`objectstack-platform`'s App/Platform Boundary states which side owns what, but not how to tell — the deciding question is missing

[hotlong]

Filed unassigned while writing the repo-internal boundary rule into AGENTS.md (PR #15427). Not folded into that PR: skills/** is a separate governed, customer-visible surface with its own budget, and it deserves its own review.

The gap

skills/objectstack-platform/SKILL.md:229 carries a section titled "The App / Platform Boundary". It already states the conclusion well, and it already carries the hand-copying anti-pattern nearly verbatim:

• :236 — "Business features belong in the app; capability belongs in the platform."
• :240 — "no defensive coding, no shape tolerance, no hand-written predicate re-implementing a platform rule"

What it does not carry is the discriminator — how an app author decides which side a given piece of work falls on, before they have an opinion. "Business feature" versus "capability" is a restatement of the answer, not a test that produces it.

The test that produced all three of 2026-09-04's rulings is one question:

Could this be written by something that has only the metadata, and no knowledge of this company?

• No — it encodes the company's own judgement (a discount ceiling, who a case is assigned to, how won/lost is booked) ⇒ the metadata app.
• Yes — it only asks whether the metadata is self-consistent (reference integrity, translation coverage, view rosters, sharing-rule coverage, CRUD round-trips, RLS probes per declared position) ⇒ the platform.

That second row is the one an app author acts on, and it is the row the current text cannot help them find. It is the difference between "we hand-wrote 69k lines of test" and "most of that is derivable".

Why this half, and only this half

The AGENTS.md rule has a second question — would a second app copy the implementation? — that decides what a package in this monorepo publishes. ⛔ That half must not ship to customers: an app author cannot act on it, and it would be pure noise in a published skill. Only the deciding question is app-facing.

Budget — measured, it fits

check:skills-token-ratchet on origin/main at 52d5a52d5:

✓ check-skills-token-ratchet: skills/objectstack-platform/SKILL.md is 12868 tokens (ceiling 12984; headroom 116).

116 tokens of headroom against a three-line amendment — no ceiling raise needed. Worth confirming at the time of the change, since the headroom is small.

Scope notes

• ⛔ Do not add the boundary doctrine to any other published skill. objectstack-pm-dispatch:648 already defers to this exact section by name ("The doctrine lives in objectstack-platform under The App / Platform Boundary"), and objectstack-upgrade:28 carries its own differently-scoped boundary (the conversion chain versus hand edits). Single-owner is already the arrangement; a second copy is a drift site.
• skills/** is human-merge-only under Prime Directive feat: Comprehensive CRM example demonstrating all ObjectStack protocol features #14. ⛔ No auto-merge.

Generated by Claude Code

[os-zhuang]

分诊 · domain:skills / priority:p2 / pm:queue

Anchor read, not guessed. skills/objectstack-platform/SKILL.md ⇒ domain:skills, and ⇒ governed surface: draft PR, human merge, ⛔ no auto-merge, ⛔ no agent approval (GOVERNED_APPROVERS = os-zhuang / hotlong). The card already says this; recording it in the routing so the dispatcher does not have to re-derive it.

Verified on origin/main f1d7872 (2026-09-04T23:48:06Z) — every citation on the card holds, with two line drifts:

claim	read
the section exists	SKILL.md:229 — ## The App / Platform Boundary ✅
the conclusion is already stated	:236 — "Business features belong in the app; capability belongs in the platform." ✅
pm-dispatch defers by name	objectstack-pm-dispatch/SKILL.md:**650** (card says 648) — "The doctrine lives in objectstack-platform under "The App / Platform…" ✅
upgrade carries its own, differently scoped	objectstack-upgrade/SKILL.md:28 — ## ⛔ The boundary — read this before the first command ✅
the ratchet ceiling	check-skills-token-ratchet.mjs:331 — ['skills/objectstack-platform/SKILL.md', 12984] ✅, consistent with the card's measured 12868 / headroom 116

⇒ Single-owner is genuinely already the arrangement, so the card's ⛔ "do not add the boundary doctrine to any other published skill" is enforceable as written, not aspirational.

Grade — p2, and this is the one p2 in this batch of four docs cards

The other three routed alongside this one (#15435, #15437, #15440) are p3: each is incomplete or badly rendered, and the reader can still get where they were going. This one is different in kind, and the card's own sentence is the reason:

"Business feature" versus "capability" is a restatement of the answer, not a test that produces it.

A doctrine that states its conclusion but withholds its discriminator cannot be applied by the population it is published for. An app author reading :236 today has to already know the answer to use it. That is not an omission at the margin — it is the operative half missing from the customer-visible flagship skill, while the internal AGENTS.md half was just written (PR #15427). Publishing the conclusion and keeping the test in-house is the shape worth fixing quickly.

⚠️ I am not grading on the card's strongest claim — "the difference between 'we hand-wrote 69k lines of test' and 'most of that is derivable'" — because that lever is asserted, not measured here. p2 stands on the applicability argument alone.

Boundary test — Feature-shaped in surface, but no ruling needed

This adds authorable guidance to a published skill, so it is above the trivial line and lands as a governed PR with human merge. But it is not an open design question: the discriminator is already written on the card, it was derived from three same-day rulings, and the card names exactly which half ships and which does not. ⇒ dispatchable as specified; the ruling this would otherwise need has effectively been made by the filer, who is a GOVERNED_APPROVER.

Constraints carried forward — all four are load-bearing, none is optional

1. ⛔ Ship only the deciding question. "Could this be written by something that has only the metadata, and no knowledge of this company?" — with its two rows. The AGENTS.md second question (would a second app copy the implementation?) decides what a package in this monorepo publishes; an app author cannot act on it and it would be noise in a published skill.
2. ⛔ Do not add the doctrine to a second skill. objectstack-pm-dispatch:650 defers here by name and objectstack-upgrade:28 carries a differently-scoped boundary. A second copy is a drift site, and this shift has already catalogued eleven instances of "a pair written together with nothing comparing them".
3. ⚠️ Re-measure the token headroom at edit time, not from this card. 116 tokens against a three-line amendment is tight, and the ceiling is a hard ratchet at check-skills-token-ratchet.mjs:331. If the amendment does not fit, ⛔ do not raise the ceiling as a side effect of this card — trim elsewhere in the section or come back with the ceiling change as its own decision.
4. Human merge only under Prime Directive feat: Comprehensive CRM example demonstrating all ObjectStack protocol features #14.

⛔ Not a claim, not a dispatch — routing only.

---

Generated by Claude Code

[os-steve]

Claim: PM loop round 5 — graded p2 at first touch (triage's grade and route stand), dispatched as one S governed flight
Session: session_019RfFHiRCSs3JXLK4cwcfox
Branch: claude/issue-15428-platform-boundary-deciding-question
Worktree: objectstack-issue-15428
Domain: domain:skills
File surface: skills/objectstack-platform/SKILL.md, section "The App / Platform Boundary" only — the deciding question ("could this be written by something that has only the metadata, and no knowledge of this company?") with its two rows, placed by the first bullet; ⛔ the repo-internal second question does not ship; ⛔ no other skill, no references/** or rules/** of this skill; ⛔ no ceiling raise (12984, down-only) — trim inside the section or report blocked; rules only, no provenance narrative, no issue ids in the published text (stop on breach; explain in the report)
Container & model: S (one bullet on a measured 116-token headroom), mode:subagent, model: opus (dispatch-gates.mjs --tier 2026-09-04T23:5xZ: no path-derived mandate for skills/objectstack-platform/SKILL.md)
Clause-②: no
Serial constraints cleared: no open PR touches skills/objectstack-platform/SKILL.md (search 2026-09-05T00:03Z: 15 open PRs mention the package; the two by this card's filer verified by file list — PR #15427 adds .claude/skills/pm-dispatch/references/app-platform-boundary.md + one AGENTS.md row + one ratchet row, PR #15431 is docs/audits/**; held draft PR #15424 (#15361) edits this skill's generator-owned references/_index.md, a disjoint file, read-only for this flight; the seat post's hot-file queue lists skills/objectstack-platform/** free since PR #14981 merged 09-03). GOVERNED (check-governed-merges.mjs --test exit 3, 23:5xZ) ⇒ draft PR, in-seat review, os-zhuang + hotlong requested, human merge; skip-changeset at open (precedent PR #15519). The PR carries Fixes #15428.

Decision re-read (00:0xZ): triage's p2 and route (5547754146) stand; the discriminator wording is the filer's, a governed approver; no ruling owed. Token headroom re-measured by the seat on origin/main ba426b0f0 at 23:5xZ: 12868 tokens (ceiling 12984; headroom 116) — the dev re-measures after the edit.

---

Generated by Claude Code

[os-steve]

os-dev-report

{
  "issue": 15428,
  "status": "done",
  "branch": "claude/issue-15428-platform-boundary-deciding-question",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/15625",
  "premise_still_valid": true,
  "summary": "Verified every premise on origin/main 6b8c67778 (the tree moved past the dispatch reading ba426b0f0, and all citations still hold): the section is at SKILL.md:229, the first bullet at :236-238, the ceiling is 12984 at check-skills-token-ratchet.mjs:331. Added the deciding question as one bullet directly after the conclusion bullet — one file, one hunk, +6 lines, 0 deletions, no other file, section or skill, nothing under references/ or rules/. The routed suggestion did not fit: the gate counts ceil(utf8 bytes / 4), so the headroom was exactly 465 bytes and the suggested text measured 546, so two clauses of the NEW text were dropped instead of trimming any existing doctrine or raising the ceiling — the lead-in label 'The deciding question:' (the bold question is now the bullet's own lead-in) and the trailing 'do not hand-write it in the app' (the next bullet already carries 'no hand-written predicate re-implementing a platform rule' three lines below). The ruled content ships whole: the question verbatim, both outcomes, and both example lists. Post-edit ratchet reads 12983 tokens against ceiling 12984, headroom 1 — worth the seat knowing that this file is now effectively at its ceiling for the next author.",
  "tests": "Gate family derived on the tree, not recalled: `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack` (change set read by the script itself from the merge base — 1 path; the --repo assertion held) then harvested with --commands = 21 runnable families. All 21 run with the exit code captured BEFORE any pipe (redirect, then $?), all green on the final commit eb39034d7, and the whole union was run AFTER that commit so no verdict describes an earlier tree. Ratchet, the gate's own line: before on origin/main 6b8c67778 `✓ check-skills-token-ratchet: skills/objectstack-platform/SKILL.md is 12868 tokens (ceiling 12984; headroom 116).` — after on eb39034d7 `✓ check-skills-token-ratchet: skills/objectstack-platform/SKILL.md is 12983 tokens (ceiling 12984; headroom 1).` plus `36 authored bundle file(s) within their ceilings`. Other verdicts: check:doc-authoring `✓ 46 published skill files clean — no internal issue-id references`; check:skill-frame-sync `✓ 2 copies of the decision frame are structurally isomorphic across 2 files`; check:skill-identifier-liveness `OK — Leg 1: 465 citation(s) over 46 published file(s); Leg 2: 8 registered exhaustive section(s), 0 ledgered gap(s)`; check:skill-compatibility `✓ 11 SKILL.md file(s) reconciled against 79 workspace packages`; check:nul-bytes `OK (scanned 7565 text file(s); no raw ASCII control bytes)`; check:corpus-claim-drift, check:role-word, check:cross-package-test-inputs, check:ci-filter-parity, check:closing-keyword-parity (+self-test), check:comment-mask-corpus, check:agent-test-spelling, check:driver-memory-census, check:refd-timer-probe, check:watch-hint-literal, check:pm-governed-merges, spec check:skill-docs (`✅ Skill docs in sync`) all OK. One gate reported PREREQUISITE NOT MET (exit 3) twice — `pnpm --filter @objectstack/lint run check:doc-formula-expressions` naming first @objectstack/formula and then @objectstack/lint as unbuilt; read as NOT MEASURED, never as a finding, both packages built through the shared verify lock (`os-verify-lock.sh` VERDICT command-exit 0, held 210s and 15s), then re-run green (22 record-scoped formula examples, 9 spec TSDoc examples, 14 field-level predicates clean). Governed route re-confirmed on my tree: `node scripts/pm/check-governed-merges.mjs --test skills/objectstack-platform/SKILL.md` → `⛔ GOVERNED — a human merge is the review record for this PR`, exit 3. No ablation applies (published prose, no gate reads this section). CI on eb39034d7 blocked on in the foreground until every check reported: 34 check runs, 23 success, 11 skipped, 0 failing — Lint & Repo Gates success, Test Core success, all four Type Check jobs success, Governed Surface Queue Guard success, Check Changeset skipped (skip-changeset label applied at open). Label write used the fallback path (whole-set write) with a comparative read-back: read set [size/xs], target union [size/xs, skip-changeset], read back [documentation, size/xs, skip-changeset] — union present, nothing stripped, `documentation` added concurrently by the labeler and kept. PR body read back in full after creation and compared byte-for-byte against what was sent: identical after CRLF normalisation, no sanitizer damage.",
  "mcp_calls": "3 — create_pull_request, issue_write (label union), add_issue_comment (this report). Every read went through unauthenticated repo-scoped REST (probed first: HTTP 200), so no MCP read quota was spent.",
  "open_questions": [],
  "out_of_scope_findings": []
}

---

Generated by Claude Code