Merge remote-tracking branch 'origin/main' into claude/authz-a5-capability-declaration

# Conflicts:
#	packages/spec/api-surface.json

Author: claude

.changeset/a3-user-assignment-tabs.md

@@ -0,0 +1,12 @@
+---
+'@objectstack/platform-objects': minor
+---
+
+feat(platform-objects): sys_user 记录页新增 Permission Sets 与 Business Units 两个一站式分配 tab (A3, #2920)
+
+管理员现在可在单个用户记录页完成三类分配:岗位(Positions,已有)、直接权限集授权(Permission Sets)、业务单元归属(Business Units)。两个新 tab 均为纯 SDUI 的 `record:related_list` + Add picker:
+
+- **Permission Sets** — junction `sys_user_permission_set`(id-keyed,`relationshipField: 'user_id'`),Add picker 绑定 `sys_permission_set`(`linkField: 'permission_set_id'`)。服务端 audience-anchor(D5/D9)与 delegated-admin(D12)门禁的拒绝原因会显示在 Add 对话框。
+- **Business Units** — junction `sys_business_unit_member`(id-keyed,`relationshipField: 'user_id'`),Add picker 绑定 `sys_business_unit`(`linkField: 'business_unit_id'`,按显示字段 `name` 标注)。
+
+tab 顺序为 Positions → Permission Sets → Business Units,四语言标签齐全。

.changeset/adr-0089-d3b-bidirectional-visibility-root.md

@@ -0,0 +1,5 @@
+---
+"@objectstack/lint": minor
+---
+
+ADR-0089 D3b: make the `visibility-root-mislayered` lint check bidirectional. `validateVisibilityPredicates` now accepts an optional `{ layer }` option — `'runtime'` (default, unchanged) flags a `data.`-rooted predicate on a `*.view.ts` / `*.page.ts` surface, and `'metadata'` flags a `record.`-rooted predicate on a `*.form.ts` metadata-editing form. Both directions of the ADR's binding-root rule are now covered. Adds the `VisibilityLayer` / `VisibilityOptions` exported types. Fully back-compat: existing single-argument callers keep the runtime behavior.

.changeset/adr-0095-d1-tenant-layer-0.md

@@ -0,0 +1,39 @@
+---
+"@objectstack/plugin-security": minor
+---
+
+ADR-0095 D1: tenant isolation is now **Layer 0** — an independent, always-first,
+AND-composed filter (`tenant-layer.ts`), no longer a wildcard `tenant_isolation`
+RLS policy OR-merged with business RLS. The effective row filter is
+`Layer0(tenant) AND Layer1(business RLS)`; the two share no compiler, merge step,
+or bypass bit. The superuser bypass now exempts the tenant wall only as a Layer 0
+rule (platform-admin posture + object posture permits: private / platform-global
+/ better-auth-managed), never via a business-RLS short-circuit.
+
+**BREAKING (multi-org `tenancy.mode = 'multi'` deployments only; `single` mode is
+inert and unchanged).** Retiring the OR-merged tenant policy resolves four
+behavior deltas, all toward stronger/correcter isolation:
+
+- **(a) Cross-tenant read leak closed.** A permissive business RLS policy (e.g.
+  `status == 'public'`) no longer OR-widens tenant scope; a foreign-org row it
+  matched is now invisible.
+- **(b) Member by-id writes narrow to owner-only.** The OR-merge silently widened
+  `owner_only_writes` (`created_by == me`) back to org-wide, so a member could
+  by-id update/delete *any* record in their org. Writes are now owner-scoped as
+  authored. **Migration:** if your deployment intentionally relied on members
+  editing each other's records org-wide, grant an explicit per-object edit
+  permission set (position-distributed) where that is wanted — the baseline
+  `member_default` no longer permits it.
+- **(c) Global-catalog objects visible to members.** On a `tenancy.enabled:false`
+  object, members were scoped by a phantom `organization_id` filter (a column
+  such objects lack); Layer 0 correctly treats them as non-tenant, so the global
+  catalog is visible.
+- **(e) No-active-org writes fail closed.** A write by a principal with no active
+  organization on a tenant object is now denied (was owner-scoped only).
+
+`tenant_isolation` is retired from the seeded `organization_admin` /
+`member_default` / `viewer_readonly` sets; the `_self` / `_org` identity-table
+carve-outs and `owner_only_writes/deletes` are unchanged. Customized seeded sets
+keep their overlays (ADR-0094). The driver-level `applyTenantScope` seam is
+untouched. See ADR-0095 and framework#2936 (the `extractTargetField` `==` blind
+spot this exposes, tracked separately).

.changeset/authz-c2-explain-record-contract.md

@@ -0,0 +1,40 @@
+---
+"@objectstack/spec": minor
+---
+
+feat(spec): C2-α — extend the `explain` contract to record granularity (#2920)
+
+The access-explanation contract (ADR-0090 D6) now carries the schema for
+record-level authorization explanations, so the β-phase engine
+(`plugin-security` + `plugin-sharing`) and the Studio/Setup "view as" UI can be
+built against a stable wire shape. Contract-only: no engine or UI changes ship
+here.
+
+Request side:
+- `ExplainRequest.recordId` (optional) — explain one concrete record at row
+  granularity. Omitted = the pre-C2 object-level question, answered identically
+  (backward compatible).
+
+Response side (row-level attribution, present only for record-grained requests):
+- New `ExplainMatchedRule` — a concrete share / sharing rule / ownership fact /
+  team / territory / RLS policy / Layer 0 tenant filter that admitted or
+  excluded the record at a layer, with its access level (`grants`), how it
+  reached the principal (`via`), the row predicate (`predicate`), and its
+  `effect` on the record.
+- New `ExplainRecordAttribution` — a layer's per-record determination
+  (`outcome`, effective `rowFilter`, `matchesRecord`, matched `rules`), attached
+  as the optional `ExplainLayer.record`.
+- New top-level `ExplainDecision.record` — the row-level bottom line
+  (`recordId`, `visible`, `decidedBy`).
+
+Reserved for the ADR-0095 kernel chain (β fills these; optional, backward
+compatible):
+- New `tenant_isolation` layer id (Layer 0, the always-first tenant wall).
+- New `ExplainLayer.kernelTier` (`layer_0_tenant` | `layer_1_business`) so a
+  consumer can tell the tenant wall from business RLS without hard-coding ids.
+- New `AuthzPosture` enum (`PLATFORM_ADMIN` > `TENANT_ADMIN` > `MEMBER` >
+  `EXTERNAL`) exposed as the optional `ExplainDecision.principal.posture`.
+
+Backward compatibility: every new field is optional or additive; existing
+object-level requests and reports parse unchanged. The contract test locks the
+new field shapes alongside the existing ones.

.changeset/system-row-write-guardrail.md

@@ -0,0 +1,17 @@
+---
+'@objectstack/plugin-security': patch
+---
+
+内置行写护栏：`sys_position` / `sys_capability` 的平台/应用托管行不再可被客户管理员删改。
+
+`sys_permission_set` 早有两道门写护栏（`assertPackageManagedWriteGate`）拦截对 package 托管行的写入，但 `sys_position` / `sys_capability` 缺失对应保护——平台/应用发布的系统岗位与能力（provenance 记录在 `managed_by`）可被管理员直接 delete / update 直达驱动，静默破坏应用的授权基线（ADR-0049：provenance 字段存在却无强制 = 正是要补的 enforcement gap）。
+
+新增 **`assertSystemRowWriteGate`**（`packages/plugins/plugin-security/src/security-plugin.ts`，data-write hook 接线与 package 门同处），对这两个对象的托管行施加一道无条件的数据层边界：
+
+- **禁止伪造托管来源**：管理员门的 insert / update 载荷（单对象或数组）不得把 `managed_by` 盖成平台/应用值——只有携带 `isSystem` 的平台 seeder / 包发布路径可写；同时封堵 update-to-forge（把自建行改badge成托管行）。
+- **拒绝改删托管行**：对 `managed_by` 已是平台/应用值的行，`delete` / `update` / `transfer` / `restore` / `purge` 一律拒绝。与 `sys_permission_set` 不同，这两个对象没有 ADR-0094 overlay write-through，故写护栏必须在此层直接拒绝，而非下放给下游翻译。
+- **管理员自建行不受限**：`managed_by` 为 `user`/∅（sys_position）或 `admin`（sys_capability）的行完全归管理员所有（含委派管理员在自己 subtree 内的自建行）。
+
+护栏 fail-closed 且不依赖调用方授权——持 `modifyAllRecords` 的超管也无法删除平台岗位。两对象的 `managed_by` 词表不同（sys_position：`system`/`config` 托管，`user`/∅ 自建；sys_capability：`platform`/`package` 托管，`admin` 自建），网关按对象分别判定。错误信息仅含业务文案（"此岗位/能力由 平台|应用包 提供，不可删除/修改"）。
+
+与 delegated-admin 边界不冲突：`GOVERNED_OBJECTS` 本就不含这两个对象，委派管理仍治理 RBAC 链接表而非定义对象。

.github/workflows/ci.yml

@@ -8,6 +8,13 @@ on:
     branches:
       - main
 
+# Superseded runs on the same PR/branch waste runners and delay feedback;
+# cancel them. Push runs to main group by commit ref as well, so an in-flight
+# main run is cancelled only by a newer main push.
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   filter:
     runs-on: ubuntu-latest
@@ -56,6 +63,9 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
+        with:
+          # Full history so `turbo --affected` can diff against the PR base.
+          fetch-depth: 0
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
@@ -93,13 +103,29 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Run all tests
-        run: pnpm turbo run test
+      # PRs: only test packages affected by the diff against the PR base.
+      # spec sits at the root of the dependency graph, so spec-touching PRs
+      # still run (close to) everything — but the many PRs that don't touch
+      # spec skip the bulk of the 75-package matrix.
+      - name: Run affected tests (PR)
+        if: github.event_name == 'pull_request'
+        env:
+          TURBO_SCM_BASE: ${{ github.event.pull_request.base.sha }}
+        run: pnpm turbo run test --affected
+
+      # Push to main: full run, but exclude spec's plain test task — the
+      # coverage step below executes the exact same 250-file spec suite once,
+      # with coverage. Previously the spec suite ran twice per push.
+      - name: Run all tests (push)
+        if: github.event_name == 'push'
+        run: pnpm turbo run test --filter=!@objectstack/spec
 
       - name: Generate coverage report
+        if: github.event_name == 'push'
         run: pnpm --filter @objectstack/spec test:coverage
 
       - name: Upload coverage reports
+        if: github.event_name == 'push'
         uses: actions/upload-artifact@v7
         with:
           name: coverage-report