[objectstack-fleet]

Requested by Leehom · project thread

domain:server#5 · os-project-manager · session_01FEkQ5od974EsY8paGtPt7R

Fixes #31124

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：ADR-0011 的「平台身份动作」附录补记 SCIM connection credentials: add a Setup action for mint and revoke #31032（PR feat(platform-objects): mint and revoke SCIM connection credentials from the console #31119）新增的两个动作：sys_scim_connection_credential.mint_scim_credential 进 H 档（仅人工，无 ai 块），revoke_scim_credential 进 C 档（暴露给 AI，但必须人工确认）。计数按当前 main 的代码树实测重写：已评估动作 61 个、ai 块 37 个（H 24 / C 18 / E 19）。另记一笔：sys_user.list_platform_admins（PR feat(plugin-auth): serve the platform-admin roster from Setup → Users (#28793) #29427，2026-11-02 并入）晚于评估、不在任何档内，按「未评估即仅人工」记入「Not assessed」段。
• 为什么改：这张表是审阅 packages/platform-objects/src/identity/** 的人判断「哪些平台身份动作 AI 能跑」的唯一记录（维护者已否决自动检查）。feat(platform-objects): mint and revoke SCIM connection credentials from the console #31119 合入后表少记了一个已暴露的动作。
• 风险与回滚：只改 ADR 文本，不改任何规则句、不加门禁或测试，不发布任何包（skip-changeset）。回滚即 revert。
• 先看：docs/adr/0011-actions-as-ai-tools.md 一个文件：① 新增的 2026-11-07 amendment 引文块；② H / C 两个列表末尾各加一个名字与计数；③ 「Not assessed」段新增 list_platform_admins 一句。
• 两分钟验证：对照 packages/platform-objects/src/identity/sys-scim-connection-credential.object.ts：mint_scim_credential 无 ai 块，revoke_scim_credential 的 ai 块是 exposed: true, requiresConfirmation: true；pnpm check:adr-index && pnpm check:adr-symbol-anchors 应为 exit 0。
• 需要你做的：Tier H（docs/adr/**）：席位按 CONTRACT_REVIEW_TIER 复核通过后，由你合并。

What changes

One file, docs/adr/0011-actions-as-ai-tools.md, inside the 2026-10-30 addendum "the platform identity actions an agent may reach". No rule text moves; the lists and the counts do.

• A dated amendment note (2026-11-07, ADR-0011 identity-actions addendum: record the two SCIM credential actions (mint H, revoke C) that #31032 adds #31124), in the form the 2026-10-31 amendment already uses in this addendum: sys_scim_connection_credential.mint_scim_credential is assessed H (it mints a SCIM bearer credential and answers it once; triage on SCIM connection credentials: add a Setup action for mint and revoke #31032, comment 6692886264: "Classify mint as not exposed to AI tools") and sys_scim_connection_credential.revoke_scim_credential is assessed C (the same triage: "Revoke may be classified on its own merits"; it switches one bearer off, as sys_api_key.revoke_api_key does, bounded to that one connection, and hands out no credential and widens no access; no door restores a revoked SCIM credential, so provisioning resumes only by minting a new one — head f557345434, from contract review 6710882534). Both shipped in PR feat(platform-objects): mint and revoke SCIM connection credentials from the console #31119, a794e32c9b on main.
• H list 23 → 24 (mint appended); C list 17 → 18 (revoke appended); E unchanged at 19.
• Counts, re-measured on the tree (below): "59 actions and 36 ai blocks (H 23 / C 17 / E 19)" → "61 assessed actions and 37 ai blocks (H 24 / C 18 / E 19); the tree holds one more identity action, unassessed (below)". The two sentences that count the declaring actions move 36 → 37 and 35 → 36 (revoke forwards to /api/v1/auth/admin/scim/revoke-credential, under /api/v1/auth/ like the other 35). The historical reading of the 2026-10-30 assessment ("58 actions in 38 blocks") is untouched; the provenance sentence gains "the two sys_scim_connection_credential actions came with the 2026-11-07 amendment".
• Not assessed gains one sentence: sys_user.list_platform_admins (PR feat(plugin-auth): serve the platform-admin roster from Setup → Users (#28793) #29427, 2026-11-02) postdates the assessment, declares no ai block (its own source comment says so), and is unassessed and human-only until a ruling assesses it. It is placed in no bucket: the H test names minting, ownership, sign-in and destruction, and classifying it is a ruling, not a dev's reading.

Why

The addendum is the only record of which platform sys_* identity actions an AI agent may reach: the maintainer struck the automatic check (「自动检查 有必要吗？每一个元数据应用都有类似的问题，后续都要检查吗」), so a reviewer of identity/** reads this table and nothing else. After PR #31119 it omitted one live AI-exposed action (revoke, C) and one human-only action (mint, H). The card asked for exactly that addendum entry, blocked on #31119 landing; #31119 merged 2026-11-07T14:04Z.

Tests

None added, by the card's ruling: the maintainer struck the automatic check for this table, so this PR adds no gate, test or script. The per-action pins on the two actions' ai blocks landed with #31119 (sys-scim-connection-credential-actions.test.ts) and are not touched.

Acceptance notes

• The card's numbers vs the tree. The card computed H 24 / C 18, 61 actions, 37 ai blocks. The tree at origin/main 658d84f575 holds 62 actions on the 13 identity objects that declare any, 37 with an ai block, 25 without. The 62nd is sys_user.list_platform_admins (PR feat(plugin-auth): serve the platform-admin roster from Setup → Users (#28793) #29427, merged 2026-11-02, after the 2026-10-31 amendment); its source comment reads "No ai block: this action postdates the ADR-0011 identity-actions assessment, and an unassessed action stays human-only." The record therefore says 61 assessed (the card's number) and names the unassessed one beside sys_approval_request's 9, rather than silently folding it into H. Whether it should be assessed H (or E, as a read-only roster answer) is a maintainer ruling; named in the report's open_questions.
• Every other name in the three lists resolves to an action on the tree with the declared bucket (H: no ai block; C: exposed: true, requiresConfirmation: true; E: exposed: true, no confirmation), and no action with an ai block is unexposed. Measured by a throwaway script importing packages/platform-objects/src/identity/index.ts and reading each sys_* object's actions[].ai; the script is not committed.
• No status-line pointer was added. ADR-0011's **Status**: line carries no pointer for the 2026-10-31 amendment either; this addendum's own convention is the dated blockquote, and the card scoped the edit to the lists and counts.
• Two routes under /api/v1/auth/admin/scim/ are plugin-auth's own platform-admin doors (feat(plugin-auth): a platform administrator can mint and revoke SCIM connection credentials #30991), not better-auth's; the existing sentence "N to the better-auth routes under /api/v1/auth/" already counts plugin-auth's admin/sso/* and admin/oauth2/* doors the same way, so only its number moved. plugin-auth's scim-connection-admin.ts header records that an anonymous caller is answered 401 there, which is the behaviour the paragraph describes. Not measured live.
• docs/adr/README.md is generated (pnpm check:adr-index); nothing in it changes, as no ADR title, status or link moved.

Verification

All readings at the final head c53003ae19: the ADR commit 2096b75721 on origin/main 658d84f575, then one merge of origin/main at de3996bd55 (two commits, #31177 and #31185, touching neither the ADR nor identity/**). The 21-gate sweep was run on both heads with the same result; the exit codes below are the final head's.

• node scripts/pm/dispatch-gates.mjs --tier --repo objectstack-ai/objectstack docs/adr/0011-actions-as-ai-tools.md: "Model tier — MANDATORY: claude-fable-5-1 … docs/adr/** … effort floor at xhigh". The claim (6710561423) records the thread's effort as high, a declared deviation with the seat's at-tier contract review as the compensating control.
• node scripts/pm/check-governed-merges.mjs --test docs/adr/0011-actions-as-ai-tools.md: exit 3, "governed-surface predicate: 1 of 1 path(s) hit the register … ⛔ GOVERNED — a human merge is the review record for this PR".
• dispatch-gates --commands derived 21 families from the diff; all 21 run, exit codes captured before any pipe; --ran reconciliation below.

Derived gate sweep at `c53003ae19` (21 families, exit codes captured before any pipe; `dispatch-gates --ran`: 21 derived, 21 run, 0 NOT-MEASURED, 0 UNRUN)

node scripts/check-adr-links.mjs :: exit 0
node scripts/check-adr-links.mjs --self-test :: exit 0
node scripts/check-closing-keyword-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0
node scripts/check-comment-mask-corpus.mjs :: exit 0
node scripts/ci/plan-test-core-shards.mjs --self-test :: exit 0
pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0
pnpm check:adr-anchors :: exit 0
pnpm check:adr-index :: exit 0
pnpm check:adr-symbol-anchors :: exit 0
pnpm check:ci-filter-parity :: exit 0
pnpm check:closed-ceremony-text :: exit 0
pnpm check:cross-package-test-inputs :: exit 0
pnpm check:doc-authoring :: exit 0
pnpm check:driver-memory-census :: exit 0
pnpm check:gitlink-declared :: exit 0
pnpm check:nul-bytes :: exit 0
pnpm check:pm-governed-merges :: exit 0
pnpm check:pm-prior-rulings :: exit 0
pnpm check:refd-timer-probe :: exit 0
pnpm check:watch-hint-literal :: exit 0

• pnpm exec eslint --no-inline-config docs/adr/0011-actions-as-ai-tools.md: exit 0, "File ignored because no matching configuration was supplied" (eslint has no markdown config; the doc gates above are the style authority).
• Control-character self-scan of the file: 0 hits.
• Changed lines: 1 file, +24 / −10 (git diff --shortstat origin/main...HEAD), under the 3000 human-merge threshold.
• Not run: package tests, typecheck, dogfood. The diff touches no package, so no closure build is owed (check:doc-formula-expressions needed @objectstack/formula and @objectstack/lint built, which was done).

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (Not touched.)
• 2. Every name I added uses the casing for its kind. (Action names are quoted as declared.)
• 3. No formatter ran; pnpm lint passes (eslint ignores .md; the derived doc gates pass).
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset: this diff publishes nothing (docs/adr/** only), skip-changeset; both declaration lines are filled in above.
• 6. packages/spec touched: not touched.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English (the 维护者速读 block is the repo's own Chinese reader section; the maintainer's rulings are quoted verbatim).
• The Before Submitting list in CONTRIBUTING.md is done.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FEkQ5od974EsY8paGtPt7R

[objectstack-fleet]

domain:server#5 · os-project-manager · session_01FEkQ5o8PE7ZtVjcor51wBZ

Contract-review-claim: session_01FEkQ5o8PE7ZtVjcor51wBZ · head c53003a · 2026-11-07T17:41Z

[objectstack-fleet]

domain:server#5 · os-project-manager · session_01FEkQ5o8PE7ZtVjcor51wBZ

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: c53003ae1962f591bbe14f551ac25a4c6399c505
Local-runs: none
Scope: docs/adr/0011-actions-as-ai-tools.md + packages/platform-objects/src/identity/sys-scim-connection-credential.object.ts, packages/platform-objects/src/identity/sys-scim-connection-credential-actions.test.ts, packages/platform-objects/src/identity/sys-user.object.ts (list_platform_admins), packages/platform-objects/src/identity/sys-user-platform-admin-roster-action.test.ts, packages/platform-objects/src/identity/sys-api-key.object.ts (revoke_api_key / restore_api_key), packages/platform-objects/src/identity/index.ts and every *.object.ts beside it (the count), packages/plugins/plugin-auth/src/scim-connection-admin.ts, packages/runtime/src/action-execution.ts (systemObjectActionExposureError, actionConfirmationRefusal), docs/adr/0146-studio-designs-setup-administers-one-editor-per-item-paired-customize-package.md (§Status-line pointers), triage comment 6692886264 on #31032

① Derived judgments

• Accept set: unchanged. The PR's file list is one path, docs/adr/0011-actions-as-ai-tools.md, and the GitHub diff is byte-identical to git diff origin/main pr-31209 -- docs/adr/0011-actions-as-ai-tools.md (+24 / -10). No packages/**, no schema, no gate, no test moves, so no accept set of any published package changes. Right.
• Public surface: none. No package is published by the diff; no API-surface or d.ts artifact is touched. The two Check Changeset runs on the head are success with the skip-changeset label. Right.
• What the diff implies about the tree, each checked against the head: (a) sys_scim_connection_credential.mint_scim_credential declares no ai block — true (sys-scim-connection-credential.object.ts, the action carries the bucket-H note and no ai key); (b) revoke_scim_credential declares ai: { exposed: true, description, requiresConfirmation: true } — true; (c) both are type: 'api' forwarding under /api/v1/auth/ (/admin/scim/mint-credential, /admin/scim/revoke-credential) — true, so the "36 to the routes under /api/v1/auth/" and "revoke_api_key to the REST data route" split holds (37 = 36 + 1); (d) sys_user.list_platform_admins exists, declares no ai block, and its source comment reads exactly "No ai block: this action postdates the ADR-0011 identity-actions assessment, and an unassessed action stays human-only." — true (sys-user.object.ts lines 610-612); (e) the two runtime symbols the addendum cites, systemObjectActionExposureError and actionConfirmationRefusal (with the 428 ACTION_CONFIRMATION_REQUIRED refusal), exist on the head in packages/runtime/src/action-execution.ts — true; (f) PR feat(platform-objects): mint and revoke SCIM connection credentials from the console #31119 is merged at a794e32c9b22915a5a03596531b1e2ca9a35efa6 (2026-11-07T14:04Z), an ancestor of origin/main — true; PR feat(plugin-auth): serve the platform-admin roster from Setup → Users (#28793) #29427 merged 2026-11-02 — true. All right.
• Gate verdicts (check-runs on the head, read 2026-11-07 after 17:50Z): 24 success, 25 skipped, 0 failures; one still in_progress: Test Core (1/8). Every docs-facing gate (Check Documentation Links, Lint · docs & code guards and the other Lint/Type Check families, PR-body guards, Governed Surface Queue Guard, Check PR Size, Check Changeset) is green. The dev's 21-family derived sweep matches what the head's check-runs cover; nothing was re-run here.

② Semver level

skip-changeset is right: the diff publishes nothing from any released package (one ADR file). Clause-②: no and Metadata-protocol: none on the PR body match the diff — no spec key, accepted value or metadata type moves, and no refusal is added or removed; the ADR's own text says "No rule text moves", and the hunks bear that out (only the two amendment blockquotes, the three name lists, the count sentences and the Not-assessed paragraph change). No (widening) / (narrowing) arm, so no dogfood battery is owed. Right.

③ Boundary flags

• Dev deviation 1 — thread effort high under the xhigh floor for docs/adr/**. Recorded on the claim (6710561423) by the seat, not changed by the dev; the named compensating control is this at-tier review. Answered: the diff is 24 added lines of record whose every claim is checkable by reading the tree, and this review checked each one (④). No residual.
• Dev deviation 2 — one more name than the card asked for (sys_user.list_platform_admins in Not-assessed). Answered: right. The tree holds 62 actions on 13 identity objects, the card counted 61; recording the 62nd outside every bucket, as the addendum's own rule puts an unassessed action, is the only move that keeps the table complete without the dev ruling a bucket. Silently folding it into H would have been the dev's ruling, and leaving it unnamed would have left the table understating the tree again, which is the drift the card was filed against.
• Dev deviation 3 — eslint ignores .md. Answered: not a gap; the docs gates on the head are the style authority and are green.
• Open question — the bucket of sys_user.list_platform_admins (A leave unassessed / B assess E with an ai block / C assess H). Answered for this PR: A holds. The addendum says a bucket is a maintainer ruling and an unassessed action stays human-only; the action's own source declares the same, and sys-user-platform-admin-roster-action.test.ts pins ai undefined. B or C is a maintainer ruling that lands as a follow-up amendment plus the ai block; nothing in this PR forecloses either. Escalated, not blocking: the seat should put A-vs-B to the maintainer at hand-over (the H test — minting, ownership, sign-in, destruction — names none of what a roster read does, so E is the natural reading if an agent ever needs the roster).
• Out-of-scope note — no Status-line pointer for the amendment. Answered: no finding. ADR-0146's "Status-line pointers" section is the convention for a record amended or superseded in part by ANOTHER ADR (the eight pointers read "Amended by [ADR-0146]" / "Superseded in part by [ADR-0146]"); an ADR's own dated amendment inside its own addendum is not that case, and ADR-0011's 2026-10-31 amendment carries none either. No gate reads a pointer (adr-index.mjs parses the Status keyword and Superseded by only).
• Open-ended flag in the triage (comment 6707830626): "It may also ride that PR if the seat prefers." Moot: PR feat(platform-objects): mint and revoke SCIM connection credentials from the console #31119 landed first and the record follows it, as the card's "Blocked by" required.

④ Design judgment

docs/adr/0011-actions-as-ai-tools.md — an ADR addendum amendment, judged against its first consumer (the two actions on sys-scim-connection-credential.object.ts and the test that pins them) and its execution plan (the addendum's own rule: the table is the only record a reviewer of identity/** reads, so it must match the tree). Every number and quotation was verified on the PR head by reading the tree (git show pr-31209:... and a text parse of the actions: [...] blocks of all 33 *.object.ts files under identity/; nothing was built, imported or executed).

• Counts, verified against the tree: 13 of the 33 identity objects declare actions; 62 actions; 37 ai blocks; 25 without an ai block; 18 exposed + requiresConfirmation; 19 exposed without confirmation; 0 ai blocks that are unexposed. Set comparison of the amended lists against the tree: H lists 24 names = tree's 25 minus sys_user.list_platform_admins (the one the Not-assessed paragraph names); C lists 18 = 18; E lists 19 = 19; no ADR-only name, no duplicate. So "61 assessed actions and 37 ai blocks (H 24 / C 18 / E 19); the tree holds one more identity action, unassessed" is exact, and "the one identity action that postdates the assessment and is in no bucket above" is exact (it is the only unlisted one).
• The 36 → 37 and 35 → 36 sentences: all 37 E+C actions are type: 'api'; 36 forward to targets under /api/v1/auth/ and the one exception is sys_api_key.revoke_api_key → /api/v1/data/sys_api_key/{id}. Both moved sentences are right. The "better-auth routes" wording is pre-existing imprecision (the two SCIM mounts, like admin/sso/* and admin/oauth2/toggle-disabled already counted there, are plugin-auth's own platform-admin doors); the behaviour the paragraph records holds for them too: scim-connection-admin.ts says the judgePlatformAdmin gate runs before the module reads anything and an anonymous caller is answered 401. Not a finding.
• Quoted triage lines: "Classify mint as not exposed to AI tools" and "Revoke may be classified on its own merits" are verbatim in comment 6692886264 on SCIM connection credentials: add a Setup action for mint and revoke #31032 (os-zhuang's triage, 2026-11-06). a794e32c9b is PR feat(platform-objects): mint and revoke SCIM connection credentials from the console #31119's merge commit on origin/main. The 2026-10-31 amendment, the "58 actions in 38 blocks" history and the maintainer's struck-check quotation are untouched.
• Bucket judgments against the ADR's own tests: mint H — "it mints a credential" is the first H test word for word, and the first consumer agrees (the object's note, and sys-scim-connection-credential-actions.test.ts refuses any ai.exposed on mint). Revoke C — a destructive lifecycle act with no credential handed out and no privilege widened, bounded to one connection; revoke_session (also irreversible) sits in C on the same reading, and the consumer test pins { exposed: true, requiresConfirmation: true }. Both hold.
• should-fix — the revoke reason's analogy. The amendment reads "switches one bearer off and cannot be undone, as sys_api_key.revoke_api_key does". On the head, revoke_api_key CAN be undone: sys_api_key.restore_api_key is in the H list of this same addendum, and revoke_api_key's own ai.description says "It can be restored later." The object's source comment makes the comparison only for "switches one bearer off" (naming revoke_api_key and revoke_session); the ADR's sentence attaches it to "cannot be undone" as well, which is false of the API key and contradicts the H list a few lines above. One-sentence fix: "switches one bearer off, as sys_api_key.revoke_api_key and sys_session.revoke_session do; it cannot be undone and its reach is that one connection, so it is C under the bounded arm." The lists, counts and buckets — the record — are unaffected, so this does not fail the PR.
• Noted, no finding: the addendum's opening sentence still says the actions "on the twelve identity objects" were assessed; thirteen objects now declare actions. The sentence describes the 2026-10-30 assessment and is not touched by this diff; the 2026-11-07 amendment names the thirteenth object explicitly, so a reader is not misled.
• No sibling record goes stale: a sweep of docs/, content/, AGENTS.md, .claude/ and package sources for "59 actions", "36 ai blocks", "H 23", "36 E and C", "All 36 are", "35 to the better-auth" finds no other carrier of the old counts; ADR-0066 D4's 2026-10-30 note cites the mechanism, not the count.

Implemented-by: claude/project-thread-k4cw5k
Reviewed-by: session_01FEkQ5o8PE7ZtVjcor51wBZ

VERDICT: PASS

[objectstack-fleet]

domain:server#5 · os-project-manager · session_01FEkQ5o8PE7ZtVjcor51wBZ

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: f557345434c357fb35dd8d176ed77428bd3583d6
Local-runs: none
Scope: docs/adr/0011-actions-as-ai-tools.md + packages/plugins/plugin-auth/src/scim-connection-admin.ts (the revoke mount's 409), packages/plugins/plugin-auth/src/scim-connection-service.ts (mintScimConnectionCredential, revokeScimConnectionCredential), packages/platform-objects/src/identity/sys-scim-connection-credential.object.ts (apiMethods, managedBy, the revoke confirmText), packages/platform-objects/src/identity/sys-api-key.object.ts (revoke_api_key / restore_api_key), every non-test writer of sys_scim_connection_credential on the head (swept)

① Derived judgments

• Delta review over record 6710882534 (the PASS on c53003ae1962f591bbe14f551ac25a4c6399c505, posted 2026-11-07T17:47Z). The new head adds one commit, f5573454 "docs(adr): ADR-0011 amendment note grounds revoke_scim_credential's C bucket on boundedness", and git diff c53003ae…pr-31209-b is one file, docs/adr/0011-actions-as-ai-tools.md, +4 / -2, confined to the 2026-11-07 amendment blockquote. Every judgment of 6710882534 outside that blockquote stands unchanged: no identity object, test, gate or script moves between the two heads, so the lists (H 24 / C 18 / E 19), the count sentences (61 assessed / 37 ai blocks; 37 and 36), the Not-assessed paragraph and the quoted triage lines are as verified there. The PR's file list is still one path; the GitHub head is f557345434…, still draft, labels unchanged.
• Accept set and public surface: unchanged and none. The delta publishes nothing and changes no rule text; it rewrites the reason sentence of one amendment. Right.
• Gate verdicts (check-runs on the new head, read within minutes of the push): 37 runs so far — 6 success (filter, Check PR Size, Check Changeset, Check Documentation Links, PR-body guards, Governed Surface Queue Guard), 16 skipped, 0 failures, and 15 in_progress: every Lint and Type Check family (Lint · ESLint, Lint · docs & code guards, Lint · repo & tooling gates, Lint · CI, release & engine gates, Lint · PM dispatch-gates, the three Lint · scoped jobs, Type Check · workspace / source gates / consumer gates / debt ledger), Plan Test Core shards, Dogfood Regression Gate, Auto Label; the Test Core shards had not been planned yet. On the prior head the same families all completed green with Test Core (1/8) the last in flight; the delta is prose in one ADR, so nothing in it can turn a family that was green. The seat should confirm green before landing.

② Semver level

Unchanged from 6710882534: skip-changeset is right for a docs-only diff that publishes nothing; Clause-②: no and Metadata-protocol: none on the PR body still match (Check Changeset is success on the new head). Right.

③ Boundary flags

• The should-fix of 6710882534 ("cannot be undone, as sys_api_key.revoke_api_key does" attached irreversibility to an action the same H list shows is restorable): answered by the delta. The comparison to revoke_api_key now attaches only to "switches one bearer off", the bounded arm of the C test is stated ("bounded to that one connection"), and the irreversibility claim is grounded on the tree rather than on an analogy. Closed.
• The dev's measurement claim ("no door restores a revoked SCIM credential; the revoke door answers 409 on an already-revoked row; the only active: true write is the mint"): verified on the head, see ④. The dev's account was not relied on.
• No new dev flag, deviation or open question is raised by the delta; the open question on sys_user.list_platform_admins and the other flags answered in 6710882534 stand as answered there (A holds for this PR; A-vs-B is the maintainer's to rule at hand-over).

④ Design judgment

docs/adr/0011-actions-as-ai-tools.md — the rewritten reason sentence of the 2026-11-07 amendment, judged against the code it now cites.

• "it switches one bearer off, as sys_api_key.revoke_api_key does" — true and now correctly scoped: revokeScimConnectionCredential (scim-connection-service.ts, line 365) is engine.update(SCIM_CREDENTIAL_OBJECT, { id, active: false }) on the one row; revoke_api_key's own ai.description describes the same switch-off ("every client using it loses access immediately. It can be restored later"), and the sentence no longer claims the API key is irreversible.
• "bounded to that one connection" — true: a credential row carries one connection_id (object field, required: true), the revoke writes that one row, and verifyScimBearerToken refuses on active per row (service lines 299-301). This is the "bounded" arm of the ADR's own C test, so the bucket is now grounded in the test's words rather than by analogy.
• "the revoke door answers 409 on one already revoked" — true: scim-connection-admin.ts line 387-388, if (outcome.outcome === 'already_revoked') return fail(409, 'RESOURCE_CONFLICT', …'is already revoked; nothing changed'); the service reports already_revoked for any row not affirmatively active (lines 360-362) and does not write it again.
• "the only write of active: true is the mint" — true on the head: the single active: true in plugin-auth is the engine.insert inside mintScimConnectionCredential (service line 256); the only other write to the object anywhere in non-test package sources is the revoke's active: false (swept every non-test site naming sys_scim_connection_credential / SCIM_CREDENTIAL_OBJECT: translations, constants, CLI inventory, comments, and these two). The generic data path cannot flip it either: the object declares managedBy: 'engine-owned' and enable.apiMethods: ['list']. No restore action exists on the object, and the object's revoke confirmText says the same ("This cannot be undone: to restore provisioning, mint a new credential").
• "so provisioning resumes only by minting a new one" — follows from the above and matches the mount header's "Rotation is not a third operation" paragraph.
• Shape: the blockquote keeps its "Amended (2026-11-07, ADR-0011 identity-actions addendum: record the two SCIM credential actions (mint H, revoke C) that #31032 adds #31124 …)" opener and "The lists below are the amended record." closer; the mint sentence and both triage quotations are untouched; the paragraph introduces no tracker number beyond those already there and no angle-bracket or tag-shaped fragment. Nothing elsewhere in the file changes.
• No must-fix and no new should-fix. The "twelve identity objects" historical sentence noted in 6710882534 remains as noted there, not a finding.

Implemented-by: claude/project-thread-k4cw5k
Reviewed-by: session_01FEkQ5o8PE7ZtVjcor51wBZ

VERDICT: PASS

[objectstack-fleet]

domain:server#5 · os-project-manager · session_01FEkQ5o8PE7ZtVjcor51wBZ

维护者速读

• 改了什么：ADR-0011「平台身份动作」附录补记 SCIM connection credentials: add a Setup action for mint and revoke #31032（PR feat(platform-objects): mint and revoke SCIM connection credentials from the console #31119）新增的两个 SCIM 凭据动作：mint_scim_credential 进 H 档（仅人工，无 ai 块），revoke_scim_credential 进 C 档（暴露给 AI，但必须人工确认），并写明它进 C 档的理由：只关掉一个凭据、不发凭据也不扩权限，且吊销后没有任何入口能恢复。计数按当前 main 实测重写：已评估 61 个、ai 块 37 个（H 24 / C 18 / E 19）。
• 为什么改：这张表是审阅 packages/platform-objects/src/identity/** 时判断「哪些平台身份动作 AI 能跑」的唯一记录（自动检查已被否决）。feat(platform-objects): mint and revoke SCIM connection credentials from the console #31119 合入后表里少了这两个动作。
• 风险与回滚：只改一个 ADR 文件（+26/−10），不改规则句、不加门禁、不发布包（skip-changeset）。回滚即 revert。
• 先看：docs/adr/0011-actions-as-ai-tools.md：新增的 2026-11-07 amendment 引文块；H / C 两个列表末尾的新名字与计数；「Not assessed」段新增的 list_platform_admins 一句。
• 两分钟验证：对照 packages/platform-objects/src/identity/sys-scim-connection-credential.object.ts：mint_scim_credential 无 ai 块，revoke_scim_credential 的 ai 是 exposed: true, requiresConfirmation: true。
• 需要你做的：批准或直接合并本 PR（Tier H，docs/adr/**）。Fable 契约复审 PASS 6711023559，Head-sha f557345434。另有一个可选裁决：sys_user.list_platform_admins（PR feat(plugin-auth): serve the platform-admin roster from Setup → Users (#28793) #29427）晚于评估，本 PR 记为「未评估 = 仅人工」；席位建议保持这样，要归档请另开卡。

席位意见：建议批准。表与代码一致，第一轮复审指出的类比错误（拿可恢复的 API key 吊销作比）已改为按「有界、不可恢复」立论，增量复审确认没有入口能恢复已吊销的 SCIM 凭据。

席位核对 — ACCEPT · domain:server#5 · Head-sha f557345434c357fb35dd8d176ed77428bd3583d6 · 2026-11-07T18:12Z

• Shape: 1 file, docs/adr/0011-actions-as-ai-tools.md, +26/−10, read from the diff. Commits: 2096b75721 (addendum), c53003ae19 (merge of origin/main), f557345434 (amendment note reworded per review S1).
• Premise measured: Blocked-by: #31032 closed (PR feat(platform-objects): mint and revoke SCIM connection credentials from the console #31119 merged). On main the two actions' ai blocks are as the addendum states; counts are the dev's re-measure, confirmed by the at-tier review.
• Review: CONTRACT_REVIEW_TIER (fable) full review PASS 6710882534 on c53003ae19, one should-fix (the revoke_api_key analogy: that key is restorable). Fixed in f557345434; delta review PASS 6711023559 on this head, which checked that no door restores a revoked SCIM credential. No must-fix open.
• Gates: head check-runs 26 success, 19 skipped, none red or pending. check-expected-skips: OK, all 19 in main's roster (exit 0). check-governed-merges: GOVERNED, docs/adr/** ×1, Tier H, 36 changed lines ≤ 3000. The dev's dispatch-gates --commands: 21 run, all exit 0. Mergeable state clean.
• Accepted deviation: the card thread ran at the thread default effort, not the xhigh floor of a fable-tier card (recorded in the claim); compensating control is the at-tier review above.
• Out of scope: list_platform_admins left unassessed, recorded in the ADR; bucketing it is a maintainer call (see 速读). Clause-②: no, Metadata-protocol: none, Skills-docs: n/a. skip-changeset (docs only).
• Landing: Tier H, Fixes #31124. pm:awaiting-merge; reviewers os-zhuang and hotlong requested. Lands by the maintainer's merge, or through the queue after an authorized APPROVED review.