feat(app-showcase): declarative private-OWD scenario + dogfood proof (ADR-0056)

First execution increment of ADR-0056: demonstrate the declarative owner-private
capability on the real showcase. `showcase_private_note` declares
`sharingModel: 'private'` + an `owner_id` field and NOTHING else — no RLS, no
predicate, no permission-set rule. The engine derives owner scoping from the OWD
baseline + auto-stamped owner_id.

Proof (`showcase-private-owd.dogfood.test.ts`, 5/5, real HTTP): two plain sign-ups
each create notes; each lists only their own, cannot read/write another owner's by
id, can write their own — owner_id auto-stamped, zero authored RLS. Full dogfood
11 files / 86 tests; showcase units 20.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XVdnfUAx85amkerym26vdx

Author: claude

.changeset/showcase-private-owd.md

@@ -0,0 +1,15 @@
+---
+"@objectstack/example-showcase": minor
+---
+
+feat(app-showcase): declarative owner-private object (`showcase_private_note`, ADR-0056)
+
+Adds the canonical **declarative `private` OWD** scenario: `showcase_private_note`
+declares `sharingModel: 'private'` and an `owner_id` field — and nothing else (no
+RLS policy, no owner predicate, no permission-set rule). The engine derives owner
+scoping from the OWD baseline + the auto-stamped `owner_id`, so a user sees and
+edits only the notes they own. This is the declarative counterpart to the invoice's
+hand-written `owner = current_user.email` escape-hatch — for plain "my records are
+mine" ownership, an object declares one word and the platform enforces it. Proven
+end-to-end (two users, owner isolation on read + by-id read/write) by the new
+`showcase-private-owd` dogfood test.

examples/app-showcase/src/objects/index.ts

@@ -8,3 +8,4 @@ export { Team, ProjectMembership } from './team.object.js';
 export { Product, Invoice, InvoiceLine } from './invoice.object.js';
 export { FieldZoo } from './field-zoo.object.js';
 export { Preference } from './preference.object.js';
+export { PrivateNote } from './private-note.object.js';

examples/app-showcase/src/objects/private-note.object.ts

@@ -0,0 +1,38 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+import { ObjectSchema, Field } from '@objectstack/spec/data';
+
+/**
+ * Personal Note — the canonical OWNER-PRIVATE object (ADR-0056, declarative OWD).
+ *
+ * It declares `sharingModel: 'private'` and nothing else: no hand-written RLS
+ * policy, no owner predicate, no permission-set rule. The engine derives owner
+ * scoping from the Org-Wide-Default baseline + the auto-stamped `owner_id` — a
+ * user sees and edits only the notes they own.
+ *
+ * This is the declarative counterpart to the invoice's hand-written
+ * `owner = current_user.email` escape-hatch (PR #2054): for plain "my records
+ * are mine" ownership, an object declares ONE WORD and the platform enforces it.
+ * The corresponding dogfood proof (`showcase-private-owd.dogfood.test.ts`) shows
+ * two users each seeing only their own notes through the real HTTP stack.
+ */
+export const PrivateNote = ObjectSchema.create({
+  name: 'showcase_private_note',
+  label: 'Personal Note',
+  pluralLabel: 'Personal Notes',
+  icon: 'lock',
+  description: 'A private journal entry visible only to its owner — declarative `private` OWD (ADR-0056).',
+
+  // The entire access policy: owner-private. No RLS authored anywhere.
+  sharingModel: 'private',
+
+  fields: {
+    title: Field.text({ label: 'Title', required: true, searchable: true, maxLength: 160 }),
+    body: Field.text({ label: 'Body', maxLength: 2000 }),
+    pinned: Field.boolean({ label: 'Pinned', defaultValue: false }),
+    // Owner anchor — auto-stamped to the creating user on insert; the `private`
+    // OWD reads it to scope visibility. Authors declare the field; the engine
+    // fills it (no manual assignment, no predicate).
+    owner_id: Field.lookup('sys_user', { label: 'Owner' }),
+  },
+});

packages/dogfood/test/showcase-private-owd.dogfood.test.ts

@@ -0,0 +1,84 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// ADR-0056 — declarative `private` OWD proof on the REAL showcase app.
+// `showcase_private_note` declares `sharingModel: 'private'` and NOTHING else:
+// no RLS policy, no owner predicate, no permission-set rule. Two plain sign-ups
+// (governed only by the default member set) each create notes; the engine scopes
+// every read/write to the owner purely from the OWD baseline + the auto-stamped
+// `owner_id`. This is the canonical "declare one word, get owner isolation"
+// capability — proven end-to-end through the real HTTP stack.
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import showcaseStack from '@objectstack/example-showcase';
+import { bootStack, type VerifyStack } from '@objectstack/verify';
+
+const OBJ = '/data/showcase_private_note';
+const idOf = (b: any) => b?.id ?? b?.record?.id ?? b?.data?.id ?? b?.recordId;
+
+describe('showcase: declarative private OWD (ADR-0056)', () => {
+  let stack: VerifyStack;
+  let aToken: string;
+  let bToken: string;
+  let aNoteId: string;
+  let bNoteId: string;
+
+  beforeAll(async () => {
+    stack = await bootStack(showcaseStack);
+    await stack.signIn(); // seed dev admin (first user)
+    aToken = await stack.signUp('owd-alice@verify.test');
+    bToken = await stack.signUp('owd-bob@verify.test');
+
+    const a1 = await stack.apiAs(aToken, 'POST', OBJ, { title: 'Alice private 1', body: 'a-body' });
+    expect(a1.status, 'alice creates note').toBeLessThan(300);
+    aNoteId = idOf(await a1.json());
+    await stack.apiAs(aToken, 'POST', OBJ, { title: 'Alice private 2' });
+
+    const b1 = await stack.apiAs(bToken, 'POST', OBJ, { title: 'Bob private 1' });
+    expect(b1.status, 'bob creates note').toBeLessThan(300);
+    bNoteId = idOf(await b1.json());
+
+    expect(aNoteId, 'alice note id').toBeTruthy();
+    expect(bNoteId, 'bob note id').toBeTruthy();
+  }, 60_000);
+
+  afterAll(async () => { await stack?.stop(); });
+
+  it('owner_id is auto-stamped (no manual assignment, no predicate)', async () => {
+    const ql: any = await stack.kernel.getServiceAsync('objectql');
+    const row = await ql.findOne('showcase_private_note', { where: { id: aNoteId }, context: { isSystem: true } });
+    expect(row?.owner_id, 'owner_id stamped to a real user id').toBeTruthy();
+  });
+
+  it('a member LISTS only the notes they own', async () => {
+    const r = await stack.apiAs(aToken, 'GET', OBJ);
+    expect(r.status).toBe(200);
+    const body: any = await r.json();
+    const titles: string[] = (body.records ?? body.data ?? body ?? []).map((x: any) => x.title);
+    expect(titles).toContain('Alice private 1');
+    expect(titles).toContain('Alice private 2');
+    expect(titles).not.toContain('Bob private 1'); // owner isolation, no RLS authored
+  });
+
+  it('a member cannot READ another owner’s note by id', async () => {
+    const r = await stack.apiAs(aToken, 'GET', `${OBJ}/${bNoteId}`);
+    expect(r.status, 'alice must not read bob note').not.toBe(200);
+  });
+
+  it('a member cannot WRITE another owner’s note, but can write their own', async () => {
+    const foreign = await stack.apiAs(aToken, 'PATCH', `${OBJ}/${bNoteId}`, { body: 'hacked' });
+    expect(foreign.status, 'alice must not edit bob note').not.toBeLessThan(300);
+
+    const own = await stack.apiAs(aToken, 'PATCH', `${OBJ}/${aNoteId}`, { body: 'updated' });
+    expect(own.status, 'alice edits her own note').toBeLessThan(300);
+  });
+
+  it('the OTHER member is symmetric (bob sees only his own)', async () => {
+    const r = await stack.apiAs(bToken, 'GET', OBJ);
+    const body: any = await r.json();
+    const titles: string[] = (body.records ?? body.data ?? body ?? []).map((x: any) => x.title);
+    expect(titles).toContain('Bob private 1');
+    expect(titles).not.toContain('Alice private 1');
+    const foreign = await stack.apiAs(bToken, 'GET', `${OBJ}/${aNoteId}`);
+    expect(foreign.status).not.toBe(200);
+  });
+});