docs(skills): clear the GraphQL residue from the published catalog and declare sharingModel on its four object examples (#11141)

* docs(skills): drop the five GraphQL residue sites and the stale /storage mount

`/graphql` is not mounted: `packages/runtime/src/http-dispatcher.ts:2069` is
`// /graphql removed — GraphQL is not in the product plan (#2462 follow-on)`,
there is no `createGraphQLDomain` among the registered domains (0 hits under
`packages/*/src`), and `handleGraphQL` survives only in CHANGELOGs. Five sites
in the published catalog still described it as a live ObjectStack surface —
the input that generates client code against a route which 404s.

- `objectstack-api` tags: drop `graphql` (the description one line above
  already lists no GraphQL surface).
- `objectstack-data` `apiEnabled`: REST + MCP, the two surfaces the flag
  actually gates (`packages/mcp/src/stdio-data-bridge.ts:260` reads
  `enable.apiEnabled === false`).
- `objectstack-platform` mount line: `createHonoApp` mounts auth and
  discovery only. `/storage` was stale on the same line and is corrected in
  the same edit — `packages/adapters/hono/src/index.ts:423` is
  `// --- Storage: deliberately NOT mounted (#4087) ---`, and the dispatcher
  carries the matching "No `/storage` domain (#4087)" note.
- `objectstack-formula`: the `GraphQL.ComputedField` CEL-host row and the
  `api/graphql` cache-key row are deleted rather than replaced — no real
  surface fills either slot (the computed-field CEL host is already the
  `Field` / `type: 'formula'` row above it, and no cache-key template surface
  exists: `system/cache` takes plain key patterns, `api/http-cache` has none).

The mirror row in `content/docs/ai/skills-reference.mdx` moves in this same
commit, per the card's anti-drift requirement — never before or after the
skill it catalogs.

Bundle effect: -27 tokens on the published skills ratchet.

Fixes #10846

* fix(skills): declare sharingModel on the 4 catalog examples, then scan skills/ for it

The 4 `ObjectSchema.create()` examples inside os:check-marked blocks in the
published catalog omitted `sharingModel`. The omission type-checks clean
(`z.enum([...]).optional()`, no `.default()`) while `os validate` rejects it as
severity: 'error' (`SECURITY_OWD_UNSET`) — so a reader copying a canonical
example got a failing build with no hint from the page, multiplied by every AI
that copies the catalog verbatim.

Values, per the #10714 sweep's shape:

- `account`, `invoice`, `support_case` (objectstack-data) -> `'private'`, the
  rule's own recommended default. DEFAULTED, not mirrored: `examples/` carries
  no object of these names. The showcase app's `showcase_account` /
  `showcase_invoice` are differently-named objects whose `public_read_write` is
  an explicit ADR-0090 D1 grandfather stamp ("record isolation for this demo
  object is RLS-owned / intentionally public") — a demo's stamp, not a value to
  teach.
- `crm_lead` (objectstack-upgrade) -> `'public_read_write'`, MIRRORED:
  `examples/app-crm/src/objects/lead.object.ts` is the same object name, and
  the skill and the app disagreeing about one object's OWD is the drift this
  mirrors away. Flagged for review in the PR body — the real object's value is
  itself a demo grandfather stamp.

Only then the gate half. `check-doc-security-posture` grows the `skills/` root
its own header recorded as deferred, following `check-skill-examples`'
SOURCE_ROOTS two-root/two-marker shape: `.md` + `<!-- os:check -->` for skills,
`.mdx` + the MDX comment spelling for docs, since MDX has no HTML comments.
Sequencing is the point — extending the roots before the 4 fixes would have
made the gate born red.

Two holes the generalization could have opened, closed here:

- The anti-idle floor is now PER ROOT. A root scanned with the wrong marker
  reads zero marked blocks, and a single whole-corpus counter would have stayed
  green on the other root's census while a governed corpus went unjudged.
- An exemption entry belonging to no root would be dropped by the per-root
  routing and never judged stale, silently ending the ledger's
  self-invalidating discipline. It is now a loud refusal.

Self-test grows a skills leg proving the .md root judges its own marker, and
that neither spelling crosses into the other root.

No changeset: `packages/lint`'s published `files` is ["dist","README.md",
"CHANGELOG.md"] with no `bin` and dist-only `exports`, so `scripts/**` ships to
no consumer, and this commit touches no package `src/`. The PR declares that
with `skip-changeset`.

Fixes #10925

* chore(skills): raise the data/upgrade token ceilings per the 2026-08-23 maintainer ruling

The four sharingModel keys commit 2 adds are required by the gating-tier
SECURITY_OWD_UNSET rule and cost 30 tokens in two files whose ceilings sat at
exactly zero headroom. Maintainer ruling, 2026-08-23, on PR #11141 (option A of
the three put to them, verbatim): 「A：提天花板（推荐）」 — data 13797→13817,
upgrade 8325→8335, quoted in the PR body as this gate's own header requires.
The same ruling confirmed crm_lead keeps the mirrored 'public_read_write'
(「镜像 public_read_write（推荐）」), so no diff change accompanies the raise.

Bundle-level the PR still nets +3 tokens (commit 1 pays back 27 elsewhere);
gate and its 33-case self-test green at this commit.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MsbKEG4LtERSLaDrbehM3e

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang

content/docs/ai/skills-reference.mdx

@@ -153,7 +153,7 @@ Use when the user is adding `*.endpoint.ts`, configuring auth providers, definin
 
 Do not use for: consuming an ObjectStack API from a client (that is just standard HTTP — no skill needed); the auto-generated CRUD endpoints (those follow from objectstack-data); request-side query syntax (see objectstack-query). CEL expressions in route guards or auth predicates: load objectstack-formula alongside.
 
-**Tags:** `rest`, `graphql`, `endpoint`, `auth`, `realtime`, `server`
+**Tags:** `rest`, `endpoint`, `auth`, `realtime`, `server`
 
 ---
 

packages/lint/scripts/check-doc-security-posture.mjs

@@ -145,15 +145,19 @@ export const CEILINGS = new Map([
   ['skills/objectstack-api/SKILL.md', 6348],
   ['skills/objectstack-automation/SKILL.md', 12543],
   // basis 7228d6c25 (PR #10402 head), not main — see CEILING_BASIS.
-  ['skills/objectstack-data/SKILL.md', 13797],
+  // +20 (13797→13817): maintainer ruling 2026-08-23 on PR #11141 — the three
+  // SECURITY_OWD_UNSET-required sharingModel keys. Ruling quoted in that PR's body.
+  ['skills/objectstack-data/SKILL.md', 13817],
   ['skills/objectstack-formula/SKILL.md', 6055],
   ['skills/objectstack-i18n/SKILL.md', 6349],
   // basis 7228d6c25 (PR #10402 head), not main — see CEILING_BASIS.
   ['skills/objectstack-platform/SKILL.md', 12716],
   ['skills/objectstack-pm-dispatch/SKILL.md', 14239],
   ['skills/objectstack-query/SKILL.md', 5569],
   ['skills/objectstack-ui/SKILL.md', 25154],
-  ['skills/objectstack-upgrade/SKILL.md', 8325],
+  // +10 (8325→8335): same 2026-08-23 ruling — crm_lead's SECURITY_OWD_UNSET-required
+  // sharingModel key (value mirrored from examples/app-crm per the same ruling).
+  ['skills/objectstack-upgrade/SKILL.md', 8335],
 ]);
 
 /**

scripts/check-skills-token-ratchet.mjs

@@ -16,7 +16,7 @@ metadata:
   author: objectstack-ai
   version: "1.4"
   domain: api
-  tags: rest, graphql, endpoint, auth, realtime, server
+  tags: rest, endpoint, auth, realtime, server
 ---
 
 # API Design — ObjectStack API Protocol

skills/objectstack-api/SKILL.md

@@ -91,7 +91,7 @@ Toggle system behaviours per object:
 |:-----|:--------|:--------|
 | `trackHistory` | `false` | Field-level audit trail |
 | `searchable` | `true` | Index records for global search |
-| `apiEnabled` | `true` | Expose via automatic REST / GraphQL APIs |
+| `apiEnabled` | `true` | Expose via automatic REST + MCP APIs |
 | `apiMethods` | all | Whitelist over the six primitives (`get`, `list`, `create`, `update`, `delete`, `bulk`); derived verbs (search/export/upsert/…) follow automatically |
 | `files` | `false` | Attachments & document management |
 | `feeds` | `true` | Social feed, comments, mentions — **opt-out**: explicit `false` hides the feed UI and rejects new comments |
@@ -214,6 +214,7 @@ import { ObjectSchema } from '@objectstack/spec/data';
 export default ObjectSchema.create({
   name: 'account',
   label: 'Account',
+  sharingModel: 'private',
 
   fieldGroups: [
     { key: 'contact_info', label: 'Contact Information', icon: 'user' },
@@ -253,6 +254,7 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
 
 export const Invoice = ObjectSchema.create({
   name: 'invoice',
+  sharingModel: 'private',
   fields: {
     status: Field.select({
       options: [
@@ -321,6 +323,7 @@ import { ObjectSchema } from '@objectstack/spec/data';
 export default ObjectSchema.create({
   name: 'support_case',
   label: 'Support Case',
+  sharingModel: 'private',
   enable: {
     trackHistory: true,
     feeds: true,

skills/objectstack-data/SKILL.md

@@ -425,7 +425,6 @@ to the envelope.
 | `Hook` | `condition` | cel |
 | `SharingRule` | `condition` | cel |
 | `Flow.decision` | `expression` / edge `condition` | cel (use `vars.<step>.<key>`) |
-| `GraphQL.ComputedField` | `expression` | cel |
 | `Dataset.records[*]` | any value | cel (via `cel\`\``) |
 | `audit` / `metrics` / `tracing` | `condition` / `successCriteria` | structured \| cel |
 
@@ -476,7 +475,6 @@ tmpl`Deal {{ record.name }} — {{ record.amount | currency }} closes {{ record.
 | `system/notification` | email subject + body, SMS message, push body + message (5 fields) |
 | `ai/model-registry` | `promptTemplate.system`, `promptTemplate.user` |
 | `integration/connector/github` | titleTemplate, bodyTemplate (PR + release) |
-| `api/graphql` | cache key |
 
 There is no JS expression surface: procedural JS is the L2
 `ScriptBody { language: 'js' }` surface (hook bodies), not an expression

skills/objectstack-formula/SKILL.md

@@ -392,7 +392,7 @@ export default app;          // Deploy to Cloudflare Workers, Deno, Bun, Node
 
 1. Accept a `kernel` (ObjectKernel) instance
 2. Create an `HttpDispatcher` internally
-3. Mount explicit routes for auth, GraphQL, storage, discovery
+3. Mount explicit routes for auth and discovery
 4. Delegate everything else to the dispatcher
 
 This means **new routes added to HttpDispatcher work automatically**

skills/objectstack-platform/SKILL.md

@@ -634,6 +634,7 @@ import { defineAgent } from '@objectstack/spec/ai';
 // physical constraint explicitly via `storage.notNull`.
 export const Lead = ObjectSchema.create({
   name: 'crm_lead',
+  sharingModel: 'public_read_write',
   label: 'Lead',
   fields: {
     name: { type: 'text', required: true, storage: { notNull: true } },