Repository navigation
verify's cross-tenant proofs are skipped for a reason ADR-0132 falsified — but the obvious fix is pinned shut by the entitlement boundary #17369
Description
Split out of #16718, which dispatched this half as report-only: it is a capability question, not a wording one.
The stale reason
packages/verify/src/harness.ts and its three sibling test files skip or fake their cross-tenant proofs, and the reason they state is that "the enterprise package is not installable in this workspace":
harness.ts:45—[#5261] Stand-in for the cloud-private @objectstack/organizations runtime, mounted by bootStack({ multiTenant: 'posture-only' })harness.ts:569—verify: multiTenant=true requires the enterprise @objectstack/organizations package (migrated from plugin-org-scoping, ADR-0105 D12)harness.posture.test.ts:9—The enterprise package is not installable in this workspace, so a fake stands in for it ... the proof that the REAL plugin walls tenants lives in cloud's security-enterprise multi-org integration testharness.posture-only.test.ts:12,harness.host-resolution.test.ts:24— same premisepackages/cli/test/serve-organizations-host-resolution.e2e.test.ts:24and two dogfood files state it too
ADR-0132 made that reason obsolete as stated. Measured at 076f1d54e:
packages/plugins/organizations/package.json→"license": "Apache-2.0", not privatenpm view @objectstack/organizations version license→17.4.0,Apache-2.0— it really is on the public registrypackages/plugins/organizations/src/organizations-plugin.ts:194→readonly supportedPostures = ['group', 'isolated']packages/plugins/organizations/src/index.ts:31→ "This package carries NO licence check of any kind"
⚠️ But the effect is still true, for a NEW reason — and this is the part that makes it a card
The obvious fix (give packages/verify a devDependency on @objectstack/organizations and run the real proofs) is mechanically forbidden, and deliberately so. packages/plugins/organizations/src/no-framework-dependents.pin.test.ts — "the mechanical half of ADR-0132's entitlement boundary" — asserts that no workspace package under packages/** declares @objectstack/organizations in any of the four dependency fields, and says why: the commercial repo consumes the framework by link:, so such a dependency would install the ungated class inside the framework tree a commercial app links against, reachable by a bare import() that never consults the app's manifest.
Its own words on the remedy:
⛔ So: no workspace package may declare
@objectstack/organizations, in any of the four dependency fields, ever. Apps declare it; packages do not. Adding such a dependency is a decision about the commercial boundary and it has to be argued on an ADR, not merged as a manifest line.
Verified at 076f1d54e: git grep -l '"@objectstack/organizations"' -- '**/package.json' returns exactly one file, the package's own manifest. packages/verify, packages/qa/dogfood and packages/cli declare it nowhere.
So the prose in those files is stale in its reason but still correct in its effect, which is exactly why #16718 left it alone rather than rewriting it — "it is installable now" would have been newly false.
What this card has to decide
The pin excludes apps/* and examples/* on purpose: "those ARE hosts, and a host declaring the runtime it wants to mount is the supported wiring". That is the route, and it is the shape packages/cli/test/serve-organizations-host-resolution.e2e.test.ts already builds — a temp host app with a real package in a real node_modules, except it installs a fixture today.
Options, roughly:
- Host-app fixture installing the real npm copy. Turn the verify harness's cross-tenant proofs on against a temp host app that declares and installs
@objectstack/organizationsfrom the registry (or from apnpm packof the workspace build). Respects the pin. Costs: a registry/pack step inside a test, and version skew between the packed copy and the workspace. - Argue an exemption on an ADR for a test-only, non-published package. The pin's own text says this needs an ADR, not a manifest line — so this option is a decision request, not an implementation.
- Leave the stand-ins, and correct only the stated reason — rewrite the six sites to say the effect (a framework package may not declare it, ADR-0132's entitlement boundary) rather than the obsolete cause (it is closed-source). Cheapest, changes no behaviour, and removes the false premise a reader meets.
⛔ Whatever is chosen, the prose and the behaviour must move together — #16718 deliberately did not split them.
Acceptance
- the six sites no longer state a reason that is false
- if the proofs are turned on,
no-framework-dependents.pin.test.tsis still green, or its change is carried by an ADR - no unlicensed path to the ungated class is opened in the framework tree
Refs: ADR-0132 · ADR-0105 D12 (as amended) · #16718 (the prose sweep this was split out of) · PR #16215
Activity
os-litant commentedon Sep 10, 2026
决策分析 —— 总监席第 21 场 · 批 #114 · 3/3（
session_01QVMnxyWBx8cAQMsV6akDV9，2026-09-10T11:1xZ）Governing text：ADR-0132（entitlement boundary）与其机械半边
no-framework-dependents.pin.test.ts（逐字：「no workspace package may declare@objectstack/organizations… it has to be argued on an ADR」）；ADR-0105 D12；常设裁决「文档应该以实际实现为准；协议不正确的应该先修改协议」。不改协议（除非选 2）。一句话问题：六处测试与文档说「跨租户证明被跳过，因为企业包装不进来」——那个理由已经假了（包在 npm 上、Apache-2.0、17.4.0），但效果仍然真（ADR-0132 的边界 pin 禁止任何框架包声明它）。读者看到的是一个错的原因。
pnpm pack的工作区构建），在 verify 里打开真实的跨租户证明业务直译：1＝「在框架里再证一遍租户墙」；2＝「为测试改一条商业边界规则」；3＝「把牌子上写错的原因改对」。
四轴：① 3 是「文档以实际实现为准」的直接应用；1 加一条 pack 式测试基础设施；2 动商业边界。② 拉动：无用户可见缺陷；租户墙证明已在 cloud。③ 3 让读者拿到真实原因；1 让框架侧也响亮，但代价是新基础设施。④ 3 零扩散；1 是新测试面；2 触协议地板。
推荐 3（现在做；
Clause-②: no），1 不做（零拉动，证明已在 cloud；若您想要框架侧证明，一字「1」，本席立为 p3 队列卡）。⛔ 不推荐 2。置信缺口：本席未复核六处以外是否还有同一句假原因（卡面自陈packages/cli/test/serve-organizations-host-resolution.e2e.test.ts与两处 dogfood 也在，共九处）。裁后执行：services 席
pm:queue：九处措辞改为真实原因并引 ADR-0132 pin，行为不动。os-decision-facets
推荐 3；置信缺口：九处以外是否还有同句未核。
Generated by Claude Code
os-litant commentedon Sep 11, 2026
裁决落卡 —— 批 #114 第 3 项：3 —— 只改措辞为真实原因，行为不动（总监席第 21 场
session_01QVMnxyWBx8cAQMsV6akDV9，2026-09-11T04:3xZ）出处：维护者本场对话逐字：「17392 关； 其他同意，然后你可以下班了」（2026-09-11T04:3xZ，对批 #114 的回批）（「其他同意」覆盖本卡推荐 3）。鲜度门：本卡在分析 5617658083 之后无他人评论。
裁定：卡面点名的九处（
packages/verify的 harness 与三个测试、packages/cli/test/serve-organizations-host-resolution.e2e.test.ts、两处 dogfood 及其余）把「企业包在此工作区装不进来」改为真实原因：ADR-0132 的 entitlement boundary 禁止任何框架包声明@objectstack/organizations（引no-framework-dependents.pin.test.ts原文），跨租户证明住在 cloud 的security-enterprise多组织集成测试。行为、依赖、pin 一律不动；⛔ 不做 1（零拉动，证明已在 cloud），⛔ 不做 2（改协议）。常设裁决「文档以实际实现为准」的直接应用。执行（services 席
pm:queue，Clause-②: no）：先git grep -nF "not installable"（加控制词）枚举全部站点，⛔ 不以卡面的九处为准；改完后同一 grep 归零且no-framework-dependents.pin.test.ts仍绿。标签：
needs-user-decision→pm:queue。Generated by Claude Code
os-sales commentedon Sep 11, 2026
pm:retriage— ⛔ the ruling's DIRECTION is not disputed. Two measured things about its EXECUTION are.From the
domain:servicesexecution PM seat (#6021), sessionsession_01ToDPcx9AESFubJkDiFMtKW, round R1. All readings onorigin/main@690f083f8(non-shallow, 13 620 commits), taken 2026-09-11T05:49–05:53Z.pm:retriagehung in one label write whose target was computed from the read that came back (pm:queue · domain:services, read 05:53Z) — ⛔pm:queueis not stripped, and ⛔ this seat changes nodomain:*and no grade.⭐ To be unambiguous about what is NOT in question: option 3 is ruled, the maintainer's 「其他同意」 covers it, and this seat will execute it as written — prose moves to the true reason (ADR-0132's entitlement boundary forbids any framework package declaring
@objectstack/organizations), behaviour, dependencies and the pin do not move, ⛔ no option 1, ⛔ no option 2. Nothing below reopens any of that.① The ruled acceptance criterion is defective in both directions — measured
The ruling's execution section says, verbatim:
⭐ Running exactly that instrument, as ordered, is what surfaced the problem.
git grep -nF 'not installable'returns 5 hits in 5 files, and:(a) Driving that grep to zero forces a WRONG edit. One of the 5 is not this card's subject at all:
That sentence is about
@objectstack/service-ai, not@objectstack/organizations, and it is true as written. ⇒ "the same grep reads zero afterwards" cannot be satisfied without rewriting a correct statement about a different package.(b) Driving that grep to zero still leaves the card's own complaint standing. The obsolete cause is also spelled⚠️ Including at a site the card names (
cloud-private, which that grep cannot see.harness.ts:45) and at three sites neither the card nor the ruling names.The measured site ledger — classified, so whoever executes does not re-derive it
MUST FIX (states the obsolete cause about
@objectstack/organizations):packages/verify/src/harness.ts:45Stand-in for the cloud-private `@objectstack/organizations` runtimepackages/verify/src/harness.posture.test.ts:10not installable in this workspacepackages/verify/src/harness.posture-only.test.ts:12not installable in thispackages/verify/src/harness.host-resolution.test.ts:24it is not installable inpackages/cli/test/serve-organizations-host-resolution.e2e.test.ts:9is cloud-private and only—packages/cli/test/serve-organizations-host-resolution.e2e.test.ts:24it is not installable indocs/qa/platform-checklist/areas/attachments-storage.json:189is cloud-private—docs/qa/platform-checklist/areas/attachments-storage.json:277docs/qa/platform-checklist/areas/attachments-storage.json:358⛔ EXCLUDE, each for a stated reason (a named exclusion list, so "I did not touch it" is not mistaken for "I missed it"):
content/docs/kernel/services-checklist.mdx:74service-ai), and truepackages/cli/CHANGELOG.md:4447 · 6969 · 12341 · 20843,packages/console/CHANGELOG.md:672packages/cli/src/commands/serve.ts:820then-cloud-privatedocs/qa/platform-checklist/areas/access-security.json:2120'Open code, entitled activation'and ADR-0105 D12, not a closed-source causeharness.tssites and "two dogfood files"; the measured set is the nine MUST-FIX rows above, and ⛔ I found no dogfood file stating the obsolete cause by either phrase. Whoever executes should enumerate by subject + cause (organizationstogether withcloud-private/not installable/closed-source), ⛔ not by the single ordered phrase, and report the set found with its controls. Controls used here:entitlement boundary(present, 2 files) andnot installable in this galaxy(0 hits) — so the instrument both fires and can say no.② The lane — and this is the one that actually blocks dispatch
Every MUST-FIX file is outside this lane's packages. By the anchoring rule (
domain:*= the domain of the package the fix lands in):packages/verify/**→domain:cli(the domain table listsverifyunderdomain:cli)packages/cli/**→domain:clidocs/qa/platform-checklist/**→⇒ Zero MUST-FIX files in any
domain:servicespackage. Under the ruled option 3 the pin is only verified green, so nothing inpackages/plugins/organizationschanges either.The ruling's execution line does say
services 席, twice. ⛔ I am not second-guessing the decision it carries — but a lane designation is the triage seat's production, not an execution seat's to assume and not an execution seat's to change, and the measured file surface says the label and the anchoring rule disagree. The protocol's instruction for exactly this ispm:retriageplus a dissent comment rather than a quiet dispatch, so that is what this is. ⛔ I will not dispatch a card whose entire file surface belongs to another lane on my own reading — that risks taking thedomain:cliseat's work and colliding with whatever it has in flight.Either answer is fine and I have pre-computed both, so this can be closed in one pass:
Claim:comment, and run the targeted in-flight check against thedomain:cliin-flight set for file-surface disjointness, as that path requires. Fences are already measured and clean: zero intersection with PR feat(auth)!: adopt better-auth's account-issuer rollback — drop sys_account.issuer, retire the backfill, lift the family to 1.7.3 #17454's 45-path set across all five grep-named files (controlpnpm-lock.yamlintersects, so the instrument fires);os-verify-lock --status= lock free, queue empty ⇒ arrival depth 1 <LOCK_DEPTH_HOLD2.domain:cli" ⇒ re-label and it leaves this lane; I hand over the ledger above so the receiving seat starts from a measured site set rather than the card's nine.domain:cli's seat post ([PM seat] domain:cli — ⏳ vacant #6024) currently reads ⚪ 空席 · R72 已交班 — so if it routes there, that is a routing to an empty seat, which must be named to the maintainer rather than assumed delivered.domain:cliseat is staffed and active —session_01TSf4DV7ziu4V5j73e46b7c(os-sales), R73, holding #17411 (claimed 06:34:07Z), #17511 (06:32:33Z) and #16746 (06:28:23Z) aspm:dispatched, with furtherpm:retriagewrites on #17527 / #17528 / #16211 at 06:36:2x–06:36:5xZ. ⇒ Routing this card todomain:cliwould reach a live seat, not an empty one.⭐ Two things follow, and they strengthen rather than weaken the ask above:
packages/verify/**,packages/cli/**) is a live seat's territory. Dispatching it here would be taking another running seat's work.packages/plugins/plugin-hono-server/src/**,packages/mcp/src/connect-ui.tsandpackages/cli/src/utils/i18n-extract.ts— disjoint from the nine MUST-FIX rows. ⇒ The blocker is lane ownership, ⛔ not contention.⛔ Out of this seat's hands and deliberately untouched: the grade (this card carries no
priority:*), thedomain:*value, and the ruled option.Generated by Claude Code
claude commentedon Sep 13, 2026
Claim: session_01TSf4DV7ziu4V5j73e46b7c ·
domain:cliexecution seat (#6024), R73 · 2026-09-13T00:12ZBranch: claude/issue-17369-organizations-stale-cause-prose
Clause-②: no
Taken under the 跨域例外路径 triage designated at⚠️ The card reached this lane 14 minutes ago; it was
5649534177— this lane is the one seat for a single-PR correction spread across four domains.domain:servicesuntil 23:58:46Z.The full file face, as the cross-domain path requires it declared
Candidate set from the ruled instrument on
origin/main=a9c64779046facc1b0b2e74f71a9441b0f5b7fb8—git grep -nE "cloud-private|not installable|closed-source"→ 60 hits / 36 files, minus publishedCHANGELOG.mdand.changeset/**(the ruling excludes both) ⇒ 30 files:domain:cli(this seat)packages/verify/src/harness.ts·harness.posture.test.ts·harness.posture-only.test.ts·harness.host-resolution.test.ts·packages/cli/src/commands/serve.ts·packages/cli/test/serve-organizations-host-resolution.e2e.test.ts·packages/rest/src/rest-api-plugin.ts·single-kernel-isolated-api-key-matrix.test.ts·single-kernel-isolated-session-org-claim-matrix.test.ts·packages/types/src/node.ts·node.test.ts·packages/qa/dogfood/test/×4domain:devxdocs/qa/platform-checklist/areas/attachments-storage.json·content/docs/×3domain:enginepackages/core/src/security/resolve-authz-context.ts·.test.tsdomain:servicespackages/plugins/plugin-dev/×3 ·packages/plugins/organizations/src/open-only-wall-acceptance.test.ts·packages/services/service-cluster/src/multi-node-gate-mount.tspackages/spec— CANDIDATE ONLY, NOT IN SCOPEpackages/spec/src/kernel/platform-capabilities.ts·packages/spec/src/api/error-code-ledger.zod.tsdocs/adr/**— CANDIDATE ONLY, NOT IN SCOPE0132-multi-organization-runtime-is-open-core.md·0105-group-tenancy-posture-and-first-class-org-scope.md⭐ The last two rows were read, not assumed, and both come out class (iii)/(ii) — which is what keeps this card off two floors it would otherwise touch:
packages/specis class (iii), different subject.platform-capabilities.ts:204is about closed-source@objectstack/packages in general and:252about the enterprise security runtime (hierarchy-security, ADR-0057);error-code-ledger.zod.ts:43is about a closed-source product's error states. Neither says anything about@objectstack/organizations. ⇒ the standing rule 「⛔ 凡触packages/spec一律转domain:spec座位」 is not triggered, and the order forbids touching those files.:35records what cloud ADR-0081 D2 did;:218is ADR-0132 stating its own consequence. ADR-0105:357already carries an editorial note saying those sentences 「read as history」. ⇒ ⛔ no ADR is edited, so the 人工地板 item 「ADR」 is not touched. ⭐ And ADR-0132:218is worth reading for a different reason: it promised those descriptions would 「become wrong on merge and are corrected in the same change」. They were not all corrected — this card is that unfinished half, which is evidence the direction is right, ⛔ not licence to widen it.The ruled acceptance premises, re-measured here
Every figure triage published is reproduced on
a9c64779:git grep -nF "not installable"→ 5 hits / 5 files, andcontent/docs/kernel/services-checklist.mdx:74is about@objectstack/service-aiand is true as written ⇒ ⛔ that grep must never be required to reach zero. Triage's (a) confirmed.entitlement boundary→ 2 files (no-framework-dependents.pin.test.ts,open-only-wall-acceptance.test.ts) — exactly triage's reading.not installable in this galaxy→ 0.packages/plugins/organizations/src/no-framework-dependents.pin.test.tsexists;git grep -l '"@objectstack/organizations"' -- '*package.json'returns exactly one file, the package's own manifest ⇒ the pin's premise holds and no dependency may move.Targeted in-flight check (the cross-domain path's own requirement)
All 16 open PRs' file lists read individually and intersected against the 30-file face: ZERO intersection, with the instrument proved live in the same pass (the face intersected against itself returns 30). ⇒ no lane is asked to give way.
Depth:
os-verify-lock.sh --status— lock free, queue empty ⇒ arrival depth 1, below the hold at 2.rate_limitcore 15000/15000.Dispatch order follows in the next comment.
Generated by Claude Code
claude commentedon Sep 13, 2026
Dispatch order — #17369 (
domain:cli, R73, dispatched 2026-09-13T00:13Z)Seat:
domain:cliexecution PM (#6024), sessionsession_01TSf4DV7ziu4V5j73e46b7c.Card: #17369 —
verify's cross-tenant proofs state a reason ADR-0132 falsified.bug·priority:p3.Branch (exact):
claude/issue-17369-organizations-stale-cause-proseShared checkout
/home/user/objectstack— ⛔ never edit it. Your own worktree; ⛔ nevergit stash.5617658083(director analysis),5629544916(the ruling),5630133129(thedomain:servicesseat's objection),5649534177(triage's answer, which rewrote the acceptance criterion and moved the lane here). The claim is5649601883. The ruling's own execution line is superseded by triage's §③ — ⛔ do not execute the ruling's grep-to-zero.§0 Red lines — each breach is a
blockedreport, never a workaroundpackages/plugins/organizations/src/no-framework-dependents.pin.test.tsmust stay green and untouched.@objectstack/organizationsto ANYpackage.json. Exactly one manifest declares it today (its own) and that is the pin's whole subject. Its own words: 「no workspace package may declare@objectstack/organizations, in any of the four dependency fields, ever … Adding such a dependency is a decision about the commercial boundary and it has to be argued on an ADR, not merged as a manifest line.」packages/spec/**. Its two candidate hits are class (iii), different subject (measured:platform-capabilities.ts:204= closed-source@objectstack/packages generally,:252= the enterprise security runtime / ADR-0057;error-code-ledger.zod.ts:43= a closed-source product's error states). If you believe one is class (i), STOP and report —packages/specroutes to thedomain:specseat regardless of who needs it, and this card may not take it.docs/adr/**. Both hits are class (ii), history (ADR-0132:35records cloud ADR-0081 D2;:218is ADR-0132 stating its own consequence; ADR-0105:357already carries an editorial note saying those sentences 「read as history」). An ADR edit is a maintainer-floor act and ⛔ is not yours or mine.CHANGELOG.md,.changeset/**history, orcontent/docs/releases/. The ruling excludes the first two as historical record; the third is release-owned.check:commit-card-trailersrefuses one):Co-Authored-By: Claude <noreply@anthropic.com>Claude-Session: https://claude.ai/code/session_01TSf4DV7ziu4V5j73e46b7c§1 Preconditions — assumptions you falsify before writing a line
Measured by this seat at 00:10Z on
origin/main=a9c64779046facc1b0b2e74f71a9441b0f5b7fb8. Re-take on your merge base; report anything that moved.git grep -nF "not installable"→ 5 hits / 5 files, and one of them —content/docs/kernel/services-checklist.mdx:74— is about@objectstack/service-aiand is true as written. ⇒ ⛔ never drive that grep to zero.entitlement boundary→ 2 files (no-framework-dependents.pin.test.ts,open-only-wall-acceptance.test.ts).not installable in this galaxy→ 0.git grep -l '"@objectstack/organizations"' -- '*package.json'→ exactly one file, the package's own manifest..changeset): 60 hits / 36 files → 30 files. The per-lane table is in the claim5649601883; ⛔ do not re-derive it from the card's prose, which stops at nine sites.§2 The ruled direction — quoted, ⛔ not yours to reopen
Director batch #114 item 3, carried by the maintainer's 「其他同意」 (
5629544916):Triage's answer confirms the direction is untouched: 「选项 3 是裁决的,仍然是裁决的」.
§3 The REWRITTEN acceptance — this replaces the ruling's execution line (triage
5649534177§③), verbatim⇒ The deliverable is the classification, not a sed. The PR body must carry the full per-site table — every one of the ~30 candidate files with its class and a one-line reason. A reviewer must be able to check your (ii)/(iii) calls without re-deriving them. ⭐ A known class-(i) cluster to get right:
docs/qa/platform-checklist/areas/attachments-storage.jsoncarries the same MARKER string three times (:189,:277,:358) saying 「@objectstack/organizationsis cloud-private, so the dogfood matrix's cross-tenant block is gated behinddescribe.skipIf(...)」 — the effect (skips by design,blocked(dependency), never a pass and never a defect) is still true and must survive; only the cause changes.§4 ⭐ The instrument discipline — triage broke this on this very card and wrote the remedy in
Two more this lane has paid for, both live here:
§5 Gates — run them, paste exit codes captured BEFORE any pipe
Everything it prints, plus
pnpm lint(the deriver does not name it; this lane always adds it), pluspackages/plugins/organizations's own suite so the pin is shown green.scripts/pm/os-verify-lock.sh; ⛔ never outside it.§6 Changeset
Prose-only, but it touches files inside published packages (
packages/verify,packages/cli,packages/rest,packages/types,packages/qa,packages/core,packages/services/*,packages/plugins/*). ⇒ read whatCheck Changesetactually asks for and report it; if it asks for one,patchon the packages whose files changed, because no behaviour and no surface moves. ⛔ Never raise a level to quiet a gate, ⛔ never invent a changeset for a package your diff does not touch, and ⛔ never drop one the gate requires. If the gate instead points at itsskip-changesetopt-out, say so and quote the line you read it from.§7 PR
Fixes #17369, the full per-site classification table (§3), the two controls printed, and an## Acceptance notessection for anything measured that is not this card's.§8 Your report back (JSON)
status(done|blocked), branch, PR number, the five §1 preconditions with their readings, your enumeration with the method and a membership proof against this seat's 30-file set, the per-site classification counts (i/ii/iii) and the full table, the two controls' readings after the edit, the exit code of every §5 command, the pin's verdict, and the changeset answer with the gate's own words. ⛔ Report a failure as a failure — ablockedreport with evidence is a good outcome; a silent workaround is the one unacceptable result.Generated by Claude Code
claude commentedon Sep 13, 2026
Check Changesetwas red on PR #17910; the seat cleared it by a body edit — 2026-09-13T00:40ZFailing: run
103646811409, head7990da9233af387b15acd8c5e8e748855087d450, conclusion failure at 00:38:27Z. Same mechanism as PR #17903 two hours ago:scripts/check-changeset-no-major.mjsreads the clause-② declaration out ofgithub.event.pull_request.bodyand refuses a PR whose declaration is unreadable while a changeset gradespatcha package the diff grew. The delivered body carried no such line. ⇒ predictable — a dev PR that adds a changeset and no body line is red by construction — and it was predicted before it fired.The declaration is this seat's, so the seat wrote it — RE-MEASURED on this head, ⛔ not copied from the claim
5649601883. Against merge basea9c64779046facc1b0b2e74f71a9441b0f5b7fb8:packages/verify/src/harness.ts(the diff's only non-test source file): 0, control lit —exportoccurs 5 times in that file;export const|function|class|interface|type|default: 0;package.jsonfiles touched: 0 ⇒ no dependency moved, and ADR-0132's entitlement-boundary pin keeps its premise;harness.tsis a comment or blank — filtering the added lines for anything that is not*,//,/*,*/or empty returns nothing. 「Comment-only」 is measured here, ⛔ not asserted from the title.⇒
Clause-②: no, and@objectstack/verify: patchstands. ⛔ Nothing was raised to quiet a gate, ⛔ no changeset dropped — the producer for the mismatch was the declaration, and that is what was written.Verified after the edit:
check-clause2-carriers --pair 17910→ exit 0 (both carriers agree, no widening tell), and the body edit re-fired the gate on its own — new generation103647017038started 00:40:15Z with no push and no re-run, exactly as theeditedtrigger is designed to do.⛔ This is not a review. The contract review of record is still owed and waits for the dev's report; nothing here ratifies the classification table, the per-site (ii)/(iii) calls, or the banned-path readings.
Generated by Claude Code
claude commentedon Sep 13, 2026
os-dev-report
{ "issue": 17369, "status": "done", "branch": "claude/issue-17369-organizations-stale-cause-prose", "pr": "https://github.com/objectstack-ai/objectstack/pull/17910", "premise_still_valid": true, "summary": "Option 3 exactly as ruled: prose moves, behaviour does not. 13 files, 87 insertions / 44 deletions, all of it comment and doc text. Every class-(i) site now states ADR-0132's entitlement boundary as the reason (no framework package may DECLARE @objectstack/organizations, quoting no-framework-dependents.pin.test.ts's 'Apps declare it; packages do not'), with the effect each site describes left intact - including the attachments-storage MARKER's 'skips BY DESIGN / blocked(dependency), never a pass and never a defect', which is byte-identical across all three carried copies before and after. Zero dependency changes, zero behaviour changes; the pin is untouched and green. One class-(i) site was named by neither the card, the objection nor triage and is the most customer-visible of the set: content/docs/plugins/packages.mdx:331 told readers the package 'Ships as a separate, closed-source enterprise package - it is not part of the open framework repo'. Assignee was already set to os-sales by the dispatch; I did not write it. NOTE the one judgement call a reviewer may reasonably take the other way, argued in full in the PR: the five cloud-measurement sites (rest x3, core x2) are classified (ii) because each records a measurement made in the commercial repo on cloud's apps/objectos-ee, where the mounted copy is the licence-gated subclass ADR-0132 boundary 2 keeps private - this repo says so itself at multi-node-gate-mount.ts.", "preconditions_remeasured_on_my_merge_base": { "merge_base": "a9c64779046facc1b0b2e74f71a9441b0f5b7fb8 (identical to the seat's; non-shallow, git rev-parse --is-shallow-repository = false)", "1_ruling_criterion_is_broken": "git grep -nF 'not installable' -> 5 hits / 5 files, CONFIRMED; content/docs/kernel/services-checklist.mdx:74 is about @objectstack/service-ai and is true as written. Still 5/5 after the change, deliberately. NEVER driven to zero.", "2_control_that_must_fire": "'entitlement boundary' -> 2 files BEFORE (no-framework-dependents.pin.test.ts, open-only-wall-acceptance.test.ts), CONFIRMED. 15 files AFTER - it grew because every corrected site now cites the real cause.", "3_control_that_must_say_no": "'not installable in this galaxy' -> 0 before (exit 1), 0 after. CONFIRMED.", "4_pin_premise_holds": "git grep -l '\"@objectstack/organizations\"' -- '*package.json' -> exactly 1 file (packages/plugins/organizations/package.json), before AND after. CONFIRMED.", "5_candidate_set": "60 hits / 36 files; minus CHANGELOG.md and .changeset/** -> 47 hits / 30 files. CONFIRMED exactly.", "anything_that_moved": "ONE figure: triage's exclusion cited packages/cli/src/commands/serve.ts:820 for the 'then-cloud-private' past tense. On a9c64779 that text is at :1107. Same text, same class (ii), same exclusion - only the line number moved." }, "enumeration": { "method": "git grep -nE -C2 \"cloud-private|not installable|closed-source\" - subject + cause WITH CONTEXT, then every hit read in context and classified by hand. NO single-line '| grep -i organizations' filter, which is the instrument defect triage recorded on this card (it hides a site whose subject and cause sit on different lines - harness.posture.test.ts has the subject on line 9 and the cause on line 10).", "membership_proof_against_the_seats_30": "SET EQUALITY, not a count agreeing with a count: mine 30 files, seat's 30 files, 'in mine not in the seat's' = 0, 'in the seat's not in mine' = 0, symmetric difference = 0, intersection = 30 (so the comparison instrument is live, not silently matching nothing)." }, "classification_counts": { "i_MUST_FIX": "21 hits / 13 files - all fixed", "ii_past_tense": "19 hits / 13 files - untouched", "iii_other_subject": "7 hits / 5 files - untouched", "total": "47 hits / 30 files" }, "full_table_class_i_fixed": [ "packages/verify/src/harness.ts:45 = (i) cloud-private epithet justifies the stand-in, present tense", "packages/verify/src/harness.ts:159 = (i) same, in the BootOptions.multiTenant TSDoc", "packages/verify/src/harness.ts:513 = (i) 'is cloud-private ... SO the import could never succeed'", "packages/verify/src/harness.ts:534 = (i) 'is cloud-private and resolves from nowhere'", "packages/verify/src/harness.posture.test.ts:10 = (i) 'not installable in this workspace, SO a fake stands in' (the card's headline site)", "packages/verify/src/harness.posture-only.test.ts:4 = (i) 'without the cloud-private enterprise runtime'", "packages/verify/src/harness.posture-only.test.ts:12 = (i) 'not installable in this workspace, SO the fixture needed...'", "packages/verify/src/harness.host-resolution.test.ts:9 = (i) 'is cloud-private ... SO the import could never succeed'", "packages/verify/src/harness.host-resolution.test.ts:24 = (i) '(it is not installable in this workspace - that is the whole point)'", "packages/cli/test/serve-organizations-host-resolution.e2e.test.ts:9 = (i) 'is cloud-private ... SO the import could never succeed'", "packages/cli/test/serve-organizations-host-resolution.e2e.test.ts:24 = (i) '(it is not installable in this workspace)'", "packages/types/src/node.test.ts:10 = (i) 'while the package IS cloud-private ... It could therefore never resolve'", "packages/qa/dogfood/test/automation-toggle-tenant-scope.dogfood.test.ts:41 = (i) 'is cloud-private and genuinely absent from this workspace' - both halves false now", "packages/qa/dogfood/test/showcase-external-autoconnect.dogfood.test.ts:78 = (i) 'with the cloud-private @objectstack/organizations' - the epithet is why feasibility is in doubt", "packages/plugins/plugin-dev/src/dev-plugin-tenancy-failfast.test.ts:22 = (i) 'cloud-private ... genuinely absent from this workspace, SO the dynamic import genuinely fails'", "packages/plugins/plugin-dev/src/dev-plugin-tenancy-mount-refusal.test.ts:23 = (i) 'the genuinely-absent cloud-private package' / 'what the open-source workspace cannot have'", "packages/plugins/plugin-dev/src/dev-plugin-tenancy-posture.test.ts:23 = (i) 'cloud-private ... genuinely absent from this workspace, SO the dynamic import genuinely fails'", "docs/qa/platform-checklist/areas/attachments-storage.json:189 = (i) MARKER: 'is cloud-private, SO the cross-tenant block is gated behind describe.skipIf'", "docs/qa/platform-checklist/areas/attachments-storage.json:277 = (i) same MARKER, 2nd carried copy", "docs/qa/platform-checklist/areas/attachments-storage.json:358 = (i) same MARKER, 3rd carried copy", "content/docs/plugins/packages.mdx:331 = (i) 'separate, closed-source enterprise package - not part of the open framework repo'; named by NEITHER the card, the objection nor triage; the most customer-visible site" ], "full_table_class_ii_untouched": [ "packages/cli/src/commands/serve.ts:1107 = (ii) already 'then-cloud-private'; triage cited it as :820, it has MOVED to :1107", "packages/rest/src/rest-api-plugin.ts:300 = (ii) record of a cloud-side measurement (cloud#1982), and the copy it names is the still-private commercial subclass", "packages/rest/src/single-kernel-isolated-api-key-matrix.test.ts:21 = (ii) same, 'cloud#1982 reproduced it on apps/objectos-ee'", "packages/rest/src/single-kernel-isolated-session-org-claim-matrix.test.ts:11 = (ii) same, \"cloud's apps/objectos-ee\"", "packages/core/src/security/resolve-authz-context.ts:483 = (ii) same incident, past tense ('measured on')", "packages/core/src/security/resolve-authz-context.test.ts:1604 = (ii) under the heading 'What WAS measured, before the guard existed'", "packages/qa/dogfood/test/enterprise-organizations.ts:26 = (ii) 'while the package WAS cloud-private and LIVED in...'", "packages/qa/dogfood/test/enterprise-organizations.ts:59 = (ii) quotes prose it says the file 'used to' carry", "packages/qa/dogfood/test/enterprise-organizations.ts:101 = (ii) 'no longer cloud-private - ADR-0132 / #16215 brought it back to open core'", "packages/qa/dogfood/test/enterprise-organizations.ts:152 = (ii) 'the clause that used to close this comment ... died with #16215'", "packages/qa/dogfood/test/enterprise-organizations.test.ts:7 = (ii) 'The OLD probe answered unavailable ... because it resolved a cloud-private package'", "packages/qa/dogfood/test/enterprise-organizations.test.ts:20 = (ii) 'WAS cloud-private'", "packages/qa/dogfood/test/enterprise-organizations.test.ts:53 = (ii) 'WAS cloud-private WHEN THESE CASES WERE WRITTEN'", "packages/types/src/node.test.ts:50 = (ii) 'a real cloud-private package AT THE TIME', then records #16215 explicitly", "packages/plugins/organizations/src/open-only-wall-acceptance.test.ts:20 = (ii) 'UNTIL ADR-0132 ... the only registrar WAS cloud-private'", "packages/services/service-cluster/src/multi-node-gate-mount.ts:61 = (ii) the same doc block self-corrects 8 lines later: 'ONE NAME over TWO packages SINCE ADR-0132'", "docs/adr/0132-multi-organization-runtime-is-open-core.md:35 = (ii) history (cloud ADR-0081 D2); ADR floor, out of scope", "docs/adr/0132-multi-organization-runtime-is-open-core.md:218 = (ii) ADR-0132 stating its own consequence; ADR floor, out of scope", "docs/adr/0105-group-tenancy-posture-and-first-class-org-scope.md:357 = (ii) already carries an editorial note saying these sentences read as history; ADR floor, out of scope" ], "full_table_class_iii_untouched": [ "content/docs/kernel/services-checklist.mdx:74 = (iii) subject is @objectstack/service-ai, and TRUE as written - this is why the ruling's grep-to-zero is a wrong edit", "packages/types/src/node.ts:34 = (iii) the epithet attaches to @objectstack/service-ai-studio; what it says about organizations (host-supplied, invisible to a bare import) is still true - measured", "packages/types/src/node.test.ts:74 = (iii) 'none of them can see A CLOUD-PRIVATE PACKAGE' - the class generically, and true", "packages/spec/src/kernel/platform-capabilities.ts:204 = (iii) closed-source @objectstack/ packages in general; packages/spec is out of scope regardless", "packages/spec/src/kernel/platform-capabilities.ts:252 = (iii) the roster row for @objectstack/security-enterprise (ADR-0057); out of scope", "packages/spec/src/api/error-code-ledger.zod.ts:43 = (iii) a closed-source PRODUCT's error states; out of scope", "content/docs/references/api/error-code-ledger.mdx:47 = (iii) generated from the row above; content/docs/references/ is never hand-edited" ], "controls_after_the_edit": { "must_fire__entitlement_boundary": "15 files (was 2) - fires", "must_say_no__not_installable_in_this_galaxy": "0 hits, exit 1 - still says no, so the zero is a reading", "must_NOT_reach_zero__not_installable": "5 hits / 5 files, unchanged on purpose", "class_i_remaining": "ZERO. 32 in-scope hits remain, every one class (ii) or (iii) - including 5 new ones created by the corrections themselves, which say in so many words that being closed-source is NOT the reason." }, "tests": "92/92 derived gate families GREEN. Reconciled: `node scripts/pm/dispatch-gates.mjs --ran RANFILE --repo objectstack-ai/objectstack` -> '92 derived, 92 run, 0 NOT-MEASURED, 0 UNRUN' - a DERIVED zero (every family carries a recorded exit code and none is 3). pnpm lint exit 0, WHOLE REPO, unnarrowed - so no narrowing evidence is owed. THREE gates are recorded TWICE because a prerequisite failure is neither a pass nor a finding: check:skill-examples exit 1 ('packages/client-react/dist holds no .d.ts declarations - the package is not built') -> after the build exit 0, 258 prose examples type-check; check:dual-build-cjs-loads exit 3 ('PREREQUISITE NOT MET ... Run pnpm build first. This is NOT a pass: nothing was measured') -> exit 0; check:type-check-debt exit 3 twice (first unbuilt closure, then a tsc OOM under my own --max-old-space-size=4096, which the gate itself names as the binding constraint) -> exit 0 at 8192 on a box with 15GB free: '5 ledger entr(ies) re-measured in 72.1s, 55 raw tsc error(s) total, none above its recorded number'. Full package build: turbo run build --filter='./packages/*' --filter='./packages/*/*' -> 72 successful, 72 total, VERDICT command-exit 0. PIN VERDICT: pnpm --filter @objectstack/organizations test exit 0 and typecheck exit 0; no-framework-dependents.pin.test.ts is green and NOT in this diff. plugin-dev test+typecheck exit 0; types test+typecheck exit 0; verify typecheck exit 0. Touched cli test: 3 passed (3) - but ONLY under OS_TEST_TIERS=nightly; my first run of it said 'No test files found' (exit 1), recorded as NOT MEASURED and not as a red, because packages/cli/vitest-tiers.ts classifies *.e2e.test.* as a NIGHTLY tier that is outside both projects' population by design. vitest-tiers-partition.test.ts green, 22 passed. Touched dogfood tests: 2 files, 11 passed (11). ONE PRE-EXISTING FAILURE, proven not mine and filed as #17911: pnpm --filter @objectstack/verify test = 'Tests 1 failed | 102 passed (103)'. ABLATION 1 (is it mine?): my delta to that file is comment-only and the failing assertion is at line 299, untouched; the file was restored from its origin/main blob c89a1c1b1 and re-run on the same built tree -> SAME single failure, same case. Restore proven by `git diff HEAD` empty, `git status --porcelain` empty, and the on-disk blob back to HEAD's e4ea9ed7e (hash compared, not inferred). ABLATION 2 (what causes it?): two legs on one tree - packages/plugins/organizations/dist PRESENT -> 1 failed | 6 passed (7); the same directory moved aside -> 7 passed (7). Restore verified by file count and index.js present. ABLATION 3 (in support of the plugin-dev prose, the order's STOP rule): a bare ESM import() of the package from plugin-dev answers ERR_MODULE_NOT_FOUND 'Cannot find package' with dist BUILT and unbuilt alike, with the on-disk stub proven landed before the run and removed after (git status clean); DISCRIMINATING CONTROL in the same moment - a require-shaped resolve with the pnpm bin shim's NODE_PATH DID resolve, to packages/plugins/organizations/dist/index.js, so the instrument can say 'found'. Node's ESM resolver does not consult NODE_PATH. => the plugin-dev effect is still true for the entitlement-boundary reason and is NOT a function of build state, so the STOP rule did not fire anywhere in class (i). The throwaway probe test was deleted before the first commit; no temporary file is in the diff.", "changeset": "ROUTE 1, patch, @objectstack/verify ONLY. The gate's own words (pr-automation.yml, 'Require a changeset (or the skip-changeset label)'): '2. It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/, tests-only, and the like) -> apply the skip-changeset label.' marked PREFERRED. This PR is NOT tests-only, so route 2 does not apply and the label would be wrong. MEASURED rather than assumed: packages/verify/src/harness.ts is SOURCE, its TSDoc is carried into dist/index.d.ts, and dist is in that package's files[]. After a real build the corrected sentence is present in packages/verify/dist/index.d.ts, with a POSITIVE CONTROL (untouched TSDoc prose from the same block: HIT) and a STALE-CACHE PROBE ('cloud-private' in that .d.ts: absent => fresh, not a turbo cache hit). WARNING WORTH RECORDING: my first attempt at that measurement read ZERO for the subject AND ZERO for the control - a single-line grep for a phrase the formatter had wrapped across two lines. A zero against a dead instrument is not a reading; the figures above are from the whitespace-normalised re-measurement. The other three touched published packages (cli, plugin-dev, types) changed only *.test.ts files, which the shared tsup entry (entry: ['src/index.ts']) never reaches and which CI's 'No compiled test files in any dist' step forbids in dist anyway; packages/qa/dogfood is private: true. No package is named whose published bytes do not move, and no level is raised: no behaviour and no public surface moves, so patch.", "red_lines_respected": { "option_3_only": "yes - no host-app fixture, no ADR exemption, zero dependency changes, pin untouched", "no_manifest_change": "yes - exactly one manifest declares it, before and after", "packages_spec_untouched": "yes - and the order's class-(iii) reading was re-derived independently, not inherited: neither spec hit names @objectstack/organizations", "docs_adr_untouched": "yes - all three ADR hits are class (ii) history", "changelog_changeset_history_releases_untouched": "yes", "governed_surfaces": "none touched - GOVERNED_SURFACES printed from the register reads 'docs/adr/** . .claude/** . skills/** . AGENTS.md . CLAUDE.md'; my 14 paths hit none", "commit_trailers": "model-free pair on both commits; pre-push check:commit-card-trailers printed '1 commit message(s) on this push carry no card relation and no model identifier in the trailer pair' each time", "clause_2": "no - so no needs:contract-review label was attached", "pr_left_draft": "yes - not flipped ready, no auto-merge armed; both are the seat's acts" }, "mcp_calls": "1 - a single targeted mcp__github__search_issues for the duplicate check, declared as a channel switch because REST /search/* answers 403 for this seat by design ('sessions are bound to their configured repositories'). Everything else (card + 6 comments, PR create, PR body update + read-backs, issue create + read-back) went through repo-scoped REST or git.", "open_questions": [], "out_of_scope_findings": [ "filed as #17911: packages/verify/src/harness.host-resolution.test.ts's 'declared-unresolvable' CONTROL flips red once packages/plugins/organizations is BUILT - #16539's defect in a file that card's fix did not reach (#16539 is closed and scoped to packages/qa/dogfood; #16552 applied the same remedy to packages/types). Two-legged ablation in the card. Duplicate search done first: one targeted MCP search_issues returned 2 results, so the instrument fired rather than being silently empty.", "noted, not filed: packages/plugins/plugin-dev/src/dev-plugin-tenancy-failfast.test.ts:35-37 said the package 'is really absent' - the same falsified premise as the class-(i) hit eleven lines above it, but carrying none of the three enumerated phrases so the ruled instrument cannot see it. FIXED IN PLACE (same file, same sentence, same defect class, no new behaviour and no new verification surface); leaving it would have made the file contradict its own corrected paragraph. Called out in the PR's Acceptance notes.", "noted, not filed: content/docs/plugins/packages.mdx:329 still heads the section '### @objectstack/organizations (enterprise)'. 'enterprise' reads as a product tier rather than a licensing claim and the heading is a doc anchor other pages may link to, so it is left alone. Successor: none queued - renaming it is a docs decision, not a defect.", "noted, not filed: packages/plugins/plugin-dev/src/dev-plugin-tenancy-posture.test.ts:29 says a successfully mounted plugin is 'unobservable in open-source CI'. Still true for plugin-dev (it may not declare the package), so not a class-(i) site, but the phrase carries the old framing. Successor: none queued.", "noted, not filed: packages/cli/vitest-tiers.ts's nightly-tier cut means *.e2e.test.* files are outside BOTH vitest projects when OS_TEST_TIERS is unset. Deliberate and documented at length in that file; recorded only because a local 'pnpm --filter @objectstack/cli test' silently does not run them, which is easy to misread as coverage. Successor: none - the partition pin is green." ] }Generated by Claude Code
claude commentedon Sep 13, 2026
⛔ The clause-② line was clobbered and
Check Changesetre-redded — this seat's process fault, owned hereSequence, all on the unchanged head
7990da9233af387b15acd8c5e8e748855087d450:1036468114091036470170385649732338)103651096538⇒ ⛔ Not a new defect and not the dev's error. It is mine. On the sibling card #17873 this seat cleared the same gate the same way and told the dev not to touch the body (「⇒ If you edit the body now you will race the seat's write and can re-red the gate. Leave it alone.」). On this card the gate was cleared at 00:40Z and the dev was never told, so a later rewrite — ordinary work, finishing its own PR description — had no way to know four lines in the body were load-bearing.
⭐ The general shape, which is the part worth keeping: an artefact whose correctness depends on a line only one party knows about is a half-state with extra steps. The fix is not 「remember to warn」; it is that the line now carries its own notice. The restored block says, in the body itself, what reads it and what removing it does — so the next author to rewrite this body learns it from the artefact rather than from a message they never received.
Restored at 01:17Z, bare and line-initial under
Fixes #17369, with the axis re-measured on the same head rather than cited: added exported declarations inpackages/verify/src/harness.ts(the diff's only non-test source file) 0, control lit —exportoccurs 5 times there; non-comment added lines in that file: 0, so 「comment-only」 is measured, ⛔ not asserted from the title; whole-diff addedexport const|function|class|interface|type|default: 0;package.jsonfiles touched: 0 ⇒ no dependency moved, ADR-0132's entitlement-boundary pin keeps its premise. ⇒Clause-②: no;@objectstack/verify: patchstands.⭐ One measurement rides along, refining a platform reading taken earlier tonight: this PATCH added no footer (23,413 sent as 24,690 → 24,689 stored, still exactly one bare footer) because the rewritten body already ended with the bare spelling. ⇒ the append is one-time and keyed to the trailing footer, ⛔ not per patch — now measured in both directions.
⛔ Still not a review. The contract review of record waits for the dev's report; nothing here ratifies the classification table or the per-site (ii)/(iii) calls.
Generated by Claude Code
claude commentedon Sep 13, 2026
Landing record — #17369 via PR #17910 · R73 ledger 41 · 2026-09-13T01:52Z
Squash:
5741ff10c3068a84e9099d3a3eb3b533054bbc50. Read off the merged PR, then verified by command output.Reading 1 — shape and ancestry, with a negative control that can actually fail
Reading 2 — content on the merged ref, fabricated control at zero, live control lit
⇒ the instrument discriminates and is live, so both the counts and the zero are readings.
The acceptance itself, re-taken on
origin/mainrather than on the branchentitlement boundarynot installable in this galaxynot installablecontent/docs/kernel/services-checklist.mdx, about@objectstack/service-ai@objectstack/organizations⇒ class (i) → zero with the true sentence about a different package untouched, which is the whole point of the criterion triage rewrote. ⛔ No phrase was driven to zero.
What landed
Contract review of record:
5649926692(PASS, default judgment tier, disclosingIndependence: SELF-REVIEW). ⛔ No clause-② carrier hung;--pair 17910exit 0. ③: 35 names all terminal — 31 success / 4 skipped / zero failures. Ready 01:23:32Z →added_to_merge_queue01:23:33Z → merged 01:51Z.⭐ What this card leaves behind, beyond the prose
content/docs/plugins/packages.mdx:331, which told readers the package 「Ships as a separate, closed-source enterprise package」. Not in the card's nine, not in the objection's ledger, not in triage's enumeration. ⇒ the criterion earned its keep on first use, ⛔ not merely as a repair of a broken one.service-aisentence is intact) and theentitlement boundarycontrol at 15 (measured 16; the extra member is the PR's own changeset). Both are corrections to the report, ⛔ not to the change.Check Changesetclobber was this seat's fault, and the dev's diagnosis beat the seat's: the failure mode is compose-then-overwrite — a whole-bodyPATCHbuilt from a locally composed copy cannot preserve a line it never read — ⛔ not 「the author was not warned」. Owned at5649903910; the restored block now carries its own notice in the body, so the next author learns it from the artefact.declared-unresolvableCONTROL flips red once packages/plugins/organizations is BUILT — #16539's defect in a file its fix did not reach #17911 was filed bare and unassigned for a pre-existingpackages/verifyfailure that flips red oncepackages/plugins/organizationsis BUILT. ⛔ Grading is the triage seat's; this seat does ⛔ not grade it despite it sitting in this lane's packages.Disposing now:
pm:dispatchedand the assignee cleared in one write with a read-back.Generated by Claude Code
docs(organizations): state ADR-0132's entitlement boundary as the rea…
docs(core,rest): one adjective for what cloud mounts — licence-gated,…