From 1ad22fa225bc45d41da08c455823cfc68ba17624 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 16 Jul 2026 13:17:02 +0000 Subject: [PATCH 1/2] docs(permissions): document the runtime OWD posture gate (#3050) in the governance section --- content/docs/permissions/authorization.mdx | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/content/docs/permissions/authorization.mdx b/content/docs/permissions/authorization.mdx index 95008453f..d4ebf8602 100644 --- a/content/docs/permissions/authorization.mdx +++ b/content/docs/permissions/authorization.mdx @@ -287,8 +287,8 @@ substrate above. ## Governance: how "declared = enforced" is kept true -Four CI-time mechanisms make the security posture a **checked artifact** -rather than a belief: +Five mechanisms — four CI-time, one runtime — make the security posture a +**checked artifact** rather than a belief: - **Security publish linter** (ADR-0090 D7, `validateSecurityPosture` in `@objectstack/lint`, gating `os compile`): unset OWD on custom objects, @@ -298,6 +298,19 @@ rather than a belief: security identifiers, and the ADR-0091 grant-lifecycle rules (a seed grant already expired at authoring time; a delegation row missing its mandatory `reason`) — every error rule mirrors a runtime gate. +- **Runtime OWD posture gate** (#3050, `objectPostureGate` in + `@objectstack/plugin-security`, registered on the metadata protocol's + pre-persistence `registerAuthoringGate` seam): the two OWD rules the CLI + linter can only check at build time are also enforced on every + runtime-authored object body — Studio drafts, REST saves, AI builders. + An environment overlay of a **packaged** object may only *tighten* + `sharingModel` / `externalSharingModel`, never widen them beyond the + packaged declaration (`403 owd_widening_forbidden` — widen it in the + package source and publish instead; this closes the + `OS_METADATA_WRITABLE=object` escape hatch as an unvalidated widening + path, ADR-0086 D1), and `externalSharingModel ≤ sharingModel` (ADR-0090 + D11) is rejected at save time (`403 owd_external_wider`). Write-path + only: stored metadata keeps loading unchanged. - **Access-matrix snapshot** (ADR-0090 D6, `buildAccessMatrix` / `diffAccessMatrix`): with `access-matrix.json` committed next to the config, `os compile` fails on any capability drift with semantic lines From a43866f7daf1a42cd41601ec4f9f9b36e85e9312 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 16 Jul 2026 13:25:18 +0000 Subject: [PATCH 2/2] =?UTF-8?q?docs(adr):=20round-2=20status=20verificatio?= =?UTF-8?q?n=20=E2=80=94=20flip=200037/0065,=20annotate=2012=20partial/clo?= =?UTF-8?q?ud-owned=20ADRs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Per-decision code+test verification (same method as #3052's round 1) of the 14 remaining medium/low-density Proposed ADRs: - Flip to Accepted: 0037 (Live Canvas — all four phases landed incl. preview-evaluator + objectui surfaces), 0065 (SDUI styling — envelope, scoped-styles compiler + 4-property test, token lint; cloud half noted). - Honest partial notes, keep Proposed: 0080 (save-time compile->store not wired), 0078 (core shared completeness predicate + lint absent), 0052 (context decomposition undone), 0067 (Decision-2 turn-atomicity missing), 0022 (Slack channel->connector delegation unbuilt), 0051 (render side absent), 0076 (D3 unbuilt, D12 runtime enforcement missing), 0061 (Tier 1 claim verified TRUE; own conformance bar unmet), 0028 (NOT STARTED). - Cloud-owned banners verified accurate, framework slices noted: 0038, 0063, 0064 (service-ai genuinely absent from framework). --- docs/adr/0022-connectors-vs-messaging-channels.md | 2 +- docs/adr/0028-metadata-naming-and-namespace-isolation.md | 2 +- docs/adr/0037-live-canvas-draft-preview.md | 2 +- docs/adr/0038-build-verification-loop.md | 2 +- docs/adr/0051-inline-metadata-views-in-docs.md | 2 +- docs/adr/0052-audit-is-not-the-activity-feed.md | 2 +- docs/adr/0061-record-search-architecture.md | 2 +- ...0063-two-kernel-agents-skills-are-the-extension-primitive.md | 2 +- docs/adr/0064-tool-scoping-to-agent.md | 2 +- docs/adr/0065-sdui-styling-model.md | 2 +- docs/adr/0067-commit-history-and-rollback-for-ai-authoring.md | 2 +- docs/adr/0076-objectql-core-tiering.md | 2 +- docs/adr/0078-no-silently-inert-metadata.md | 2 +- docs/adr/0080-ai-authored-ui-jsx-source.md | 2 +- 14 files changed, 14 insertions(+), 14 deletions(-) diff --git a/docs/adr/0022-connectors-vs-messaging-channels.md b/docs/adr/0022-connectors-vs-messaging-channels.md index 9929114f9..d00a0f52f 100644 --- a/docs/adr/0022-connectors-vs-messaging-channels.md +++ b/docs/adr/0022-connectors-vs-messaging-channels.md @@ -1,6 +1,6 @@ # ADR-0022: Connectors vs Messaging Channels — Where "Push to Slack" Lives -**Status**: Proposed (2026-05-31) +**Status**: Proposed (2026-05-31) — routing decision recorded; both substrates now exist independently (`connector-slack` built; `service-messaging` notify/outbox/preferences built), but the §3 shared-transport wiring — a Slack `MessagingChannel.send()` delegating to the Slack Connector — is unbuilt (no slack-channel in service-messaging). (2026-07-16 audit) **Deciders**: ObjectStack Protocol Architects **Builds on**: [ADR-0012](./0012-notification-platform.md) (Messaging Platform — outbound `notify` on a generalized outbox), [ADR-0013](./0013-bidirectional-messaging.md) (Bidirectional Messaging — Slack first), [ADR-0015](./0015-external-datasource-federation.md) (open mechanism / enterprise lifecycle split), [ADR-0018](./0018-unified-node-action-registry.md) (`connector_action` as baseline generic dispatch) **Consumers**: `@objectstack/spec` (`integration/`, future `messaging/`), `@objectstack/services/service-automation` (connector registry), future `@objectstack/service-messaging`, future `@objectstack/plugin-messaging-slack`, `@objectstack/connectors/*` diff --git a/docs/adr/0028-metadata-naming-and-namespace-isolation.md b/docs/adr/0028-metadata-naming-and-namespace-isolation.md index db0b3410e..4bd577ba8 100644 --- a/docs/adr/0028-metadata-naming-and-namespace-isolation.md +++ b/docs/adr/0028-metadata-naming-and-namespace-isolation.md @@ -1,6 +1,6 @@ # ADR-0028: Metadata Naming & Namespace Isolation — Derived Physical Names, Namespace-Scoped Identity, and a Single Kernel Contract -**Status**: Proposed (2026-06-01) +**Status**: Proposed (2026-06-01) — NOT STARTED (2026-07-16 audit): the target model (namespace as identity dimension, short authored names, derived physical names, `namingMode` dual-read, `sys` reservation, namespaced transport segments) is entirely unbuilt; what exists is the superseded literal-prefix current-state contract (`spec/kernel/namespace-prefix.ts`, self-labelled) plus unrelated ADR-0048 conflict scaffolding. **Deciders**: ObjectStack Protocol Architects **Supersedes**: the hand-written object-namespace-prefix authoring rule documented in `packages/spec/src/kernel/manifest.zod.ts` (the `namespace` field) and enforced by `validateNamespacePrefix()` in `packages/spec/src/stack.zod.ts` — there is no standalone ADR for that rule today. **Builds on**: [ADR-0005](./0005-metadata-customization-overlay.md) (one Zod source per type, org overlay), [ADR-0008](./0008-metadata-repository-and-change-log.md) (Repository · ChangeLog · Cache · Registry; `MetaRef = org/type/name`), [ADR-0010](./0010-metadata-protection-model.md) (protection model), [ADR-0019](./0019-app-as-consumer-unit.md) (app as the consumer-installable unit), [ADR-0025](./0025-plugin-package-distribution.md) (package distribution), [ADR-0029](./0029-kernel-object-ownership-and-platform-objects-decomposition.md) (**prerequisite** — kernel object ownership; D5/D6 below assume the kernel is properly owned per ADR-0029) diff --git a/docs/adr/0037-live-canvas-draft-preview.md b/docs/adr/0037-live-canvas-draft-preview.md index c5147d52b..f2ceaf28c 100644 --- a/docs/adr/0037-live-canvas-draft-preview.md +++ b/docs/adr/0037-live-canvas-draft-preview.md @@ -1,6 +1,6 @@ # ADR-0037: Live Canvas — draft-overlay live preview while you build -**Status**: Proposed (2026-06-10) +**Status**: Accepted (2026-06-10) — all four phases implemented: `previewDrafts` reads (`runtime/http-dispatcher.ts`), objectui LiveCanvas/PreviewModeContext/DraftPreviewBar, draft-data preview via `service-analytics/preview-evaluator.ts` (+test), assistantBus back-channel (Phase 4 the least exercised). **Deciders**: ObjectStack Protocol Architects **Builds on**: [ADR-0033](./0033-ai-assisted-metadata-authoring.md) (AI authors metadata as DRAFTS; publish is the human gate), [ADR-0021](./0021-analytics-dataset-semantic-layer.md) (datasets as the single analytics form — what dashboards render from), [ADR-0005](./0005-metadata-customization-overlay.md) (the overlay model the draft state lives in) **Consumers**: `@objectstack/runtime` + `@objectstack/objectql` (preview data plane — mostly already present), `@objectstack/service-analytics` (Phase 3 draft-data queries), `../objectui` (`data-objectstack` preview client, `app-shell` Live Canvas + assistant bus, view/dashboard renderers), `../cloud` (Build-with-AI entry surface) diff --git a/docs/adr/0038-build-verification-loop.md b/docs/adr/0038-build-verification-loop.md index 0d478a6e2..3994c35c1 100644 --- a/docs/adr/0038-build-verification-loop.md +++ b/docs/adr/0038-build-verification-loop.md @@ -2,7 +2,7 @@ > **🔶 Cloud-owned — superseded in part by cloud ADR-0025 (2026-06-25).** The in-UI AI runtime and the `ask` / `build` agents described here moved to the **cloud / Enterprise** distribution (`@objectstack/service-ai` → `cloud/packages/service-ai`, closed); the open framework exposes AI only via `@objectstack/mcp` (BYO-AI) and ships no in-product `ask` / `build` chat. Retained as historical design context, now **cloud-owned** — see [`cloud/docs/adr/0025-service-ai-to-cloud-open-mcp-only`](https://github.com/objectstack-ai/cloud/blob/main/docs/adr/0025-service-ai-to-cloud-open-mcp-only.md). -**Status**: Proposed (2026-06-11) +**Status**: Proposed (2026-06-11) — cloud-owned; framework slice partially implemented (2026-07-16 audit): L3 runtime probes shipped and tested (`metadata-protocol/src/build-probes.ts`, `RuntimeBuildIssue` contract); L2 half-present (dataset compile only); L1/L4/L5 + `ai_eval_*` storage are cloud-only and not verifiable in this repo. **Deciders**: ObjectStack Protocol Architects **Builds on**: [ADR-0033](./0033-ai-assisted-metadata-authoring.md) (drafts as the staging layer — this ADR **replaces its human-approval assumption for AI builds** with a machine gate; HITL stays for destructive actions), [ADR-0021](./0021-analytics-dataset-semantic-layer.md) (datasets — what most verification probes exercise), ADR-0037 / [framework#1694](https://github.com/objectstack-ai/framework/pull/1694) (Live Canvas — the *human-visibility* complement to this ADR's *machine-verification*) **Consumers**: `@objectstack/service-analytics` + `@objectstack/objectql` (verification probes), `../cloud/service-ai-studio` (graph lint, `verify_build` tool, self-correction protocol, eval intelligence), `../objectui` (build health card in chat), `ai_eval_cases`/`ai_eval_runs` (existing, currently-unused storage) diff --git a/docs/adr/0051-inline-metadata-views-in-docs.md b/docs/adr/0051-inline-metadata-views-in-docs.md index 1b9d7de7c..3387d03a1 100644 --- a/docs/adr/0051-inline-metadata-views-in-docs.md +++ b/docs/adr/0051-inline-metadata-views-in-docs.md @@ -1,6 +1,6 @@ # ADR-0051: Inline metadata views in docs — the ` ```metadata ` fenced block -**Status**: Proposed (2026-06-16) +**Status**: Proposed (2026-06-16) — P1 authoring surface implemented (2026-07-16 audit): `ElementMetadataViewerPropsSchema` + `element:metadata_viewer` component entry + publish lint with reference-liveness checks (`cli/utils/collect-docs.ts lintMetadataEmbeds`); the console SDUI fence-lift and the state_machine/flow/permission renderers are NOT implemented — no runtime rendering of the embed yet. **Deciders**: ObjectStack Protocol Architects **Builds on**: [ADR-0046](./0046-package-docs-as-metadata.md) (`doc`/`book` as metadata — §3.4 syntax boundary, §3.5 *derived content is rendered, never written*, §6.7 anonymous live-embed guardrail), [ADR-0020](./0020-state-machine-converge-and-enforce.md) (a record state machine is a `state_machine` validation rule on an object, not a standalone type), [ADR-0047](./0047-object-ui-run-modes.md) (ObjectUI is the server-driven UI runtime), [ADR-0048](./0048-cross-package-metadata-collision.md) (package-scoped single-item resolution), [ADR-0049](./0049-no-unenforced-security-properties.md) (enforce-or-remove posture for governed properties), [ADR-0033](./0033-ai-assisted-metadata-authoring.md) (AI as primary author) **Consumers**: `@objectstack/spec` (`DocSchema` unchanged; new `element:metadata_viewer` entry in `ComponentPropsMap`; the fenced-block body schema), `@objectstack/cli` (publish lint: parse + validate body + reference-liveness), `@objectstack/console` (the SDUI doc renderer lifts ` ```metadata ` fences into the component), `apps/docs` portal (anonymous degradation per ADR-0046 §6.7), `@objectstack/core` (kernel **unchanged** — `doc` stays inert) diff --git a/docs/adr/0052-audit-is-not-the-activity-feed.md b/docs/adr/0052-audit-is-not-the-activity-feed.md index 42447de81..d16c216f0 100644 --- a/docs/adr/0052-audit-is-not-the-activity-feed.md +++ b/docs/adr/0052-audit-is-not-the-activity-feed.md @@ -1,6 +1,6 @@ # ADR-0052: Audit is not the activity feed — decompose collaboration, activity, and audit into bounded contexts -**Status**: Proposed (2026-06-16) +**Status**: Proposed (2026-06-16) — partially implemented (2026-07-16 audit): §5b declarative activity (`trackHistory` + milestone templates), ActivityPointer fields, and `service-feed` retirement are done; the headline bounded-context decomposition is NOT — `sys_activity`/`sys_comment` still live in plugin-audit, the audit-writer still dual-writes (no event-bus spine), `sys_notification` move deferred (P1/P2). **Deciders**: ObjectStack Protocol Architects **Builds on**: [ADR-0030](./0030-notification-platform-convergence.md) (single-ingress `NotificationService.emit` — *no producer writes a per-user inbox row directly*; this ADR applies the same "one canonical service per context, producers emit through a seam" posture to activity and collaboration), [ADR-0012](./0012-notification-platform.md) (messaging outbox owns `sys_notification`), [ADR-0049](./0049-no-unenforced-security-properties.md) (enforce-or-remove posture for governed properties — audit immutability must be enforced at its own boundary, not diluted by co-tenant objects), [ADR-0042](./0042-approval-sla-escalation.md) (uses `sys_audit_log` rows as an idempotency primitive — a second reason audit must stay a clean, append-only ledger) **Consumers**: `@objectstack/plugin-audit` (sheds 4 of its 5 objects; keeps only `sys_audit_log`), `@objectstack/service-feed` (becomes the canonical collaboration+timeline backend, or is retired into it), `@objectstack/service-storage` (takes `sys_attachment`), `@objectstack/service-messaging` (takes `sys_notification`, per ADR-0030), `@objectstack/platform-objects` (object ownership map), `@objectstack/cli` (`ALWAYS_ON_CAPABILITIES` / capability resolver), `@objectstack/console` (ChatterPanel data source), `@objectstack/spec` (`IFeedService` / event contracts) diff --git a/docs/adr/0061-record-search-architecture.md b/docs/adr/0061-record-search-architecture.md index a22f44b56..76ad5e236 100644 --- a/docs/adr/0061-record-search-architecture.md +++ b/docs/adr/0061-record-search-architecture.md @@ -1,6 +1,6 @@ # ADR-0061: Record Search Architecture — metadata-driven `$search` resolution -**Status**: Proposed — recommended for acceptance (2026-06-21). **Tier 1 (`$search` + `object.searchableFields`) has since been implemented & is live; Tier 2 (FTS/relevance) deferred — header pending formal update.** +**Status**: Proposed — recommended for acceptance (2026-06-21). **Tier 1 (`$search` + `object.searchableFields`) has since been implemented & is live; Tier 2 (FTS/relevance) deferred.** Verified 2026-07-16: Tier 1 claim TRUE (`objectql/src/search-filter.ts` + engine wiring + unit tests, incl. `$searchFields` narrowing and select label-mapping) — but this ADR's own acceptance bar (a `search-conformance` ledger entry + dogfood multi-field HTTP proof, per ADR-0060 closure) is still unmet, so the header stays Proposed until that lands. **Deciders**: ObjectStack Protocol Architects **Builds on**: ADR-0045 (additive materialization & visibility gate — search must be visibility-aware), ADR-0049 (enforce-or-remove / no unenforced declaration), ADR-0054 (runtime proof per enforced surface), ADR-0060 (conformance ledger as a platform pattern) **Consumers**: spec, objectql, driver-sql, driver-memory, driver-mongodb, rest, objectui (`fields`, `plugin-list`, `app-shell`), verify, dogfood diff --git a/docs/adr/0063-two-kernel-agents-skills-are-the-extension-primitive.md b/docs/adr/0063-two-kernel-agents-skills-are-the-extension-primitive.md index 6c3de063f..6e688670f 100644 --- a/docs/adr/0063-two-kernel-agents-skills-are-the-extension-primitive.md +++ b/docs/adr/0063-two-kernel-agents-skills-are-the-extension-primitive.md @@ -2,7 +2,7 @@ > **🔶 Cloud-owned — superseded in part by cloud ADR-0025 (2026-06-25).** The in-UI AI runtime and the `ask` / `build` agents described here moved to the **cloud / Enterprise** distribution (`@objectstack/service-ai` → `cloud/packages/service-ai`, closed); the open framework exposes AI only via `@objectstack/mcp` (BYO-AI) and ships no in-product `ask` / `build` chat. Retained as historical design context, now **cloud-owned** — see [`cloud/docs/adr/0025-service-ai-to-cloud-open-mcp-only`](https://github.com/objectstack-ai/cloud/blob/main/docs/adr/0025-service-ai-to-cloud-open-mcp-only.md). -**Status**: Proposed (2026-06-22) +**Status**: Proposed (2026-06-22) — cloud-owned (2026-07-16 audit): the framework spec dependencies shipped (`skill.surface` + `agent.surface` enums, `spec/ai/{skill,agent}.zod.ts`); the runtime two-agent split, shim removal, ask-rename and tenant-agent withdrawal live in cloud `service-ai` / objectui and are not verifiable in this repo. **Deciders**: ObjectStack Protocol Architects **Supersedes**: [ADR-0040](./0040-unified-assistant-and-agent-binding.md) — its core decision (a *single* unified assistant selected by *per-turn intent classification*) is **reversed**. ADR-0040's UX win ("the end user never picks from a roster") is **kept** but re-grounded: the *surface* binds the agent, not a classifier and not a dropdown. §3 (custom tenant agents) is withdrawn; §4 (tool-scoping) is handed to [ADR-0064](./0064-tool-scoping-to-agent.md). **Builds on**: [ADR-0033](./0033-ai-assisted-metadata-authoring.md) (draft → verify → publish), [ADR-0038](./0038-build-verification-loop.md) (verify-fix-reverify discipline carried by skills) diff --git a/docs/adr/0064-tool-scoping-to-agent.md b/docs/adr/0064-tool-scoping-to-agent.md index 4cd852282..857b89ceb 100644 --- a/docs/adr/0064-tool-scoping-to-agent.md +++ b/docs/adr/0064-tool-scoping-to-agent.md @@ -2,7 +2,7 @@ > **🔶 Cloud-owned — superseded in part by cloud ADR-0025 (2026-06-25).** The in-UI AI runtime and the `ask` / `build` agents described here moved to the **cloud / Enterprise** distribution (`@objectstack/service-ai` → `cloud/packages/service-ai`, closed); the open framework exposes AI only via `@objectstack/mcp` (BYO-AI) and ships no in-product `ask` / `build` chat. Retained as historical design context, now **cloud-owned** — see [`cloud/docs/adr/0025-service-ai-to-cloud-open-mcp-only`](https://github.com/objectstack-ai/cloud/blob/main/docs/adr/0025-service-ai-to-cloud-open-mcp-only.md). -**Status**: Proposed (2026-06-22) +**Status**: Proposed (2026-06-22) — cloud-owned (2026-07-16 audit): the only framework dependency (`skill.surface`) exists; the tool-resolution scoping, global fall-through removal, and bind-time affinity error live in cloud `service-ai` and are not verifiable in this repo. **Deciders**: ObjectStack Protocol Architects **Builds on**: [ADR-0063](./0063-two-kernel-agents-skills-are-the-extension-primitive.md) (two agents bound by surface; skill ↔ agent affinity), [ADR-0033](./0033-ai-assisted-metadata-authoring.md) (draft-gated authoring tools) **Resolves**: [ADR-0040 §4](./0040-unified-assistant-and-agent-binding.md) ("tools are registry-global; a custom agent can change persona but not constrain capability") — the named follow-up contract. diff --git a/docs/adr/0065-sdui-styling-model.md b/docs/adr/0065-sdui-styling-model.md index 0082630d0..33c473b07 100644 --- a/docs/adr/0065-sdui-styling-model.md +++ b/docs/adr/0065-sdui-styling-model.md @@ -1,6 +1,6 @@ # ADR-0065: SDUI styling model — scoped style-objects over arbitrary Tailwind classes -**Status**: Proposed (2026-06-22) +**Status**: Accepted (2026-06-22) — open-mechanism half implemented: `style`/`responsiveStyles` on the spec UI envelope (`page.zod.ts:97,106`), reference scoped-styles compiler + four-property test (objectui `core/src/styling/scoped-styles.ts(.test)`), token/Tailwind lint (`lint/validate-responsive-styles.ts`). Cloud tier-policy + VLM gate remain the cloud half. **Deciders**: ObjectStack Protocol Architects **Builds on**: [ADR-0026](./0026-client-ui-plugin-distribution.md) (client UI distribution), [ADR-0016](./0016-studio-package-authoring-and-publish.md) (package authoring/publish), [ADR-0049](./0049-no-unenforced-security-properties.md) (spec must not promise what the runtime can't deliver) **Consumers**: `@objectstack/spec` (UI component envelope), the objectui renderers (`@object-ui/components`), cloud SDUI page authoring, the AI metadata-authoring agents. diff --git a/docs/adr/0067-commit-history-and-rollback-for-ai-authoring.md b/docs/adr/0067-commit-history-and-rollback-for-ai-authoring.md index 739039038..e7188e6f8 100644 --- a/docs/adr/0067-commit-history-and-rollback-for-ai-authoring.md +++ b/docs/adr/0067-commit-history-and-rollback-for-ai-authoring.md @@ -1,6 +1,6 @@ # ADR-0067: Commit history and rollback for AI authoring — turns become atomic, revertible commits -**Status**: Proposed (2026-06-24) +**Status**: Proposed (2026-06-24) — mostly implemented (2026-07-16 audit): commit grouping (`sys_metadata_commit`), `revertCommit`/`rollbackToPackageCommit`/`listCommits`, REST routes and tests all shipped; **Decision-2 (turn-atomic single-transaction apply, "a commit cannot half-land") is NOT implemented** — publish remains per-item best-effort and commits record partial publishes (`protocol.ts` records over `publishedKeys` after the fact). **Deciders**: ObjectStack Protocol Architects **Builds on / amends**: [ADR-0045](./0045-additive-materialization-and-visibility-gate.md) (**amended**: ADR-0045 keeps a *draft + human-confirm* gate on mutations as the safety mechanism; this ADR replaces *confirm-before* with *revert-after* for everything except irreversible data loss, and unifies the two authoring regimes under one primitive — the commit), [ADR-0027](./0027-metadata-authoring-lifecycle.md) (draft workspace — retained as a *review affordance*, demoted from *safety mechanism*), [ADR-0033](./0033-ai-assisted-metadata-authoring.md) ("AI never publishes — it drafts" → **AI commits; commits are revertible**), [ADR-0034](./0034-transactional-writes-and-ambient-transaction.md) (per-write transaction — **extended to span a whole turn**), [ADR-0038](./0038-build-verification-loop.md) (machine gate — runs per commit, before it lands) **Consumers**: `@objectstack/objectql` (commit grouping, atomic turn-apply, `revertCommit`, history query — built on the existing `sys_metadata_history` + `restoreVersion`), `@objectstack/runtime` + `@objectstack/rest` (commit/revert routes), `../cloud/service-ai-studio` (turn = commit; auto-commit policy; data-loss confirmation), `../objectui` (commit timeline + "revert to here") diff --git a/docs/adr/0076-objectql-core-tiering.md b/docs/adr/0076-objectql-core-tiering.md index 4f3bbd557..5618b0751 100644 --- a/docs/adr/0076-objectql-core-tiering.md +++ b/docs/adr/0076-objectql-core-tiering.md @@ -1,6 +1,6 @@ # ADR-0076: objectql is the data engine — relocate metadata management (protocol) out of it; enforce the boundary; defer the engine repo-split -**Status**: Proposed (2026-06-28, rev. 9) — D1–D12 below. D9 step-1 (interface segmentation) shipped in #2429; OQ#7 resolved (keep `metadata-protocol` name). rev.9 adds **D12 (honest capabilities** — discovery must not report stub/fallback services as real; the analytics fallback + dev stubs are marked honestly, not deleted) and corrects the D10 analytics note (deliberate fallback + `replaceService`, not a collision). — v12 assessment +**Status**: Proposed (2026-06-28, rev. 9) — D1–D12 below. D9 step-1 (interface segmentation) shipped in #2429; OQ#7 resolved (keep `metadata-protocol` name). rev.9 adds **D12 (honest capabilities** — discovery must not report stub/fallback services as real; the analytics fallback + dev stubs are marked honestly, not deleted) and corrects the D10 analytics note (deliberate fallback + `replaceService`, not a collision). — v12 assessment. Verified 2026-07-16: D1 (metadata-protocol extraction + back-compat re-export), D2 (core-boundary ratchet test), D9-step1 (segmented protocol interfaces) confirmed in code; D3 capability/profile contract unbuilt; D12 schema half landed but runtime enforcement missing (`http-dispatcher.ts` `svcAvailable` still hardcodes `status:'available'` for every service); D7/D10/D11-decomposition deferred as designed. **Deciders**: ObjectStack Protocol Architects **Builds on**: [ADR-0005](./0005-metadata-customization-overlay.md) (sys_metadata overlay substrate), [ADR-0025](./0025-plugin-package-distribution.md) (plugin package distribution), [ADR-0033](./0033-ai-assisted-metadata-authoring.md) (open-core boundary), [ADR-0048](./0048-cross-package-metadata-collision.md) (package id is the addressing unit), [ADR-0066](./0066-unified-authorization-model.md) (secure-by-default, posture-gated bypass) **Consumers**: **new** `@objectstack/metadata-protocol` (receives `protocol` + `sys-metadata-repository` + `metadata-diagnostics`), `@objectstack/objectql` (loses protocol → becomes a lean data engine; keeps a back-compat re-export), `@objectstack/metadata-core` (gains the `SysMetadataEngine` interface), `@objectstack/plugin-security`, `@objectstack/plugin-sharing`, `@objectstack/spec`, and out-of-tree embedders — notably `../objectbase` (its `gateway`). diff --git a/docs/adr/0078-no-silently-inert-metadata.md b/docs/adr/0078-no-silently-inert-metadata.md index faddaf07d..eb4a26ef4 100644 --- a/docs/adr/0078-no-silently-inert-metadata.md +++ b/docs/adr/0078-no-silently-inert-metadata.md @@ -1,6 +1,6 @@ # ADR-0078: A Zod-valid metadata instance that is functionally incomplete must fail loudly at author time, uniformly across surfaces (the completeness gate) -**Status**: Proposed (2026-06-28) +**Status**: Proposed (2026-06-28) — philosophy adopted piecemeal, core mechanism unbuilt (2026-07-16 audit): the shared per-type completeness predicate in `@objectstack/spec` and the `validate-functional-completeness` lint do NOT exist; only narrow per-shape applications landed (page `source` refine, form-layout/semantic-roles/widget-bindings lints). The principle is however actively cited and enforced case-by-case (e.g. `bootstrapDeclaredPermissions` closed the `stack.permissions` inert-metadata violation, ADR-0086 D5). **Deciders**: ObjectStack Protocol Architects **Builds on**: [ADR-0049](./0049-no-unenforced-security-properties.md) (enforce-or-remove gate — *property* level), [ADR-0054](./0054-runtime-proof-for-authorable-surface.md) (prove-it-runs gate — *integration* level), [ADR-0038](./0038-build-verification-loop.md) (build → verify → self-correct), [ADR-0032](./0032-unified-expression-layer.md) (validate-by-default, no silent failure), [ADR-0072](./0072-reference-scope-and-resolvability.md) (reference resolvability — the reference-side sibling of completeness) **Sibling**: [ADR-0077](./0077-authoring-surface-boundary-hook-flow-validation.md) — 0077 makes *surface-selection* traps loud (a before-flow can't veto); this ADR makes *instance-completeness* traps loud (a bare summary computes nothing). Same "loud-not-silent, AI-is-the-author" family; orthogonal axis. diff --git a/docs/adr/0080-ai-authored-ui-jsx-source.md b/docs/adr/0080-ai-authored-ui-jsx-source.md index 97a711eaf..96247e2f1 100644 --- a/docs/adr/0080-ai-authored-ui-jsx-source.md +++ b/docs/adr/0080-ai-authored-ui-jsx-source.md @@ -1,6 +1,6 @@ # ADR-0080: AI-authored UI pages — JSX source compiled to the SDUI tree (parse ≠ execute); the component registry is the contract; capability ≠ contract -**Status**: Proposed (2026-06-29) +**Status**: Proposed (2026-06-29) — partially implemented (2026-07-16 audit): `sdui-parser` package (parse≠execute) + codegen + `tier:'public'` flag + page-kind schema + parse-level lint shipped; the save-time authoritative compile→store(`compiledTree`) pipeline and registry-manifest prop/binding validation are NOT wired (the parser is consumed only by `@objectstack/lint`). **Deciders**: ObjectStack Protocol Architects **Builds on**: [ADR-0033](./0033-ai-assisted-metadata-authoring.md) (AI writes metadata via draft-gated `saveMetaItem`), [ADR-0038](./0038-build-verification-loop.md) (agent builds → verifies → self-corrects), [ADR-0046](./0046-package-docs-as-metadata.md) (generated, not hand-maintained, surfaces), [ADR-0048](./0048-cross-package-metadata-collision.md) (package id is the addressing unit; `requires`), [ADR-0058](./0058-expression-and-predicate-surface.md) (one expression language, two backends), [ADR-0063](./0063-two-kernel-agents-skills-are-the-extension-primitive.md) (build agent owns metadata authoring), [ADR-0064](./0064-tool-scoping-to-agent.md) (tool scope by surface), [ADR-0065](./0065-sdui-styling-model.md) (scoped styles — the conflict-free styling channel), [ADR-0067](./0067-commit-history-and-rollback-for-ai-authoring.md) (versioned AI-authored metadata), [ADR-0077](./0077-authoring-surface-boundary-hook-flow-validation.md) (route by intent; verifiability tier = friction tier; loud-not-silent; code is the flagged escape hatch), [ADR-0078](./0078-no-silently-inert-metadata.md) (the completeness gate — valid-but-inert fails loudly) **Consumers**: `@objectstack/spec` (`packages/spec/src/ui/page.zod.ts` — gains a JSX-source page kind + the tree *envelope*; **does not** gain per-component prop schemas), `@objectstack/cli` (`os build` / `os validate` — the save-time parse + validate gate), a **new shared `@objectstack/sdui-parser`** (isomorphic JSX-text → SchemaNode-tree compiler, run server-side authoritative and client-side for preview), `../objectui` `@object-ui/core` (the `ComponentRegistry` `inputs` become the authoritative contract; `getAllConfigs()` is serialized to a manifest) and `@object-ui/react` (`SchemaRenderer` renders the compiled tree, unchanged), the `objectstack-ui` skill (the routing + the curated public block list the build agent composes from)