@@ -0,0 +1,12 @@
+---
+"@objectstack/connector-mcp": minor
+---
+
+feat(connector-mcp): a declarative stdio MCP transport runs in the declaring app's root, so its relative command and args resolve there wherever the server was started
+
+Clause-②: yes (widening)
+
+- **What changes.** For a declarative `provider: 'mcp'` connector with a stdio transport, the `mcp` provider factory now sets the child process's working directory to the app's root. It reads that root from the host through `ConnectorProviderContext.resolvePackagePath('.')`. Relative paths in the entry now resolve against the same root as the app's other relative refs, such as the `openapi` provider's `providerConfig.spec`. That covers a relative `command` path (`./bin/server`) and a script the launched program opens itself (`args: ['./scripts/server.mjs']` with `command: 'node'`). Before this change they resolved against the directory the server was started from. A boot from any other directory, such as `os verify --app examples/app-showcase/objectstack.config.ts` from the repository root, therefore registered the connector degraded, with no actions.
+- **What does not change.** A bare executable (`node`, `npx`) is still looked up on `PATH`, and an absolute command or argument resolves as before. The `declarativeStdio` policy judges the `command` string exactly as written, and it runs before the root is resolved. `providerConfig.transport` gains no key: the working directory comes from the host, and an authored `cwd` there is not used. A host that does not provide `resolvePackagePath` starts the child exactly as before, in the host's current directory. A server that opens relative files of its own now opens them under the app's root.
+- **New on the exported type.** The stdio variant of `McpTransport` gains an optional `cwd`, which the default client passes to the MCP SDK's `StdioClientTransport`. A hand-wired transport (`new ConnectorMcpPlugin({ transport })` or `createMcpConnector`) may set it. Left out, the child inherits the host's current directory, as before.
+- **Nothing to migrate.** An app that started its server from its own directory sees no difference, because both anchors were the same directory.
@@ -0,0 +1,29 @@
+---
+"@objectstack/formula": minor
+---
+
+fix(formula)!: the unknown-field check judges every spelling of a `record` / `previous` member, not only the dot, so `os build` and the object save door refuse `record['typo']`, `previous['typo']`, `record.?typo` and `record[?'typo']` (#22428)
+
+Clause-②: yes (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) A refusal at `os build` and at the object save door of an expression that names an undeclared field in a non-dot member spelling: no authorable key, spelling, export or stored shape moves, and no stored row is read, rewritten or converted. A stored object whose expression is refused keeps loading until it is next saved, and the repair is the author's own (declare the field or fix the typo), which no ledger entry can derive. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id covers this verdict and this diff adds none (not registered / already-registered); and no exported TypeScript declaration changes (not runtime-interface-only / type-surface-only). -->
+
+**BREAKING**: an accept-set change, in both directions, of the `os build`, `os validate` and `os lint` verdicts and of the object save door, shipped as `minor` under the launch-window convention for accept-set narrowings. It narrows: an expression that names an undeclared field of its object in a non-dot member spelling (`record['FIELD']`, `record["FIELD"]`, `record.?FIELD`, `record[?'FIELD']`, or any of those on `previous`), or an undeclared leaf of a declared read attachment in such a spelling, is now refused where it was accepted. It widens: three shapes the dot-only regex misread as a member of the root, and refused as unknown fields, are now accepted, because none of them names a member. They are text inside a string literal (`record.name == 'record.typo'`), a root name after another root (`vars.record.x`), and a method call on the root itself (`record.size()`). No refusal code is added.
+
+`validateExpression`'s field-existence pass judges each member an expression reads on `record` or `previous` against the object's fields, and refuses an undeclared one with the `unknown-field` code. It found those members with a regex over the dot spelling, so it judged `record.typo` and `has(record.typo)` and nothing else. `record['typo']`, `record["typo"]`, `previous['typo']`, `record.?typo` and `record[?'typo']` name the same column, and they reached the evaluator with no verdict at every slot the pass judges, among them a select option's `visibleWhen`, a field's `requiredWhen` and a validation rule's condition. There the expression faults on a key the record never carries, or reads a value that never exists.
+
+The pass now reads members through the same AST member reader the relationship-traversal analysis is built on, so every spelling gets the dot spelling's verdict, did-you-mean included:
+
+- `os build`, `os validate` and `os lint` refuse an expression that names an undeclared field of its object as `record['FIELD']`, `record["FIELD"]`, `record.?FIELD`, `record[?'FIELD']` or any of those on `previous`, at `error`, with the message they already give for `record.FIELD`.
+- The object save door runs the same pass, so an object write in publish mode that carries such an expression is now refused with an `expression-invalid` issue located at the slot, the build's own finding.
+- A declared read attachment's leaf (`ObjectSchema.attachedOnRead`) is judged in the same spellings: `record.viewer['can_actt']` and `record.viewer.?can_actt` are refused like `record.viewer.can_actt`. An earlier entry in this release says index access on a read attachment stays unjudged; that describes the check before this change.
+
+**Remedy.** Declare the field on the object, or fix the typo to the field the message suggests. The spelling itself is not the defect: `record['status']`, `record.?status` and `record[?'status']` on a declared `status` are accepted, as before.
+
+**Unchanged.**
+
+- A computed key (`record[record.kind]`, `record[someVar]`) names no member before evaluation, so it is not judged.
+- A method call on a member (`record.name.startsWith('A')`) still judges the member (`name`).
+- Stored rows are not migrated or refused on read; an object stored before this change keeps loading until it is next saved, and that save is judged. Drafts are not gated.
+- Measured before crossing: the stacks this repository ships give the same expression findings before and after the change. That covers `examples/app-todo`, `examples/app-crm`, both `examples/app-multi-package` sub-stacks, the objects, actions, flows, views and pages of `examples/app-showcase`, the 51 objects `@objectstack/platform-objects` exports, and `plugin-approvals`' `sys_approval_request`, whose eight action predicates read the leaves of its declared `viewer` read attachment and pass. No in-repo producer writes a non-dot spelling of an undeclared field.
+- No public export or signature moves; only the doc comments of `ExprSchemaHint.fields` and `ExprSchemaHint.attachedOnRead` change. `analyzeRelationshipTraversals` answers exactly what it answered before: measured identical, set order included, on 4,528 analyses of the 2,264 `record` / `previous` expressions in this repository's TypeScript sources.
@@ -1460,7 +1460,9 @@ jobs:
       # held by every later refresh; it rises only by a ruled entry in the
       # script's RULED_CEILING_RAISES. A `provisional` package prints "no
       # ceiling: provisional" and is not red; a package absent from the dataset
-      # is red (the new-package shape). See the script header for the ruling.
+      # prints "no ceiling: new package" and is not red until the first refresh
+      # after it lands gives it a ceiling, while a package the dataset knows
+      # that lost its row is refused, red. See the script header for the ruling.
       #
       # HERE, in the aggregator, rather than in each shard, because the CLI's
       # file-level slices land on three shards: the three windows are SUMMED
 
@@ -279,9 +279,10 @@ after DNS propagates.
 <Callout type="info">
 **The mounts are unconditional; the switch controls the endpoint behind them.**
 Both routes exist whether or not `OS_SSO_DOMAIN_VERIFICATION` is set — and with
-it unset the two halves report that differently, so match on the code rather than
-the status: step 1 answers **400 `DOMAIN_VERIFICATION_DISABLED`**, step 2 passes
-the inner **404** through with an explanatory message. Either way an anonymous
+it unset there is no endpoint behind them, so both steps answer **400
+`DOMAIN_VERIFICATION_DISABLED`**. With it on, either step answers an unknown
+`providerId` with **404 `RESOURCE_NOT_FOUND`**; step 2's `NO_PENDING_VERIFICATION`
+is a 404 too, so match on the code rather than the status. Either way an anonymous
 caller gets **401 `UNAUTHENTICATED`** and a signed-in non-platform-admin **403
 `PERMISSION_DENIED`** — identity is answered before capability, so a stranger
 cannot use these routes to probe which features an environment has enabled.
 
@@ -39,6 +39,21 @@ export type McpTransport =
           args?: string[];
           /** Environment variables for the child process — carries credentials. */
           env?: Record<string, string>;
+          /**
+           * Working directory of the child process. A relative `command` path
+           * (one with a path separator, e.g. `./bin/server`) resolves against
+           * it, and so does a relative path the launched program resolves
+           * itself, such as the script in `node ./server.mjs`. A bare
+           * executable name (`node`, `npx`) is still looked up on `PATH`, and an
+           * absolute path is unaffected. Omitted, the child inherits the host
+           * process's current directory.
+           *
+           * The `mcp` provider factory sets it for a **declarative** instance to
+           * the root of the app that declared it (ADR-0097), so one app's
+           * relative paths resolve against one anchor wherever the server was
+           * started. A hand-wired transport keeps whatever its author passes.
+           */
+          cwd?: string;
       }
     | {
           kind: 'http';
@@ -174,6 +189,8 @@ async function defaultClientFactory(
                 command: transport.command,
                 args: transport.args,
                 env: transport.env,
+                // `undefined` inherits the host's current directory, as before.
+                cwd: transport.cwd,
             }),
         );
     } else {
 
@@ -191,3 +191,110 @@ describe('mcp provider declarative stdio policy (#3055)', () => {
         expect(mat.def.name).toBe('github');
     });
 });
+
+// ── #22423 — a declarative stdio transport runs in the declaring app's root ──
+//
+// One anchor for an app's relative paths: the host's
+// `ConnectorProviderContext.resolvePackagePath('.')` (the same root the
+// `openapi` provider's `providerConfig.spec` is read under) becomes the stdio
+// child's working directory. The anchor is the host's alone; an authored
+// `providerConfig.transport.cwd` never reaches the transport. A host without
+// the member gets the transport exactly as before: no `cwd` key at all.
+
+describe('mcp provider: declarative stdio working directory (#22423)', () => {
+    const ROOT = '/srv/apps/my-app';
+    const stdioCfg = { transport: { kind: 'stdio', command: 'node', args: ['./scripts/server.mjs'] } };
+
+    function recordingResolver(answer = ROOT) {
+        const asked: string[] = [];
+        const resolvePackagePath = async (relativePath: string) => {
+            asked.push(relativePath);
+            return answer;
+        };
+        return { resolvePackagePath, asked };
+    }
+
+    it("sets the stdio cwd to the host's resolvePackagePath('.'), leaving command and args as written", async () => {
+        const { factory: clientFactory, seen } = fakeClientFactory();
+        const { resolvePackagePath, asked } = recordingResolver();
+        const factory = createMcpProviderFactory({ clientFactory, declarativeStdio: ['node'] });
+
+        await factory(ctx({ providerConfig: stdioCfg, resolvePackagePath }));
+
+        expect(asked).toEqual(['.']);
+        const t = seen.transport;
+        expect(t?.kind).toBe('stdio');
+        if (t?.kind !== 'stdio') return;
+        expect(t.cwd).toBe(ROOT);
+        expect(t.command).toBe('node');
+        expect(t.args).toEqual(['./scripts/server.mjs']);
+    });
+
+    it('keeps the transport exactly as before when the host provides no resolvePackagePath', async () => {
+        const { factory: clientFactory, seen } = fakeClientFactory();
+        const factory = createMcpProviderFactory({ clientFactory, declarativeStdio: ['node'] });
+
+        await factory(ctx({ providerConfig: stdioCfg }));
+
+        expect(seen.transport?.kind).toBe('stdio');
+        expect(Object.keys(seen.transport ?? {})).not.toContain('cwd');
+    });
+
+    it('never honours an authored providerConfig.transport.cwd: the anchor is the host\'s', async () => {
+        const authored = { transport: { ...stdioCfg.transport, cwd: '/somewhere/else' } };
+
+        const withHost = fakeClientFactory();
+        const { resolvePackagePath } = recordingResolver();
+        await createMcpProviderFactory({ clientFactory: withHost.factory, declarativeStdio: ['node'] })(
+            ctx({ providerConfig: authored, resolvePackagePath }),
+        );
+        expect(withHost.seen.transport?.kind === 'stdio' && withHost.seen.transport.cwd).toBe(ROOT);
+
+        const withoutHost = fakeClientFactory();
+        await createMcpProviderFactory({ clientFactory: withoutHost.factory, declarativeStdio: ['node'] })(
+            ctx({ providerConfig: authored }),
+        );
+        expect(Object.keys(withoutHost.seen.transport ?? {})).not.toContain('cwd');
+    });
+
+    it('does not consult the resolver for an http transport', async () => {
+        const { factory: clientFactory, seen } = fakeClientFactory();
+        const { resolvePackagePath, asked } = recordingResolver();
+        const factory = createMcpProviderFactory({ clientFactory });
+
+        await factory(
+            ctx({ providerConfig: { transport: { kind: 'http', url: 'https://mcp.example.com' } }, resolvePackagePath }),
+        );
+
+        expect(asked).toEqual([]);
+        expect(Object.keys(seen.transport ?? {})).not.toContain('cwd');
+    });
+
+    it('judges the declarativeStdio policy first: a denied command never reaches the resolver', async () => {
+        const { factory: clientFactory, seen } = fakeClientFactory();
+        const { resolvePackagePath, asked } = recordingResolver();
+        const factory = createMcpProviderFactory({ clientFactory }); // default deny
+
+        await expect(factory(ctx({ providerConfig: stdioCfg, resolvePackagePath }))).rejects.toThrow(
+            /stdio transports are disabled by default/,
+        );
+        expect(asked).toEqual([]);
+        expect(seen.transport).toBeUndefined();
+    });
+
+    it('treats a resolver failure as a configuration fault (plain, not upstream-unavailable), before any connection', async () => {
+        const { factory: clientFactory, seen } = fakeClientFactory();
+        const factory = createMcpProviderFactory({ clientFactory, declarativeStdio: ['node'] });
+        const resolvePackagePath = async (): Promise<string> => {
+            throw new Error('host cannot resolve paths here');
+        };
+
+        const err: unknown = await Promise.resolve(factory(ctx({ providerConfig: stdioCfg, resolvePackagePath }))).catch(
+            (e: unknown) => e,
+        );
+
+        expect(err).toBeInstanceOf(Error);
+        expect(isConnectorUpstreamUnavailable(err)).toBe(false);
+        expect(seen.transport).toBeUndefined();
+    });
+});
@@ -162,6 +162,18 @@ function assertDeclarativeStdioAllowed(
  * Stdio transports on declarative instances are policy-gated (default deny) —
  * see {@link McpDeclarativeStdioPolicy} (#3055).
  *
+ * A declarative stdio transport runs **in the declaring app's root** (#22423):
+ * when the host hands `ConnectorProviderContext.resolvePackagePath`, the
+ * child's working directory is `resolvePackagePath('.')`, so the app's relative
+ * `command` and `args` resolve against the same anchor as its other relative
+ * refs (the `openapi` provider's `providerConfig.spec`, read through
+ * `loadPackageFile`), not against the directory the server was started from.
+ * The anchor is the host's: `providerConfig.transport` carries no working
+ * directory, and an author cannot write one. A host without the member keeps
+ * the previous behaviour — no `cwd`, so the child inherits the host's current
+ * directory. The policy check runs first and is unchanged: it judges the
+ * `command` string exactly as written.
+ *
  * The connection is opened at materialization. Faults are classified (#3017):
  * an invalid transport shape is a *configuration* fault and throws plain —
  * fatal at boot per the ADR-0097 fail-loud contract — while a connect /
@@ -173,9 +185,15 @@ function assertDeclarativeStdioAllowed(
 export function createMcpProviderFactory(deps: McpProviderDeps = {}): ConnectorProviderFactory {
   return async (ctx) => {
     const cfg = (ctx.providerConfig ?? {}) as McpProviderConfig;
-    const transport = normalizeTransport(cfg.transport, ctx.name, ctx.auth);
+    let transport = normalizeTransport(cfg.transport, ctx.name, ctx.auth);
     if (transport.kind === 'stdio') {
       assertDeclarativeStdioAllowed(deps.declarativeStdio, transport.command, ctx.name);
+      // One anchor for the app's relative paths (#22423). A resolver that
+      // throws is a host fault: it propagates plain, a configuration error
+      // (fatal at boot), never upstream-unavailable.
+      if (ctx.resolvePackagePath) {
+        transport = { ...transport, cwd: await ctx.resolvePackagePath('.') };
+      }
     }
     const includeList = Array.isArray(cfg.include)
       ? cfg.include.filter((x): x is string => typeof x === 'string')