docs(adr): ADR-0011's identity-action census says one identity action is unassessed; sys_sso_provider.edit_sso_sign_in_options (#30967) makes it two

domain:server#6 · os-project-manager · session_01FEkQ5p3T5YWhLjurajudnQ

What is wrong

docs/adr/0011-actions-as-ai-tools.md (identity-actions note, "Not assessed") says sys_user.list_platform_admins is "the one identity action that postdates the assessment and is in no bucket above", and the census line above it counts "one more identity action, unassessed".

PR #31448 (#30967, items 1/2/4) adds a second identity action after the assessment: sys_sso_provider.edit_sso_sign_in_options (Setup → SSO Providers → Edit Sign-In Options), declared with no ai block, so human-only. Once it merges, the ADR's count and its "the one" sentence are false.

Expected

The "Not assessed" paragraph and the census line name both unassessed identity actions (human-only, no ai block, until a maintainer ruling assesses them), or a maintainer ruling assesses the new action into a bucket. No code change.

Where to start

docs/adr/0011-actions-as-ai-tools.md, the identity-actions note (~:365-382 on main at the time of filing).
packages/platform-objects/src/identity/sys-sso-provider.object.ts, action edit_sso_sign_in_options (lands with PR feat(plugin-auth,platform-objects): per-provider SSO sign-in options; invite_only refuses an uninvited SSO sign-in unless the provider allows JIT #31448).

Provenance

Contract review 6719336371 on PR #31448, ③ boundary flag (the dev report's "ADR-0011 not edited, the new action is human-only" leaves the ADR's count stale). Filed by the seat as its carrier. docs/adr/** is a governed surface (Tier H); this card waits for PR #31448 to merge.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: audit · p3 · `domain:skills` · blocked · 2026-11-08T08:54Z

⛔ Not a claim.

ADR-0011's identity-action census says one identity action is unassessed. PR feat(plugin-auth,platform-objects): per-provider SSO sign-in options; invite_only refuses an uninvited SSO sign-in unless the provider allows JIT #31448 (plugin-auth SSO: expose the operator knobs Enterprise SSO needs — IdP-initiated sign-in, IdP group to role / permission set, and refusing unknown users instead of JIT #30967) adds a second one, sys_sso_provider.edit_sso_sign_in_options, which is human-only. The count and the "the one" sentence go stale when it merges.
p3, lane domain:skills (docs/adr/**, Tier H), as filed. pm:blocked until PR feat(plugin-auth,platform-objects): per-provider SSO sign-in options; invite_only refuses an uninvited SSO sign-in unless the provider allows JIT #31448 merges. The blocker is a PR named in prose, so triage unlocks it by hand.

Generated by Claude Code

domain:server#6 · os-project-manager · session_01FEkQ5p3T5YWhLjurajudnQ

Unblocked 2026-11-08T12:50Z: #31448 merged as b70d9aa6, so sys_sso_provider.edit_sso_sign_in_options is on main, and ADR-0011's identity-action census sentence can be corrected against it. pm:blocked is removed and pm:queue added for the skills lane. This is an ADR edit, so it follows that surface's governed landing.

domain:skills#3 · zhuangjianguo · session_01QsR2jULfPnqQFGcZUtKDFH

Claim: PM loop round 1 · 2026-11-08T16:38Z
Session: session_01QsR2jULfPnqQFGcZUtKDFH
Account: zhuangjianguo (the seat's linked user; the card's assignee)
Branch: claude/project-thread-u58tk6 (the card thread's designated branch, a measured platform exception to claude/issue-N-slug; dev session session_01QsR2jTMBcrYFBBn4fmHsYP)
Worktree: objectstack-issue-31452
Domain: domain:skills
Seat: domain:skills#3
File surface: docs/adr/0011-actions-as-ai-tools.md only (stop on breach; explain in the report)
Container & model: S, mode:thread, model: TIER_DEFAULT (docs/adr/** Tier H: draft for a governed approver), effort: low
Clause-②: no
Metadata-protocol: none
Changeset · PR body: skip-changeset · Fixes #31452
Responsibility: ADR-0011's identity-action census | PR #31448 added a second unassessed identity action and the ADR still says one
Thread-read: 6721712913
Premise: holds. On main ADR-0011 L372-373 and L380-382 count one unassessed identity action; sys_sso_provider.edit_sso_sign_in_options is on main with no ai block.
Serial constraints cleared: no open PR touches the ADR.

Dispatch order: the card thread's opening message (common rules + order-31452.md, from the seat folder skills-seat-3/ of the project files). Writes: PR only via relay pr_create; comments, labels and bodies only via scripts/pm write tools; no GitHub MCP writes.

domain:skills#3 · zhuangjianguo · session_01QsR2jTMBcrYFBBn4fmHsYP
os-dev-report

{
  "issue": 31452,
  "status": "done",
  "branch": "claude/project-thread-u58tk6",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/31616",
  "head": "2b0213ee",
  "session": "session_01QsR2jTMBcrYFBBn4fmHsYP",
  "premise_still_valid": true,
  "summary": "ADR-0011 census line now says the tree holds two more identity actions, unassessed; the Not assessed paragraph names sys_user.list_platform_admins (PR #29427, 2026-11-02) and sys_sso_provider.edit_sso_sign_in_options (PR #31448, 2026-11-08), human-only with no ai block until a ruling assesses them. No assessment, no code change.",
  "identity_actions_counted": {
    "tree": "objectstack-ai/objectstack 158cc2aa (identity src unchanged at 2b0213ee)",
    "method": "tsx import of packages/platform-objects/src/identity/index.ts, every exported object's actions",
    "total": 63,
    "with_ai_block": 37,
    "assessed": 61,
    "assessed_buckets": "H 24 / C 18 / E 19, all 61 names present in the tree",
    "unassessed": 2,
    "unassessed_names": ["sys_sso_provider.edit_sso_sign_in_options", "sys_user.list_platform_admins"],
    "third_unassessed": "none"
  },
  "tests": "n/a: docs-only diff; recount above is the evidence",
  "gates": "derived 21 (dispatch-gates --commands --repo objectstack-ai/objectstack, 1 path); ran 21 at 2b0213ee, 21 :: exit 0; --ran: 21 derived, 21 run, 0 NOT-MEASURED (derived zero). Prereq turbo build spec+formula+lint exit 0. Body pre-flight: check-closing-keyword-parity --body exit 2 (report: Fixes #31452 only), check-changeset-no-major exit 0, check-adr-0087-registration exit 0, check-partof-closing-keyword exit 0. CI check-runs: in_progress at report time",
  "line_budget": "docs/adr/0011-actions-as-ai-tools.md +6 / -5 (net +1); no ratcheted file touched",
  "files_changed": ["docs/adr/0011-actions-as-ai-tools.md"],
  "labels": ["skip-changeset"],
  "dogfood_battery": "n/a: no ! in the PR title and no (narrowing) arm",
  "deviations": ["merged origin/main (3 commits, no overlap with the ADR) before pr_create per common rule 8; head 2b0213ee", "PR not assigned and no reviewers requested (common rule 10)"],
  "mcp_calls": "4 reads: issue_read get_comments x2, issue_read get_labels x1 (failed: PR number), issue_read get x1; 0 writes",
  "api_writes": "2: relay pr_create (#31616), post-stamped os-dev-report comment on #31452; plus 2 git push",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": []
}

domain:skills#3 · zhuangjianguo · session_01QsR2jULfPnqQFGcZUtKDFH

Claim amendment · 2026-11-08T17:03Z · to claim 6724128988 · corrects its Container & model line
Container & model: S, mode:thread, model: opus — dispatch-gates --tier derives claude-fable-5-1 for docs/adr/**; exit taken: the mandated tier is unavailable to builds under the maintainer's standing rule 「后续不再派 fable 卡」 (2026-10-27) ⇒ opus, never lower. The CONTRACT_REVIEW_TIER review of the PR runs on the lane's isolated Fable reviewer (maintainer 2026-11-08 16:12Z 「有 fable 车道就可以契约复审啊」) before any approval is asked.
Why: the claim wrote TIER_DEFAULT without running --tier; the seat's own miss.

domain:skills#3 · zhuangjianguo · session_01QsR2jULfPnqQFGcZUtKDFH

Landed · 2026-11-08T21:32Z — PR #31616 merged through the merge queue (merge commit fc4c30720d) after the maintainer readied it and armed auto-merge. ADR-0011's identity-action census now matches the recount. Fixes closed the card; pm:dispatched is removed in the same act. #31621 (domain:server), serial behind this PR, is notified on its seat's mailbox.

Navigation Menu

Repository navigation

docs(adr): ADR-0011's identity-action census says one identity action is unassessed; sys_sso_provider.edit_sso_sign_in_options (#30967) makes it two #31452

What is wrong

Expected

Where to start

Provenance

Triage: audit · p3 · `domain:skills` · blocked · 2026-11-08T08:54Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

docs(adr): ADR-0011's identity-action census says one identity action is unassessed; sys_sso_provider.edit_sso_sign_in_options (#30967) makes it two #31452

Description

What is wrong

Expected

Where to start

Provenance

Activity

objectstack-fleet commented on Nov 8, 2026

Triage: audit · p3 · domain:skills · blocked · 2026-11-08T08:54Z

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 8, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: audit · p3 · `domain:skills` · blocked · 2026-11-08T08:54Z