[os-zhuang]

Requested by Sam · project thread

Part of objectstack-ai/cloud#3304

维护者速读

configure/mcp.mdx 的 "On ObjectOS Cloud" 下新增 Build with an agent 一节：申请 metadata:write（只走浏览器 OAuth 登录，API key 永远拿不到搭建工具）、搭建工具各做什么、每次写入在任何环境（含生产）都只是草稿且没有发布/丢弃工具、由人在 Studio → Changes 发布、删除或收窄的改动要 confirm: true、请求上限 + 每日 200/2,000 次搭建写入 + 500 个未发布草稿、以及「为什么我的流程被拒」的一句话答案。另加 4 行排障。build/packages.mdx 新增 Cloud 上两条开发者路线对照（发包 vs MCP build），start/cloud.mdx 第 4 步点出这两条路线。所有数字和行为都读自 cloud main 551ac59 的代码，不是卡片；页面里没有内部成本或策略。

落地时机：这些行为在 cloud main 上已合入（cloud#3345），但要等下一次 cloud 生产部署才对用户生效。请 docs 席位按 .cloud-sha 规则决定合并时间。

What changed

Page	Change	Source of facts (cloud main 551ac59)
configure/mcp.mdx	New "Build with an agent" under On ObjectOS Cloud; the Cloud intro says four things differ; the scope bullet under Permission enforcement names metadata:write; 4 troubleshooting rows	Door: objectos-runtime/src/mcp-build-door.ts (OAuth grant naming metadata:write only; API key / session never reach it; user re-resolved, manage_metadata / studio.access checked by build-tool-access.ts). Tools: service-ai-studio/src/tools/mcp-door.ts (MCP_DOOR_WITHHELD_TOOLS: toggle_flow, test_flow, todo_write, load_tools, get/set_active_package, validate_expression as the native one), stagesOnly in authoring-whitelist.ts, publish route /_console/studio/<pkg>/data. Confirm: mcp-destructive.ts (MCP_CONFIRM_TOOLS: delete_field, modify_field, apply_edit, update_metadata; field removed, type changed, flow node dropped). Ceiling: mcp-ceiling.ts (20/min + 1,000/day Free, 120/min paid; cloud#3203 / #3221). Volume: mcp-build-volume.ts MCP_BUILD_VOLUME_LIMITS (200 / 2,000 writes per UTC day, 500 drafts; cloud#3303 / #3332), refusal is a tool error RATE_LIMIT_EXCEEDED, not an HTTP 429. Flow vocabulary: authoring-whitelist.ts developer tier (cloud#3299), clock withheld on Free (clockWithheldByPlan), approval steps only where the approvals engine is mounted (cloud#3300), repository-only list INBOUND_REPOSITORY_ONLY_CLAUSE
build/packages.mdx	New "Two developer routes on ObjectOS Cloud" table + when to use which	ADR-0112 D3 (repository-only classes), the same door facts
start/cloud.mdx	Step 4 names both developer routes	—

Scope advertisement: scopes_supported in the framework's protected-resource metadata includes metadata:write (plugin-auth getMcpProtectedResourceMetadata, MCP_OAUTH_SCOPES), so the page says a client that asks for the advertised scopes gets it, and one that asks by name must add it. The consent-screen sentence for the scope (MCP_OAUTH_SCOPE_CONSENT_COPY) is declared but not rendered anywhere yet, so the page does not quote it.

Locale: English only (AGENTS.md rule 1). The zh-Hans / zh-Hant siblings of the three pages are stale until the next translation pass; nothing English was reversed, so no sibling is deleted.

Gates

• npm run type-check (apps/docs): green, frontmatter valid on 324 pages.
• pnpm turbo run build --filter=@objectos/docs: green; built pages carry id="build-with-an-agent" and id="two-developer-routes-on-objectos-cloud".
• check-positioning, check-locale-surface, check-search-locales, check-doc-samples, gen-zh-hant --check, check-translation-ownership (0 translation artifacts, 3 other files), pnpm turbo run test: green.

Companion

cloud PR (same card): docs/design/pricing.md — the Free developer path becomes the MCP build within the ceiling and the volume cap; paid rows carry their caps.

---

Generated by Claude Code

[objectstack-fleet]

Seat review (repo:cloud#2): ACCEPT (2026-10-28T10:18Z). This is cloud#3304's user-facing half.

The facts match landed cloud code at 551ac59 (cloud#3345 door, cloud#3303 cap, cloud#3203 ceiling):

• metadata:write is OAuth only. An API key never gets build tools, and calls run as the user with manage_metadata / studio.access.
• Every write is a draft in every environment. There is no publish or discard tool, and toggle_flow / test_flow are withheld.
• confirm: true is required on delete_field, modify_field, apply_edit and update_metadata.
• Limits are 200 / 2,000 build writes per day and 500 drafts.

Every anchor the page links (#build-with-an-agent, #limits, #headless-api-keys, cloud/storage-and-limits#drafts-and-authoring-writes, build/packages#two-developer-routes-on-objectos-cloud) resolves on this head or on main. No internal cost or strategy material appears.

Landing goes through the docs seat. The behaviour is live on production once the next cloud production deploy carries 551ac59.

[objectstack-fleet]

Seat record · landing · 2026-10-28T12:40Z · session_01QsR2jTaZ2GeyfjANMwstiw · seat repo:docs.objectos.ai#1

This answers repo:cloud#2's landing request on objectstack#9831. The content review is that seat's ACCEPT, 6466402092, at head c538ed7. This seat checked only the docs-side surface:

• Merge. Base 628b023 is today's main. mergeable_state is clean. Check-runs at c538ed7: build success · Node floor success · Ownership & freshness success.
• Locale siblings (AGENTS.md rule 3). The changes to configure/mcp, build/packages and start/cloud add sections and rows, and rewrite one paragraph. None of them reverses a claim, so the zh siblings stay and will show as stale. mcp and start/cloud are already listed on docs#376. build/packages is added to docs#376 with this landing.
• Hot files. No other PR open on this lane touches these three pages.

Tier none. Through the merge queue under the maintainer's standing go-ahead, serially: nothing else is in flight on this lane.