object.json

{
  "type": "object",
  "_note": "ObjectSchema (top-level). Seeded from docs/audits/2026-06-objectschema-property-liveness.md. Roughly half dead — a large aspirational enterprise-data-management tier with zero runtime. Framework evidence cited with paths; objectui-renderer evidence as prose.",
  "props": {
    "name": {
      "status": "live",
      "evidence": "packages/plugins/driver-sql/src/sql-driver.ts",
      "note": "table name; objectql registry key."
    },
    "label": {
      "status": "live",
      "note": "objectui app-shell/grid."
    },
    "pluralLabel": {
      "status": "live",
      "note": "objectui."
    },
    "description": {
      "status": "live",
      "note": "display metadata."
    },
    "icon": {
      "status": "live",
      "note": "objectui."
    },
    "displayNameField": {
      "status": "live",
      "note": "Deprecated alias of nameField (ADR-0079); still read by objectui RecordDetailView + resolveDisplayField back-compat."
    },
    "nameField": {
      "status": "live",
      "note": "ADR-0079 canonical record-title pointer; read by data/display-name.ts resolveDisplayField/resolveRecordDisplayName, objectql search displayField, and plugin-approvals."
    },
    "titleFormat": {
      "status": "live",
      "note": "objectui ({{record.field}} interpolation)."
    },
    "highlightFields": {
      "status": "live",
      "note": "ADR-0085 semantic role (renamed from compactLayout): objectui default list/grid columns (ObjectGrid/ObjectView/InterfaceListPage), child-record previews (first entry), record:details auto layout, detail highlight strip (first 4)."
    },
    "stageField": {
      "status": "live",
      "note": "ADR-0085 semantic role: objectui plugin-detail detectStatusField drives the record:path stepper; string names the lifecycle field, false suppresses heuristic stage detection."
    },
    "fieldGroups": {
      "status": "live",
      "note": "objectui form layout order."
    },
    "listViews": {
      "status": "live",
      "note": "objectui segmented tabs."
    },
    "fields": {
      "status": "live",
      "evidence": "packages/objectql/src/engine.ts",
      "note": "engine/DDL + forms."
    },
    "datasource": {
      "status": "live",
      "evidence": "packages/objectql/src/engine.ts:1147",
      "note": "driver routing."
    },
    "external": {
      "status": "live",
      "evidence": "packages/runtime/src/external-validation-plugin.ts",
      "note": "remote table + write gate."
    },
    "indexes": {
      "status": "live",
      "evidence": "packages/plugins/driver-sql/src/sql-driver.ts:1181",
      "note": "DDL."
    },
    "validations": {
      "status": "live",
      "evidence": "packages/objectql/src/validation/rule-validator.ts:154",
      "note": "incl. state_machine."
    },
    "activityMilestones": {
      "status": "live",
      "evidence": "packages/plugins/plugin-audit/src/audit-writers.ts",
      "note": "ADR-0052 §5b.2 — audit-writer matchMilestone() emits a templated activity row when a watched field transitions into the configured value."
    },
    "actions": {
      "status": "live",
      "evidence": "packages/runtime/src/app-plugin.ts:929",
      "note": "served on /meta/objects/:name."
    },
    "managedBy": {
      "status": "live",
      "evidence": "packages/objectql/src/registry.ts:208",
      "note": "default perms; ui crudAffordances."
    },
    "access": {
      "status": "live",
      "evidence": "packages/plugins/plugin-security/src/permission-evaluator.ts",
      "note": "ADR-0066 D2 secure-by-default posture. access.default:'private' → resolveObjectPermission excludes the object from non-super-user '*' wildcard grants (needs an explicit grant or View/Modify All Data), and security-plugin computeRlsFilter/computeWriteCheckFilter apply the posture-gated super-user RLS bypass. Unit + full-middleware proven in plugin-security/security-plugin.test.ts."
    },
    "requiredPermissions": {
      "status": "live",
      "evidence": "packages/plugins/plugin-security/src/security-plugin.ts",
      "note": "ADR-0066 D3 object capability contract — the security middleware denies unless the caller's systemPermissions union covers it (AND-gate, before the CRUD grant). Mirrors App.requiredPermissions. Unit + full-middleware proven in plugin-security/security-plugin.test.ts."
    },
    "userActions": {
      "status": "live",
      "note": "objectui ObjectGrid per-object CRUD."
    },
    "systemFields": {
      "status": "live",
      "evidence": "packages/objectql/src/registry.ts",
      "note": "organization_id auto-inject gate."
    },
    "sharingModel": {
      "status": "live",
      "evidence": "packages/plugins/plugin-sharing/src/sharing-service.ts:54",
      "proof": "packages/dogfood/test/controlled-by-parent.dogfood.test.ts#cbp-controlled-by-parent",
      "note": "ADR-0055 high-risk class (sharing): the `controlled_by_parent` value derives a detail object's access from its master — the security layer injects `masterFK IN (accessible master ids)` on reads and requires master edit-access on by-id writes. The proof asserts a member who cannot read the master can neither read nor by-id-write the detail, and is not over-blocked on a master they own."
    },
    "publicSharing": {
      "status": "live",
      "evidence": "packages/plugins/plugin-sharing/src/share-link-service.ts:56"
    },
    "tenancy": {
      "children": {
        "enabled": {
          "status": "live",
          "evidence": "packages/plugins/driver-sql/src/sql-driver.ts:1081"
        },
        "strategy": {
          "status": "dead",
          "evidence": "inert — only tenancy.enabled is read",
          "note": "part of the live tenancy block (sql-driver reads enabled+tenantField); verify before touching."
        },
        "tenantField": {
          "status": "live",
          "evidence": "packages/plugins/driver-sql/src/sql-driver.ts",
          "note": "row-level tenant scoping (org-scoping plugin path) reads tenancy.tenantField — audit called it inert; corrected."
        },
        "crossTenantAccess": {
          "status": "dead",
          "evidence": "inert",
          "note": "part of the live tenancy block; verify before touching."
        }
      }
    },
    "enable": {
      "children": {
        "apiEnabled": {
          "status": "live",
          "evidence": "packages/rest/src/rest-server.ts",
          "note": "enforced by enforceApiAccess on the REST data surface (ADR-0049 #1889) — apiEnabled:false → 404."
        },
        "apiMethods": {
          "status": "live",
          "evidence": "packages/rest/src/rest-server.ts",
          "note": "enforced by enforceApiAccess — operations outside the whitelist → 405."
        },
        "trackHistory": {
          "status": "dead",
          "evidence": "no behavior-changing reader (database-loader.trackHistory is a separate ctor option)",
          "authorWarn": true,
          "authorHint": "Per-field history is live via `Field.trackHistory` (plugin-audit, ADR-0052) — set it on the fields you want tracked instead of this object flag."
        },
        "searchable": {
          "status": "dead",
          "evidence": "no behavior-changing reader",
          "_authorWarnSkipped": "defaults to true in the schema — the lint can't distinguish author-set-true from the default, so warning here would fire on every object with an enable block. Only default-FALSE booleans are safe to authorWarn."
        },
        "files": {
          "status": "dead",
          "evidence": "no behavior-changing reader",
          "authorWarn": true,
          "authorHint": "File attachments are modeled with a `Field.file`/`Field.image` (or the sys_attachment object), not this object flag — it enables nothing on its own."
        },
        "feeds": {
          "status": "dead",
          "evidence": "no behavior-changing reader",
          "authorWarn": true,
          "authorHint": "Comments/collaboration live on the dedicated sys_comment object (plugin-audit), not this flag — it enables no feed at runtime."
        },
        "activities": {
          "status": "dead",
          "evidence": "no behavior-changing reader",
          "authorWarn": true,
          "authorHint": "Tasks/events live on the dedicated sys_activity object (plugin-audit), not this flag — it enables no activity suite at runtime."
        },
        "trash": {
          "status": "dead",
          "evidence": "no behavior-changing reader"
        },
        "mru": {
          "status": "dead",
          "evidence": "no behavior-changing reader"
        },
        "clone": {
          "status": "live",
          "evidence": "packages/objectql/src/protocol.ts:2259",
          "note": "cloneData() gates on schema.enable.clone (explicit false ⇒ 403 CLONE_DISABLED); exposed at POST /data/:object/:id/clone (rest-server.ts registerDataActionEndpoints)."
        }
      }
    },
    "versioning": {
      "status": "dead",
      "evidence": "aspirational; no runtime",
      "authorWarn": true,
      "authorHint": "No record-versioning engine reads this block — setting it stores nothing and snapshots no history. Remove it (use Field.trackHistory for field-level history)."
    },
    "softDelete": {
      "status": "dead",
      "evidence": "no runtime; duplicates the (also dead) enable.trash",
      "authorWarn": true,
      "authorHint": "There is no soft-delete/recycle-bin runtime. Deletes are hard deletes; remove this to avoid implying restore semantics that don't exist."
    },
    "search": {
      "status": "dead",
      "evidence": "SearchConfigSchema — no runtime; duplicates enable.searchable",
      "authorWarn": true,
      "authorHint": "No search-engine config is consumed. Remove it — records remain queryable via the normal data API regardless."
    },
    "recordName": {
      "status": "dead",
      "evidence": "superseded by a field of type:'autonumber' + autonumberFormat (engine.ts:757)",
      "authorWarn": true,
      "authorHint": "Auto-naming is done by a `Field` of type 'autonumber' (with autonumberFormat). This block is not read — model the name field instead."
    },
    "keyPrefix": {
      "status": "dead",
      "evidence": "no runtime",
      "authorWarn": true,
      "authorHint": "Record ids are not prefixed from this value (no Salesforce-style key prefix runtime). Remove it — it has no effect."
    },
    "tags": {
      "status": "dead",
      "evidence": "no runtime reader"
    },
    "abstract": {
      "status": "dead",
      "evidence": "no runtime reader"
    },
    "isSystem": {
      "status": "dead",
      "evidence": "object-level — no runtime reader"
    },
    "active": {
      "status": "dead",
      "evidence": "object-level — no runtime reader"
    },
    "searchableFields": {
      "status": "live",
      "note": "objectql `$search` executor (ADR-0061: expandSearchToFilter in engine.find) + objectui list/lookup/command-palette; canonical searchable-field source."
    }
  }
}