From 785ebd1ee9fdb4ec672e94a8b45273d23f68e88b Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Oct 2026 06:11:24 +0000 Subject: [PATCH 1/3] =?UTF-8?q?docs(adr):=20ADR-0090=20D11=20=E2=80=94=20e?= =?UTF-8?q?xternal=20visibility=20is=20the=20EXTERNAL=20rung;=20externalSh?= =?UTF-8?q?aringModel=20retired?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Claude-Session: https://claude.ai/code/session_01D6F9axfoPzR7t8G1J7Ytzz Co-authored-by: Claude --- .../0090-permission-model-v2-concept-convergence.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/docs/adr/0090-permission-model-v2-concept-convergence.md b/docs/adr/0090-permission-model-v2-concept-convergence.md index 2fb593ae51e..a34c88ddff5 100644 --- a/docs/adr/0090-permission-model-v2-concept-convergence.md +++ b/docs/adr/0090-permission-model-v2-concept-convergence.md @@ -3,6 +3,7 @@ **Status**: Accepted (2026-07-09) · **Amended** (2026-10-13, ADR-0138 D3/D4) — D9's `guest` anchor bindings resolve for anonymous requests, in the organization ADR-0138 D4 resolves; an empty set denies all. · **Amended** (2026-10-14, [ADR-0131](./0131-total-organization-ownership-no-null-organization-id.md) D3/D13) — two of the row objects D3 renames into, `sys_position` and `sys_position_permission_set`, and the `sys_capability` D5 names, are retired by #15204 stage 8 (`66949b7729`, 2026-10-13): a position is a metadata-registry definition that names its sets in `PositionSchema.permissionSets`; `sys_user_position` stays. See the notes under D3, D5 and D8. +· **Amended** (2026-10-14, ruling of record 6159300530 on #23268, letter A) — D11's external org-wide default is retired: external visibility is the [ADR-0095](./0095-authz-kernel-tenant-layer-and-posture-ladder.md) `EXTERNAL` rung, explicitly shared rows only. See the note under D11. **Deciders**: ObjectStack Protocol Architects **Builds on**: [ADR-0049](./0049-no-unenforced-security-properties.md) (enforce-or-remove), [ADR-0056](./0056-permission-model-landing-verification.md) (permission-model landing verification), @@ -478,6 +479,17 @@ alias tax on every API. ### D11 — OWD gains an external dimension (`externalSharingModel`) +> **Amended 2026-10-14 (ruling of record 6159300530 on #23268, letter A — the maintainer's 「23268 +> 同意」).** External visibility is [ADR-0095](./0095-authz-kernel-tenant-layer-and-posture-ladder.md) +> / [ADR-0099](./0099-posture-adjudicated-tiering-and-external-rung.md)'s `EXTERNAL` rung — +> explicitly shared rows only, never OWD-derived — so `externalSharingModel` is retired (ADR-0049 +> enforce-or-remove; the schema refuses it with "delete the key"), and when a portal or partner +> line is built, external principals reach rows through explicit shares, relationship-based grants +> (a sharing set: the records related to the principal's account or contact — Salesforce's +> sharing sets, Power Pages' table-permission scopes) and share links, drawn from an identity pool +> separate from members (the pool below is kept). The bullets that follow record the decision as +> taken; read their `externalSharingModel` and external-OWD clauses as superseded by this note. + Portal and partner scenarios need the Salesforce insight: internal and external record baselines are **two different dials, and external must never be wider**. Decision: From ce509e82c038385f69b92dc6b098ef502d53f456 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Oct 2026 09:13:53 +0000 Subject: [PATCH 2/3] skills(objectstack-data): drop the retired security-external-wider-than-internal row from the lint-rule reference Claude-Session: https://claude.ai/code/session_01D6F9axfoPzR7t8G1J7Ytzz Co-authored-by: Claude --- skills/objectstack-data/references/lint-rules.md | 1 - 1 file changed, 1 deletion(-) diff --git a/skills/objectstack-data/references/lint-rules.md b/skills/objectstack-data/references/lint-rules.md index b5e5b15b3b9..968f3cba059 100644 --- a/skills/objectstack-data/references/lint-rules.md +++ b/skills/objectstack-data/references/lint-rules.md @@ -20,7 +20,6 @@ Data-model rules (in addition to naming/label/i18n): | `object/missing-name-field` | suggestion | an object with no `nameField` (ADR-0079's canonical title pointer) and no name-like field (`name`/`title`/`subject`/`label`/`full_name`/`display_name`/`code`) | | `security-owd-unset` | error | an object published with no authored `sharingModel` (422 lint envelope; absence is not a decision) | | `security-owd-alias` | error | a legacy OWD spelling instead of the canonical four (ADR-0090 D4) | -| `security-external-wider-than-internal` | error | `externalSharingModel` wider than `sharingModel` (ADR-0090 D11) | | `security-master-detail-ungranted` | warning | a `master_detail` child whose master carries no matching grant | > **`code` counts for R9, but is NOT a title-derivation key.** R9's name-like From 1e1491293dd46fd3657ad481bf120ddce9e7cd92 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Oct 2026 09:36:21 +0000 Subject: [PATCH 3/3] changeset: @objectstack/skills patch for the retired lint-rule row Claude-Session: https://claude.ai/code/session_01D6F9axfoPzR7t8G1J7Ytzz Co-authored-by: Claude --- .changeset/23268-skills-lint-rules-row.md | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 .changeset/23268-skills-lint-rules-row.md diff --git a/.changeset/23268-skills-lint-rules-row.md b/.changeset/23268-skills-lint-rules-row.md new file mode 100644 index 00000000000..e2cf387894e --- /dev/null +++ b/.changeset/23268-skills-lint-rules-row.md @@ -0,0 +1,9 @@ +--- +'@objectstack/skills': patch +--- + +docs(skills): the `objectstack-data` lint-rule reference drops `security-external-wider-than-internal`, retired with `externalSharingModel` (#23268) + +Clause-②: no + +The row named a rule `@objectstack/lint` 18 no longer has, and nothing an author writes changes.