skills: teach the declared action override (an installed package's action renamed, hidden or adjusted through its .custom pair) and its access-widening refusal

domain:server#3 · os-bill · session_01Utp6CbPxYq1wQmUNWvMZkC

Filing gate: ③ a Skills-docs: follow-up owed line on PR #30497 (#30065), which the seat files before ACCEPT. ⛔ Not a claim. Triage sets lane and grade. Suggested-grade: p3.
Dedupe (open AND closed): declared action override skill, declared_action_widens_access → none. New.
type: Docs

What changes when PR #30497 lands

action joins the declared-override types (ADR-0146 D9): an installed package's action can be overridden through its paired <base>.custom package with overrides: { package, basedOn }, served wherever the action is drawn or run, and removed to restore the base.
An override that widens who may run the action is refused at save: requiredPermissions may only grow, ai.exposed may not go false → true, requiresConfirmation may not go true → false (rule declared_action_widens_access, 403 NOT_OVERRIDABLE). Behaviour fields (type, target, body, params, label, visible, …) may be replaced whole.

Wanted

skills/objectstack-platform/SKILL.md (and any reference page it routes to for overrides) teaches the action override next to the existing flow/view override guidance, with the three widening refusals and the fact that the override's body runs for the people who could already run the base action.
The package's skill evals exercise it if the skill's convention requires it.

Reader: domain:skills (skills/** is a governed surface). Links: #30065, PR #30497.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: audit · p3 · `domain:skills` · 2026-11-05T14:05Z

⛔ Not a claim.

A skills follow-up owed by PR feat(metadata-protocol,objectql): open the declared override for a package's action (ADR-0146 D9) #30497 (Action customization: open the declared override for a package's action, so a customer can rename, hide or adjust a button #30065): teach the declared action override and its declared_action_widens_access refusal. A skills/** change carries an '@objectstack/skills': patch changeset.
p3 as suggested. Serial after PR feat(metadata-protocol,objectql): open the declared override for a package's action (ADR-0146 D9) #30497. The domain:skills lane is offline on the maintainer's order, so this card waits.

Generated by Claude Code

domain:server#3 · os-bill · session_01Utp6CbPxYq1wQmUNWvMZkC

Scope addition from PR #30612 (#30542), contract review 6665887696 (Skills-docs: follow-up #30505). Not a claim.

Teach that a declared action override keeps the base action's objectName. Every door (the save and publish doors, os validate, the managed install) matches the base's action by OBJECT:NAME. An override that moves the action to another object is refused 403 NOT_OVERRIDABLE with rule declared_package_ships_no_such_item.
content/docs/concepts/metadata-lifecycle.mdx lines 132–134 still say that an action override waits for ADR-0146 D9's conditions and is not served yet. That has been false since PR feat(metadata-protocol,objectql): open the declared override for a package's action (ADR-0146 D9) #30497 (bcdf8d34). Correct it in the same docs change.

domain:skills#1 · os-elon-musk · session_016WV4d1mkgEris4MHHLjtnk

Claim: PM loop round 1 · 2026-11-05T21:57Z
Session: session_016WV4d1mkgEris4MHHLjtnk
Account: os-elon-musk (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/project-thread-7vwgvw (the card thread's designated branch; dev session session_016WV4czCxwMepBDxUtozyne, amended by the seat)
Worktree: objectstack-issue-30505
Domain: domain:skills
Seat: domain:skills#1
File surface: skills/objectstack-platform/SKILL.md (the ADR-0146 customization paragraph, ~L128) and any reference page it routes to for overrides, skills/objectstack-platform/evals/** if owed, content/docs/concepts/metadata-lifecycle.mdx (~L132-134, the stale action sentence), one root .changeset/ file. ⛔ packages/**, ⛔ docs/adr/** (stop on breach)
Container & model: M, mode:thread, model: TIER_DEFAULT (dispatch-gates --tier: MANDATORY CONTRACT_REVIEW_TIER for skills/** clause ①; exit taken = the proactive low-headroom downgrade under the maintainer's standing posture of this project: develop on the default tier, the contract-review tier runs the final contract review; the compensating control is the seat's at-tier review before ACCEPT), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (a Skills-docs: follow-up of landed work)
Thread-read: 6665908890
Premise: holds: PR #30497 merged 2026-11-05T16:15Z and PR #30612 merged 19:14Z; SKILL.md L128 lists no action and the docs page still says it is not served, on origin/main b77c160a
Serial constraints cleared: none: no open PR touches skills/** or that docs page (36 open PRs read at claim time). Next on skills/objectstack-platform/** after this card: #30092, #30275 (serial)

Tier H (skills/**): draft until a governed approver approves; the seat's at-tier contract review precedes ACCEPT.

Generated by Claude Code

domain:skills#1 · os-elon-musk · session_016WV4czCxwMepBDxUtozyne
os-dev-report

{
  "issue": 30505,
  "status": "done",
  "branch": "claude/project-thread-7vwgvw",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/30704",
  "session": "session_016WV4czCxwMepBDxUtozyne",
  "premise_still_valid": true,
  "summary": "skills/objectstack-platform/SKILL.md lists `action` among the types a .custom pair's declared override is honoured for, and one sentence teaches the action override: it keeps the base's objectName (OBJECT:NAME identity; another object is refused declared_package_ships_no_such_item), replaces behaviour whole for whoever could already run the base, and dropping a requiredPermissions entry, turning ai.exposed on or ai.requiresConfirmation off is refused 403 NOT_OVERRIDABLE with rule declared_action_widens_access. content/docs/concepts/metadata-lifecycle.mdx drops the stale 'not served yet' sentence and states the same rules. Evals: new case 15, case 13's type list gains action. Facts read off origin/main b77c160a (customization-package.ts OVERRIDE_TYPE_CLASSIFICATION.action; protocol-packaged-base-refusal.ts actionOverrideWidening and the refuse calls). The card's 'requiresConfirmation' is spelled ai.requiresConfirmation in code, so the skill spells it that way.",
  "tests": "No code changed, so there is no test suite to run and nothing to ablate. Teaching-text gates only, run on head 17e0285f (git rev-parse --short HEAD) after a whole-tree turbo build (os-verify-lock VERDICT command-exit 0).",
  "gates": "dispatch-gates --commands: 70 families, all exit 0, and pnpm lint exits 0, all on 17e0285f. dispatch-gates --ran: 70 derived, 70 run, 0 NOT-MEASURED, 0 UNRUN. The first sweep, on ea0dcdad, was red on check:skill-top-level-keys (exit 1): a compression had reworded the PAGE_CONTRACT sentence that gate quotes. It was restored in 17e0285f and the bytes were paid elsewhere. CI check-runs: in_progress when this report was written.",
  "line_budget": {
    "file": "skills/objectstack-platform/SKILL.md",
    "lines_before": 426,
    "lines_after": 413,
    "tokens_before": 6009,
    "tokens_after": 6010,
    "ceiling": 6011,
    "ceiling_raised": false,
    "package_skill_md_lines_before": 4534,
    "package_skill_md_lines_after": 4521,
    "package_skill_md_tokens_before": 56667,
    "package_skill_md_tokens_after": 56668,
    "paid_by": "same-file deletion of words (no re-wrap): tighter customization-paragraph wording, strict:false fence inlined, pointer stubs merged and 'Moved verbatim to' cut to 'See', two low-information observations dropped"
  },
  "files_changed": [
    ".changeset/30505-skills-declared-action-override.md",
    "content/docs/concepts/metadata-lifecycle.mdx",
    "skills/objectstack-platform/SKILL.md",
    "skills/objectstack-platform/evals/config-plugins-ops.json"
  ],
  "deviations": [
    "Development ran on the session's default model. The seat names this its recorded exit (it runs the contract-review-tier review before ACCEPT), so it is not a deviation.",
    "The eval file is outside the ratchet, so case 15 costs no tokens."
  ],
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "4 — mcp__github__issue_read x2 (get, get_comments on #30505), mcp__github__pull_request_read x1 (get #30497); ToolSearch load excluded; no write tool",
  "api_writes": "3 — git push x2 (not REST); relay pr_create x1 (repository_dispatch, PR #30704); this os-dev-report comment via post-stamped is the 4th relay write",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "carrier: none · noted in PR acceptance notes, not filed — content/docs/concepts/metadata-lifecycle.mdx L208 (ADR-0126 table) names only the switch-off route for a packaged action (still true per packaged-base-regime.ts) and does not mention the declared override; outside this card's line surface"
  ]
}

domain:skills#1 · os-elon-musk · session_016WV4d1mkgEris4MHHLjtnk

ACCEPT → PR #30704 comment 6671904319 (head 17e0285f), contract review PASS 6671703593. Tier H: awaiting a governed approver.

Navigation Menu

Repository navigation

skills: teach the declared action override (an installed package's action renamed, hidden or adjusted through its .custom pair) and its access-widening refusal #30505

What changes when PR #30497 lands

Wanted

Triage: audit · p3 · `domain:skills` · 2026-11-05T14:05Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

skills: teach the declared action override (an installed package's action renamed, hidden or adjusted through its .custom pair) and its access-widening refusal #30505

Description

What changes when PR #30497 lands

Wanted

Activity

objectstack-fleet commented on Nov 5, 2026

Triage: audit · p3 · domain:skills · 2026-11-05T14:05Z

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: audit · p3 · `domain:skills` · 2026-11-05T14:05Z