object.json

{
  "type": "object",
  "_note": "ObjectSchema (top-level). Seeded from docs/audits/2026-06-objectschema-property-liveness.md. Roughly half dead — a large aspirational enterprise-data-management tier with zero runtime. Framework evidence cited with paths; objectui-renderer evidence as prose.",
  "props": {
    "name": {
      "status": "live",
      "evidence": "packages/plugins/driver-sql/src/sql-driver.ts",
      "note": "table name; objectql registry key."
    },
    "label": {
      "status": "live",
      "note": "objectui app-shell/grid."
    },
    "pluralLabel": {
      "status": "live",
      "note": "objectui."
    },
    "description": {
      "status": "live",
      "note": "display metadata."
    },
    "icon": {
      "status": "live",
      "note": "objectui."
    },
    "displayNameField": {
      "status": "live",
      "note": "Deprecated alias of nameField (ADR-0079); still read by objectui RecordDetailView + resolveDisplayField back-compat."
    },
    "nameField": {
      "status": "live",
      "note": "ADR-0079 canonical record-title pointer; read by data/display-name.ts resolveDisplayField/resolveRecordDisplayName, objectql search displayField, and plugin-approvals."
    },
    "titleFormat": {
      "status": "live",
      "note": "objectui ({{record.field}} interpolation)."
    },
    "highlightFields": {
      "status": "live",
      "note": "ADR-0085 semantic role (renamed from compactLayout): objectui default list/grid columns (ObjectGrid/ObjectView/InterfaceListPage), child-record previews (first entry), record:details auto layout, detail highlight strip (first 4)."
    },
    "stageField": {
      "status": "live",
      "note": "ADR-0085 semantic role: objectui plugin-detail detectStatusField drives the record:path stepper; string names the lifecycle field, false suppresses heuristic stage detection."
    },
    "fieldGroups": {
      "status": "live",
      "note": "objectui form layout order."
    },
    "listViews": {
      "status": "live",
      "note": "objectui segmented tabs."
    },
    "fields": {
      "status": "live",
      "evidence": "packages/objectql/src/engine.ts",
      "note": "engine/DDL + forms."
    },
    "datasource": {
      "status": "live",
      "evidence": "packages/objectql/src/engine.ts:1147",
      "note": "driver routing."
    },
    "lifecycle": {
      "status": "live",
      "evidence": "packages/objectql/src/lifecycle/lifecycle-service.ts",
      "proof": "packages/qa/dogfood/test/storage-growth.dogfood.test.ts#adr0057-lifecycle-bounded-growth",
      "note": "ADR-0057 data lifecycle contract. The platform LifecycleService (registered by ObjectQLPlugin, default-on) reaps rows past retention.maxAge / ttl.expireAfter under a system context, bounds rotation-declared telemetry by shards×unit, never hot-deletes archive-declared audit ledgers unarchived, and reclaims driver space (SQLite incremental_vacuum) after each sweep. Non-record classes without a bounding policy are rejected at parse time (LifecycleSchema superRefine)."
    },
    "external": {
      "status": "live",
      "evidence": "packages/runtime/src/external-validation-plugin.ts",
      "note": "remote table + write gate."
    },
    "indexes": {
      "status": "live",
      "evidence": "packages/plugins/driver-sql/src/sql-driver.ts:1181",
      "note": "DDL."
    },
    "validations": {
      "status": "live",
      "evidence": "packages/objectql/src/validation/rule-validator.ts:154",
      "note": "incl. state_machine."
    },
    "activityMilestones": {
      "status": "live",
      "evidence": "packages/plugins/plugin-audit/src/audit-writers.ts",
      "note": "ADR-0052 §5b.2 — audit-writer matchMilestone() emits a templated activity row when a watched field transitions into the configured value."
    },
    "actions": {
      "status": "live",
      "evidence": "packages/runtime/src/app-plugin.ts:929",
      "note": "served on /meta/objects/:name."
    },
    "managedBy": {
      "status": "live",
      "evidence": "packages/objectql/src/registry.ts:208",
      "note": "default perms; ui crudAffordances."
    },
    "ownership": {
      "status": "live",
      "evidence": "packages/objectql/src/registry.ts:272",
      "note": "#3175 record-ownership model. applySystemFields injects the reassignable owner_id lookup by default (ownership:'user'); 'org'|'none' opt out (Dataverse-style catalog/junction tables). Proven in objectql/src/registry.test.ts."
    },
    "access": {
      "status": "live",
      "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts",
      "note": "ADR-0066 D2 secure-by-default posture. access.default:'private' → resolveObjectPermission excludes the object from non-super-user '*' wildcard grants (needs an explicit grant or View/Modify All Data), and security-plugin computeRlsFilter/computeWriteCheckFilter apply the posture-gated super-user RLS bypass. Unit + full-middleware proven in plugin-security/security-plugin.test.ts."
    },
    "requiredPermissions": {
      "status": "live",
      "evidence": "packages/plugins/plugin-security/src/security-plugin.ts",
      "note": "ADR-0066 D3 object capability contract — the security middleware denies unless the caller's systemPermissions union covers it (AND-gate, before the CRUD grant). Mirrors App.requiredPermissions. Unit + full-middleware proven in plugin-security/security-plugin.test.ts."
    },
    "userActions": {
      "status": "live",
      "note": "objectui ObjectGrid per-object CRUD."
    },
    "systemFields": {
      "status": "live",
      "evidence": "packages/objectql/src/registry.ts",
      "note": "organization_id auto-inject gate."
    },
    "sharingModel": {
      "status": "live",
      "evidence": "packages/plugins/plugin-sharing/src/sharing-service.ts:54",
      "proof": "packages/qa/dogfood/test/controlled-by-parent.dogfood.test.ts#cbp-controlled-by-parent",
      "note": "ADR-0055 high-risk class (sharing): the `controlled_by_parent` value derives a detail object's access from its master — the security layer injects `masterFK IN (accessible master ids)` on reads and requires master edit-access on by-id writes. The proof asserts a member who cannot read the master can neither read nor by-id-write the detail, and is not over-blocked on a master they own."
    },
    "publicSharing": {
      "status": "live",
      "evidence": "packages/plugins/plugin-sharing/src/share-link-service.ts:56"
    },
    "tenancy": {
      "children": {
        "enabled": {
          "status": "live",
          "evidence": "packages/plugins/driver-sql/src/sql-driver.ts:1081"
        },
        "tenantField": {
          "status": "live",
          "evidence": "packages/plugins/driver-sql/src/sql-driver.ts",
          "note": "row-level tenant scoping (org-scoping plugin path) reads tenancy.tenantField — audit called it inert; corrected. strategy/crossTenantAccess were REMOVED after spec 15.0 (#2763): zero consumers; tenancy block is now .strict() with tombstone guidance."
        }
      }
    },
    "enable": {
      "children": {
        "apiEnabled": {
          "status": "live",
          "evidence": "packages/rest/src/rest-server.ts",
          "note": "enforced by enforceApiAccess on the REST data surface (ADR-0049 #1889) — apiEnabled:false → 404."
        },
        "apiMethods": {
          "status": "live",
          "evidence": "packages/rest/src/rest-server.ts",
          "note": "enforced by enforceApiAccess — operations outside the whitelist → 405."
        },
        "trackHistory": {
          "status": "live",
          "evidence": "objectui app-shell RecordDetailView gates the record History tab on enable.trackHistory === true (historyEnabled memo); pairs with per-field trackHistory (plugin-audit renderTrackedChangeSummary, packages/plugins/plugin-audit/src/audit-writers.ts) which selects the field diffs. Audit CAPTURE into sys_audit_log is deliberately unconditional (compliance ledger) — the flag gates the UI surface, not the ledger (#2707)."
        },
        "searchable": {
          "status": "dead",
          "evidence": "no behavior-changing reader",
          "_authorWarnSkipped": "defaults to true in the schema — the lint can't distinguish author-set-true from the default, so warning here would fire on every object with an enable block. Only default-FALSE booleans are safe to authorWarn."
        },
        "files": {
          "status": "live",
          "evidence": "packages/plugins/plugin-audit/src/audit-writers.ts (enforceFilesCapability beforeInsert hook: sys_attachment rows may only target objects declaring enable.files true — 403 FILES_DISABLED otherwise); objectui RecordAttachmentsPanel renders the record Attachments surface (upload/list/download/delete) when the flag is true. Opt-in — spec default false (#2727)."
        },
        "feeds": {
          "status": "live",
          "evidence": "packages/plugins/plugin-audit/src/audit-writers.ts (enforceFeedsCapability beforeInsert hook: explicit feeds:false on the target object rejects sys_comment creation, 403 FEEDS_DISABLED); objectui RecordDetailView hides the record feed on explicit false. Opt-out — spec default true (#2707)."
        },
        "activities": {
          "status": "live",
          "evidence": "packages/plugins/plugin-audit/src/audit-writers.ts (writeAudit: explicit activities:false skips the sys_activity timeline mirror; audit row unaffected); objectui RecordDetailView skips the timeline merge on explicit false. Opt-out — spec default true; the per-object lever for activity-row growth, ADR-0057 (#2707)."
        },
        "trash": {
          "status": "dead",
          "evidence": "no behavior-changing reader"
        },
        "mru": {
          "status": "dead",
          "evidence": "no behavior-changing reader"
        },
        "clone": {
          "status": "live",
          "evidence": "packages/objectql/src/protocol.ts:2259",
          "note": "cloneData() gates on schema.enable.clone (explicit false ⇒ 403 CLONE_DISABLED); exposed at POST /data/:object/:id/clone (rest-server.ts registerDataActionEndpoints)."
        }
      }
    },
    "versioning": {
      "status": "dead",
      "evidence": "aspirational; no runtime",
      "authorWarn": true,
      "authorHint": "No record-versioning engine reads this block — setting it stores nothing and snapshots no history. Remove it (use Field.trackHistory for field-level history)."
    },
    "softDelete": {
      "status": "dead",
      "evidence": "no runtime; duplicates the (also dead) enable.trash",
      "authorWarn": true,
      "authorHint": "There is no soft-delete/recycle-bin runtime. Deletes are hard deletes; remove this to avoid implying restore semantics that don't exist."
    },
    "search": {
      "status": "dead",
      "evidence": "SearchConfigSchema — no runtime; duplicates enable.searchable",
      "authorWarn": true,
      "authorHint": "No search-engine config is consumed. Remove it — records remain queryable via the normal data API regardless."
    },
    "recordName": {
      "status": "dead",
      "evidence": "superseded by a field of type:'autonumber' + autonumberFormat (engine.ts:757)",
      "authorWarn": true,
      "authorHint": "Auto-naming is done by a `Field` of type 'autonumber' (with autonumberFormat). This block is not read — model the name field instead."
    },
    "keyPrefix": {
      "status": "dead",
      "evidence": "no runtime",
      "authorWarn": true,
      "authorHint": "Record ids are not prefixed from this value (no Salesforce-style key prefix runtime). Remove it — it has no effect."
    },
    "tags": {
      "status": "dead",
      "evidence": "no runtime reader"
    },
    "abstract": {
      "status": "dead",
      "evidence": "no runtime reader",
      "authorWarn": true,
      "authorHint": "No runtime reader — an abstract object still gets a table and is instantiable. Object inheritance/abstraction is not implemented."
    },
    "isSystem": {
      "status": "dead",
      "evidence": "object-level — no runtime reader"
    },
    "active": {
      "status": "dead",
      "evidence": "object-level — no runtime reader"
    },
    "searchableFields": {
      "status": "live",
      "note": "objectql `$search` executor (ADR-0061: expandSearchToFilter in engine.find) + objectui list/lookup/command-palette; canonical searchable-field source."
    },
    "externalSharingModel": {
      "status": "planned",
      "authorWarn": true,
      "note": "[ADR-0090 D11] P1 lands the SPEC SHAPE only (validated external<=internal at authoring; Studio surfaces the Ext badge). Runtime consumption (audience-aware evaluator branch substituting the external dial for external principals) is scheduled with the principal-taxonomy semantics phase; tracked on #2696. `planned` + authorWarn per enforce-or-mark: authors get told the dial does not evaluate yet. Was a bespoke 'authorable' status outside the documented vocabulary."
    }
  }
}