docs(skills): the object enable table names aiReadable - #33458

domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 555603e2abcdec56e5b4574f657c528e93b9d2dc
Local-runs: none
Scope: skills/objectstack-data/SKILL.md + none

① Derived judgments

• Accept set: none changed. The diff touches no schema, no gate and no runtime code: one row in the published skill and one changeset. Net diff against the merge base ba35dfd7: 2 files, +11 / -0.
• Public surface: the published @objectstack/skills catalog now teaches enable.aiReadable in the object enable table. Right: the key is live on main (ObjectCapabilities.aiReadable in packages/spec/src/data/object.zod.ts, read by isAiReadExposed), and until now the published table did not teach it.
• Implementing files in the diff: none. The row describes code outside the diff (packages/spec/src/data/ai-read-exposure.ts, object.zod.ts, packages/mcp/src/mcp-http-tools.ts, packages/mcp/src/stdio-data-bridge.ts, packages/runtime/src/domains/mcp.ts). That code was read, not reviewed.
• Gate verdicts (check-runs on this head, as read): green so far: PR-body guards, Governed Surface Queue Guard, Lint · PM dispatch-gates, Lint · scoped (3 jobs), Type Check · debt ledger, Dogfood Regression Gate, Check PR Size and Test UI. Still running or queued: Check Changeset, Build Core, the Type Check jobs (workspace, source gates, consumer gates), the Lint jobs (ESLint, repo and tooling, docs and code guards, CI/release/engine), Live E2E UI, and Test Core shards 1 and 2. The record does not answer those families; their conclusions are the verdict. The two families the dev did not measure (check:dual-build-cjs-loads, check:lean-entry-closure) are among the families CI runs.

② Semver level

• .changeset/32974-skills-enable-ai-readable-row.md declares '@objectstack/skills': patch. Right: added teaching text in a published skill, with no schema or API change. The package name matches packages/skills/package.json.
• Clause-②: no appears in both the PR body and the changeset. Right: nothing is narrowed, and no declared capability is taken away.

③ Boundary flags

• open_questions is empty.
• Dev deviation, a dash in the Default column instead of false: accepted. An absent key is closed, and aiReadExposureRefusal judges any declared value, false included, so a false default would teach the one value that fails on an app object.
• Dev deviation, the token headroom measured at 4 after the row (ceiling 6665): accepted. Any prose fix below has to stay inside that ceiling, or trim elsewhere in the row.
• Dev flag, dispatch-gates --tier mandates the contract-review tier for skills/**: this record answers it.
• The remaining deviations (the PR-body trailer, the labels key on the relay, the commit trailer) are process matters and have no effect on the contract.

④ Design judgment

skills/objectstack-data/SKILL.md, the new aiReadable row, checked against card 32974's Do line and against the spec and server on main:

• Holds. "Platform sys_* objects only" and "an app object never declares it": aiReadExposureRefusal refuses any declared value on a name that fails /^sys_/i, and sys_ names are reserved for the platform (manifest.zod.ts, namespace-prefix.ts). The two shipped declarers are platform objects (sys_user, sys_approval_request).
• Holds. "false included: refused at parse": the refusal judges every value except an absent or undefined key. ObjectSchema's refinement calls it through refuseMisplacedAiReadExposure, so every door that parses an object refuses it.
• Holds. "read-only AI access (query, get, aggregate, describe, list; never a write)": in mcp-http-tools.ts, readGuard admits an attested sys_* object only on describe_object, query_records, aggregate_records and get_record, and list_objects filters with the same attestation. create_record, update_record, delete_record, delete_records, validate_expression, read_file and create_upload_link keep the plain guard, so no declaration opens a write. Both bridges attest through isAiReadExposed, which answers true only for the boolean true. The row matches the .describe text of ObjectCapabilities.aiReadable.
• should-fix: "(not sys_metadata*)" overstates the refusal. The parse refusal and isAiReadExposed exclude exactly STORED_METADATA_BODY_OBJECTS, which is sys_metadata and sys_metadata_history. Other sys_metadata_* objects ship on main: sys_metadata_audit, sys_metadata_commit and sys_metadata_activation. The glob covers them, but the spec accepts aiReadable on them, so the row teaches a parse boundary the spec does not have. The PR's own changeset names the two objects correctly. Fix on the prose face: name the family, for example "(not sys_metadata, sys_metadata_history)" or "(not the stored-metadata family)". With 4 tokens of headroom, keep it under the ceiling by trimming elsewhere in the row, for example "never a write" to "no write". The ceiling does not move.
• No contradiction elsewhere. The other skill text was searched on the head (skills/**). The only related line, the MCP tools table in skills/objectstack-ai/SKILL.md ("system objects filtered out by default"), agrees with the row: an object is filtered by default and admitted only by the opt-in. That table does not mention that the read tools can admit a sys_* object that opts in. This is out of scope for this card and is not a finding against this head; a follow-up card could add it.

Implemented-by: claude/project-thread-7ha66d
Reviewed-by: session_01FEkQ5pjSPT7ui2EUcunaVb

VERDICT: PASS

_{Adopted by the seat 2026-11-14T21:42Z · isolated sub-agent at CONTRACT_REVIEW_TIER · Ruling-ref: Leehom card cmsg_01TenzsRopZj4jMbvjX8uz1XFhuiZmTH8VFgMmHRmpiGAb, option A, tapped 2026-11-14T15:37Z}

domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb

Contract review (delta)

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: fa4ef05c36f796582f4b51836a45e0cfd2eb4eba
Local-runs: none
Scope: skills/objectstack-data/SKILL.md + none

This is a DELTA record. It judges the move from 555603e2, which passed with one should-fix (comment 6884644527), to fa4ef05c. Everything that record judged outside the delta stands as written there.

① Derived judgments

• Delta: git diff 555603e2 fa4ef05c is one row in skills/objectstack-data/SKILL.md, +1 / -1, the aiReadable row of the object enable table. No schema, gate, runtime code, changeset or ratchet file is touched.
• Accept set: none changed.
• Implementing files in the diff: none. The row describes packages/spec/src/data/ai-read-exposure.ts and packages/spec/src/kernel/stored-metadata-body-objects.ts on main (7e61983e); that code was read, not reviewed.
• Token ratchet: measured by the ratchet's convention (bytes less the stamp line, divided by 4, rounded up): 6661 at 555603e2, 6665 at fa4ef05c, against the ceiling of 6665 in scripts/check-skills-token-ratchet.mjs. The gate fails only above the ceiling, so the row lands at headroom 0 and the ceiling does not move, as the prior record asked.
• Gate verdicts (check-runs on this head, as read): none failed. Green so far: Check Changeset, PR-body guards, Governed Surface Queue Guard, Check PR Size, Lint · PM dispatch-gates, Lint · scoped (3 jobs), Build Core, Plan Test Core shards, Dogfood Regression Gate, Test UI, Auto Label, filter. Still running: Test Core shards 1 and 2, Live E2E UI, the Type Check jobs (workspace, source gates, consumer gates, debt ledger), and the Lint jobs (ESLint, repo and tooling, docs and code guards, CI/release/engine); a second run each of Check Changeset and PR-body guards is also still in progress. The record does not answer those families; their conclusions are the verdict.

② Semver level

• Unchanged by the delta: '@objectstack/skills': patch and Clause-②: no, as judged at 555603e2. Correcting a row's scope is still teaching text with no schema or API change.

③ Boundary flags

• None new. The token headroom is now 0; any later edit to this skill file pays its own tokens or trims.

④ Design judgment

skills/objectstack-data/SKILL.md, the corrected aiReadable row, checked against main:

• Holds. The should-fix is answered. "(not sys_metadata, sys_metadata_history)" now names exactly STORED_METADATA_BODY_OBJECTS (stored-metadata-body-objects.ts: the set holds those two names and no other). aiReadExposureRefusal refuses any declared value on a name in that set, judged before the sys_ test, and isAiReadExposed answers false for those names before reading the key. The other shipped sys_metadata_* objects (sys_metadata_audit, sys_metadata_commit, sys_metadata_activation) are no longer taught as refused, which matches the spec: they are sys_ names outside the set, where the key is accepted.
• Holds. "never a write" to "no write": the same claim in the same place, the parenthesis that lists the admitted tools. The read tools are the only ones an attested object reaches; no write tool is admitted. No meaning change.
• Holds. "An app object never declares it" to "App objects never declare it": a generic singular to a generic plural, followed by the same "false included: refused at parse". The non-system arm of aiReadExposureRefusal refuses every declared value on every name that fails /^sys_/i, so the plural states it as exactly as the singular did. No meaning change.
• Observation, not a finding: the row says the stored-metadata pair is "not" eligible but does not repeat that a declaration there is also refused at parse, false included. The row claims nothing false, and spelling it out would cost tokens the file no longer has.

Implemented-by: claude/project-thread-7ha66d
Reviewed-by: session_01FEkQ5pjSPT7ui2EUcunaVb

VERDICT: PASS

_{Adopted by the seat 2026-11-14T22:11Z · isolated sub-agent at CONTRACT_REVIEW_TIER · Ruling-ref: Leehom card cmsg_01TenzsRopZj4jMbvjX8uz1XFhuiZmTH8VFgMmHRmpiGAb, option A, tapped 2026-11-14T15:37Z}

domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb

维护者速读

• 改了什么:objectstack-data 技能的对象 enable 能力表新增 aiReadable 一行：只给平台 sys_* 对象用(不含 sys_metadata、sys_metadata_history),开放只读 AI 访问(查询、取单条、聚合、描述、列表，不能写);应用对象从不声明它，写了(包括 false)解析即拒。外加 patch changeset。
• 为什么改:PR feat(spec): enable.aiReadable — a system object's author can open its records to the AI read tools, read-only #32971 上线了这个键，技能表里没教(卡 skills: the object enable capability table does not teach aiReadable (read-only AI exposure, sys_* objects only) — PR #32971's Skills-docs follow-up #32974)。
• 风险与回滚：只改技能文字一行，不动 schema 与运行时;文件 token 正好用到上限(6665 / 6665),未抬上限。回滚即还原本 PR。
• 先看:skills/objectstack-data/SKILL.md 的 enable 表最后一行。
• 两分钟验证:git diff origin/main -- skills/objectstack-data/SKILL.md。
• 需要你做的：受管面 Tier H(skills/**),契约复审 PASS 评论 6884644527 与增量复审 PASS 评论 6884995626(Head-sha fa4ef05c36f796582f4b51836a45e0cfd2eb4eba)已在案，请批准或直接合并。
• 席位意见：可以合。首轮复审指出“不含 sys_metadata*”说宽了，已改为点名那两个对象，增量复审确认与 main 的 STORED_METADATA_BODY_OBJECTS 一致。

席位核对

Verdict: ACCEPT, held for the maintainer · head fa4ef05c36f796582f4b51836a45e0cfd2eb4eba · card #32974 · report 6884604716 · contract review 6884644527 (PASS on 555603e2, one should-fix) · delta review 6884995626 (PASS on this head, CONTRACT_REVIEW_TIER; Ruling-ref for the in-seat review: Leehom card cmsg_01TenzsRopZj4jMbvjX8uz1XFhuiZmTH8VFgMmHRmpiGAb option A).

• Shape: draft → main, Fixes #32974. skills/objectstack-data/SKILL.md (one table row), one '@objectstack/skills': patch changeset. GOVERNED, Tier H (skills/**). Clause-②: no; Metadata-protocol: none.
• Contract: the row agrees with aiReadExposureRefusal (any declared value refused on a non-sys_ name, and on the two stored-metadata body objects), isAiReadExposed (true only for the boolean true), and the MCP read guard (describe, query, aggregate, get one, list; every write tool stays closed). Should-fix fixed: the row names exactly the two objects STORED_METADATA_BODY_OBJECTS holds; sys_metadata_audit, sys_metadata_commit and sys_metadata_activation accept the key and the row no longer says otherwise.
• Gates: 46 derived, 44 exit 0, 2 NOT MEASURED (dual-build-cjs-loads, lean-entry-closure; no package touched). Token ratchet 6665 of 6665, no raise. Check-runs on the head all concluded, none failing.
• Out of scope, noted: skills/objectstack-ai/SKILL.md's MCP tools table says system objects are filtered out by default and does not mention the opt-in; true, not contradicted.
• Process: the thread ran at the default tier, met by this in-seat review. The report comment still cites the first head and 6661 tokens; this ACCEPT carries the current figures.
• Landing: Tier H. The seat does not flip this PR ready or enqueue it. It needs the maintainer's merge, or an authorised APPROVED review after which the seat lands it.

domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: fa4ef05c36f796582f4b51836a45e0cfd2eb4eba
Local-runs: none
Scope: skills/objectstack-data/SKILL.md + none

This is the at-tier re-review of this head. It judges the tree on its own reading and does not rest on records 6884644527 or 6884995626; ③ says which of their findings it confirms.

① Derived judgments

• Net diff: against the merge base ba35dfd7, 2 files, +11 / -0: one row added to the Object Capabilities (enable) table in skills/objectstack-data/SKILL.md (line 121), and .changeset/32974-skills-enable-ai-readable-row.md.
• Accept set: none changed. No schema, gate, ratchet file or runtime code is in the diff. Right.
• Public surface: the published @objectstack/skills catalog now teaches enable.aiReadable. Right: the key is declared on main (ObjectCapabilities.aiReadable, packages/spec/src/data/object.zod.ts), has its reader (isAiReadExposed, exported from @objectstack/spec/data), and is declared by two shipped objects (sys_user, sys_approval_request). The table omitted it before this PR.
• Implementing files in the diff: none. The row describes code outside the diff; that code was read on main (8e63ed87), not reviewed.
• Base drift: between ba35dfd7 and main at 8e63ed87, none of skills/objectstack-data/SKILL.md, ai-read-exposure.ts, stored-metadata-body-objects.ts, the MCP tool files or the token-ratchet script changed. The ceiling for this file is still 6665 on main, so the row's reading holds at the merge.
• Gate verdicts: every check-run on this head has concluded; none failed. Success: Check Changeset, PR-body guards, Governed Surface Queue Guard, Check PR Size, Build Core, Test Core (shards 1/8 and 2/8 and the roll-up), TypeScript Type Check with its four jobs (workspace, source gates, consumer gates, debt ledger), Lint and Repo Gates with its jobs (ESLint, repo and tooling, docs and code guards, CI/release/engine, PM dispatch-gates, the three scoped jobs), Dogfood Regression Gate, Test UI, Live E2E UI. The remainder are skipped by path filter. The two families the dev left unmeasured locally (check:dual-build-cjs-loads, check:lean-entry-closure) are answered by those green runs. The token ratchet (6665 of 6665, per the PR body) is answered by the green Lint jobs; it was not recomputed here.

② Semver level

• '@objectstack/skills': patch. Right: teaching text added to a published skill; nothing published changes shape.
• Clause-②: no on the PR body and in the changeset. Right: the row declares no narrowing. The refusal it describes already ships on main; the row reports it and adds none.
• Metadata-protocol: none. Right.

③ Boundary flags

• open_questions on the dev report is empty.
• Deviation, the Default column reads a dash and not false: accepted. aiReadExposureRefusal judges every declared value, false included, and the key is z.boolean().optional() with no default, so a dash is the true default and false would teach the one value that fails on an app object.
• Deviation, the token ceiling was not hit and nothing was cut: accepted. The file now sits at the ceiling with no headroom; the next edit to it pays its own tokens.
• Deviation, the thread ran below the tier dispatch-gates --tier mandates for skills/**: this record is the at-tier review that answers it.
• The other deviations (PR-body trailer, relay labels key, commit trailer) are process matters with no effect on the contract.
• Earlier records. 6884644527 (on 555603e2): its should-fix is confirmed as a real defect of that head. "(not sys_metadata*)" covered sys_metadata_audit, sys_metadata_commit and sys_metadata_activation, which ship on main and where the spec accepts the key. It is fixed on this head: the row names sys_metadata and sys_metadata_history, exactly the two members of STORED_METADATA_BODY_OBJECTS. Its "holds" findings are confirmed by the independent reading in ④. 6884995626 (delta on this head): confirmed, including that the two rewordings ("no write", "App objects never declare it") change no meaning. Neither record's finding is rejected.

④ Design judgment

skills/objectstack-data/SKILL.md, the aiReadable row, read clause by clause against the card's Do line and the code on main. The card has no eval prompt for the enable table; the acceptance scenario is its Do line: one row saying the key exists for platform system objects and that an app author never writes it (a parse error on an app object).

• Holds, "Platform sys_* objects only". aiReadExposureRefusal accepts a declared value only on a name matching /^sys_/i outside the stored-metadata set; isAiReadExposed answers true nowhere else. sys_ names are platform-reserved (namespace-prefix.ts).
• Holds, "(not sys_metadata, sys_metadata_history)". STORED_METADATA_BODY_OBJECTS holds those two names and no other. Both functions judge that set before the sys_ test, so no declaration opens them.
• Holds, "read-only AI access (query, get, aggregate, describe, list; no write)". In packages/mcp/src/mcp-http-tools.ts, readGuard is the guard of describe_object, query_records, get_record and aggregate_records only, and list_objects filters with the same attestation (attestsAiRead). Every write tool keeps the plain guard, which refuses a system object whatever it declares. The five verbs match the .describe text of ObjectCapabilities.aiReadable and the docblock in ai-read-exposure.ts.
• Holds, "App objects never declare it, false included: refused at parse". The non-system arm refuses any value except an absent or undefined key. ObjectSchema's refinement calls it through refuseMisplacedAiReadExposure, so every door that parses an object inherits the refusal.
• Holds against the Do line: the row says both things the card asks for, in one row, and nothing more.
• Attempts to break it. (a) An app author copying the row onto a business object: the row tells them not to and names the outcome. (b) An app author writing aiReadable: false as a lock: covered by "false included". (c) A reader inferring a write arm: "no write" closes it, and the spec refuses the write-arm spellings with guidance. (d) Another skill contradicting it: the only related line on the head, the MCP tools table in skills/objectstack-ai/SKILL.md ("system objects filtered out by default"), agrees. None broke the row.
• nit: the row does not say that the value that opens the reads is true. A platform author can infer it from an opt-in flag with a dash default, and the spec's .describe says it. Left as an accepted deviation: the file has no token headroom.
• nit: "refused at parse" reads as attached to app objects only; a declaration on the two stored-metadata objects is refused at parse as well. The row says nothing false, since "not" already excludes them. Accepted deviation, same reason.
• nit: the verb get here is the AI read tool (get one record), in a table whose apiMethods row uses get for an API primitive. The card and the spec say "get one". No effect on what an author writes. Accepted deviation.
• Out of scope, not a finding on this head: skills/objectstack-ai/SKILL.md does not mention that an opted-in sys_* object reaches the read tools. A follow-up card could add it.

No must-fix and no should-fix. Nits alone end the round.

Implemented-by: claude/project-thread-7ha66d
Reviewed-by: session_01FEkQ5pjSPT7ui2EUcunaVb

VERDICT: PASS

_{Adopted by the seat 2026-11-15T00:28Z · isolated sub-agent at CONTRACT_REVIEW_TIER (served model verified by the seat) · Ruling-ref: Leehom card cmsg_01TenzsRopZj4jMbvjX8uz1XFhuiZmTH8VFgMmHRmpiGAb, option A, tapped 2026-11-14T15:37Z}

domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb

Correction: contract-review tier

The contract-review record(s) 6884644527, 6884995626 on this PR say Served-tier: CONTRACT_REVIEW_TIER, and the seat adopted them as "isolated sub-agent at CONTRACT_REVIEW_TIER". That is wrong. The seat launched the reviewing sub-agent without the tier, so it ran at the seat's own default tier, not at CONTRACT_REVIEW_TIER. The seat found this on its own audit. The review was still isolated and adversarial, and its findings stand as an off-tier review. They are not the at-tier record AGENTS.md and the in-seat review ruling require.

The seat re-runs the review at CONTRACT_REVIEW_TIER on this PR's head and posts that record here. Until it does, this PR has no at-tier record.