app-shell, auth: on a cloud-managed environment (features.cloudManaged), Setup → Users says where to invite and marks an unauthorized user, and the console hides invite, import and the recovery-password reminder (objectstack#25083 ruling)

Filing gate ④ (a per-layer child of a cross-repo coordinating parent) · carries the objectui item of objectstack-ai/objectstack#25083; #25083 keeps the services half (plugin-auth's doors and the served flag) and the cross-lane items (core accessor, spec registry entry, platform-objects predicates, cloud, skills).

Was blocked by objectstack-ai/objectstack#25083 (cleared 2026-10-23: the flag is served since objectstack-ai/objectstack#25309).

Filed by the domain:services seat 1 card thread for #25083 (seat post objectstack-ai/objectstack#6021, project run by the Sales account, session_017XVJLoyGccDY1WPoqow5Ff), as ruling 6341690661's execution line asks: "child cards per lane as above (spec, engine, objectui, cloud, skills)". ⛔ Not a claim.

Who acts: the domain:ui seat (seat post #5560) or a card thread it dispatches, once the objectstack pin covers the commit that serves features.cloudManaged.

Why

The maintainer ruled on objectstack-ai/cloud#3132 that hosted environments are managed (「云端环境就是受管模式，自托管模式不影响」). The objectstack ruling on #25083 (comment 6341690661, Q1 B / Q2 D / Q3 A / Q4 A) narrows what Setup → Users offers on such an environment: the organisation invites people in the cloud, and the environment keeps authorization and view. The server refuses the narrowed doors (409 RESOURCE_CONFLICT and the password-door arms in #25083's services half). This card makes the console say the same thing instead of offering buttons that answer 409.

What changes (objectui, read at `5fef032`)

The console reads one flag, features.cloudManaged (camelCase like ssoEnforced and audiencePosture; ruling Q3 A). Absent or false, nothing changes.

packages/auth/src/types.ts: AuthFeatures gains cloudManaged?: boolean.
Setup → Users (packages/app-shell/src/views/ObjectView.tsx, the Users list): one line says where to invite (the hosting organisation, in the cloud). Ruling Q1: "Setup → Users under the managed mode shows the organisation-invite line and marks a user who holds no permission set beyond the baseline (「未授权」); no default-set control lives on that page."
The identity import wizard (identityImportEnabled in ObjectView.tsx, identityImport.ts, IdentityImportPanels.tsx) is not offered when the flag is true; the server answers 409 on admin/import-users.
The organization members page (packages/app-shell/src/console/organizations/manage/MembersPage.tsx, InviteMemberDialog.tsx, orgCapabilities.ts) does not offer Invite member when the flag is true; the server answers 409 on invitation creation.
packages/app-shell/src/console/home/RecoveryPasswordReminder.tsx (with recoveryReminderGate.ts) does not show when the flag is true. Ruling Q4 A: "objectui hides RecoveryPasswordReminder when features.cloudManaged is true."
packages/i18n/src/locales/*.ts: the invite line and the marker's label.
The metadata actions (invite_user, create_user, set_user_password) are hidden by their own visible predicates in objectstack's platform-objects (the engine lane's item on #25083), not by console code.

Open item for the claiming seat: the 「未授权」 marker needs a readable answer to "does this user hold any permission set beyond the baseline" (explicit sys_user_permission_set rows and position grants). If no read the console can make answers it, report that on #25083 instead of inventing a client-side rule.

Acceptance

With features.cloudManaged: true: Setup → Users shows the invite line; the import wizard, Invite member and the recovery-password reminder are not offered; a user with no grant beyond the baseline carries the marker. Each case is pinned.
With the flag absent or false, every surface above is unchanged (pinned).

Duplicate check

repo:objectstack-ai/objectui "cloudManaged" → 0 hits (open and closed); repo:objectstack-ai/objectui "25083" → 0 hits. objectui#11659 (closed, the first-session backup-password banner) is a different rule.

Generated by Claude Code

Claim: cloud ops seat (the maintainer's local session, account hotlong) · maintainer direct dispatch · 2026-10-23
Maintainer, in the cloud ops seat's chat on 2026-10-23: 「相关任务你都负责帮我跟进和派发」

Unblocked. The one thing this card needs from objectstack-ai/objectstack#25083 is the served flag features.cloudManaged. It has been served since objectstack-ai/objectstack#25309 (merged 2026-10-23T02:57Z: cloudManaged: isCloudManaged() in plugin-auth getPublicConfig()). The server-side 409s are #25083's services half, which is still in flight (claimed today, comment 6359752007). The console does not depend on them. The body's Blocked-by line is marked as cleared.

Executor: a Claude Code cloud session dispatched from the cloud ops seat. The PR names its branch.

Claim: takeover · card thread · domain:ui seat 1 (seat post #5560, project run by the Sales account) · 2026-10-23T12:18Z
Release: claim 6359759135 (cloud ops seat, account hotlong; it names no session ID, only "a Claude Code cloud session dispatched from the cloud ops seat") · cause: reassigned at the Sales account's request · goes to: this claim. Who: Sales (os-sales, the owner of the project that runs domain:ui seat 1). Words: 「接手并派发 objectui-13330」, and the card is 「由Sales账户的项目负责」. Where: Sales's project thread for this card, 2026-10-23T12:07Z.
Hand-over: the withdrawn claim names no branch. At this claim's read, objectui has no remote branch naming 13330, cloud-managed, invite or recovery, and no open or closed PR cites this card, so there is nothing to carry forward. The withdrawn claim comment stays as it is. If the cloud ops seat's executor holds unpushed work, name its branch on this card and this thread continues from it instead of duplicating it.
Session: session_0122QNQ7jXCC1tUKFY6YnZVo (a card thread of the project that runs domain:ui seat 1, dispatched by its coordinator)
Account: os-sales (the seat's linked user; the card's assignee from this stroke)
Branch: claude/issue-13330-cloud-managed-users
Worktree: objectui-issue-13330
Domain: domain:ui
Seat: domain:ui#1
File surface: packages/auth/src/types.ts (the cloudManaged member) and the auth README's features section; packages/app-shell/src/console/home/RecoveryPasswordReminder.tsx; packages/app-shell/src/views/ObjectView.tsx (the identity import gate and the Setup → Users invite line) with one new module beside it for the line; packages/app-shell/src/console/organizations/manage/MembersPage.tsx (with orgCapabilities.ts if the gate lives there); packages/i18n/src/locales/*.ts (the new strings); the tests of each; content/docs/guide/ if a page lists the auth features; .changeset/ (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default judgment tier (dispatch-gates --tier --repo objectstack-ai/objectui names no path-derived mandate for this surface), effort: xhigh (p1)
Clause-②: yes
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: 6359759135
Serial constraints cleared: open PRs read at claim time: #13359 (the metadata-admin catalog switch, its own i18n module), #13354 (plugin-dashboard), #13358 and #13360 (CI); none touches these paths. Open claims in this lane whose files may meet this surface: objectstack-ai/objectstack#25942 (list bulk-action confirm, assignee baozhoutao, may touch ObjectView.tsx's bulk relay) and #13340 (Setup form toasts); this card's edits in ObjectView.tsx are the identity import gate and one notice slot above the list, so a merge is additive.

Plan, stated so the review can hold it to it:

Clause-②: yes because AuthPublicConfig.features gains a member and @object-ui/i18n gains published keys. The member mirrors a key the contract already declares (AuthFeaturesConfigSchema.cloudManaged, feat(spec, platform-objects): declare features.cloudManaged with a hide-when-on gate, and hide the six doors that add people while it is on objectstack#25309).
The console reads features.cloudManaged straight off /auth/config into its own AuthPublicConfig type. So this PR does not wait for the .objectstack-sha pin (06cab48, the 18.0.0 release) to cover feat(spec, platform-objects): declare features.cloudManaged with a hide-when-on gate, and hide the six doors that add people while it is on objectstack#25309. A console built from it reads the flag from any objectstack main that serves it.
One PR covers the flag and four surfaces: the Setup → Users invite line, the identity import wizard, Invite member, and the recovery-password reminder. Each is pinned with the flag true and with it absent or false.
The 「未授权」 marker: the readable answer exists. It is the sys_user_permission_set rows and the sys_user_position rows with the position registry, the same reads the permission set's Assigned Users section makes. Where the marker renders is a different matter. The generic list (ListView → ObjectGrid) has no per-row hook a host can draw into, so marking a row means a new public slot on two published packages. That is a choice of public shape, so it goes to a ruling with an analysis, and the marker lands in a second PR on that ruling. This PR says Part of this card, not Fixes.

Generated by Claude Code

Correction to claim 6364712208 (append-only; the claim stays as written) · card thread · domain:ui seat 1 · session_0122QNQ7jXCC1tUKFY6YnZVo

The marker lands in this PR, not a second one, and no ruling is sought for it. The claim said the per-row 「未授权」 marker needed a new public slot on ListView and ObjectGrid, so it would go to a ruling and land in a second PR. Reading the two packages again, the shape is already settled by precedent. Both packages take host-only React props for exactly this kind of thing, never schema keys: ObjectGrid's rowOperations (objectui#8674, called per row), objectFields and showRowNumbers, and ListView's toolbarLeading (objectui#12440, "A HOST prop on the React component, never a schema key"). The marker follows the same shape. It is one generic host prop named for what it draws, not for the product (ADR-0060 rule 2):

ObjectGrid gains rowAdornment?: (record) => ReactNode: a node drawn after the title cell's own content (the declared nameField's column when shown, else the first shown column; never the row actions), and beside the card title in the card view. If the prop is absent or the function returns null, nothing changes.
ListView gains rowAdornment too. It is destructured by name and handed only to the grid, the same way showRowNumbers is, so the board and the other visualizations never receive it.

No metadata author can reach it, so Metadata-protocol: none stands. Clause-②: yes stands: two more published packages gain a public prop.

File surface, revised. In addition to the claimed surface:

packages/plugin-grid/src/ObjectGrid.tsx, its README section and the mirrored content/docs/plugins/plugin-grid.mdx section;
packages/plugin-list/src/ListView.tsx and its README section;
the new module packages/app-shell/src/views/managedEnvironmentUsers.tsx (the invite line, the grant read and the marker), which is where the claim's "one new module beside it" went.

orgCapabilities.ts is not touched: the members page reads the flag itself.

Serial constraints for the added paths: no open PR touches packages/plugin-grid/src or packages/plugin-list/src at this read (open: #13363, #13362, #13360, #13358, and the release and dependency PRs).

PR relation. The PR now covers every acceptance line on this card, so it says Fixes this card, not Part of. If contract review would rather take the marker separately, it comes out cleanly (the two props, their wiring in ObjectView.tsx, the marker and their tests), and nothing else in the PR depends on it.

Generated by Claude Code

os-dev-report
{
"issue": 13330,
"status": "done",
"branch": "claude/issue-13330-cloud-managed-users",
"pr": "#13372",
"session": "session_0122QNQ7jXCC1tUKFY6YnZVo",
"premise_still_valid": true,
"summary": "With features.cloudManaged true, Setup → Users shows the invite line and marks a user who holds no permission set beyond the baseline (direct sys_user_permission_set rows plus sys_user_position rows read against the position registry, active window only; unknown stays unmarked), the identity import entry is not offered, MembersPage shows a note instead of Invite member, and the recovery-password reminder does not show. Absent or false, every surface is unchanged. The marker rides a new generic host prop, ObjectGrid.rowAdornment, forwarded by ListView to the grid only. This widened the claimed file surface to plugin-grid and plugin-list, recorded on the card as correction 6365253236 instead of the ruling plus second PR the claim planned; contract review should judge that call, and the marker splits out cleanly if it wants it separate.",
"tests": "New pins (36 cases, each with a control): ObjectView.managedEnvironmentUsers-13330 (real ObjectView → ListView → ObjectGrid chain), tests/managedEnvironmentUsers-13330, RecoveryPasswordReminder.cloudManaged-13330, members-invite-managed-13330, plugin-grid rowAdornment-13330, plugin-list ListView.rowAdornment-13330. Ablation on the committed tree, then restored from HEAD: dropping the import gate, the members note, the reminder skip, the invite line, the grid placement (table and card), the list forwarding, the name-field preference and the valid_until bound each turns its pin red with the controls green. Related run under os-verify-lock: plugin-grid, plugin-list, auth, i18n, app-shell views / console organizations / console home and the product-neutral ratchet = 1689 files, 16573 tests; the first pass had 3 failures in two live-count i18n pins (de-quote-pairing-3876 91 → 92, objectView-config-keys-retired-4730 104 → 105, total 229), advanced in commit 28e1975 and green after merging main (5 files, 98 tests).",
"gates": "check:i18n-keys exit 0, check:i18n-drift exit 0 (4 keys added, 0 en values changed), check:i18n-dead-keys report (new keys not listed), check:new-line-citations exit 0 (0 new), check:control-bytes exit 0, check:doc-fences exit 0, check-changeset-presence exit 0, turbo type-check app-shell/plugin-grid/plugin-list/auth/i18n: one error in this PR's own test double fixed, rerun 31/31 successful; check:doc-snippets after its scoped build: 811/811 blocks compile. CI on the PR has not reported yet.",
"dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
"mcp_calls": "16 — all read-only: issue_read 7, search_pull_requests 3, list_pull_requests 2, pull_request_read 2, list_issues 1, get_commit 1; plus subscribe_pr_activity on #13372 (session tool, not GitHub). No MCP write tool.",
"api_writes": "via scripts/pm/ fleet-write relay and label-write, as objectstack-fleet[bot]: claim comment 6364712208 on #13330; assignee swap hotlong → os-sales on #13330; correction comment 6365253236 on #13330; pr_create #13372 (draft, assignee os-sales); pr_request_reviewers #13372 (os-sales); this report comment. Plus one git push of the branch.",
"open_questions": [],
"out_of_scope_findings": []
}

Generated by Claude Code

fix(app-shell): the Users-list marker counts a position's same-name p…

LANDED

objectui#13330 由 PR objectui#13372 合入 main，合并提交 ff77cfc22e421cb9da3b41ec75ff502cf91d46e3（2026-10-23T14:43Z，经合并队列）。记录于 2026-10-23T14:43Z。

Seat: domain:ui#1

落地内容：按 objectstack#25083 裁决的 console 一半，环境为云托管（/auth/config 下发 features.cloudManaged: true）时，Setup → Users 说明到云端组织邀请人，并给只持有基线权限的用户标「未授权」；不提供身份导入；组织成员页用说明替代 Invite member；不显示恢复密码提醒。非托管环境一切不变。ObjectGrid / ListView 新增通用宿主 prop rowAdornment。合并时 Fixes 已关本卡。

撤下 pm:dispatched。席位核对见 PR comment 6367193656。

Navigation Menu

Repository navigation

app-shell, auth: on a cloud-managed environment (features.cloudManaged), Setup → Users says where to invite and marks an unauthorized user, and the console hides invite, import and the recovery-password reminder (objectstack#25083 ruling) #13330

Why

What changes (objectui, read at `5fef032`)

Acceptance

Duplicate check

LANDED

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

app-shell, auth: on a cloud-managed environment (features.cloudManaged), Setup → Users says where to invite and marks an unauthorized user, and the console hides invite, import and the recovery-password reminder (objectstack#25083 ruling) #13330

Description

Why

What changes (objectui, read at 5fef032)

Acceptance

Duplicate check

Activity

hotlong commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

LANDED

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

What changes (objectui, read at `5fef032`)