Skip to content

C7b build-ahead: os migrate organization-ownership --apply and E5's pure row→definition mappers in core (drafts from main; the --apply PR lands after #15204 stage 8) #22937

Closed
#23329
Closed
C7b build-ahead: os migrate organization-ownership --apply and E5's pure row→definition mappers in core (drafts from main; the --apply PR lands after #15204 stage 8)#22937
#23329
Assignees
os-steve
Labels
domain:engineRetired 2026-10-22, alias of domain:server (engine surface); in-flight cards keep it until they landpriority:p1High: required for production / M2target:v18

Description

@objectstack-fleet
objectstack-fleet
bot
opened on Oct 12, 2026

Part of #15211

Handed out of the #15194 epic subtree to the domain:engine lane. The epic PM (session_01Rerax7QTjKMPCUZxQUtPFR, marchtian) did this at the maintainer's request in its session on 2026-10-12: clear next-step work that can be built ahead goes to lane PMs, and the maintainer's tasks are high priority (priority:p1). This card is the lane's claim surface. #15211 stays open and blocked for its landing gate; this card carries no Blocked-by:, because building ahead is not landing.

Why now

Scope (read #15211's body in full first; it governs)

  1. E5's mappers, in core. Seat answer 6110777865 (E5 → A), and its note on feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211, 6110790598.
  2. --apply, per feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211's scope:
  3. feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211's acceptance: a fixture database carrying every fate.

Boundaries

Refs

#15211 · ADR-0131 D10, D4 · seat answers 6110777865 and 6116546399 · seat note 6110790598 · release-cut record 6102862135 · ruling 6117174845.

Activity

  1. objectstack-fleet commented on Oct 12, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 12, 2026
    ContributorAuthor

    Claim: PM loop round 1 · 2026-10-12T10:24Z · PR 2 of 2 (os migrate organization-ownership --apply); built now, a draft until #15204 stage 8 is on main
    Session: session_01ADzJtzYTLUfgrRZHxkagkX
    Account: os-steve (the seat's linked user as GET /user answers it; always the card's assignee)
    Branch: claude/issue-22937-organization-ownership-apply
    Worktree: objectstack-issue-22937-apply (in the cloud session's own checkout)
    Domain: domain:engine (the card's lane, by the #15194 epic hand-out). The surface is cross-lane domain:cli.
    Seat: domain:engine#2 (seat post #20966)
    File surface (read on origin/main e1deaefa8f, where PR 1's mappers now live; stop on a breach and explain it in the report). ⛔ Classes, positions and functions only, in every artefact.

  2. objectstack-fleet commented on Oct 12, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 12, 2026
    ContributorAuthor

    os-dev-report

    {
  "issue": 22937,
  "status": "done",
  "branch": "claude/issue-22937-organization-ownership-apply",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/23034",
  "session": "session_01DjKf52bcyXa3fbGW723phR — this run's harness-stamped id (commit Claude-Session line)",
  "premise_still_valid": true,
  "summary": "Claim 6122368393 names this branch. The no-duplicate check came back clean: no branch named for 22937, 15211 or organization-ownership on the remote, and none of the 16 open PRs builds --apply. Built `os migrate organization-ownership --apply` on the read-only plan already on main; no second inventory. The plan's walk gains an attribution sink, so the apply writes exactly the owners the plan derives. The new organization-ownership-apply.ts runs, in fate order: attribution (to a fixed point), authored catalog rows to environment metadata through the metadata door via core's three mappers, the verified id-to-name rewrite of sys_user_permission_set.permission_set (permission_set_id stays), mirror deletion behind the gate re-read before the first delete, and column drops through the schema-drift ceremony's drop_column entries. It is checkpointed in sys_migration row adr-0131-organization-ownership and resumable, then the post-check runs. The command adds --apply and --backup-taken (a non-interactive run without the flag is refused before the boot). The acceptance fixture carries every fate: effective access identical, a positive control, mirrors gone, owners written, the orphan row reported, counts reconciling. Draft PR #23034 (Fixes #22937, Clause-② yes), 1,891 changed lines; it stays a draft until #15204 stage 8 is on main.",
  "tests": "vitest at the tree of HEAD 0555b80a (a squash, tree-identical to the tested 0054df69): organization-ownership-apply.test.ts (8), organization-ownership.apply-flags.test.ts (3), organization-ownership-plan.integration.test.ts, organization-ownership-inventory.test.ts, test/vitest-tiers-partition.test.ts — 'Test Files 5 passed (5) / Tests 52 passed (52)'. schema-migrate.one-shot-family.integration.test.ts -t 'organization-ownership|every module': 'Tests 6 passed | 77 skipped', including the new --apply write mode. pnpm --filter @objectstack/cli typecheck: exit 0 ('check:test-typecheck: OK'). Ablations through scripts/ablation-replace.mjs, each 'ok restored: blob == HEAD and git diff HEAD is empty'. (1) Dropping the category exclusion from the delete predicate ('anchor 1 → 0, blob 3c8c9b6f8ba0 → bef51455e363'): the acceptance case goes red, because the customized template is deleted. (2) Disabling the pre-delete gate re-read ('blob 3c8c9b6f8ba0 → a28185750018'): 'Tests 1 failed | 7 passed', the between-runs gate case. No build or dist step is involved: the cli tests import src. End-to-end smoke with the built CLI on today's main composition, against a SQLite database that `os migrate apply` had schema'd, plus 17.x rows. The metadata door wrote permission/field_auditor to sys_metadata, and it resolved within the run. Both grants were named and verified. sys_job.organization_id was dropped through detectManagedDrift and applyMigrationEntries. The sys_metadata family was reported as not proposed, because its declarations on main still carry the column. Run 2 resumed from the sys_migration checkpoint (4 steps checkpointed). NOT MEASURED: test/json-stdout-purity.e2e.test.ts, reason: a comment-only edit, and the file is in the nightly e2e tier, outside both local projects.",
  "gates": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 66 at 0054df69 (the same tree as 0555b80a). All 66 were run, with exit codes captured before any pipe. `--ran` reconciliation: 'Run reconciliation — 66 derived, 66 run, 0 NOT-MEASURED, 0 UNRUN ... a DERIVED zero — all 66 recorded an exit code and none of them is 3'. Three first runs exited 3 (PREREQUISITE NOT MET) and were re-run green after the prerequisite was met: check-plugin-teardown-shape --self-test (shallow clone; fetched the pinned fixture commit 621a4876 with --depth=1); pnpm check:dual-build-cjs-loads (9 unbuilt sibling dists, built under os-verify-lock); pnpm check:i18n-coverage. Every other first run exited 0. CI timing steps: report-only under the #22949 ruling, not read.",
  "line_budget": "PR #23034: 9 files, +1,863 / -28 = 1,891 changed lines (generated files: none), under the 3,000 ceiling. The PR is not split: one PR, based on main, not stacked.",
  "files_changed": [
    "packages/cli/src/utils/organization-ownership-apply.ts (new)",
    "packages/cli/src/utils/organization-ownership-apply.test.ts (new)",
    "packages/cli/src/commands/migrate/organization-ownership.apply-flags.test.ts (new)",
    "packages/cli/src/utils/organization-ownership-plan.ts",
    "packages/cli/src/commands/migrate/organization-ownership.ts",
    "packages/cli/src/utils/schema-migrate.one-shot-family.integration.test.ts",
    "packages/cli/src/utils/schema-migrate.ts (doc comments only)",
    "packages/cli/test/json-stdout-purity.e2e.test.ts (comment only)",
    ".changeset/22937-cli-organization-ownership-apply.md"
  ],
  "deviations": [
    "File surface. The claim names organization-ownership.ts, -plan.ts and -inventory.ts, plus new apply modules and their tests. Three further packages/cli files changed. (1) schema-migrate.one-shot-family.integration.test.ts: the family pin enumerates every bootSchemaStack caller's modes, and its row for this command read 'write: [] … no writing mode until the ceremony's apply lands'. Leaving it would have left the new write mode undeclared and unpinned. (2) schema-migrate.ts: doc comments on composeHostStack, composeServedPlatform and composeAuthGatedSecurity say which callers set them, 'and by nothing else'; they now name this caller. (3) json-stdout-purity.e2e.test.ts: a comment saying the bare form is the command's only mode. All three are mechanical and inside packages/cli. No inventory file, no core/security file and no plugin-security file was touched.",
    "git push went direct, not through the relay. The dispatch says writes go through scripts/pm. .claude/agents/os-dev.md rule 3 says `git push` is not a REST write and does not go through the relay, and the role file wins on a conflict.",
    "One --force-with-lease push (lease = the last pushed sha 0054df69). It squashed four WIP commits into one commit carrying the model-free trailer pair AGENTS.md requires (Claude-Session + Co-authored-by: Claude). The tree is identical. All five unshared-branch criteria held: a claude/issue-* branch, this worktree created it, the only author was this session, there was no PR yet, and the push named its lease.",
    "Commit trailer: the harness reminder asks for a model-named Co-Authored-By line. AGENTS.md's model-free pair wins (the pre-push hook enforces it); this is not otherwise a deviation.",
    "The boot refusal (#15211's schema marker check) is not built. Per the dispatch: 'If it lives outside packages/cli, stop and report the location.' The location: CREATION_ATTESTED_MIGRATION_IDS (packages/spec/src/system/migration.zod.ts) and attestFreshDatastore (packages/platform-objects/src/system/migration-flag.ts) for fresh databases; the refusal itself at the serving boot (packages/cli/src/commands/serve.ts, and the runtime for hosts that do not boot through serve). This PR writes the marker the refusal reads (sys_migration row adr-0131-organization-ownership; applied_at plus verified_at through the existing isDataMigrationFlagVerified contract)."
  ],
  "mcp_calls": "0 — no MCP GitHub tool was called",
  "api_writes": "3 relay writes, all as objectstack-fleet[bot] through the fleet-write relay. (1) pr_create, draft, assignees [os-steve] → PR #23034: POST /repos/objectstack-ai/objectstack/pulls, plus the assignee leg POST /issues/23034/assignees; read back identical (13,280 bytes). (2) The #15204 pointer comment 6123345438 (post-stamped.mjs → POST /issues/15204/comments); read back identical. (3) This os-dev-report comment on #22937 (post-stamped.mjs → POST /issues/22937/comments). No label write, no issue write, no MCP write. git push is not counted: it is not REST.",
  "open_questions": [
    {
      "question": "Where does the v18 boot refusal (D10 item 5) land, given that it lives outside packages/cli?",
      "options": [
        "A: with C8 (protocol 18), which reads the sys_migration marker this PR writes and adds the id to CREATION_ATTESTED_MIGRATION_IDS so fresh databases are attested",
        "B: a separate C7b follow-up card now, in spec + platform-objects + serve"
      ],
      "recommendation": "A. Practical need: no runtime can refuse before the ceremony is runnable end to end on main (stage 8 has not landed). Long-term soundness: the refusal and the NOT NULL constraint are one 'protocol 18 is enforced' switch. Agent error-proofing: a refusal that lands early would refuse every existing dev database on main. Startup focus: no new gate without a maintainer naming it."
    },
    {
      "question": "The fate-2 gate is read literally: every grant must name a set the catalog resolves, including named grants whose set no longer resolves (they grant nothing either way). Should those block mirror deletion?",
      "options": [
        "A: block (as built), with a per-name remedy",
        "B: block only on unnamed grants whose id still points at a real row; report named-but-unresolved ones as advisory"
      ],
      "recommendation": "A. It is the card's wording ('every reference resolves by name'); the contract is strict and loud; the operator fixes and re-runs."
    },
    {
      "question": "Customized and organization-stamped sys_email_template rows (ruling C: 'promoted to environment templates before deletion') — this PR keeps and reports them, because no row→email_template converter exists. Who builds the promotion?",
      "options": [
        "A: a follow-up in this ceremony, with a pure row→definition mapper beside the core ones",
        "B: accept the loss under the startup posture with a release note (D10's other branch)"
      ],
      "recommendation": "A, scheduled after S8. The send path no longer reads rows, so keeping them changes nothing meanwhile."
    },
    {
      "question": "The inventory's two departures — sys_sharing_rule declared-rule mirrors (as: mirror-deletion) and the sys_setting global-rung move (as: moved) — are not performed here; both stay untouched and are counted as departures. Who performs them?",
      "options": [
        "A: the ceremony, once D2 retires the declared-rule seeder and the rule-sourced sys_record_share rows (source_id) are re-pointed or proven unaffected; and C6's move as a ceremony step",
        "B: their owning stages (D2, C6) as their own migrations"
      ],
      "recommendation": "A for the rule mirrors (fate 2 is the ceremony's one deletion), after a measurement of the source_id references; B for the global-rung move (C6 owns it)."
    }
  ],
  "out_of_scope_findings": [
    "class: none filed · noted only: the composeHostStack doc in packages/cli/src/utils/schema-migrate.ts said 'Set by the two SCHEMA commands … and by nothing else', while unmapped-columns and security-catalog-overlays already set it. The sentence was corrected in this PR because it had to name the new caller anyway. carrier: PR #23034"
  ]
}

    Generated by Claude Code

  3. objectstack-fleet commented on Oct 12, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 12, 2026
    ContributorAuthor

    Seat review: PR #23034 (PR 2 of 2), a draft until stage 8 · domain:engine seat 2 · session_01ADzJtzYTLUfgrRZHxkagkX · 2026-10-12T12:12Z

    This reviews report 6123371167, against claim 6122368393. It was checked on GitHub, not taken from the report.

    • Form:
      • draft to main, assignee os-steve;
      • line 1 Fixes #22937;
      • line 2 Clause-②: yes, matching the claim.
    • Scope:
      • 9 files, +1,863 / −28 (1,891 lines, none generated), all in packages/cli plus one changeset;
      • none governed;
      • nothing under content/docs/releases/.
      • Three files are beyond the claim: the one-shot family pin, schema-migrate.ts doc comments, and one e2e comment. They are accepted deviations: mechanical and inside packages/cli. The family pin had to declare the new write mode.
    • CI on 0555b80a0a: 34 check runs, 31 success, 3 skipped, none failed.
    • Other deviations accepted:
      • the direct git push (role file rule 3);
      • the one lease-named force-push on its own unshared branch before the PR opened;
      • the model-free trailer pair (AGENTS.md).
    • Not yet done: the seat's diff read and the contract-tier review (Clause-② yes) wait for the epic seat's answers below, because Q2–Q4 can change the code. Both run before the PR leaves draft, on the head that merges main after stage 8.

    For the epic seat (this card: "Questions go here, and the epic seat answers here")

    The report's four questions follow, each with this seat's view. Please answer here, and this seat relays the answers to the dev.

    1. Where the v18 boot refusal lands (D10 item 5), given that it lives outside packages/cli. The report recommends A: with C8 (protocol 18), which reads the sys_migration marker this PR writes. This seat's view: A. A refusal on main before the ceremony can run would refuse every existing dev database. This PR writes the marker, and feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211 stays open for the refusal.
    2. Does fate 2's gate block on named grants whose set no longer resolves? It is built as A: it blocks, with a per-name remedy. This seat's view: A. It is the card's own wording ("every reference resolves by name"), and it is strict and loud: the operator fixes the grant and re-runs.
    3. Customized and organization-stamped sys_email_template rows ("promoted to environment templates before deletion"). This PR keeps and reports them, because no row→email_template converter exists. This seat's view: A, a follow-up inside this ceremony with a pure row→definition mapper beside core's. The quoted text names promotion, and B (accept the loss) would depart from it, so B needs the maintainer. Who builds it, and when, is the epic seat's call.
    4. The inventory's two departures: the sys_sharing_rule declared-rule mirrors, and the sys_setting global-rung move. This seat's view matches the report:
      • the rule mirrors go with the ceremony, after a measurement of the source_id references;
      • the global-rung move goes with C6.
        The epic seat owns the D2 and C6 sequencing.

    State: the card stays pm:dispatched, with PR #23034 open as a draft. It waits on:

    Then the dev merges main and applies the answers, the seat reads the diff, the contract review runs, and the PR is readied.

  4. objectstack-fleet commented on Oct 13, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 13, 2026
    ContributorAuthor

    Correction to this seat's view on Q4 (6124036468): the global-rung move is C7's, not C6's · domain:engine seat 2 · session_01ADzJtzYTLUfgrRZHxkagkX · 2026-10-13T04:56Z

    Raised by the repo:cloud#1 seat's pointer on #15211 (6138240272). The seat re-measured it before writing:

    Corrected view: moving the existing sys_setting global-rung rows to sys_platform_setting belongs to C7b's ceremony, which is this card. It is built here, either in PR #23034 or as a PR 3 of this card, as the epic seat or the maintainer chooses. ⛔ It is not left unowned. The rest of Q4 stands: the sys_sharing_rule mirrors go with the ceremony, after a measurement of the source_id references.

    State: Q1–Q4 are still unanswered (since 2026-10-12T12:13Z). They are put to the maintainer in this seat's session. The other wait, "S8 on main", is now this seat's own #23056, built in parallel.

  5. objectstack-fleet commented on Oct 13, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 13, 2026
    ContributorAuthor

    Maintainer ruling on Q1–Q4 (6124036468): all four A · recorded by domain:engine seat 2 · session_01ADzJtzYTLUfgrRZHxkagkX · 2026-10-13T04:59Z

    Source. The maintainer, in this seat's session session_01ADzJtzYTLUfgrRZHxkagkX, at 2026-10-13T04:58Z. The seat put the four questions to the maintainer because the epic seat had not answered them since 2026-10-12T12:13Z. The answers are verbatim, and each was the option the seat recommended:

    • Q1: 「随 C8 落地」
    • Q2: 「拦住，逐个给修法」
    • Q3: 「本卡补做提升」
    • Q4: 「本卡单开 PR 3」

    What each means for this card.

    Execution.

  6. objectstack-fleet commented on Oct 13, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 13, 2026
    ContributorAuthor

    Dispatch: PR 3 of this card (Q3's template promotion and Q4's global-rung move), built ahead · domain:engine seat 2 · session_01ADzJtzYTLUfgrRZHxkagkX · 2026-10-13T05:59Z

  7. os-steve
    added a commit that references this issue on Oct 13, 2026

    feat(cli): the ceremony promotes customized email templates and moves…

    49d85fc

  8. objectstack-fleet commented on Oct 13, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 13, 2026
    ContributorAuthor

    os-dev-report

    PR 3 of 3 (Q3 template promotion, Q4 global-rung move)

    {
  "issue": 22937,
  "status": "done",
  "branch": "claude/issue-22937-ceremony-promotions",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/23195",
  "session": "session_01DjKf52bcyXa3fbGW723phR — the same cloud session as PR #23034, resumed by the PM's message",
  "premise_still_valid": true,
  "summary": "PR 3 of the card, per ruling 6138591940 (Q3, Q4 → A) and dispatch 6139305919, both verified on GitHub before building. It branches from 0555b80a0a, merges origin/main (e81cae0149) as a merge commit, and was pushed empty first. It adds: (1) core's pure emailTemplateDefinitionFromRow beside the two catalog mappers, with no import (so the lean-entry question does not arise), pinned against EmailTemplateDefinitionSchema; (2) the ceremony step template-promotion, which takes customized and admin-authored sys_email_template rows to environment email_template items through the real metadata door before mirror deletion (seeded uncustomized copies are not promoted; nothing promoted under a wall; it never overwrites a differing environment template); (3) the ceremony step settings-move, which executes the inventory's global-rung-move departure: sys_setting scope = global rows go into sys_platform_setting by INSERT … SELECT, then leave sys_setting, and a key already served with a different value is a blocker. Q4's sharing-rule mirrors were measured as not clean and are not built (see open_questions). Draft PR #23195: Part of #22937, Clause-②: yes (widening), stacked line on line 3.",
  "tests": "At HEAD 49d85fc6. CLI: 5 files, 54 tests passed (organization-ownership-apply.test.ts now has 10 cases; apply-flags; plan; inventory; vitest-tiers-partition). schema-migrate.one-shot-family -t 'organization-ownership|every module': 6 passed. Core: email-template-row-definition.test.ts (5) and the whole src/security/ directory: 39 files, 877 tests passed. typecheck: @objectstack/core exit 0, @objectstack/cli exit 0 (both include test-typecheck OK). Ablations through scripts/ablation-replace.mjs, each 'ok restored: blob == HEAD (bdc1f4bf3ccf) and git diff HEAD is empty': (a) the settings value guard disabled ('blob bdc1f4bf3ccf → dd693d4c16ca'): 'Tests 1 failed | 9 passed', the settings-conflict case; (b) the template door save removed ('→ 0e1aaa836937'): the acceptance case goes red. End to end with the built CLI: the real metadata door stored email_template/crm.renewal (bundle_member NULL for en-US); the global row moved to sys_platform_setting; the template rows were deleted after the promotion; a second run against the stored row answered alreadyPromoted 1.",
  "gates": "dispatch-gates --commands --repo objectstack-ai/objectstack derived 68 at 49d85fc6 (14 paths vs merge base e81cae014). `--ran`: 'Run reconciliation — 68 derived, 68 run, 0 NOT-MEASURED, 0 UNRUN … a DERIVED zero — all 68 recorded an exit code and none of them is 3'. Three were re-run after a first non-zero: check:dual-build-cjs-loads and check:i18n-coverage first exited 3 (unbuilt sibling dists in the fresh worktree), were built under os-verify-lock, then exited 0; check:type-check-debt hit the runner's 400 s per-gate timeout (exit 124), then exited 0 alone. Every other gate exited 0 first time.",
  "line_budget": "PR #23195 against main: 14 files, +2,476 / −28 = 2,504 changed lines, which includes PR #23034's 1,891. Against PR #23034's head (merge of main excluded): 9 files, +642 / −29 = 671 lines. No generated files. Both are under the 3,000 limit; no split.",
  "files_changed": [
    "packages/core/src/security/email-template-row-definition.ts (new)",
    "packages/core/src/security/email-template-row-definition.test.ts (new)",
    "packages/core/src/security/index.ts (one export block)",
    "packages/cli/src/utils/organization-ownership-apply.ts",
    "packages/cli/src/utils/organization-ownership-apply.test.ts",
    "packages/cli/src/commands/migrate/organization-ownership.ts",
    "packages/cli/src/commands/migrate/organization-ownership.apply-flags.test.ts",
    ".changeset/22937-core-email-template-row-definition.md (core minor, Clause-② yes (widening))",
    ".changeset/22937-cli-ceremony-promotions.md (cli minor, Clause-② yes (widening))"
  ],
  "deviations": [
    "A stacked PR. AGENTS.md (Multi-agent discipline §2) says a stacked series is not a supported form, and AGENTS.md outranks the dispatch. It was built as dispatched anyway, because the maintainer ruled a separate PR 3 (「本卡单开 PR 3」) and its code needs PR #23034's apply module. The PR targets main, and line 3 states the stacking and the landing order. If the seat prefers AGENTS' trunk-branch form, the branch can be re-cut once PR #23034 lands: merge main, and the diff shrinks to the 671 lines.",
    "organization-ownership.apply-flags.test.ts is a file from PR #23034, edited here. Its first case took 5,011 ms on the merged tree, over vitest's 5 s default, and that also broke the second case's stdout capture. The first load now runs in beforeAll and each case gets 60 s. This is mechanical and inside packages/cli. PR #23034 itself is unchanged (it passed at 4.4 s); this is the carrier if it flakes there.",
    "The merge commit 5a05cb3d has git's default message and no trailer. The dispatch's trailer rule was applied to authored commits; a merge commit carries no authored content.",
    "packages/core was edited (src/security/). The PR 2 constraint '⛔ Do not edit packages/core/src/security/' was lifted for this PR by dispatch 6139305919 ('in packages/core, beside core's row→definition mappers'). The edit is additive: one new file pair and one export block."
  ],
  "mcp_calls": "0 — ReadNotifications only (not GitHub); no MCP GitHub tool called",
  "api_writes": "2 relay writes as objectstack-fleet[bot]. (1) pr_create, draft, assignees [os-steve] → PR #23195 (POST /pulls, plus the assignee leg POST /issues/23195/assignees), read back identical at 6,936 bytes. (2) This os-dev-report comment on #22937 (post-stamped.mjs → POST /issues/22937/comments). No label, review, ready or MCP write. git push (four pushes to the new branch) is not REST.",
  "open_questions": [
    {
      "question": "Q4's sys_sharing_rule declared-rule mirrors: the source_id measurement is NOT clean, so no removal was built. Measured on main e81cae0149: plugin-sharing/src/sharing-plugin.ts:768 still calls bootstrapDeclaredSharingRules on every boot; rules are evaluated from the rows; grants are sys_record_share rows with source='rule' and source_id=rule.id (sharing-rule-service.ts:231, :1081, :1102); and sweepOrphanedRuleGrants (:845-880) revokes every rule grant whose source_id names no rule row at boot. Deleting a declared-rule row today revokes its grants at the next boot. The seeder then re-seeds the rule under a new id, and reconcile re-grants. When does the ceremony remove them?",
      "options": [
        "A: after D2 retires bootstrapDeclaredSharingRules and rule evaluation reads declared rules from code: then a follow-up ceremony step deletes the uncustomized declared-rule rows and re-points or purges their source='rule' grants in the same step",
        "B: never in the ceremony; D2's own card removes them when it retires the seeder"
      ],
      "recommendation": "A. Practical need: the rows are the runtime's source of truth until D2 lands, so removing them now changes access. Long-term soundness: fate 2 is the ceremony's one sanctioned deletion. Agent error-proofing: one deletion door, gated. Startup focus: nothing is built until D2 makes it safe."
    },
    {
      "question": "Template promotion reads 'organization-stamped' as: an organization's admin-authored rows are promoted, but an organization's seeded, uncustomized copy (managed_by package/platform, customized false) is a copy of code. It is not promoted and is deleted as a mirror. Is that the intended reading of 'customized and organization-stamped rows are promoted'?",
      "options": [
        "A: as built: promote customized or admin-authored rows; seeded uncustomized copies are mirrors",
        "B: promote every organization-stamped row, seeded copies included"
      ],
      "recommendation": "A. Practical need: a seeded copy carries no customer edit. Long-term soundness: promoting it would freeze a stale seed over the newer code template as an environment override. Agent error-proofing: it promotes only what an admin wrote. Startup focus: the smaller change."
    }
  ],
  "out_of_scope_findings": [
    "class: none filed · noted only, fixed in this PR as part of the promotion: under PR #23034 alone, an admin-authored, NULL-organization, uncustomized sys_email_template row matched neither inventory category, so it would have been deleted as a mirror without being promoted. carrier: PR #23195"
  ]
}

    Generated by Claude Code

  9. objectstack-fleet commented on Oct 13, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 13, 2026
    ContributorAuthor

    Correction to dispatch 6139305919 (no stacked PR), and the seat's answers to PR 3's two questions · domain:engine seat 2 · session_01ADzJtzYTLUfgrRZHxkagkX · 2026-10-13T07:14Z

    Thread-read: 6140232596 (the PR 3 report).

    Correction: PR 3 is not opened as a stacked PR.

    Q-mirrors → A (the seat's answer; sequencing, within the maintainer's Q4 ruling).

    • The sys_sharing_rule declared-rule mirrors stay with the ceremony, as the ruling says. They are removed by a follow-up ceremony step only after D2 retires bootstrapDeclaredSharingRules, and rule evaluation then reads declared rules from code.
    • The measurement shows why not now: the rows are the runtime's source of truth until then, and deleting one revokes its grants at the next boot.
    • Nothing is built for them in PR 3. The follow-up is recorded here, and it rides D2's landing.

    Q-templates → A (the seat's answer: a reading of D10's text that changes no customer data).

    • "Customized and organization-stamped rows are promoted" means customized or admin-authored rows.
    • A seeded, uncustomized copy (managed_by package or platform, customized: false) carries no customer edit. It is a copy of code, so it is deleted as a mirror and not promoted. Promoting it would freeze a stale seed over the newer code template.

    Dev deviations accepted:

    • the apply-flags test's first-load move to beforeAll, mechanical and inside packages/cli;
    • the merge commit's default message;
    • the packages/core edit, which dispatch 6139305919 authorised.

  10. objectstack-fleet commented on Oct 13, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 13, 2026
    ContributorAuthor

    Dispatch: PR 2 (#23034) pre-landing work, started now, ahead of S8's merge · domain:engine seat 2 · session_01ADzJtzYTLUfgrRZHxkagkX · 2026-10-13T13:16Z

  11. objectstack-fleet commented on Oct 13, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 13, 2026
    ContributorAuthor

    Pointer from domain:services seat 2 (#21118) · session_01FzQy26KznSa5j2gnf3AzsE · 2026-10-13T14:31Z. ⛔ Not a claim, ⛔ no ask to change scope. A reply is owed only on an objection, on #23256.

    #23256 (p1 target:v18: an upgraded 17.x holder of an approver position, whose sys_user_position row has no organization, never reaches an approval slate) is now pm:blocked on this card. The maintainer ruled (6147914816, verbatim 「所有有问题也应该是优化升级方案」) that the fix is the upgrade's attribution, not a compatibility reading in plugin-approvals.

    This card already covers it: the inventory gives sys_user_position the attribution fate (organization-ownership-inventory.ts:495). When it lands, this seat verifies the slate reaches an attributed holder on main. If you change that row's fate or anchor, #23256 is the card to tell.

    Generated by Claude Code

  12. objectstack-fleet commented on Oct 13, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 13, 2026
    ContributorAuthor

    os-dev-report

    PR 2 (#23034) pre-landing: main merged, post-S8 measured

    {
  "issue": 22937,
  "status": "done",
  "branch": "claude/issue-22937-organization-ownership-apply",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/23034",
  "new_head": "aa6bc6d91f",
  "merge_sha": "3f68f15e — merge of origin/main 6d7f4df3c into 0555b80a0a (merge commit, clean, no os-regen-pending; no rebase, no force-push)",
  "session": "session_01DjKf52bcyXa3fbGW723phR — resumed for dispatch 6146422537",
  "premise_still_valid": true,
  "summary": "Pre-landing work for PR #23034 per dispatch 6146422537, which was verified on GitHub with ruling 6138591940 and correction 6140351542; PR 3's branch was not touched. Merged origin/main (124 behind) with a merge commit. The merged tree reddened one of PR 2's own tests: organization-ownership.apply-flags.test.ts's first case took 5.4 s, over vitest's 5 s default. The fix is the same one PR 3 carried (load the command in beforeAll; 60 s per case), committed as aa6bc6d9 and pushed. Measured against the post-S8 state on a local, never-pushed scratch tree (aa6bc6d9 + S8's branch at 23e450a6): the full @objectstack/cli suite (unit and integration) is green; the ceremony's acceptance fixture is green; the derived gates are green; and an end-to-end run with the built CLI from examples/app-crm handles the four unregistered catalog tables as D10 says. S8 needed no fix in PR 2's surface. PR #23034's code is otherwise unchanged.",
  "both_trees": {
    "main_merged (aa6bc6d9)": "@objectstack/cli typecheck exit 0 (test-typecheck OK). PR suites: 5 files, 52 tests passed (organization-ownership-apply, apply-flags, plan.integration, inventory, vitest-tiers-partition). Before the fix: 'Tests 2 failed | 50 passed' (apply-flags, 'refuses a non-interactive --apply…' 5,431 ms, then a JSON parse failure in the next case). After: 52 passed. The full suite on this head is CI's.",
    "main_merged + S8 (scratch, never pushed; S8 branch at 23e450a6, merge clean)": "Full @objectstack/cli suite, sharded locally (vitest --project unit --shard=k/2 and --project integration --shard=k/8, SQLite, which is what CI's Test Core runs with no database service): unit 286 files / 4,286 tests passed; integration 120 files / 1,006 passed, 2 skipped. The skips are preview-read-only.integration.test.ts's live-Postgres cells, which skip without OS_TEST_POSTGRES_URL, as in CI. Beyond CI: that file was also run against a local Postgres 16 with OS_TEST_POSTGRES_URL set: 12 passed, 0 skipped. Every integration shard is green, including the full one-shot family pin (83 cases), unmanaged-tables.integration and schema-migrate.host-composition.integration, which S8 edits. The ceremony's acceptance fixture (organization-ownership-apply.test.ts, 8 cases) and the plan, inventory and apply-flags tests: 52 passed."
  },
  "post_s8_measurement": "Inventory: the plan, run with the built CLI from examples/app-crm on a database schema'd by `os migrate apply` (post-S8 composition, so the four catalog tables were not created and were added by hand with 17.x rows), classifies all four tables: sys_position, sys_permission_set and sys_capability as mirror-deletion with the authored category counted, sys_position_permission_set as mirror-deletion (every row), physical present; and sys_user_permission_set as attribution. No uninventoried-platform-table refusal. --apply (single), all through the raw-SQL seam: attribution 1; authored-conversion: 2 converted through the real metadata door (sys_metadata permission/field_auditor, position/sales_lead), the authored capability reported (fate 4); rewrite 1 named, 1 verified; mirror-deletion 5 deleted (the NULL and per-organization member_default mirrors, the org_admin mirror, the seeded capability, the binding), with the authored rows kept; column-drops blocked only on the sys_metadata family (see open_questions). The second run resumed from the sys_migration checkpoint (4 steps checkpointed). Dogfood: no dogfood suite exercises the ceremony. A grep of packages/qa for organization-ownership has no hit, and the other hits are prose (S8's 18.catalog-row-objects-retired ADR-0087 entry says the tables 'stay until the organization-ownership migration takes them', which matches). So no dogfood suite applies: NOT MEASURED, because none exists.",
  "tests": "See both_trees and post_s8_measurement. The fix commit aa6bc6d9 holds on both trees: apply-flags 3/3 on main+merge and on main+merge+S8.",
  "gates": "Merged head aa6bc6d9: `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` derived 66 (9 paths vs merge base 6d7f4df3c, 1,900 changed lines). `--ran`: 'Run reconciliation — 66 derived, 66 run, 0 NOT-MEASURED, 0 UNRUN … a DERIVED zero'. One first run exited 3: check:dual-build-cjs-loads, on an unbuilt service-knowledge dist; it was built under os-verify-lock and re-run with exit 0. Every other first run exited 0. Post-S8 scratch tree: the same 66, derived over the PR's 9 files given as explicit paths, all exit 0 on the first run. `--ran`: '66 derived, 66 run, 0 NOT-MEASURED, 0 UNRUN … a DERIVED zero'.",
  "line_budget": "PR #23034 against main at aa6bc6d9: 9 files, +1,872 / −28 = 1,900 changed lines (was 1,891; the +9 are the apply-flags fix). Under 3,000.",
  "files_changed": [
    "packages/cli/src/commands/migrate/organization-ownership.apply-flags.test.ts (aa6bc6d9: first load in beforeAll, 60 s per case)"
  ],
  "deviations": [
    "None beyond the fix itself. It is inside PR 2's surface, and the seat accepted the same change in PR 3 (6140351542).",
    "To build the dependency closure, pnpm install had to run again after the merge: main brought a new workspace package (service-mailbox), and the first build failed TS2307 until the install. This is local tooling, not a change.",
    "I started a local Postgres 16 service in the container for the extra live-PG leg and stopped it afterwards."
  ],
  "pr_body_changes_needed": [
    "The Files heading reads '9, +1,863 / −28; 1,891 changed lines' and should read '9, +1,872 / −28; 1,900 changed lines'.",
    "The Gates section names 'HEAD 0555b80a' and should name aa6bc6d9 (merged with main 6d7f4df3c). It should add one line: 'apply-flags cases load the command in beforeAll, with 60 s per case: on the merged tree the first case took 5.4 s'.",
    "The NOT MEASURED line for test/json-stdout-purity.e2e.test.ts stands."
  ],
  "mcp_calls": "0 — ReadNotifications only; no MCP GitHub tool called",
  "api_writes": "1: this os-dev-report comment on #22937 (post-stamped.mjs → relay → POST /issues/22937/comments). git push to the PR branch (3f68f15e, aa6bc6d9) is not REST. No PR ready, no review request, no body PATCH, no label write.",
  "open_questions": [
    {
      "question": "On main + S8, the ceremony cannot complete: column-drops blocks on sys_metadata, sys_metadata_audit, sys_metadata_commit and sys_metadata_history, whose declarations still carry organization_id, so the drift differ proposes no drop. The inventory cites the metadata family's schema change (triage record 6068052798: 'declared field removed, systemFields.tenant: false'). Until that stage lands, `--apply` stops at column-drops with exit 1, and the sys_migration marker stays unapplied. Is that the intended landing order: PR 2 lands as is, and the metadata-family schema stage is a precondition of running the ceremony to completion?",
      "options": [
        "A: as built: the ceremony refuses to call itself complete while a fate-1 column cannot be dropped through the drift ceremony, and names the remedy; the metadata-family stage is sequenced before the v18 final cut",
        "B: let column-drops skip a column whose declaration still carries it and record the table as 'pending its stage', completing the ceremony without it"
      ],
      "recommendation": "A. It is D10's 'column drops through the ADR-0120 D4 ceremony' with no hand ALTER. B would let the marker claim a completed ceremony while columns remain, which C8's NOT NULL / boot refusal reads. The ordering is the epic seat's to confirm."
    }
  ],
  "out_of_scope_findings": []
}

    Generated by Claude Code

  13. objectstack-fleet commented on Oct 13, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 13, 2026
    ContributorAuthor

    Seat collection: report 6150092087 (PR 2's pre-landing half) and the open question · domain:engine seat 2 · session_01ADzJtzYTLUfgrRZHxkagkX · 2026-10-13T16:22Z

    Accepted, as the pre-landing half of dispatch 6146422537.

    • The merge of main (3f68f15e) is a merge commit, with no rebase.
    • The apply-flags timing fix aa6bc6d9 matches the change the seat accepted for PR 3 (6140351542).
    • The post-S8 measurement is clean on a scratch tree:
      • the full @objectstack/cli suite, unit and integration, as CI shards it;
      • 66 of 66 derived gates on both trees;
      • an end-to-end --apply from examples/app-crm, which treats the four unregistered catalog tables as D10 says.
    • Dogfood is NOT MEASURED because no dogfood suite exercises the ceremony. That is accepted as stated.

    Still owed on PR #23034: B1 and B2 from the FAIL record 6147223040. The seat sent the patch round at 2026-10-13T13:57Z. It reached the session only at 2026-10-13T16:21Z, because the session was mid-turn on the pre-landing run, and the session is now on it. The head has not moved (aa6bc6d91f). The delta contract review runs on the head that fixes B1 and B2, and the PR lands only after that.

    The open question (column-drops on the sys_metadata family) → A, as built. This is a seat answer: an execution parameter about task order, not the decision box.

    The PR body: the seat applies pr_body_changes_needed once, after the B1/B2 round, with that round's final head and line counts.

  14. objectstack-fleet commented on Oct 13, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 13, 2026
    ContributorAuthor

    ✅ ACCEPT: PR 2, PR #23034 at 8b615d0f9c · domain:engine seat 2 · session_01ADzJtzYTLUfgrRZHxkagkX · 2026-10-13T16:55Z

    Basis:

    • claim 6122368393;
    • the maintainer's Q1–Q4 ruling 6138591940 and the seat's correction 6140351542;
    • the pre-landing dispatch 6146422537, with the B1/B2 patch round sent to the session;
    • the dev's report 6150092087, collected in 6150126995. The B1/B2 round's own report is pending, and that round is judged on its commit and on CI.

    Everything below was checked on GitHub and in the objects, not taken from the reports.

    Next: ready and auto-merge now. After the merge: verify the squash and post the landing record, then dispatch PR 3 off main.

  15. objectstack-fleet commented on Oct 13, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 13, 2026
    ContributorAuthor

    Landing record: PR 2, PR #23034 → 2808069121 · domain:engine seat 2 · session_01ADzJtzYTLUfgrRZHxkagkX · 2026-10-13T17:13Z

  16. objectstack-fleet commented on Oct 13, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 13, 2026
    ContributorAuthor

    Dispatch: PR 3, the template promotion and the global-rung move, off main now that PR 2 has landed · domain:engine seat 2 · session_01ADzJtzYTLUfgrRZHxkagkX · 2026-10-13T17:20Z

    To the cloud session session_01DjKf52bcyXa3fbGW723phR. The claim 6122368393 stands. PR 2 landed as 2808069121 (landing record 6151058104). This PR closes the card.

    Rulings it carries: the maintainer's Q3 (「本卡补做提升」) and Q4 (「本卡单开 PR 3」), in 6138591940, and the seat's answers 6140351542: sharing-rule mirrors ride D2, and seeded uncustomized organization-stamped copies are mirrors. Q1 (the boot refusal lands with C8) and Q2 (the fate-2 gate blocks unresolved named grants) are already in PR 2.

    Base and branch:

    • Start from claude/issue-22937-ceremony-promotions 49d85fc653. Its own work is two commits: 691bb957bb (core emailTemplateDefinitionFromRow) and 49d85fc653 (the promotion and the settings move), about 670 lines.
    • Merge origin/main into it with a merge commit (no rebase, no force-push). main now carries PR 2's squash, including B1 and B2. Expect conflicts in organization-ownership-apply.ts, its test, the command and apply-flags.test.ts (PR 2 landed the same beforeAll timing fix). Resolve them so that PR 2's landed behaviour holds exactly, then layer PR 3 on top.
    • Open a NEW draft PR off main, with line 1 Fixes #22937 and line 2 Clause-②: … (yes, if core's new export is a widening). Name the closed stacked draft feat(cli,core): the organization-ownership ceremony promotes customized email templates and moves the settings global rung (C7b, PR 3) #23195 in the body as its predecessor.
    • Merge main before every push.

    Rework that PR 2's landed form requires:

    1. B1's kept rows are the promotion population. PR 2 now keeps, on sys_email_template, every row whose managed_by is outside package, platform and system (admin-authored, and NULL provenance), as well as customized and organization-stamped rows. The promotion step promotes that same kept set: customized, organization-stamped, and admin-authored or NULL-provenance NULL-organization rows. Seeded uncustomized copies stay mirrors, which PR 2 already deletes.
    2. Count them until they are promoted (consequence 2 of the review 6150575317). Make the kept template rows a departure, or count them in remainingFor, so a run that has not promoted them leaves verified_at null and exits 1, naming them.
    3. B2's global-rung-move departure is executed here. After the step, its count reads 0 and the marker can verify. The declared-rule-mirrors departure stays counted until D2.
    4. Pins:
      • a database with admin-authored, customized and organization-stamped templates, plus sys_setting global-rung rows, ends complete with verified_at set after one --apply;
      • a run where the promotion is blocked keeps verified_at null and names the rows;
      • ablations, each measured red: drop the count, and drop the provenance population from the promotion.

    Gates:

    • @objectstack/core and @objectstack/cli typecheck;
    • core's new test, and the full @objectstack/cli suite, unit and integration, as CI shards it;
    • dispatch-gates --commands, with --ran reconciled.

    No dogfood suite exercises the ceremony, so state that as before. Expect fewer than 3,000 lines, so not Tier H. ⛔ Do not ready, queue or arm the PR.

    Report: one os-dev-report on #22937, with the new PR, its head and the gate exits.

  17. objectstack-fleet commented on Oct 13, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 13, 2026
    ContributorAuthor

    os-dev-report

    PR 2 B1/B2 round (short)

    {
  "issue": 22937,
  "status": "done",
  "branch": "claude/issue-22937-organization-ownership-apply",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/23034",
  "head": "8b615d0f9c (the B1/B2 fix; landed as 2808069121 by the seat)",
  "session": "session_01DjKf52bcyXa3fbGW723phR",
  "summary": "The B1/B2 round of contract review 6147223040. B1: on a fate-2 table that records provenance, mirror deletion keeps every row whose managed_by is NULL or outside package/platform/system, and a claim that evaluates NULL keeps its row. B2: remainingFor counts each departure's rows, so verified_at stays null until a step carries them; TableOutcome.departures and the human face name each departure, and NOT NULL readiness says why it waits. Also: the --out description names the apply report. Pushed as 8b615d0f, the head the PASS review 6150575317 read. Nothing was pushed after that.",
  "tests": "At 8b615d0f, merged with main 6d7f4df3c: the PR suites passed 5 files / 53 tests, and cli typecheck exited 0. Full @objectstack/cli suite, CI-sharded: unit 2/2 shards exit 0, 286 files / 4,286 tests; integration 8/8 shards exit 0, 120 files / 1,047 passed, 2 skipped (the live-Postgres cells, which skip without OS_TEST_POSTGRES_URL, as in CI). Ablations through scripts/ablation-replace.mjs, each restored to the HEAD blob: (1) the provenance keep removed: the acceptance case goes red (tpl_admin is deleted); (2) departingRows dropped from remainingFor: the global-rung case goes red. On a local, never-pushed merge of 8b615d0f with origin/main (which carries S8 66949b77): typecheck exited 0; the PR suites passed 53; unit 2/2 exit 0 (4,286); integration shards 1-5 exit 0. Shards 6-8 are NOT MEASURED: the PM interrupted them as moot once PR 2 had landed on green CI with S8. One earlier attempt at shard 1 was OOM-killed (SIGKILL), not a test red. The cause was orphaned vitest and serve processes from my own timed-out shards. They were killed by recorded PID, and the shard re-ran green.",
  "gates": "No dispatch-gates rerun at 8b615d0f in this round. The 66-of-66 reconciliation at aa6bc6d9 (report 6150092087) stands for the gate families: the round touched only the same three cli files. CI on 8b615d0f's merge ref is the seat's record (6150575317).",
  "files_changed": [
    "packages/cli/src/utils/organization-ownership-apply.ts",
    "packages/cli/src/utils/organization-ownership-apply.test.ts",
    "packages/cli/src/commands/migrate/organization-ownership.ts"
  ],
  "deviations": [
    "None. The local merge with main (70329954) was never pushed and has been discarded."
  ],
  "mcp_calls": "0",
  "api_writes": "1: this comment (post-stamped.mjs → relay). git push of 8b615d0f is not REST.",
  "open_questions": [],
  "out_of_scope_findings": []
}

    Generated by Claude Code

  18. objectstack-fleet commented on Oct 13, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 13, 2026
    ContributorAuthor

    os-dev-report

    PR 3 of 3 (#23329)

    {
  "issue": 22937,
  "status": "done",
  "branch": "claude/issue-22937-ceremony-promotions",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/23329",
  "head": "34989ec72e",
  "session": "session_01DjKf52bcyXa3fbGW723phR",
  "premise_still_valid": true,
  "summary": "PR 3 of 3 per dispatch 6151180611. Started from 49d85fc653 and merged origin/main 404fc477 (PR 2 landed as 2808069121) with a merge commit, f36a3a34. The three conflicts were resolved so PR 2's landed behaviour holds exactly (B1's provenance keep, NULL claims keep, B2's departure count), with PR 3 on top. The promotion carries exactly B1's kept set; under single, once the promotion has run, those claims are discharged; under a wall the unpromoted rows count as remaining and are named as a template-promotion departure; settings-move executes the global-rung departure. A changeset fix followed (636f149b), then a merge of main 87e902dc..4d4040cc (34989ec7, clean, no PR file touched). New draft PR #23329: line 1 Fixes #22937, line 2 Clause-②: yes (widening), predecessor #23195 named. 8 files, +704 / −41.",
  "tests": "Pins in organization-ownership-apply.test.ts (12 cases): one --apply ends complete and verified (verdict {complete:true, blocking:0}) with four templates promoted (customized, admin with an organization, admin without one, unknown provenance) and the global rung moved; a blocked promotion ends complete:false with verified_at not written and the template named; under a wall an unpromoted admin template counts, is named (template-promotion departure) and blocks verified_at; the declared-rule mirror departure still blocks and is named; a settings conflict moves and deletes nothing. Ablations through scripts/ablation-replace.mjs, each 'ok restored: blob == HEAD (7e290e53b140) and git diff HEAD is empty': (a) the count dropped ('blob 7e290e53b140 → d684b7d801e2'): 'Tests 1 failed | 11 passed', the walled case; (b) the provenance population dropped from the promotion ('→ a5466256ed65'): 'Tests 3 failed | 9 passed'.",
  "gates": "At 636f149b: @objectstack/core typecheck exit 0; @objectstack/cli typecheck exit 0; core src/security/ 38 files / 872 passed; full @objectstack/cli suite, CI-sharded: unit 2/2 exit 0 (286 files / 4,286), integration 8/8 exit 0 (120 files / 1,050 passed, 2 skipped: the live-PG cells, as in CI). The first unit shard initially failed one suite, published-subpath-console.pin, because packages/cli itself was not built in the worktree; it passed after the build. dispatch-gates --commands derived 67, all exit 0 on the first run; --ran: '67 derived, 67 run, 0 NOT-MEASURED, 0 UNRUN … a DERIVED zero'. At 34989ec7 (merge of 2 main commits, #23301 and #23322, which touch packages/core/src/utils and objectql, none of the PR's files), a scoped re-check: closure rebuilt; core src/security/ 872 passed; cli tsc exit 0; the ceremony suites 5 files / 56 passed. Dogfood: NOT MEASURED, because no dogfood suite exercises the ceremony.",
  "line_budget": "8 files, +704 / −41 = 745 changed lines against main. None generated.",
  "files_changed": [
    "packages/core/src/security/email-template-row-definition.ts (new)",
    "packages/core/src/security/email-template-row-definition.test.ts (new)",
    "packages/core/src/security/index.ts",
    "packages/cli/src/utils/organization-ownership-apply.ts",
    "packages/cli/src/utils/organization-ownership-apply.test.ts",
    "packages/cli/src/commands/migrate/organization-ownership.ts",
    ".changeset/22937-core-email-template-row-definition.md (core minor)",
    ".changeset/22937-cli-ceremony-promotions.md (cli minor)"
  ],
  "deviations": [
    "The promotion population adds rows whose customized is NULL (unknown). PR 2's B1 rule is 'a claim that evaluates NULL keeps its row', so such a row is kept under a wall; under single it is promoted, and if its body equals the served template the promotion is a no-op before deletion. The dispatch named customized, organization-stamped and non-seeded rows; organization-stamped seeded uncustomized copies stay mirrors, per the seat's answer 6140351542.",
    "Two merge commits (f36a3a34 with the resolution, 34989ec7 clean). The second has git's default message."
  ],
  "mcp_calls": "0 — ReadNotifications only",
  "api_writes": "3 relay writes: (1) the short B1/B2 report, comment 6152108251 on #22937; (2) pr_create, draft, assignees [os-steve] → #23329, read back identical at 6,092 bytes; (3) this comment. git push is not REST. No ready, review, label or MCP write.",
  "open_questions": [],
  "out_of_scope_findings": []
}

    Generated by Claude Code

  19. objectstack-fleet commented on Oct 13, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 13, 2026
    ContributorAuthor

    Claim: PM loop round 1 · 2026-10-13T20:14Z · PR 3's branch, under the same claim 6122368393 (the same seat and session; it is not a new holder)
    Session: session_01ADzJtzYTLUfgrRZHxkagkX
    Account: os-steve (the seat's linked user as GET /user answers it; always the card's assignee)
    Branch: claude/issue-22937-ceremony-promotions
    Worktree: objectstack-issue-22937-pr3 (in the cloud session's own checkout)
    Domain: domain:engine
    Seat: domain:engine#2 (seat post #20966)
    File surface: packages/cli/src/utils/organization-ownership-apply*.ts, packages/cli/src/commands/migrate/organization-ownership.ts, packages/core/src/security/email-template-row-definition*.ts, packages/core/src/security/index.ts, two changesets
    Container & model: M, mode:cloud (session_01DjKf52bcyXa3fbGW723phR), model: default
    Clause-②: yes
    Responsibility: n/a — not a defect card
    Thread-read: 6153947869
    Serial constraints cleared: PR 2 (#23034) landed as 2808069121; PR 3 is PR #23329, off main, and closes this card

  20. objectstack-fleet commented on Oct 13, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 13, 2026
    ContributorAuthor

    Patch round for PR 3 (PR #23329): the contract review is FAIL (6154293191) · domain:engine seat 2 · session_01ADzJtzYTLUfgrRZHxkagkX · 2026-10-13T20:15Z

    To session_01DjKf52bcyXa3fbGW723phR. Read the record in full. The seat's answers are below; all of it is in this PR.

    F1, the claim gate: done by the seat. The Claim: naming claude/issue-22937-ceremony-promotions is 6154303731. Your next push re-runs the gate.

    F2 (blocking): the template delete must stay inside fate 2 on every run, resumed runs included.

    • Today, under single, the sys_email_template DELETE is WHERE 1 = 1, discharged by posture alone. So:

      • on a resumed run (template-promotion checkpointed, mirror-deletion not), a row customized or authored between runs is deleted unpromoted;
      • a nameless row is "reported, never promoted", and then deleted.

    • Fix: before the first template DELETE, re-run the idempotent promotion pass. Better still, delete only the ids whose environment copy is verified, plus the seeded uncustomized mirrors B1 already deletes, and block on any other row.

    • The nameless arm becomes a blocker, which keeps the row, names it, and leaves verified_at null. It is never deleted.

    • Pins:

      • a between-runs case: a row customized after the promotion checkpoint survives and blocks, or is promoted, and is never deleted unpromoted;
      • a nameless-row case.

      Each comes with a measured ablation.

    The walled promotion is in this PR (the maintainer's Q3 「本卡补做提升」, applied as ADR-0131 §6 Q1 ruling C words it). PR 3 must not leave a walled deployment unable ever to verify.

    • Under isolated or group, the population is the same B1 kept set, grouped by (name, locale):

      • One candidate body for a (name, locale), or several identical ones: promote it through the same door, as under single.
      • Two or more differing bodies for one (name, locale) are a conflict, fate 4. List it in the plan and the --apply report with each candidate's row id and organization. It counts as remaining and blocks verified_at until the operator chooses one row per conflict. ⛔ Nothing is guessed, and no conflict row is deleted.

    • The operator's choice: use the smallest shape that fits the command's existing flags and report. For example, a repeatable flag that names one row id per conflict, or a choices file. Validate it against the listed conflicts: an unknown or ambiguous choice is refused with a located message. Name the shape in the changeset; it is part of the declared widening.

    • Pins:

      • a walled database with no conflict ends verified;
      • a conflict blocks and names its candidates;
      • a chosen conflict promotes the chosen body, verifies, and deletes the losers only after the promotion is verified;
      • a bad choice is refused.

      Each comes with ablations.

    • If this turns out to need more than about 600 added lines, or a decision this text does not settle, stop and report the fork. Do not narrow it silently.

    The notes, same round:

    • Give the settings move the same population as its departure (organization_id IS NULL), and read back each destination row before deleting its source.
    • Print the moves on the human face.
    • The mapper uses EMAIL_TEMPLATE_FLOOR_LOCALE, not 'en-US'.

    The card closes with this PR. The card's C7b sentence (drop sys_user_permission_set.permission_set_id and both indexes) is carried by #15211, C7b's own card, which stays open. The seat posts that pointer, so Fixes #22937 stays. Add one line to the PR body under the known limits, naming #15211 for the column drop.

    Then:

    ⛔ Do not ready, queue or arm the PR.

  21. os-steve
    added a commit that references this issue on Oct 13, 2026

    fix(cli): the template delete stays inside fate 2 on every run; walle…

    1bede35

  22. objectstack-fleet commented on Oct 13, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 13, 2026
    ContributorAuthor

    os-dev-report

    PR 3 of 3 (#23329), patch round 6154321875

    {
  "issue": 22937,
  "status": "done",
  "branch": "claude/issue-22937-ceremony-promotions",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/23329",
  "head": "db20886484",
  "session": "session_01DjKf52bcyXa3fbGW723phR",
  "premise_still_valid": true,
  "summary": "Patch round for review FAIL 6154293191 / patch round 6154321875. Commit 1bede353, then a clean merge of origin/main 614fdec8 (db208864, no PR file touched). F1 is the seat's claim (6154303731). F2: mirror deletion re-runs the idempotent template promotion after the fate-2 gate and before its first template DELETE; if that pass is not done, the step is blocked and nothing is deleted. It then deletes the seeded, uncustomized mirrors (the selector keeps the whole B1 population, in any posture) and, by id in IN_CHUNK slices with a count read-back, only the rows whose environment copy that pass verified. A nameless customized or authored row is a blocker: kept, named, verified_at null. Walled promotion: the step runs under every posture over the B1 kept set grouped by (name, locale). A single or identical candidate is promoted through the door. Differing bodies are a conflict: listed in the plan (TablePlan.templateConflicts) and the --apply report (TableOutcome.templateConflicts plus the step blocker), each candidate with row id and organization, counted as remaining, blocking verified_at. The operator chooses with the repeatable --template-choice ROW_ID; the chosen body is promoted, and every candidate of that group is deleted by id only after the promotion is verified. A choice that names no candidate, or two candidates of one conflict, throws TemplateChoiceRefusal before any write; the command maps it to reason template-choice-refused, and --template-choice without --apply is refused. Notes: the settings move selects organization_id IS NULL (when the column exists) and reads each destination row back, requiring equality, before deleting the source; the human face prints moved out / moved in and the template conflicts (plan and apply); the core mapper falls back to EMAIL_TEMPLATE_FLOOR_LOCALE. Changesets updated (flag, conflict rule, walled promotion, F2, settings selector; core: one constant import).",
  "body_change_for_seat": "Please add one line under the PR body's 'Not in this PR' list: '- The sys_user_permission_set.permission_set_id column and its index drop is #15211's, not this PR's.' The body's other walled-template lines ('Under a wall no promotion runs…', the walled pin, 'Under single, after it has run, PR 2's template claims are discharged') are now stale and describe the previous head: under every posture the promotion runs, conflicts block until --template-choice, and the template delete is by verified id only. The os-dev role makes no body PATCH, so the seat owns it.",
  "tests": "organization-ownership-apply.test.ts now 17 cases (was 12). New pins: (1) between runs: killed at DELETE FROM sys_capability with template-promotion checkpointed, a customized row tpl_late inserted, the resume promotes crm.late and ends complete, blocking 0, no template row left; (2) a nameless customized row blocks the promotion, stays, is named, verdict complete:false; (3) walled, no conflict: complete, blocking 0, crm.note promoted, mirror and row deleted, no departure; (4) conflict under group: blocked, conflicts 1, the blocker names 'tpl_a (organization org_a), tpl_b (organization org_b)' and --template-choice, templateConflicts listed in the report, both rows kept, nothing promoted; (5) chosen conflict (tpl_b): the From B body is promoted, verified, both rows deleted (deleted 2); (6) tpl_nope refused with the exact located message, and tpl_a plus tpl_b refused as ambiguous, with no write. Two existing pins updated: the acceptance case's DELETE allow-list now pins the settings selector with organization_id IS NULL, and the walled acceptance case now expects the four templates promoted (mirror deletion is still not reached there). Ablations through scripts/ablation-replace.mjs, each 'ok restored: blob == HEAD (5805c2d00e26) and git diff HEAD is empty': A1, the pre-delete promotion re-run disabled (to 3534d572b54d): 1 failed | 16 passed, the between-runs pin. A2, the nameless blocker disabled (to f2b1dfa7320e): 1 failed, the nameless pin. A3, the walled-promotion wall restored (to d84779f4e168): 4 failed, the walled cases. A4, the conflict detection disabled (to ee75c35284b1): 2 failed, the conflict and chosen pins. A5, the chosen body replaced by the first candidate (to 98dad315726b): 1 failed, the chosen pin. A6, choice validation disabled (to e54580e7ed9b): 1 failed, the refusal pin. A7, the template keep in the delete selector replaced by a no-op claim (to 614e1551111f): 17 passed, GREEN. Measured cause: the re-run promotion verifies every population row whenever it completes, so the id-only delete never meets an unverified row the keep would hold. The keep is a second line of defence behind A1's gate, which is red under its own ablation; no fixture reaches the keep alone.",
  "gates": "At 1bede353 (main cc14657e): @objectstack/core typecheck exit 0; @objectstack/cli typecheck exit 0; core src/security 39 files / 887 passed; the full @objectstack/cli suite, CI-sharded: unit 2/2 exit 0 (287 files / 4,292 passed), integration 8/8 exit 0 (121 files / 1,067 passed, 2 skipped: the live-PG cells, as in CI); dispatch-gates --commands derived 67, all exit 0 on the first run, and --ran: '67 derived famil(ies) accounted for, 67 run, 0 NOT-MEASURED (a DERIVED zero)'. At db208864 (merge of 6 main commits, 572ecfb2..614fdec8: spec, metadata-protocol, service-automation, plugin-security, docs, pm; none of the PR's files), a scoped re-check: closure rebuilt; core and cli typecheck exit 0; core src/security 887 passed; the ceremony suites 4 files / 39 passed; the derivation re-run is the identical 67. Dogfood: NOT MEASURED, because no dogfood suite exercises the ceremony.",
  "line_budget": "This round: 8 files, +451 / -137, under the ~600 added-line stop. PR against main: 9 files, +1,025 / -47.",
  "files_changed": [
    "packages/cli/src/utils/organization-ownership-apply.ts",
    "packages/cli/src/utils/organization-ownership-plan.ts",
    "packages/cli/src/commands/migrate/organization-ownership.ts",
    "packages/cli/src/utils/organization-ownership-apply.test.ts",
    "packages/core/src/security/email-template-row-definition.ts",
    "packages/core/src/security/email-template-row-definition.test.ts",
    ".changeset/22937-cli-ceremony-promotions.md",
    ".changeset/22937-core-email-template-row-definition.md"
  ],
  "deviations": [
    "Ablation A7 is green, measured and explained in tests; no pin isolates the delete selector's keep.",
    "The settings read-back throws (a mid-write failure: the checkpoint holds, a re-run resumes) rather than returning a blocker, because the INSERT has already been written when it fails. No pin reaches it: SQLite's INSERT ... SELECT always reads back equal.",
    "A --template-choice for a conflict that a finished run already removed is refused as naming no candidate. That is the located message the round asked for, and a re-run without the flag is a no-op."
  ],
  "mcp_calls": "0 MCP writes",
  "api_writes": "1 relay write: this comment. git push is not REST. No ready, queue, arm, review, label, body or MCP write.",
  "open_questions": [],
  "out_of_scope_findings": []
}

    Generated by Claude Code

  23. objectstack-fleet commented on Oct 13, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 13, 2026
    ContributorAuthor

    ✅ ACCEPT: PR 3, PR #23329 at db2088648c · domain:engine seat 2 · session_01ADzJtzYTLUfgrRZHxkagkX · 2026-10-13T22:24Z

    Basis:

    • claim 6122368393, and the seat's claim 6154303731 naming this branch;
    • the maintainer's ruling 6138591940 (Q3, Q4) and the seat's answers 6140351542;
    • dispatch 6151180611 and the patch round 6154321875;
    • the dev's reports 6153947869 and 6156054460.

    Everything below was checked on GitHub and in the objects, not taken from the reports.

    • Form:
    • Scope:
      • 9 files, +1,025 / −47 = 1,072 changed lines, in packages/cli, packages/core/src/security and two changesets;
      • no governed path, under 3,000. Not Tier H; the seat lands it.
    • The change, read in the diff:
      • core's emailTemplateDefinitionFromRow;
      • the template-promotion step over B1's kept set, under every posture, grouped by (name, locale). Conflicts are listed, counted and resolved by --template-choice; a nameless row blocks;
      • mirror deletion re-runs the promotion before its first template DELETE, and deletes promoted rows by verified id only;
      • the settings-move step, with organization_id IS NULL and a read-back before each source DELETE.
    • CI on db2088648c: ci-failure --pr 23329 reads GREEN: 40 check runs, none failed. git merge-tree against origin/main 828fe1d5a8 is clean.
    • Contract review: FAIL 6154293191 at 34989ec72e (F1, F2, the walled promotion, the card closure), then the delta review PASS 6156331986 at db2088648c. Every finding is closed. Both records were adopted after a tool-use audit of the reviewer's transcript.
    • Semver: core minor, cli minor, Clause-②: yes (widening). --template-choice is a new flag inside the declared widening, and it is named in the cli changeset.
    • The card closes with this PR. Each piece the card still names has a carrier:
    • Acceptance notes (remedy-quality, not filed):
      • no pin isolates the delete selector's keep (A7 green; it is a second line behind A1's gate);
      • "verified" after door.save is the door accepting in-process, not a find read-back;
      • the plan's conflict read is its one unpaged SELECT;
      • the inventory's organization-stamped category label still says "promoted with the customized population" (the inventory file is outside this PR);
      • the settings read-back's message does not say the destination now holds a differing copy.

    Next: ready and auto-merge now. After the merge: verify the squash and post the landing record; the card closes through Fixes.

  24. objectstack-fleet
    closed this as completedin #23329on Oct 13, 2026

  25. objectstack-fleet commented on Oct 13, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 13, 2026
    ContributorAuthor

    Landing record: PR 3, PR #23329 → ed0383419d; the card closes · domain:engine seat 2 · session_01ADzJtzYTLUfgrRZHxkagkX · 2026-10-13T22:57Z

  26. objectstack-fleet
    removed
    pm:dispatched
    on Oct 13, 2026

  27. objectstack-fleet commented on Oct 14, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 14, 2026
    ContributorAuthor

    Amendment record · domain:engine seat 2 · session_01ADzJtzYTLUfgrRZHxkagkX · 2026-10-14T07:24Z. The maintainer's Q1 ruling on this card (6138591940, 「随 C8 落地」: the v18 boot refusal lands with C8) is amended by decision #23413, Q3 → A (ruling 6163114098, the maintainer's 「同意」).

  28. os-steve
    added 3 commits that reference this issue on Oct 14, 2026

    chore(changeset): leave #22937's pending note as it is; its correctio…

    bc3525a

    fix(cli): the apply refuses a plan reviewed under another tenancy pos…

    0802a12

    revert(changeset): leave the consumed #22937 and #23280 notes as they…

    91db38b
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

domain:engineRetired 2026-10-22, alias of domain:server (engine surface); in-flight cards keep it until they landpriority:p1High: required for production / M2target:v18

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions