object.json

{
  "type": "object",
  "_note": "ObjectSchema (top-level). Seeded from docs/audits/2026-06-objectschema-property-liveness.md. Roughly half dead — a large aspirational enterprise-data-management tier with zero runtime. Framework evidence cited with paths; objectui-renderer evidence as prose.",
  "props": {
    "name": {
      "status": "live",
      "evidence": "packages/plugins/driver-sql/src/sql-driver.ts",
      "note": "table name; objectql registry key."
    },
    "label": {
      "status": "live",
      "note": "objectui app-shell/grid."
    },
    "pluralLabel": {
      "status": "live",
      "note": "objectui."
    },
    "description": {
      "status": "live",
      "note": "display metadata."
    },
    "icon": {
      "status": "live",
      "note": "objectui."
    },
    "displayNameField": {
      "status": "live",
      "note": "Deprecated alias of nameField (ADR-0079); still read by objectui RecordDetailView + resolveDisplayField back-compat."
    },
    "nameField": {
      "status": "live",
      "note": "ADR-0079 canonical record-title pointer; read by data/display-name.ts resolveDisplayField/resolveRecordDisplayName, objectql search displayField, and plugin-approvals."
    },
    "titleFormat": {
      "status": "live",
      "note": "objectui ({{record.field}} interpolation)."
    },
    "highlightFields": {
      "status": "live",
      "proof": "packages/qa/dogfood/test/semantic-roles.dogfood.test.ts#semantic-roles-served",
      "note": "ADR-0085 semantic role (renamed from compactLayout): objectui default list/grid columns (ObjectGrid/ObjectView/InterfaceListPage), child-record previews (first entry), record:details auto layout, detail highlight strip (first 4)."
    },
    "stageField": {
      "status": "live",
      "proof": "packages/qa/dogfood/test/semantic-roles.dogfood.test.ts#semantic-roles-served",
      "note": "ADR-0085 semantic role: objectui plugin-detail detectStatusField drives the record:path stepper; string names the lifecycle field, false suppresses heuristic stage detection."
    },
    "fieldGroups": {
      "status": "live",
      "proof": "packages/qa/dogfood/test/semantic-roles.dogfood.test.ts#semantic-roles-served",
      "note": "objectui form layout order."
    },
    "listViews": {
      "status": "live",
      "note": "objectui segmented tabs."
    },
    "fields": {
      "status": "live",
      "evidence": "packages/objectql/src/engine.ts",
      "note": "engine/DDL + forms."
    },
    "datasource": {
      "status": "live",
      "evidence": "packages/objectql/src/engine.ts:1147",
      "note": "driver routing."
    },
    "lifecycle": {
      "status": "live",
      "evidence": "packages/objectql/src/lifecycle/lifecycle-service.ts",
      "proof": "packages/qa/dogfood/test/storage-growth.dogfood.test.ts#adr0057-lifecycle-bounded-growth",
      "note": "ADR-0057 data lifecycle contract. The platform LifecycleService (registered by ObjectQLPlugin, default-on) reaps rows past retention.maxAge / ttl.expireAfter under a system context, bounds rotation-declared telemetry by shards×unit, never hot-deletes archive-declared audit ledgers unarchived, and reclaims driver space (SQLite incremental_vacuum) after each sweep. Non-record classes without a bounding policy are rejected at parse time (LifecycleSchema superRefine)."
    },
    "external": {
      "status": "live",
      "evidence": "packages/runtime/src/external-validation-plugin.ts",
      "note": "remote table + write gate."
    },
    "indexes": {
      "status": "live",
      "evidence": "packages/plugins/driver-sql/src/sql-driver.ts:1181",
      "note": "DDL."
    },
    "validations": {
      "status": "live",
      "evidence": "packages/objectql/src/validation/rule-validator.ts:154",
      "note": "incl. state_machine."
    },
    "activityMilestones": {
      "status": "live",
      "evidence": "packages/plugins/plugin-audit/src/audit-writers.ts",
      "note": "ADR-0052 §5b.2 — audit-writer matchMilestone() emits a templated activity row when a watched field transitions into the configured value."
    },
    "actions": {
      "status": "live",
      "evidence": "packages/runtime/src/app-plugin.ts:929",
      "note": "served on /meta/objects/:name."
    },
    "managedBy": {
      "status": "live",
      "evidence": "packages/objectql/src/registry.ts:208",
      "note": "default perms; ui crudAffordances."
    },
    "ownership": {
      "status": "live",
      "evidence": "packages/objectql/src/registry.ts:272",
      "note": "#3175 record-ownership model. applySystemFields injects the reassignable owner_id lookup by default (ownership:'user'); 'org'|'none' opt out (Dataverse-style catalog/junction tables). Proven in objectql/src/registry.test.ts."
    },
    "access": {
      "status": "live",
      "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts",
      "note": "ADR-0066 D2 secure-by-default posture. access.default:'private' → resolveObjectPermission excludes the object from non-super-user '*' wildcard grants (needs an explicit grant or View/Modify All Data), and security-plugin computeRlsFilter/computeWriteCheckFilter apply the posture-gated super-user RLS bypass. Unit + full-middleware proven in plugin-security/security-plugin.test.ts."
    },
    "requiredPermissions": {
      "status": "live",
      "evidence": "packages/plugins/plugin-security/src/security-plugin.ts",
      "note": "ADR-0066 D3 object capability contract — the security middleware denies unless the caller's systemPermissions union covers it (AND-gate, before the CRUD grant). Mirrors App.requiredPermissions. Unit + full-middleware proven in plugin-security/security-plugin.test.ts."
    },
    "userActions": {
      "status": "live",
      "note": "objectui ObjectGrid per-object CRUD."
    },
    "systemFields": {
      "status": "live",
      "evidence": "packages/objectql/src/registry.ts",
      "note": "organization_id auto-inject gate."
    },
    "sharingModel": {
      "status": "live",
      "evidence": "packages/plugins/plugin-sharing/src/sharing-service.ts:54",
      "proof": "packages/qa/dogfood/test/controlled-by-parent.dogfood.test.ts#cbp-controlled-by-parent",
      "note": "ADR-0055 high-risk class (sharing): the `controlled_by_parent` value derives a detail object's access from its master — the security layer injects `masterFK IN (accessible master ids)` on reads and requires master edit-access on by-id writes. The proof asserts a member who cannot read the master can neither read nor by-id-write the detail, and is not over-blocked on a master they own."
    },
    "publicSharing": {
      "status": "live",
      "evidence": "packages/plugins/plugin-sharing/src/share-link-service.ts:56"
    },
    "tenancy": {
      "children": {
        "enabled": {
          "status": "live",
          "evidence": "packages/plugins/driver-sql/src/sql-driver.ts:1081"
        },
        "tenantField": {
          "status": "live",
          "evidence": "packages/plugins/driver-sql/src/sql-driver.ts",
          "note": "row-level tenant scoping (org-scoping plugin path) reads tenancy.tenantField — audit called it inert; corrected. strategy/crossTenantAccess were REMOVED after spec 15.0 (#2763): zero consumers; tenancy block is now .strict() with tombstone guidance."
        }
      }
    },
    "enable": {
      "children": {
        "apiEnabled": {
          "status": "live",
          "evidence": "packages/rest/src/rest-server.ts",
          "note": "enforced by enforceApiAccess on the REST data surface (ADR-0049 #1889) — apiEnabled:false → 404."
        },
        "apiMethods": {
          "status": "live",
          "evidence": "packages/spec/src/data/api-derivation.ts, packages/rest/src/rest-server.ts, packages/runtime/src/api-exposure.ts",
          "note": "three-state whitelist over the six primitives (get/list/create/update/delete/bulk): undefined = unrestricted, [] = deny-all (fully closed), subset = the derived closure; a present-but-non-array value fails CLOSED (#3545). resolveEffectiveApiMethods (the single derivation table) is consumed by the REST gate (405 outside the effective set) and the runtime dispatcher gate. Since #3543 the enum IS the six primitives; the legacy 8 values (upsert/aggregate/history/search/restore/purge/import/export) are DERIVED effective operations (ApiOperation vocabulary) — a stored legacy value is stripped at parse (stripLegacyApiMethods, canonicalize-and-warn, permanent tolerance)."
        },
        "trackHistory": {
          "status": "live",
          "evidence": "objectui app-shell RecordDetailView gates the record History tab on enable.trackHistory === true (historyEnabled memo); pairs with per-field trackHistory (plugin-audit renderTrackedChangeSummary, packages/plugins/plugin-audit/src/audit-writers.ts) which selects the field diffs. Audit CAPTURE into sys_audit_log is deliberately unconditional (compliance ledger) — the flag gates the UI surface, not the ledger (#2707)."
        },
        "searchable": {
          "status": "live",
          "evidence": "packages/metadata-protocol/src/protocol.ts:2967",
          "note": "Global Search (searchAll, M10.5): `enable.searchable === false` opts the object out of cross-object search. Behavior-changing reader — the 2026-06 audit mis-classified as dead (search executor not re-verified). default(true), so still not authorWarn'd."
        },
        "files": {
          "status": "live",
          "proof": "packages/qa/dogfood/test/attachments-permission-matrix.dogfood.test.ts#attachments-permission-matrix",
          "evidence": "packages/plugins/plugin-audit/src/audit-writers.ts (enforceFilesCapability beforeInsert hook: sys_attachment rows may only target objects declaring enable.files true — 403 FILES_DISABLED otherwise); objectui RecordAttachmentsPanel renders the record Attachments surface (upload/list/download/delete) when the flag is true. Opt-in — spec default false (#2727)."
        },
        "feeds": {
          "status": "live",
          "evidence": "packages/plugins/plugin-audit/src/audit-writers.ts (enforceFeedsCapability beforeInsert hook: explicit feeds:false on the target object rejects sys_comment creation, 403 FEEDS_DISABLED); objectui RecordDetailView hides the record feed on explicit false. Opt-out — spec default true (#2707)."
        },
        "activities": {
          "status": "live",
          "evidence": "packages/plugins/plugin-audit/src/audit-writers.ts (writeAudit: explicit activities:false skips the sys_activity timeline mirror; audit row unaffected); objectui RecordDetailView skips the timeline merge on explicit false. Opt-out — spec default true; the per-object lever for activity-row growth, ADR-0057 (#2707)."
        },
        "clone": {
          "status": "live",
          "verifiedAt": "2026-07-28",
          "evidence": "packages/metadata-protocol/src/protocol.ts:2938",
          "note": "cloneData() gates on schema.enable.clone (explicit false ⇒ 403 CLONE_DISABLED); exposed at POST /data/:object/:id/clone (rest-server.ts registerDataActionEndpoints). POINTER REPAIRED 2026-07 — cited packages/objectql/src/protocol.ts:2259 until the protocol moved to @objectstack/metadata-protocol. The claim never stopped being true, but the stale-evidence check could not surface the rot: 47 parse-artefact false positives were burying it (fixed in the same pass). Behaviour guarded by packages/objectql/src/protocol-clone-real-engine.test.ts."
        }
      }
    },
    "isSystem": {
      "status": "live",
      "evidence": "packages/plugins/plugin-sharing/src/sharing-service.ts:74",
      "note": "effectiveSharingModel: an object with no sharingModel and isSystem===true defaults to 'public' (else 'private') — fail-closed org-wide-default posture; ORed with the sys_ name-prefix fallback. Also read by lint/src/validate-security-posture.ts:98 (isSystemObject exempts system objects from the master-detail CRUD-grant lint) and mirrored in metadata-protocol/src/protocol.ts:106. The 2026-06 audit mis-classified as dead (sharing/lint readers not re-verified)."
    },
    "searchableFields": {
      "status": "live",
      "note": "objectql `$search` executor (ADR-0061: expandSearchToFilter in engine.find) + objectui list/lookup/command-palette; canonical searchable-field source."
    },
    "externalSharingModel": {
      "status": "planned",
      "authorWarn": true,
      "note": "[ADR-0090 D11] P1 lands the SPEC SHAPE only (validated external<=internal at authoring; Studio surfaces the Ext badge). Runtime consumption (audience-aware evaluator branch substituting the external dial for external principals) is scheduled with the principal-taxonomy semantics phase; tracked on #2696. `planned` + authorWarn per enforce-or-mark: authors get told the dial does not evaluate yet. Was a bespoke 'authorable' status outside the documented vocabulary."
    },
    "fileAccessDelegate": {
      "status": "live",
      "evidence": "packages/services/service-storage/src/storage-service-plugin.ts (buildFileReadAuthorizer)",
      "note": "ADR-0104 D3 wave 2. Named service answers 'may this caller download a file owned by this object's media fields?' instead of the storage service testing raw readability of the owning row — which asks the wrong authority for an object whose access is mediated by a service. sys_approval_action declares 'approvals'; the service reuses the same parent-request visibility gate listActions applies. Fails closed: a declared-but-missing delegate denies."
    }
  }
}