docs: add the North Star (the maintainer's text, verbatim) (#19134)

Fixes #19131

Clause-②: no

One new file — `docs/NORTH-STAR.md` — carrying the maintainer's North
Star text exactly as finalized in chat on 2026-09-18 (「同意,北极星定稿」 ·
「其他同意」). Nothing else moves: the pointers in `AGENTS.md` / `SKILL.md` /
`PRIORITIZATION.md` and the governed register belong to #18489, which
remains open.

Governed by intent — this page is meant to sit above `AGENTS.md` as the
fleet's law. Draft on purpose: the maintainer merges it by hand. No seat
readies it, queues it, or arms auto-merge on it.

## Byte-for-byte proof

The file's content is the fenced markdown block of #19131's body,
extracted mechanically and compared byte for byte. Card body read
through the REST proxy (4646 bytes); the extracted block is 3271 bytes
over 25 lines, with no trailing whitespace on any line and exactly one
terminating newline.

````text
# 1 — read the card body through the REST proxy
curl -sS -H "Authorization: Bearer $GITHUB_TOKEN" \
     -H "Accept: application/vnd.github+json" \
     https://api.github.com/repos/objectstack-ai/objectstack/issues/19131 > card.json
node -e 'process.stdout.write(JSON.parse(require("fs").readFileSync("card.json","utf8")).body)' > card-body.md

# 2 — extract the fenced block, dropping both fence lines
sed -n '/^```markdown$/,/^```$/p' card-body.md | sed '1d;$d' > card-block.md

# 3 — compare
$ diff card-block.md docs/NORTH-STAR.md
$ echo $?
0

$ sha256sum card-block.md docs/NORTH-STAR.md
b94152a07b9fd81aa59e019875aa5a53a00a7c058e53e098bb1b6f65ac6f67a8  card-block.md
b94152a07b9fd81aa59e019875aa5a53a00a7c058e53e098bb1b6f65ac6f67a8  docs/NORTH-STAR.md

$ git show HEAD:docs/NORTH-STAR.md | sha256sum
b94152a07b9fd81aa59e019875aa5a53a00a7c058e53e098bb1b6f65ac6f67a8  -
````

Two independent extractions were run — the `sed` range above and a
JSON-side split on the fence lines — and both produce the same sha256,
so the proof does not rest on one parser. The card body itself was
checked for sanitizer damage first: exactly one opening fence and one
closing fence, no image-bracket sequence, complete Markdown.

Nothing was reworded, reformatted, translated or annotated: no added
heading, date, number, provenance line, status line, table of contents
or footer, and no trailing-whitespace "fix".

## Gates

Derived, not guessed: `node scripts/pm/dispatch-gates.mjs --commands
--repo objectstack-ai/objectstack` (change set `docs/NORTH-STAR.md`, one
path, against merge base `14a762f9f`). All 11 derived families were run
at `37f1830fd`; every exit code captured redirect-then-`$?`, never
through a pipe.

| command | exit |
|:---|:---|
| `node scripts/check-ci-filter-parity.mjs` | 0 |
| `node scripts/check-closing-keyword-parity.mjs` | 0 |
| `node scripts/check-closing-keyword-parity.mjs --self-test` | 0 |
| `node scripts/check-comment-mask-corpus.mjs` | 0 |
| `pnpm --filter @objectstack/lint run check:doc-formula-expressions` |
0 |
| `pnpm check:cross-package-test-inputs` | 0 |
| `pnpm check:doc-authoring` | 0 |
| `pnpm check:driver-memory-census` | 0 |
| `pnpm check:nul-bytes` | 0 |
| `pnpm check:refd-timer-probe` | 0 |
| `pnpm check:watch-hint-literal` | 0 |

Reconciled with `dispatch-gates --ran`: *11 derived families accounted
for — 11 run, 0 NOT-MEASURED (a DERIVED zero — all 11 recorded an exit
code and none of them is 3)*.

Two readings worth naming:

- `check:doc-authoring` is the gate that actually reads this file: its
roots are `.claude`, `docs`, `skills`, `content`, so a hand-written
top-level guide under `docs/` is corpus. It reports *402 files clean —
no bare metadata literals*.
- `check:doc-formula-expressions` first exited **3** (PREREQUISITE NOT
MET — `@objectstack/lint` resolves to source but its compiled entry
point was absent). That is not a finding and measures nothing.
`@objectstack/formula` and `@objectstack/lint` were built through
`scripts/pm/os-verify-lock.sh` (VERDICT `command-exit 0`, both runs),
after which the gate passed: *22 record-scoped formula examples across
439 files / 1378 TS blocks judged clean*.

Outside the derivation, one extra docs audit was run for this doc-only
diff: `node scripts/docs-audit/check-affected-docs.mjs` :: exit 0.

No package build or package test is owed: `pnpm-workspace.yaml`'s globs
cover `packages/*`, its seven nested roots, `apps/*` and `examples/*` —
none of them reaches repo-root `docs/`, so this path belongs to no
workspace package and there is no affected set to build or test.

## Repo-wide lint, narrowed — with the three readings the narrowing
needs

Instead of the farm-wide `eslint . --no-inline-config`, this diff's lint
obligation is empty, and that is a measurement rather than a skip:

1. **Population, read off eslint's own config, not guessed:** every
`files:` entry in `eslint.config.mjs` targets
`**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}` or a narrower subset of those
extensions. No config object matches Markdown.
2. **File count, read off `--format json`:** `pnpm exec eslint
--no-inline-config --format json docs/NORTH-STAR.md` returns one entry
with `errorCount: 0` and the single message *"File ignored because no
matching configuration was supplied."* — the diff contributes **0**
linted files.
3. **Invariance for untouched files:** `eslint.config.mjs` is not in
this diff, and this repo runs one config that never enables type-aware
linting for any file (no `parserOptions.project`, no typed rules —
stated in the config's own header comment and true of every
`languageOptions` block, each carrying only `ecmaVersion` and
`sourceType`). A Markdown file outside the lint population therefore
cannot move the verdict on any file this diff does not touch.

Readings 1–3 were taken at `37f1830fd`, the final commit. `turbo ls
--affected` is deliberately **not** cited: with no base to compare
against in a fresh worktree it printed all 81 packages, which is a
fallback, not a reading.

## Changeset

`skip-changeset`, measured rather than assumed: an npm tarball can only
contain files inside its own package directory, and `docs/NORTH-STAR.md`
sits outside every workspace package (globs above). Cross-checked from
the other side — no package manifest in `packages/**`, `apps/**`,
`examples/**` or `skills/**` has a `files[]` entry referencing a `docs/`
path — and the repo-root manifest is `private: true`. Nothing published
moves, so there is no released surface for a changeset to describe.

## Acceptance notes

- *noted, not filed:* `AGENTS.md` Prime Directive #8 still sends readers
to `content/docs/concepts/north-star.mdx`, so after this lands two
north-star documents coexist until the pointers are rewired. That
rewiring — AGENTS.md, the skill files, `PRIORITIZATION.md` and the
governed register — is explicitly the other card's scope, and #18489
remains open as its carrier. Not filed as a defect: nothing is broken
today, and the successor is already queued.

## 维护者速读(草稿)

**改了什么**:新增一个文件 `docs/NORTH-STAR.md`,内容就是你 2026-09-18
在聊天里定稿的那段北极星文本,逐字节照搬(sha256 与卡面 fenced block 一致,diff 为空)。没有第二个文件改动。


**为什么改**:把这段定稿从聊天记录落成仓库里的一页,让它能被引用、被门禁读到、被后续的指针改动挂上。文本本身没有任何加工——没加标题、日期、编号、来源行、状态行、目录或页脚。

**风险与代价(含回滚)**:风险接近零——这是一页文档,不改任何代码或已发布产物,`skip-changeset`
已实测(不在任何包目录内)。回滚就是删这一个文件,无迁移、无依赖。唯一的暂态是:在 #18489 把指针改完之前,`AGENTS.md` 第 8
条仍指向旧的 `content/docs/concepts/north-star.mdx`,两页会并存一段时间。

**席位意见**:(留空,待席位定稿)


**你要做的**:读这一页,不同意的地方**直接删行或改行**——这是你的文本,不是我的草案,所以我没有替你改任何一个字。定稿后**由你手动合并**(按设计留作
draft:这页是 `AGENTS.md` 之上的法,没有任何 AI 席位会 ready、入队或武装它)。

---
_Generated by [Claude
Code](https://claude.ai/code/session_01BTeBejoPUvRHN8WdAJC6oF)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-elon-musk

docs/NORTH-STAR.md

@@ -0,0 +1,25 @@
+# ObjectStack 北极星
+
+**我们是什么**:一个应用开发平台;创业阶段。
+
+**给谁**:第三方开发者,AI 代理为主、人验收——AI 进入我们的元数据协议写应用,人看结果、拍板。应用的终端用户是企业里的业务人员,他们通过 Agent 和界面使用应用。
+
+**做出来的是什么**:**AI 原生的企业管理应用**——业务对象与记录、看数据的视图、能用的表单、真挡得住的权限、审批与自动化、经营报表、登录与身份、可对外的 API、文件、客户的语言,以及不写代码在运行中改应用。AI 原生的意思:应用自带一个能替用户操作它的 Agent——本仓(社区版)通过 MCP 把对象与动作暴露出去,用户接入自己的 Agent;企业版把 Agent 内置在用户界面里,那一半住 cloud 仓。缺任何一样就不是这个应用。这一行是定义,不是清单;每一项做到什么、怎么验证,在 `docs/qa/platform-checklist/`。参考实现 hotcrm。
+
+**什么算做好**:一个建在协议上的应用,过了验证才算做好——它的元数据对应的清单项在一次 run 里通过,`objectstack verify` 在它上面是绿的。没过验证的交付不算 done。
+
+**唯一的度量,那条路**:一个新的 AI 开发者(人在旁验收)从 `npm create objectstack` 出发:写元数据 → 本地跑起来、看到 → 验证响亮拒绝错的、放行对的 → 发布并装进一个环境 → 接一个 Agent(社区版走 MCP),让它在应用里完成一次真实业务操作 → 按客户一句话需求迭代一次。每周真走一遍,结果落一张 run record。第一个断掉的步骤就是当前的 P0;跑得通但结果错的是 P2。
+
+**优先级**:
+1. 安全与数据完整性永远最高,不等路。
+2. 路断了、或清单上的能力断了 ⇒ P0/P1;能跑但出错 ⇒ P2;不在路上、不在清单上 ⇒ p3 或不做。
+3. 产品仓还有开放的 P0/P1 时,任何车道不派 p2/p3 的工具卡、契约卫生卡;解锁产品 P0/P1 的仪器卡沿链继承其优先级。
+4. 因为写的是 AI、用的也是 AI:元数据既要 AI 能写——错的必须被响亮拒绝并给处方,永不静默落库;也要 AI 能用——声明了的对象、动作、agent / tool / skill 元数据在运行时兑现,MCP 面暴露的就是应用真能做的。写给 AI 的文档与 skills 说错一句,等于产品缺陷。
+
+**阶段姿态**:速度优先于兼容。用的人少:退役立即生效,无过渡窗口、无别名双拼;兼容层、迁移窗口一类的工作默认 p3;声明了但不兑现的键按发布批量退役,不一键一卡。
+
+**仪器为车队服务**:改 PM 协议、门禁、棘轮、技能的卡,以「它落地后车队的哪个决定或动作会不一样」评级——说得出(一次本来会派错的派发、一次落不了的落地、一次放过假货的复核、一个卡住的席位),就按上面的规则定级,与产品卡同场竞争;说不出,就不做。
+
+**现在不做**:云服务的旅程(注册、控制面、托管)另有自己的清单;企业版内置 Agent 属 cloud 仓,不在本仓的路与清单里;计费未建。
+
+**账本**:能力与验证的账本是 `docs/qa/platform-checklist/`,本页不复制它。本页不带任何数字;数字从命令来。