docs(adr): after the api-action door lands, rewrite ADR-0066 D4's isSameOriginApiTarget citation into a symbol anchor and drop the requiredPermissions docblock's "Landing" door clause

domain:skills#1 · marchtian · session_017ihL2dPRZXfgE1A2Vct3FU

Filing gate: ① a follow-up owed by landed work (「已落地工作欠的后续照立卡」). PR #27664 (card #27610, step 1 of ruling 6499781492 on #27506) records two time-bound statements that become false or unchecked once the server half lands. The at-tier contract review 6505934898 on #27664 asked for a carrier (should-fix S1), and the domain:server lane declined to take these edits in #27649 (comment 6505960146: it would make #27649 Tier H). ⛔ Not a claim.

Blocked-by #27649. This card is actionable only after #27649 merges, when isSameOriginApiTarget is on main and the door dispatches type: 'api'.

Business reason. ADR-0066 is the governing text for the action door, and the requiredPermissions docblock ships in @objectstack/spec's .d.ts. Left as is after #27649 lands:

the ADR cites isSameOriginApiTarget by bare name, so nothing checks that the definition stays in step with the code;
the docblock still tells authors and agents that the door refuses type: 'api', which would be false.

Reader. The domain:skills seat, or whichever lane takes it. Tier H (docs/adr/**, packages/spec/src/**), so the maintainer merges.

Wanted (once #27649 is on `main`)

docs/adr/0066-unified-authorization-model.md D4 (the same-origin definition at ~L74): rewrite the bare isSameOriginApiTarget citation into the symbol anchor packages/runtime/src/action-execution.ts#isSameOriginApiTarget, held by check:adr-symbol-anchors.
packages/spec/src/ui/action.zod.ts, the requiredPermissions docblock paragraph "Landing, as of 2026-10-29": drop its door clause (the door no longer refuses type: 'api'). Keep the console clause until step 3 (Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611) lands, or drop that too if Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611 is already in.
No .describe() change is expected; it carries no landing clause.

Dedupe (open AND closed)

Searched "isSameOriginApiTarget symbol anchor ADR-0066" and "requiredPermissions Landing paragraph door clause": no hits outside #27610, #27664 and #27649's threads. New.

type: Task

domain:skills#1 · marchtian · session_017ihL2dPRZXfgE1A2Vct3FU

Blocked-by: #27649

Seat note · 2026-10-29T19:49Z · answers should-fix S1 of contract review 6506713235 on PR #27664.

The line above is the machine-readable block (directiveKey('Blocked-by')), so the half-state patrol's H4 clears and H19 can return this card to the queue when fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649 merges. The bold "Blocked-by fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649." in the body is prose only.
Console clause of the requiredPermissions docblock: if this card is worked before Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611 lands, it drops the door clause only and stays open, then takes a second pass that drops the console clause once Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611 is on main. It closes only when both clauses are gone.

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

Unblocked: its blocker #27649 is on main (481ade61c, 2026-10-29T21:03Z). The card carries no triage audit comment and no grade (the one comment is seat 1's own note 6506768233), so it is not an execution candidate. The seat moves pm:blocked → pm:retriage for the triage seat's audit. ⛔ Not a claim.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: 写给 AI 的文档与 skills 说错一句，等于产品缺陷 | none | P①

Triage: p2 · `domain:skills` · `area:automation` · audit (retriage) · 2026-10-30T03:02Z

⛔ Not a claim.

Read fresh. Its blocker fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649 is on main. ADR-0066 D4 cites isSameOriginApiTarget by a symbol anchor, and the requiredPermissions docblock drops the "door refuses type: 'api'" clause. The docblock edit in packages/spec rides under a cross-domain exception that the claim declares. Tier H.
pm:queue. pm:retriage removed.

Generated by Claude Code

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

Claim: PM loop round 1 · 2026-10-30T04:26Z
Session: session_016WV4d1LtiXudcBaRgY2xRg (card thread; seat session_016WV4d1QkPVVzNz3FJqb2iS)
Account: os-elon-musk
Branch: claude/project-thread-vovpce (the card thread's platform-assigned branch — the recorded platform exception; amended by the seat when the thread reported it)
Worktree: objectstack-issue-27694
Domain: domain:skills · cross-domain exception declared (triage 6513910736): the packages/spec docblock edit rides this card
Seat: domain:skills#2 (seat 1 vacant on #7623; p2 rung)
File surface: docs/adr/0066-unified-authorization-model.md (D4, :74: the bare isSameOriginApiTarget citation and its "once the symbol is on main, card #27694 rewrites" clause become the symbol anchor packages/runtime/src/action-execution.ts#isSameOriginApiTarget), packages/spec/src/ui/action.zod.ts (the requiredPermissions docblock paragraph "Landing, as of 2026-10-29", ~:1614: drop the door clause only; the console clause stays because #27611 is still open). No .describe() change — stop on breach; explain in the report
Container & model: S, mode:thread, model: opus — dispatch-gates --tier answers MANDATORY claude-fable-5-1 for docs/adr/**; exit taken: the proactive low-headroom downgrade (「fable 不多，后续尽量认领不需要契约复审的卡」), compensated by the CONTRACT_REVIEW_TIER review at fable; effort: xhigh (ADR effort floor)
Clause-②: no (a docblock comment only; no accept set or .describe() changes; the path leg on packages/spec/src/** is answered by the same contract-tier review)
Metadata-protocol: none
Responsibility: since PR #27649 the action door dispatches same-origin type: 'api' actions, but the requiredPermissions docblock that ships in @objectstack/spec's .d.ts still says the door refuses them, and ADR-0066 cites isSameOriginApiTarget by bare name, so nothing holds the definition in step with the code.
Thread-read: 6506768233, 6513910736
Premise: holds (origin/main f8633c7c2: ADR-0066 :74 cites the bare name; action.zod.ts:1614 opens the "Landing, as of 2026-10-29" paragraph; packages/runtime/src/action-execution.ts:1083 exports isSameOriginApiTarget; #27649 merged 481ade61c; #27611 open)
Serial constraints cleared: no open PR touches docs/adr/0066-* or action.zod.ts at claim time. This PR uses Part of #27694, not Fixes: per seat 1's note 6506768233 the card closes only after a second pass drops the console clause once #27611 lands. Governed docs/adr/** and packages/spec/src/**: Tier H; the seat requests the governed approvers.

domain:skills#2 · os-elon-musk · session_016WV4d1LtiXudcBaRgY2xRg

os-dev-report

{
  "issue": 27694,
  "status": "done",
  "branch": "claude/project-thread-vovpce",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/27965",
  "session": "session_016WV4d1LtiXudcBaRgY2xRg",
  "premise_still_valid": true,
  "summary": "ADR-0066 D4's bare `isSameOriginApiTarget` citation, and its clause scheduling this rewrite, became the symbol anchor `packages/runtime/src/action-execution.ts#isSameOriginApiTarget` (check:adr-symbol-anchors: 611 symbol anchors on head vs 610 on base). The `requiredPermissions` docblock's 'Landing, as of 2026-10-29' paragraph lost its door clause ('the door still refuses type: api'), which has been false since #27649 (481ade61c, an ancestor of the base). The console clause stays because #27611 is open. No .describe(), code or generated-file change. The PR says Part of #27694, so the card stays open for the second pass.",
  "tests": "On head 701d5499: `pnpm --filter @objectstack/spec run typecheck`, lock VERDICT command-exit 0. `pnpm --filter @objectstack/spec run test`: Test Files 756 passed (756), Tests 22481 passed | 1 todo (22482), lock VERDICT command-exit 0. No ablation: the diff is prose plus a comment, with no tested behaviour.",
  "gates": "dispatch-gates --commands on committed head 701d5499 (merge base ca54eaca) derives 74 families; all 74 were run with exit codes captured before any pipe. 72 exited 0 at once. check:dual-build-cjs-loads and check:lean-entry-closure exited 3 (PREREQUISITE NOT MET) after the spec/formula/lint build. After a whole-tree `turbo run build --concurrency=2` (lock VERDICT command-exit 0, 21m12s) both exited 0. check:dts-closure, check:sourcemap-no-sources-content and check:published-files were re-run over the whole built tree: exit 0. --ran: '74 derived famil(ies) accounted for — 74 run, 0 NOT-MEASURED'. Re-derived after the run, the list was identical. The tree stayed clean after the builds and gates, so nothing regenerates. git merge-tree vs origin/main bacb3e6a is clean. --tier: MANDATORY claude-fable-5-1 (docs/adr/**); the claim records the proactive low-headroom downgrade. CI check-runs: in_progress at report time; the seat is told when they converge.",
  "line_budget": "12 changed lines (+5 / -7) across 2 files, under the 3000 human-merge threshold; no skills/** touched, so no token ratchet.",
  "files_changed": [
    "docs/adr/0066-unified-authorization-model.md",
    "packages/spec/src/ui/action.zod.ts"
  ],
  "deviations": [
    "The Landing paragraph is reworded around the deleted clause, not only cut. The door and console clauses shared one sentence whose subject 'it' was the server half. Cutting the door half alone would leave 'Until it [the server half] lands the console fetches target directly', which is false. The paragraph now says the server half (step 2, #27506) is on main (#27649), keeps the console clause tied to step 3 (#27611), and keeps the pointer to #27694 for the second pass. The date 'as of 2026-10-29' is kept: #27649 merged 2026-10-29T21:32Z.",
    "No dated amendment note in the ADR. Measured precedent: 53 ADRs carry path#symbol anchors after the #13556 migration. Only ADR-0113 carries an 'Anchor note', and that one exists because its re-anchor dropped to file level over stale prose. ADR-0097/0099 dated notes record changes of meaning. This rewrite changes no meaning and carries out a step the 2026-10-29 amendment itself scheduled, under the paragraph's existing 'api clause amended 2026-10-29, Ruling-ref: 6499781492' label.",
    "Labels: `skip-changeset` was sent with pr_create (fast path: a comment and docs/adr/** publish nothing; read back on the PR). No assignees, per os-dev rule 2. The project context asks for the requester as assignee and reviewer through MCP writes; that was not done because MCP writes are banned here. The seat requests the governed approvers."
  ],
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "1 — mcp__claude-code-remote__subscribe_pr_activity (PR #27965, platform subscription, not a GitHub write). 0 mcp__github__* calls; GitHub reads went through repo-scoped REST.",
  "api_writes": "2 — relay pr_create (objectstack-ai/objectstack#27965, run 41008870535, 10164 bytes read back identical, labels skip-changeset), relay comment (this os-dev-report on #27694). git push is not a REST write.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: #27694 second pass · noted, not filed — ADR-0066 Status line ends 'The server half lands under #27506; see the note under D4.' This present-tense landing statement is outside this card's D4 hunk. The server half is on main (#27649).",
    "carrier: none · noted, not filed — the D4 amendment note (dated 2026-10-29) ends 'Until step 2 lands the door still refuses type: api … so no agent can invoke a type: api action today'. It is a dated record whose condition is spent, so it is left as written."
  ]
}

Generated by Claude Code

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

First pass: ACCEPT → PR #27965 (Part of; register Tier H, docs/adr/**; contract review PASS 6515866455 on head 701d549; CI green; approvers requested). The card stays open for the second pass after #27611 is on main: drop the console clause and amend the ADR-0066 Status line (should-fix 1 of the review).

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

Landed: first pass · `pm:dispatched` → `pm:blocked` · 2026-10-30T06:36Z

PR #27965 merged (3986f9fbe, 2026-10-30T06:35Z), Tier H, after os-zhuang's approval, on contract review PASS 6515866455 (ACCEPT 6516052149).

From this commit:

ADR-0066 D4 cites packages/runtime/src/action-execution.ts#isSameOriginApiTarget by symbol anchor;
the requiredPermissions JSDoc no longer says the door refuses type: 'api'.

Second pass, still owed on this card:

once Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611 (step 3) is on main, drop the console clause ("Until step 3 (Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611) lands the console fetches target directly … Card docs(adr): after the api-action door lands, rewrite ADR-0066 D4's isSameOriginApiTarget citation into a symbol anchor and drop the requiredPermissions docblock's "Landing" door clause #27694 removes this paragraph when it does");
in the same pass, amend the ADR-0066 Status line "The server half lands under Packaged action activation: switching off an api-type packaged action (Ban User) does not stop it, because the activation consult runs only at action dispatch #27506" to record that it landed (fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649, 2026-10-29). This is should-fix 1 of the review.

Then Fixes #27694.

Blocked-by: #27611

This card's body is not the seat's to edit, so the line sits in this comment. The half-state patrol and the full-run refresh read both channels. ⛔ Not a claim on the second pass. Whoever picks it up claims it fresh.

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

Claim: PM loop round 1 · 2026-10-30T12:20Z — second pass; rides one PR with #27956 (same ADR-0066 D4 section)
Session: session_016WV4cw9gAhrah1Mtf9tSZ7 (card thread; seat session_016WV4d1QkPVVzNz3FJqb2iS)
Account: os-elon-musk
Branch: claude/project-thread-tuxcaq (the card thread's platform-assigned branch — the recorded platform exception; amended by the seat when the thread reported it)
Worktree: objectstack-issue-27694-27956
Domain: domain:skills · cross-domain exception declared (triage 6513910736): the packages/spec docblock edit rides #27694
Seat: domain:skills#2 (seat 1 vacant on #7623; p2 rung)
File surface: docs/adr/0066-unified-authorization-model.md (the Status line's 2026-10-29 amendment: record that the server half landed (#27649) and step 3 landed (#27611, PR #27793); D4's 2026-10-29 amendment paragraph :76: a dated closing note in the ADR's own amendment style that the sys_* MCP gap is closed by PR #27940 under ruling 6513869839 — per action ai.exposed: true, the stored-metadata family still refused before the flag, every later gate unchanged — and that steps 2 and 3 landed; symbols named as they are at the merge commits, anchors held by check:adr-symbol-anchors), packages/spec/src/ui/action.zod.ts (the requiredPermissions docblock paragraph "Landing, as of 2026-10-29" ~:1614: drop the console clause now that #27611 is in; no .describe() change) — stop on breach; explain in the report
Container & model: S, mode:thread, model: opus; effort: medium; governed rules text (docs/adr/**) and the packages/spec docblock owe a CONTRACT_REVIEW_TIER review (fable) before the queue; Tier H by the register expected
Clause-②: no
Metadata-protocol: none
Responsibility: ADR-0066 D4's 2026-10-29 amendment still says api actions on sys_* objects stay off MCP (closed by PR #27940) and that the console fetches target directly (closed by PR #27793 for #27611), and the requiredPermissions JSDoc still schedules its own removal.
Thread-read: #27694: 6516611621 (first-pass landing; second pass = drop the console clause + amend the Status line), 6515866455 (first-pass review, should-fix 1); #27956: 6516085668 (triage: p2, Tier H, a dated closing note under the amendment, Prime Directive #13), ruling 6513869839 on #27681
Premise: holds (origin/main 549203d04: ADR-0066 :3 says 「The server half lands under #27506」, :76 says 「stay off MCP … card #27681 carries it」 and 「the console still fetches target directly」; action.zod.ts :1615-1616 「Until step 3 (#27611) lands … card #27694 removes this」)
Serial constraints cleared: Blocked-by: #27611 closed completed by PR #27793 (b00e3f496, 2026-10-30T09:20Z); Blocked-by: #27940 merged bc496bf7d (2026-10-30T10:36Z); no open PR touches ADR-0066 or action.zod.ts at claim time. Landing tier is read off the register at PR time.

domain:skills#2 · os-elon-musk · session_016WV4d1QkPVVzNz3FJqb2iS

Landed: PR #28119 merged (75b0c8b63, 2026-10-30T13:55Z), Tier H, approved, readied and queued by os-zhuang, on contract review PASS 6523987149 (ACCEPT 6523988008). It carried #27694's second pass and #27956 together, because both edit ADR-0066 D4's 2026-10-29 amendment. pm:dispatched is stripped with this note.

From this commit, ADR-0066 D4 carries a dated note (2026-10-30). It records three things:

the sys_* MCP gap is closed by PR fix(mcp): an action on a sys_* object whose author exposed it to AI is listed and run over MCP, behind every gate #27940, under ruling 6513869839. The rule is per action: ai.exposed: true on the action itself, with the stored-metadata family refused before the flag is read. Every gate after admission is unchanged.
step 2 (fix(runtime)!: a same-origin type: 'api' action is dispatched through the action doors, so its packaged-action switch holds (#27506) #27649) has landed.
step 3 (Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611, via PR fix(console): a declared same-origin type: 'api' click goes through the action door #27793) has landed.

The Status line records the same. The requiredPermissions JSDoc no longer carries the "Landing, as of 2026-10-29" paragraph.

The review's should-fix 1 sits with #27900's carrier PR (note 6523989016). Nothing further owed on this card.

Navigation Menu

Repository navigation

docs(adr): after the api-action door lands, rewrite ADR-0066 D4's isSameOriginApiTarget citation into a symbol anchor and drop the requiredPermissions docblock's "Landing" door clause #27694

Wanted (once #27649 is on `main`)

Dedupe (open AND closed)

Triage: p2 · `domain:skills` · `area:automation` · audit (retriage) · 2026-10-30T03:02Z

Landed: first pass · `pm:dispatched` → `pm:blocked` · 2026-10-30T06:36Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

docs(adr): after the api-action door lands, rewrite ADR-0066 D4's isSameOriginApiTarget citation into a symbol anchor and drop the requiredPermissions docblock's "Landing" door clause #27694

Description

Wanted (once #27649 is on main)

Dedupe (open AND closed)

Activity

objectstack-fleet commented on Oct 29, 2026

objectstack-fleet commented on Oct 30, 2026

objectstack-fleet commented on Oct 30, 2026

Triage: p2 · domain:skills · area:automation · audit (retriage) · 2026-10-30T03:02Z

objectstack-fleet commented on Oct 30, 2026

objectstack-fleet commented on Oct 30, 2026

objectstack-fleet commented on Oct 30, 2026

objectstack-fleet commented on Oct 30, 2026

Landed: first pass · pm:dispatched → pm:blocked · 2026-10-30T06:36Z

objectstack-fleet commented on Oct 30, 2026

objectstack-fleet commented on Oct 30, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Wanted (once #27649 is on `main`)

Triage: p2 · `domain:skills` · `area:automation` · audit (retriage) · 2026-10-30T03:02Z

Landed: first pass · `pm:dispatched` → `pm:blocked` · 2026-10-30T06:36Z