Epic: Duly as the standard ObjectStack template app (M4 — install it, load your catalog, run it without us) #127

Why this epic exists

Ruling from the maintainer (2026-10-26, this session, in Chinese): position Duly as the standard ObjectStack template app — a platform asset and reference implementation — rather than as a standalone product bet. Direct sales, the customer's phase-2 QHSE module and phase-3 scoring are out; per-customer IM connectors are out. The product's positioning versus EHS suites is layering, not replacement: the suite stays the system of record for incidents, chemicals, permits and environmental data; Duly is the duty layer owned by the operating roles themselves. The competitor to beat is "a spreadsheet plus a chat group", not the suites.

The roadmap's M4 gate already states the bar: a customer can install it, load their own catalog, and run it without us.

What the template must be

A. From "one customer's app" to "anyone's starting point"

• Neutral defaults where the customer's taste leaked in (progress phrases; readable position codes everywhere — finding: readable position codes stopped at the demo seed — samples, action placeholders and docs still say plant_compliance_officer #120)
• A measured matrix of which authored knobs a customer can change in Setup / Studio without code; platform gaps filed, not worked around
• A permission model that is correct in the open edition (reviewer can approve, cannot rewrite cadence) — decision card
• Timezone posture decided: declared single-timezone, or resolved from the business unit — A duty's timezone has no source to resolve from — every instantiated duty is UTC #26 decision
• The pnpm demo priming boot removed once maybeSeedDevAdmin gates on "any sys_user row", but runs at kernel:ready — so any app that seeds people permanently loses the objectstack dev login objectstack#14157 ships (blocked)

B. Packaged as a template

• Repo is template-shaped: empty on pnpm dev, demo opt-in, no customer naming, README quick start for "load your own catalog"
• Industry catalog packs, importable in ten minutes, en + zh-CN, invented references only: food-safety daily/weekly/monthly control, ISO 9001 internal audit & calibration, EHS inspections
• Release canary: a scheduled workflow runs the four gates against the newest @objectstack/* and opens an issue on red
• create-objectstack carries a duly (compliance calendar) template — lives in objectstack-ai/objectstack, filed separately
• Deployment & upgrade docs, container image (Packaging and deployment — image, compose, upgrade path #20); MCP surface documented (Document the MCP surface — ask the system what is late #21); accessibility & dark mode (Accessibility and dark mode pass #22)
• Positioning and README rewritten for the new positioning (layering vs EHS suites; template first)

C. Platform fixes the template depends on (not this repo's work)

• Object-bound actions are hidden by the ADR-0066 D4 capability gate with nothing anywhere saying so — the relay carries actions and the button IS drawn (premise falsified); decide the requiredPermissions observability contract objectui#7234 — app-declared actions do not render (confirm / approve buttons; The three task actions from #4 do not render anywhere in the UI — one-click completion has no button #60 is on hold on it)
• Analytics: a chart renders English option labels while the neighbouring list view is correct — the stated cause (#4324/#4330 leaving a cell uncovered) is FALSIFIED; determine which of the five translation-starvation paths is live objectui#7696 — chart local-select dimension labels ignore the locale (pie legend)
• maybeSeedDevAdmin gates on "any sys_user row", but runs at kernel:ready — so any app that seeds people permanently loses the objectstack dev login objectstack#14157 — dev admin is not minted when the seed carries users (the priming boot)
• i18n: the validation-message bridge matches the locale EXACTLY while every document translator does variant fallback — accept-language: zh refuses in English on the same response whose dataset labels are Chinese objectstack#15757 — validation-message locale has no variant fallback
• A dataset measure over a datetime is typed number in the analytics response, and a metric tile ignores the format style it is handed — measured on 17.3.0 objectstack#15768 — datetime measure typed number, metric tile ignores format
• A dataset measure cannot render as a percent: the console's scale heuristic reports a rate of exactly 1 as 1.0% #101 — percent scale heuristic (platform renderer)

The template does not ship with workarounds for C: it ships with the gaps filed and the affected surface documented.

Explicitly not in this epic

Phase-2 QHSE checklists · phase-3 supervision and scoring · work calendar · per-customer IM connectors · any ranking or league table (positioning: what we will not build).

Decision rule for sub-cards

Anything that changes product semantics or a security boundary goes to the maintainer as a needs-user-decision card with the four-axis analysis; everything else is PM discretion and gets dispatched.