[objectstack-fleet]

Closes #371

Clause-②: no
Metadata-protocol: none

What

/trust-center/ gets one new section, first among the page sections (after the hero, metrics and review-packet block): "Four gates every AI action passes" / 「AI 的每个动作都要过的四道闸」. Each gate has a short title, one plain business sentence, and a link (the title, with the existing item arrow) to the page that documents the shipped mechanism. Mechanism detail is not repeated.

• Files: content/pages/en/trust-center.ts, content/pages/zh-Hans/trust-center.ts. Nothing else changed.
• Shape: the existing MarketingPageSection with meta + href items. types.ts and MarketingEvidencePage.astro are untouched. There are no new styles or literal colours, and the 4-card grid lays out 2 + 2 via cardSpans.
• zh-Hant derives from zh-Hans (the build shows 四道閘). ja / de / es / fr / ko fall back to en, as on the other marketing pages. Links are written as /en/...#anchor and localized at render time (for example /zh-Hans/permissions/#ai-safety).
• No sentence states what ObjectStack is, so positioning[locale].t2 is not involved. Prices are untouched (Pricing: ObjectOS Enterprise shows no public price — remove the Enterprise Single-Node $540 / AI seat / yr figure; Enterprise is contact-sales only #377 is in flight on the same file and may conflict; the second PR to land merges main).

Evidence: one backing sentence per gate (en sources, at base a239294)

Gate	Links to	Backing sentence
1 · Same access as the person it works for	/permissions/#ai-safety	content/pages/en/permissions.ts:111: "every agent action runs as the signed-in user who asked for it, inside the same fence as that user."
2 · The same automatic checks	/data-modeling/#modeling	content/pages/en/data-modeling.ts:70: "Constraints are expressions next to the fields they protect, enforced on every write path: UI, API, imports, and AI tools."
3 · Sensitive changes wait for a person	/approvals/#ai-gate	content/pages/en/approvals.ts:135: "a structural change from an agent does not ship — it waits for a person." and content/pages/en/approvals.ts:147: "Runtime actions can require sign-off too, so an AI-triggered refund or bulk update waits for a person."
4 · Every AI tool call leaves a trail	/permissions/#admin	content/pages/en/permissions.ts:102: "AI tool calls appear in the same log as human activity — same filters, same diffs — so reviewing the AI is the same job as reviewing people."
5 · A mistake can be undone	dropped	No mechanism page documents a shipped revert of an AI action, and no site page calls one planned. See below.

The section copy says "the audit log shows each change old → new". That is backed by content/pages/en/permissions.ts:134: "Old → new diffs, entry by entry, in the audit viewer".

Gate 5: why it is dropped and not marked "planned"

I searched content/pages/en/, src/lib/security.ts and the English blog for rollback|roll back|revert|undo|record history|history tracking:

• data-modeling.ts:24 and :46 describe history tracking (trackHistory: true). That records field changes; it does not undo them.
• permissions.ts:134 shows old → new audit diffs. That shows what changed; it does not revert it.
• trust-center.ts:27, :32 and :128 (:95 before this diff) list a "rollback plan" and "How is a bad metadata change rolled back?" as things a reviewer should ask for. They are reviewer questions, not a mechanism.
• The blog post automation-governed-flow-changes describes sys_metadata_history with a revert operation for metadata definitions. It is a blog post, not a mechanism page, and it covers definitions, not an AI's record changes.
• No page says record revert is planned.

So, following the card ("Do not claim it", "It is not rounded up"), the section is titled with the honest count, four. Its copy says in so many words: "Undo is not on the list … we do not claim a one-step revert of an AI action, so it does not count as a gate."

Wording held below the card's draft, so as not to overstate

• Gate 3: the card's "Anything irreversible waits for a person" became "A structural change, or an action you mark for sign-off such as a refund or a bulk update, waits for a person". The site documents that sign-off is configurable ("can require sign-off"), not automatic for every irreversible action.
• Gate 4: the card's "Every AI action leaves a trail" became "Every AI tool call leaves a trail", which is exactly what permissions.ts:102/:123 say.

Verification (head 862fdf4)

• pnpm content:lint: exit 0, ✓ content lint passed (414 files, 46 glossary terms checked). No warning names trust-center; the remaining warnings are pre-existing blog title widths.
• pnpm check (verify lock): VERDICT command-exit 0, Result (169 files): 0 errors, 0 warnings, 0 hints.
• pnpm build (verify lock): VERDICT command-exit 0. content lint --dist links passed (115802 internal links in 987 built pages resolve to built files). CJK line-break and quotation-mark checks pass.
• pnpm seo:smoke: exit 0, SEO smoke test passed (977 HTML pages checked; …).
• Browser (Playwright + Chromium, astro preview): /en/, /zh-Hans/ and /zh-Hant/trust-center/ at 1366×625, 1440×750, 1512×830, 1920×945, 390×844 and 360×800, in light and dark. All 36 runs: HTTP 200, page horizontal overflow 0, no element in #gates past the viewport, 4 cards, 2 rows on desktop and 4 on phones.
• Gate links (en and zh-Hans): all four targets return 200 and the anchor id (ai-safety, modeling, ai-gate, admin) exists on the target page.
• axe-core 4.10.2: 0 violations on the full page and 0 inside #gates, in en, zh-Hans and zh-Hant at 1440 and 390, light and dark.
• Screenshots (en and zh-Hans; 1440 and 390; light and dark) were taken and looked at. Text is legible in both themes and there is no clipping. The meta row uses the existing mono green label style.

Acceptance notes

• "Near the top": the section is the first of the page's sections. The component renders sections after the hero, metrics and review-packet block, so the section starts at about y=1600 on desktop and about y=2900 on a 390 phone. Moving it above the review packet would need a component change, which was kept out of scope by the claim's file surface. If the seat wants it higher, that is a follow-up.
• Naming overlap, recorded but not acted on: ontology.ts and agent-developer.ts already use "4 道闸门" for a different set of gates (typing, validation, review, governance, which sit between the agent and users at build time). The trust-center "四道闸" is about runtime control over AI actions. The two are different concepts with similar names.
• Related: objectstack-ai/cloud#3567 tests G1–G5 per scenario. It is still open with no verdicts recorded, so nothing there contradicts the four claimed gates. If its G5 ever passes and a mechanism page documents revert, gate 5 can be added then.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01FeA1nwBz1ohH65dvffUGKr

[objectstack-fleet]

席位核对

ACCEPT。

• 形态:改了 content/pages/{en,zh-Hans}/trust-center.ts 两个文件,各 +33,一个提交 862fdf4,基于 a239294。没有碰组件和类型,也没有碰受管面。
• 前提实测:卡片要求「每道闸都链到已上线机制的页面,撑不住的如实写」。
  • 第 5 道(撤销/回滚)没有可链的已上线机制,也没有任何页面称它「planned」。trust-center 里的 'rollback plan' 是给审阅者的问题,trackHistory/审计里的 old→new 只是记录,不是回滚。
  • 因此按卡片规则去掉第 5 道,标题改为「四道闸」,正文直接说明撤销不在清单上。
• 门禁 check-runs:head 862fdf4 上 Build and deploy = success;Post-deploy probe = skipped,PR 上按设计跳过。本地四项门禁 exit 0。
• 抽查读数:
  • 四条链接都按页面语言本地化(localizeHref),目标锚点 ai-safety/modeling/ai-gate/admin 都存在。
  • 截图看过 zh-Hans 1440 亮色:2×2 卡片,无溢出。
  • axe 0 violations。六个视口 × 三种语言 × 亮暗,共 36 项全部通过。
  • 第 3、4 道的措辞已收紧到页面能证实的范围:「标为需签核的动作」「每次 AI 工具调用」。
• 接受的偏差:
  • 闸数从卡片写的 5 道变为 4 道,理由同上,符合卡片约束。
  • 本节是 sections 的第一项,但组件把 sections 渲染在 hero/metrics/artifact 之后:桌面约 y=1600,390 约 y=2900。要提到更靠前需要改组件,超出认领文件面。
• 范围外去向:
  • 位置上移(改组件):记录在此;维护者要的话再立卡。
  • 命名重叠:ontology/agent-developer 页的「4 道闸门」指构建期四道关,本节指运行时的 AI 动作控制。记录在此。
  • 与 fix(pricing): remove Enterprise price; Enterprise is contact sales only #379 的合并顺序:fix(pricing): remove Enterprise price; Enterprise is contact sales only #379 不改 trust-center.ts,不冲突。
• 落地条款:等维护者点头 → pr_ready → 合并队列 → 确认部署和 probe。

---

Generated by Claude Code

[objectstack-fleet]

Landed. The maintainer approved the merge in the seat's session (2026-11-05): 「合 #378 #379 #380 #381.」

reading	value
merge commit on main	7f2d400 (merge queue)
push deploy covering it	Build and deploy on 62f74aa: success (the runs on intermediate queue merges were superseded)
Post-deploy probe on 62f74aa	success

#371 closed by this PR; pm:dispatched removed.

---

Generated by Claude Code