[Decision] cloud: sample rows an app install seeds on a hosted environment may have no owner — apply #30324's rule (owner = the installer, ordinary permissions, no exception)

repo:cloud#3 · hotlong · session_01Q4EjjRhUZjdy8VXs6Kkur2

Ruled: 6673940208 · letter A · 2026-11-06T01:12Z
Blocked-by: objectstack-ai/cloud#3644

domain:server#5 · os-elon-musk · session_016WV4cyvF7SP65frVFAYLv7

Filing gate: ② a decision only the maintainer can make, filed on the maintainer's direct word (③), verbatim: 「写一个 cloud 车道的决策卡，带上我的意见 cloud 车道也有类似的问题。」 (2026-11-05, Claude Code project "Objectstack", thread 「Server 车道派发(席5 #28677)」). Analysis-tier: seat tier (this seat's session default).
Reader: the repo:cloud seat (cloud PM). This seat cannot read the cloud repository, so the premise below is unmeasured on the cloud side and is the cloud seat's first step.
Dedupe: is:issue label:repo:cloud seed (9 hits, none on seed ownership), is:issue seed owner_id created_by install (41 hits; the only match is #30324, this card's objectstack twin). New.

维护者速读

在 objectstack 本仓，应用安装时写入的示例数据没有负责人和创建人，同事打开应用什么都看不到。你在 #30324 上已经定了：示例数据写入时负责人、创建人就是执行安装的管理员，之后完全按平台统一的权限规则走，不为示例数据破例；私有共享下同事看不到也接受。你说 cloud 车道也有类似问题，本卡把同一条规则交给 cloud 车道：cloud 侧凡是在安装或开通环境时写入示例数据的地方，都要带上安装人作为负责人和创建人，不加任何示例数据专用的权限规则。我建议 A，与你在 #30324 的意见一致。

The question

When the hosted platform (cloud) installs an app into a customer's environment and seeds its sample data, who owns those rows, and do they get any special visibility?

Governing text:

The maintainer's ruling on the objectstack twin, recorded on [Decision] An installed app's sample data has no owner, so a colleague opening the app sees none of it #30324 as comment 6670861426, verbatim: 「HotCRM 是私有共享，记录的主人是管理员，同事照样看不到，这个按照平台同意的权限规则就可以。」 and 「我不认为需要为了事例数据破例。」
packages/plugins/plugin-security/src/claim-seed-ownership.ts (objectstack main b77c160a), header: boot seeds land with owner_id = NULL or usr_system, so "owner-keyed UX — 'My' views, owner reports, owner notifications — is empty out of the box"; the platform hands boot-seeded rows to the first platform admin. The same header says the marketplace install's seed is NOT covered by that pass, which is the gap [Decision] An installed app's sample data has no owner, so a colleague opening the app sees none of it #30324 closes on the objectstack side.
Protocol: no spec change is expected (the rows already carry owner_id / created_by); if the cloud side finds one is needed, that is a domain:spec card first.

Premise to measure first (cloud seat)

Which cloud doors seed sample or demo rows into a customer environment: the hosted marketplace install, environment provisioning, a template or blueprint publish that seeds records, any reseed or replay. Re-check: in the cloud repository, search the seed and install paths for writes of seed datasets, then read one seeded row's owner_id and created_by on a hosted environment after an install.
Whether those rows land ownerless (NULL or usr_system) the way the objectstack marketplace install does today ([Decision] An installed app's sample data has no owner, so a colleague opening the app sees none of it #30324 measured: the installer reads 11 accounts, a member 0, owner_id and created_by empty).
If no cloud door seeds ownerless rows, this card closes with that reading.

Options

Option	What it does	What the customer sees	Work
A. Owner = the installer, ordinary rules (the maintainer's stated position)	Every cloud seeding door writes `owner_id` and `created_by` as the person who ran the install or provisioning; nothing else changes	The installer owns the demo data and sees it in "My" views and owner reports. Under `private` sharing, colleagues see it only as they would any real record	Cloud lane, one PR per seeding door family; precedent: #30324 (objectstack side, in flight) and `claim-seed-ownership.ts`
B. A sample-data read rule	Mark seeded rows and let holders of the app's permission read them	Colleagues see the demo data read-only	Cloud + server + security lanes; rejected on #30324 by the maintainer
C. Leave the rows ownerless	No change	Demo data visible only to administrators; owner views and reports empty	None

In business terms: A treats demo data like data an admin typed in. B is a special showroom pass. C leaves the demo data with nobody's name on it.

Recommendation: A

四轴（中文）：

项目长远合理性： 示例数据和真实数据走同一套权限规则，平台里没有第二种记录。objectstack 侧 [Decision] An installed app's sample data has no owner, so a colleague opening the app sees none of it #30324 已按此执行，cloud 侧照做，两边一致。
实际业务需求： 管理员装好应用后，自己的"我的记录"、按负责人的报表都能看到演示数据；同事是否可见由应用自己的共享设置决定，和真实数据一样，客户不会被一套只对演示数据生效的规则搞糊涂。
防 AI 写代码犯错： 没有特例就没有特例的边角（[Decision] An installed app's sample data has no owner, so a colleague opening the app sees none of it #30324 里就出现过"示例主记录下的真实明细被同事看到"这种静默泄露风险）。出错时谁看到什么，只取决于平台统一规则。
创业阶段不扩散： 不加新权限路径、不加新配置，只是在写入时补上本该有的两个字段。

Blind spot: this seat has not read the cloud code, so the number of cloud seeding doors and whether any already stamps an owner are unknown.

只看①选 A；②③④ 是否翻转：否。

os-decision-facets
① 项目长远合理性: A removes a special case; demo rows become ordinary records under one permission model, same as the objectstack side (#30324).
② 实际业务拉动: the installer's owner views and reports are empty today on the objectstack side (measured on #30324); cloud premise unmeasured.
③ 防 AI 犯错: no sample-only access path, so no silent widening; visibility follows the one platform rule.
④ 创业阶段不扩散: no new key, rule or gate; two fields written at seed time.

After the ruling

The cloud seat measures the premise, then dispatches the seeding doors it finds, each stamping the installer as owner and creator, pinned on a hosted environment. No sample-data permission rule is added. Related: #30324 (objectstack twin, in flight under this seat).

Blocks nothing.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: audit · p2 · `domain:cloud` · `needs-user-decision` · 2026-11-05T22:53Z

⛔ Not a claim.

A cloud decision card: the owner of sample rows an app install seeds on a hosted environment. Option A is the maintainer's stated position: the owner is the installer, applying [Decision] An installed app's sample data has no owner, so a colleague opening the app sees none of it #30324's rule. Under the standing rule that an issue touching cloud is the cloud PM's, the repo:cloud seat measures the cloud premise first, and the maintainer rules.

Generated by Claude Code

repo:cloud#3 · hotlong · session_01Q4EjjRhUZjdy8VXs6Kkur2

Ruling: objectstack#30680 hosted install sample-row ownership · letter A · maintainer 「A 归安装人（推荐）」 · 2026-11-06T01:12Z

Provenance:

Who: the maintainer, in person, in the repo:cloud#3 seat session session_01Q4EjjRhUZjdy8VXs6Kkur2.
What: two selections, verbatim:
- on the card: 「A 归安装人（推荐）」;
- on the three sub-cases: 「重生成者·不改存量·归 owner（推荐）」.

Premise, measured by the cloud seat on cloud origin/main 6393eb75 (source reads; a live hosted read is still owed).

The hosted marketplace install does NOT go through the framework's install.
- The control plane records sys_package_installation with with_sample_data and evicts the kernel (service-cloud/src/routes/package-install/install.ts:721-831).
- On rebuild the runtime replays the seed union under a context with no user id (objectos-runtime/src/artifact-kernel-factory.ts:2449).
- It then hands every unowned row to the organization's earliest owner member (seed-ownership-handover.ts:236-249), which is not the installer.
created_by stays NULL.
installed_by is written on a fresh install only (install.ts:781) and is read nowhere.
reseed_sample_data (installation-actions.ts:650-716) and the backfill hand-over (artifact-kernel-factory.ts:2538-2553) take the same path.
objectstack#30324 (landed as PR fix(cloud-connection): an installed package's sample rows are owned by the person who seeded them #30739) covers cloud-connection's local install only. Hosted does not mount that install, so this is cloud's fix, not a pin move.
The AI build's sample rows already carry the builder as owner_id / created_by (sample-data-tools.ts:1469-1483), which matches the ruling.
Environment provisioning seeds identity rows only, no sample rows.

The ruling.

A. On a hosted environment, sample rows an app install seeds get the installer as owner_id and created_by. Ordinary platform permissions apply, with no sample-data exception.
Reseed: the person who triggers reseed_sample_data owns the reseeded rows.
Existing rows: rows already seeded and now owned by the organization owner are not re-stamped.
No installer: when there is no installing person (a service-key or CLI install, or an installer with no user in the environment yet), the organization owner is the fallback, and the fallback is reported.

Execution.

Cloud card cloud#3644 carries the work. This card goes needs-user-decision → pm:blocked on it, and the seat closes it once that lands.
The unmanaged-install card cloud#3624 gets the parity line: it loads no sample data, and if it ever does, the rows are stamped with the installer.
PR cloud#3595 needs no change. It binds the app's default permission set and touches no row ownership.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: blocker closed · `pm:blocked` removed · decision stays · 2026-11-06T05:49Z

⛔ Not a claim.

Read fresh: the named blocker objectstack-ai/cloud#3644 is closed. pm:blocked is removed. The card stays needs-user-decision and is the cloud PM's.

Generated by Claude Code

repo:cloud#3 · hotlong · session_01Q4EjjRhUZjdy8VXs6Kkur2

Executed · 2026-11-06T08:26Z

Ruling A (record 6673940208) is executed by objectstack-ai/cloud#3644, landed as PR objectstack-ai/cloud#3647 (merge commit 8f574b9e): on hosted installs, sample rows go to the installer (owner_id and created_by), the reseeder owns reseeded rows, already-owned rows are untouched, and the organization owner is the reported fallback. No sample-data permission was added. Self-hosted standalone EE picks up #30324 with a later cloud pin move. The staging reading is owed on objectstack-ai/cloud#3644.

Navigation Menu

Repository navigation

[Decision] cloud: sample rows an app install seeds on a hosted environment may have no owner — apply #30324's rule (owner = the installer, ordinary permissions, no exception) #30680

维护者速读

The question

Premise to measure first (cloud seat)

Options

Recommendation: A

After the ruling

Triage: audit · p2 · `domain:cloud` · `needs-user-decision` · 2026-11-05T22:53Z

Triage: blocker closed · `pm:blocked` removed · decision stays · 2026-11-06T05:49Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Decision] cloud: sample rows an app install seeds on a hosted environment may have no owner — apply #30324's rule (owner = the installer, ordinary permissions, no exception) #30680

Description

维护者速读

The question

Premise to measure first (cloud seat)

Options

Recommendation: A

After the ruling

Activity

objectstack-fleet commented on Nov 5, 2026

Triage: audit · p2 · domain:cloud · needs-user-decision · 2026-11-05T22:53Z

objectstack-fleet commented on Nov 6, 2026

objectstack-fleet commented on Nov 6, 2026

Triage: blocker closed · pm:blocked removed · decision stays · 2026-11-06T05:49Z

objectstack-fleet commented on Nov 6, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: audit · p2 · `domain:cloud` · `needs-user-decision` · 2026-11-05T22:53Z

Triage: blocker closed · `pm:blocked` removed · decision stays · 2026-11-06T05:49Z