[objectstack-fleet]

Requested by Warren · project thread

Refs objectstack-ai/cloud#4029

维护者速读

• 问题：文档站有 4 个页面说审计日志"不可变（immutable）"，比实测的保证宽。
• 实测的保证：审计行不能通过数据接口（data API）或在 Setup 里编辑、删除（cloud#4016）。
• 修法：英文页改成这句；reference/security.mdx 加一句"防篡改证明（tamper-evidence）规划中"，不给日期。
• 译文：按翻译流程第 3 步删掉 3 个改动页面的 ja / zh-Hans 译文，zh-Hant 由 gen:zh-hant 重新生成（随之删除）；没有手改任何译文。
• 两分钟验证：grep -rn immutab content/docs --include='*.mdx'，审计相关的命中应为零，剩下的都是"已发布的制品 / 版本不可变"。
• 需要你做的：无，席位落地。

What changes

English pages, using the wording recommended in cloud#4025 docs/design/audit-tamper-evidence.md §7:

Page	Before	After
reference/security.mdx L129	"Audit rows are immutable: cannot be modified, only archived."	"Audit rows cannot be edited or deleted through the data API or in Setup. A verifiable proof that rows were not changed or removed (tamper-evidence) is planned."
reference/security.mdx HIPAA row	"audit controls (§164.312(b)), integrity (immutable audit)"	"audit controls (§164.312(b): the audit log; tamper-evidence planned)" — §7's replacement folded into the existing audit-controls item so the row does not name it twice
operate/audit-logs.mdx L4 (description), L8	"the immutable audit trail", "the immutable record"	"the audit trail", "the record"
operate/audit-logs.mdx L27	"read-only and immutable — an append-only trail of platform events … nothing can edit or delete them from Setup."	"read-only. … nothing can edit or delete them from Setup or through the data API."
operate/audit-logs.mdx L105	"back the immutability up at the storage layer"	"add protection at the storage layer" (rest of the callout unchanged)
operate/index.mdx L27	"Read the immutable audit trail …"	"Read the audit trail …"
build/interface/actions.mdx L216	"sys_audit_log, an immutable trail"	"sys_audit_log, a read-only trail"

Translation step 3 (AGENTS.md § Translation workflow): an English correction that removes a capability assertion deletes the page's locale siblings in the same PR. Deleted: ja and zh-Hans of operate/audit-logs, operate/index and build/interface/actions; pnpm --filter @objectos/docs gen:zh-hant then pruned the three zh-Hant files. reference/security.mdx has no siblings. No locale file is modified.

Grep for "immutable" in English content

grep -rniE immutab content/docs --include='*.mdx', English sources only; line numbers are main's before the change:

• About the audit log, all changed here: operate/audit-logs.mdx L4, L8, L27, L105; operate/index.mdx L27; reference/security.mdx L129, L148; build/interface/actions.mdx L216. None left.
• About published artifacts, versions or backup snapshots, left as they are (a different claim): deploy/docker.mdx L117, operate/upgrade.mdx L48, operate/backup.mdx L17, L102, L121, reference/environment-variables.mdx L126, build/marketplace.mdx L122, resources/glossary.mdx L40, configure/runtime.mdx L36, cloud/apps.mdx L113.

Also read and kept (line numbers at the PR head): "append-only" in reference/security.mdx L258 (sys_ai_audit_log gets one row per tool event) and the storage-layer advice in operate/observability.mdx L109 and operate/audit-logs.mdx L105 describe how rows are written or what an operator can add, not a guarantee that rows never change.

Gates

Run in the worktree at 6385584:

node apps/docs/scripts/gen-zh-hant.mjs --check :: exit 0
node .github/scripts/check-translations.mjs :: exit 0
node .github/scripts/check-translation-ownership.mjs --actor objectstack-fleet[bot] :: exit 0
TRANSLATION_BOT_LOGIN=<probe> node .github/scripts/check-translation-ownership.mjs --actor objectstack-fleet[bot] :: exit 0   (enforced: "9 translation artifact(s) deleted, none added or modified")
node .github/scripts/check-translation-output.mjs --files :: exit 0
pnpm --filter @objectos/docs build :: exit 0
pnpm check:positioning :: exit 0
pnpm check:locale-surface :: exit 0

Acceptance notes

• The companion cloud PR narrows docs/enterprise/security-questionnaire.md §5.1 the same way and carries Closes #4029.
• Nothing here says tamper-evidence, a verify command or write-once storage exists; the only mention is "planned" (cloud#3823, 对外口径). The a/b/c ruling on cloud#4016 does not change this wording.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JQwxbZ4kktRMDFTUzkwMuU

[objectstack-fleet]

repo:cloud#3 · os-warren · session_01JQwxbZqfEd7pcckjz3pGqn

席位核对

ACCEPT · head 6385584 · repo:cloud#3 · TIER_DEFAULT seat review (2026-11-09T04:41Z; English edits in reference/security.mdx, operate/audit-logs.mdx, operate/index.mdx, build/interface/actions.mdx; the ja / zh-Hans / zh-Hant siblings of the three pages that have them deleted)

1. Shape: draft → main, Refs objectstack-ai/cloud#4029, 维护者速读 present.
2. Wording matches the measurement (cloud#4025 §2.1 / §7): "cannot be edited or deleted through the data API or in Setup". Tamper-evidence says only "planned", with no date. No public line describes any other way a row changes. "Immutable" for published artifacts and versions is untouched. The two deviations are reasonable: the HIPAA row folds §7 into the existing audit-controls item, and L105's storage-layer line drops "immutability" because it was a grep hit on an in-scope page.
3. Translation step 3: the siblings of actions, audit-logs and index are deleted (9 files, none modified). reference/security.mdx has no sibling at origin/main. gen:zh-hant --check and the three translation checks exit 0.
4. Gates (thread, gates-4029.txt): docs build, positioning and locale-surface exit 0. CI runs on the ready run.
5. Landing: not governed → pr_ready → automerge_enable on green. cloud#4029 closes with cloud#4031 after this deploy and smoke check are green.