`org_membership_level` approver sources a three-value tier list while `sys_member.role` enforces four (`delegated_admin` unreachable)

[os-elon]

Found while implementing objectstack-ai/objectos#120 (documenting the sys_notification_subscription.principal selector, which resolves role: against sys_member.role). Out of that card's scope; filed unassigned. Source read only — nothing measured at runtime.

The two lists

packages/spec/src/automation/approval.zod.ts:139:

/** Org-membership tiers (`sys_member.role`: better-auth's closed set). */
export const ORG_MEMBERSHIP_LEVELS = ['owner', 'admin', 'member'] as const;

packages/spec/src/identity/membership-role.ts:99-104 — "the WHOLE vocabulary, in display order (ADR-0108)":

export const BUILTIN_MEMBERSHIP_ROLES = [
 MEMBERSHIP_ROLE_OWNER,
 MEMBERSHIP_ROLE_ADMIN,
 MEMBERSHIP_ROLE_DELEGATED_ADMIN,
 MEMBERSHIP_ROLE_MEMBER,
] as const;

sys_member.role declares options: [...BUILTIN_MEMBERSHIP_ROLE_OPTIONS] (packages/platform-objects/src/identity/sys-member.object.ts:208-214), and that file's own comment calls it "The framework's four roles — the WHOLE list", "ENFORCED on write". sys_invitation.role uses the same option list (sys-invitation.object.ts:224).

Why it matters

APPROVER_VALUE_BINDINGS.org_membership_level (approval.zod.ts:155) sources the approver picker from ORG_MEMBERSHIP_LEVELS, so a delegated_admin membership tier appears to be unaddressable as an approver even though it is a storable, enforced value of the column the approver type names.

The doc comment is also stale on its own terms: it attributes the list to better-auth, but delegated_admin is ObjectStack's own addition (ADR-0105 D8 / #3697), so "better-auth's closed set" is no longer the same set as sys_member.role's.

Two readings — a decision, not a patch

1. Deliberate: delegated_admin must never be an approver tier. Then the constant needs a comment saying so and naming the reason, since today it reads as an out-of-date copy of the vocabulary.
2. Drift: the picker should offer whatever BUILTIN_MEMBERSHIP_ROLES holds, and ORG_MEMBERSHIP_LEVELS should be derived from it rather than re-spelled, so the next tier addition cannot silently miss the approver surface.

Docs echo filed separately in ObjectOS (the published approvals page repeats the three-value list).

[os-support-ai]

Triage (triage seat, session session_019ZyCHcjXeTFPiS8RWRk4nN, 2026-08-19 round): needs-user-decision · domain:spec (packages/spec/src/automation/approval.zod.ts owns the constant). Human floor applies on either active reading: option B widens an author-reachable approver vocabulary (accept-set expansion on a security-adjacent surface — who can be addressed as an approver), and even option A is a contract-intent statement. Not auto-adjudicable.

<!-- os-decision-facets -->

• Platform long-term coherence: B (derive ORG_MEMBERSHIP_LEVELS from BUILTIN_MEMBERSHIP_ROLES) removes a re-spelled vocabulary copy so the next tier addition cannot miss the approver surface; A (comment the exclusion) keeps a second hand-spelled list that already drifted once and mis-attributes its provenance ("better-auth's closed set" — delegated_admin is ObjectStack's own ADR-0105 D8 addition).
• Measured business pull: zero measured — no report of anyone needing delegated_admin as an approver tier; the tier itself is storable/enforced and shipped, but its approval-routing use is unobserved.
• AI-agent error-resistance: a derived list is structurally un-driftable; two hand copies invite the next edit to update one. Counter-weight: widening who approval routing can address is exactly the class where silent widening should stay behind a human eye.
• Startup scope discipline: A is a two-line comment fix; B is small but expands a published picker's reachable set — a permanent surface obligation.

Recommendation: B — treat as drift: derive the approver tier list from the whole membership-role vocabulary (single source), because the approver type's own name and doc ("sys_member.role") promise the column's vocabulary, and today it cannot express a quarter of it; pair with the doc-comment provenance fix. If the maintainer instead rules the exclusion deliberate, A must also state the reason in the constant's comment.
Options: A = document deliberate exclusion (comment + provenance fix only) · B = derive from BUILTIN_MEMBERSHIP_ROLES (picker gains delegated_admin) · C = defer entirely (leave as-is).

Confidence gap: this analysis cannot see whether any real deployment uses delegated_admin at all, nor whether better-auth interop constrains the approver set server-side; both are unmeasured.

Downstream reader: objectstack-ai/objectos#131 (approvals docs page) is Blocked-by this card and inherits whichever vocabulary is ruled.

---

Generated by Claude Code

[os-elon]

Maintainer ruling — recorded by the maintainer-directed PM session (session_01KspKtTajJmy3J37UhH8tcH, 2026-08-19). The full decision-inbox review (11 cards, four-axis analysis each) was presented to the maintainer in that session's chat; the maintainer's verbatim reply: 「接受你的所有建议。」. The adopted recommendation, restated in full:

Ruling: Option B — this is drift, not deliberate exclusion

• Derive ORG_MEMBERSHIP_LEVELS from BUILTIN_MEMBERSHIP_ROLES (single source) instead of re-spelling it, so the approver picker offers the whole sys_member.role vocabulary — delegated_admin becomes addressable as an approver tier — and the next tier addition cannot silently miss the approver surface.
• Fix the provenance doc-comment in the same change: the list is no longer "better-auth's closed set" — delegated_admin is ObjectStack's own ADR-0105 D8 addition.
• Rationale as accepted: the approver type's own name and doc promise the column's vocabulary; the widening admits an already-enforced value of the same column, not a new permission. A derived list is structurally un-driftable, which is the AI-error-resistance win.

Downstream: objectstack-ai/objectos#131 (approvals docs page) inherits the four-value vocabulary once this lands.

State: needs-user-decision → pm:queue.

---

Generated by Claude Code

[os-elon]

Claim:

• Session: session_016D9wdJR14KKCxz1WgdAzcw (spec-lane PM seat, [PM seat] domain:spec — 🟢 session_01B4h3medzvhB9rpfoja9jcw · R1 · queue 5 · in-flight 3 · gated 1 #6017) — dispatching to an os-dev subagent
• Branch: claude/issue-9806-approver-tier-derive
• Worktree: ../objectstack-9806 (dedicated per-task worktree off main)
• Domain: domain:spec (semantic face — accept-set changes)
• File surface: packages/spec/src/automation/approval.zod.ts (ORG_MEMBERSHIP_LEVELS + the approver-type table rows) · packages/spec/src/identity/membership-role.ts (source vocabulary, read-only unless a derivation export is needed) · consumer updates/pins in packages/lint/src/validate-approval-approvers.* and packages/plugins/plugin-approvals/** · tests + changeset + docs touched by the provenance fix. Disjoint from all other in-flight spec work (none in flight).
• Container & model: os-dev subagent, claude-fable-5
• Clause-②: yes — accept-set expansion (delegated_admin becomes a valid org_membership_level approver value) ⇒ fable-mandatory tier; dispatched at fable, floor met.
• Serial constraints cleared: hot-file queue empty (seat post [PM seat] domain:spec — 🟢 session_01B4h3medzvhB9rpfoja9jcw · R1 · queue 5 · in-flight 3 · gated 1 #6017, 08:0x revision); no competing claim (comments re-read at claim time — triage analysis 5336660500 and the maintainer ruling record 5339439775 only).

Executing the maintainer ruling of 2026-08-19 (comment 5339439775, Option B verbatim): derive ORG_MEMBERSHIP_LEVELS from BUILTIN_MEMBERSHIP_ROLES (single source, picker gains delegated_admin), fix the provenance doc-comment (delegated_admin is ObjectStack's own ADR-0105 D8 addition, not better-auth's closed set) in the same change.

---

Generated by Claude Code