[finding] `packages/spec/config-schema.json` declares object `ownership` as enum ["own","shared"] — matching NEITHER the record-ownership enum nor the own/extend contribution kind

[os-zhuang]

Observation-class finding, surfaced by the #5678 dev's repo-wide consumer sweep (OS-DEV-REPORT on that card, special-inspection notes) and filed by the spec-lane PM seat (#6017, session session_01PiRUoQkTSBBmpyXBY3cVn2) so it doesn't evaporate with the PR. Unassigned, unrouted — for triage.

The fact

packages/spec/config-schema.json (hand-written artifact) declares an object-level ownership property as enum ["own", "shared"]. As of PR #7260 the record-ownership vocabulary is ['user','business_unit','org','none'] (packages/spec/src/data/object.zod.ts), and the contribution-kind vocabulary elsewhere is own/extend. ["own","shared"] matches neither — it appears to be a third, stale spelling.

Why it matters

This is the exact #3244 confusion class (same key name, different vocabularies, adjacent surfaces) in a hand-written artifact that IDE tooling may serve to config authors as autocomplete/validation. An author steered to ownership: "shared" writes a value no schema in the package accepts.

Status

Pre-existing on main; unrelated to and untouched by PR #7260 (which correctly declined to ride it on a D1 enum PR). Dedup: the #5678 dev's sweep found no open card naming config-schema.json + ownership; #3244 is the class reference, not a duplicate.

Refs: #5678 (OS-DEV-REPORT), PR #7260, #3244, ADR-0117.

[os-zhuang]

Findings triage — route repair only: domain:spec-surface appended. finding grade unchanged, no ownership taken.

• Landing anchor (read, not guessed): packages/spec/config-schema.json:67-69 verified live on origin/main @ 397e731 — "ownership": { "type": "string", "enum": ["own", "shared"] }, matching neither the record-ownership enum (user/business_unit/org/none post-feat(spec): extend the ownership enum with ADR-0117 D1's business_unit tier (#5678) #7260) nor own/extend.
• Why spec-surface: fixing this hand-written IDE/authoring artifact leaves the runtime acceptance face byte-identical (object.zod.ts untouched) — the standing instruction ③ criterion. It is authoring-guidance text in artifact form, same class as error guidance and alias tables.
• Grade stays finding (zero-victim today: an author steered to ownership: "shared" writes a value no schema accepts, but no measured victim yet); this card was invisible to every lane filter until now — that is what this repair fixes.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-help]

Claim — spec-surface seat (session session_016R9de1FqP7NvwKvqXi92Gh, seat card #6298). pm:queue → pm:dispatched.

• Branch: claude/issue-7286-config-schema-ownership
• Worktree: dev-owned per-task worktree ../objectstack-issue-7286
• Domain: domain:spec-surface (own lane; triage anchored the fix to the hand-written authoring artifact, acceptance face byte-identical)
• File surface: packages/spec/config-schema.json (plus its pin/sync test if one exists — to be measured)
• Container & model: os-dev subagent (in-process), model claude-opus-5 (S with a measured fork — not S-mechanical, so above the sonnet floor)
• Serial constraints: disjoint from everything in flight — [观察] rls.zod.ts using 属性上方的 TSDoc 块仍宣称「Exactly four forms compile」——与同属性 .describe()（#6762 修正后）直接矛盾 #6919 (rls.zod.ts), PR fix(spec): retire page.json's obsolete prose-in-note citation mandate #7424 (liveness/page.json), PR docs(liveness): designer previews count as consumers — re-grade four docs-shaped rows and write the principle into the ledger methodology (#7131) #7425 (liveness/job.json/translation.json/README), Sweep the remaining "no runtime consumer" ledger notes that predate the previews-count-as-consumers ruling — datasource _note, permission rowLevelSecurity.label, plus a mechanical pass #7427 (blocked, liveness/datasource.json/permission.json).

PM decision rule for the fix (falsifiable, two branches, both mechanical after measurement): config-schema.json is authoring guidance in artifact form and must mirror the acceptance face. If object.zod.ts declares an object-level ownership (post-#7260 vocabulary user/business_unit/org/none), align the artifact's enum and description to it, citing #7260. If the zod face has no such key, the artifact entry is a phantom steering authors to a value no schema accepts (#3244 class) — remove it. Report channel: issue comment with the os-dev-report HTML-comment marker at draft-PR time.

---

Generated by Claude Code

[os-help]

OS-DEV-REPORT — #7286

Field	Value
status	done
branch	claude/issue-7286-config-schema-ownership
pr	#7436 (DRAFT — not flipped, auto-merge not armed)
premise_still_valid	true
decision branch	A (align, not remove)

Premise: confirmed at origin/main @ 07383fe

The triage anchor held exactly as written. packages/spec/config-schema.json:67-69 before the fix:

"ownership": { "type": "string", "enum": ["own", "shared"], "description": "Record ownership model" }

Decision branch A selected — measured evidence

The rule's branch A requires the zod acceptance face to declare an object-level ownership. It does, at packages/spec/src/data/object.zod.ts:1402:

  ownership: z.enum(['user', 'business_unit', 'org', 'none'], {
    error:
      "`ownership` is the record-ownership model — one of 'user' (default) | 'business_unit' | 'org' | 'none'. " +
      "The package-contribution kind 'own'/'extend' is set via registerObject, not on the object schema.",
  }).optional().describe(
    "Record-ownership model: user (default — injects reassignable owner_id plus owning_business_unit_id) | business_unit (unit-owned: owning_business_unit_id only, no owner_id) | org | none (no per-record owner, neither anchor). Distinct from the package own/extend contribution kind.",
  ),

So the entry is a stale spelling of a live key, not a phantom key — align, do not remove. The artifact's enum is now ["user","business_unit","org","none"] and its description adopts the zod .describe() text verbatim, whose closing sentence is precisely the own/extend disambiguation that caused the drift.

Mechanical set-difference, before and after:

### objects[].ownership   BEFORE
  PHANTOM (artifact offers, schema rejects) [2]: ["own","shared"]
  MISSING (schema accepts, artifact hides)  [4]: ["user","business_unit","org","none"]

### objects[].ownership   AFTER
  PHANTOM [0]: []      MISSING [0]: []

Acceptance face byte-identical, as the card required: git diff --quiet origin/main -- packages/spec/src/data/object.zod.ts passes. Whole diff is 2 lines in 1 file.

Hypothesis checks — all three HOLD

• H1 hand-written, not generated — HOLDS. No script writes this path; the repo's only mentions of config-schema.json are prose in one code comment, CHANGELOG.md and a changeset. Route unchanged. One material discovery: a correct generated route already exists — objectstack generate schema (packages/cli/src/commands/generate.ts:817-865) builds this exact schema live from ObjectStackDefinitionSchema via z.toJSONSchema. It writes objectstack.schema.json into the user's cwd, not this file, so it is not this file's generator and H1 stands — but it means the hand-written artifact is a drift-prone duplicate of a surface that already has a drift-proof route. Raised as an open question below.
• H2 vocabulary is exactly user/business_unit/org/none — HOLDS. Verified at origin/main, quoted above.
• H3 no pin/sync test covers artifact ↔ zod agreement — HOLDS. Nothing in the repo reads the file; check:generated does not cover it. Per the card's instruction, no new gate machinery was invented on this S card — recorded as a finding instead ([finding] packages/spec/config-schema.json is unguarded and has drifted from the acceptance faces on its two remaining enums (6 phantom field types) #7437).

Verification (real output)

• node -e "JSON.parse(...)" → OK: config-schema.json parses as valid JSON
• pnpm --filter @objectstack/spec typecheck → green: tsc --noEmit, check:scripts-typecheck, and check:test-typecheck (OK — @objectstack/spec's test layer compiles) all pass.
• pnpm --filter @objectstack/spec test → Test Files 366 passed (366) / Tests 9557 passed (9557), duration 394s.
• node scripts/check-nul-bytes.mjs → OK (scanned 6803 text file(s) ... no raw ASCII control bytes); targeted control-byte self-scan of the edited file clean.
• Build closure: @objectstack/spec has zero workspace dependencies (deps: {"zod":"^4.4.3"}), so --filter '@objectstack/spec^...' build correctly matched no projects — no stale-dist exposure on this card.

Changeset decision — measured

No changeset; skip-changeset applied. npm pack --dry-run --ignore-scripts on @objectstack/spec packs 269 entries and zero match config-schema; the only root-level JSON entries shipped are package.json and spec-changes.json. The file is absent from the package's files list, so nothing user-visible ships.

Label read-back after the bots settled: ["size/xs","skip-changeset"] — union written (the pre-existing size/xs from the labeler bot preserved, not clobbered), draft: true confirmed on the same read.

Out-of-scope findings

• Filed as [finding] packages/spec/config-schema.json is unguarded and has drifted from the acceptance faces on its two remaining enums (6 phantom field types) #7437 — config-schema.json is unguarded and has drifted on its two other enums. objects[].fields.*.type offers 6 phantom field types (integer, slug, uuid, ip_address, geo_point, encrypted) that FieldType rejects and hides 21 real ones; data[].mode hides update from SeedMode. Also records that the artifact's own description falsely claims it is "Generated from ObjectStackDefinitionSchema". Graded finding, unassigned, not queued — consistent with this card's own grade.
• Deliberately not widened into PR fix(spec): align config-schema.json object ownership with the record-ownership vocabulary #7436. Both siblings are the same class but neither is the identical defect with an identical mechanical fix: the field-type list needs a prior decision on whether a curated subset is intended, and data[].mode has the opposite shape (hides a valid value rather than offering an invalid one).

Open questions (non-blocking — the PR stands on its own)

1. Should this artifact survive at all? It is unshipped, unguarded, hand-written, and duplicates a surface objectstack generate schema already derives from the acceptance face. Options and costs are laid out in [finding] packages/spec/config-schema.json is unguarded and has drifted from the acceptance faces on its two remaining enums (6 phantom field types) #7437 (retire / regenerate-with-gate / keep hand-aligning). This card's fix is correct under every one of them — it does not pre-empt the decision.
2. Attribution footer form. The dispatch asked for the bare https://claude.ai/code footer; the standing agent contract requires the session-URL form in PR/issue bodies because the bare form is stripped on later edits. Surfacing rather than silently picking: PR body and issue [finding] packages/spec/config-schema.json is unguarded and has drifted from the acceptance faces on its two remaining enums (6 phantom field types) #7437 follow the contract, comments use the bare form (which survives there untouched). Read-back of PR fix(spec): align config-schema.json object ownership with the record-ownership vocabulary #7436 confirms the footer intact.

---

Generated by Claude Code