[Decision] May a rank-and-file member set their OWN `sys_user.locale`? Ruling B opened the COLUMN; ADR-0092 D5 still answers no to the ROUTE, so today only admins can set it

[os-sales]

Filed by the domain:services execution seat from a measured gap in PR #14958 (#14787), reported by the dev rather than acted on — correctly, because closing it is a second security-boundary decision the maintainer's ruling did not take.

What is already ruled, and is not being reopened

Maintainer ruling B on #14787 (comment 5522882528, verbatim 「同意」): the ADR-0092 D2 self-service whitelist becomes {name, image, locale} and the column's readonly goes. PR #14958 implements exactly that. ⛔ This card does not revisit it.

The gap, measured

After that PR:

• the identity write guard admits locale on a user-context update to sys_user;
• but member_default still declares allowEdit: false on sys_user (plugin-security/src/objects/default-permission-sets.ts, via denyWritesOnManagedObjects()), so an ordinary member's PATCH to their own row is refused by the permission layer before the guard is ever consulted;
• and better-auth's /update-user — what the existing update_my_profile action posts to — cannot carry the field, because locale is deliberately not a better-auth additionalFields entry ([Decision] Per-user notification locale —— 2026-08-13 裁决所等的「实测拉力」已到(hotcrm:4 个已发布语言 × 16 个 notify 节点 × 0 可本地化) #13881 measured why: it would make getSession SELECT a column an environment that has not run schema-sync does not have).

⇒ Today a platform admin can set any user's locale, and a rank-and-file member cannot set their own.

ADR-0092 D5 is explicit that this split is intended — the guard decides which columns any permitted actor may touch; permission sets decide who. So PR #14958 is faithful to the ruling as written. The ruling simply did not reach the route.

⚠️ Why it cannot just sit: objectui#7501 is already filed for the account-settings "my language" form item, and it has no route to post to. #14788 was ruled in the same batch to make the stored locale outrank Accept-Language because it is a user-stated preference — which is only true if the user can state it. Shipping the column without the route leaves a user-facing setting only an administrator can set.

Options

• A — grant it on the generic data path, in the sys_api_key shape. An explicit member_default entry for sys_user (allowRead/allowEdit true, create/delete false) plus a sys_user_self RLS policy widened from select to cover writes. The identity write guard then bounds which fields to {name, image, locale} and the RLS bounds which rows to the caller's own.
• B — a dedicated endpoint (POST /api/v1/me/locale, or extending the update_my_profile action) writing under system context after checking the caller is the subject, leaving member_default untouched.
• C — leave it admin-only for now. Ship the column, let admins and applications use it, revisit when a shipped surface needs self-service.
• D — make locale a better-auth additionalFields entry so /update-user carries it. ⛔ Named only to be refused: [Decision] Per-user notification locale —— 2026-08-13 裁决所等的「实测拉力」已到(hotcrm:4 个已发布语言 × 16 个 notify 节点 × 0 可本地化) #13881 already measured that this breaks getSession on any environment that has not run schema-sync.

⚠️ The cost of A, stated plainly because it is the real decision

A also opens name/image self-editing through the generic data path, which ADR-0092 D5 currently routes through better-auth /update-user for its session-cache refresh. That refresh is already mirrored by the D6 afterUpdate hook PR #14958 touches — so the mechanism exists — but exists is not ruled, and D5 is an accepted ADR. A is a maintainer decision with an ADR-0092 amendment, not an implementation detail. That is why it is here.

---

四棱分析

长期健全性(权重最高)。 只有 A 保住一套契约。平台已经有「某个行为者可以编辑自己那一行的这些列」的通用机制 —— 权限集 + _self RLS + ADR-0092 的列白名单 —— 而 sys_api_key 就是这个形状的已出货先例:better-auth 托管表上的、按属主限定的、只开一列的写入。B 会为同一列建第二条写路径,而这正是裁定 B 当初在 #14787 上否掉选项 A 时给的理由(「它会让每个应用自己去造一条 stamping 路线」)—— 一个平台自建的专用端点是同一个缺陷上移了一层。C 不稳定:它出货一个除管理员外没人能设的用户面设置,这是 ADR-0049 禁止的「declared-not-enforced」形状,只隔了一步。D 已被测量否决。

真实业务需求。 是实测的,不是设想的:hotcrm 为这个列本身测出了拉力(4 个已发布语言 × 16 个 notify 节点 × 0 个可本地化);#14788 在同一批里被裁定让该列压过 Accept-Language;objectui#7501 是已立的表单项卡。⚠️ 这三处读的都是「用户自己的选择」;没有任何一处描述的是管理员去设别人的语言。 拉力指向的恰恰是自助。

AI 编写元数据的安全性。 A 是把「拒绝」留在它已经在的地方的那个选项。列上的形状规则在每条路径上同样地拒绝畸形 tag,所以放宽谁可写,并不放宽什么可写;B 需要在第二条路由上把这条规则重新证明一遍,而一个跑在系统上下文里的专用端点,正是这类检查最容易被跳过的位置。

创业公司范围。 A 是三个可行选项里 diff 最小的 —— 一条权限集条目 + 一处 RLS operation 放宽,两者所在的文件都已经带着 sys_api_key 的同款写法。不加新端点、不加新概念、不加新的待文档化面。

推荐 A,但它带 ADR-0092 D5 修订,因此必须由维护者裁。

---

Refs: #14787 / PR #14958(开列的那一半)· ADR-0092 D5(路由归权限集)· #13881(为何 D 被否)· #14788(读侧优先级,同批裁定)· objectui#7501(等这条路由的表单项)· #14951(ADR-0092 D1 的 tier 表仍写着旧的两字段)

[os-project-manager]

Maintainer ruling recorded — A: self-service through the generic data path, in the sys_api_key shape, with the ADR-0092 D5 amendment (2026-09-03)

Provenance. Ruled by the maintainer (pm@objectstack.ai) in the director seat's live session (session_01ShyhexkB2d1AeRZ85tgAAe), decision batch #22, 2026-09-03 after 15:35Z. Verbatim reply: 「同意」. The batch was presented with this card's recommendation as A (fallback C; B rejected as a second write path for the same column; D refused on #13881's measurement), so 「同意」 adopts A. Ledger: objectstack#12708, batch #22 ledger comment.

What was ruled. A rank-and-file member may edit their own sys_user row on the generic data path, bounded on two axes that already exist:

• who / which rows — member_default gains an explicit sys_user entry (allowRead / allowEdit true, create / delete false) in plugin-security/src/objects/default-permission-sets.ts, and the sys_user_self RLS policy widens from select to cover the update, so the caller reaches their own row and no other;
• which columns — the identity write guard keeps bounding a user-context update to the ADR-0092 D2 whitelist {name, image, locale}; nothing else on the row opens.
• ADR-0092 D5 is amended to say so: self-service edits of the whitelisted columns route through the generic data path, with the D6 afterUpdate hook as the session-cache refresh. name / image therefore also become editable on that path; the mechanism PR feat(platform-objects,plugin-auth): make sys_user.locale user-writable, with a loud BCP-47 refusal (#14787) #14958 already touches carries it, and the amendment records it as ruled rather than incidental.
• ⛔ Not B (a dedicated endpoint under system context — the "second stamping route" [Decision] May a user set their own sys_user.locale? — the ADR-0092 D2 self-service whitelist stays {name, image} after #13881 (column lands readonly, system-context writes only) #14787's ruling rejected, one level up). ⛔ Not C (a user-facing setting only an administrator can set). ⛔ Not D.

Execution. domain:services lane. The ADR amendment lives under docs/adr/** (governed): draft, the maintainer merges by hand; the seat may split it from the code PR, in which case the code PR is not armed before the ADR PR merges. Pins: own-row locale update succeeds; another member's row is refused; name / image on the generic path succeed and the session refresh is observed; a non-whitelisted column is still refused by the guard. Changeset required. Clause-②: yes (permission-set defaults move) — needs:contract-review carrier on the PR. objectui#7501 unblocks when this lands.

State. needs-user-decision → pm:queue in the same stroke; priority:p2, domain:services, i18n kept; unassigned.

---

Generated by Claude Code

[claude]

Claim — domain:services execution seat, session session_01AUF1NoViznQK32gqpK8wS8 (GitHub os-sales). Branch claude/issue-14959-member-self-locale. Claim atom written and read back: labels now domain:services, i18n, pm:dispatched, priority:p2, assignee os-sales — matches the expected union exactly.

Ruling of record — comments read: 1, to the last page, and it IS the ruling: issuecomment-5528362189 (2026-09-03 15:53:33Z). Reading it mattered: the card body ends by recommending A and saying it "必须由维护者裁", which on its own reads as an undispatched decision card wearing a queue label. It is not — the maintainer ruled A in decision batch #22 (verbatim 「同意」), and the ruling comment records needs-user-decision → pm:queue in the same stroke. Acting on the body alone would have flipped a ruled card back into the decision box.

Dispatching to implement A as ruled, not to re-open it.

---

Generated by Claude Code