer text :592, E2 :607 — re-read on the tree; this list is a lead, not a spec).
• The G2 result and the ruling are recorded at class level: classes 1–5 match, the everything-else class did not (three families, named at function level as the ruling and runtime: the /i18n dispatcher domain answers an anonymous caller — handleI18nRequest makes no shouldDenyAnonymous call, unlike every other dispatcher domain (ADR-0056 D2); with an objectui companion for the Console sign-in page #22432 / rest: the API-description endpoints (RestServer.registerOpenApiEndpoints) answer an anonymous caller with the whole object model; ADR-0056 D2 and ADR-0138 D2 require 401 #22430 / service-storage: a file with no scope and no field owner is downloadable by an anonymous caller who has its id; the download should require a signed-in caller, while acl: 'public_read' stays anonymous (ADR-0104) #22431 name them), and acceptance waits on those three cards and a re-measurement.
• ⛔ No code, no other record, no back-pointer lines (criterion 4 lands with the accepting change, not here).
  Container & model: S (one record), mode:subagent, model: default tier. docs/adr/** is a Tier H governed surface: the PR stays draft with the four-part final set (速读 draft by the dev, the seat's final, reviews requested from os-zhuang and hotlong), and an at-tier contract review (CONTRACT_REVIEW_TIER, governed rule text) is owed before the maintainer's approval is asked for.
  Clause-②: no (a record revision; no accept set or public surface moves)
  Responsibility: n/a — not a defect card
  Thread-read: 6074960686
  Serial constraints cleared: no open PR touches docs/adr/0138-*.md (read 2026-10-09T06:33Z). The three defect cards it names (runtime: the /i18n dispatcher domain answers an anonymous caller — handleI18nRequest makes no shouldDenyAnonymous call, unlike every other dispatcher domain (ADR-0056 D2); with an objectui companion for the Console sign-in page #22432, rest: the API-description endpoints (RestServer.registerOpenApiEndpoints) answer an anonymous caller with the whole object model; ADR-0056 D2 and ADR-0138 D2 require 401 #22430, service-storage: a file with no scope and no field owner is downloadable by an anonymous caller who has its id; the download should require a signed-in caller, while acl: 'public_read' stays anonymous (ADR-0104) #22431) are filed and unassigned; this revision does not wait on them.

Ruling: 6074960686 (batch #300 item 1, letter A, maintainer 「同意」): "ADR-0138 D2's closed list gains a sixth class, the public_read file download, as a record revision (Tier H; the maintainer approves that PR). When the three cards have landed, the everything-else class is re-measured on a booted reference deployment; when it answers 401 throughout, the acceptance PR opens, with acceptance criterion 4's two back-references. ADR-0138 stays Proposed until then."

The three defect cards filed under the ruling: #22432 (the /i18n dispatcher domain, with its objectui companion), #22430 (the API-description endpoints), #22431 (storage download of a file with no scope and no field owner). After this round's PR, the card carries Blocked-by: on all three for the re-measurement.

This act moves the card pm:queue → pm:dispatched and assigns os-tesla.

[objectstack-fleet]

os-dev-report

{
  "issue": 22146,
  "status": "done",
  "branch": "claude/issue-22146-d2-public-read-class",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22433",
  "session": "session_01VZqqwTj2wsihZEbfT6yyYN",
  "premise_still_valid": true,
  "summary": "Round 4 delivered as draft PR #22433 (Tier H, stays draft; one file, +121 / -37; Status stays Proposed): the ADR-0138 record revision under the G2 ruling 6074960686. D2's closed list gains class 6, the acl: 'public_read' file download (ADR-0104 D3 wave 2), in the existing columns: admitted by the file's own acl: 'public_read' (packages/services/service-storage/src/objects/system-file.object.ts#acl), running as a read of that one file's bytes with no principal evaluated, enforced in packages/services/service-storage/src/storage-routes.ts#registerStorageRoutes at its download gate authorizeDownload (a closure both download routes call; read on origin/main e02833c240). The adoption rule (classes 4 and 5 take the guest envelope; 1 to 3 and 6 their own declaration), every count of the door classes and the quoted ADR-0056 back-pointer count follow; the G2 result is recorded at class level under acceptance criterion 2 (classes 1-5 match; the public_read download was served as ADR-0104 rules and is now class 6; the everything-else class did not match: handleI18nRequest's /i18n domain, RestServer.registerOpenApiEndpoints, storage download of a file with no scope and no field owner) with the ruling's acceptance sentence quoted verbatim, and acceptance waits on #22432, #22430, #22431 and a re-measurement. Premises re-read on e02833c240 (5 commits past 27a8b33dec, none touching the record or the three families' files): i18n.ts still makes no shouldDenyAnonymous call. No code, no other record, no back-pointer lines; the card's assignee was not written.",
  "tests": "All at HEAD 024872cb90. Derived with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (stderr: tree of objectstack-ai/objectstack at 024872cb90, --repo holds; 1 path, +121/-37 vs merge base e02833c24): 19 commands, all exit 0, each exit captured before any pipe (list under gates). check-adr-symbol-anchors: '2232 anchors across 141 records resolve'; positive control: the shared extractor reads 57 anchors in this record at base and 63 at head, the +6 (system-file.object.ts#acl, storage-routes.ts#registerStorageRoutes x2, the #authorizeDownload continuation, i18n.ts#handleI18nRequest, rest-server.ts#RestServer.registerOpenApiEndpoints) each resolving as a declaration via symbolSegmentResolution; negative control: authorizeDownloadNope reads absent. check-adr-links: '715 relative link destination(s) under docs/adr/ resolve'. check:doc-formula-expressions: first run exit 3 = PREREQUISITE NOT MET (@objectstack/formula unbuilt in the fresh worktree), not a measurement; built formula+lint under os-verify-lock (slot issue-22146-d2; 'VERDICT command-exit 0', held 104s, waited 71s; turbo 4/4), rerun exit 0. check:nul-bytes OK; separate control-byte grep on the record and the PR body: exit 1 (none). --ran reconciliation with recorded exit codes: '19 derived, 19 run, 0 NOT-MEASURED, 0 UNRUN'. check-issue-citations (dispatch-named, not in the derived set): exit 0 but '0 file(s) read' because docs/adr/** is a deferred surface, so NOT MEASURED for this diff; instead the three cited cards were read by REST GET: #22430, #22431, #22432 are open issues, not pull requests. No ablation (no code). CI: in_progress, not awaited.",
  "gates": [
    "node scripts/check-adr-links.mjs :: 0",
    "node scripts/check-adr-links.mjs --self-test :: 0",
    "node scripts/check-adr-symbol-anchors.mjs :: 0",
    "node scripts/check-adr-symbol-anchors.mjs --self-test :: 0",
    "node scripts/check-ci-filter-parity.mjs :: 0",
    "node scripts/check-closing-keyword-parity.mjs :: 0",
    "node scripts/check-closing-keyword-parity.mjs --self-test :: 0",
    "node scripts/check-comment-mask-corpus.mjs :: 0",
    "pnpm check:adr-anchors :: 0",
    "pnpm check:cross-package-test-inputs :: 0",
    "pnpm check:doc-authoring :: 0",
    "pnpm check:driver-memory-census :: 0",
    "pnpm check:gitlink-declared :: 0",
    "pnpm check:nul-bytes :: 0",
    "pnpm check:pm-governed-merges :: 0",
    "pnpm check:pm-prior-rulings :: 0",
    "pnpm check:refd-timer-probe :: 0",
    "pnpm check:watch-hint-literal :: 0",
    "pnpm --filter @objectstack/lint run check:doc-formula-expressions :: 0",
    "(dispatch-named, outside the derived 19) node scripts/check-issue-citations.mjs :: 0, vacuous: 0 files read (docs/adr/** deferred)"
  ],
  "mcp_calls": "0",
  "api_writes": "3 REST writes, all through scripts/pm via the fleet-write relay (each a POST /repos/objectstack-ai/objectstack/dispatches, HTTP 204, run success, executed as objectstack-fleet[bot]): (1) pr_create via with-fleet.sh --via dispatch → POST /repos/objectstack-ai/objectstack/pulls (#22433, draft forced; body read back byte-identical, 12299 bytes, footer intact); (2) label-write.mjs --issue 22433 --add skip-changeset --assign os-tesla → POST /repos/objectstack-ai/objectstack/issues/22433/labels + POST /repos/objectstack-ai/objectstack/issues/22433/assignees (read-back matches: documentation, size/m, skip-changeset, assignee os-tesla; documentation and size/m added by the labelers, preserved; final re-read identical); (3) this os-dev-report via post-stamped.mjs → POST /repos/objectstack-ai/objectstack/issues/22146/comments. Plus git push x2 (not REST): the empty-branch claim marker at e02833c240 and the revision 024872cb90. No reviewer requested, no MCP call, no card-assignee write. Reads: the card and all 18 comments (one page), the three defect cards and the PR, by REST GET.",
  "files_changed": [
    "docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md"
  ],
  "count_sites_changed": [
    "TL;DR decision table D2 row :63 → :77: 'five door classes' → 'six door classes'; Ruled cell + 'class 6 added by the G2 ruling'",
    "D2 intro :215 → :238: 'exactly these five door classes' → 'six'; the Ruled line names 6074960686",
    "D2 table: row 6 added (:248)",
    "D2 adoption rule :244-:245 → :268-:270: 'classes 1 to 3 take their own declared grant' → 'classes 1 to 3 and 6 take their own declaration'",
    "D2 Enforced by :249 → :274 (NOT in the dispatch's lead list): 'Card E2 records the five classes' → 'six'",
    "Enforcement map :487 → :519: 'the five door classes' → 'the six door classes'",
    "Acceptance criterion 2 :578 → :624: 'each of D2's five classes' → 'six', plus the measured result and what remains",
    "Criterion 4 quoted ADR-0056 back-pointer text :592 → :665: 'closed list of five door classes' → 'six' (the count inside the quote only; the back-pointer itself not landed)",
    "E2 :607 → :682: 'the five classes recorded in the conformance matrix' → 'six'"
  ],
  "count_sites_left": [
    ":74 → :88 the first ruling's summary, verbatim quote of 6054113537 ('the closed list of five door classes'): left, because editing it would rewrite a ruling; a new paragraph under it (:101-:106) records the G2 ruling and says why the quote still says five",
    "D1 point 1 '(D2, classes 4 and 5)' :207, D3 point 1 same :330, D8 'D2 class 1' :449, D2b 'D2's class 5 row' :504, E1 'denied on class 4' :681: left, class 6 is appended so classes 1-5 keep their numbers",
    "D2 'except at the two endpoint classes above' :254: left, still two (class 6 takes no guest envelope)",
    "Context table 're-measured at 7b926f7600' :122: left, a dated reading",
    "Alternatives G1 'every door class reads as a denial or a narrow door': left, the recorded reasoning for a letter not taken",
    "Criterion 1: left as the record has it (unmarked); see open_questions"
  ],
  "deviations": [
    "Status line: the record's '⛔ Nothing in packages/** ... changes before acceptance' would contradict the ruling, which lands three defect cards before acceptance; reworded to 'no change this record decides lands in packages/** ... before acceptance', plus one sentence that the defect cards land first because they enforce ADR-0056 D2 and ADR-0104, both Accepted. A matching sentence was added under the Execution plan ('not execution cards of this record').",
    "Consistency edits beyond the dispatch's lead list, each forced by class 6 or the G2 result and named in the PR body: Decided by (+ the G2 ruling), Builds on (+ ADR-0104 D3 wave 2), Leaves unchanged (+ ADR-0104), Consumers (+ @objectstack/service-storage), Card line, the TL;DR note under the verbatim summary, the Context G2 bullet's pointer, a D2 'Measured, and not yet held' paragraph, the enforcement map's default-deny row status (names the three G2 exceptions), two Consequences bullets, Alternatives (+ G2-result B and C in the ruling's words), criterion 4's 'No line is added to' (+ ADR-0104), References (+ 6074331185, 6074404262, 6074960686 and the three cards).",
    "The dispatch's lead :74 (the ruling summary) was deliberately not edited: it is a verbatim quote of 6054113537; annotated instead (count_sites_left).",
    "check-issue-citations was named by the dispatch but is outside the derived 19; run anyway, it read 0 files (docs/adr/** is one of its deferred surfaces), so recorded as vacuous, with the three citations checked by REST instead.",
    "Worktree base is origin/main e02833c240, 5 commits past the dispatch's 27a8b33dec; none touch the record (byte-identical at both) or the three families' files, so the dispatch's line leads hold.",
    "Attribution: the commit carries the AGENTS.md model-free trailer pair (Claude-Session + Co-authored-by: Claude) and the PR body ends with the AGENTS.md session-URL footer, not the harness reminder's model-named trailer or its footer (os-dev.md: the harness reminder yields).",
    "Cleanup: worktree node_modules removed and git worktree remove (no --force) run after the PR and labels, before this report; the remote branch head 024872cb90 equals the local head at removal."
  ],
  "open_questions": [
    {
      "question": "Should the post-card re-measurement also read class 6? The ruling names only the everything-else class for the re-measurement, but criterion 2 now names six classes, class 6's G2 reading is the observation that public_read files were served anonymously, and #22431 edits the very gate (authorizeDownload) that class 6 passes through.",
      "options": [
        "A: the re-measurement reads class 6 beside the everything-else class (one more class-level line; no record change, criterion 2 already requires six)",
        "B: re-measure the everything-else class only, as the ruling words it, and rely on #22431's own pin that a public_read file stays anonymous"
      ],
      "recommendation": "A, because the change most likely to move class 6 is #22431 itself and a class-level line costs nothing; it is the seat's call, so the record does not add it."
    },
    {
      "question": "Criterion 1 (the maintainer's approval): the record still says only 'the third is met', while the landing comment 6058198880 read criterion 1 as met by the approval on PR #22239. This revision is itself a Tier H approval.",
      "options": [
        "A: leave the record's wording; the accepting change states criterion 1 met",
        "B: the seat marks criterion 1 met in this PR before asking for approval"
      ],
      "recommendation": "A: the revision did not touch criterion 1's wording, and the accepting PR is where all four are stated met together."
    }
  ],
  "out_of_scope_findings": [
    "carrier: #22431 · noted, not filed — the acl: 'public_read' opt-in has no in-repo producer: both upload routes in registerStorageRoutes create sys_file rows as private, copy-on-claim copies the source row's acl, and FieldSchema declares no file acl, so ADR-0104's 'the field/file explicitly declares' exists only on the file-row side (the sys_file.acl select). Not a defect under ADR-0104 (an opt-in), but it bears on #22431: once an unclaimed upload such as an organization logo requires sign-in, nothing in the repository marks it public_read. Recorded in PR #22433's Acceptance notes; #22431's acceptance already asks its dev to measure the in-repo producers of unclaimed uploads."
  ]
}

---

Generated by Claude Code

[objectstack-fleet]

✅ ACCEPT — PR #22433 at 024872cb90 (round 4: ADR-0138 D2 class 6). Tier H: waits on the maintainer's approval

domain:spec seat 1 (#6017) · os-tesla · session session_01VZqqwTj2wsihZEbfT6yyYN · 2026-10-09T07:07Z · holder of claim 6075714215. Report: os-dev-report 6076046095.

Checked on GitHub and in the diff, not from the report:

• Shape: draft, base main; line 1 Part of #22146 (the card stays open), line 2 Clause-②: no; one file, docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md, +121 / −37; skip-changeset; assignee os-tesla; the ## 维护者速读(草稿) section is present.
• The revision, read in the diff: D2 gains class 6, the acl: 'public_read' file download, with its admission (system-file.object.ts#acl), what it runs as (that one file's bytes, no principal evaluated) and its enforcer (registerStorageRoutes' authorizeDownload); the adoption rule reads "classes 1 to 3 and 6 take their own declaration"; every door-class count reads six, and the one remaining "five" is the verbatim summary of ruling 6054113537, annotated beneath it; criterion 2 records the G2 result at class level, the three cards, and the ruling's acceptance sentence verbatim; Status stays Proposed. Readings stay at function level.
• CI on 024872cb90: 35 runs, 24 success and 11 skipped; check-expected-skips --pr 22433: "OK — 11 skipped check-run(s), every one in the roster".
• Governed surface: check-governed-merges --pr 22433: docs/adr/**, landing tier H — an authorized APPROVED review, then the owning seat lands it; 158 changed lines.
• Contract review: at-tier, PASS on 024872cb90 (6076189164).

The dev's open questions, decided by the seat:

1. The post-card re-measurement reads class 6 as well as the everything-else class (A). Criterion 2 as revised requires all six classes to match, and service-storage: a file with no scope and no field owner is downloadable by an anonymous caller who has its id; the download should require a signed-in caller, while acl: 'public_read' stays anonymous (ADR-0104) #22431 edits the gate class 6 passes through. No record change is needed.
2. Criterion 1's wording stays as it is (A); the acceptance PR states all four criteria met together.

The public_read producer gap (no in-repo producer marks a file public_read) is carried to #22431 (6076074763).

Next: the final 速读 on the PR, needs-user-decision on the PR, and review requests to os-zhuang and hotlong. After the approval, the seat lands the PR through the queue; the card then waits, pm:blocked, on #22432, #22430 and #22431 for the re-measurement.

[objectstack-fleet]

Landed: round 4, PR #22433 → 05c7c3fa3b (ADR-0138 D2 gains class 6; the G2 result recorded). The card waits on the three defect cards: pm:dispatched → pm:blocked

domain:spec seat 1 (#6017) · os-tesla · session session_01VZqqwTj2wsihZEbfT6yyYN · 2026-10-09T07:40Z · holder of claim 6075714215, released by this act.

• Landed: merged through the merge queue as 05c7c3fa3b (one parent, 46692c118b), an ancestor of origin/main. docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md is blob-equal to the approved head 024872cb90.
• The review record: Tier H — os-zhuang's APPROVED review on 024872cb90 (2026-10-09T07:24Z); the seat's ACCEPT 6076202284; at-tier contract review PASS 6076189164; the final 维护者速读 6076213418.
• What now holds on main: ADR-0138, still Proposed. D2's closed list has six classes (class 6, the acl: 'public_read' file download, ADR-0104). Criterion 2 records the G2 result at class level and what remains.

What acceptance still needs (ruling 6074960686):

1. The three defect cards land: runtime: the /i18n dispatcher domain answers an anonymous caller — handleI18nRequest makes no shouldDenyAnonymous call, unlike every other dispatcher domain (ADR-0056 D2); with an objectui companion for the Console sign-in page #22432 (the /i18n dispatcher domain, with its objectui companion), rest: the API-description endpoints (RestServer.registerOpenApiEndpoints) answer an anonymous caller with the whole object model; ADR-0056 D2 and ADR-0138 D2 require 401 #22430 (the API-description endpoints), service-storage: a file with no scope and no field owner is downloadable by an anonymous caller who has its id; the download should require a signed-in caller, while acl: 'public_read' stays anonymous (ADR-0104) #22431 (storage download of a file with no scope and no field owner). They are filed for triage to route.
2. The re-measurement on a booted reference deployment: the everything-else class, and class 6 as well (the seat's decision in 6076202284, since service-storage: a file with no scope and no field owner is downloadable by an anonymous caller who has its id; the download should require a signed-in caller, while acl: 'public_read' stays anonymous (ADR-0104) #22431 edits the gate class 6 passes through).
3. When every class answers as D2 says, the acceptance PR (Status → Accepted, criterion 4's back-pointers), Tier H.

Blocked-by: lines for the three cards are in the body. When the last one closes, the unblock sweep returns this card, and the spec seat re-claims it for the re-measurement.

Release: session_01VZqqwTj2wsihZEbfT6yyYN · why: round 4 is delivered and landed; what remains waits on three cards in other lanes · to: pm:blocked, unassigned. This act moves the card pm:dispatched → pm:blocked and removes the assignee os-tesla.

[objectstack-fleet]

Pointer from the domain:cli seat: ruling 6074960686 item 2 has landed (#22430 → PR #22446 → 166a94f75d). · seat domain:cli#1 (#6024) · session_01BmsuLyUeuG5CNpZFMH1jzS · 2026-10-09T11:51Z. ⛔ Not a claim, ⛔ not a request for work. Function level.

• What landed: the API-description endpoints that RestServer.registerOpenApiEndpoints mounts (the document and its viewer) refuse an anonymous caller with the shared 401 UNAUTHENTICATED. The authorization matrix classifies the family (anonymous-deny-api-description), and the population baseline reads 31. The changeset declares Clause-②: no (narrowing), minor, as PR fix(service-storage)!: downloading a file with no attachments scope and no field owner requires a signed-in caller #22439 (item 3) did.
• One open observation for the everything-else re-measurement, recorded in PR fix(rest): the API-description endpoints refuse an anonymous caller (#22430) #22446's Acceptance notes and NOT measured:
  • On the environment-scoped twin of these two routes, a signed-in caller is judged by the auth service of the environment the URL names.
  • The two handlers add no environment-ownership comparison of the kind the UI-view route makes.
  • Item 2 covers anonymous callers only, and the reference boot mounts no scoped base, so neither the fix nor its proof reached this.
  • The seat leaves it here for whoever re-measures D2's everything-else class, instead of filing a card with no measured reach.
• Item 1 (runtime: the /i18n dispatcher domain answers an anonymous caller — handleI18nRequest makes no shouldDenyAnonymous call, unlike every other dispatcher domain (ADR-0056 D2); with an objectui companion for the Console sign-in page #22432, /i18n with the objectui companion, now landed on objectui main) is next in this seat's lane.

---

Generated by Claude Code

[objectstack-fleet]

Pointer from the domain:cli seat: the third door named in ruling 6074960686 item 1 has landed · session_01BmsuLyUeuG5CNpZFMH1jzS · 2026-10-10T00:25Z. ⛔ Not a claim.

• runtime: the /i18n dispatcher domain answers an anonymous caller — handleI18nRequest makes no shouldDenyAnonymous call, unlike every other dispatcher domain (ADR-0056 D2); with an objectui companion for the Console sign-in page #22432 → PR fix(runtime)!: the /i18n dispatcher domain refuses an anonymous caller, with the console pin moved past the sign-in companion (#22432) #22496 → b53b949a15: the /i18n dispatcher domain refuses an anonymous caller (401 UNAUTHENTICATED). With rest: the API-description endpoints (RestServer.registerOpenApiEndpoints) answer an anonymous caller with the whole object model; ADR-0056 D2 and ADR-0138 D2 require 401 #22430 (166a94f75d) and rest(public forms): POST /forms/:slug/submit answers the anonymous submitter with the whole stored record, so any field a hook derives from existing data (a duplicate match, an owner) reaches the internet #22437 (7806a14117), all three doors of item 1 are on main.
• For ADR-0138's everything-else re-measure, an observation that is not measured: I18nServicePlugin.registerI18nRoutes (packages/services/service-i18n/src/i18n-service-plugin.ts) mounts the same three /api/v1/i18n paths with no anonymous floor of its own. In every in-repo composition (os serve, os dev, DevPlugin) the dispatcher's gated mounts register first and answer; runtime: the /i18n dispatcher domain answers an anonymous caller — handleI18nRequest makes no shouldDenyAnonymous call, unlike every other dispatcher domain (ADR-0056 D2); with an objectui companion for the Console sign-in page #22432's dev measured that on a booted showcase. A host that composes the plugin on an HTTP server without the runtime dispatcher plugin was NOT measured. Source: runtime: the /i18n dispatcher domain answers an anonymous caller — handleI18nRequest makes no shouldDenyAnonymous call, unlike every other dispatcher domain (ADR-0056 D2); with an objectui companion for the Console sign-in page #22432's report 6083216104, out_of_scope_findings[0].

---

Generated by Claude Code

[objectstack-fleet]

Unlock: pm:blocked → pm:queue. All three anonymous-door cards are closed (#22430, #22431, #22432)

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-10T00:59Z. Unlock scan. ⛔ Not a claim, ⛔ not a dispatch. ⛔ Classes, positions and functions only.

Thread-read: 6076657462

• service-storage: a file with no scope and no field owner is downloadable by an anonymous caller who has its id; the download should require a signed-in caller, while acl: 'public_read' stays anonymous (ADR-0104) #22431 closed at 2026-10-09T09:01Z, rest: the API-description endpoints (RestServer.registerOpenApiEndpoints) answer an anonymous caller with the whole object model; ADR-0056 D2 and ADR-0138 D2 require 401 #22430 at 2026-10-09T11:49Z, and runtime: the /i18n dispatcher domain answers an anonymous caller — handleI18nRequest makes no shouldDenyAnonymous call, unlike every other dispatcher domain (ADR-0056 D2); with an objectui companion for the Console sign-in page #22432 at 2026-10-10T00:22Z. All three are completed.
• runtime: the /i18n dispatcher domain answers an anonymous caller — handleI18nRequest makes no shouldDenyAnonymous call, unlike every other dispatcher domain (ADR-0056 D2); with an objectui companion for the Console sign-in page #22432's PR moved this repo's .objectui-sha to 47b1f0bb71, past its objectui companion, as ordered. Cloud's row for it rides objectstack-ai/cloud#2709.
• As 6076657462 set: the domain:spec seat re-claims this card for the re-measurement of the guest model against main with all three doors closed. Then the one ADR follows (batch Bump version to 0.3.4 #300 A).

[objectstack-fleet]

Claim: PM loop round 2 (#22146 round 5: the G2 re-measurement on main with all three doors closed; then, if criterion 2 is met, the acceptance PR) · 2026-10-10T01:40Z
Session: session_01KNKBCRDJCu5tGy3TEbvtrF
Account: zhuangjianguo (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-22146-adr-0138-acceptance
Worktree: objectstack-issue-22146
Domain: domain:spec
Seat: domain:spec#3 (seat post #18883)
File surface:

• Phase 1, the re-measurement: none. No tracked file is edited and no PR is opened. The branch is pushed at its base as the claim's marker. Classes 4 and 5 may again need uncommitted fixture declarations in the worktree (no example app declares an authRequired: false endpoint, re-read on fbb065fd4b); they are restored to HEAD before teardown. The probes live outside the repository and are not published.

• Phase 2, only on this seat's ACCEPT of phase 1 with criterion 2 met:

  • docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md: the Status line, and criterion 2's record of the re-measurement at class level;
  • criterion 4's two back-pointers, one status-line continuation each, in docs/adr/0090-permission-model-v2-concept-convergence.md and docs/adr/0056-permission-model-landing-verification.md.

  Tier H (docs/adr/**): the maintainer approves that PR. If criterion 2 is not met, there is no phase 2: the result comes back to this card for a decision.
  Container & model: M, mode:subagent, model: default tier (dispatch-gates --tier on the phase-2 paths: no path-derived mandate; judged from the card: a measurement, then a record status change with no contract edit). Phase 2 owes a contract review at CONTRACT_REVIEW_TIER before the maintainer is asked.
  Clause-②: no (a measurement, then a record status change; no accept set or public surface changes)
  Responsibility: n/a — not a defect card
  Thread-read: 6091919249
  Serial constraints cleared: the file lists of the 12 open PRs, read at 2026-10-10T01:40Z. None touches the three phase-2 ADRs or examples/app-showcase/src/system/apis/**. The run builds and boots one local reference deployment on a random high port through os-verify-lock.sh.

Why the claim, with its source.

• The triage unlock 6091919249: "the domain:spec seat re-claims this card for the re-measurement of the guest model against main with all three doors closed. Then the one ADR follows (batch Bump version to 0.3.4 #300 A)."
• The G2 ruling 6074960686, verbatim: "When the three cards have landed, the everything-else class is re-measured on a booted reference deployment; when it answers 401 throughout, the acceptance PR opens, with acceptance criterion 4's two back-references."
• Seat 1's decision in the ACCEPT 6076202284: the re-measurement reads class 6 as well as the everything-else class. This round reads all six classes and the everything-else class on one boot of one main SHA, so the acceptance PR cites a single reading.
• Target: only a deployment the dev boots itself, from this repository's own example app. Every probe goes to 127.0.0.1 and to that one server. No other host is probed.
• Publication: a class-level result only, as ADR-0138 criterion 2 and the card body require: one line for each of D2's six classes and one for the everything-else class. Route-level readings stay private in the seat's container and do not go on GitHub.
• Stop rule: if the environment's safety check refuses the run, the dev reports blocked with the refusal as written. Nothing is worked around.

This act moves the card pm:queue → pm:dispatched and assigns zhuangjianguo.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 22146,
  "status": "blocked",
  "branch": "claude/issue-22146-adr-0138-acceptance",
  "pr": null,
  "session": "session_01KNKBCRDJCu5tGy3TEbvtrF",
  "premise_still_valid": true,
  "booted_sha": "fbb065fd4b (origin/main at worktree creation), with the uncommitted class 4/5 and negative-control fixtures; since restored to HEAD",
  "summary": "BLOCKED by the stop rule. The environment's safety check refused a step of the probes. While I was writing the everything-else sweep driver (the script that would send one anonymous request per registered surface), the response was stopped and withheld. The refusal, as written: \"Your response above was stopped by a safety classifier — this is not a tool or API error. The rest of it was withheld, and tool calls in it that had not finished did not run. Do not produce that content again, even reworded.\" Per the dispatch, I stopped there. I did not rephrase, re-route or retry the refused step, and the sweep driver never ran. No anonymous probe of any surface was sent, so no class was measured. What did happen: (1) Mechanism assumption 1 was confirmed by reading on fbb065fd4b. handleI18nRequest calls shouldDenyAnonymous at its first statement. RestServer.registerOpenApiEndpoints refuses an anonymous caller through enforceAuth as each handler's first act. authorizeDownload serves acl public_read and otherwise calls requireDownloadSession for a file with neither an attachments scope nor a field owner. None of these was confirmed by a booted answer. (2) Assumption 2 holds: the only example hit for an authRequired false declaration is a comment, so uncommitted fixtures were added for classes 4 and 5 and their negative controls. (3) Assumption 3 was measured: a signed-in admin can set acl public_read on the stored file record through the data API's ordinary record update of sys_file; it answered 2xx and the value read back. (4) The showcase was built, booted on a random high port in its own process group, and torn down. Only PM or the maintainer can unblock this: decide where, or by whom, the anonymous sweep may run (seat 1's earlier claim used the wording \"run, or have run in an environment that permits the probe\"). Then dispatch the measurement again.",
  "g2_class_results": [
    "1 · the public form doors (resolve and submit) · matches D2: NOT MEASURED · no anonymous probe sent (blocked) · -",
    "2 · share links · matches D2: NOT MEASURED · no anonymous probe sent (blocked); subjects were created signed in, then destroyed with the ephemeral store · -",
    "3 · the public book and doc metadata reads · matches D2: NOT MEASURED · no anonymous probe sent (blocked) · -",
    "4 · authRequired: false endpoints of type object_operation · matches D2: NOT MEASURED · the fixture loaded (the boot reported 32 flows); never probed · -",
    "5 · authRequired: false endpoints of type flow · matches D2: NOT MEASURED · the fixture loaded; never probed · -",
    "6 · the acl public_read file download · matches D2: NOT MEASURED · a public_read file and a private unclaimed file were created signed in; never probed anonymously · -",
    "everything else · matches D2: NOT MEASURED · the booted route table was read (177 registered routes plus raw-app mounts), but the sweep driver was refused before it ran · -"
  ],
  "tests": "Measurement only, and stopped before any anonymous probe. No tracked change, so no gate family is owed: dispatch-gates --commands --repo objectstack-ai/objectstack exits 2 and prints \"this branch changes nothing against 'origin/main' (merge base fbb065fd4) - nothing to derive.\" Build: the showcase dependency closure, then the 8 workspace packages check-dev-prereqs named as unbuilt, both through os-verify-lock with slot issue-22146, OS_SKIP_DTS=1 and workspace-concurrency 2. Both printed VERDICT command-exit 0 (held 64s and 57s, waited 0s). check-dev-prereqs then exited 0 (\"67 package build artifacts present\"). os validate on the showcase with the fixtures: \"Validation passed\". Boot: the backend-only recipe from AGENTS.md (pnpm dev, --fresh, random high port), with an ephemeral tempdir and the seeded admin. The server was ready in about 12s. Requests sent: 22 in all, every one to 127.0.0.1 on that one server. They were the admin sign-in (one first attempt refused with INVALID_ORIGIN until an Origin header was added) and signed-in setup reads and writes. Zero anonymous surface probes were sent. Teardown: only the process group this session started was signalled. It then held 0 processes, the port had no listener, and the tempdir was gone. The 4 fixture files were restored with git checkout HEAD; git diff HEAD is 0 bytes and git status --porcelain is empty. The remote branch is at its base fbb065fd4b. The worktree is kept. The private scratch (setup readings, fixture patch, route-table dump, boot log) stays in this container; no g2r-readings.md verdict file was written, because no class was read.",
  "mcp_calls": "0",
  "api_writes": "1: this os-dev-report comment, sent through scripts/pm/post-stamped.mjs (the relay to POST issues/22146/comments). Also one git push, which is not REST: the marker branch at its base. Reads: the card and its 25 comments, through REST GET. No PR, no label or assignee write, and no MCP tool.",
  "deviations": [
    "The boot carried a read-only route-table tap: a Node module load hook, preloaded only into the serve child, that wrapped the HTTP adapter's listen to record the server instance and every 5s wrote its mounted-route table to scratch. It did not change routing or answers, but the boot was not byte-for-byte the plain recipe.",
    "The sign-in and setup writes send an Origin header naming the server's own localhost origin, because the auth layer refuses a POST without one (INVALID_ORIGIN).",
    "The second build step filtered each unbuilt package together with its dependencies, so it rebuilt 58 packages instead of 8. That cost time only.",
    "Class 3's negative control was a fixture book with the org audience. No doc-level negative was prepared."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: the next G2 everything-else reading · noted, not filed (read from source and the live route table only; nothing measured). The approvals plugin mounts its actionable-link pages on the raw app (ApprovalsServicePlugin, the action-token peek and redeem handlers). This is a token-addressed door that D2's six classes do not name. Read from source, a request without a valid token is answered with an HTML result page rather than a 401. The next reading should classify this door explicitly.",
    "carrier: the next G2 everything-else reading · noted, not filed. The live route table also holds raw-app mounts that need an explicit classification under \"Outside the guest model by construction\" or the everything-else class: the OAuth well-known metadata documents, the runtime-config bootstrap reads (RuntimeConfigPlugin), the MCP skill read, and the dev-only metadata event stream (the metadata HMR routes). None was probed."
  ]
}

---

Generated by Claude Code

[objectstack-fleet]

Round 5 stopped by the stop rule: the environment's safety check refused the anonymous sweep. No class was measured. The card goes to the maintainer

domain:spec seat 3 (#18883) · zhuangjianguo · session session_01KNKBCRDJCu5tGy3TEbvtrF · 2026-10-10T02:04Z · holder of claim 6092292795, released by this act. Report: os-dev-report 6092490239. Thread-read: 6092490239.

What happened, checked by the seat:

• The dev built the showcase closure, booted it from origin/main fbb065fd4b on a random high port in its own process group, and set up the subjects while signed in: a public_read file and a private unclaimed file, fixtures for classes 4 and 5, and their negative controls. All 22 requests went to 127.0.0.1. Zero anonymous probes were sent.

• While the dev was writing the driver for the everything-else class, the environment's safety classifier stopped the response. Its words: "Your response above was stopped by a safety classifier — this is not a tool or API error. … Do not produce that content again, even reworded." The dev stopped there, as the claim's stop rule requires. Nothing was re-routed or reworded. ⛔ This seat does not run the sweep itself and does not hand it to another agent: a refused step stays refused.

• Teardown, verified by the seat:

  • no process remains in the dev's process group, and the port has no listener;
  • the ephemeral tempdir is gone;
  • the worktree's git status --porcelain is empty and git diff HEAD is 0 bytes;
  • claude/issue-22146-adr-0138-acceptance sits at its base fbb065fd4b with nothing committed.

• Read, but not measured on the wire: the three doors are closed in source on fbb065fd4b:

  • packages/runtime/src/domains/i18n.ts#handleI18nRequest calls shouldDenyAnonymous first;
  • packages/rest/src/rest-server.ts#RestServer.registerOpenApiEndpoints refuses through enforceAuth;
  • packages/services/service-storage/src/storage-routes.ts#authorizeDownload serves acl: 'public_read' and otherwise requires a session for an unclaimed file.

  A signed-in admin can set acl: 'public_read' on a stored file through the data API's ordinary sys_file update. That is class 6's producer path, which service-storage: a file with no scope and no field owner is downloadable by an anonymous caller who has its id; the download should require a signed-in caller, while acl: 'public_read' stays anonymous (ADR-0104) #22431 left open.

Class-level result: NOT MEASURED for all six classes and for the everything-else class. Criterion 2 is still unmet, and ADR-0138 stays Proposed.

For the next reading (function level; noted by the dev from source and the live route table, not probed):

• ApprovalsServicePlugin's actionable-link pages (the action-token peek and redeem handlers) are a token-addressed door that D2's six classes do not name. Without a valid token they answer an HTML result page, not a 401. The next reading should classify this door explicitly.
• These raw-app mounts need an explicit classification, either under "Outside the guest model by construction" or in the everything-else class:
  • the OAuth well-known metadata documents;
  • RuntimeConfigPlugin's bootstrap reads;
  • the MCP skill read;
  • the dev-only metadata HMR stream.

Precedent: seat 1's session ran the 2026-10-09 sweep (6074331185) in its own environment, on the maintainer's word. Where this one runs is the maintainer's to say.

Maintainer-action: run, or have run in an environment that permits the probe, the ADR-0138 criterion 2 re-measurement on current main (all six D2 door classes and the everything-else class, on one boot of one SHA, class-level publication only) — done when a comment on #22146 records a class-level result for each of the six classes and the everything-else class

Release: session_01KNKBCRDJCu5tGy3TEbvtrF · why: the sweep is refused in this seat's environment, and running it elsewhere is the maintainer's call · to: pm:awaiting-maintainer, unassigned. When a class-level result is on record and the everything-else class answers 401 throughout, the domain:spec seat re-claims the card for the acceptance PR (Tier H, with criterion 4's two back-pointers).

---

Generated by Claude Code