docs: document runtime OWD gate in permissions guide + round-2 ADR status verification (#3061)

* docs(permissions): document the runtime OWD posture gate (#3050) in the governance section

* docs(adr): round-2 status verification — flip 0037/0065, annotate 12 partial/cloud-owned ADRs

Per-decision code+test verification (same method as #3052's round 1) of the
14 remaining medium/low-density Proposed ADRs:

- Flip to Accepted: 0037 (Live Canvas — all four phases landed incl.
  preview-evaluator + objectui surfaces), 0065 (SDUI styling — envelope,
  scoped-styles compiler + 4-property test, token lint; cloud half noted).
- Honest partial notes, keep Proposed: 0080 (save-time compile->store not
  wired), 0078 (core shared completeness predicate + lint absent), 0052
  (context decomposition undone), 0067 (Decision-2 turn-atomicity missing),
  0022 (Slack channel->connector delegation unbuilt), 0051 (render side
  absent), 0076 (D3 unbuilt, D12 runtime enforcement missing), 0061 (Tier 1
  claim verified TRUE; own conformance bar unmet), 0028 (NOT STARTED).
- Cloud-owned banners verified accurate, framework slices noted: 0038, 0063,
  0064 (service-ai genuinely absent from framework).

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang

content/docs/permissions/authorization.mdx

@@ -287,8 +287,8 @@ substrate above.
 
 ## Governance: how "declared = enforced" is kept true
 
-Four CI-time mechanisms make the security posture a **checked artifact**
-rather than a belief:
+Five mechanisms — four CI-time, one runtime — make the security posture a
+**checked artifact** rather than a belief:
 
 - **Security publish linter** (ADR-0090 D7, `validateSecurityPosture` in
   `@objectstack/lint`, gating `os compile`): unset OWD on custom objects,
@@ -298,6 +298,19 @@ rather than a belief:
   security identifiers, and the ADR-0091 grant-lifecycle rules (a seed grant
   already expired at authoring time; a delegation row missing its mandatory
   `reason`) — every error rule mirrors a runtime gate.
+- **Runtime OWD posture gate** (#3050, `objectPostureGate` in
+  `@objectstack/plugin-security`, registered on the metadata protocol's
+  pre-persistence `registerAuthoringGate` seam): the two OWD rules the CLI
+  linter can only check at build time are also enforced on every
+  runtime-authored object body — Studio drafts, REST saves, AI builders.
+  An environment overlay of a **packaged** object may only *tighten*
+  `sharingModel` / `externalSharingModel`, never widen them beyond the
+  packaged declaration (`403 owd_widening_forbidden` — widen it in the
+  package source and publish instead; this closes the
+  `OS_METADATA_WRITABLE=object` escape hatch as an unvalidated widening
+  path, ADR-0086 D1), and `externalSharingModel ≤ sharingModel` (ADR-0090
+  D11) is rejected at save time (`403 owd_external_wider`). Write-path
+  only: stored metadata keeps loading unchanged.
 - **Access-matrix snapshot** (ADR-0090 D6, `buildAccessMatrix` /
   `diffAccessMatrix`): with `access-matrix.json` committed next to the config,
   `os compile` fails on any capability drift with semantic lines

docs/adr/0022-connectors-vs-messaging-channels.md

@@ -1,6 +1,6 @@
 # ADR-0022: Connectors vs Messaging Channels — Where "Push to Slack" Lives
 
-**Status**: Proposed (2026-05-31)
+**Status**: Proposed (2026-05-31) — routing decision recorded; both substrates now exist independently (`connector-slack` built; `service-messaging` notify/outbox/preferences built), but the §3 shared-transport wiring — a Slack `MessagingChannel.send()` delegating to the Slack Connector — is unbuilt (no slack-channel in service-messaging). (2026-07-16 audit)
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: [ADR-0012](./0012-notification-platform.md) (Messaging Platform — outbound `notify` on a generalized outbox), [ADR-0013](./0013-bidirectional-messaging.md) (Bidirectional Messaging — Slack first), [ADR-0015](./0015-external-datasource-federation.md) (open mechanism / enterprise lifecycle split), [ADR-0018](./0018-unified-node-action-registry.md) (`connector_action` as baseline generic dispatch)
 **Consumers**: `@objectstack/spec` (`integration/`, future `messaging/`), `@objectstack/services/service-automation` (connector registry), future `@objectstack/service-messaging`, future `@objectstack/plugin-messaging-slack`, `@objectstack/connectors/*`

docs/adr/0028-metadata-naming-and-namespace-isolation.md

@@ -1,6 +1,6 @@
 # ADR-0028: Metadata Naming & Namespace Isolation — Derived Physical Names, Namespace-Scoped Identity, and a Single Kernel Contract
 
-**Status**: Proposed (2026-06-01)
+**Status**: Proposed (2026-06-01) — NOT STARTED (2026-07-16 audit): the target model (namespace as identity dimension, short authored names, derived physical names, `namingMode` dual-read, `sys` reservation, namespaced transport segments) is entirely unbuilt; what exists is the superseded literal-prefix current-state contract (`spec/kernel/namespace-prefix.ts`, self-labelled) plus unrelated ADR-0048 conflict scaffolding.
 **Deciders**: ObjectStack Protocol Architects
 **Supersedes**: the hand-written object-namespace-prefix authoring rule documented in `packages/spec/src/kernel/manifest.zod.ts` (the `namespace` field) and enforced by `validateNamespacePrefix()` in `packages/spec/src/stack.zod.ts` — there is no standalone ADR for that rule today.
 **Builds on**: [ADR-0005](./0005-metadata-customization-overlay.md) (one Zod source per type, org overlay), [ADR-0008](./0008-metadata-repository-and-change-log.md) (Repository · ChangeLog · Cache · Registry; `MetaRef = org/type/name`), [ADR-0010](./0010-metadata-protection-model.md) (protection model), [ADR-0019](./0019-app-as-consumer-unit.md) (app as the consumer-installable unit), [ADR-0025](./0025-plugin-package-distribution.md) (package distribution), [ADR-0029](./0029-kernel-object-ownership-and-platform-objects-decomposition.md) (**prerequisite** — kernel object ownership; D5/D6 below assume the kernel is properly owned per ADR-0029)

docs/adr/0037-live-canvas-draft-preview.md

@@ -1,6 +1,6 @@
 # ADR-0037: Live Canvas — draft-overlay live preview while you build
 
-**Status**: Proposed (2026-06-10)
+**Status**: Accepted (2026-06-10) — all four phases implemented: `previewDrafts` reads (`runtime/http-dispatcher.ts`), objectui LiveCanvas/PreviewModeContext/DraftPreviewBar, draft-data preview via `service-analytics/preview-evaluator.ts` (+test), assistantBus back-channel (Phase 4 the least exercised).
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: [ADR-0033](./0033-ai-assisted-metadata-authoring.md) (AI authors metadata as DRAFTS; publish is the human gate), [ADR-0021](./0021-analytics-dataset-semantic-layer.md) (datasets as the single analytics form — what dashboards render from), [ADR-0005](./0005-metadata-customization-overlay.md) (the overlay model the draft state lives in)
 **Consumers**: `@objectstack/runtime` + `@objectstack/objectql` (preview data plane — mostly already present), `@objectstack/service-analytics` (Phase 3 draft-data queries), `../objectui` (`data-objectstack` preview client, `app-shell` Live Canvas + assistant bus, view/dashboard renderers), `../cloud` (Build-with-AI entry surface)

docs/adr/0038-build-verification-loop.md

@@ -2,7 +2,7 @@
 
 > **🔶 Cloud-owned — superseded in part by cloud ADR-0025 (2026-06-25).** The in-UI AI runtime and the `ask` / `build` agents described here moved to the **cloud / Enterprise** distribution (`@objectstack/service-ai` → `cloud/packages/service-ai`, closed); the open framework exposes AI only via `@objectstack/mcp` (BYO-AI) and ships no in-product `ask` / `build` chat. Retained as historical design context, now **cloud-owned** — see [`cloud/docs/adr/0025-service-ai-to-cloud-open-mcp-only`](https://github.com/objectstack-ai/cloud/blob/main/docs/adr/0025-service-ai-to-cloud-open-mcp-only.md).
 
-**Status**: Proposed (2026-06-11)
+**Status**: Proposed (2026-06-11) — cloud-owned; framework slice partially implemented (2026-07-16 audit): L3 runtime probes shipped and tested (`metadata-protocol/src/build-probes.ts`, `RuntimeBuildIssue` contract); L2 half-present (dataset compile only); L1/L4/L5 + `ai_eval_*` storage are cloud-only and not verifiable in this repo.
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: [ADR-0033](./0033-ai-assisted-metadata-authoring.md) (drafts as the staging layer — this ADR **replaces its human-approval assumption for AI builds** with a machine gate; HITL stays for destructive actions), [ADR-0021](./0021-analytics-dataset-semantic-layer.md) (datasets — what most verification probes exercise), ADR-0037 / [framework#1694](https://github.com/objectstack-ai/framework/pull/1694) (Live Canvas — the *human-visibility* complement to this ADR's *machine-verification*)
 **Consumers**: `@objectstack/service-analytics` + `@objectstack/objectql` (verification probes), `../cloud/service-ai-studio` (graph lint, `verify_build` tool, self-correction protocol, eval intelligence), `../objectui` (build health card in chat), `ai_eval_cases`/`ai_eval_runs` (existing, currently-unused storage)

docs/adr/0051-inline-metadata-views-in-docs.md

@@ -1,6 +1,6 @@
 # ADR-0051: Inline metadata views in docs — the ` ```metadata ` fenced block
 
-**Status**: Proposed (2026-06-16)
+**Status**: Proposed (2026-06-16) — P1 authoring surface implemented (2026-07-16 audit): `ElementMetadataViewerPropsSchema` + `element:metadata_viewer` component entry + publish lint with reference-liveness checks (`cli/utils/collect-docs.ts lintMetadataEmbeds`); the console SDUI fence-lift and the state_machine/flow/permission renderers are NOT implemented — no runtime rendering of the embed yet.
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: [ADR-0046](./0046-package-docs-as-metadata.md) (`doc`/`book` as metadata — §3.4 syntax boundary, §3.5 *derived content is rendered, never written*, §6.7 anonymous live-embed guardrail), [ADR-0020](./0020-state-machine-converge-and-enforce.md) (a record state machine is a `state_machine` validation rule on an object, not a standalone type), [ADR-0047](./0047-object-ui-run-modes.md) (ObjectUI is the server-driven UI runtime), [ADR-0048](./0048-cross-package-metadata-collision.md) (package-scoped single-item resolution), [ADR-0049](./0049-no-unenforced-security-properties.md) (enforce-or-remove posture for governed properties), [ADR-0033](./0033-ai-assisted-metadata-authoring.md) (AI as primary author)
 **Consumers**: `@objectstack/spec` (`DocSchema` unchanged; new `element:metadata_viewer` entry in `ComponentPropsMap`; the fenced-block body schema), `@objectstack/cli` (publish lint: parse + validate body + reference-liveness), `@objectstack/console` (the SDUI doc renderer lifts ` ```metadata ` fences into the component), `apps/docs` portal (anonymous degradation per ADR-0046 §6.7), `@objectstack/core` (kernel **unchanged** — `doc` stays inert)

docs/adr/0052-audit-is-not-the-activity-feed.md

@@ -1,6 +1,6 @@
 # ADR-0052: Audit is not the activity feed — decompose collaboration, activity, and audit into bounded contexts
 
-**Status**: Proposed (2026-06-16)
+**Status**: Proposed (2026-06-16) — partially implemented (2026-07-16 audit): §5b declarative activity (`trackHistory` + milestone templates), ActivityPointer fields, and `service-feed` retirement are done; the headline bounded-context decomposition is NOT — `sys_activity`/`sys_comment` still live in plugin-audit, the audit-writer still dual-writes (no event-bus spine), `sys_notification` move deferred (P1/P2).
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: [ADR-0030](./0030-notification-platform-convergence.md) (single-ingress `NotificationService.emit` — *no producer writes a per-user inbox row directly*; this ADR applies the same "one canonical service per context, producers emit through a seam" posture to activity and collaboration), [ADR-0012](./0012-notification-platform.md) (messaging outbox owns `sys_notification`), [ADR-0049](./0049-no-unenforced-security-properties.md) (enforce-or-remove posture for governed properties — audit immutability must be enforced at its own boundary, not diluted by co-tenant objects), [ADR-0042](./0042-approval-sla-escalation.md) (uses `sys_audit_log` rows as an idempotency primitive — a second reason audit must stay a clean, append-only ledger)
 **Consumers**: `@objectstack/plugin-audit` (sheds 4 of its 5 objects; keeps only `sys_audit_log`), `@objectstack/service-feed` (becomes the canonical collaboration+timeline backend, or is retired into it), `@objectstack/service-storage` (takes `sys_attachment`), `@objectstack/service-messaging` (takes `sys_notification`, per ADR-0030), `@objectstack/platform-objects` (object ownership map), `@objectstack/cli` (`ALWAYS_ON_CAPABILITIES` / capability resolver), `@objectstack/console` (ChatterPanel data source), `@objectstack/spec` (`IFeedService` / event contracts)

docs/adr/0061-record-search-architecture.md

@@ -1,6 +1,6 @@
 # ADR-0061: Record Search Architecture — metadata-driven `$search` resolution
 
-**Status**: Proposed — recommended for acceptance (2026-06-21). **Tier 1 (`$search` + `object.searchableFields`) has since been implemented & is live; Tier 2 (FTS/relevance) deferred — header pending formal update.**
+**Status**: Proposed — recommended for acceptance (2026-06-21). **Tier 1 (`$search` + `object.searchableFields`) has since been implemented & is live; Tier 2 (FTS/relevance) deferred.** Verified 2026-07-16: Tier 1 claim TRUE (`objectql/src/search-filter.ts` + engine wiring + unit tests, incl. `$searchFields` narrowing and select label-mapping) — but this ADR's own acceptance bar (a `search-conformance` ledger entry + dogfood multi-field HTTP proof, per ADR-0060 closure) is still unmet, so the header stays Proposed until that lands.
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: ADR-0045 (additive materialization & visibility gate — search must be visibility-aware), ADR-0049 (enforce-or-remove / no unenforced declaration), ADR-0054 (runtime proof per enforced surface), ADR-0060 (conformance ledger as a platform pattern)
 **Consumers**: spec, objectql, driver-sql, driver-memory, driver-mongodb, rest, objectui (`fields`, `plugin-list`, `app-shell`), verify, dogfood

docs/adr/0063-two-kernel-agents-skills-are-the-extension-primitive.md

@@ -2,7 +2,7 @@
 
 > **🔶 Cloud-owned — superseded in part by cloud ADR-0025 (2026-06-25).** The in-UI AI runtime and the `ask` / `build` agents described here moved to the **cloud / Enterprise** distribution (`@objectstack/service-ai` → `cloud/packages/service-ai`, closed); the open framework exposes AI only via `@objectstack/mcp` (BYO-AI) and ships no in-product `ask` / `build` chat. Retained as historical design context, now **cloud-owned** — see [`cloud/docs/adr/0025-service-ai-to-cloud-open-mcp-only`](https://github.com/objectstack-ai/cloud/blob/main/docs/adr/0025-service-ai-to-cloud-open-mcp-only.md).
 
-**Status**: Proposed (2026-06-22)
+**Status**: Proposed (2026-06-22) — cloud-owned (2026-07-16 audit): the framework spec dependencies shipped (`skill.surface` + `agent.surface` enums, `spec/ai/{skill,agent}.zod.ts`); the runtime two-agent split, shim removal, ask-rename and tenant-agent withdrawal live in cloud `service-ai` / objectui and are not verifiable in this repo.
 **Deciders**: ObjectStack Protocol Architects
 **Supersedes**: [ADR-0040](./0040-unified-assistant-and-agent-binding.md) — its core decision (a *single* unified assistant selected by *per-turn intent classification*) is **reversed**. ADR-0040's UX win ("the end user never picks from a roster") is **kept** but re-grounded: the *surface* binds the agent, not a classifier and not a dropdown. §3 (custom tenant agents) is withdrawn; §4 (tool-scoping) is handed to [ADR-0064](./0064-tool-scoping-to-agent.md).
 **Builds on**: [ADR-0033](./0033-ai-assisted-metadata-authoring.md) (draft → verify → publish), [ADR-0038](./0038-build-verification-loop.md) (verify-fix-reverify discipline carried by skills)

docs/adr/0064-tool-scoping-to-agent.md

@@ -2,7 +2,7 @@
 
 > **🔶 Cloud-owned — superseded in part by cloud ADR-0025 (2026-06-25).** The in-UI AI runtime and the `ask` / `build` agents described here moved to the **cloud / Enterprise** distribution (`@objectstack/service-ai` → `cloud/packages/service-ai`, closed); the open framework exposes AI only via `@objectstack/mcp` (BYO-AI) and ships no in-product `ask` / `build` chat. Retained as historical design context, now **cloud-owned** — see [`cloud/docs/adr/0025-service-ai-to-cloud-open-mcp-only`](https://github.com/objectstack-ai/cloud/blob/main/docs/adr/0025-service-ai-to-cloud-open-mcp-only.md).
 
-**Status**: Proposed (2026-06-22)
+**Status**: Proposed (2026-06-22) — cloud-owned (2026-07-16 audit): the only framework dependency (`skill.surface`) exists; the tool-resolution scoping, global fall-through removal, and bind-time affinity error live in cloud `service-ai` and are not verifiable in this repo.
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: [ADR-0063](./0063-two-kernel-agents-skills-are-the-extension-primitive.md) (two agents bound by surface; skill ↔ agent affinity), [ADR-0033](./0033-ai-assisted-metadata-authoring.md) (draft-gated authoring tools)
 **Resolves**: [ADR-0040 §4](./0040-unified-assistant-and-agent-binding.md) ("tools are registry-global; a custom agent can change persona but not constrain capability") — the named follow-up contract.