[objectstack-fleet]

Requested by Steedos · project thread

Fixes #31452

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:ADR-0011 身份动作清点里"另有 1 个未评估身份动作"改为 2 个,并在「Not assessed」段同时点名 sys_user.list_platform_admins 与新增的 sys_sso_provider.edit_sso_sign_in_options(PR feat(plugin-auth,platform-objects): per-provider SSO sign-in options; invite_only refuses an uninvited SSO sign-in unless the provider allows JIT #31448)。
• 为什么改:PR feat(plugin-auth,platform-objects): per-provider SSO sign-in options; invite_only refuses an uninvited SSO sign-in unless the provider allows JIT #31448 落地后,SSO 登录选项动作上线且未带 ai 块,ADR 仍写"唯一一个",清点与代码不符。
• 风险与回滚:仅改 ADR 文字两处,不动代码、不评估新动作;回滚即 revert 本 PR。
• 先看:docs/adr/0011-actions-as-ai-tools.md 第 372–373 行与第 379–383 行。
• 两分钟验证:grep -n "two more identity\|edit_sso_sign_in_options" docs/adr/0011-actions-as-ai-tools.md,应见清点句写 two,「Not assessed」段列出两个动作。
• 需要你做的:作为受管审批人审阅并批准此 draft PR(docs/adr/** 属 Tier H)。

What changes

• docs/adr/0011-actions-as-ai-tools.md, 2026-10-30 addendum: the census line now says the tree holds two more identity actions, unassessed, and the "Not assessed" paragraph names both — sys_user.list_platform_admins (PR feat(plugin-auth): serve the platform-admin roster from Setup → Users (#28793) #29427, 2026-11-02) and sys_sso_provider.edit_sso_sign_in_options (PR feat(plugin-auth,platform-objects): per-provider SSO sign-in options; invite_only refuses an uninvited SSO sign-in unless the provider allows JIT #31448, 2026-11-08) — as human-only, with no ai block, until a ruling assesses them.
• No assessment of the new action (that is a maintainer ruling). No code change. The H/C/E buckets and the "37 ai blocks" count are unchanged and still match the tree.

Tests

Recount from the tree (main 158cc2aa plus this branch), by importing packages/platform-objects/src/identity/index.ts and walking every exported object's actions:

• 63 identity actions in the tree, 37 with an ai block, 26 without.
• The 61 names in the H/C/E buckets all exist in the tree; the tree holds exactly two names in no bucket: sys_sso_provider.edit_sso_sign_in_options and sys_user.list_platform_admins, both without an ai block. No third unassessed identity action.

Acceptance notes

• docs-only, publishes nothing: skip-changeset.

Verification

Derived gates — 21/21 exit 0 on head 2b0213e

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 21 commands for this diff; each ran with its exit code captured before any pipe, all exit 0, and --ran reconciled 21 derived, 21 run, 0 NOT-MEASURED (a derived zero). Prerequisite: turbo run build for @objectstack/spec, @objectstack/formula, @objectstack/lint.

---

Generated by Claude Code

[objectstack-fleet]

domain:skills#3 · zhuangjianguo · session_01QsR2jULfPnqQFGcZUtKDFH

Contract-review-claim: session_01QsR2jULfPnqQFGcZUtKDFH · head 2b0213e · 2026-11-08T17:06Z

The lane seat's isolated Fable reviewer runs the CONTRACT_REVIEW_TIER review (maintainer 2026-11-08 16:12Z 「有 fable 车道就可以契约复审啊」); the director seat is off duty.

[objectstack-fleet]

domain:skills#3 · zhuangjianguo · session_01QsR2jULfPnqQFGcZUtKDFH

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 2b0213ee5d2c2873ad1bcddc8f1a442b6538b202
Local-runs: none
Scope: docs/adr/0011-actions-as-ai-tools.md + none

Inputs read: card #31452 (body and all 5 comments: triage 6719510887, unblock 6721712913, claim 6724128988, dev report 6724386079, claim amendment 6724414481), PR #31616 (body, file list, net diff origin/main...2b0213ee: one file, +6/-5), the 45 check-runs on 2b0213ee. The live tree was read at origin/main 133f75ae; main has not moved on docs/adr/0011-actions-as-ai-tools.md or packages/platform-objects/src/identity/ since the merge base 95df3459.

① Derived judgments

• Face: docs/adr/** is a governed register row, so the rules face and CONTRACT_REVIEW_TIER; reviewFace hits = docs/adr/0011-actions-as-ai-tools.md alone. Right.
• Accept-set and public surface: the diff touches no package source, no schema, no ai declaration; the 37 ai blocks the ADR counts are the 37 the tree declares (census below), so no action's exposure, confirmation or listing over MCP changes. No accept-set change, no public-surface change. Right.
• The diff implies no implementing file: the ADR's own "No automatic check" paragraph makes the reviewer of packages/platform-objects/src/identity/** its first consumer, and no gate enforces the census. + none is right.
• Gate verdicts are the head's check-runs, not the body's "21/21": 45 check-runs on 2b0213ee, every one success or skipped (Test Core (1/8) was in_progress on the first read and success on the second); Governed Surface Queue Guard, Check Changeset, Check Documentation Links, PR-body guards and Lint · PM dispatch-gates all success. Right.
• The head is a merge of origin/main (3 commits) over the one docs commit 91c6fc7a; the net diff against main is still the one file, so the merge carries nothing of its own. Right.

② Semver level

Docs-only; no released package moves; skip-changeset label present and no .changeset/ file in the diff — matches AGENTS.md §3 ("that label is for a diff that publishes nothing from any released package"). Right.
Clause-②: Clause-②: no and Metadata-protocol: none, line-initial in the PR body, agree with the diff (no key, value or meaning an author can write changes). No changeset body exists to carry a second copy, which is what skip-changeset means. Right.

③ Boundary flags

• Dev report open_questions: [] — nothing to answer.
• Deviation "merged origin/main before pr_create (common rule 8)": judged on the tree, the merge adds nothing to the net diff. Accepted.
• Deviation "PR not assigned, no reviewers requested": landing is Tier H, the maintainer's hand or a GOVERNED_APPROVERS review; this record does not lift it and is not an approval. Nothing for this record to do.
• Dev report "check-closing-keyword-parity --body exit 2": per that script's exit register (scripts/check-closing-keyword-parity.mjs L79-90), 2 means "at least one parser binds — the body declares a close", not a failure; the close is Fixes #31452, the card this PR serves, and the head's PR-body guards check-run is success. Answered.
• Claim amendment 6724414481: the build ran at opus under the maintainer's standing rule and the CONTRACT_REVIEW_TIER review was to run on the lane's isolated Fable reviewer before any approval is asked. This record is that review.
• Card's "Expected" offered two routes (name both unassessed actions, or a maintainer ruling assesses the new one into a bucket). The PR takes the first and leaves the assessment to the maintainer, as the card's "No code change" and the ADR's H row ("no ... without a maintainer ruling that names the action") require. Right route for a seat.

④ Design judgment

docs/adr/0011-actions-as-ai-tools.md — judged against its first consumer (a reviewer of packages/platform-objects/src/identity/** reading the table) and the live tree it describes.

Census of the live tree (every *.object.ts under packages/platform-objects/src/identity/, each actions: [...] entry's name and whether the entry carries an ai: key): 63 actions, 37 with an ai block, 26 without. All 61 names in the H/C/E lists exist in the tree. The 37 ai-bearing names are exactly the C (18) + E (19) lists. Exactly two tree actions are in no bucket: sys_sso_provider.edit_sso_sign_in_options (sys-sso-provider.object.ts L261-285, no ai key, its own comment says "No ai block") and sys_user.list_platform_admins (sys-user.object.ts L612, no ai key; sys-user-platform-admin-roster-action.test.ts L61-63 pins ai undefined). No third unassessed identity action. The dev report's recount (63 / 37 / 61 / 2) is independently confirmed.

Sentence by sentence against the tree:

• "61 assessed actions and 37 ai blocks (H 24 / C 18 / E 19)" — unchanged and true: 24+18+19 = 61, 18+19 = 37.
• "the tree holds two more identity actions, unassessed (below)" — true: 63 − 61 = 2, both named in the paragraph it points to.
• "sys_user.list_platform_admins (PR feat(plugin-auth): serve the platform-admin roster from Setup → Users (#28793) #29427, 2026-11-02)" — PR feat(plugin-auth): serve the platform-admin roster from Setup → Users (#28793) #29427 merged 2026-11-02T16:02Z (92b7bbd1). True.
• "sys_sso_provider.edit_sso_sign_in_options (PR feat(plugin-auth,platform-objects): per-provider SSO sign-in options; invite_only refuses an uninvited SSO sign-in unless the provider allows JIT #31448, 2026-11-08)" — PR feat(plugin-auth,platform-objects): per-provider SSO sign-in options; invite_only refuses an uninvited SSO sign-in unless the provider allows JIT #31448 merged 2026-11-08T12:49Z (b70d9aa6), on main at the merge base. True.
• "the two identity actions that postdate the assessment and are in no bucket above" — the qualifier "in no bucket above" correctly excludes the two sys_scim_connection_credential actions, which also postdate 2026-10-30 but were bucketed by the 2026-11-07 amendment. True.
• "no ai block, human-only, until a ruling assesses them" — both carry no ai key, so neither is listed or runnable over MCP (systemObjectActionExposureError); the ADR does not place the new action into H, which the H row reserves to a ruling. Agrees with the contract.

Attempts to break it: (a) could a sys_* action with no ai block live outside the identity directory and belong to this census? The addendum's scope is "the twelve identity objects in packages/platform-objects/src/identity/" and the only other sys_* action set, sys_approval_request (plugin-approvals), is already named as outside it. No. (b) Does the source comment at sys-sso-provider.object.ts L275-276 ("stays human-only (ADR-0011 bucket H's test)") contradict the ADR's "unassessed"? No: it cites H's test as its reason for declaring no ai block; it does not claim a bucket placement, and the ADR, correctly, records the action as unassessed until a ruling. Same effect either way (no ai block). Code outside the diff, read not reviewed; no finding. (c) Does main drift make the count stale again? No commit on origin/main since the merge base touches the ADR or the identity directory.

Findings:

• nit (outside the diff hunks, prose face, follow-up at the seat's option): the addendum's "the twelve identity objects" (L317-318) predates the 2026-11-07 amendment; the tree's actions-bearing identity objects now number 13 (sys_scim_connection_credential added). Not introduced by this PR, no effect on this diff's correctness or on the contract; left as a follow-up card, not a fix on this head.

No must-fix. No should-fix.

Implemented-by: claude/project-thread-u58tk6
Reviewed-by: session_01QsR2jULfPnqQFGcZUtKDFH

VERDICT: PASS

[objectstack-fleet]

domain:skills#3 · zhuangjianguo · session_01QsR2jULfPnqQFGcZUtKDFH

维护者速读

• 改了什么：ADR-0011 的身份动作清点里，「另有 1 个未评估的身份动作」改成 2 个；「Not assessed」段同时点名 sys_user.list_platform_admins（PR feat(plugin-auth): serve the platform-admin roster from Setup → Users (#28793) #29427）和 SSO 的 sys_sso_provider.edit_sso_sign_in_options（PR feat(plugin-auth,platform-objects): per-provider SSO sign-in options; invite_only refuses an uninvited SSO sign-in unless the provider allows JIT #31448）。
• 为什么改：PR feat(plugin-auth,platform-objects): per-provider SSO sign-in options; invite_only refuses an uninvited SSO sign-in unless the provider allows JIT #31448 上线了 SSO 登录选项动作，它没有 ai 块、只能人用，可 ADR 还写着「唯一一个」未评估动作，清点和代码对不上。
• 风险与回滚：只改 ADR 两处文字，不动代码，也不替新动作做评估（评估仍归你裁）。回滚即 revert 本 PR。
• 先看：docs/adr/0011-actions-as-ai-tools.md 第 372–373 行（清点句）和第 379–383 行（Not assessed 段）。
• 两分钟验证：grep -n "two more identity\|edit_sso_sign_in_options" docs/adr/0011-actions-as-ai-tools.md，应见清点句写 two，Not assessed 段列出两个动作。
• 需要你做的：批准本 PR（Approve review）。契约复审 PASS 记录是评论 6724527824，Head-sha 2b0213ee5d2c2873ad1bcddc8f1a442b6538b202；批准后由席位落地。
• 席位意见：ACCEPT。席位自己读了 diff，复审从身份目录全部对象重新数过：63 个动作、37 个带 ai 块，61 个在 H/C/E 三档里，恰好剩这两个不在任何档，没有第三个。

席位核对

Head-sha: 2b0213ee5d2c2873ad1bcddc8f1a442b6538b202

1. Shape: draft, base main, body Fixes #31452, skip-changeset (docs only, publishes nothing). 1 file, +6/−5. check-governed-merges --pr 31616: docs/adr/**, Tier H, 11 lines.
2. Premise measured: on main the ADR counted one unassessed identity action while edit_sso_sign_in_options sat in the tree with no ai block (seat read, claim 6724128988). The Fable contract review recounted the live tree independently (record 6724527824).
3. Gates: dev gates 21 derived / 21 run, all exit 0. Check-runs on this head: 26 success, 20 skipped, 0 failure, 0 running.
4. Accepted deviations: none in the diff. Model: built on opus under the standing no-Fable-build rule, reviewed at CONTRACT_REVIEW_TIER on the lane's Fable reviewer (claim amendment 6724414481).
5. Out of scope / Skills-docs: the review's nit, ADR L317–318 "the twelve identity objects" predating the 2026-11-07 amendment (13 now), is outside this diff; it is left for a follow-up and not fixed on this head. Metadata-protocol: none, so no Skills-docs: line is owed.
6. Landing: Tier H. pm:awaiting-merge + reviewers os-zhuang, hotlong; stays draft until an authorized approval or a maintainer merge.