docs(adr): ADR-0090 D11 — external visibility is the EXTERNAL rung; externalSharingModel retired (#23268)

[objectstack-fleet]

Refs #23268
Clause-②: no

The ADR-0090 D11 sentence of ruling of record 6159300530 on #23268, letter A, item 2 (the maintainer's 「23268 同意」), drafted for the maintainer's hand. This PR touches docs/adr/0090-permission-model-v2-concept-convergence.md and one row of skills/objectstack-data/references/lint-rules.md, both governed, so it is Tier H: it lands by an authorized approval, never by a seat on green.

What changes

Two ADR additions, the shape the ADR's earlier amendments already use, and one published-skill deletion:

1. The status block gains one Amended line (2026-10-14): D11's external org-wide default is retired, and external visibility is the ADR-0095 EXTERNAL rung, explicitly shared rows only. It points at the note under D11.
2. Under the D11 heading, one amendment note, quoting the ruling's sentence: external visibility is ADR-0095 / ADR-0099's EXTERNAL rung (explicitly shared rows only, never OWD-derived); externalSharingModel is retired (ADR-0049); when a portal or partner line is built, external principals reach rows through explicit shares, relationship-based grants (a sharing set: the records related to the principal's account or contact — Salesforce's sharing sets, Power Pages' table-permission scopes) and share links, from an identity pool separate from members. D11's identity-pool text is kept, and the note says to read the bullets' externalSharingModel and external-OWD clauses as superseded.
3. skills/objectstack-data/references/lint-rules.md loses its security-external-wider-than-internal row (one line deleted): the implementation PR removes that rule, and the skill ships with npx skills add. A grep of the whole skills/ tree for externalSharingModel, SECURITY_EXTERNAL_WIDER and the rule id finds no other line.

Not edited, on purpose: the D11 bullets themselves (the decision as taken stays readable), the D11 summary line in the decision list near the top, and the P1 phasing bullet that names externalSharingModel among the pre-launch shapes. The amendment line and the note govern both; if you prefer those two lines struck through as well, that is a two-line follow-up in this same PR.

The implementation is the separate draft PR for #23268 (branch claude/issue-23268-retire-external-sharing-model), which touches no governed surface.

维护者速读(草稿)

改了什么
ADR-0090 的 D11 加了一条修订:状态栏新增一行"已修订",D11 标题下新增一段说明。内容是:外部用户(门户、合作伙伴)能看到哪些记录,由 ADR-0095/0099 已实施的 EXTERNAL 档决定,只认明确共享给他的记录,不看任何组织级默认;externalSharingModel 退役;将来真做门户或伙伴产品线时,外部用户通过显式共享、关系授权(共享集:与其客户或联系人相关的记录)和分享链接拿到记录,身份池与内部成员分开(D11 原有的身份池表述保留)。原 D11 条目不删,只标明被这段说明取代。
另外,对外发布的技能包 skills/objectstack-data/references/lint-rules.md 删掉了已随代码退役的 security-external-wider-than-internal 规则那一行,避免 AI 作者照着一条不存在的规则写元数据。

为什么改
您 10 月 14 日对 #23268 裁了 A(「23268 同意」):这个"外部可见性开关"作者能设、Studio 能显示,但从来不影响任何人的访问结果。D11 原文还写着"外部可见性 = 自己的记录 + 显式共享 + 外部 OWD",和已实施、有测试锁住的 ADR-0095 直接矛盾。代码侧的退役在另一个 PR 里;这份修订让决策记录和实际一致,消掉两份记录之间的矛盾。

风险与代价(含回滚)
纯文档改动,不改任何代码或运行行为,零运行风险。代价是 D11 的原文保留、加注取代说明,读者要读到那段说明才知道外部 OWD 已退役。回滚:撤销这个 PR 的提交即可,ADR 回到原状;但代码侧退役一旦落地,回滚这段文字会让记录重新和实现不一致。

席位意见

你要做的(一个动作)
读一遍 D11 下新增的那段说明,措辞同意就批准这个 PR。

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: ce509e82c038385f69b92dc6b098ef502d53f456
Local-runs: none

Inputs read: card #23268 (body + all 9 comments, ruling of record 6159300530 included), PR #23443 (body, 2-file list, net diff vs main at the head: docs/adr/0090-permission-model-v2-concept-convergence.md +12/−0, skills/objectstack-data/references/lint-rules.md +0/−1), the 41 check-runs on the head. Every completed check-run is success or skipped; none in progress. Check Changeset reads skipped on both runs of the head (the live label read saw skip-changeset), Governed Surface Queue Guard, Check Documentation Links, Lint · docs & code guards, Part-of PR must not also close its card all success.

① Derived judgments

Accept-set / public surface the diff implies

1. ADR-0090 status block, one Amended line (2026-10-14, ruling 6159300530 letter A) — right. Same shape as the two amendment lines above it (date, ruling, one sentence, "See the note under D11"). The sentence — "D11's external org-wide default is retired: external visibility is the ADR-0095 EXTERNAL rung, explicitly shared rows only" — is a faithful précis of ruling item 2's first two clauses.
2. D11 amendment note — right, and it says what ruling item 2 binds, no more, no less. Checked clause by clause against 6159300530 item 2: (a) external visibility is ADR-0095/0099's EXTERNAL rung, explicitly shared rows only, never OWD-derived — present, with both ADR links; (b) externalSharingModel is retired — present; (c) when a portal or partner line is built, external principals reach rows through explicit shares, relationship-based grants (a sharing set: the records related to the principal's account or contact — Salesforce's sharing sets, Power Pages' table-permission scopes) and share links — present, near-verbatim; (d) from an identity pool separate from members, D11's pool kept — present ("the pool below is kept"). The one phrase beyond item 2's sentence, "(ADR-0049 enforce-or-remove; the schema refuses it with 'delete the key')", restates item 1 of the same ruling and matches PR feat(spec)!: retire the object's externalSharingModel — the external org-wide default no principal ever read (#23268) #23441's tombstone prescription ("Delete the key"); it adds no decision. Item 2's "Permission Model v2 — named follow-up ADRs (post-ADR-0090 parking lot) #2776 item 6 gets a pointer" is a comment on Permission Model v2 — named follow-up ADRs (post-ADR-0090 parking lot) #2776, not ADR text, and the dev's report records it as the seat's post-merge act — correctly not in this diff. The closing sentence ("read their externalSharingModel and external-OWD clauses as superseded by this note") is the scoping device the ADR's own earlier amendments use (the D3/D5/D8 notes of the ADR-0131 amendment leave the rename table at lines 184–186 standing and supersede it by note), so it is the house convention, not an addition.
3. No contradiction introduced elsewhere in ADR-0090. The D11 summary bullet in the decision list (line 65, "optional externalSharingModel, default private… lands in P1") and the P1 phasing bullet (line 606) still name the key unstruck. This is the same posture the ADR-0131 amendment took for sys_position (its D3 rename table is left as the decision-as-taken, governed by the status-block line and the section notes), and the status-block line at the top of the file governs both. D10's audience: internal | external principal taxonomy is untouched and the note explicitly keeps the identity pool, so D10 and the amended D11 agree. D9/D11's "guest is deliberately not an OWD audience" stands and is consistent with ruling C on [Decision] 访客（guest）的行可见范围：沿用对象的内部共享模型（A，现状，公开对象全部行可见）、按 externalSharingModel 判（B）、还是只经分享链接（C） #23266. Both ADR links resolve (Check Documentation Links green).
4. skills/objectstack-data/references/lint-rules.md, one row deleted (security-external-wider-than-internal) — complete and adds nothing. Re-checked on the local read-only tree (e4ec6ec1a, the main the branch is measured against): across skills/** the strings externalSharingModel, SECURITY_EXTERNAL_WIDER, security-external-wider-than-internal and external-wider occur on exactly that one line (lint-rules.md:23); the external hits elsewhere in the skill are externalId (seeds) and "external systems" (hooks), unrelated. The table's remaining rows (security-owd-unset, security-owd-alias, security-master-detail-ungranted) are all rules PR feat(spec)!: retire the object's externalSharingModel — the external org-wide default no principal ever read (#23268) #23441 keeps. The sibling PR removes the rule and its SECURITY_EXTERNAL_WIDER export, so the row would otherwise teach a rule the linter no longer has. Nothing else in the file changes. Right.
5. Public surface. No code, no schema, no runtime behaviour. The ADR is governed rule text (Tier H). The skill row is published text: skills/** is the source of @objectstack/skills (packages/skills/scripts/sync-catalog.mjs copies it byte for byte into dist/skills/, the only tree in that package's files), published at 18.0.0-next.0 in the changeset fixed group. The diff therefore changes a file a released npm package ships — this is what ② turns on.

② Semver level

Wrong: skip-changeset does not match what the diff publishes. FAIL on this axis.

• What the diff publishes: one row removed from dist/skills/objectstack-data/references/lint-rules.md of @objectstack/skills, a released package (packages/skills/package.json: files: [dist, README.md, CHANGELOG.md]; build = sync-catalog.mjs, which wipes and re-copies skills/**). AGENTS.md Post-Task Checklist 3: skip-changeset "is for a diff that publishes nothing from any released package". This diff publishes something from one.
• The level owed: @objectstack/skills: patch, Clause-②: no — a skill-text correction that narrows nothing an author writes (the author-facing narrowing is feat(spec)!: retire the object's externalSharingModel — the external org-wide default no principal ever read (#23268) #23441's). This is exactly the measured precedent for the same situation: e4a770d (spec: rename allowOrgOverride to an environment-overlay key with an ADR-0087 load-time conversion (ADR-0131 C5's spec half, split from #15206 per #22007 ruling C) #22340 S3, "docs(skills): the objectstack-ai skill names the agent type's… protocol-18 spelling" — a skill line aligned to a retirement, shipped as a @objectstack/skills patch and now in that package's CHANGELOG), and every skills/** change since the package landed on 2026-10-11 (feat(skills): publish the skills catalog as @objectstack/skills in the fixed group #22691 165587e): 22743, 22825, 23039, 22585, 23276 each name @objectstack/skills: patch. The seat's stated reason, "docs/governed text only, no package", is false for the second file.
• Why the gate text does not rescue it: Check Changeset's route-2 prose and the GREEN 3 self-test fixture ("skills/ is not a workspace member and no package's files field includes it", 已发布 skill 变更的 changeset 路线先例与 #5292 现行处方冲突(空 frontmatter vs skip-changeset 标签) #5947) predate feat(skills): publish the skills catalog as @objectstack/skills in the fixed group #22691 and their premise no longer holds; AGENTS.md is the source of truth and its rule is the one above. A wrong skip-changeset is, in that workflow's own words, "caught by review" — this is that review.
• Consequence if landed as is: the fixed group still bumps @objectstack/skills on feat(spec)!: retire the object's externalSharingModel — the external org-wide default no principal ever read (#23268) #23441's changeset, so the row deletion ships, but the package's CHANGELOG — the text an upgrading agent reads — says nothing about a rule disappearing from the reference it ships. The ADR half of the PR publishes nothing and would, alone, have been a correct skip-changeset.
• Clause-②: line: the PR body carries none (the sibling feat(spec)!: retire the object's externalSharingModel — the external org-wide default no principal ever read (#23268) #23441 carries Clause-②: no; the dispatch claim 6161609217 declared no). The changeset above carries Clause-②: no and the PR body should state the same line once.

Fix (one file, one label): remove skip-changeset; add .changeset/23268-skills-lint-rules-row.md with frontmatter '@objectstack/skills': patch, a one-line title ("docs(skills): the objectstack-data lint-rule reference drops security-external-wider-than-internal, retired with externalSharingModel (#23268)"), Clause-②: no, and one sentence saying the row named a rule @objectstack/lint 18 no longer has and that nothing an author writes changes. The ADR text needs no declaration. The retirement's own ADR-0087 marker belongs to #23441's changeset and must not be repeated here.

③ Boundary flags

• Dev flag (PR body, "Not edited, on purpose"): the D11 summary bullet (line 65) and the P1 phasing bullet (line 606) still name externalSharingModel. Answered: consistent with the ADR's own amendment convention (ADR-0131 note left the D3 table standing); the status-block line governs both. Whether to strike them is the maintainer's call on a Tier H surface; the PR body puts that option in front of the maintainer. Escalated as written, no action required for PASS.
• Dev open_questions (report 6164903067): []. Nothing to answer.
• Dev out_of_scope_findings, each carried: (1) Permission Model v2 — named follow-up ADRs (post-ADR-0090 parking lot) #2776 item 6 pointer — the seat posts it when the amendment lands (review 6165097122); not ADR text; right. (2) objectui Studio select + Ext badge — filed as objectui#12353; outside this repo; right. (3) the skills/** lint-rules row — now this PR's second commit; complete per ① item 4; but it changes the PR's publish status (②).
• Ordering dependency (new): the note's clause "the schema refuses it with 'delete the key'" is true once PR feat(spec)!: retire the object's externalSharingModel — the external org-wide default no principal ever read (#23268) #23441 (1060ed3e7, ACCEPT) lands. If this Tier H PR lands first, the ADR is briefly ahead of the tree. Both are dated 2026-10-14 and the sibling is enqueued on green; no change asked, noted for the lander.
• Stale gate prose (new, not this PR's): Check Changeset route 2 and scripts/check-empty-changeset.mjs GREEN 3 still assert that skills/** ships in no package; since feat(skills): publish the skills catalog as @objectstack/skills in the fixed group #22691 it ships in @objectstack/skills. A skills/**-only PR with no changeset still passes that gate green, so the only guard on the skills CHANGELOG is review. Worth a card; dedupe words: "check-changeset route 2 skills/** @objectstack/skills stale premise".
• Tier: docs/adr/** and skills/** are both governed; the PR says Tier H and Refs (not Fixes) the card; Part-of PR must not also close its card green. Lands only by the maintainer's or an authorized approval, never on green.

Implemented-by: claude/issue-23268-adr-0090-d11-external
Reviewed-by: session_01D6F9axfoPzR7t8G1J7Ytzz

VERDICT: FAIL

(① right on all five points; ③ answered; FAIL on ② alone — skip-changeset on a diff that edits a file @objectstack/skills publishes. A @objectstack/skills: patch changeset with Clause-②: no, as the fix above, and the label removed, turns this record PASS on the next head.)

Adopted by domain:spec seat 3 (#18883), baozhoutao, session session_01D6F9axfoPzR7t8G1J7Ytzz, at 2026-10-14T09:34Z: rendered by an isolated read-only reviewer at CONTRACT_REVIEW_TIER. The seat confirms ②: @objectstack/skills is published (packages/skills/package.json, files: [dist, …], built from skills/** by sync-catalog.mjs), and AGENTS.md's post-task checklist gives a skills/** change a patch changeset, never skip-changeset. The skip-changeset label was the seat's error; it is removed in this act, and the dev adds the changeset on a new head.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 1e1491293dd46fd3657ad481bf120ddce9e7cd92
Local-runs: none

Supersedes the record this seat rendered on ce509e82c (FAIL on ② alone). Inputs read once on this head: card #23268 (body + all comments, ruling of record 6159300530), PR #23443 (body, 3-file list, net diff vs main), the 41 check-runs on 1e1491293. The head is ce509e82c plus one commit (changeset: @objectstack/skills patch for the retired lint-rule row); the ADR and skill hunks are byte-identical to the previous head. Every check-run is completed; none in progress. Check Changeset now success (the label is gone and a changeset is counted); Governed Surface Queue Guard, Check Documentation Links, Lint · docs & code guards, Part-of PR must not also close its card, No other open PR may claim the same issue all success. Labels now documentation, size/s, tooling; skip-changeset removed.

① Derived judgments

Unchanged from the previous head (the two governed hunks did not move); restated so this record stands alone.

1. ADR-0090 status block, one Amended line (2026-10-14, ruling 6159300530 letter A) — right. Same shape as the two amendment lines above it; a faithful précis of ruling item 2's first two clauses; points at the note under D11.
2. D11 amendment note — right; it says what ruling item 2 binds, no more, no less. Clause by clause: (a) external visibility is ADR-0095/0099's EXTERNAL rung, explicitly shared rows only, never OWD-derived — present, both ADRs linked; (b) externalSharingModel is retired — present; (c) when a portal or partner line is built, external principals reach rows through explicit shares, relationship-based grants (a sharing set: the records related to the principal's account or contact — Salesforce's sharing sets, Power Pages' table-permission scopes) and share links — present, near-verbatim; (d) from an identity pool separate from members, D11's pool kept — present. The parenthesis "(ADR-0049 enforce-or-remove; the schema refuses it with 'delete the key')" restates item 1 of the same ruling and matches feat(spec)!: retire the object's externalSharingModel — the external org-wide default no principal ever read (#23268) #23441's tombstone prescription; it decides nothing new. "Permission Model v2 — named follow-up ADRs (post-ADR-0090 parking lot) #2776 item 6 gets a pointer" is a comment on Permission Model v2 — named follow-up ADRs (post-ADR-0090 parking lot) #2776, not ADR text; correctly absent. The closing "read their … clauses as superseded by this note" is the ADR's own amendment convention (the ADR-0131 notes under D3/D5/D8 leave the rename table standing).
3. No contradiction elsewhere in ADR-0090. The D11 summary bullet (line 65) and the P1 phasing bullet (line 606) still name the key as the decision-as-taken, governed by the status-block line — the posture the ADR-0131 amendment took for sys_position. D10's audience taxonomy is untouched and the note keeps the identity pool, so D10 and amended D11 agree; D9/D11's "guest is not an OWD audience" stands with ruling C on [Decision] 访客（guest）的行可见范围：沿用对象的内部共享模型（A，现状，公开对象全部行可见）、按 externalSharingModel 判（B）、还是只经分享链接（C） #23266. Both links resolve.
4. skills/objectstack-data/references/lint-rules.md, one row deleted — complete and adds nothing. On the read-only tree (e4ec6ec1a) externalSharingModel, SECURITY_EXTERNAL_WIDER, security-external-wider-than-internal and external-wider occur in skills/** on exactly that line; the other external hits are externalId and "external systems". The remaining rows are rules feat(spec)!: retire the object's externalSharingModel — the external org-wide default no principal ever read (#23268) #23441 keeps.
5. Public surface. No code, schema or runtime behaviour. The ADR is governed text (Tier H). The skill row is published text: skills/** is copied byte for byte into dist/skills/ of @objectstack/skills (packages/skills/scripts/sync-catalog.mjs), a released package in the fixed group — the fact ② now declares.

② Semver level

Right. The changeset matches what the diff publishes.

• .changeset/23268-skills-lint-rules-row.md: frontmatter '@objectstack/skills': patch, one title line naming the dropped rule, the key it went with and the card, Clause-②: no, one sentence ("The row named a rule @objectstack/lint 18 no longer has, and nothing an author writes changes"). That is the level the previous record named as owed and the measured precedent for a skill line aligned to a retirement (e4a770d, spec: rename allowOrgOverride to an environment-overlay key with an ADR-0087 load-time conversion (ADR-0131 C5's spec half, split from #15206 per #22007 ruling C) #22340 S3, in @objectstack/skills' CHANGELOG), and the shape every skills/** change since feat(skills): publish the skills catalog as @objectstack/skills in the fixed group #22691 carries (22743, 22825, 23039, 22585, 23276).
• patch is the right level: the author-facing narrowing (the key refused at parse) is feat(spec)!: retire the object's externalSharingModel — the external org-wide default no principal ever read (#23268) #23441's @objectstack/spec minor + BREAKING; this PR removes a reference row for a rule that package already removes, and nothing an author writes changes. Not a widening, so Clause-②: no with no arm is well-formed (AGENTS.md Post-Task Checklist 3).
• No ADR-0087 marker in this changeset — right; the retirement's adr-0087: registered marker lives in feat(spec)!: retire the object's externalSharingModel — the external org-wide default no principal ever read (#23268) #23441's changeset and must not be duplicated.
• The ADR hunk publishes nothing and needs no declaration; the changeset body does not claim it.
• Clause-②: line: the PR body now carries Clause-②: no as its own line under Refs #23268, matching the changeset and the dispatch claim 6161609217. Check Changeset reads success on this head (the changeset is counted, no empty-frontmatter file added).
• skip-changeset removed — right; the label was the only wrong element of the previous head.

③ Boundary flags

• Dev flag (PR body, "Not edited, on purpose"): the D11 summary bullet (line 65) and the P1 phasing bullet (line 606) still name externalSharingModel. Answered: consistent with the ADR's amendment convention; the status-block line governs both; striking them is the maintainer's option on a Tier H surface and the body offers it. No action needed.
• Dev open_questions (report 6164903067): []. Nothing to answer.
• Dev out_of_scope_findings, each carried: Permission Model v2 — named follow-up ADRs (post-ADR-0090 parking lot) #2776 item 6 pointer — the seat posts it when the amendment lands; objectui Studio select + Ext badge — objectui#12353; the skills/** row — this PR, now with its changeset.
• Ordering dependency: the note's "the schema refuses it with 'delete the key'" is true once feat(spec)!: retire the object's externalSharingModel — the external org-wide default no principal ever read (#23268) #23441 (1060ed3e7, ACCEPT) lands; if this Tier H PR lands first the ADR is briefly ahead of the tree. Noted for the lander; no change asked.
• Stale gate prose (not this PR's): Check Changeset route 2 and scripts/check-empty-changeset.mjs GREEN 3 still say skills/** ships in no package; since feat(skills): publish the skills catalog as @objectstack/skills in the fixed group #22691 it ships in @objectstack/skills, so a skills/**-only PR with no changeset still passes that gate green and review is the only guard on that CHANGELOG. Worth a card; dedupe words: "check-changeset route 2 skills/** @objectstack/skills stale premise".
• Tier: docs/adr/** and skills/** are governed; the PR Refs (not Fixes) the card and says Tier H. This PASS clears the contract tier only; the landing waits for the maintainer's or an authorized approval, never a seat on green.

Implemented-by: claude/issue-23268-adr-0090-d11-external
Reviewed-by: session_01D6F9axfoPzR7t8G1J7Ytzz

VERDICT: PASS

Adopted by domain:spec seat 3 (#18883), baozhoutao, session session_01D6F9axfoPzR7t8G1J7Ytzz, at 2026-10-14T09:50Z: rendered by an isolated read-only reviewer at CONTRACT_REVIEW_TIER, superseding its FAIL on ce509e82c. ③'s stale-gate flag is filed as #23451.

---

Generated by Claude Code

[objectstack-fleet]

维护者速读(终稿)· PR #23443 · domain:spec seat 3 · 2026-10-14T09:51Z

Session session_01D6F9axfoPzR7t8G1J7Ytzz · baozhoutao. Head 1e1491293; contract review PASS on this head (record above). Tier H: this PR lands only on your approval.

改了什么
ADR-0090 的 D11 加一条修订(状态栏一行 + D11 标题下一段说明):外部用户(门户、合作伙伴)能看到哪些记录,由已实施的 ADR-0095/0099 EXTERNAL 档决定,只认明确共享给他的记录,不看任何组织级默认;externalSharingModel 退役;将来做门户或伙伴产品线时,外部用户通过显式共享、关系授权(共享集)和分享链接拿到记录,身份池与内部成员分开。原 D11 条目保留,标为被这段说明取代。另外删掉对外发布的技能文件 skills/objectstack-data/references/lint-rules.md 里一行(那条 lint 规则随这个键一起删了),并配一个 @objectstack/skills 的 patch changeset。

为什么改
您对 #23268 的裁决 A(「23268 同意」)第 2 条:D11 原文写"外部可见性含外部 OWD",和已实施、有测试锁住的 ADR-0095 矛盾。代码侧退役在 PR #23441(已在合并队列)。技能文件那一行如果不删,客户的 AI 会照着一条已不存在的规则写。

风险与代价(含回滚)
纯文字:ADR 不影响运行;技能文件少一行规则说明。回滚 = revert 本 PR;但 PR #23441 落地后再回滚这段,记录会重新和实现不一致。D11 的决策摘要(第 65 行)和 P1 分期(第 606 行)两处仍提这个键,按本 ADR 既有修订惯例由状态栏那一行统摄、不逐处改;若您希望逐处划掉,回一句即可。

席位意见
建议批准。修订逐句对得上裁决第 2 条,没有多说或少说(复核记录 ① 第 2 项逐句核对);技能文件只删一行、不新增,skills/** 里再无提到该键或该规则的行。最好在 PR #23441 合入之后合并,这样 ADR 的"会被拒"一句与代码同时成立。

你要做的(一个动作)
读一遍 D11 下新增的那段说明,同意就在本 PR 点批准(os-zhuang 或 hotlong 任一)。批准后席位负责落地。

---

Generated by Claude Code