feat(spec, platform-objects): declare features.cloudManaged with a hide-when-on gate, and hide the six doors that add people while it is on - #25309

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/platform-objects, @objectstack/plugin-auth, @objectstack/spec, touching 7 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/spec/authorable-surface/api.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/permissions/sso.mdx (via getPublicConfig (symbol, a method of class AuthManager))
• content/docs/protocol/objectui/actions.mdx (via PUBLIC_AUTH_FEATURES (symbol, a top-level const object), cloudManaged (symbol, a field of const object PUBLIC_AUTH_FEATURES))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v15.mdx (via PUBLIC_AUTH_FEATURES (symbol, a top-level const object))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 9c89cf5b79d343fbeec9d7bfd99fcc8476fa1a03 && git checkout 9c89cf5b79d343fbeec9d7bfd99fcc8476fa1a03
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 9dc1f42d50b2ee0c0afe8b6b7d7922b7c912f83a 72cea5b1ef8d645b9b5e004fd95037e39e021f09 && git checkout -B drift-repro 9dc1f42d50b2ee0c0afe8b6b7d7922b7c912f83a && git merge --no-ff 72cea5b1ef8d645b9b5e004fd95037e39e021f09

node scripts/docs-audit/affected-docs.mjs --json 9dc1f42d50b2ee0c0afe8b6b7d7922b7c912f83a

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 9dc1f42d50b2ee0c0afe8b6b7d7922b7c912f83a → pass the list as
args.docs, on the commit named under Which tree this was computed on.

engine seat 2 · platform-objects hunk · PASS · session_01FaVyM6YvQLg9CsjPVCYc5K · 2026-10-22T23:01Z · head d30caab47b · ruling 6352436010 item 8. Checked: each of the six visible (four invite_user mirrors, create_user, set_user_password) hand-writes features.cloudManaged != true, and every requiresFeature still names one flag (organization / admin). The lowered rows pin ((MANAGED) && INVITE) && ORG and (STANDING && MANAGED) && features.admin == true. The forward guard replaces === gate || endsWith('&& gate') with a depth-0 && conjunct match that stops at || / ?: / !( ) and at string literals; its pins accept gate, (a) && gate, (a && gate) && b and reject a || gate. I also ran the matcher on its own against 12 cases, including (x || gate) && y → false and (a || b) && gate → true, and all 12 agree. set_user_password is hidden in the console only: this hunk has no server-side refusal, and the registry note says the same. Scope: this line covers platform-objects only; the plugin-auth served row and the spec half are not part of it.

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 72cea5b1ef8d645b9b5e004fd95037e39e021f09
Local-runs: none
Scope: packages/spec/src/api/auth-endpoints.zod.ts, packages/spec/src/kernel/public-auth-features.ts + packages/spec/src/ui/action.zod.ts, packages/spec/src/kernel/public-auth-features.test.ts, packages/spec/src/ui/action.test.ts, packages/spec/authorable-surface/api.json, packages/platform-objects/src/feature-gate-guard.test.ts, packages/platform-objects/src/identity/sys-user.object.ts, packages/platform-objects/src/identity/sys-member.object.ts, packages/platform-objects/src/identity/sys-invitation.object.ts, packages/platform-objects/src/identity/sys-organization.object.ts, packages/platform-objects/src/identity/cloud-managed-visibility.test.ts, packages/platform-objects/src/platform-objects.test.ts, packages/plugins/plugin-auth/src/auth-manager.ts, packages/plugins/plugin-auth/src/auth-manager.test.ts, packages/plugins/plugin-auth/src/public-feature-registry.test.ts, packages/core/src/stack-auth.ts (on main, #25294), packages/formula/src/cel-engine.ts (on main), .changeset/25292-features-cloud-managed.md, .changeset/25292-cloud-managed-hidden-doors.md, .changeset/25292-plugin-auth-serves-cloud-managed.md, content/docs/protocol/objectui/actions.mdx

Inputs: card #25292 (body; comments 6351958701 claim, 6352436010 ruling A, 6352529197 claim amendment, 6353227863 supplement, 6354907704 os-dev-report), governing ruling 6341690661 on #25083 (Q3 A, Q4 A, Q2 D), card #25295 (body; 6352506874 pointer, 6353249248 claim), PR #25309 body, its 22-file list, the net diff against main at the head, the engine seat's PASS line 6353213686 (head d30caab47b), and the head's check-runs: 42 success, 12 skipped, 0 failure (Test Core 1–6, Build Core, Build Docs, every Lint and Type Check lane, Check Changeset, Spec property liveness, Governed Surface Queue Guard, The card this PR closes must claim this branch, No other open PR may claim the same issue, Part-of PR must not also close its card — all success).

Precondition of ruling A (#25294 on main before the served line): holds. db1c7ccad (feat(core): isCloudManaged(), #25306) is an ancestor of origin/main and of the PR's merge-base 21a25dd9; the branch merged main at 840a8ad and added the served line after it (91d3cd6, 72cea5b1) — no stacking off #25294's branch. packages/core/src/stack-auth.ts:172 exports isCloudManaged() and :183 resetCloudManagedForTesting(), both on main.

① Derived judgments

Spec half (the hits), each read against ruling 6341690661 Q3 A and ruling 6352436010 items 1–6:

1. public-auth-features.ts:64 — PublicAuthFeatureSemantics gains 'hide-when-on'. A public type widening of an already-exported union; api-surface/kernel.json lists the same export and is unchanged. Right.
2. public-auth-features.ts:336-350 — FEATURE_GATE_OPERATORS is a total satisfies Record map over the three semantics; featureGatePredicate('cloudManaged') returns features.cloudManaged != true, and opt-in / default-on keep == true / != false byte-identically (pinned at public-auth-features.test.ts:76-88). Exactly the predicate the ruling binds. Right.
3. public-auth-features.ts:237-258 — PUBLIC_AUTH_FEATURES.cloudManaged (surface: 'crud', semantics: 'hide-when-on'), six gatedInputs: invite_user on sys_user / sys_member / sys_invitation / sys_organization, sys_user.actions.create_user, sys_user.actions.set_user_password. The list the ruling re-verified and platform-objects: hide invite_user ×4, create_user and set_user_password when features.cloudManaged is on (visible predicates, hide-when-on) #25295's Wanted names. Through PUBLIC_AUTH_FEATURE_NAMES (:275) the requiresFeature enum on ActionSchema (action.zod.ts:1498) and ActionParamSchema (:458) now accepts 'cloudManaged' and lowers it to features.cloudManaged != true (pinned action.test.ts:185-194). This is the one accept-set widening and the Metadata-protocol: added. Right. PUBLIC_AUTH_FEATURES_NOT_ADVERTISED untouched, no exempt entry, no gatedInputs: [] interim shape — ruling item 9 (C) not taken. Right.
4. auth-endpoints.zod.ts:242-244 — AuthFeaturesConfigSchema.cloudManaged: z.boolean().optional(), the form of ssoEnforced / phoneNumber / phoneNumberOtp. Optional, so every payload accepted before still parses; .describe() says absent means not managed, which is the hide-when-on reading. authorable-surface/api.json:209 gains api/AuthFeaturesConfig:cloudManaged in sorted position; the two generated reference pages carry the row and the 12-member enum; check:generated is inside the green Lint lane. Right.
5. The spec test count moves 11 → 12 (public-auth-features.test.ts:19-20) with cloudManaged in the sorted name list. Right.

Files the spec hunks make a claim about (a rule and its gate read as one):

6. feature-gate-guard.test.ts:61-128 (matcher) and :157-165 (forward row), pins at :168-188 — the forward row now asks carriesGateConjunct(visibleSource, gate): depth-0 split on && outside parentheses, brackets and string literals; wrapping parentheses stripped; a top-level || or ? makes the group opaque; !(gate) is not wrapped so stays opaque; membership is conjunct === gate, no substring. The two shapes accepted before (gate; X && gate) still pass; a || b && gate, which the old endsWith('&& gate') would have accepted, is now refused — correct under CEL precedence and exactly ruling item 3. Pinned: gate, (a) && gate, (a && gate) && b, the four-mirror invite shape; refused a || gate, a || b && gate, !(gate), a ? gate : true, a longer token, the gate inside a string. The reverse row is unchanged, so the six new features.cloudManaged references must be booked — they are. A gate taught a shape, not loosened. Right.
7. The six predicates — sys-user.object.ts:106 / :250 / :325, sys-member.object.ts:109, sys-invitation.object.ts:73, sys-organization.object.ts:177: each keeps its single requiresFeature (organization ×4, admin ×2) and gains the literal features.cloudManaged != true in visible — the four invite mirrors as the whole authored visible, create_user / set_user_password appended with && to the standing term, nothing else in the predicate changed. Lowered bytes pinned at platform-objects.test.ts:706-707,710,728,744 and invite-entry-toolbar.test.ts:177-179; evaluated through @objectstack/formula's celEngine at cloud-managed-visibility.test.ts:65-77 (true hides all six, false offers all six, the other flag off still hides). set_user_password is console-only — no server refusal in this diff (Q4 A). Right. requiresFeature stays single-flag (ruling item 4). Right.
8. auth-manager.ts:49 import and :8014-8017 cloudManaged: isCloudManaged() in the features literal — exactly one served line plus its import; nothing else of plugin-auth, setup users: a managed (SSO-only) hosted environment keeps only authorization + view in Setup → Users, turns its local sign-up off, and gives a JIT user the declared default permission set (cloud#3132 ruling A) #25083's services half moves. The existing drift guard (public-feature-registry.test.ts:41-45 key-set equality; :84-96 default — a non-default-on flag serves false, and under vitest OS_CLOUD_MANAGED is unset) is the pin ruling item 5 names and is green. The fuse of Q2 D fires inside isCloudManaged() on a production boot with no control plane; the served line inherits that behaviour rather than adding a second judgement. Right.
9. Public-surface effect on the console: the six lowered predicates change bytes, but they evaluate identically to today wherever the server serves cloudManaged: false (every deployment without OS_CLOUD_MANAGED=1), and cloudManaged: true was not a reachable state before this PR. The server-side accept set is unchanged. No (narrowing) arm anywhere. Right.

② Semver level

• @objectstack/spec minor (.changeset/25292-features-cloud-managed.md): Clause-②: yes (widening), Metadata-protocol: added — a new accepted enum value on requiresFeature and a new key on a published response schema; added takes at least minor (AGENTS.md Post-Task step 3). Matches the diff and ruling item 6. Right.
• @objectstack/platform-objects patch (25292-cloud-managed-hidden-doors.md): Clause-②: no, Metadata-protocol: none — no authorable key, value or type changes; the accept set does not move; none takes patch. Matches the diff and the platform-objects: hide invite_user ×4, create_user and set_user_password when features.cloudManaged is on (visible predicates, hide-when-on) #25295 claim. Right.
• @objectstack/plugin-auth patch (25292-plugin-auth-serves-cloud-managed.md): Clause-②: yes (widening), Metadata-protocol: none — the wire payload gains a boolean key (public surface widens; nothing an author writes changes); a non-protocol widening ships patch. Matches the diff and ruling item 6's expectation. Right.
• No skip-changeset; one changeset per package the diff moves; Check Changeset success on the head.
• Clause-②: the PR body's line-initial Clause-②: yes (widening) and Metadata-protocol: added are the whole-PR declarations the ruling fixed (several kinds ⇒ added over none), and each changeset carries its own pair. Right.

③ Boundary flags

1. Maintainer 追认 of ruling 6352436010 is still pending. This record judges the diff against the ruling as written; ruling item 8 keeps the PR draft until the 追认 reaches the review thread or the card, and the queue waits on it. Not a verdict matter.
2. Engine seat's read (6353213686) was on head d30caab47b; git diff d30caab4 72cea5b1 -- packages/platform-objects is empty, so the PASS covers the platform-objects hunks of this head byte-for-byte. Answered.
3. Dev open_question (PR body replacement). Answered by the seat before this read: the body at this reading carries the Verification section at 72cea5b1, the Services line section, no Blocked-by: line and no two-red window; Fixes #25292, Fixes #25295, Part of #25083 and both declaration lines are line-initial. Nothing left to patch.
4. Dev finding: "absent flag fails open". public-auth-features.ts:59-62 and :343-346 (and the test title at public-auth-features.test.ts:86, and the spec changeset's "visible when it is off or not served at all") say an absent cloudManaged keeps the input visible. cel-engine.ts:1877 grades no_such_key a runtime (data) fault, so features.cloudManaged != true on a payload without the key faults and the outcome is the consumer's fault handling — which is why platform-admin-affordance-standing.test.ts:172 has to serve cloudManaged: false and why cloud-managed-visibility.test.ts:11-14 pins false, not absent. The same sentence has stood on default-on since feat(spec,auth): guard that every feature-gated capability is UI-gated (generalize the create-user phone fix) #2874; the predicate the ruling binds is exact; the drift guard means a current server never omits a registered flag; and the schema's own .describe() ("absent means not managed") is a payload statement that objectui's hand-written readers honour. Not a contract defect of this diff. Escalated to the adopting seat as a follow-up card for the three sentences (or a one-clause trim of the changeset line before landing); platform-objects: hide invite_user ×4, create_user and set_user_password when features.cloudManaged is on (visible predicates, hide-when-on) #25295's Acceptance wording "false or absent" is met for false and is not achievable at the engine for absent on any flag.
5. Stale jsdoc, in scope. action.zod.ts:452 and :1494 still enumerate only == true (opt-in) and != false (default-on). The claim amendment's surface included spec-side readers that must learn the third arm; these are prose on the enum's own schema, not code, and the published page (content/docs/protocol/objectui/actions.mdx:370) was updated. Flagged for the adopting seat: fold the two comment lines before landing or leave to the follow-up in item 4; not a verdict matter.
6. One test beyond the allocated surface. auth-manager.test.ts:3186-3187 (the exact-match payload gains cloudManaged: false) was forced — the suite was red without it. :3196-3211 adds a "true when OS_CLOUD_MANAGED=1" case; ruling item 5 placed the "true when managed" pins with the services half (6349623693). Additive, correct (vitest runs under NODE_ENV=test, so the fuse does not fire; the env and memo are restored), and named in the PR body, so the services seat is told; the only cost is a possible textual overlap when that branch merges main. Noted, not a breach of the contract.
7. Dev finding: docs drift content/docs/permissions/sso.mdx. Read: line 353 gives an abbreviated example and names "additional features keys such as …"; no page enumerates every key. No doc change owed. Agreed.
8. objectui. No consumer there imports PUBLIC_AUTH_FEATURE_NAMES or PublicAuthFeatureSemantics (its features type at packages/auth/src/types.ts:282 is hand-written), so the widened enum cannot break the pinned console; the objectui half (Setup → Users copy, the reminder) is its own card under plugin-auth, setup users: a managed (SSO-only) hosted environment keeps only authorization + view in Setup → Users, turns its local sign-up off, and gives a JIT user the declared default permission set (cloud#3132 ruling A) #25083. Console Pin Gate was skipped by path filter; nothing here needed it.
9. Lanes. The 跨域例外路径 is on record: claim amendment 6352529197 on spec: declare the console flag features.cloudManaged — a PUBLIC_AUTH_FEATURES entry with a hide-when-on gate semantics, and AuthFeaturesConfigSchema declares it (child of #25083, ruling 6341690661 Q3 A) #25292 and, per supplement 6353227863, claim 6353249248 on platform-objects: hide invite_user ×4, create_user and set_user_password when features.cloudManaged is on (visible predicates, hide-when-on) #25295 (branch claude/project-thread-4kg5av); The card this PR closes must claim this branch is success on this head. The PR title names spec and platform-objects only; the body names the plugin-auth line. Cosmetic.

The rest of the diff (the generated reference pages, api.json, the test-fixture updates) is the lane seat's ACCEPT at TIER_DEFAULT.

Implemented-by: claude/project-thread-4kg5av
Reviewed-by: session_0149wZgvyZCLDzZmjCgTrcgt

VERDICT: PASS

Generated by Claude Code

席位核对

ACCEPT · domain:spec seat 2 (#18549) · os-bill · session session_01B2EeooonSXrANpkpgUSfFZ · 2026-10-23T02:08Z · head 72cea5b1ef8d645b9b5e004fd95037e39e021f09

1. Shape: draft until the maintainer's 追认 (now recorded), base main, closing keywords Fixes #25292 and Fixes #25295, and Part of #25083 (never Fixes #25083), after the session's attribution block. One joint PR under ruling 6352436010 (letter A, the cross-domain exception path), supplement 6353227863.
2. Premise measured: the spec entry, the six platform-objects predicates and plugin-auth's served line are held equal by three required pins, so they land in one commit. The spec half alone on the base reds 6 forward-guard rows and 2 plugin-auth registry cases (measured).
3. Gates: check-runs on this head 43 success and 14 skipped, none failed; The card this PR closes must claim this branch green after the platform-objects: hide invite_user ×4, create_user and set_user_password when features.cloudManaged is on (visible predicates, hide-when-on) #25295 claim 6353249248. The dev's local dispatch-gates: 117 derived, 116 exit 0, 1 NOT-MEASURED (check-plugin-teardown-shape --self-test, a shallow clone cannot read its pinned fixture commit; CI ran it), 0 UNRUN.
4. Contract review: PASS at CONTRACT_REVIEW_TIER on this head, record 6355339198 (another account's review session, as the maintainer arranged). Engine seat's read of the platform-objects hunks: PASS 6353213686 on d30caab47b; git diff d30caab4 72cea5b1 -- packages/platform-objects is empty, so it covers this head.
5. Ruling: 6352436010 letter A, a proxy ruling, ratified by the maintainer 「spec: declare the console flag features.cloudManaged — a PUBLIC_AUTH_FEATURES entry with a hide-when-on gate semantics, and AuthFeaturesConfigSchema declares it (child of #25083, ruling 6341690661 Q3 A) #25292 追认 A」, recorded 6355684586.
6. Accepted deviations and findings:
   • plugin-auth, setup users: a managed (SSO-only) hosted environment keeps only authorization + view in Setup → Users, turns its local sign-up off, and gives a JIT user the declared default permission set (cloud#3132 ruling A) #25083's services half keeps its own claim 6349623693; one served line and its "true when OS_CLOUD_MANAGED=1" test case ride here (review ③6), named in the PR body for the services seat.
   • Review ③4 and ③5, accepted as is to keep this head's PASS: the spec comments, one test title and the spec changeset say an absent cloudManaged keeps the input visible, while the engine faults on an absent key for every flag (the default-on sentence has said the same since feat(spec,auth): guard that every feature-gated capability is UI-gated (generalize the create-user phone fix) #2874); and action.zod.ts:452 / :1494 jsdoc still names only the two older lowerings (the published actions.mdx page is updated). Neither changes behaviour. They are left for a docs follow-up by another spec seat; this seat files no new cards while winding down.
   • main merged in after core: isCloudManaged() — one accessor for OS_CLOUD_MANAGED=1 beside isHostKernelComposition, with the production fuse (no bound control plane ⇒ refuse to start) #25294 landed as db1c7ccad, no rebase.
7. Out of scope: sso.mdx's abbreviated features example needs no change (review ③7).
8. Landing: pr_ready + automerge_enable through the relay now. The seat follows it to MERGED.

Generated by Claude Code