Merge branch 'main' into fix/meta-resync-default-permission-sets

Author: os-zhuang

.changeset/adr-0090-docs-audience-enforcement.md

@@ -0,0 +1,40 @@
+---
+'@objectstack/spec': major
+'@objectstack/rest': minor
+'@objectstack/plugin-security': minor
+'@objectstack/lint': minor
+'@objectstack/metadata': minor
+'@objectstack/platform-objects': patch
+---
+
+ADR-0090 follow-through wave: enforce book audience at the read layer; finish the D2/D3 cleanup the P1 rename missed.
+
+- **rest**: `/meta/book`, `/meta/doc`, and `/meta/book/:name/tree` now ENFORCE
+  the ADR-0046 §6.7 audience model (ADR-0049 — no unenforced security
+  properties): anonymous callers see only `public` books/docs;
+  `{ permissionSet }`-gated books require the caller to hold the named set;
+  a doc's effective audience is the union over the books that CLAIM it
+  (unclaimed docs default to `org`; orphan rendering never inherits `public`).
+  Gated evaluation fails CLOSED when holdings cannot be resolved. `doc`/`book`
+  single-item reads bypass the shared meta cache (per-caller gate vs shared ETag).
+- **spec**: new pure helpers powering that gate — `audienceAllows`,
+  `resolveDocAudiences`, `docAudienceAllows`, `resolveBookClaimedDocs`
+  (+ `AudienceCaller`/`AudienceBook` types). BREAKING (launch window):
+  `METADATA_FORM_REGISTRY` keys `role`/`profile` are gone — `position` is the
+  registered form (the `position` type had LOST its form layout in the P1
+  rename); `EnvironmentArtifactMetadataSchema` declares `positions` instead of
+  retired `roles`/`profiles`.
+- **plugin-security**: the `security` service exposes
+  `resolvePermissionSetNames(ctx)` — the same resolution as data-plane
+  enforcement, for the docs gate.
+- **metadata**: artifact ingestion maps `positions → 'position'` (the stale
+  `roles → 'role'` mapping matched nothing since the P1 rename, silently
+  dropping compiled positions from metadata registration).
+- **lint**: books join the D3 role-word scan (their `audience` is a
+  permission-model reference now), and a new advisory rule
+  `security-book-audience-unknown-set` flags a `{ permissionSet }` audience
+  naming a set the stack does not declare (runtime fails closed — the typo
+  cost is "nobody can read the book", so say it at author time).
+- **platform-objects**: metadata-form translations regain `position` (all four
+  locales) and drop the retired `role`/`profile` groups, with a vocabulary
+  regression test.

.changeset/me-apps-and-anchor-baseline.md

@@ -0,0 +1,38 @@
+---
+"@objectstack/plugin-hono-server": patch
+"@objectstack/plugin-security": minor
+"@objectstack/spec": minor
+---
+
+Two ADR-0090 D5 closures (#2752, #2753):
+
+**`GET /me/apps` sources the engine registry.** Stack apps are registered
+into the engine registry (runtime AppPlugin), not the metadata service —
+`metadata.list('app')` returned `[]` for every principal, leaving
+`tabPermissions` and `AppSchema.requiredPermissions` with no enforced
+consumer. The endpoint now reads `registry.getAllApps()` (same authority as
+the meta routes, nav contributions merged) with the metadata service as an
+additive fallback; the capability and tab filters are unchanged and now
+actually run.
+
+**The default baseline binds to the `everyone` anchor.** `member_default`
+carried `allowDelete` on its `'*'` grant — an anchor-forbidden bit — so
+bootstrap refused the `everyone` binding on every boot and the baseline
+flowed only through the separate fallback channel D5 explicitly rejected.
+Two aligned changes:
+
+- `describeHighPrivilegeBits` (spec) is calibrated to the exact ADR-0090 D5
+  bit list (VAMA, delete/purge/transfer, systemPermissions). A plain `'*'`
+  wildcard is no longer high-privilege by itself; the wildcard ban moves to
+  the GUEST tier where D9 specifies it (`describeAnchorForbiddenBits`).
+- `member_default` drops `allowDelete` from the wildcard. **Behavior
+  change:** deleting records is no longer a baseline right — members keep
+  create/read/edit-own; domains that want member deletes grant them per
+  object via an ordinary position-distributed set. The owner-scoped delete
+  RLS stays as a narrowing defense for members who receive a delete bit
+  elsewhere.
+
+With the baseline anchor-safe, bootstrap's existing binding path succeeds:
+"what new users get" is now literally "what is bound to `everyone`" — same
+table, same audit, same explain path (proven by the new
+`me-apps-and-everyone-baseline` dogfood).

.changeset/objectql-defaults-before-beforeinsert-2703.md

@@ -0,0 +1,28 @@
+---
+'@objectstack/objectql': patch
+---
+
+fix(data): resolve field `defaultValue`s BEFORE the `beforeInsert` hook (#2703)
+
+Declarative field defaults (including the `current_user` token) were resolved
+by `applyFieldDefaults` *after* the user `beforeInsert` hook ran. A hook that
+DERIVED one field from another therefore read a stale `null` for any field that
+was about to be defaulted — e.g. `sales_person: Field.user({ defaultValue:
+'current_user' })` left `sales_person == null` inside the hook, so a derived
+`current_status` computed to `unassigned` unless the client passed the field
+explicitly.
+
+`applyFieldDefaults` now runs at record-initialization time, before
+`beforeInsert`, matching the industry-standard order of execution (Salesforce
+field defaults / ServiceNow dictionary defaults are populated before before-
+triggers; engine-owned generation — autonumber sequences, encryption, timestamps
+— stays after the hook). The hook still has final say: it runs after and may
+override any defaulted field. Defaults still only fill fields left `undefined`,
+so client-supplied values are untouched, and the caller's input object is no
+longer mutated in place.
+
+Behavior note: a `beforeInsert` hook can no longer distinguish "client omitted
+field X" from "field X received its default" for fields that declare a
+`defaultValue` — the hook now always sees the resolved default. This matches how
+Salesforce/ServiceNow behave (before logic sees a fully-initialized record) and
+is the intended fix.

.changeset/positions-sdui-panels.md

@@ -0,0 +1,13 @@
+---
+"@objectstack/spec": minor
+"@objectstack/platform-objects": minor
+"@objectstack/plugin-security": minor
+---
+
+Position assignment panels as pure SDUI (ADR-0090 follow-through).
+
+- `RecordRelatedListProps` gains `relationshipValueField` (default `'id'`): which parent-record field the junction's `relationshipField` stores — the generic affordance for name-keyed junctions (`sys_user_position.position` stores `sys_position.name`). Used for both the list filter and the Add-picker's parent-side value.
+- `sys_user` detail page gains a **Positions** tab (assign positions to a user; Add picker stores the position machine name via `valueField: 'name'`; the D12 delegated-admin gate's denials surface in the dialog).
+- New `sys_position` detail page (shipped by plugin-security): **Holders** (name-keyed via `relationshipValueField: 'name'`) and **Permission Sets** (bindings) tabs — zero bespoke UI; ADR-0091 validity columns slot in later as plain column additions.
+
+Renderer note: the generic `record:related_list` Add-picker and `relationshipValueField` support land in objectui alongside the ^14 alignment; with older renderers these tabs degrade to read-only lists.

.changeset/xlsx-export-select-colours.md

@@ -0,0 +1,30 @@
+---
+"@objectstack/rest": minor
+---
+
+feat(rest): colour select/radio cells in xlsx exports with their option colour
+
+The data export route (`GET /data/:object/export`) now carries a select /
+radio field's option `color` into the generated Excel workbook as the cell's
+**font colour** (white cell background), so an exported sheet reads like the
+in-app coloured badges instead of plain black text. csv / json output is
+unchanged.
+
+- `export-format.ts` gains `toArgb()` (hex `#RGB` / `#RRGGBB` → exceljs ARGB
+  `FFRRGGBB`, `undefined` for anything not plain hex) and `cellFontColor()`
+  (resolves the matched select/radio option's colour for one cell; returns
+  `undefined` — i.e. leave it unstyled — for non-option fields, unmatched
+  values, colourless options, or invalid hex). `ExportFieldMeta.options` now
+  carries the option `color`.
+- `createXlsxStream(res, useStyles)` takes the flag through to exceljs'
+  `WorkbookWriter`; the route enables styling and sets `cell.font.color`
+  per-cell only for xlsx.
+
+Styling is heavier than a bare value dump, so it is gated behind a **10 000-row
+cap** (`STYLE_ROW_CAP`): exports whose effective limit exceeds it stream
+without colours (all rows intact) and set `X-Export-Styles: dropped`; coloured
+exports set `X-Export-Styles: applied`. This mirrors the "formatted export has a
+lower ceiling than a raw dump" pattern used by Salesforce / ServiceNow. The
+existing 50 000-row hard cap is unchanged.
+
+Closes #2757.

.github/workflows/lint.yml

@@ -58,6 +58,13 @@ jobs:
       - name: Doc/skill authoring guard
         run: pnpm check:doc-authoring
 
+      # ADR-0090 D3 vocabulary ratchet: "role" is reserved-forbidden in docs
+      # and skills. Existing occurrences are frozen in the baseline (better-auth
+      # boundary, ARIA samples, educational mentions); NEW occurrences fail.
+      # Improvements ratchet the baseline down via --update.
+      - name: Reserved-word ("role") docs ratchet
+        run: pnpm check:role-word
+
       # Authorization resolution must stay single-sourced (resolveAuthzContext,
       # @objectstack/core). Guards against a duplicate resolver copy drifting on a
       # security path (the REST-vs-dispatcher sys_user_role drift) and against an

.github/workflows/release.yml

@@ -62,18 +62,6 @@ jobs:
         run: bash scripts/build-console.sh
 
       - name: Downstream backward-compat smoke (live hotcrm)
-        # TEMPORARY (ADR-0090 v2 launch window) — advisory, not blocking.
-        # ADR-0090 P1 (#2697) removed the sharing recipients `role` /
-        # `role_and_subordinates` from @objectstack/spec with NO compatibility
-        # aliases (docs/adr/0090 D3 — a deliberate, launch-window break). The
-        # latest published hotcrm tag (v1.2.2) still authors those values, so
-        # this gate necessarily goes red on a break the spec took on purpose,
-        # and no adopting hotcrm release exists yet to bump HOTCRM_REF to. Keep
-        # the step running for signal, but don't let it block the v2 publish.
-        # RESTORE (make blocking again): once hotcrm ships a release adopting
-        # the v2 recipient vocabulary, bump HOTCRM_REF below to that tag and
-        # delete this `continue-on-error` line so a red here blocks publish.
-        continue-on-error: true
         # Pre-publish gate (#2035): the about-to-publish @objectstack/spec must
         # not break a real third-party consumer pinned to a published release.
         # Clones objectstack-ai/hotcrm@${HOTCRM_REF}, installs it (published
@@ -82,11 +70,12 @@ jobs:
         # The deterministic in-repo floor is @objectstack/downstream-contract;
         # this is the live ceiling.
         env:
-          # v1.2.1: hotcrm dropped the ObjectSchema `detail` block removed by
-          # ADR-0085 (hotcrm#423) — the intended break, explicitly digested
-          # downstream. Bump this ref whenever a deliberate spec surface
-          # removal ships a matching hotcrm release.
-          HOTCRM_REF: v1.2.2
+          # v2.0.0: hotcrm adopted the ADR-0090 Permission Model v2 vocabulary
+          # (role→position recipients, profiles removed, explicit OWD —
+          # hotcrm#438), closing the launch-window advisory period from #2719.
+          # Bump this ref whenever a deliberate spec surface removal ships a
+          # matching hotcrm release.
+          HOTCRM_REF: v2.0.0
         run: bash scripts/downstream-smoke.sh
 
       - name: Create Release Pull Request or Publish to npm

.objectui-sha

@@ -1 +1 @@
-7a68d78f2a0c3c1f99dafd39b75b4f117a24917b
+397dcad73eaf6fdaa1740bff15f9d8faf45c4232

content/docs/ai/actions-as-tools.mdx

@@ -210,7 +210,7 @@ await aiService.chatWithTools(messages, tools, {
     actor: {
       id: currentUser.id,
       name: currentUser.displayName,
-      roles: currentUser.roles,
+      positions: currentUser.positions,
       permissions: currentUser.permissions,
     },
     conversationId,

content/docs/ai/agents.mdx

@@ -46,7 +46,9 @@ instead — see the callout in the [AI Overview](/docs/ai).)
 
 Every deployment serves MCP at `/api/v1/mcp` by default (a core platform
 capability — set `OS_MCP_SERVER_ENABLED=false` to opt out), with two
-authentication tracks:
+authentication tracks: The in-product entry point is the
+**Setup → Connect an Agent** page: per-client connect snippets, the portable
+SKILL.md download (`GET /api/v1/mcp/skill`), and API-key minting.
 
 - **OAuth 2.1 (interactive clients — recommended).** Each deployment is its
   own spec-compliant authorization server: the endpoint publishes