Merge remote-tracking branch 'origin/main' into claude/issue-17356-reachability-root-enumeration

Author: claude

.changeset/17189-app-capability-not-high-privilege.md

@@ -0,0 +1,81 @@
+---
+'@objectstack/spec': minor
+---
+
+feat(spec): an app-declared capability token is not a platform system permission at the `everyone` anchor
+
+`describeHighPrivilegeBits` counted **any** non-empty `systemPermissions` as a
+high-privilege bit, so a permission set carrying the capability token its own
+app declared could not be bound to the `everyone` audience anchor:
+
+```
+FROM  describeHighPrivilegeBits({ systemPermissions: ['clm_requester.access'] })
+      -> 'system permissions'        // the app's own navigation gate, refused
+TO    describeHighPrivilegeBits({ systemPermissions: ['clm_requester.access'] },
+                                { declaredCapabilities: ['clm_requester.access'] })
+      -> null
+```
+
+One list carries two unlike things: the platform's own powers (`manage_users`
+and friends) and a capability a package **declared for itself** (ADR-0066 D1,
+entering `sys_capability` with `managed_by: 'package'` + `package_id`
+provenance). An app whose navigation gates on its own token therefore could not
+ship the set every employee holds — the set's own gate made it unbindable — and
+authors were pushed toward declaring no gates at all, the opposite of what
+ADR-0066 D1 exists to encourage.
+
+**The discriminator is provenance, not spelling.** Both predicates
+(`describeHighPrivilegeBits`, `describeAnchorForbiddenBits`) take a new optional
+`AnchorBindingContext` naming the capability names *this stack declared*; a
+token on that list is the app's own gate and is not counted. ⛔ A naming-syntax
+rule (dotted ⇒ app token) was considered and rejected: it misjudges in silence
+the first dotted platform permission — `setup.access` is one today — and the
+first undotted app token.
+
+**What is still refused**, each pinned in `high-privilege.test.ts`:
+
+- a platform capability name, **however it is declared** — a package declaring
+  `manage_users` cannot launder it past the gate (the platform floor);
+- any token absent from the declared list, and every token when no list is
+  passed — omission gets the pre-change verdict, so the narrowing fails closed;
+- a mixed set: one unexcused token still refuses the whole set;
+- the `guest` tier (ADR-0090 D9), which does not honour the excusal at all —
+  D5 speaks for authenticated members, and anonymous visitors are not that.
+
+**No shipped behaviour moves in this release.** Every current caller invokes the
+predicates with the old arity, and with no context the code path is identical —
+so this release widens the API, not any live anchor binding. The
+`@objectstack/plugin-security` boot refusal and the `@objectstack/lint`
+`security-anchor-high-privilege` rule pass the declared list in a follow-up, in
+the ruled order (protocol first).
+
+ADR-0090 D5's offending-bit list is revised to match in its own governed PR
+(objectstack#17814), per the ruling's 「ADR-0090 修订单独受管 PR」: the offending
+bit is a `systemPermissions` entry naming a **platform** system permission.
+Both halves are phase ①; ⛔ neither lands without the other following.
+
+**This is shipped, which is why it carries a changeset rather than
+`skip-changeset`.** `@objectstack/spec`'s published `files[]` ships `dist`, and
+the new code reaches it.
+
+Counts below are taken on a **clean full build of this head** — an empty `dist`,
+then `pnpm --filter @objectstack/spec build` with both passes (JS and DTS): exit
+0, `check-dts-emitted` reporting 34/34 declaration files, and
+`dist/.build-input-hash` and `.build-input-hash-dts` both matching `src`. The
+build state is named because it changes the answer: on a JS-only `dist` — one
+still mid-DTS, or built under `OS_SKIP_DTS` — every declaration file is missing
+and each count below that reaches one is halved.
+
+| identifier | built files | where |
+|---|---|---|
+| `declaredCapabilities` | **4** | `security/index.js`, `index.mjs`, `index.d.ts`, `index.d.mts` |
+| `AnchorBindingContext` | **2** | `index.d.ts`, `index.d.mts` — a type, so the declarations are its whole published reach |
+| `appDeclaredCapabilityNames` | **2** | `index.js`, `index.mjs` — module-private, so it has no declaration presence at all |
+| `describeHighPrivilegeBits` | **4** | the positive control: a symbol already known to ship |
+
+Negative control: a sentence occurring **only** in the ADR revision — `As first
+written, the bullet above made` — occurs in **0** built files, and `docs/adr/**`
+is in no package's `files[]`. ⚠️ The control has to be a sentence the source
+does not also carry: `The platform floor is absolute` reads 2, not 0, because
+that sentence is in this predicate's JSDoc as well as in the ADR, and an emitted
+JSDoc reaches `index.d.ts` / `index.d.mts` like any other declaration text.

.changeset/17612-job-queue-claim-index.md

@@ -0,0 +1,18 @@
+---
+"@objectstack/platform-objects": patch
+"@objectstack/service-queue": patch
+---
+
+`sys_job_queue`'s claim path no longer sorts the whole queue on every poll, and a job's due time is now a SQL predicate instead of a filter applied after `LIMIT` (#17612).
+
+`DbQueueAdapter.claimBatch` — the 1s poll every `DbQueueAdapter` runs — read the queue as `WHERE queue = ? AND status = 'pending' ORDER BY priority ASC, scheduled_for ASC`, while `sys_job_queue` declared `['queue','status','scheduled_for']`. The sort's **first** key, `priority`, was in no declared index at all, so the equality prefix seeked and the planner then built a sorter over every pending row in the queue, every tick. Measured on both Turso faces:
+
+```
+SEARCH sys_job_queue USING INDEX idx_sys_job_queue_queue_status_scheduled_for (queue=? AND status=?)
+USE TEMP B-TREE FOR ORDER BY
+```
+
+- **The declared index becomes `['queue','status','priority','scheduled_for']`**, replacing `['queue','status','scheduled_for']` — the table still declares three. The full-queue sort is gone on both faces; what remains is a sorter bounded to rows tying on the whole indexed prefix, because a paged read carries one ORDER BY term the caller never writes — the unique tie-breaker of the deterministic-paging contract (ADR-0053 D-A1), here `id`. ⛔ That last term is deliberately **not** closed by appending `id` to the index: `id` is an unbounded `Field.text`, and a text column a declared index keys on without a `maxLength` makes MySQL reject the index DDL outright (`check:keyed-text-bounds`, ER_BLOB_KEY_WITHOUT_LENGTH).
+- **Due-ness moved into `where`** as `$or: [{ scheduled_for: null }, { scheduled_for: { $lte: now } }]`, the same shape `SqlOutboxStore.claim` uses. It had been a JS filter applied to rows `LIMIT` had already chosen, so a window full of not-yet-due high-priority jobs hid already-due work behind it indefinitely: at the default `batchSize: 10` (candidate window 30), 30 future-dated `priority: 1` rows plus one due `priority: 100` row claimed **0** per poll, forever. It now claims 1.
+- **`priority` still decides claim order.** The alternative — dropping it from the sort — would have left a declared, documented field (`Lower = higher priority`) with no runtime effect at all.
+- ⚠️ **On an existing database the superseded index is not dropped.** The retrofit adds `idx_sys_job_queue_queue_status_priority_scheduled_for` and leaves `idx_sys_job_queue_queue_status_scheduled_for` in place (measured: 3 indexes before, 4 after, no row touched), so a provisioned table carries one redundant index until an operator drops it through the migrate-plan path. A freshly created table gets three.

.changeset/plain-donkeys-repeat.md

@@ -4,6 +4,19 @@
 
 Declare the ASSEMBLED manifest stage on the installed-package read API.
 
+**BREAKING** — a TYPE-level break on two PUBLISHED response types. It ships
+`minor` under the pre-GA launch-window convention (ADR-0087, *Ratified: the
+pre-launch launch-window exemption*), where the npm level is deliberately not the
+carrier of breaking-ness; this banner and the ADR-0087 disposition at the bottom
+are. Runtime is untouched and stays additive — every payload that parsed before
+still parses — so the affected party is a TypeScript consumer and the channel is
+the compiler at their own call site. Reading a manifest field off
+`ListInstalledPackagesResponseSchema` or `GetInstalledPackageResponseSchema` can
+stop compiling, and assigning a malformed manifest to either can start compiling
+where the old annotation refused it. Both directions are measured against the
+built `.d.ts` under *The STATIC gain is one-sided* below, which is also where the
+point-of-use reading lives.
+
 `GET /api/v1/packages` and `GET /api/v1/packages/:packageId` serve whatever a
 package was installed with, and two stages reach that table through declared
 doors: `POST /api/v1/packages` installs an authoring manifest (`manifest.objects`
@@ -54,3 +67,5 @@ before `parse` — the unix-socket short-circuit and the refusal of the
 filesystem-reading `?sslcert=` / `?sslkey=` / `?sslrootcert=` query parameters
 are kept; the "is this a URL `pg` can open" arm answers "no findings". Datasource
 publish is a server-side act, so that arm never legitimately ran in a browser.
+
+<!-- adr-0087: not-required (no-migration-prescription) nothing is removed or renamed: `ManifestSchema` is unchanged, no authorable key moves and no stored row shape moves, so `objectstack migrate meta` has nothing to rewrite and the ledger cannot carry this change. The break is confined to the declared TypeScript surface of two response schemas, where the compiler reaches every affected consumer. -->

.changeset/refused-end-node-outcome.md

@@ -0,0 +1,46 @@
+---
+'@objectstack/service-automation': minor
+---
+
+Flow `end` nodes honour `outcome: 'refused'` — a terminal `refused` run, distinct from `failed`
+
+`packages/spec` has declared the shape since 17.4.0: an `end` node accepts
+`outcome: 'completed' | 'refused'`, a `refused` end requires a `message`,
+`ExecutionStatus` carries `refused`, and `ExecutionLog` / `AutomationResult` /
+the trigger response carry `refusalMessage`. The engine produced none of it —
+it returned on every `end` node without reading its config — so an author who
+wrote a refusal shipped a plain completion: the run recorded `completed`, the
+caller got the flow's `successMessage`, and the authored reason reached nobody.
+
+The `end` node now honours it:
+
+- **The run terminates `refused`.** A refusal is a *successful evaluation that
+  says no*, so the result is `success: true, status: 'refused'` with no `error`
+  and no `errorMessage` — and, deliberately, no `successMessage`: the flow's
+  completion toast is for a completion. All three terminal producers answer
+  identically (a triggered run, a resumed screen flow, and an attempt under
+  `errorHandling.strategy: 'retry'`, where a refusal also stops the ladder
+  rather than consuming retry budget).
+- **The `message` is rendered per record**, through the same interpolation a
+  `screen` node's `description` gets — one implementation (`interpolateText`),
+  never a second template engine — so `'Refused: {record.name} is a confirmed
+  duplicate'` reaches the caller naming the record.
+- **Both are persisted on the run.** `sys_automation_run.status` gains
+  `refused` and a new `refusal_message` column carries the rendered text; the
+  refusal is never folded into `error`, which would tell every reader the run
+  broke. `RunRecord` gains `refusalMessage` and `TerminalRunStatus` gains
+  `refused`, so history rows are written, aged and read back like any other
+  terminal.
+- **A refused run is never resumed.** It writes no continuation, so `resume`
+  answers `RUN_NOT_FOUND`.
+
+Untouched on purpose: a paused run still returns `silent` with no
+`successMessage`, and a plain `end` — or one declaring `outcome: 'completed'` —
+completes exactly as before.
+
+An `end` declaring `outcome: 'refused'` **inside a structured region** (a `loop`
+body, a `try`/`catch` region) is refused loudly rather than honoured: a refusal
+terminates the run and a region body cannot end one. Previously such a node was
+a silent no-op like every other `end` in a region, so nothing that ever worked
+stops working — put the refusing `end` on the top-level graph and route the
+region's exit to it.

.claude/skills/pm-dispatch/references/landing-operations.md

@@ -24,17 +24,17 @@
 - 契约复核 PASS 落地的 PR 到窗口时已 ready 且 auto-merge 在挂,见 `contract-review.md`。
 - 窗口自身权责不变:跟到 MERGED、踢出处置、落地后对账。
 - 转 ready 或挂 auto-merge 前先判受管面:`node scripts/pm/check-governed-merges.mjs --test` 加变更路径。
-- 一条命中 ⇒ 整 PR 改走人工合并道:复核照写 + 留 draft + 向授权批准人请审 + 状态评论。
-- ⛔ 不翻 ready、不入队;清标即落地同受此闸,漏判会被队列守卫在 merge group 里拒收。
+- 受管路径全在本技能 `references/` 者事实层:席内达档复核过落地前检三条即转正式入队。
+- 其余为规则层:四件套留 draft 等人批,⛔ 不翻正式不入队;获授权批准后认领席落地。
+- ⛔ 两层不由席位批准;清标即落地同受此闸,漏判会被队列守卫在 merge group 里拒收。
 - 再读 `mergeable_state`:`dirty` ⇒ 先 merge `origin/main` 再挂;生成物在面上按 A 的固定序。
 - ready + 全绿 ≠ 已入队:队列从不主动拉 PR,入队是显式动作。
 - 零 `enqueued` 事件按序查三条:① `mergeable_state` 是否 `dirty`。
 - ② enable-auto-merge 调用根本没落地,重发与效果验证序列见 `platform-readings.md`。
 - ③ PR 碰 `.github/workflows/**` 而 token 缺 workflows 权限。
-- 确认 MERGED 的同一动作里给 `Part of` 卡收口,`Fixes` 卡代关但标也须摘。
+- 确认 MERGED 同一动作里给 `Part of` 卡收口、`Fixes` 卡代关但标也须摘,⛔ 不拆到下轮巡检。
 - `Part of` 卡开着不摘 `pm:dispatched`,无在飞物的卡就永远算进 `label:pm:dispatched is:open`。
 - 摘标换回 `pm:queue` 或按剩余物定级,加一条写清交付了什么、剩下归谁的评论。
-- 摘标与 MERGED 确认是一个动作,⛔ 不拆到下轮巡检。
 - 同刻读相关卡 `closed_by_pull_requests`,确认没有卡被正文闭合关键词误关。
 - 每次合并后重拉一次车道盘点与预期状态对账,⛔ 不留给下轮巡检。
 - 取 open 卡清单对照预期 diff:预期之外从 open 消失的,就是被闭合关键词静默误关的卡。

.claude/skills/pm-dispatch/references/lanes/ui.md

@@ -19,7 +19,7 @@
 
 - 构建产物经 `pnpm objectui:refresh` 回流,见 SKILL.md 〈多仓协调〉。
 - 回流后的 console pin bump 是 objectstack 的单张卡,⛔ 永不做本仓 PR 的 rider。
-- 凡触 `packages/spec` 一律转 `domain:spec` 座位,见 SKILL.md 〈多仓协调〉。
+- 新 `packages/spec` 工作恒归 `domain:spec` 席,已派发卡 ⛔ 不因此转席,见 SKILL.md 〈多仓协调〉。
 - `scripts/pm/**` 单写手恒在 objectstack 侧 ⇒ 本席的工具需求走上游卡带 `Blocked-by:` 回链。
 - 受管面五项含仓根发布 `skills/**`,清单、判据与禁令见 objectui AGENTS.md §9 受管面段。
 - ⇒ 命中即停 draft;⛔ 未获授权批准不 ready 不入队不自合、永不批准,获批后认领席落地。