feat(lint): check:doc-security-posture — gate os:check docs object examples on the os validate security posture

.github/workflows/lint.yml

@@ -3343,6 +3343,28 @@ jobs:
  - name: Check docs formula examples are valid CEL
  run: pnpm --filter @objectstack/lint run check:doc-formula-expressions
 
+ # The AUTHOR-TIME-LINT half of the same surface (#10618). check:skill-examples
+ # proves an `os:check` block COMPILES; it cannot prove `os validate` accepts
+ # what the block constructs, because the lint rules judge VALUES, not types:
+ # `sharingModel` is `.optional()` with no `.default()`, so omitting it
+ # type-checks clean while `os validate` rejects the object as severity:
+ # 'error' (SECURITY_OWD_UNSET — the ADR-0090 D1 authored-baseline rule).
+ # That is how 22 canonical docs examples across 12 pages shipped a shape
+ # the platform's own gate rejects (#10581; fixed by the #10714 sweep, plus
+ # 8 more this gate's first run found on pages outside that sweep's scope).
+ #
+ # The verdict is `validateSecurityPosture` imported from @objectstack/lint —
+ # the same gating-tier registry entry `os validate` / `os compile` and the
+ # runtime publish gate run — never a lookalike, so the docs are gated by
+ # the rule rather than a dialect of it. Same home and reasoning as its
+ # CEL neighbour directly above. The constructed `ObjectSchema.create`
+ # literal is STATICALLY evaluated (never executed), with per-fact
+ # conservatism: a verdict is only trusted where its facts are statically
+ # known, so `Field.*` factory calls and dynamic values can never turn
+ # into a false red. Self-test first, both directions.
+ - name: Check docs object examples pass the os validate security posture
+ run: pnpm --filter @objectstack/lint run check:doc-security-posture
+
  # Same anti-drift class as the gates above, for the generated translation
  # bundles in packages/platform-objects/src/apps/translations/. Nothing
  # regenerated them either, so they rotted three ways at once (#3670):

content/docs/plugins/development.mdx

@@ -134,6 +134,7 @@ import { ObjectSchema } from '@objectstack/spec/data';
 
 export const greetingLogObject = ObjectSchema.create({
  name: 'greeting_log',
+ sharingModel: 'private',
  label: 'Greeting Log',
  fields: {
  recipient: { label: 'Recipient', type: 'text', required: true },

content/docs/protocol/kernel/i18n-standard.mdx

@@ -656,6 +656,7 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
 
 export const Account = ObjectSchema.create({
  name: 'account',
+ sharingModel: 'private',
  label: 'account.label', // Translation key
  pluralLabel: 'account.pluralLabel',
  icon: 'building',

content/docs/protocol/kernel/lifecycle.mdx

@@ -481,6 +481,7 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
 
 export default ObjectSchema.create({
  name: 'salesforce_account',
+ sharingModel: 'private',
  label: 'Salesforce Account',
  fields: {
  salesforce_id: Field.text({ required: true, unique: 'global' }),

content/docs/protocol/kernel/plugin-spec.mdx

@@ -263,6 +263,7 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
 
 export const Account = ObjectSchema.create({
  name: 'account',
+ sharingModel: 'private',
  label: 'Account',
  pluralLabel: 'Accounts',
  icon: 'building',

content/docs/protocol/objectql/schema.mdx

@@ -52,6 +52,7 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
 
 export const Customer = ObjectSchema.create({
  name: 'customer',
+ sharingModel: 'private',
  label: 'Customer',
  icon: 'building',
 
@@ -135,6 +136,7 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
 
 export const Project = ObjectSchema.create({
  name: 'project',
+ sharingModel: 'private',
  label: 'Project',
  pluralLabel: 'Projects',
  description: 'A business project or initiative',

content/docs/protocol/objectql/state-machine.mdx

@@ -30,6 +30,7 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
 
 export const PurchaseRequest = ObjectSchema.create({
  name: 'purchase_request',
+ sharingModel: 'private',
  label: 'Purchase Request',
 
  fields: {

content/docs/ui/field-grouping-and-order.mdx

@@ -35,6 +35,7 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
 
 export const Contact = ObjectSchema.create({
  name: 'showcase_contact',
+ sharingModel: 'private', // matches the real showcase_contact (examples/app-showcase)
  label: 'Contact',
 
  // The DECLARATION half — array order is display order (there is no `order` key).

packages/lint/package.json

@@ -23,7 +23,8 @@
  "dev": "tsc -w",
  "test": "vitest run",
  "typecheck": "tsc --noEmit",
- "check:doc-formula-expressions": "node scripts/check-doc-formula-expressions.mjs --self-test && node scripts/check-doc-formula-expressions.mjs"
+ "check:doc-formula-expressions": "node scripts/check-doc-formula-expressions.mjs --self-test && node scripts/check-doc-formula-expressions.mjs",
+ "check:doc-security-posture": "node scripts/check-doc-security-posture.mjs --self-test && node scripts/check-doc-security-posture.mjs"
  },
  "dependencies": {
  "@objectstack/formula": "workspace:*",