Skip to content

docs(adr): ADR-0090 D11 — external visibility is the EXTERNAL rung; externalSharingModel retired (#23268) #23443

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
os-zhuang merged 4 commits into from
Oct 14, 2026
Merged

docs(adr): ADR-0090 D11 — external visibility is the EXTERNAL rung; externalSharingModel retired (#23268) #23443

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
785ebd1
docs(adr): ADR-0090 D11 — external visibility is the EXTERNAL rung; e…
claude Oct 14, 2026
133f9d1
Merge remote-tracking branch 'origin/main' into claude/issue-23268-ad…
claude Oct 14, 2026
ce509e8
skills(objectstack-data): drop the retired security-external-wider-th…
claude Oct 14, 2026
1e14912
changeset: @objectstack/skills patch for the retired lint-rule row
claude Oct 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions .changeset/23268-skills-lint-rules-row.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
---
'@objectstack/skills': patch
---

docs(skills): the `objectstack-data` lint-rule reference drops `security-external-wider-than-internal`, retired with `externalSharingModel` (#23268)

Clause-②: no

The row named a rule `@objectstack/lint` 18 no longer has, and nothing an author writes changes.
12 changes: 12 additions & 0 deletions docs/adr/0090-permission-model-v2-concept-convergence.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
**Status**: Accepted (2026-07-09)
· **Amended** (2026-10-13, ADR-0138 D3/D4) — D9's `guest` anchor bindings resolve for anonymous requests, in the organization ADR-0138 D4 resolves; an empty set denies all.
· **Amended** (2026-10-14, [ADR-0131](./0131-total-organization-ownership-no-null-organization-id.md) D3/D13) — two of the row objects D3 renames into, `sys_position` and `sys_position_permission_set`, and the `sys_capability` D5 names, are retired by #15204 stage 8 (`66949b7729`, 2026-10-13): a position is a metadata-registry definition that names its sets in `PositionSchema.permissionSets`; `sys_user_position` stays. See the notes under D3, D5 and D8.
· **Amended** (2026-10-14, ruling of record 6159300530 on #23268, letter A) — D11's external org-wide default is retired: external visibility is the [ADR-0095](./0095-authz-kernel-tenant-layer-and-posture-ladder.md) `EXTERNAL` rung, explicitly shared rows only. See the note under D11.
**Deciders**: ObjectStack Protocol Architects
**Builds on**: [ADR-0049](./0049-no-unenforced-security-properties.md) (enforce-or-remove),
[ADR-0056](./0056-permission-model-landing-verification.md) (permission-model landing verification),
Expand Down Expand Up @@ -478,6 +479,17 @@ alias tax on every API.

### D11 — OWD gains an external dimension (`externalSharingModel`)

> **Amended 2026-10-14 (ruling of record 6159300530 on #23268, letter A — the maintainer's 「23268
> 同意」).** External visibility is [ADR-0095](./0095-authz-kernel-tenant-layer-and-posture-ladder.md)
> / [ADR-0099](./0099-posture-adjudicated-tiering-and-external-rung.md)'s `EXTERNAL` rung —
> explicitly shared rows only, never OWD-derived — so `externalSharingModel` is retired (ADR-0049
> enforce-or-remove; the schema refuses it with "delete the key"), and when a portal or partner
> line is built, external principals reach rows through explicit shares, relationship-based grants
> (a sharing set: the records related to the principal's account or contact — Salesforce's
> sharing sets, Power Pages' table-permission scopes) and share links, drawn from an identity pool
> separate from members (the pool below is kept). The bullets that follow record the decision as
> taken; read their `externalSharingModel` and external-OWD clauses as superseded by this note.

Portal and partner scenarios need the Salesforce insight: internal and external record baselines
are **two different dials, and external must never be wider**. Decision:

Expand Down
1 change: 0 additions & 1 deletion skills/objectstack-data/references/lint-rules.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,6 @@ Data-model rules (in addition to naming/label/i18n):
| `object/missing-name-field` | suggestion | an object with no `nameField` (ADR-0079's canonical title pointer) and no name-like field (`name`/`title`/`subject`/`label`/`full_name`/`display_name`/`code`) |
| `security-owd-unset` | error | an object published with no authored `sharingModel` (422 lint envelope; absence is not a decision) |
| `security-owd-alias` | error | a legacy OWD spelling instead of the canonical four (ADR-0090 D4) |
| `security-external-wider-than-internal` | error | `externalSharingModel` wider than `sharingModel` (ADR-0090 D11) |
| `security-master-detail-ungranted` | warning | a `master_detail` child whose master carries no matching grant |

> **`code` counts for R9, but is NOT a title-derivation key.** R9's name-like
Expand Down
Loading