content(blog): ADR-0015 turn-key federation has shipped — correct the closing roadmap paragraph in all eight locales

[hotlong]

Fixes #149

Head SHA for every measurement below: bb17f28.

What the post claimed

The closing section of extend-existing-systems-with-ai, "What Has Shipped vs. What Is Coming", ended with:

A richer, turn-key federation experience — one-step schema import, binding to externally owned schemas, and built-in write-safety gates — is in active design under ADR-0015 (status: Proposed). We'll write more as it lands. Until then, the documented path — connect, model, bind, query — is the supported one.

All three named items have landed. The paragraph's last word on the subject told a reader that the write-safety gates are unbuilt — the one thing a reader most needs to believe exists before pointing anything at a production database.

What ships

Verified against objectstack origin/main @ dbf1152 before a word was written. (Placeholders written as NAME / TABLE here because GitHub's body sanitizer strips short angle-bracket fragments; the post itself uses the angle-bracket spelling and renders it correctly.)

Claim in the post	What is actually there
one-step schema import	os datasource list-tables NAME and os datasource introspect NAME --table TABLE — packages/cli/src/commands/datasource/{list-tables,introspect}.ts, over GET /api/v1/datasources/:name/external/tables and POST …/tables/:remote/draft. os datasource validate NAME (validate.ts) checks declarations against the live schema on demand.
binding to externally owned schemas	Datasource.schemaMode — 'managed' / 'external' / 'validate-only' — and external.validation.onMismatch ('fail' / 'warn' / 'ignore', default fail) in packages/spec/src/data/datasource.zod.ts; Object.external with remoteName / remoteSchema / columnMap in packages/spec/src/data/object.zod.ts.
built-in write-safety gates	The double opt-in: external.allowWrites on the datasource ("Individual objects must also opt in via object.external.writable") plus external.writable on the object ("ADR-0015 requires BOTH … either one alone leaves the object read-only").
status	ADR-0015: "Accepted — backend/REST/CLI implemented; Studio UI + extra dialect drivers pending". ADR-0062 (Accepted 2026-06-22) supersedes its runtime half.

The corrected paragraph says all of that in the post's own register, and keeps the still pending half honest: the Studio UI for federation and drivers for more SQL dialects.

Two things deliberately preserved. The post's connect-not-rebuild argument is untouched — only the roadmap paragraph was stale. And the federation write gate is kept distinct from a read-only connection: the correction states that allowWrites / writable answer who owns this database and apply to an external datasource, while read-only on a database ObjectStack owns is still a database GRANT. The FAQ's "bind to a read-only connection or DB user" was already correct and is unchanged; this is the confusion the issue warned an update could introduce.

Not overstated. The docs page this post links carries a separately known-stale section tracked as objectstack-ai/objectos#250 — different repo, untouched here, and nothing in this PR leans on it.

Consistency with #147. how-to-move-an-internal-system-to-metadata (PR #147, merges on its 2026-09-17 slot) links to this post and describes the same surface. Read from origin/claude/issue-91-how-to-move-an-internal-system-to-metadata and matched in both facts and vocabulary: schemaMode: 'external' as an ownership declaration that forbids DDL, boot validation with onMismatch: 'fail' (and validate-only to warn while drafting), list-tables / introspect for the drafts, and "two explicit opt-ins, in two files" for writes. That branch was not edited.

Which locales carried it

All eight files in the post directory:

Locale	Treatment
index.mdx (en)	Original — the corrected paragraph plus three bullets naming the shipped surface.
index.zh-Hans.mdx	Full translation (this locale mirrors the English body).
index.ja.mdx	Faithful localisation at this locale's compression — the translated files are condensed, so the correction is condensed with them.
index.de.mdx, index.es.mdx, index.fr.mdx, index.ko.mdx	Same, at their own (shorter) compression.
index.zh-Hant.mdx	Generated by pnpm gen:zh-hant; never hand-edited. pnpm build regenerates it and leaves the tree clean, which is the proof the committed file is the generator's output.

Frontmatter tags are [] in every locale and stay [] — nothing added, nothing #160 dropped restored.

One rendering fix inside the same sentence

The zh-Hans sentence being rewritten used **开箱即用联邦（turn-key federation）**体验, whose closing ** sits after a full-width ）. Under CommonMark's flanking rule that run cannot close, so readers were shown literal asterisks (verified in the built HTML and in the browser). Since the correction rewrites that exact sentence, the delimiter was moved off the punctuation — **开箱即用联邦（turn-key federation）体验** — and zh-Hant regenerated. The built page now contains zero literal **, where it had two.

This is a site-wide class (24 built pages across ja/ko/zh-Hans/zh-Hant); the other 22 are not touched here and are filed separately.

Gates

Run through the shared verify lock as one chain after the final commit, exit code captured before any pipe. git rev-parse --short HEAD at the time of the run: bb17f28.

bash scripts/pm/os-verify-lock.sh -c 'pnpm content:lint && pnpm check && pnpm build && pnpm seo:smoke'

Gate	Its own verdict line
pnpm content:lint	✓ content lint passed (334 files, 44 glossary terms checked)
pnpm check (astro check)	Result (134 files): · - 0 errors · - 0 warnings · - 0 hints
pnpm build	✓ zh-Hant: generated 46, kept 0 hand-maintained · ✓ content lint passed (334 files, 44 glossary terms checked) · [build] 866 page(s) built in 50.47s
pnpm seo:smoke	SEO smoke test passed (865 HTML pages checked)
lock	os-verify-lock: VERDICT command-exit 0 · held the lock 64s (1m04s) · waited 0s

GATES_EXIT=0, and git status --porcelain is empty afterwards — the build's gen:zh-hant pass reproduced the committed zh-Hant byte for byte.

Browser verification

Served the built dist/ over python3 -m http.server on 127.0.0.1 and drove Chromium (/opt/pw-browsers/chromium) through the global Playwright. Pages: /en/, /en/blog/extend-existing-systems-with-ai/, /zh-Hans/blog/extend-existing-systems-with-ai/; viewports 1440×900 and 390×844. Every page: full scroll so lazy images enter the viewport, then img.decode() on each.

Check	Result (all 6 page × viewport combinations)
HTTP status	200
scrollWidth === clientWidth	true (1440/1440, 390/390) — no horizontal overflow
images decoded	5 on /en/, 2 per post page; 0 broken
page errors / console errors / failed requests	none
internal links → 200	49 / 47 / 46 unique /… hrefs per page, 0 non-200
Updated line	Updated Sep 2, 2026 (en) and 更新于 2026年9月2日 (zh-Hans), datetime="2026-09-02"

Screenshots of the corrected section were read at both widths: the three bullets, the inline code spans and the ADR links render correctly, the code spans wrap inside the column at 390px, and the zh-Hans bold now renders bold instead of asterisks. datetime="2026-09-02" is present in all eight built locale pages.

The updated value

updated: 2026-09-02T10:00:00+08:00 — added to the seven authored locale files and propagated into the generated zh-Hant. date: 2026-05-30 is untouched in every file. The value matches the convention already in the repo (ai-ontology-open-protocol, forward-deployed-engineer-tools), sorts after date, and is not in the future for content-lint's window; astro check enforces the same ordering through the collection's superRefine.

Filed out of scope

• Bold that closes against CJK punctuation renders as literal ** — 24 built pages across ja / ko / zh-Hans / zh-Hant #174 — bold that closes against CJK punctuation renders as literal **; 24 built pages in ja/ko/zh-Hans/zh-Hant, one lint rule closes the class.
• extend-existing-systems-with-ai: the datasource code sample no longer parses — config.connection, user and an inlined password are all rejected now that per-driver config is enforced #175 — this post's datasource code sample no longer parses (config.connection, user, an inlined password) since per-driver config became enforced; all 8 locale files, and the place defineDatasource belongs.

Neither is touched by this branch.

---

Generated by Claude Code