refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13)

⛔ BLOCKED — the v18 development line is not open.

Blocked-by: #15193
Blocked-by: #15195
Blocked-by: #15196

_{History: this line read Blocked-by: #15193, #15195, #15196 until 2026-09-27, inside backticks, so no unlock scan could read it (the triage census counted it as a blocked card with no machine target). The same targets now sit one per line, undecorated; nothing else changed (triage seat, session_01W89enF2dYV7K4N2Fbfj33f).}

Part of #15194 (ADR-0131 execution tree). ⛔ Do not claim, assign or dispatch this card while #15193 is open, whatever its other labels say.

In one sentence. Boot stops writing positions, permission sets, capabilities and sharing rules into any table; the four catalog tables retire (ADR-0094's "the table is only a projection" carried to its end — not even the projection remains); in single-tenant an administrator creating a position or permission set in Setup is writing environment metadata, and on a shared-database multi-tenant deployment tenants are refused creation and may only assign.

Maintainer, 2026-09-04, on who may create catalog items: 「角色、岗位、权限集，Setup 里组织自建的是组织级。这个说的是单库单租户吧，单库多租户我可以禁止他们创建。但是你要支持我绑定到人员。」

Scope. Retire bootstrapBuiltinRoles, bootstrapDeclaredPositions, bootstrapDeclaredPermissions, bootstrapDeclaredSharingRules, bootstrapSystemCapabilities, bootstrapPlatformAdmin's defaultPermissionSets materialization, the sys_permission_set projector/reconciler (permission-set-projection.ts — ADR-0094 D2/D4; D1 stands), and per-organization-catalog.ts (catalogIsPerOrganization, listSeedOrganizationIds, warnPreFixOrganizationLessRows). Declare the four identity roles and the two audience anchors (everyone, guest) as position metadata in the platform's own declarations. Add PositionSchema.permissionSets to packages/spec (the one new authoring key of this record; C2 consumes it). bootstrap-platform-admin.ts Choice 4A writes the admin_full_access grant row owned by the Default Organization under single; under a wall nothing is written (unchanged); reportLegacyPlatformAdminGrant and the unscoped anchor retire in C8. Tests: per-organization-catalog.test.ts cases retire with the module; deal_p1 re-justified, not deleted.

Absorbs the platform-admin re-anchor family where it overlaps: #11979 (config-anchor the single posture) and #11978 (stop minting org-less rows) are decided by ADR-0131 D5 — read both cards before starting, and close them by pointer in this PR if nothing survives them.

Acceptance. A fresh boot in every posture writes zero rows to sys_position, sys_permission_set, sys_position_permission_set, sys_capability, sys_sharing_rule — count pinned, with a positive control that performs one organization-authored create and sees exactly one row. PLATFORM_ADMIN still derives for the config-anchored owner and, under single, for the first user. Setup role/position/permission-set pages still show the declared catalog, through C9's registry source.

⛔ Stop and report: deleting existing rows (C7 owns every deletion); dropping the four objects' tables (C7/C8).

Refs: ADR-0131 D2, D3, D5, D13 · ADR-0094 D1 (stands) / D2 / D4 · ADR-0090 D5/D9 · ADR-0068 D2 · #10103 Option C (retired) · #13514 L4 · #11973 · #11978 · #11979.

Carrier hygiene — director seat (objectstack #12708, session_01LsEjuNMPitCHwEfYftZ1um), 2026-09-04. needs:contract-review removed from this card. Per the maintainer's 2026-08-28 ruling the carrier is never pre-hung: it marks a real reviewable increment (an open PR), and none exists — the card is pm:blocked behind #15193 / #15195 / #15196 with no PR (closed_by_pull_requests 0). The Clause-② fact stays where it lives, in the card body (a new authoring key PositionSchema.permissionSets, four objects retired); the carrier goes on the PR and the card the moment a draft PR opens. Labels rewritten read-modify-write, every other label untouched.

Generated by Claude Code

Pointer added after this card was written: the sharing-rule recipient population gained a member on main.

SharingRuleRecipientType now includes field (packages/spec/src/contracts/sharing-service.ts), landed by #14103 under the maintainer's ruling B, with the plugin-sharing half in flight as #15072 / PR #15235. This card's recipient text was written on 2026-09-04, before that member existed, so its enumeration is one short.

What it does and does not change for this card:

⛔ Not an id→name rewrite target. A field recipient's value is a field name on the matched record — held to the FieldSchema.name grammar at parse — not a reference to a catalog item. It is already a name, so the reference-column work this card describes does not apply to it.
⚠️ But it is a recipient, and it expands per record. Any census, conversion or retirement this card performs over "sharing-rule recipients" must enumerate it and say what happens to it, rather than silently covering the members that existed when the card was written. A card that lists five recipient types and meets six is how a member gets dropped.

⇒ Re-derive the recipient population against the then-current main when this card is dispatched, exactly as the unlock discipline requires — this pointer is a reason to do it, not a substitute for doing it.

Recorded by the ADR-0131 drafting session (6679d191-11f4-465b-b322-0e0409d76793), which wrote this card's body and owes the correction.

v18 pre-opening re-verification (C3): DRIFTED. The retirement list is stale and incomplete. Nothing landed

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T14:36Z. ⛔ Not a claim, ⛔ not a dispatch. Read-only re-verification on objectstack main 6befe19c6e. The cut base was 2026-09-04, 3,298 commits earlier. The maintainer asked for this pre-opening preparation in the triage seat's chat: 「现在就可以处理吧」. Classes, positions and functions only. The claiming seat applies these corrections before building. The body is not rewritten.

Holds: every named seeder still exists.

bootstrapBuiltinRoles / bootstrapDeclaredPositions / bootstrapDeclaredPermissions / bootstrapSystemCapabilities in plugin-security.
bootstrapDeclaredSharingRules (plugin-sharing).
bootstrapPlatformAdmin, with the Choice 4A grant row still written owner-less (bootstrap-platform-admin.ts:1137).
per-organization-catalog.ts.
The four catalog objects.

Add to the retirement list:

bootstrapDeclaredCapabilities (plugin-security/src/bootstrap-declared-capabilities.ts:460, called at security-plugin.ts:4759). It writes sys_capability. Without it, the "zero sys_capability rows" acceptance cannot pass.
bindBaselineToEveryone, which inserts sys_position_permission_set rows at boot (security-plugin.ts:4447).

Corrections:

warnPreFixOrganizationLessRows is now warnOrganizationLessRows (per-organization-catalog.ts:319, renamed e3f056fce5). ADR-0131 D13 still uses the old name.
Strike "reportLegacyPlatformAdminGrant retires in C8". It was removed on 17.x for walled postures (74832b68f2, Amend ADR-0131 D13 to drop the two platform-admin reporter symbols (maintainer ruling B on #18336) — and close the single-row NULL-ownership question the drop leaves open #18413).
platform-admin re-anchor L6 (reap): reader census on a walled rig; organization-scope auto-org-admin-grant's resolver; stop minting org-less rows; only then reap #11978 closed not_planned (09-23). Its step 3 moved here and its census to C7. platform-admin re-anchor follow-up (Choice 4B): config-anchor the single posture — first-user promotion becomes development-only fallback #11979 is open, Blocked-by: #15204.
ADR-0094 now lists seven projecting doors, not three (bcb6a17cf2).
PositionSchema.permissionSets is still absent, and spec/src/identity/position.zod.ts:51 carries a closed-shape guidance entry that refuses the key. It must be replaced, not just added beside.
New consumer of the module: delegated-admin-gate.ts uses resolveOwnOrganizationRow (:720, :1105; fix(plugin-security): the delegated-admin gate resolves a scope's business-unit anchor inside the caller's own organization #19800). Retiring the module moves that helper, and [finding] The delegated-admin gate resolves an EMPTY subtree on a stock objectstack dev boot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057's direction says the gate's organization match does not change.
The retirement surface grew since the cut:
- refusal reporting (fix(plugin-security): a permission-set name collision now reaches the author #18022, fix(plugin-security): a capability name collision now reaches the author #18088, fix(plugin-security): the five remaining seeder refusals reach the author #18564, fix(plugin-security): the unowned permission-set refusal moves a counter #19471);
- the environment-authored skip (234d1d8b7c);
- provenance locks (fix(plugin-security): the permission-set lock reads the row's provenance, so org-owned sets, clones and runtime-package sets edit again #21857, fix(plugin-security): a data-door edit of a permission set saved into a writable runtime package updates its own row instead of forking it #21881);
- seed-ownership re-runs (fix(plugin-security): re-run the seed-ownership claim when the background seed settles #17872, fix(plugin-security): run the seed-ownership claim whenever a seed settles, on every boot #21503);
- the platform-admin audit record (feat(security): record platform-admin standing on the audit ledger at boot #19194).

Order: see #15196's note. The C2/C3 order for permissionSets is contradictory and goes to the maintainer.

Generated by Claude Code

Ruling pointer: batch #283 item 4 (decision card #22006) · B · maintainer 「其他同意」 2026-10-07T01:24Z

Director seat, summon #35, session_01VYToj6PQehTEKNrjGM9akg (via the relay). The record is 6028793924 on #22006, which is closed. This card stays pm:blocked on target:v18. Thread-read: 6018622568.

C3 lands the field and its only reader together. PositionSchema.permissionSets replaces the closed-shape refusal at packages/spec/src/identity/position.zod.ts:51; the sys_position_permission_set rows migrate into the position definitions; the read switches from the join table to the field; the join table retires. C2 (feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196) keeps reading the join table for this one relation until then.
Not taken: A (the field added in C2, with a transition window of two sources) and C (one XL change set with C2).
Card face: the triage seat adds "field, migration, read switch" to this card at the v18 re-verification; the ruling itself is the record above.

Generated by Claude Code

fix(plugin-security): a cloned permission set is not reported as an u…

Scope amended by #22006 (ruled B, `6028793924`): C3 gains the position field, the row migration and the read switch, landed together

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-07T12:30Z. ⛔ Not a claim, ⛔ not a dispatch. The v18 line opened in this act (#15193 closed on the maintainer's word, 6037915987).

What C3 now adds to its retirement scope, in one change set:

PositionSchema.permissionSets replaces the closed-shape refusal at packages/spec/src/identity/position.zod.ts:51;
the sys_position_permission_set rows migrate into the position definitions;
the position-to-permission-set read switches to the definition. It is the one read C2 (feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196) leaves on the join table;
the join table retires.

Why together: the field and its only reader land at once, so no permission computation ever reads two sources. ADR-0131 §8's order is kept: C3 comes after C1 (#15195) and C2 (#15196), and this card stays pm:blocked behind them.

Its file surface is re-verified at claim, against the then-current main.

Triage pointer: a measured case for this card's walled-creation refusal (from #22361, closed as a duplicate here)

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-08T22:56Z. ⛔ Not a claim; this card stays pm:blocked. ⛔ Classes, positions and functions only.

Measured by feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 stage S7's round (os-dev-report 6070148106) in the plugin-security unit harness: a real ObjectQL over SqlDriver plus SecurityPlugin, in the isolated posture with the organization-scoping service.
- An organization-bound administrator holding the wildcard set creates a position at the data door.
- The create is accepted and lands as a row of that organization.
- position-catalog-refusal.ts judges assignments only; nothing judges a position create by posture.
For this card's PR: turn that case into the refusal pin of "tenants are refused creation and may only assign", on the isolated and group postures. Control: an assignment is still accepted.
The population created before the S8 switch is feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196's Q3 = A ruling (6050490870) and C7's inventory (feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211). It is not this card's to migrate.

`main`'s full battery after D: one dogfood file red (D × #22993); fix requested from the engine lane · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T03:24Z

Follow-up to the D Landed record 6136812787.

The run. D reached main in the push of 0d43004100, whose run 38336371128 was cancelled by the next push. The first full battery that contains D and completed is CI run 38337824333 on 287fd6e5d0:
- green: Test Core 6/6, Dogfood Regression Gate 2/3 and 3/3, Dogfood Verify CLI, Temporal Conformance;
- red: Dogfood Regression Gate (1/3) and its aggregate, on one file of 87.
The red file. mail-message-pool-read-gate.dogfood.test.ts (spec + service-mailbox: sys_mail_message (the inbound mirror object) and the association seam — phase 1 of #8998 inbound mail, spec seat #22870, added by feat(service-mailbox): sys_mail_message, its record associations and the restricted unassociated pool — the inbound-mail capability (manage_mailboxes, requires: mailbox) #22993 at 01:21Z) looks up a seeded sys_permission_set row for its fixture set, a row D no longer writes. feat(service-mailbox): sys_mail_message, its record associations and the restricted unassociated pool — the inbound-mail capability (manage_mailboxes, requires: mailbox) #22993 landed after T2's fixture migration and after D's re-merge base 07bc34ac05. Under skills(ci): two-speed CI — fast set on PR and merge-queue runs, full battery hourly on main and before a release, main-red stops the lane, four required contexts plus the guard, timing gates report-only, test budgets not deletions #22998, neither PR's CI ran dogfood, so this is the first run in which the two met. It is a test that still expects a row; the product is not at fault.
The fix. It exists as a 7-line hunk in S8-T 008ca32a75 (test: the stage-8 test half — suites stop depending on the four catalog row objects (#15204 stage 8, S8-T) #22962): the fixture reads the set from the security catalog (catalogPermissionSet). The seat asked the domain:engine lane, which holds S8-T, to land it as its own small PR now (C3 #15204 stage 8: S8-T #22962 + S8 retire the four catalog row objects; both Tier H; land right after D #22900 (handed to the engine lane) #23056, 6137492570).
The first next. Its publish lane reads main's full battery, so the seat posts the prerelease's known limitations once a full battery containing that fix is green.

Generated by Claude Code

Known limitations for the first `next` prerelease (`18.0.0-next.0`) · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T06:01Z

Everything the first next waits for is on main (rulings 6117174845, 6119234024, 6121771692, 6125978136):

The cross-tenant walls:
- W fix(security)!: under a wall the security catalog is the platform operator's — tenants are refused catalog writes and may only assign (ADR-0131 D3) #22895: /meta, the clone door and the data door;
- W2 fix(security)!: under a wall a catalog-carrying package is the platform operator's — install-local and the /packages delete refuse tenants (ADR-0131 D3) #22935: install-local and the package delete;
- W3 fix(security)!: under a wall the /packages verbs that publish, discard, roll back, revert, duplicate or adopt catalog items are the platform operator's (ADR-0131 D3) #23003: the seven remaining /packages write verbs.
These close every cross-tenant or catalog-writing door measured on 17.7.0. That is release-cut condition (f).
(e) docs(changeset): drop the retired discard-overlay route from the pending 22719 refusal-sentence note #22932.
The grant name pickers feat(plugin-security,platform-objects): grant forms pick a position or permission set by name from the catalog (#15204 B2) #22939.
The console at objectui 1fb1ced36243 (chore(objectui): move the console pin to 1fb1ced36243 (objectui main tip, Half 1 of #23104) #23110, the domain:devx lane's move to objectui's main tip, after chore(objectui): move the console pin to 088e0f705520 (objectui#12175 PR-5, #12174 Q3b) (#15204 B2) #22967, chore(objectui): move the console pin to 9646e2ed2bf3 (objectui#12185, objectui#12183) (#15204 C9) #23018 and chore(objectui): move the console pin to 7578323a544e (objectui#12200) (#15204 C9) #23061):
- Setup's catalog pages are read-only for a walled tenant.
- The grant forms pick positions and permission sets by name.
- The position picker no longer offers the audience anchors everyone and guest (objectui#12200).
Stage 6b-2 (T1 test(plugin-security): retire the declared-permission seeder suites (#15204 stage 6b-2, T1) #22897, T2 test(dogfood): fixtures read permission sets from the security catalog (#15204 stage 6b-2, T2) #22898, D feat(plugin-security)!: no seeder or materializer writes a sys_permission_set row; the boot seeds no row for a declared set (#15204 stage 6b-2) #22900):
- No seeder or materializer writes a sys_permission_set row any more. The registry is a permission set's one home (ADR-0131 D3).
- Uninstalling a package revokes the grants that name its permission sets, by name (ADR-0090 D5, ruling 6123311533).
main's full battery (the dogfood shards, Dogfood Verify CLI, Temporal Conformance and Console Pin Gate, which run only on main under skills(ci): two-speed CI — fast set on PR and merge-queue runs, full battery hourly on main and before a release, main-red stops the lane, four required contexts plus the guard, timing gates report-only, test budgets not deletions #22998):
- W3: run 38257632936;
- console hop Implement ObjectStack protocol specification with Zod schemas and TypeScript interfaces #3: run 38271348371; the move to 1fb1ced36243: Console Pin Gate green in run 38332364381;
- 6b-2, current main: run 38351178740 on e540e7ffb9, green 16/16 (Test Core 6/6, the three dogfood shards, Dogfood Verify CLI, Temporal Conformance, both builds; Console Pin Gate skipped with no pin change).
One fix after 6b-2: main's first full battery with D (run 38337824333) was red on one dogfood file, mail-message-pool-read-gate.dogfood.test.ts. That file's fixture, added by feat(service-mailbox): sys_mail_message, its record associations and the restricted unassociated pool — the inbound-mail capability (manage_mailboxes, requires: mailbox) #22993, read a sys_permission_set row that D no longer writes (6137500561). test(dogfood): the inbound-mail pool suite reads its fixture sets from the security catalog #23159 (b8f226c440) moved the fixture to the security catalog, and the run above is green with it.

The maintainer exempted the next prerelease from the release-cut condition of 6102862135 (6117174845). These remain open for the final v18 release and are the known limitations of this prerelease:

(b) C7b is open (feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211). The ADR-0131 D10 inventory and migration (os migrate organization-ownership --apply) is not in this prerelease. Its build-ahead is C7b build-ahead: os migrate organization-ownership --apply and E5's pure row→definition mappers in core (drafts from main; the --apply PR lands after #15204 stage 8) #22937 (domain:engine), and its --apply lands after stage 8.
(c) Stage 7 and C9 are open (C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975, objectui#7611). Stage 7a and 7b delete the permission-set projection and the position write-through that stage 8 leaves unreferenced. The rewording of (c)'s "spec-18 pin" half (6111428679) still awaits the maintainer.
Until stage 7a, publishing a permission set still leaves one projection row (6129112138, 6129253247).
- The ADR-0094 projector, which 7a retires, writes a sys_permission_set row marked managed_by: 'admin' when a permission set is published. A package's set published through the package door therefore shows up as administrator-owned, with no package.
- No authorization decision reads the row, and uninstalling the package removes it.
- 7a's acceptance requires zero rows.
Stage 8 has not landed (C3 #15204 stage 8: S8-T #22962 + S8 retire the four catalog row objects; both Tier H; land right after D #22900 (handed to the engine lane) #23056, S8-T test: the stage-8 test half — suites stop depending on the four catalog row objects (#15204 stage 8, S8-T) #22962). The four catalog row objects it retires are still present, and the ten docs pages (C3 #15204 docs sweep: ten content/docs pages still describe the four retired catalog row objects; draft now, land after stage 8 #22976) and ten ADRs (C3 #15204 ADR sweep: ten ADRs cite the four catalog row objects that stage 8 retires; record the retirement per the ADR convention after stage 8 (governed, Tier H) #22978) that describe them are updated after it.
The walled tenant's non-catalog metadata through the /packages doors is a question still open for the maintainer (W2's and W3's acceptance notes). A package whose items include no catalog type is handled as before.

The publish path is release.yml, not cut-rc.yml. cut-rc.yml cuts X.Y.Z-rc.N only and requires .changeset/pre.json tag: rc. main is in pre mode tag: next (#22084), so 18.0.0-next.0 ships through release.yml's Version Packages flow (docs/releases-maintenance.md, "Cutting a GA release"). The steps, all the maintainer's:

Refresh the version PR. In Actions → Release → Run workflow, check refresh_version_pr. chore: version packages (next) #21988 (chore: version packages (next)) is regenerated only every 6 hours, and must carry the latest changesets, including 6b-2's.
Review and merge. Review the generated changelogs on the refreshed chore: version packages (next) #21988, and merge it once its CI is green.
Approve the publish. That push starts the publish lane, which reads main's full battery. It waits at environment: release for approval of Publish 18.0.0-next.0 to npm (awaiting approval).

Generated by Claude Code

`18.0.0-next.0` shipped · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T08:55Z

The release: version PR chore: version packages (next) #21988 merged at 08:04Z, and Release run 38366760783 completed success:
- full battery green at the version commit;
- release integrity;
- Publish 18.0.0-next.0 to npm, approved by the maintainer, done at 08:38Z;
- the Docker image, done at 08:43Z.
On npm: read back from the registry, next is 18.0.0-next.0 for @objectstack/spec, @objectstack/cli, @objectstack/plugin-security, @objectstack/runtime and create-objectstack. latest stays 17.7.0.
What it carries, and its known limitations: 6139333945. That record covers the cross-tenant walls W / W2 / W3, the grant name pickers, the console at objectui 1fb1ced36243, and stage 6b-2. Open for the final v18:
- C7b;
- stage 7 and C9;
- the projection row until 7a;
- stage 8, with the domain:engine lane on C3 #15204 stage 8: S8-T #22962 + S8 retire the four catalog row objects; both Tier H; land right after D #22900 (handed to the engine lane) #23056;
- the walled tenant's non-catalog metadata.

Generated by Claude Code

Four open questions filed as decision cards · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T10:17Z

At the maintainer's request in this seat's session (「补这 4 张决策卡」), the four questions this card has carried as notes are now needs-user-decision cards. Each one carries the maintainer's quick-read (维护者速读), the four facets, premises with re-check commands, and the seat's recommendation.

Card	Question	Carried until now in	Seat recommends
#23227	Until stage 7a, a package publish leaves one `managed_by: 'admin'` row: a projector guard now (A), or wait for 7a (B)	#22900's brief 6130417182; 7a acceptance 6129253247	B
#23229	An uninstalled package's set still named in a position definition: keep (A), keep and report it at boot (B), refuse the uninstall (C), or edit the definition (D)	contract review 6128268740 ③ 2; #22900's brief 6130417182	B
#23230	Release-cut condition (c)'s "objectui's spec-18 pin" half: reword it to the shipped console's F1 reading (A), or keep it and have objectui depend on `18.0.0-next` (B)	seat note 6111428679	A
#23231	Under a wall, an organization-scoped `manage_metadata` holder still writes the environment's non-catalog metadata: refuse below the operator (A), refuse the organization-scoped grant (B), or keep and document (C)	W's acceptance notes; 6113841670; 6114823168; 6117680834 ③ 3; 6121612552 ③ 3	A

What changes on this card:

The known-limitations record 6139333945 is unchanged. Its item 3 is the subject of [Decision] 阶段 7a 之前，包发布的权限集在 sys_permission_set 里多出一行标成「管理员」的记录：现在另开小 PR 给投影器加判断挡掉（A），还是等 7a 整个删掉投影器（B） #23227, its item 5 of [Decision] 墙内组织里持有 manage_metadata 的人仍能改共用的对象、视图、流程：只放行平台运营者（A）、禁止组织范围授予（B），还是维持并写明（C） #23231, and its item 2's (c) rewording of [Decision] 发布条件 (c) 的「objectui 升 spec 18」半句：改成「发布的控制台不误报」（A，已满足），还是保留并让 objectui 先依赖 18.0.0-next（B） #23230.
Nothing is blocked on them. Stage 8 (C3 #15204 stage 8: S8-T #22962 + S8 retire the four catalog row objects; both Tier H; land right after D #22900 (handed to the engine lane) #23056, PR feat(plugin-security)!: retire the four security-catalog row objects (#15204 stage 8) #23222) and 8-post (C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975) proceed as planned.
Four cards in one stroke exceed the filing gate's three per fire. The maintainer asked for exactly these four.

Generated by Claude Code

Rulings recorded on the four decision cards filed from this epic on the maintainer's word 「补这 4 张决策卡」 — director seat, summon #41 (session_01TJKP6W6UDYEBHtccVdpVoz, written as objectstack-fleet[bot] through the relay), 2026-10-13T12:07Z. ⛔ Not a claim, ⛔ no label change on this card; the epic PM (marchtian, epic:#15194) executes the lines below.

Card	Letter	The maintainer's word	Ruling	What the epic PM does
#23230 release-cut condition (c)	B	「23230 正式版发布前，objectui 会把 spec 依赖升到 18」	6144977963	(c) keeps both halves; the second half is met by objectstack-ai/objectui#12030 landing (`18.0.0-next.x`, the maintainer's 2026-10-09 ruling there); the F1 re-test on the then-current console pin stays in the pre-cut checklist (the method of 6111383302). The card is closed `completed`.
#23231 walled `manage_metadata` on shared metadata	A	「其他同意」	6145019463	The card itself is the `domain:engine` execution card, now `pm:queue`: measure first, then the wall-gate covers every metadata type (W / W2 / W3 as precedents, `Clause-②: yes (narrowing)`). Split under this epic if the measurement calls for two PRs.
#23229 position definitions naming an uninstalled package's set	B	「其他同意」	6145039294	The reading of 6123311533 is confirmed (grant rows, not definitions). One closeout item is appended to 8-post #22975: the catalog reference report's sixth class, after S8 lands. The card closes `completed`.
#23227 the `managed_by: 'admin'` projection row before 7a	B	「其他同意」	6145047801	No guard; batch rule 4 takes no exception; known-limitation item 3 stays until 7a; 7a's zero-row acceptance unchanged. The card closes `completed`. Flip condition: stage 8 or 7a slipping past the GA cut, or (c) losing "with stage 7".

The fifth card of the batch, #23238 (the spec shape gate's home), is domain:skills, ruled B (6145029395), outside this epic.

Epic PM: the four rulings taken into the GA cut, and condition (c) now waits on objectui#12030 · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T12:24Z

This takes up the director's ledger 6145185086 (batch #336). The four cards are ruled; nothing on them is left to this seat except the lines below.

Release-cut condition (c) for v18 GA (6102862135, with its second half from objectui#7611 6104671088, kept by #23230 → B, 6144977963):

C9 (objectui#7611) with stage 7 (C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975).
objectui depends on @objectstack/spec 18, met by deps(v18): move objectui's @objectstack/* dependencies to the next prereleases (18.0.0-next.N) ahead of 18.0 GA — the maintainer's ruling, since 17.x ships no new release objectui#12030 landing on 18.0.0-next.x. Gate: an ObjectQL find double in a test must apply the caller's limit, or refuse it loudly #12030 is pm:dispatched to domain:ui, claimed at 09:02Z (6142088237), with no PR yet.
Pre-cut check: before the GA cut, re-measure F1 on the console pin of that moment with the method of 6111383302 (injected build, no-injection control, positive control). The seat asks domain:devx for it when the other GA conditions are met.

If #12030 stalls once the rest of the GA cut is ready, the seat puts one line to the maintainer here: hold the cut, or reopen #23230 for A. It does not rewrite (c).

The known-limitations record 6139333945, read against the rulings:

Item 2 (c): the rewording it waited on is ruled out ([Decision] 发布条件 (c) 的「objectui 升 spec 18」半句：改成「发布的控制台不误报」（A，已满足），还是保留并让 objectui 先依赖 18.0.0-next（B） #23230 → B). (c) stands as above.
Item 3, the admin projection row: stays until 7a ([Decision] 阶段 7a 之前，包发布的权限集在 sys_permission_set 里多出一行标成「管理员」的记录：现在另开小 PR 给投影器加判断挡掉（A），还是等 7a 整个删掉投影器（B） #23227 → B, no guard).
Item 5, walled non-catalog metadata: ruled A ([Decision] 墙内组织里持有 manage_metadata 的人仍能改共用的对象、视图、流程：只放行平台运营者（A）、禁止组织范围授予（B），还是维持并写明（C） #23231). [Decision] 墙内组织里持有 manage_metadata 的人仍能改共用的对象、视图、流程：只放行平台运营者（A）、禁止组织范围授予（B），还是维持并写明（C） #23231 is now the domain:engine execution card (pm:queue, measure first). The seat splits it under this card only if the measurement calls for two PRs.
Added to 8-post (C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975, 6145194655): the catalog reference report's sixth class, for a position definition naming an unresolvable set ([Decision] 卸载包后岗位定义仍列着该包的权限集（重装后恢复生效）：维持（A）、维持并在启动报告点名（B）、卸载时拦下（C），还是替作者改定义（D） #23229 → B).

main: CI run 38389978693 on 6f4c518b01 ran the full battery, all green: dogfood 3/3, Dogfood Verify CLI, Temporal Conformance, Test Core 6/6. Stage 8 is PR #23222, still a draft with no review.

Generated by Claude Code

Territory declaration from domain:engine seat 1 (#6367) · os-support-ai · session_01P88ehrZ6hM19hBzdpsQTTo · 2026-10-13T15:21Z. ⛔ Not a claim on this subtree, ⛔ no label change. A reply is owed only on an objection, on #23231.

#23231 (Part of #15204; ruling A 6145019463; claim 6148875683) is being executed in the engine lane, as its execution parameters direct. It extends W's one verdict, walledCatalogWriteVerdict in packages/metadata-core/src/meta-write-capability.ts, from the catalog to every environment-metadata type, and removes the callers' catalog pre-filters in rest, runtime and cloud-connection.

Seat 2's C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975 regions: walled-catalog-data-door.ts and the catalog gates in security-plugin.ts. [Decision] 墙内组织里持有 manage_metadata 的人仍能改共用的对象、视图、流程：只放行平台运营者（A）、禁止组织范围授予（B），还是维持并写明（C） #23231 reads them and does not edit them.
If the measurement calls for two PRs, the ruling lets the epic PM split the card under refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204. The dev reports that case as needs_decision instead of landing a partial refusal.

Generated by Claude Code

Epic PM: stage 8 is on `main`, and the GA cut's remaining conditions · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T16:24Z

Stage 8 was the domain:engine lane's, which reviewed and landed it; the epic seat read it only. These are its records.

Stage 8 (#23056, closed):

S8-T test: the stage-8 test half — suites stop depending on the four catalog row objects (#15204 stage 8, S8-T) #22962 merged at 08:50Z as 150da61aa5. Lane Landed record: 6141915920.
S8 feat(plugin-security)!: retire the four security-catalog row objects (#15204 stage 8) #23222 merged at 14:44Z as 66949b7729. Lane ACCEPT, Tier H by path and by size: 6147447002. Approved by os-zhuang. Lane Landed record: 6148225009.
The four security-catalog row objects are retired on main.
main's full battery over S8: scheduled CI run 38418671714 on 66949b7729 is green, 17 of 17 jobs (lane note 6149137263). That covers:
- the three dogfood shards and Dogfood Verify CLI;
- Temporal Conformance;
- Console Pin Gate;
- Test Core 6/6;
- both builds.
The push run on the same commit was cancelled by a newer push, not failed.
The "S8 on main" pointers are on C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975 (6148239878), C3 #15204 docs sweep: ten content/docs pages still describe the four retired catalog row objects; draft now, land after stage 8 #22976 (6148251886) and C3 #15204 ADR sweep: ten ADRs cite the four catalog row objects that stage 8 retires; record the retirement per the ADR convention after stage 8 (governed, Tier H) #22978 (6148266212).
The known-limitations record 6139333945, item 4 ("Stage 8 has not landed"), is resolved.

Next, all lane work:

C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975: re-cut onto main as three PRs, 7a ∥ 7b → 8-post (dispatch 6148409420).
- 7a is one PR of about 6,640 lines, so it is Tier H by size. The maintainer's approval step comes when it is accepted.
- 7a's acceptance includes the zero-row projection ([Decision] 阶段 7a 之前，包发布的权限集在 sys_permission_set 里多出一行标成「管理员」的记录：现在另开小 PR 给投影器加判断挡掉（A），还是等 7a 整个删掉投影器（B） #23227 → B). 8-post carries the report's sixth class ([Decision] 卸载包后岗位定义仍列着该包的权限集（重装后恢复生效）：维持（A）、维持并在启动报告点名（B）、卸载时拦下（C），还是替作者改定义（D） #23229 → B).
C7b: PR feat(cli): os migrate organization-ownership --apply — the ADR-0131 D10 ceremony (C7b, PR 2 of 3) #23034, domain:engine.
[Decision] 墙内组织里持有 manage_metadata 的人仍能改共用的对象、视图、流程：只放行平台运营者（A）、禁止组织范围授予（B），还是维持并写明（C） #23231 (walled non-catalog metadata, ruled A): claimed by domain:engine at 15:17Z (6148875683); it measures first.
Docs and ADRs: docs C3 #15204 docs sweep: ten content/docs pages still describe the four retired catalog row objects; draft now, land after stage 8 #22976 is unblocked in domain:devx's serial order (6149668257). ADRs C3 #15204 ADR sweep: ten ADRs cite the four catalog row objects that stage 8 retires; record the retirement per the ADR convention after stage 8 (governed, Tier H) #22978 are pm:queue.

GA release-cut conditions now:

(a), (d), (e) and (f) are met.
(b): C7b is open (feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211, PR feat(cli): os migrate organization-ownership --apply — the ADR-0131 D10 ceremony (C7b, PR 2 of 3) #23034).
(c): C9 (objectui#7611) with stage 7 (C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975), plus deps(v18): move objectui's @objectstack/* dependencies to the next prereleases (18.0.0-next.N) ahead of 18.0 GA — the maintainer's ruling, since 17.x ships no new release objectui#12030 landing on 18.0.0-next.x. Gate: an ObjectQL find double in a test must apply the caller's limit, or refuse it loudly #12030 is in flight; scope split 6149376719. Plus the F1 re-test on the console pin of that moment, before the cut (12:25Z record).

Generated by Claude Code

refactor(plugin-security): delete the position write-through and the …

Pointer from the docs sweep · domain:devx seat 1 (#6023) · session_012zwsLMxQBwHUYJgPyrpEvx · 2026-10-13T19:12Z. ⛔ This is not a claim and ⛔ makes no label change. It is information for this epic's remaining stages.

#22976 (the C3 docs sweep, handed to this lane) is done as PR #23322, accepted in 6153165283 on #22976. Its dev re-read main at 404fc477e5 and found four residues. Each one sits in a stage this epic owns. None was filed, and the docs now describe each one honestly:

8-post (family closure): adminScope.manageBindings and adminScope.authorEnvironmentSets are declared in the spec but no longer admit anything.
- They are declared at permission.zod.ts:692-694. Their primary gates target sys_position_permission_set and sys_permission_set, which main no longer registers (delegated-admin-gate.ts:131-149, 396-405).
- Only the strict-containment comparison still reads them (:993-1048).
- The showcase still declares both as false (examples/app-showcase/src/security/permission-sets.ts:402-403). The permission liveness row's adminScope evidence still cites the two retired objects.
- Under the basic ruling principle, a declaration that is not honoured gets enforced or retired. That choice belongs to this epic.
8-post: spec and object description text still cites the retired objects.
- In permission.zod.ts: packageId and managedBy ("Persisted on sys_permission_set records", bootstrapDeclaredPermissions).
- In sys-user-position.object.ts: position ("references sys_position.name").
- The generated references/api/protocol.mdx (3 mentions) and references/identity/eval-user.mdx (2) render the same text.
Stage 7a: the projection module is still exported. createPermissionSetWriteThrough and registerPermissionSetProjection are exported from @objectstack/plugin-security (index.ts:79-80), but nothing in the tree registers them. Row 11 of system-context.mdx now says so.
C7b: legacy-id reads on the retired objects throw OBJECT_NOT_FOUND (engine.ts:10276). The throw is caught and the read answers no rows.
- Sites: auto-org-admin-grant.ts resolvePermissionSetIdsForName (:343-356, via tryFind :154); the set and position lookups by id in delegated-admin-gate.ts (:1317, :1330); and the grant-name backfill.
- The S8 report already lists these. This re-confirms them on 404fc477e5.

Epic PM: 7b and C7b PR 2 landed; an S8 regression parks 7a; the next `next` publish should wait for #23308 · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T20:25Z

All of the work below is lane work; the seat read it only.

Landed since the 16:24Z record:

Stage 7b: PR refactor(plugin-security): delete the position write-through and the row-only position backfill (C3 stage 7b) #23302 merged at 17:42Z as 5c9bfb0d3f. Lane ACCEPT 6151006770, Landing record 6151599894.
C7b PR 2 of 3: PR feat(cli): os migrate organization-ownership --apply — the ADR-0131 D10 ceremony (C7b, PR 2 of 3) #23034 merged at 17:12Z (contract review 6150575317). PR 3 of 3 is feat(cli,core): the organization-ownership ceremony promotes customized email templates and moves the settings global rung (C7b, PR 3 of 3) #23329, still a draft.
main: the full battery is green on scheduled run 38451485569 (404fc477e5): the three dogfood shards, Dogfood Verify CLI and Temporal Conformance. The later push runs path-filtered dogfood out or were cancelled.

The S8 regression: #23308 (p1, bug).

The lane measured it (6151143582). On an environment kernel, every permission set saved through the metadata door is missing from the security catalog, so a user granted that set is refused.
The kernel before S8 served these sets.
CI stayed green because permission-set-echo-package-owner.test.ts registers the projector itself.
The fix, A2, is dispatched as its own PR off main (6151126677).
7a is parked on claude/issue-22975-7a-recut until fix(plugin-security): an environment kernel's security catalog serves permission sets and positions saved through the metadata door again (S8 regression) #23308 lands. 8-post still follows 7a.

The publish note.

18.0.0-next.0 was cut before S8, so it does not carry the regression.
The next next publish should wait until fix(plugin-security): an environment kernel's security catalog serves permission sets and positions saved through the metadata door again (S8 regression) #23308 is on main. That publish is the next Version Packages PR from release.yml and its environment: release approval.

Other open items:

[Decision] 墙内组织里持有 manage_metadata 的人仍能改共用的对象、视图、流程：只放行平台运营者（A）、禁止组织范围授予（B），还是维持并写明（C） #23231, PR fix(security)!: under a wall every environment-metadata write is the platform operator's, whatever its type (ADR-0131 D12 items 7–8, D11) #23330 (draft): the lane reported the ruling's fork clause (6154226716).
- Under a wall, the operator rung comes only from OS_PLATFORM_OWNER_EMAIL.
- A stock group deployment's HQ IT holds manage_metadata through the platform-admin set, so it is the operator and keeps authoring.
- An HQ IT given an HQ-organization-scoped set (TENANT_ADMIN) is now refused, and must be declared there. tenancy-modes.mdx says so.
- No reference deployment runs group. The PR proceeds as ruled.
objectui#12030, objectui PR [finding] The first worktree at a new set of package inputs pays a ~431s cold closure build UNDER the shared verify lock; every sibling afterwards pays 0.2s #12337 (GA condition (c)):
- contract review PASS (6151661549) and seat ACCEPT (6151458792);
- 3,507 changed lines, so it waits on a GOVERNED_APPROVERS approval (review requested from os-zhuang and hotlong).

Generated by Claude Code

docs(adr): record the stage-8 retirement of the four security-catalog…

Epic PM: the S8 regression fix is green on `main`; objectui is on `18.0.0-next`; C9's remainder waits on a `next` that carries S8 · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-14T04:24Z

All of the work below is lane work; the seat read it only.

main:

fix(plugin-security): an environment kernel's security catalog serves permission sets and positions saved through the metadata door again (S8 regression) #23308's fix, PR fix(plugin-security): an environment kernel's security catalog serves metadata-door permission sets and positions again #23334 (6d96721faa), is green under the full battery: scheduled run 38487892274 is success, with the three dogfood shards, Dogfood Verify CLI, Temporal Conformance, Console Pin Gate and Test Core 6/6.
The latest full battery since then is scheduled run 38504097762 (713f231854), also success.
A next publish no longer carries the S8 regression.

GA release-cut condition (c), as recorded in this seat's 12:25Z note:

objectui on spec 18: met. objectui PR [finding] The first worktree at a new set of package inputs pays a ~431s cold closure build UNDER the shared verify lock; every sibling afterwards pays 0.2s #12337 (os-zhuang approved) merged at 02:36Z and closed deps(v18): move objectui's @objectstack/* dependencies to the next prereleases (18.0.0-next.N) ahead of 18.0 GA — the maintainer's ruling, since 17.x ships no new release objectui#12030 completed.
C9 (feat: Setup catalog pages read the registry (editable under single, read-only under a wall); assignment pages stay data pages; pickers list the registry (objectstack ADR-0131 D3/D7) objectui#7611): released to domain:ui at 00:32Z on the maintainer's word (Release record 6158162134). The lane claimed it at 01:00Z (6158502886) and landed item 2 as objectui PR fix(pm): let a followed module declare what a gate inherits by importing it #12346. The console already shows W2's walled refusal on every install, uninstall and delete gesture, and that is now pinned. The card is pm:on-hold until (6159065130):
- item 1 (census row 8c): an @objectstack/spec next release whose tag commit descends from S8 (66949b7729). 18.0.0-next.0 (d889448b93) is behind it. So the next next publish also restarts C9.
- item 3 (the card's acceptance and parity gate): feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 closed;
- item 4: objectui#7205 read before the card closes.
Stage 7a: PR refactor(plugin-security)!: delete the permission-set projection, the seed-name lookup and the refusal sink (C3 stage 7a) #23368 (draft) is in a patch round after the contract review FAIL 6160232724 (the patch dispatch is 6160244399). 8-post is being built ahead with no PR until 7a lands (6160674776). 7a is Tier H by size, so the maintainer's approval comes after its ACCEPT.
The F1 re-test on the console pin of that moment stays owed before the cut.

Condition (b): C7b #15211 is unchanged (pm:blocked). Its build-ahead extras landed: #23345 (Fixes #23298) and #23348 (Fixes #23280).

Generated by Claude Code

Correction note on known-limitation item 3 · domain:engine seat 2 · session_01ADzJtzYTLUfgrRZHxkagkX · 2026-10-14T06:20Z. ⛔ Not a claim, ⛔ no label change.

Known-limitation item 3 (comment 6139333945, the transitional managed_by: 'admin' sys_permission_set row after a package-door publish) no longer holds on main. #22975's 7a landed as dac99c2277 (PR #23368). It deletes the permission-set projector, the last writer of that table, and pins zero rows on both kernels for a package-door publish, a writable base's publish and a restart. This is the remedy director ruling #23227 → B named (6145194655, ruling 2). The pending changeset for #23258 was corrected in the same PR, and the maintainer's approval confirmed it. The known-limitations list for the next prerelease can drop item 3.

Epic PM: stage 7a is on `main`; known-limitation items 3 and 5 are resolved · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-14T08:29Z

Stage 7a: PR #23368 merged at 2026-10-14T06:18Z as dac99c2277 (domain:engine seat 2).

Lane ACCEPT, Tier H by size: 6161363247.
os-zhuang approved.
Landing record: 6162235520.

It deletes the permission-set projection, and its acceptance has zero projection rows (#23227 → B). The full battery after it is scheduled run 38526194338 (5656c5638a), success.

Known limitations (6139333945), now resolved:

item 3, the managed_by: 'admin' projection row: resolved by 7a;
item 5, walled non-catalog metadata: resolved by [Decision] 墙内组织里持有 manage_metadata 的人仍能改共用的对象、视图、流程：只放行平台运营者（A）、禁止组织范围授予（B），还是维持并写明（C） #23231 → A, PR fix(security)!: under a wall every environment-metadata write is the platform operator's, whatever its type (ADR-0131 D12 items 7–8, D11) #23330 (430e5f5ad1).

Still open for the GA cut:

(b) C7b feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211: seat 2 holds S1 and S4. domain:engine seat 1 holds the splits feat(metadata-core,metadata-protocol,runtime): #15211 S2+S5 — the sys_metadata family drops organization_id, and the v18 boot refusal lands with it (C7b, split for seat 1) #23429 (S2 + S5) and feat(plugin-security,cli): #15211 S3 — retire sys_user_permission_set.permission_set_id and its indexes, delete the boot grant-name backfill, add the named-grant unique index (C7b, split for seat 1) #23430 (S3). This session now also sits engine seat 1, on the maintainer's order (seat post [PM seat] domain:engine — 🟢 marchtian #6367, opening marker 6164065757).
(c): C3's 8-post (C3 #15204 stages 7a ∥ 7b → 8-post, build ahead: delete the permission-set projection and the position write-through that stage 8 leaves unreferenced, then the post-stage-8 catalog gates and residue #22975, built ahead), the C9 remainder (objectui#7611, on hold), and the F1 re-test before the cut.

Generated by Claude Code

Navigation Menu

Repository navigation

refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under `single` and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204

v18 pre-opening re-verification (C3): DRIFTED. The retirement list is stale and incomplete. Nothing landed

Scope amended by #22006 (ruled B, `6028793924`): C3 gains the position field, the row migration and the read switch, landed together

Triage pointer: a measured case for this card's walled-creation refusal (from #22361, closed as a duplicate here)

231 remaining items

`main`'s full battery after D: one dogfood file red (D × #22993); fix requested from the engine lane · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T03:24Z

Known limitations for the first `next` prerelease (`18.0.0-next.0`) · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T06:01Z

`18.0.0-next.0` shipped · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T08:55Z

Four open questions filed as decision cards · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T10:17Z

Epic PM: the four rulings taken into the GA cut, and condition (c) now waits on objectui#12030 · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T12:24Z

Epic PM: stage 8 is on `main`, and the GA cut's remaining conditions · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T16:24Z

Epic PM: 7b and C7b PR 2 landed; an S8 regression parks 7a; the next `next` publish should wait for #23308 · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T20:25Z

Epic PM: the S8 regression fix is green on `main`; objectui is on `18.0.0-next`; C9's remainder waits on a `next` that carries S8 · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-14T04:24Z

Epic PM: stage 7a is on `main`; known-limitation items 3 and 5 are resolved · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-14T08:29Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204

Description

Activity

os-warren commented on Sep 4, 2026

hotlong commented on Sep 5, 2026

objectstack-fleet commented on Oct 6, 2026

v18 pre-opening re-verification (C3): DRIFTED. The retirement list is stale and incomplete. Nothing landed

objectstack-fleet commented on Oct 7, 2026

objectstack-fleet commented on Oct 7, 2026

Scope amended by #22006 (ruled B, 6028793924): C3 gains the position field, the row migration and the read switch, landed together

objectstack-fleet commented on Oct 8, 2026

Triage pointer: a measured case for this card's walled-creation refusal (from #22361, closed as a duplicate here)

231 remaining items

objectstack-fleet commented on Oct 13, 2026

main's full battery after D: one dogfood file red (D × #22993); fix requested from the engine lane · epic PM session_01Rerax7QTjKMPCUZxQUtPFR (marchtian) · 2026-10-13T03:24Z

objectstack-fleet commented on Oct 13, 2026

Known limitations for the first next prerelease (18.0.0-next.0) · epic PM session_01Rerax7QTjKMPCUZxQUtPFR (marchtian) · 2026-10-13T06:01Z

objectstack-fleet commented on Oct 13, 2026

18.0.0-next.0 shipped · epic PM session_01Rerax7QTjKMPCUZxQUtPFR (marchtian) · 2026-10-13T08:55Z

objectstack-fleet commented on Oct 13, 2026

Four open questions filed as decision cards · epic PM session_01Rerax7QTjKMPCUZxQUtPFR (marchtian) · 2026-10-13T10:17Z

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

Epic PM: the four rulings taken into the GA cut, and condition (c) now waits on objectui#12030 · epic PM session_01Rerax7QTjKMPCUZxQUtPFR (marchtian) · 2026-10-13T12:24Z

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

Epic PM: stage 8 is on main, and the GA cut's remaining conditions · epic PM session_01Rerax7QTjKMPCUZxQUtPFR (marchtian) · 2026-10-13T16:24Z

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

Epic PM: 7b and C7b PR 2 landed; an S8 regression parks 7a; the next next publish should wait for #23308 · epic PM session_01Rerax7QTjKMPCUZxQUtPFR (marchtian) · 2026-10-13T20:25Z

objectstack-fleet commented on Oct 14, 2026

Epic PM: the S8 regression fix is green on main; objectui is on 18.0.0-next; C9's remainder waits on a next that carries S8 · epic PM session_01Rerax7QTjKMPCUZxQUtPFR (marchtian) · 2026-10-14T04:24Z

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

Epic PM: stage 7a is on main; known-limitation items 3 and 5 are resolved · epic PM session_01Rerax7QTjKMPCUZxQUtPFR (marchtian) · 2026-10-14T08:29Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under `single` and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204

Scope amended by #22006 (ruled B, `6028793924`): C3 gains the position field, the row migration and the read switch, landed together

`main`'s full battery after D: one dogfood file red (D × #22993); fix requested from the engine lane · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T03:24Z

Known limitations for the first `next` prerelease (`18.0.0-next.0`) · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T06:01Z

`18.0.0-next.0` shipped · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T08:55Z

Four open questions filed as decision cards · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T10:17Z

Epic PM: the four rulings taken into the GA cut, and condition (c) now waits on objectui#12030 · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T12:24Z

Epic PM: stage 8 is on `main`, and the GA cut's remaining conditions · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T16:24Z

Epic PM: 7b and C7b PR 2 landed; an S8 regression parks 7a; the next `next` publish should wait for #23308 · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-13T20:25Z

Epic PM: the S8 regression fix is green on `main`; objectui is on `18.0.0-next`; C9's remainder waits on a `next` that carries S8 · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-14T04:24Z

Epic PM: stage 7a is on `main`; known-limitation items 3 and 5 are resolved · epic PM `session_01Rerax7QTjKMPCUZxQUtPFR` (`marchtian`) · 2026-10-14T08:29Z