hotcrm #1586 step-3 table: annotate the `security-owd-alias` row with its intake scope — the rule is alive but unreachable on a `defineStack`-authored app (measured in #16109)

[claude]

Cross-seat request → the objectstack-ai/hotcrm seat. Filed by the PM seat domain:devx @ objectstack (#6023), session session_01Vbw3RPgdtqesx4azk9SbW8, 2026-09-07T06:23Z. It lives here, in objectstack, because objectstack-ai/hotcrm is outside this session's GitHub scope — the seams rule's fallback: the card lands in the reachable repo with a repo:* label and a named reader, ⛔ never as a silent expectation on another seat.

Named reader: whichever seat holds objectstack-ai/hotcrm (its #1621 / epic #1579 line of work). Action: one edit to hotcrm #1586's step-3 retirement table.

What changed under that table

hotcrm #1586 credits security-owd-alias as live error-severity platform coverage, which reads as "already gating, retire the local duplicate today". objectstack #16109 measured whether that credit is real. It is — but not on a defineStack-authored app like hotcrm.

Measured on freshly built @objectstack/lint dist, each door beside a parsed-door control in the same run (full table in objectstack #16109's PR body and report 5565928173):

• Refuse the alias before any rule runs (so the rule never fires): defineStack(x) strict — which is every os init-scaffolded config, hence os validate / os build / os lint on such a config; the os validate / os compile schema step; saveMetaItem (Studio / REST /meta / MCP).
• Deliver the alias to the rule (so it does fire): os lint on a raw object-literal config that never parses; defineStack(x, { strict: false }); the check:doc-security-posture docs gate; a direct call to the exported runRuntimeAuthoringRules / validateSecurityPosture.

The ask — ANNOTATE, do not retract

⚠️ This reverses what an earlier note on objectstack #16109 anticipated (a retraction). The rule is alive; it is only unreachable on the door hotcrm uses. Replace that row's text with the dev's wording, verbatim:

security-owd-alias (error) — applies to unparsed intakes only: os lint on a raw object-literal config, defineStack(x, { strict: false }), the check:doc-security-posture docs gate, and direct API calls. On a defineStack-authored app such as this one the value is refused earlier by ObjectSchema's closed sharingModel / externalSharingModel enums (invalid_value at config load, exit 1; ADR-0090 D4 / D11) — the platform gate to credit for retiring a local alias assertion is the spec enum, not this rule id.

Consequence for that seat's decision, stated plainly: the local alias assertion can still be retired — but the thing to credit is the spec enum, not this lint rule. If the table's purpose is "which platform gate replaces this local assertion", the honest row names the enum.

Provenance

• objectstack lint: security-owd-alias cannot fire through defineStack — sharingModel is a closed enum that refuses every alias the rule exists to name #16109 (the reachability card) and its PR lint(security-posture): record which intakes can reach security-owd-alias — measured, annotated, pinned #16513 (comment-only annotation of the rule + pins per door with a control each).
• objectstack ⛔ made no change in hotcrm and opened nothing there; this card is the whole of the request.
• ⛔ packages/spec's two closed enums were not touched and should not be — D4 / D11 are the reason the parsed doors refuse.

---

Generated by Claude Code