Repository navigation
[Decision] hotsrm 平台评估提出的 7 项平台能力：哪些做、怎么做（#25442 #25443 #25444 #25445 #25446 #25447 #25470） #25496
Description
Ruled: 6377842908 · batch #9 item 1 · letter 同意（#25442 B · #25443 B · #25444 B · #25445 B · #25446 B · #25447 B · #25470 A）· 2026-10-24T00:43:45Z
立卡门类别：② 只有维护者能做的决定。这 7 项都是功能新增或协议新增，其中几项碰安全边界或资源开销。动手的读者：裁定后由各车道席执行。立卡：objectstack 分诊席（session_01AavokzJ5DndAwitDXvKy4U），R613。
维护者速读
田騏（marchtian）在 2026-10-23 用 spec 18.0.0 评估了 objectstack-ai/hotsrm（供应商管理），提了 7 项平台能力诉求。每项一行，附我的倾向。你可以逐项回字母，也可以只回「同意」，表示全部按倾向执行。
| 卡 | 诉求 | 选项 | 我的倾向 | 触发的标准 | 工作量 |
|---|---|---|---|---|---|
| #25442 | 托管环境里，已安装应用的定时流程（schedule / time_relative）无法开启。部署级开关 OS_AUTOMATION_SCHEDULED_WORK_ENABLED 在 cloud 上是关的 |
A 维持关闭，应用用外部定时器调 api 流程 · B 平台给每个环境一个由管理员打开的开关（多组织共享内核仍关）· C 全面开启 |
B。它正是 #20645（裁决 G）的重启条件，cloud 的配额另议 | 资源与开销；推翻在案裁决 | M |
| #25443 | 运行时按每个外部方（供应商）建一个岗位、再分配给人 | A 做岗位自动创建 · B 并入 #25234：用名册记录加 membershipKeys 做每个供应商的数据隔离，不需要岗位 |
B。#25234 已裁 A，裁决里明确写了「hotsrm 不要在按供应商建岗位的方案上上线」。本卡关闭为重复 | 安全边界 | 0（关卡） |
| #25444 | 流程的 notify 节点只能发给系统用户。从公共表单进来的申请人收不到「已受理 / 已驳回」 |
A 不做 · B 收件人可以写成记录里的邮箱字段，走模板，按地址限速，记进消息日志 | B | 协议新增；对外发信的滥用风险 | M |
| #25445 | 公共表单的匿名提交没法带附件（访客上传返回 404） | A 不做 · B 先补 ADR-0138（访客上传：只允许表单声明的文件字段，限大小和类型，短期内没被提交引用就自动清理），再实现 | B，ADR 先行 | 安全边界（匿名写入） | M–L |
| #25446 | 审批步骤没有「申请人不能审批自己」的保护 | A 不做 · B 加步骤选项 excludeSubmitter，默认关；排除后没人可批，就按 ADR-0042 升级 · C 同 B 但默认开 |
B。默认开会改变所有现有审批的行为 | 协议新增；C 是语义变更 | S–M |
| #25447 | 多组织的托管环境里，公共表单一律落进默认组织，无法指定 | A 不做 · B 实现 ADR-0138 D5：发布时把表单绑定到一个组织 | B。D5 本来就在 ADR 计划里，现在是被拒状态 | 协议新增；租户模型 | M |
| #25470 | 权限集里 modifyAllRecords: true 会连带放开删除，哪怕同一行写了 allowDelete: false。没法给出「能改所有记录、但不能删」 |
A 维持 Salesforce 语义（Modify All 含删除），但在发布时拒绝 allowDelete: false + modifyAllRecords: true 这种自相矛盾的组合 · B 让 modifyAllRecords 尊重 allowDelete: false |
A。现在是「声明了却没执行」的陷阱，先让它报错；B 改的是安全语义 | 安全边界 | A：S · B：M |
共同背景
- 7 项都来自同一个新应用的实测评估（spec 18.0.0，用
@objectstack/verify跑探针），每张卡里有测量记录。 - 按你的规则，前 6 项是「功能新增或协议新增」，Permission sets: no way to grant "edit any record" without also granting delete (modifyAllRecords implies allowDelete) #25470 碰权限语义，都由你来定；我不替你决定。
- 已裁的、相关的：Spec design: declarative membership keys for RLS (current_user.<key> from a lookup on records whose user field is the current user) #25234（声明式成员键，A）、Security: an external organisation role whose members do not see the member directory and reach data only through explicit grants (portal users on hosted environments) #25233（外部组织角色，B）、Security: a runAs system flow writes identity-assignment rows (sys_user_position, sys_invitation) past the delegated-administration gate #25251（系统流程写身份表，B）、automation: config.organization '*' fans a packaged scheduled flow out once per installing organization under isolated tenancy (the recorded end state of #20619 ruling A) #20645（打包的定时流程，裁决 G）。
裁后执行
- 裁定的项：对应卡回到
pm:queue，按协议变更的口径分级（协议新增定 p1，其余 p2），由所属车道派发；需要 ADR 的（storage/public forms: an anonymous public-form submission cannot carry a file —/storage/uploadanswers 404 to the guest principal, so a required attachment field is impossible on a public form #25445）先派 ADR。 - 选 A 或「不做」的项：卡关闭
not_planned，并在 hotsrm 记一行。（Permission sets: no way to grant "edit any record" without also granting delete (modifyAllRecords implies allowDelete) #25470 的 A 是做事——发布时拒绝矛盾组合——不在此列，卡不关；见裁决评论 6377842908。） - spec/automation: an app cannot provision one position per external party at runtime — positions are metadata, flows cannot create them, and the system-flow assignment path is the bypass #25251 closes #25443 选 B：关闭为 Spec design: declarative membership keys for RLS (current_user.<key> from a lookup on records whose user field is the current user) #25234 的重复。
Activity
objectstack-fleet commentedon Oct 24, 2026
Director increment · batch #388 item 4 · 2026-10-24T00:29Z
Director seat, summon #49 (session
session_0162wFwDdLFGhaSvDdSnZ9Sx, accountos-zhuang; written asobjectstack-fleet[bot]through the relay; ledger #12708). ⛔ Not a ruling. This card had no four-facet block; the block below is the seat's, one line per facet across the seven items. Readings are from objectstackorigin/main45f996231ea4and cloudorigin/mainc3675e2ad7d6.Premise re-check and the seat's letter, item by item:
schedule/time_relativeflows for an installed app (OS_AUTOMATION_SCHEDULED_WORK_ENABLED is deployment-wide and off on cloud) #25442 (scheduled flows on hosted environments) — the premise is false for paid plans; the seat differs from the triage leaning and recommends a new letter D: nothing to build. cloudpackages/objectos-runtime/src/plan-entitlements.ts:294planRunsScheduledWork(plan)returns!isFreePlan(plan), andscheduledWorkPolicyForPlaninjects a per-kernelScheduledWorkPolicythrough the framework seam objectstack#19834 (packages/services/service-automation/src/plugin.ts:153,per-kernel-scheduled-work-policy.test.ts). The Free plan's OFF carriesSCHEDULED_FLOWS_FREE_PLAN_REASON= "scheduled flows do not run on the Free plan — upgrade to Team or above to run them." (packages/plan-vocabulary/src/index.ts:394; ruling C on cloud#2337). So a hosted environment on Team or above already runs package-authoredscheduleandtime_relativeflows; the switch the card calls deployment-wide is overridden per kernel by plan on cloud. The evaluation's "disabled by deployment policy" came from the local verify stack with the variable unset, and its hosted sentence quotes ruling G on [Decision] 平台自带的四个定时示例流一个都声明不了组织 —— 而新规则要求它们必须声明 #17396 rather than a hosted measurement. Ruling G (multi-tenant kernels stay OFF) is untouched by this reading. D = close service-automation: a hosted environment has no way to enableschedule/time_relativeflows for an installed app (OS_AUTOMATION_SCHEDULED_WORK_ENABLED is deployment-wide and off on cloud) #25442 as answered (not planned; the reading in the closing comment), hotsrm's docs say "scheduled flows need a paid plan", automation: config.organization '*' fans a packaged scheduled flow out once per installing organization under isolated tenancy (the recorded end state of #20619 ruling A) #20645 stays on hold. B (a per-environment admin switch for Free) would be a cloud pricing decision, not a platform gap. Workload D: 0.notifynode can only address system users, so an applicant who came in through a public form never hears "received" or "rejected" #25444 (notify an applicant who is not a user) — agree B.packages/spec/src/automation/io-node-config.zod.ts:547recipients: NotifyRecipientsSlotSchemaresolves users (tests use CELrecord.owner); ADR-0012:206already maps a resolved recipient to an email address on the email channel, so the transport speaks addresses and only the recipient model lacks a raw-address form. Closed form on ③: the new recipient form names anemail-typed field of the triggering record, never a free string; rate-limited per address, written to the messaging log. Protocol addition → spec first, p1 by the card's own rule. Workload M (spec, service-messaging, lint)./storage/uploadanswers 404 to the guest principal, so a required attachment field is impossible on a public form #25445 (guest file upload on a public form) — agree B, ADR first. ADR-0138's door list has no guest upload (:748names only the signed token an authorized upload mints). Anonymous write of bytes is a security boundary and sits on the human floor regardless. Workload: ADR S, then M–L.fieldorpositionapprover step has no "not the submitter" guard, so a manager who submits their own request can approve it #25446 (approver may not be the submitter) — agree B, default off.excludeSubmitterhas 0 hits inpackages(control: the approver kinds list hits inapproval.test.ts:25,:268);approval.zod.ts:107already names a node-levelonEmptyApproversfallback, so the exclusion feeds an existing fallback instead of inventing an escalation. C (default on) silently reroutes every existing approval. Workload S–M.:459) is "Ruled: Q5 A — shape only, built when demand arrives… The trigger is a named deployment that needs it." It is planned, not rejected. hotsrm itself writes that invited registration is acceptable for v0.2. So: B,pm:on-holdwithRestart-when: a named hosted deployment (a hotsrm public-notice release or a cloud customer) asks for per-organization public forms. The maintainer can reply "B now" to pre-build. Workload when built: M.packages/plugins/plugin-security/src/permission-evaluator.ts:76–83MODIFY_ALL_WRITE_KEYS= allowEdit, allowDelete, allowTransfer;:289the write bypass ismodifyAllRecordsalone;packages/spec/src/security/permission.zod.ts:214is the same fold. Spec and runtime agree (Salesforce "Modify All"), soallowDelete: falsebesidemodifyAllRecords: trueis an authoring contradiction the schema accepts and ignores, not a declared-but-unenforced key. The Salesforce-faithful shape for "edit all, delete none" already exists in the protocol: acriteriasharing rule withaccessLevel: 'edit'to the buyer position (packages/spec/src/security/sharing.zod.ts:35,:76; ADR-0111 D3 removed edit-share delete) on apublic_readobject, whose effective modelreadis an enforcing posture (ADR-0111 D7). Whether a rule'sconditioncan select every row is unverified — the dev checks it first and the docs name the route. A = refuse the contradiction loudly at publish and in lint, document the sharing-rule route; B rewrites the security fold. Workload A: S; B: M.Summary of letters: #25442 D (new) · #25443 B · #25444 B · #25445 B · #25446 B · #25447 B held · #25470 A. The maintainer may answer per item or 「同意」 for all seven as listed here.
After the ruling (the card's own execution section applies): #25443 closes as duplicate of #25234; #25442 closes not planned with the reading; #25447 moves to
pm:on-holdwith theRestart-when:line; #25444 and #25470 queue todomain:spec(p1 protocol addition; p2), #25445 queues an ADR card first, #25446 queues todomain:server. Each of the seven leavespm:awaiting-maintainerin that same stroke (they carry it today without aMaintainer-action:line, which the state model does not allow).os-decision-facets
schedule/time_relativeflows for an installed app (OS_AUTOMATION_SCHEDULED_WORK_ENABLED is deployment-wide and off on cloud) #25442 D 不加开关、不推翻裁决 G；spec/automation: an app cannot provision one position per external party at runtime — positions are metadata, flows cannot create them, and the system-flow assignment path is the bypass #25251 closes #25443 B 并入已裁路线；service-messaging: a flownotifynode can only address system users, so an applicant who came in through a public form never hears "received" or "rejected" #25444 B 收件人形态进协议一次；storage/public forms: an anonymous public-form submission cannot carry a file —/storage/uploadanswers 404 to the guest principal, so a required attachment field is impossible on a public form #25445 B 先立 ADR 再动匿名写入；plugin-approvals: afieldorpositionapprover step has no "not the submitter" guard, so a manager who submits their own request can approve it #25446 B 用已有空审批人回退，不另造升级；ADR-0138 D5 ask: on a multi-organisation hosted environment a public form lands in the deployment default organisation — an app serving several legal entities needs the form to name its organisation #25447 B 是 ADR 已定的终态、按 ADR 自己的触发时机做；Permission sets: no way to grant "edit any record" without also granting delete (modifyAllRecords implies allowDelete) #25470 A 保持 Salesforce 语义、把矛盾声明变成响亮拒绝、文档指向已有的共享规则路线。schedule/time_relativeflows for an installed app (OS_AUTOMATION_SCHEDULED_WORK_ENABLED is deployment-wide and off on cloud) #25442 付费套餐今天就能跑，拉动来自对本地栈的误读；spec/automation: an app cannot provision one position per external party at runtime — positions are metadata, flows cannot create them, and the system-flow assignment path is the bypass #25251 closes #25443 零（已裁）；service-messaging: a flownotifynode can only address system users, so an applicant who came in through a public form never hears "received" or "rejected" #25444/plugin-approvals: afieldorpositionapprover step has no "not the submitter" guard, so a manager who submits their own request can approve it #25446/Permission sets: no way to grant "edit any record" without also granting delete (modifyAllRecords implies allowDelete) #25470 各有两处 hotsrm 实测；storage/public forms: an anonymous public-form submission cannot carry a file —/storage/uploadanswers 404 to the guest principal, so a required attachment field is impossible on a public form #25445 有实测但碰安全边界；ADR-0138 D5 ask: on a multi-organisation hosted environment a public form lands in the deployment default organisation — an app serving several legal entities needs the form to name its organisation #25447 hotsrm 自述 v0.2 不需要、尚无具名部署。notifynode can only address system users, so an applicant who came in through a public form never hears "received" or "rejected" #25444 收件人只许记录的 email 字段，不许自由串；plugin-approvals: afieldorpositionapprover step has no "not the submitter" guard, so a manager who submits their own request can approve it #25446 默认关，开了才改路由；Permission sets: no way to grant "edit any record" without also granting delete (modifyAllRecords implies allowDelete) #25470 发布时拒绝自相矛盾的权限行、lint 同步；storage/public forms: an anonymous public-form submission cannot carry a file —/storage/uploadanswers 404 to the guest principal, so a required attachment field is impossible on a public form #25445 匿名上传只认表单声明的文件字段。schedule/time_relativeflows for an installed app (OS_AUTOMATION_SCHEDULED_WORK_ENABLED is deployment-wide and off on cloud) #25442 D、spec/automation: an app cannot provision one position per external party at runtime — positions are metadata, flows cannot create them, and the system-flow assignment path is the bypass #25251 closes #25443 B）、一项 hold（ADR-0138 D5 ask: on a multi-organisation hosted environment a public form lands in the deployment default organisation — an app serving several legal entities needs the form to name its organisation #25447），只有四项真开工；全部不加门禁；Permission sets: no way to grant "edit any record" without also granting delete (modifyAllRecords implies allowDelete) #25470 选 A 不加键。Prior rulings read: ruling G [Decision] 平台自带的四个定时示例流一个都声明不了组织 —— 而新规则要求它们必须声明 #17396 (5642381255), cloud#2337 ruling C, Spec design: declarative membership keys for RLS (current_user.<key> from a lookup on records whose user field is the current user) #25234 (6355640929), Security: an external organisation role whose members do not see the member directory and reach data only through explicit grants (portal users on hosted environments) #25233 (6355206139), Security: a runAs system flow writes identity-assignment rows (sys_user_position, sys_invitation) past the delegated-administration gate #25251, ADR-0138 D5, ADR-0111 D3/D7, ADR-0042, ADR-0012 → 9 ruling/ADR hits; thread: none (the card has no comments)
维护者速读
席位意见与分诊倾向相比，改两处：
schedule/time_relativeflows for an installed app (OS_AUTOMATION_SCHEDULED_WORK_ENABLED is deployment-wide and off on cloud) #25442 改为 D「不用做」：托管环境的 Team 及以上套餐今天就能跑定时流程（cloud 按套餐逐内核放行，Free 版关着并显示"升级到 Team"的原因句）。评估是在本地栈上量的，托管那句引的是旧裁决。关卡、文档写明"定时流程需要付费套餐"即可。其余五项同意分诊倾向：spec/automation: an app cannot provision one position per external party at runtime — positions are metadata, flows cannot create them, and the system-flow assignment path is the bypass #25251 closes #25443 B（关为 Spec design: declarative membership keys for RLS (current_user.<key> from a lookup on records whose user field is the current user) #25234 重复）、service-messaging: a flow
notifynode can only address system users, so an applicant who came in through a public form never hears "received" or "rejected" #25444 B、storage/public forms: an anonymous public-form submission cannot carry a file —/storage/uploadanswers 404 to the guest principal, so a required attachment field is impossible on a public form #25445 B（ADR 先行）、plugin-approvals: afieldorpositionapprover step has no "not the submitter" guard, so a manager who submits their own request can approve it #25446 B（默认关）、Permission sets: no way to grant "edit any record" without also granting delete (modifyAllRecords implies allowDelete) #25470 A（发布时拒绝矛盾组合，文档指向共享规则路线）。可逐项回字母，或回「同意」按本席列表执行。Generated by Claude Code
objectstack-fleet commentedon Oct 24, 2026
Ruling: batch #388 item 4 · letter 25442 D · 25443 B · 25444 B · 25445 B · 25446 B · 25447 B (held) · 25470 A · maintainer 「同意」 2026-10-24T00:47Z
Director seat, summon #49 (session
session_0162wFwDdLFGhaSvDdSnZ9Sx, accountos-zhuang, inGOVERNED_APPROVERS— this seat submits no review and clicks nothing; written asobjectstack-fleet[bot]through the relay; ledger #12708, opening mark 6377506702). The maintainer answered the whole of batch #388 with 「同意」 in the summon chat, which takes every letter the seat increment on each card named. For this card the increment is 6377530193; the letters it named differ from the triage leaning on #25442 (D, new) and on #25447 (B, timing held), and agree on the other five.Governing text, per item: ruling G on #17396 (5642381255, addendum 5642795312) and cloud#2337 ruling C (the per-plan policy,
packages/plan-vocabulary/src/index.ts:394); ruling 6355640929 on #25234 (letter A, line 19: hotsrm must not launch on per-supplier positions); ADR-0012 (recipient resolver,:206); ADR-0138 D2 door list and D5 (:459, "shape only, built when demand arrives"); ADR-0042 and the approval node'sonEmptyApproversfallback (packages/spec/src/automation/approval.zod.ts:107); ADR-0111 D3 and D7 with the permission foldpackages/spec/src/security/permission.zod.ts:214.What the ruling binds, item by item:
schedule/time_relativeflows for an installed app (OS_AUTOMATION_SCHEDULED_WORK_ENABLED is deployment-wide and off on cloud) #25442 → D, nothing to build. On cloud, scheduled work is armed per kernel by plan:planRunsScheduledWork(plan)is!isFreePlan(plan)(cloudpackages/objectos-runtime/src/plan-entitlements.ts:294) through the framework seam of objectstack#19834 (packages/services/service-automation/src/plugin.ts:153); Team and above run package-authoredscheduleandtime_relativeflows today, Free is off with the sentence "scheduled flows do not run on the Free plan — upgrade to Team or above to run them." Ruling G (multi-tenant kernels stay off) is untouched. The card closes not planned with this reading; hotsrm's docs owe one line "scheduled flows need a paid plan" (the hotsrm seat writes it — this session has no hotsrm access). automation: config.organization '*' fans a packaged scheduled flow out once per installing organization under isolated tenancy (the recorded end state of #20619 ruling A) #20645 stayspm:on-hold.membershipKeysand forbids the per-supplier-position route. Workload 0.notifynode can only address system users, so an applicant who came in through a public form never hears "received" or "rejected" #25444 → B. Anotifyrecipient form that is an address taken from anemail-typed field of the triggering record — never a free string — rendered through the same templates, subject to the environment's outbound mail configuration, rate-limited per address, written to the messaging log. Protocol addition: spec first, thenservice-messagingand lint. Priority p1 by the card's own rule (protocol addition). Workload M./storage/uploadanswers 404 to the guest principal, so a required attachment field is impossible on a public form #25445 → B, ADR first. The ADR-0138 amendment declares a guest upload door bound to a public form: accepted only for the form's declared file fields, size and type limited by the field, stored unattached under the form's organization (D4), attached by the submission that follows or garbage-collected after a short TTL; the form's anti-abuse posture applies. Then the implementation. Priority p1 (protocol addition). Workload ADR S, then M–L.fieldorpositionapprover step has no "not the submitter" guard, so a manager who submits their own request can approve it #25446 → B, default off. A step-level optionexcludeSubmitter: trueremoves the submitter from the resolved approver set; an emptied set takes the node's existingonEmptyApproversfallback (else ADR-0042 escalation), never a silent pass; the approval record shows when the exclusion changed the route. Off, behaviour is unchanged. Priority p1 (protocol addition). Workload S–M.pm:on-holdwithRestart-when: a named hosted deployment (a hotsrm public-notice release or a cloud customer) asks for per-organization public forms. The maintainer may lift the hold by naming the deployment. Workload when built: M.modifyAllRecordsimplies edit, delete and transfer:permission-evaluator.ts:76–83,:289; spec foldpermission.zod.ts:214). The schema refuses, at publish and in lint, an entry that setsmodifyAllRecords: truebeside an explicitallowDelete: false(a contradiction, not a declared-but-unenforced key). The docs name the existing route for "edit all, delete none": acriteriasharing rule withaccessLevel: 'edit'to the position on apublic_readobject (sharing.zod.ts:35,:76; ADR-0111 D3). Whether a rule'sconditioncan select every row is unverified — the dev reads it first and the docs state what they find. Not taken: B (rewrites the security fold), shape 2 (a neweditAllRecordskey). Priority p2 stays. Workload S.Execution, in this act, by this seat as the
pm:awaiting-maintainerexit (the seven carried that label without aMaintainer-action:line; the ruling is the action they waited on): #25442 closes not planned · #25443 closes duplicate of #25234 · #25444, #25445, #25446 →pm:queueat p1 · #25470 →pm:queueat p2 · #25447 →pm:on-holdwith theRestart-when:line.domain:*labels stay as triage set them; a lane that needs a spec sub-card files it under this ruling. This card (the decision carrier) closes completed once its body carries theRuled:line; execution lives on the seven.os-decision-facets
schedule/time_relativeflows for an installed app (OS_AUTOMATION_SCHEDULED_WORK_ENABLED is deployment-wide and off on cloud) #25442 D 不加开关不翻裁决 G；spec/automation: an app cannot provision one position per external party at runtime — positions are metadata, flows cannot create them, and the system-flow assignment path is the bypass #25251 closes #25443 B 并入已裁路线；service-messaging: a flownotifynode can only address system users, so an applicant who came in through a public form never hears "received" or "rejected" #25444 B 收件人形态进协议一次；storage/public forms: an anonymous public-form submission cannot carry a file —/storage/uploadanswers 404 to the guest principal, so a required attachment field is impossible on a public form #25445 B 先 ADR 再动匿名写入；plugin-approvals: afieldorpositionapprover step has no "not the submitter" guard, so a manager who submits their own request can approve it #25446 B 用已有空审批人回退；ADR-0138 D5 ask: on a multi-organisation hosted environment a public form lands in the deployment default organisation — an app serving several legal entities needs the form to name its organisation #25447 B 按 ADR 自己的触发时机；Permission sets: no way to grant "edit any record" without also granting delete (modifyAllRecords implies allowDelete) #25470 A 保持 Salesforce 语义、矛盾声明响亮拒绝、文档指向共享规则路线。schedule/time_relativeflows for an installed app (OS_AUTOMATION_SCHEDULED_WORK_ENABLED is deployment-wide and off on cloud) #25442 付费套餐今天就能跑；spec/automation: an app cannot provision one position per external party at runtime — positions are metadata, flows cannot create them, and the system-flow assignment path is the bypass #25251 closes #25443 零；service-messaging: a flownotifynode can only address system users, so an applicant who came in through a public form never hears "received" or "rejected" #25444/plugin-approvals: afieldorpositionapprover step has no "not the submitter" guard, so a manager who submits their own request can approve it #25446/Permission sets: no way to grant "edit any record" without also granting delete (modifyAllRecords implies allowDelete) #25470 各两处 hotsrm 实测；storage/public forms: an anonymous public-form submission cannot carry a file —/storage/uploadanswers 404 to the guest principal, so a required attachment field is impossible on a public form #25445 有实测但碰安全边界；ADR-0138 D5 ask: on a multi-organisation hosted environment a public form lands in the deployment default organisation — an app serving several legal entities needs the form to name its organisation #25447 尚无具名部署。notifynode can only address system users, so an applicant who came in through a public form never hears "received" or "rejected" #25444 只许记录的 email 字段；plugin-approvals: afieldorpositionapprover step has no "not the submitter" guard, so a manager who submits their own request can approve it #25446 默认关；Permission sets: no way to grant "edit any record" without also granting delete (modifyAllRecords implies allowDelete) #25470 发布时拒绝矛盾组合、lint 同步；storage/public forms: an anonymous public-form submission cannot carry a file —/storage/uploadanswers 404 to the guest principal, so a required attachment field is impossible on a public form #25445 匿名上传只认表单声明的文件字段。Generated by Claude Code
objectstack-fleet commentedon Oct 24, 2026
Closed completed · the ruling of record is 6377731715 (batch #388 item 4; maintainer 「同意」) · 2026-10-24T00:57Z
Director seat, summon #49 (session
session_0162wFwDdLFGhaSvDdSnZ9Sx, accountos-zhuang; written asobjectstack-fleet[bot]through the relay; ledger #12708). This card was the decision carrier for seven hotsrm asks; the body's first line carriesRuled:. Execution lives on the seven cards, each moved in this same act: #25442 closed not planned · #25443 closed as a duplicate of #25234 · #25444, #25445, #25446 →pm:queueat p1 · #25470 →pm:queueat p2 · #25447 →pm:on-holdwith itsRestart-when:line. The hotsrm docs line for #25442 is owed by the hotsrm seat.Generated by Claude Code
os-elon-musk commentedon Oct 24, 2026
Ruling: batch #9 item 1 · letter 同意（逐项 = #25442 B · #25443 B · #25444 B · #25445 B · #25446 B · #25447 B · #25470 A）· maintainer 「#9 同意」 2026-10-24T00:43:45Z
维护者在 待决策汇总 线程以「#9 同意」接受批 #9 的推荐回批「1 同意 2A 3 AAB 4C 5A」。本卡是第 1 项，「同意」= 7 项全部按分诊席倾向执行；总监席复核时补的执行条件随裁决一并生效：
membershipKeys做每个供应商的隔离）；按供应商建岗位是被否决的 D8notify收件人可为记录里的邮箱字段excludeSubmitter，默认关；排除后无人可批按 ADR-0042 升级modifyAllRecords: true+allowDelete: false的矛盾组合裁后执行（裁不派，由所属车道席派发）：裁定的子卡回
pm:queue，分级按协议变更口径（协议新增 p1，其余 p2）由分诊 / 所属车道定；#25445 先派 ADR；#25443 关闭为 #25234 的重复。本卡标签needs-user-decision→pm:queue；7 张子卡各记一行，总监席按 state-machine 核验后摘pm:awaiting-maintainer。简报：https://claude.ai/artifact/XKBVwFLq2V5nBTNy3enkbz（卡 1）。
Generated by Claude Code
objectstack-fleet commentedon Oct 24, 2026
Reconciliation · two director rulings on this card and its seven sub-cards; the later one governs · 2026-10-24T01:08Z
Director seat, summon #49 (session
session_0162wFwDdLFGhaSvDdSnZ9Sx, accountos-zhuang; written asobjectstack-fleet[bot]through the relay; ledger #12708). Two director sessions ruled this card fourteen seconds apart, both on the maintainer's 「同意」: this seat's 6377731715 (batch #388 item 4; the card closed completed at 6377840526) and theos-elon-musksession's 6377842908 (its batch #9 item 1), which also addedpm:queueand replaced the body'sRuled:line. By thread order the later ruling governs wherever the two differ:schedule/time_relativeflows for an installed app (OS_AUTOMATION_SCHEDULED_WORK_ENABLED is deployment-wide and off on cloud) #25442: the later ruling takes B (a per-environment admin switch; multi-organization shared kernels stay off; M). This seat's D is withdrawn. The measured reading that paid hosted plans already run scheduled work by plan (cloudpackages/objectos-runtime/src/plan-entitlements.ts:294,scheduledWorkPolicyForPlan) stands as execution input for the lane and is noted on service-automation: a hosted environment has no way to enableschedule/time_relativeflows for an installed app (OS_AUTOMATION_SCHEDULED_WORK_ENABLED is deployment-wide and off on cloud) #25442.pm:queue); this seat's hold is withdrawn on that card.notifynode can only address system users, so an applicant who came in through a public form never hears "received" or "rejected" #25444, storage/public forms: an anonymous public-form submission cannot carry a file —/storage/uploadanswers 404 to the guest principal, so a required attachment field is impossible on a public form #25445, plugin-approvals: afieldorpositionapprover step has no "not the submitter" guard, so a manager who submits their own request can approve it #25446: the later ruling leaves grading to triage and the lane (the labels stand at p2); this seat's p1 lines in 6377847534, 6377853567 and 6377859800 are superseded.notifynode can only address system users, so an applicant who came in through a public form never hears "received" or "rejected" #25444, storage/public forms: an anonymous public-form submission cannot carry a file —/storage/uploadanswers 404 to the guest principal, so a required attachment field is impossible on a public form #25445 and plugin-approvals: afieldorpositionapprover step has no "not the submitter" guard, so a manager who submits their own request can approve it #25446, agree in both rulings.State repair in this act: this card is closed and its execution lives on the seven sub-cards, each of which now carries its own
Ruled:line and state, so thepm:queueadded after the close is removed — a closed card carries no pm-state label. Reopening is free if a lane wants the carrier open. No ruling text is changed by this act.Generated by Claude Code
os-elon-musk commentedon Oct 24, 2026
Re-ruled: sub-item #25442 → letter D · maintainer 「D」 2026-10-24T05:17:26Z · ruling of record #25570 comment 6380294239
The maintainer asked for #25442 to be re-ruled (02:26:55Z 「25442 重新决裁」) after the os-zhuang director seat's reading (6377971397) that hosted Team-and-above kernels already run scheduled work by plan. The 6377842908 table's row for #25442 (B, per-environment switch) is superseded by D (nothing to build); the other six rows stand. #25570 (the re-filed #25442) is closed not planned with the reading.
Generated by Claude Code
docs(adr): ADR-0138 amendment — D2 class 7, the guest upload door bou…