[转移] 发布期护栏:多组织下「平台级 + schedule + create_record + 未显式 organization_id」拒绝——#6155 Q3=A 裁决的 lint 半边

[hotlong]

Part of #6155(维护者 2026-08-07 裁决 Q2=A + Q3=A;services 座位转移立单,落点在运行时发布门——域标签交分诊按落点文件定)。

裁决口径

• Q2=A:平台级定时流程的 org 由作者在 create_record 的 fields.organization_id 显式声明(fix(service-automation): runAs:'system' 的 create_record 按 ADR-0118 染全三列——组织、属主、创建者禁 NULL (#5494) #6153 的 fill-only 已保证作者值优先——该半边零新代码,既有能力);
• Q3=A:护栏只落运行时发布门——给 assertRuntimeAuthoringRules → evaluateRuntimeAuthoringGate 补两个缺失输入(写入 org 与 部署形态 postureEnforcesWall(resolveTenancyPosture())),CLI 纯函数侧 ⛔ 不判(构建机 env 是假信号);
• 拒绝组合:多组织部署 && 平台级流程 && schedule 触发 && 含 create_record && 未在 fields 显式给 organization_id ⇒ 发布时拒绝(与 fix(security): surface schedule/user-less flow runAs fail-open (#1888 follow-up) #2308/Author-time expression validator is blind to registry-injected system columns — record.owner_id / created_at / organization_id are rejected as unknown fields #5378 lint 面同族,照抄形状不发明新面)。

#6155 dev 探针已量出的两个输入缺口(实现起点,勿重查)

1. 部署形态:postureEnforcesWall(resolveTenancyPosture()) 是进程级 env 读数,AUTHORING_RULES 纯函数签名不含它——按 Q3=A 从 gate 侧注入;
2. 写入 org:在 saveMetaItem 手里但 assertRuntimeAuthoringRules 未传给 evaluateRuntimeAuthoringGate;
3. ⚠️ 待确认的短路:assertRuntimeAuthoringRules 现有 if (this.environmentId === undefined) return;——控制面 kernel 上整条 gate 不跑。实现前先答「这是既有设计还是遗漏」:若短路使护栏在关键部署形态不可达,STOP 上报,⛔ 不得擅自拓宽 gate 激活面(Schedule 触发器不携带任何 org 上下文——定时 runAs:'system' 清扫在多组织部署里仍会产出 organization_id=NULL 的行(#5494 的用户缺席半边) #6155 dev 原话:无把握,未擅自改动)。

依赖

Blocked-by: #6283(spec 半边 flip——Q1=B 落地后「org 归属的 flow」不复存在,本护栏的拒绝组合语义才是终态)。

Refs:#6155(裁决与探针证据)、#6153(fill-only 先例)、#2308/#5378(lint 面同族)、ADR-0118 D1。

[claude]

Triage (lane-label repair): domain:metadata.

pm:queue since 13:01Z with the domain deliberately left to triage ("域标签交分诊按落点文件定"). Answered by reading the code, not the title:

packages/metadata-protocol/src/runtime-authoring-gate.ts:102  export function evaluateRuntimeAuthoringGate(
packages/metadata-protocol/src/protocol.ts:2378               private assertRuntimeAuthoringRules(
packages/metadata-protocol/src/protocol.ts:2413                 const err = evaluateRuntimeAuthoringGate({
packages/metadata-protocol/src/protocol.ts:7986, :8700         call sites

Both named functions live in packages/metadata-protocol, which is the packages/metadata* family ⇒ domain:metadata (seat #6367). Explicitly not domain:services (the filing lane) and not domain:cli: the /meta HTTP route in packages/rest is the cli lane's half of this red line, and this card does not touch it.

Blocked-by: #6283 stands — that spec flip decides whether "org-scoped flow" still exists as a shape, which is what the refusal combination is defined against. Selection skips this until #6283 merges.

⚠️ The body's third input — if (this.environmentId === undefined) return; short-circuiting the whole gate on a control-plane kernel — is a STOP-and-report item, not something to widen on the way past. That instruction is carried into this label repair unchanged.

本评论来自分诊座位 Routine(#5474 试点),不构成认领。

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round 1+ (domain:metadata seat, sticker #6367; batch raised to 5 by maintainer instruction 2026-08-08 「并发加到5」)
Session: session_01W6bLax4KMrSfnE1ydFU8Dw
Branch: claude/issue-6285-platform-schedule-org-gate
Worktree: objectstack-issue-6285
Domain: domain:metadata
File surface: packages/metadata-protocol/src/runtime-authoring-gate.ts (primary) + packages/metadata-protocol/src/protocol.ts assertRuntimeAuthoringRules region only (~:2405–:2430) + their tests + one .changeset/*.md
Serial constraints cleared: Blocked-by: #6283 CLEARED — #6283 closed completed 2026-08-08T01:58:05Z (Q1=B spec flip landed), so the refusal combination's semantics are final. Same-file note: #6479 is in flight on protocol.ts updateData (:5743) and #5079 goes out this round on getMetaItems/deleteMetaItem (:3284/:10514) — maintainer explicitly authorized filling the batch with region-disjoint parallel authorship on this hot file (2026-08-08, after the serialization constraint was reported); landings stay serial through the merge queue. Region confinement is a stop-on-breach term for all three.

Ruling of record: #6155 Q2=A + Q3=A (maintainer 2026-08-07) — gate-side only, CLI pure-function side does NOT judge. The environmentId === undefined short-circuit question (protocol.ts:2408) is a STOP-and-report item, carried unchanged from the card.

---

Generated by Claude Code

[os-zhuang]

Review verdict: ACCEPT — PM domain:metadata seat, session session_01W6bLax4KMrSfnE1ydFU8Dw.

PR #6708 implements #6155 Q2=A + Q3=A as ruled:

• The STOP item was answered before coding, with evidence, and without widening the gate: the environmentId === undefined short-circuit is the ADR-0005 control-plane carve-out (already pinned as deliberate), and every real serving path binds an environment id (os dev/os start → env_local, standalone → proj_local, cloud per-project kernels), so the guardrail is reachable exactly where multi-org deployments live. Evidence in the PR body and a code comment.
• The judgement is a pure function (findPlatformScheduleOrgGaps) with all five limbs of the refusal combination; the schedule test mirrors AutomationEngine.resolveTriggerBinding branch-for-branch, and region traversal reuses spec's FLOW_REGION_SLOTS_BY_TYPE so a create_record inside a loop body is visible. Deliberately NOT an AUTHORING_RULES entry — the wiring test would force it onto os build, which is precisely what Q3=A rejects.
• Refusals reuse the 422 INVALID_METADATA envelope; 26 cases assert code AND status at the caller face; reverse verification (plumbing removed, pure function kept) went 5 red / 21 green with the exact shapes that prove toThrow() alone would have been forever-green (expected { success: true } to be an instance of Error).
• Out-of-scope finding #4463 运行时发布门在 host-config 拓扑(environmentId 未绑定)上整体不跑——#5086 只把 code-only 拒绝移出了同一条短路 #6710 filed (the whole [runtime/metadata] 作者时规则只存在于 CLI:Studio/REST/MCP 的运行时授权面是第四扇门,26 条规则一条不跑——#4409 修完后最大的敞口 #4463 gate never runs on a host-config topology — honest about the unmeasured reachability question); successor pricing recorded: [P2] 运行时授权门扩到 object 写入 + 全量 runtime-safe 规则快照(#4463 P1 之后) #4716 EASIER (inherits the deployment-context plumbing; must NOT copy the gate-local home for rule snapshots), [P2/P3] 运行时授权门的 advisory findings 要进响应并被 Studio 渲染 + docs「the gate」补第四列(#4463 收尾) #4717 UNAFFECTED (error-only rule; renderers should read rulesRun rather than assume lint-registry ids).

Next: CI convergence, then ready + merge queue (landings on protocol.ts remain serial; regions verified disjoint from #6709/#6687).

---

Generated by Claude Code

[os-zhuang]

Landing confirmed — PR #6708 merged as a5d25734c (verified on origin/main). Publishing a platform-level scheduled create_record flow with no organization_id is now refused on walled deployments at the runtime publish gate, per #6155 Q2=A + Q3=A. The out-of-scope activation-surface finding lives on as #6710. — domain:metadata PM, session session_01W6bLax4KMrSfnE1ydFU8Dw

---

Generated by Claude Code