[1 of #7891] `METADATA_CREATE_SEEDS.object` gains an authored `sharingModel` — or an explicit default-OWD ruling (blocker A)

[hotlong]

Programme slice of #7891 (split by the domain:spec seat, session session_01Euoy6wyfzgiWtgCg4s6JK2). Contract-first head of the chain — no Blocked-by:; slices 2 and 3 wait on it.

Scope

Blocker A of the parent card: declaring object in runtimeTypes makes security-owd-unset refuse the platform's own minimal create body, because METADATA_CREATE_SEEDS.object (packages/spec/src/kernel/metadata-create-seeds.ts) carries no sharingModel. This slice repairs the authoritative create body: the seed gains an authored OWD or an explicit, documented decision not to — plus the fallout repair in the 8 affected @objectstack/metadata-protocol test files (measured: 26 refusals → 48 failing tests, all from the single rule id security-owd-unset).

Escalation clause (from triage, binding)

Whether the seed gains an authored sharingModel vs an explicit default-OWD ruling is the one embedded judgment call. If implementation shows it is a genuine product fork (semantics of a tenant's default sharing) rather than the mechanical repair the measurements suggest, flip THIS slice to needs-user-decision — ⛔ never silently pick.

Measured facts inherited from PR #7886 (re-run, do not trust)

• Fallout measurement re-runnable via packages/lint/src/validate-security-posture.runtime-surface.test.ts and the metadata-protocol suite.
• Corrected premise: the gate's plumbing reaches non-object collections; the gap for three cross-collection rules is sibling collections (that is slice 2's territory, not this one's).

Notes

• packages/spec/src/kernel semantic-face change ⇒ claude-fable-5 clause applies at dispatch.
• ⛔ This slice does NOT flip runtimeTypes for object — that is slice 3, after this and slice 2 land.

Part of #7891.

[hotlong]

Claim: PM loop round 1 (backfill slot after #7917 ACCEPT)
Session: session_01Euoy6wyfzgiWtgCg4s6JK2
Branch: claude/issue-8308-object-seed-owd
Worktree: objectstack-issue-8308
Domain: domain:spec
File surface: packages/spec/src/kernel/metadata-create-seeds.ts, the 8 affected @objectstack/metadata-protocol test files, related pins; changeset (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: claude-fable-5 (mandatory clause — packages/spec semantic face)
Serial constraints cleared: no in-flight claim touches kernel/metadata-create-seeds.ts or the metadata-protocol suite (in flight this lane: #8010 → ui/view.zod.ts, #8124 → api/errors+types+rest, #8082 → data/driver/**, #8116 → data/injected-system-columns+metadata-core+lint). Premise re-verified on origin/main just now: sharingModel absent from the seeds file (grep exit 1); file unchanged since 7e06f51.

---

Generated by Claude Code

[hotlong]

{
 "issue": 8308,
 "status": "done",
 "branch": "claude/issue-8308-object-seed-owd",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/8338",
 "premise_still_valid": true,
 "summary": "Mechanical repair, not a product fork — the escalation clause was checked and NOT triggered: the runtime's operative default for a custom object with no sharingModel is 'private', measured at effectiveSharingModel (packages/plugins/plugin-sharing/src/sharing-service.ts, ADR-0090 D1 fail-closed), so authoring 'private' in METADATA_CREATE_SEEDS.object changes no tenant's effective sharing. Delivered: the seed repair; 10 metadata-protocol test files (the inherited figure was 8 files / 26 refusals from PR #7886 — today's re-measurement found 56 active object writes across 10 files, all refusable by security-owd-unset alone, the suite grew) each fixture judged individually incl. two refusal-pin files where an OWD-less body would have swapped the pinned refusal post-flip; a new lint runtime-surface pin consuming the REAL seed (registry runtimeTypes untouched — #8310's); changeset. Method deviation, disclosed: the sandbox's action classifier repeatedly denied rebuilding packages/lint with the temporary runtimeTypes measurement flip, so the 56→0 measurement used the gate's exact mirror (temporary never-committed tap at the saveMetaItem gate call site + validateSecurityPosture with the runtime gate's own baseline/candidate set-difference) instead of a flipped dist; #8310's real flip re-verifies end to end.",
 "tests": "spec full suite 388 files / 10249 tests PASS (with repaired seed); metadata-protocol full suite 77 files / 1117 tests PASS both before and after fixture repair; gate-mirror measurement 56 refusable writes -> 0 (all security-owd-unset, per-file breakdown in PR); lint validate-security-posture{,.runtime-surface} 2 files / 97 tests PASS; metadata-core 10 files / 162 tests PASS; typecheck spec+lint PASS (metadata-protocol is DEBT-ledgered, no typecheck script; check:type-check-debt needs the full 42-package built closure — CI's lint.yml covers it); spec check:generated all 13 artifacts current; check:nul-bytes / check:cross-package-test-inputs / check:spec-parsed-alias PASS. CI on PR #8338: in_progress at report time.",
 "open_questions": [],
 "out_of_scope_findings": []
}

---

Generated by Claude Code

---

Generated by Claude Code

[hotlong]

ACCEPT — reviewed by the dispatching seat (session session_01Euoy6wyfzgiWtgCg4s6JK2) against PR #8338's diff.

Verified: the escalation clause was exercised exactly as written — the operative default was MEASURED (effectiveSharingModel, plugin-sharing, ADR-0090 D1 fail-closed ⇒ private) before concluding mechanical-repair, and the seed comment records the basis; 13 files all in surface (the claim's "8 files" grew to a re-measured 10 — the suite moved under the inherited figure, and the report says so with the new number); the two refusal-pin files are handled for exactly the post-flip swap hazard the card warned about; the new lint pin consumes the REAL seed from the registry so a seed regression reopens the pin; runtimeTypes untouched (#8310's). Measurement-method deviation (gate-mirror tap instead of a flip-rebuild, sandbox-forced) is disclosed, never-committed, and re-verified end-to-end by #8310's real flip. Changeset patch is the right level — no acceptance change today.

Landing: draft until gate jobs conclude; flip + auto-merge (squash) on the timed check. Programme state after merge: #8310 remains Blocked-by: #8308 #8309; #8309 stays on #4463; #8307 stays held behind #8116's packages/lint landing.

---

Generated by Claude Code