os-zhuang · Oct 28, 2026 · Oct 28, 2026
@@ -2,7 +2,7 @@
 
 > **🔶 Cloud-owned — superseded in part by cloud ADR-0025 (2026-06-25).** The in-UI AI runtime and the `ask` / `build` agents described here moved to the **cloud / Enterprise** distribution (`@objectstack/service-ai` → `cloud/packages/service-ai`, closed); the open framework exposes AI only via `@objectstack/mcp` (BYO-AI) and ships no in-product `ask` / `build` chat. Retained as historical design context, now **cloud-owned** — see [`cloud/docs/adr/0025-service-ai-to-cloud-open-mcp-only`](https://github.com/objectstack-ai/cloud/blob/main/docs/adr/0025-service-ai-to-cloud-open-mcp-only.md).
 
-**Status**: Proposed (2026-06-11) — cloud-owned; framework slice partially implemented (2026-07-16 audit): L3 runtime probes shipped and tested (`metadata-protocol/src/build-probes.ts`, `RuntimeBuildIssue` contract); L2 half-present (dataset compile only); L1/L4/L5 + `ai_eval_*` storage are cloud-only and not verifiable in this repo.
+**Status**: Accepted — 2026-10-28 (ruled on objectstack#26553, ADR batch 2; proposed 2026-06-11). cloud-owned; implemented: L1 graph lint and L4 `verify_build` self-correction in cloud `service-ai-studio` (`verify/graph-lint.ts`), L3 runtime probes in the framework (`metadata-protocol/src/build-probes.ts`, `RuntimeBuildIssue` contract, post-publish probe report in `protocol.zod.ts`), L5 golden-prompt evals (cloud `eval-golden-prompts.yml` on `ai_eval_cases` / `ai_eval_runs`); pending: L2 renderability contract (dataset compile only today).
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: [ADR-0033](./0033-ai-assisted-metadata-authoring.md) (drafts as the staging layer — this ADR **replaces its human-approval assumption for AI builds** with a machine gate; HITL stays for destructive actions), [ADR-0021](./0021-analytics-dataset-semantic-layer.md) (datasets — what most verification probes exercise), ADR-0037 / [framework#1694](https://github.com/objectstack-ai/objectstack/pull/1694) (Live Canvas — the *human-visibility* complement to this ADR's *machine-verification*)
 **Consumers**: `@objectstack/service-analytics` + `@objectstack/objectql` (verification probes), `../cloud/service-ai-studio` (graph lint, `verify_build` tool, self-correction protocol, eval intelligence), `../objectui` (build health card in chat), `ai_eval_cases`/`ai_eval_runs` (existing, currently-unused storage)

@@ -1,6 +1,6 @@
 # ADR-0046: Package documentation as metadata — flat `src/docs/*.md` compiled into the manifest
 
-**Status**: Proposed (2026-06-12, revised — simplified from the original directory/docSet design)
+**Status**: Accepted — 2026-10-28 (ruled on objectstack#26553, ADR batch 2; proposed 2026-06-12, revised — simplified from the original directory/docSet design). implemented: P1 (`DocSchema`, `os build` collection of flat `src/docs/*.md`, publish lint, kernel `doc`), P2 (console documentation portal and help menu, Studio doc editor), P3a/P3b (`book` spine, `GET /meta/book/:name/tree`, §6.7 audience gating in the REST read gate); pending: P3c (Studio drag-edit of `doc.order` / groups, anonymous library via `apps/docs`) and P3d (portal taxonomy, book-level search, §5 tags).
 · **Superseded in part (2026-06-13, ADR-0048)** — the bare-name overwrite premise; note at §3.2.
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: [ADR-0003](./0003-package-as-first-class-citizen.md) (package + versioned releases), [ADR-0016](./0016-studio-package-authoring-and-publish.md) (publish pipeline, `manifest_json` snapshot), [ADR-0025](./0025-plugin-package-distribution.md) (artifact distribution, trust boundary), [ADR-0033](./0033-ai-assisted-metadata-authoring.md) (AI as primary author)

@@ -1,6 +1,6 @@
 # ADR-0051: Inline metadata views in docs — the ` ```metadata ` fenced block
 
-**Status**: Proposed (2026-06-16) — P1 authoring surface implemented (2026-07-16 audit): `ElementMetadataViewerPropsSchema` + `element:metadata_viewer` component entry + publish lint with reference-liveness checks (`cli/utils/collect-docs.ts lintMetadataEmbeds`); the console SDUI fence-lift and the state_machine/flow/permission renderers are NOT implemented — no runtime rendering of the embed yet.
+**Status**: Accepted — 2026-10-28 (ruled on objectstack#26553, ADR batch 2; proposed 2026-06-16). P1–P3 implemented: the `metadata` fenced block lifts to `element:metadata_viewer` in the markdown renderer, the viewer renders `state_machine`, `flow` and `permission` (`ui/packages/components/src/renderers/basic/metadata-viewer.tsx`), publish lint with reference-liveness checks (`cli/utils/collect-docs.ts lintMetadataEmbeds`); `object` embeds and the general `objectui` fence stay deferred (§5).
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: [ADR-0046](./0046-package-docs-as-metadata.md) (`doc`/`book` as metadata — §3.4 syntax boundary, §3.5 *derived content is rendered, never written*, §6.7 anonymous live-embed guardrail), [ADR-0020](./0020-state-machine-converge-and-enforce.md) (a record state machine is a `state_machine` validation rule on an object, not a standalone type), [ADR-0047](./0047-object-ui-run-modes.md) (ObjectUI is the server-driven UI runtime), [ADR-0048](./0048-cross-package-metadata-collision.md) (package-scoped single-item resolution), [ADR-0049](./0049-no-unenforced-security-properties.md) (enforce-or-remove posture for governed properties), [ADR-0033](./0033-ai-assisted-metadata-authoring.md) (AI as primary author)
 **Consumers**: `@objectstack/spec` (`DocSchema` unchanged; new `element:metadata_viewer` entry in `ComponentPropsMap`; the fenced-block body schema), `@objectstack/cli` (publish lint: parse + validate body + reference-liveness), `@objectstack/console` (the SDUI doc renderer lifts ` ```metadata ` fences into the component), `apps/docs` portal (anonymous degradation per ADR-0046 §6.7), `@objectstack/core` (kernel **unchanged** — `doc` stays inert)

@@ -1,6 +1,6 @@
 # ADR-0052: Audit is not the activity feed — decompose collaboration, activity, and audit into bounded contexts
 
-**Status**: Proposed (2026-06-16) — partially implemented (2026-07-16 audit): §5b declarative activity (`trackHistory` + milestone templates), ActivityPointer fields, and `service-feed` retirement are done; the headline bounded-context decomposition is NOT — `sys_activity`/`sys_comment` still live in plugin-audit, the audit-writer still dual-writes (no event-bus spine), `sys_notification` move deferred (P1/P2).
+**Status**: Accepted — 2026-10-28 (ruled on objectstack#26553, ADR batch 2; proposed 2026-06-16). implemented: §5b declarative activity (`trackHistory` + object-level milestone templates), P0b ownership moves (`sys_attachment` and `sys_notification` are no longer registered by plugin-audit), P1 (`sys_comment` is the one collaboration backend with reactions and threads; `service-feed` retired); pending: P2 domain event spine — the audit writer still dual-writes `sys_audit_log` and `sys_activity`, and `sys_activity` / `sys_comment` still live in plugin-audit (the headline bounded-context decomposition).
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: [ADR-0030](./0030-notification-platform-convergence.md) (single-ingress `NotificationService.emit` — *no producer writes a per-user inbox row directly*; this ADR applies the same "one canonical service per context, producers emit through a seam" posture to activity and collaboration), [ADR-0012](./0012-notification-platform.md) (messaging outbox owns `sys_notification`), [ADR-0049](./0049-no-unenforced-security-properties.md) (enforce-or-remove posture for governed properties — audit immutability must be enforced at its own boundary, not diluted by co-tenant objects), [ADR-0042](./0042-approval-sla-escalation.md) (uses `sys_audit_log` rows as an idempotency primitive — a second reason audit must stay a clean, append-only ledger)
 **Consumers**: `@objectstack/plugin-audit` (sheds 4 of its 5 objects; keeps only `sys_audit_log`), `@objectstack/service-feed` (becomes the canonical collaboration+timeline backend, or is retired into it), `@objectstack/service-storage` (takes `sys_attachment`), `@objectstack/service-messaging` (takes `sys_notification`, per ADR-0030), `@objectstack/platform-objects` (object ownership map), `@objectstack/cli` (`ALWAYS_ON_CAPABILITIES` / capability resolver), `@objectstack/console` (ChatterPanel data source), `@objectstack/spec` (`IFeedService` / event contracts)

@@ -17,8 +17,8 @@
 
 | Status | Records |
 |---|---|
-| Accepted | 112 |
-| Proposed | 18 |
+| Accepted | 116 |
+| Proposed | 14 |
 | Superseded | 4 |
 | Draft | 3 |
 | Deferred | 2 |
@@ -108,21 +108,21 @@ A bare `ADR-0006` names the decision; its current text is [0006-project-environm
 | [ADR-0035](./0035-config-driven-master-detail.md) | Config-driven master-detail (declare on the relationship, forms derive) | Accepted | — | — | — |
 | [ADR-0036](./0036-app-as-rest-api-and-mcp-server.md) | Every app is a REST API + an MCP server — make it visible and connectable after build | Accepted — framework implemented; cloud surfacing pending (proposed 2026-0… | 2026-06-06 | — | — |
 | [ADR-0037](./0037-live-canvas-draft-preview.md) | Live Canvas — draft-overlay live preview while you build | Accepted — 2026-06-10 — all four phases implemented: `previewDrafts` reads… | 2026-06-10 | — | — |
-| [ADR-0038](./0038-build-verification-loop.md) | Build Verification Loop — the agent builds, verifies, and corrects itself | Proposed — 2026-06-11 — cloud-owned; framework slice partially implemented… | 2026-06-11 | — | cloud ADR-0025 |
+| [ADR-0038](./0038-build-verification-loop.md) | Build Verification Loop — the agent builds, verifies, and corrects itself | Accepted — 2026-10-28 (ruled on objectstack#26553, ADR batch 2; proposed 2… | 2026-10-28 | — | cloud ADR-0025 |
 | [ADR-0039](./0039-token-scope-tree-execution.md) | Concurrent durable pause — multi-instance nodes now, token/scope-tree later | Accepted — Track A implemented; Track B deferred (proposed 2026-06-11, rev… | 2026-06-11 | — | — |
 | [ADR-0040](./0040-unified-assistant-and-agent-binding.md) | Unified Assistant — the end user never picks an agent | Superseded — by ADR-0063 — original: Proposed (2026-06-11) | 2026-06-11 | — | ADR-0063, cloud ADR-0025 |
 | [ADR-0041](./0041-flow-trigger-family.md) | Flow trigger family — taxonomy, naming, and the open-source core set | Accepted — Tier 1 implemented (rename deprecation stubs pending) (proposed… | 2026-06-12 | — | — |
 | [ADR-0042](./0042-approval-sla-escalation.md) | Approval SLA escalation — a jobs-backed scanner with audit-row idempotency | Accepted — implemented (proposed 2026-06-12 · calibrated 2026-06-12) | 2026-06-12 | — | — |
 | [ADR-0043](./0043-actionable-approval-links.md) | Actionable approval links — single-use tokens with a session-less confirm page | Accepted — implemented (proposed 2026-06-12 · calibrated 2026-06-12) · Ame… | 2026-06-12 | — | — |
 | [ADR-0044](./0044-approval-send-back-for-revision.md) | Flow-level send-back-for-revision — `revise` branch + typed back-edge re-entry | Accepted — engine + model implemented; designer pending (objectui) (propos… | 2026-06-12 | — | — |
 | [ADR-0045](./0045-additive-materialization-and-visibility-gate.md) | Additive materialization with a visibility gate — drafts narrow to mutations | Accepted — 2026-06-12 · Amended 2026-08-09 (#4829, maintainer ruling 2026-… | 2026-06-12 | — | — |
-| [ADR-0046](./0046-package-docs-as-metadata.md) | Package documentation as metadata — flat `src/docs/.md` compiled into the manifest | Proposed — 2026-06-12, revised — simplified from the original directory/do… | 2026-06-12 | — | — |
+| [ADR-0046](./0046-package-docs-as-metadata.md) | Package documentation as metadata — flat `src/docs/.md` compiled into the manifest | Accepted — 2026-10-28 (ruled on objectstack#26553, ADR batch 2; proposed 2… | 2026-10-28 | — | — |
 | [ADR-0047](./0047-object-ui-run-modes.md) | Two run modes for object UI — data views vs interface pages, user filters, and runtime visualization choice | Accepted — 2026-06-12; revised 2026-06-19 — framework scope implemented (`… | 2026-06-12 | — | — |
 | [ADR-0048](./0048-cross-package-metadata-collision.md) | Cross-package metadata collision — package-id identity, namespace install gate, package-scoped resolution | Revised — 2026-06-13 — supersedes the original per-item collision | 2026-06-13 | — | — |
 | [ADR-0049](./0049-no-unenforced-security-properties.md) | Spec must not declare security properties the runtime does not enforce (enforce-or-remove gate) | Accepted — 2026-06-15 — implemented: fail-closed `DESTRUCTIVEOPERATIONS` (… | 2026-06-15 | — | — |
 | [ADR-0050](./0050-form-layout-vs-presentation.md) | Form layout vs presentation — split the overloaded `FormView.type` | Proposed — 2026-06-15 · Amended (2026-10-20, letter B′ on #24692, ruling r… | 2026-06-15 | — | — |
-| [ADR-0051](./0051-inline-metadata-views-in-docs.md) | Inline metadata views in docs — the ` ```metadata ` fenced block | Proposed — 2026-06-16 — P1 authoring surface implemented (2026-07-16 audit… | 2026-06-16 | — | — |
-| [ADR-0052](./0052-audit-is-not-the-activity-feed.md) | Audit is not the activity feed — decompose collaboration, activity, and audit into bounded contexts | Proposed — 2026-06-16 — partially implemented (2026-07-16 audit): §5b decl… | 2026-06-16 | — | — |
+| [ADR-0051](./0051-inline-metadata-views-in-docs.md) | Inline metadata views in docs — the ` ```metadata ` fenced block | Accepted — 2026-10-28 (ruled on objectstack#26553, ADR batch 2; proposed 2… | 2026-10-28 | — | — |
+| [ADR-0052](./0052-audit-is-not-the-activity-feed.md) | Audit is not the activity feed — decompose collaboration, activity, and audit into bounded contexts | Accepted — 2026-10-28 (ruled on objectstack#26553, ADR batch 2; proposed 2… | 2026-10-28 | — | — |
 | [ADR-0053](./0053-date-and-datetime-semantics.md) | `date` is a timezone-naive calendar day; `datetime` is an instant rendered in a reference timezone | Accepted — 2026-06-16 — Phase 1 + addendum D-A1 implemented (`sql-driver.t… | 2026-06-16 | — | — |
 | [ADR-0054](./0054-runtime-proof-for-authorable-surface.md) | A live authorable property must be proven at runtime, not merely have a consumer (prove-it-runs gate) | Accepted — 2026-06-18 | 2026-06-18 | — | — |
 | [ADR-0055](./0055-master-detail-controlled-by-parent.md) | Master-detail "controlled by parent" permissions — derived access via pre-resolved master-id membership | Accepted — 2026-06-19 — implemented in this PR (P0–P2) · Amended (2026-09-… | 2026-06-19 | — | — |