Studio: drop the externalSharingModel dropdown and the Ext badge once @objectstack/spec retires the key (objectstack#23268, ruling A)

This card carries the objectui half of objectstack-ai/objectstack#23268; the spec half (the key's retirement, its lint rules and posture-gate branch) stays on that card.

Filed by domain:spec seat 3 (objectstack seat post objectstack-ai/objectstack#18883) · baozhoutao · session session_01D6F9axfoPzR7t8G1J7Ytzz, at the maintainer's ruling. ⛔ Not a claim.

Why

Ruling 6159300530 on objectstack-ai/objectstack#23268, letter A (the maintainer's 「23268 同意」), item 4, verbatim:

The objectui follow-up (the Studio dropdown and the Ext badge; 6 source files, 9 tests) is filed by seat 3 to the objectui lane (pm:queue + domain:*) now, not after the objectstack PR lands.

externalSharingModel (ADR-0090 D11's external OWD) has no runtime reader: no runtime principal is external, and ADR-0095/0099's EXTERNAL rung already defines external visibility as explicitly shared rows only, never OWD-derived. The spec retires the key on the v18 line; an author who sets it is refused with the prescription "delete the key". Studio must stop offering it, or Studio's save is refused.

Where (read on objectui `origin/main` `b9814b3`; unverified beyond the grep)

git grep -ln "externalSharingModel" origin/main -- 'packages/**' 'apps/**', excluding CHANGELOG.md:

Source: packages/app-shell/src/views/studio-design/{ObjectSettingsPanel.tsx, PackageOwdOverviewPanel.tsx, StudioDesignSurface.tsx, owd-sharing.ts}, packages/app-shell/src/views/metadata-admin/{PermissionMatrixEditor.tsx, i18n.ts}.
Tests: ObjectSettingsPanel.{test, owdAgreement.test, sharedSelect-11865.test}.tsx, PackageOwdOverviewPanel.{layersUnsaved-11799, servedDraftTakenAsIs-10765, sharedSelect-11865}.test.tsx, PermissionMatrixEditor.scope.test.tsx.

Wanted

Studio no longer reads, renders or writes externalSharingModel; the Ext badge and the "external wider than internal" comparison (isExternalWider in owd-sharing.ts) go with it.
publicSharing is untouched (ruling item 3: the share-link policy).
Tests that pin the dropdown or the badge are deleted with the feature; an absence pin is enough on one surface.

Order

Lands when the spec pin carries the retirement (objectstack-ai/objectstack#23268's PR), or earlier if Studio dropping the field is harmless against the current pin (the field is optional; dropping it sends less). The claimant decides from the pin reading.

Dedupe

MCP search_issues on objectui, closed included: externalSharingModel Studio dropdown Ext badge retire → 0 hits; control external sharing model OWD object settings panel → 3 hits (#5477, #11692, #2505, all closed, none this shape).

Generated by Claude Code

Regrade: p2 → p1 · consumer follow-up, class A · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-14T08:57Z

The maintainer's rule of 2026-10-14 (「同意 A + C」): a consumer follow-up of a protocol change is p1 when its absence breaks users.

Why here: once security: externalSharingModel is declared and authored but has no runtime reader — an object's externalSharingModel: private changes no answer for any principal (ADR-0090 D11 declared-not-enforced) objectstack#23268 retires externalSharingModel, a Studio that still offers it writes a key the protocol refuses, and the author's save is refused.
Order: it lands with or right after the spec half, as the ruling's item 4 intends.
It is listed on objectui#12334's pre-release list.

Claim: PM loop round 1
Session: session_01XVp19E1MYUTFM3dnkwz8gB
Account: baozhoutao (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-12353-drop-external-sharing-model
Worktree: objectui-issue-12353
Domain: domain:ui
Seat: domain:ui#2
File surface: packages/app-shell/src/views/studio-design/ (ObjectSettingsPanel.tsx, PackageOwdOverviewPanel.tsx, StudioDesignSurface.tsx, owd-sharing.ts), packages/app-shell/src/views/metadata-admin/ (PermissionMatrixEditor.tsx, i18n.ts) and their tests (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus (default tier; dispatch-gates --tier --repo objectstack-ai/objectui reads no path-derived mandate)
Clause-②: no
Responsibility: n/a — not a defect card
Ruling-ref: 6159300530 (objectstack-ai/objectstack#23268, letter A, item 4)
Thread-read: 6164706080
Serial constraints cleared: no in-flight domain:ui claim names these paths (read 2026-10-14T11:26Z). objectui#12343 (this seat, PR #12367 in the queue) edits studio-design/metadataError.ts, a different file.

Clause-②: no: Studio stops offering a key the spec retires, which sends less and widens nothing. The dev measures whether owd-sharing.ts's isExternalWider or anything removed is on a published @object-ui/app-shell export, and reports it.

Generated by Claude Code

os-dev-report

{
  "issue": 12353,
  "status": "done",
  "branch": "claude/issue-12353-drop-external-sharing-model",
  "pr": "https://github.com/objectstack-ai/objectui/pull/12369",
  "session": "session_01XVp19E1MYUTFM3dnkwz8gB — subagent, parent's id",
  "premise_still_valid": true,
  "summary": "Studio no longer offers externalSharingModel. The object Settings tab loses the external dial and its D11 warning. The package OWD overview loses its External column, the D11 row check, the banner and the Save block they drove; a controlled_by_parent row's master link moves under the row's dial. The permission matrix loses the Ext badge and its owdExternal read. isExternalWider and OWD_WIDTH (owd-sharing.ts) are removed, as are 8 i18n keys from both the en and zh tables (16 rows), and three strings that named the external half are reworded. publicSharing is untouched. Changeset .changeset/12353-drop-external-sharing-model.md declares app-shell minor (it removes a Studio control). Pin reading: on the installed @objectstack/spec@18.0.0-next.0, ObjectSchema.shape.externalSharingModel.isOptional() is true, and safeParse of a minimal object succeeds both with and without the key, so landing now is harmless. Clause-② measured as no: app-shell exports '.' and './styles.css', and src/index.ts re-exports nothing from owd-sharing.ts, the three panels or metadata-admin/i18n.ts, so no published export is removed; only the UI that the exported StudioDesignSurface renders changes. A1: on origin/main, git grep externalSharingModel outside CHANGELOGs hit 13 files (6 source, 7 test). I changed all 13, plus owd-sharing.test.ts and PackageOwdOverviewPanel.test.tsx, which pinned isExternalWider and the D11 block without spelling the key. That makes 9 test files, matching the ruling's count. ObjectSettingsPanel.owdAgreement.test.tsx is deleted; the absence pin is in ObjectSettingsPanel.test.tsx. What now mentions the key: the absence pin and one doc line in PackageOwdOverviewPanel.tsx. A2: both save paths re-send the whole document they read. A throwaway probe (not committed) on the new overview, with a stored externalSharingModel, saved {name,label,sharingModel:'private',externalSharingModel:'private'}. So a stored key is preserved and not migrated; see open_questions. A3: the dead i18n keys went with the feature; check:i18n-designer-parity and check:i18n-dead-keys both exit 0.",
  "tests": "All at HEAD 44e4287. (1) Dependency closure: turbo run build --filter='@object-ui/app-shell^...' --concurrency=2 → 28/28 successful, lock VERDICT command-exit 0. (2) pnpm --filter @object-ui/app-shell type-check (tsc --noEmit && tsc -p tsconfig.test.json) → VERDICT command-exit 0. (3) Targeted vitest, 32 files: every touched test, plus all *Owd*, ObjectSettingsPanel*, PermissionMatrixEditor* and owd-sharing tests → 'Test Files 32 passed (32)', 'Tests 202 passed (202)', VERDICT command-exit 0. (4) Lint, narrowed: eslint as app-shell's lint script runs it ('eslint .', inline config honoured) on the 14 changed .ts/.tsx files. The --format json count is 14 files, 0 errors, 41 warnings, and the per-file warning counts equal origin/main's for all 14. No parserOptions/projectService is set in eslint.config.js, so linting is not type-aware and this diff cannot move the verdict on any untouched file. One note: run with --no-inline-config, the same files show 2 errors, both react-hooks/static-components on lines this diff does not touch; they are suppressed inline, and objectui's lint does not pass that flag. (5) check:phantom-deps, self-import, unreferenced-sources, doc-example-readers, handler-key-reads, side-effects-array, element-data-source-declaration, spec-symbols, action-forward-parity, designer-field-key-parity, icon-record-names, i18n-keys, i18n-drift, i18n-designer-parity, i18n-dead-keys and new-line-citations → all exit 0. check-changeset-fixed, check-changeset-presence ('15 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)') and check-changeset-no-major → all exit 0. check:spec-floors → exit 1: 'The scan collapsed: 0 package(s) declare @objectstack/spec in a consumer-facing field'. This is the known objectui#12334 failure; I did not re-measure it on main, and the diff touches no package.json. check-nul-bytes OK, and the raw control-byte grep over the changed files has no hits. NOT MEASURED: the full packages/app-shell project and the CI shards. Reason: three 9-minute acquisitions (slot os-dev-12353) all returned VERDICT queue-timeout (exit 99). The holder, pid 29792 (worktree objectui-issue-12101, 'vitest run packages/app-shell/ --maxWorkers=2'), was alive and progressing (about 70 CPU-minutes) and held the lock for more than 33 minutes. This narrowing is declared in the PR body, and CI runs all 12 shards. No ablation was run: this change removes code, and the absence pin was not mutation-tested.",
  "mcp_calls": "0",
  "api_writes": "3 — git push x2 to the branch (the empty-branch probe and the commit; not REST); 1 fleet-write relay stroke: POST /repos/objectstack-ai/objectstack/dispatches → relay pr_create (POST /repos/objectstack-ai/objectui/pulls, draft, plus POST /repos/objectstack-ai/objectui/issues/12369/assignees ['baozhoutao']); read-back said all 6533 bytes were stored identically; 1 os-dev-report comment POST /repos/objectstack-ai/objectui/issues/12353/comments via the relay. 0 label writes: in objectui, labeler.yml owns path labels and the dispatch named none. The PR already carries 'tests' and 'package: app-shell' from labeler.",
  "gates": {
    "type-check": 0,
    "vitest-targeted-32": 0,
    "eslint-changed-14": 0,
    "check:phantom-deps": 0,
    "check:self-import": 0,
    "check:unreferenced-sources": 0,
    "check:doc-example-readers": 0,
    "check:handler-key-reads": 0,
    "check:side-effects-array": 0,
    "check:element-data-source-declaration": 0,
    "check:spec-symbols": 0,
    "check:action-forward-parity": 0,
    "check:designer-field-key-parity": 0,
    "check:icon-record-names": 0,
    "check:i18n-keys": 0,
    "check:i18n-drift": 0,
    "check:i18n-designer-parity": 0,
    "check:i18n-dead-keys": 0,
    "check:new-line-citations": 0,
    "check-changeset-fixed": 0,
    "check-changeset-presence": 0,
    "check-changeset-no-major": 0,
    "check:spec-floors": "1 (known, objectui#12334)",
    "app-shell-full": "NOT MEASURED (lock queue-timeout x3, holder pid 29792)"
  },
  "files_changed": [
    ".changeset/12353-drop-external-sharing-model.md",
    "packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.tsx",
    "packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.scope.test.tsx",
    "packages/app-shell/src/views/metadata-admin/i18n.ts",
    "packages/app-shell/src/views/studio-design/ObjectSettingsPanel.tsx",
    "packages/app-shell/src/views/studio-design/ObjectSettingsPanel.test.tsx",
    "packages/app-shell/src/views/studio-design/ObjectSettingsPanel.sharedSelect-11865.test.tsx",
    "packages/app-shell/src/views/studio-design/ObjectSettingsPanel.owdAgreement.test.tsx (deleted)",
    "packages/app-shell/src/views/studio-design/PackageOwdOverviewPanel.tsx",
    "packages/app-shell/src/views/studio-design/PackageOwdOverviewPanel.test.tsx",
    "packages/app-shell/src/views/studio-design/PackageOwdOverviewPanel.layersUnsaved-11799.test.tsx",
    "packages/app-shell/src/views/studio-design/PackageOwdOverviewPanel.servedDraftTakenAsIs-10765.test.tsx",
    "packages/app-shell/src/views/studio-design/PackageOwdOverviewPanel.sharedSelect-11865.test.tsx",
    "packages/app-shell/src/views/studio-design/StudioDesignSurface.tsx",
    "packages/app-shell/src/views/studio-design/owd-sharing.ts",
    "packages/app-shell/src/views/studio-design/owd-sharing.test.ts"
  ],
  "deviations": [
    "The full app-shell test project and the CI shards were not run locally, despite the dispatch asking for them before push. The verify lock was held for more than 33 minutes by a live sibling run, so the run is narrowed to 32 targeted files, declared in the PR body, and left to CI.",
    "The branch was pushed (the empty probe, then the commit) before the full-project run; the role file requires the push at each compilable step."
  ],
  "open_questions": [
    {
      "question": "An object that already stores externalSharingModel keeps it on every Studio save, because both save paths re-send the document as read (measured). Once the spec PR retires the key, saving such an object from Studio will be refused with 'delete the key', and no Studio control can remove it. Should Studio strip the key on save?",
      "options": [
        "A — Keep as landed: preserve the stored document. The author deletes the key in source or in the raw metadata editor, guided by the spec's refusal. Cost: none now. A save of such an object is refused until the key is deleted, and the refusal says what to do. Effort: 0.",
        "B — Delete-on-save: the Settings tab and overview save paths drop externalSharingModel from the body. Cost: Studio keeps naming the retired key, which is the 'second spelling / grace window' the dispatch rules out. It is a silent consumer-side migration that hides the stored debt instead of surfacing it, and it would have to be removed again later. Effort: small (2 sites + 2 tests)."
      ],
      "recommendation": "A. Real business need: measured stored use is unknown. The key has no runtime reader, and a stored value only matters at a save the spec refuses with a precise prescription. Long-term soundness: contract-first, so the spec's loud refusal is the single mechanism and Studio carries no knowledge of the retired key. Preventing AI from writing it wrong: a loud refusal at the door beats a silent strip, which would mask producers (including AI-written metadata) that keep emitting the key. Startup focus: no transition shims; retire at once."
    }
  ],
  "out_of_scope_findings": []
}

Generated by Claude Code

Review: ACCEPT — objectui PR #12369 · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB` · 2026-10-14T12:44Z

Reviewed on GitHub at head 44e4287daa, against objectstack-ai/objectstack#23268 ruling A (6159300530) and triage's regrade 6164706080, not against the dev's report.

Shape: the PR is a draft against main, and its body opens Fixes #12353 (the only closing keyword), then Clause-②: no. The governed sweep reads NOT governed, 650 lines (+111 / −539).
No contract review owed. Clause-②: no holds by the dev's measurement: app-shell's exports are . and ./styles.css, and src/index.ts re-exports nothing from owd-sharing.ts, the three panels or metadata-admin/i18n.ts. So isExternalWider and the removed keys were module-internal, and only the UI that StudioDesignSurface renders changes. None of the three contract faces is touched; this is CI plus the seat's own read.
The ruling's item 4 is met:
- No Studio control reads, renders or writes externalSharingModel.
- The external dial and its D11 warning are gone from the Settings tab; the External column, the D11 row check, its banner and the Save block it drove are gone from the OWD overview; the Ext badge is gone from the permission matrix.
- isExternalWider / OWD_WIDTH and the 8 i18n keys (en and zh) go with them.
- publicSharing and sharingModel are untouched.
- An absence pin sits in ObjectSettingsPanel.test.tsx.
Landing now, before the spec half, as the card's "Order" allows. On the installed spec 18.0.0-next.0, ObjectSchema.shape.externalSharingModel.isOptional() is true, and a minimal object parses with and without the key. Dropping the control only sends less.
The dev's open question (a stored key is re-sent on save): A, keep as landed. Studio carries no knowledge of the retired key. Once the spec retires it, a save of such an object is refused with "delete the key", the spec's own prescription. A silent strip on save would be the grace window and second spelling that the ruling's retirement rules out, and it would hide producers, AI-written metadata included, that keep emitting the key. The changeset states this behaviour.
Prose, checked sentence by sentence: the changeset (@object-ui/app-shell: minor) matches the diff, including its "an object that already stores the key keeps it until the author deletes it".
CI at head (filter=latest): 30 success, 3 skipped, 0 failures.
Narrowed locally, declared: the dev's full app-shell run lost the verify lock to a sibling three times; CI's 12 shards are green.

Next: pr_ready + automerge_enable.

Generated by Claude Code

Landed · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB` · 2026-10-14T13:01Z

Merged: PR Studio: drop the externalSharingModel dial and the Ext badge (objectui#12353) #12369 merged through the merge queue as main 2d8450e. The card closed completed by the PR's Fixes #12353. No other card closed with it.
Verified by content: on origin/main, every file the PR touches is blob-identical to the accepted head 44e4287daa. That covers 15 present files, among them:
- owd-sharing.ts
- ObjectSettingsPanel.tsx
- PackageOwdOverviewPanel.tsx
- PermissionMatrixEditor.tsx
- .changeset/12353-drop-external-sharing-model.md
The one test file the PR deletes is absent on both sides.
Label: pm:dispatched is removed in the same stroke as this comment.

Generated by Claude Code

Studio: drop the externalSharingModel dial and the Ext badge (objectu…

Navigation Menu

Repository navigation

Studio: drop the `externalSharingModel` dropdown and the Ext badge once @objectstack/spec retires the key (objectstack#23268, ruling A) #12353

Why

Where (read on objectui `origin/main` `b9814b3`; unverified beyond the grep)

Wanted

Order

Dedupe

Regrade: p2 → p1 · consumer follow-up, class A · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-14T08:57Z

Review: ACCEPT — objectui PR #12369 · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB` · 2026-10-14T12:44Z

Landed · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB` · 2026-10-14T13:01Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Studio: drop the externalSharingModel dropdown and the Ext badge once @objectstack/spec retires the key (objectstack#23268, ruling A) #12353

Description

Why

Where (read on objectui origin/main b9814b3; unverified beyond the grep)

Wanted

Order

Dedupe

Activity

objectstack-fleet commented on Oct 14, 2026

Regrade: p2 → p1 · consumer follow-up, class A · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-14T08:57Z

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

Review: ACCEPT — objectui PR #12369 · domain:ui seat 2 · session_01XVp19E1MYUTFM3dnkwz8gB · 2026-10-14T12:44Z

objectstack-fleet commented on Oct 14, 2026

Landed · domain:ui seat 2 · session_01XVp19E1MYUTFM3dnkwz8gB · 2026-10-14T13:01Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Studio: drop the `externalSharingModel` dropdown and the Ext badge once @objectstack/spec retires the key (objectstack#23268, ruling A) #12353

Where (read on objectui `origin/main` `b9814b3`; unverified beyond the grep)

Regrade: p2 → p1 · consumer follow-up, class A · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-14T08:57Z

Review: ACCEPT — objectui PR #12369 · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB` · 2026-10-14T12:44Z

Landed · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB` · 2026-10-14T13:01Z