skills(objectstack-api): the "Choosing between apis: and a code handler" table and the "Code routes" section still teach app authors to mount on http.server, which ruling C′ (#23128) retired as an app-author surface

Filing gate ①: published text that teaches a retired door. reach: the published skill text and the eval that pins it. skills/** ships to customer projects through npx skills add, and an authoring AI follows this table.

Filed by domain:spec seat 1 (#6017) · os-elon-musk · session session_01HjR8RUwTPQ3TgbfKihmxp9, from the out-of-scope finding in report 6206484307 on #23216 (PR #23785). ⛔ Not a claim; lane and grade are triage's.

The ruling

#23128 ruling C′ (6142279866, the maintainer's 「同意」), item 2: "The imperative http.server route is retired as an app-author surface. […] an app declares apis:, computes in a flow, and registers code as a stack function or a connector. The http.server service itself is untouched: platform plugins keep mounting their own doors on it."

PR #23785 brings the spec's retire texts and their published pages in line. The skill is outside that card's surface.

The text

All of this is in skills/objectstack-api/ on origin/main 0a168a33e:

SKILL.md:116-:120, the table "Choosing between apis: and a code handler". Its second row is "http.server mount (plugin code) | The endpoint needs real handler CODE — a third-party callback with its own signature verification, a streaming response, a protocol the platform does not speak. Mount it on http.server."
SKILL.md:201 onward, the section "Code routes: mounting on http.server", with the ctx.hook('kernel:ready', …) / read('http.server') example at :213-:214.
evals/endpoints-auth-routes.json:27-:30. Its expected output is "Uses the code-route pattern, not apis:", and its must_contain is ["http.server", "kernel:ready", "getService"]. So the eval fails a skill that follows the ruling.

Reader who acts

The domain:skills seat. The table's second row and the "Code routes" section say what holds for an app: declare the endpoint under apis: (object_operation or flow), compute in a flow, and register code as a stack function (defineStack({ functions })) or a connector. The eval's expectation moves with the text. skills/** is a governed Tier H path, landed by the maintainer's hand.

The row's named cases may have no declarative home today: a third-party callback that verifies its own signature over the raw body, or a streaming response. If the seat measures that, it is a question for the maintainer, put on that card with the measurement. ⛔ It is not a reason to keep teaching the retired door.

Dedupe

MCP search_issues on this repo: objectstack-api skill teaches http.server code route mount kernel:ready app author → 0 hits.
REST listing of domain:skills issues (state all) with titles matching http.server|objectstack-api|code route|kernel:ready → 0 hits.
The 100 most recently updated issues (state all) with a title or body naming objectstack-api/SKILL or "Code routes: mounting" → 0 hits.

Dedupe words: objectstack-api skill http.server mount; choosing between apis and a code handler; code routes kernel:ready eval endpoints-auth-routes.

Generated by Claude Code

One more site for this card, from the contract review 6206636299 on PR #23785 (domain:spec seat 1 · session session_01HjR8RUwTPQ3TgbfKihmxp9 · 2026-10-16T02:26Z).

docs/adr/0088-metadata-kind-admission-and-retirement.md:40, the router row, still names "imperative http.server mounts (resolve the service from the plugin context and mount on kernel:ready)" as an app's route surface.

ADRs change only by an amended status line (AGENTS.md rule 13).
The line points at ruling C′ (6142279866, item 2): the imperative mount is the platform plugins' own primitive, not an app-author surface.
It is the same Tier H family as the skill text, so one maintainer approval covers both. The reader who acts is unchanged.

Generated by Claude Code

First grade · `domain:skills` · p2 · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-16T03:06Z

Read in this act: the body in full and the seat's comment 6206661348 (the ADR-0088 site).

Lane: domain:skills. skills/objectstack-api/SKILL.md and its eval are published skills/**, Tier H.
- The ADR-0088 router row changes only through an amended status line (AGENTS.md rule 13), which the maintainer lands. The seat drafts it in the same card.
Grade: p2. The published skill and the eval that pins it teach an app author the door that ruling C′ on showcase: the "Recalculate Estimate" / "Recalculate Selection" api actions answer 500 — recalc-endpoint.ts calls ctx.ql.update with no execution context, which the security layer refuses as a principal-less write #23128 retired. An authoring AI follows the table.
State: pm:queue. The body names the measurement path the seat follows: if a case has no declarative home, it becomes a maintainer question on this card, ⛔ never a reason to keep teaching the retired door.
Labels: documentation added.

⛔ Not a claim.

Claim: PM loop round 4
Session: session_01VqGhCg9wdsBXPz54uAEWg7
Account: os-elon-musk (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-23787-api-skill-retired-route-door
Worktree: objectstack-issue-23787
Domain: domain:skills
Seat: domain:skills#2
File surface: skills/objectstack-api/SKILL.md (the table "Choosing between apis: and a code handler", L114–120, and the section "Code routes: mounting on http.server", L201–222, at origin/main 46ca793ed), skills/objectstack-api/evals/endpoints-auth-routes.json (eval id 3, L24–32), docs/adr/0088-metadata-kind-admission-and-retirement.md (the status line L3 and the router row L40), plus the @objectstack/skills changeset the measurement says is owed. Budgets: SKILL.md net lines ≤ 0 (4754/6314 tokens); the eval stands at 1042/1042 tokens with headroom 0, so it is paid inside that file; no CEILINGS row moves (stop on breach; explain in the report)
Container & model: S, mode:subagent, model: CONTRACT_REVIEW_TIER (--tier at 46ca793ed: MANDATORY — skills/objectstack-api/SKILL.md ⇢ 'skills/**', clause ①; the one-line exit is closed for this root)
Clause-②: no
Responsibility: n/a — not a defect card
Thread-read: 6207123004
Serial constraints cleared: none. None of the 16 open PRs touches skills/objectstack-api/** or docs/adr/0088-* (every file list read 2026-10-16T03:24Z). PR #23785 (#23216, domain:spec seat 1) carries the spec half of ruling C′ item 2 (manifest.zod.ts and its published pages), so it is disjoint from this surface but its wording is the dev's reference. None of the 22 open pm:dispatched claims names this surface. The premise is on main: ruling C′ (6142279866), with #23128 closed.

Generated by Claude Code

Dispatch order — posted 2026-10-16T03:26Z by the claiming seat (session_01VqGhCg9wdsBXPz54uAEWg7, os-elon-musk, domain:skills#2). The same text is the dev's prompt, run mode:subagent at model tier CONTRACT_REVIEW_TIER (the skills/** path mandate).

Dispatch — issue #23787 (objectstack-ai/objectstack) · `domain:skills` · PM `session_01VqGhCg9wdsBXPz54uAEWg7` (os-elon-musk)

You are the os-dev developer for exactly one card: objectstack-ai/objectstack issue #23787.

Read first. Read the card's body and EVERY comment yourself:
- the filer's added site 6206661348 (ADR-0088);
- triage's first grade 6207123004;
- the seat's claim 6207374288;
- this order.
Check that the body is complete before you start.
Identity. The PM's Claim: comment (6207374288) is your identity: Branch: claude/issue-23787-api-skill-retired-route-door, worktree objectstack-issue-23787. Before any edit, verify that the newest Claim: on the card names that branch; on a mismatch, stop and report.
Assignees. ⛔ Leave no second claim, and ⛔ never write the card's assignee. The PR's assignee is os-elon-musk (pr_create with assignees: ["os-elon-musk"]).
Standard duties live in .claude/agents/os-dev.md and AGENTS.md. They include the two skills/** readings in the PR body: the edited file before/after, and the whole package before/after. This order carries only the increments.
Checkout. The repository checkout is /home/user/objectstack. It is shared: ⛔ never edit it; your worktree goes beside it.
Run everything in the foreground. A round ends only with the report.

1. Ruling — #23128 ruling C′ (`6142279866`, the maintainer's 「同意」), item 2, verbatim

The imperative http.server route is retired as an app-author surface. The retire text of manifest.contributes.routes (packages/spec/src/kernel/manifest.zod.ts:884) and its three published copies (content/docs/references/api/metadata.mdx, package-api.mdx, kernel/manifest.mdx) stop sending authors to a kernel:ready handler: an app declares apis:, computes in a flow, and registers code as a stack function or a connector. The http.server service itself is untouched: platform plugins keep mounting their own doors on it.

The item's spec half is PR #23785 (#23216, domain:spec seat 1, open). This card is the skill half plus the ADR-0088 row the filer added. The card body's 「Reader who acts」 binds this work: the named cases that may have no declarative home are a question for the maintainer, put on this card with the measurement. ⛔ They are never a reason to keep teaching the retired door.

Deliverable: ONE draft PR to main. The first body line is Fixes #23787. It edits only these files, plus the changeset your measurement says is owed:

skills/objectstack-api/SKILL.md: the table "Choosing between apis: and a code handler" (L114–120) and the section "Code routes: mounting on http.server" (L199–225, separators included);
skills/objectstack-api/evals/endpoints-auth-routes.json: eval id 3 (L24–33);
docs/adr/0088-metadata-kind-admission-and-retirement.md: the status line (L3) and the router row (L40).

⛔ No other skills/** file. ⛔ No code. ⛔ No file in PR #23785's list.

2. PM mechanism assumptions — measure before you build; falsify and report where wrong

(a) PM readings at origin/main 46ca793ed.
- SKILL.md: 434 lines; node scripts/check-skills-token-ratchet.mjs reads 4754 tokens against ceiling 6314.
- The eval: 55 lines, 1042 tokens against ceiling 1042 (headroom 0).
- http.server appears in skills/ only in these two files. Nothing else in skills/ links the "Code routes" section.
(b) The surface the ruling names for an app. Re-read each item on your base before a word of the skill states it:
- apis: with type: 'object_operation' or type: 'flow' (live from protocol 17; the skill says so at L107ff).
- A stack function, defineStack({ functions }). ADR-0088's function row calls these "hook-binder & flow script body runners". The skill's L154 says script / proxy endpoint targets "do not execute in 17.x". Measure on 18.x whether a flow can run a stack function, and through which node.
- A connector, packages/connectors/* (connector-imap, -mcp, -openapi, -rest, -slack at this base). Measure whether any of them is an inbound door or only outbound.
- A PM reading, not a premise: packages/triggers/trigger-api is an inbound, HMAC-signed hook that starts a flow. It verifies only ObjectStack's own x-objectstack-signature (t=<unix>,v1=<hex HMAC-SHA256 of "<t>.<raw body>">, api-trigger.ts L111–153). On that reading it does not verify a third party's own scheme, such as Stripe's Stripe-Signature. Measure it before relying on it, and name it in the skill only if it is an app-authorable door.
(c) The row's named cases. They are a third-party callback that verifies its own signature over the raw body, a streaming response, and a protocol the platform does not speak. The PM expects at least one of them to have no declarative home today.
- For each case: state in the skill only what holds; ⛔ do not keep the retired door and ⛔ do not invent a door.
- Put each case without a home in the report's open_questions, with its measurement (file:line). The seat puts it to the maintainer on this card.
(d) The eval moves with the text. Eval id 3 (a Stripe webhook whose signature is verified in code, at POST /api/v1/apps/acme/stripe) expects the code-route pattern; its must_contain is ["http.server", "kernel:ready", "getService"].
- Its expected_output and assertions must match what the new skill text teaches.
- If the Stripe case has no declared home under (c), re-target the eval at a case the declared surface serves, or have it expect the skill's statement of the gap. Say which in the PR body.
- The eval file is at headroom 0, so pay any growth inside it. ⛔ No CEILINGS move, and ⛔ re-wrapping is not payment.
(e) ADR-0088. AGENTS.md rule 13: a recorded decision changes by a new ADR or an amended status line.
- The repo's precedent is a · **Amended** (<date>, <card> — <what changed>) entry on the **Status**: line (for example ADR-0005's line).
- Row L40 already carries two in-row "⚠️ Correction" notes. The retirement of the router KIND is unchanged by the ruling; what changes is the delivered form "imperative http.server mounts" as an app's route surface.
- Write the least text that keeps the ADR true: one **Amended** entry citing showcase: the "Recalculate Estimate" / "Recalculate Selection" api actions answer 500 — recalc-endpoint.ts calls ctx.ql.update with no execution context, which the security layer refuses as a principal-less write #23128 ruling C′ item 2, and the row pointed at it. ⛔ No other ADR edit.
- check-adr-links and check:adr-anchors are in your gate list.
(f) The changeset. The precedent is PRs docs(skills): the datasources rule states that default is host-reserved, connected from OS_DATABASE_URL, and refused in a stack's datasources (#23768) #23793 and docs(skills): navigation.md states the derived record surface per flow — viewing routes to a page, create/edit opens a modal bounded on desktop and full-screen on mobile, a light record uses a drawer #23795 (this seat, R3): skills/** ships through packages/skills' dist (scripts/sync-catalog.mjs), so a text edit owes an @objectstack/skills patch with Clause-②: no. Re-measure, and measure whether docs/adr/** ships in any files[] (the PM expects not).
(g) PR docs(spec): the routes / App.apis retire text stops sending app authors to an imperative http.server route (ruling C′ item 2) #23785's wording is your reference.
- Read its diff (manifest.zod.ts, app.zod.ts, dispatcher.zod.ts, plugin-rest-api.zod.ts retire texts) and keep the skill consistent with it where they say the same thing.
- ⛔ Touch none of its files. If it merges before you open your PR, merge main once (parallel discipline ②).

3. PM suggested route — optional; measurement wins

The table. Keep the apis: row. Replace the http.server row with what an app does when it needs code: compute in a flow, and register code as a stack function or a connector, each as measured in (b). Then state the gap cases from (c) in one line.
The "Code routes" section. Delete it. If the skill needs to say anything, one sentence is enough: the imperative http.server mount is the platform plugins' own primitive, not an app surface. The deprecated-alias, kernel:listening and Hono-sealing notes go with it.
Expected budget. Lines and tokens both fall. Report the readings either way.

4. Verification you owe (the derived gate families below are a clue, not the spec)

Derived at 46ca793ed by node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack skills/objectstack-api/SKILL.md skills/objectstack-api/evals/endpoints-auth-routes.json docs/adr/0088-metadata-kind-admission-and-retirement.md (37 commands).

After your FINAL commit, re-derive with no paths.
Run the local subset, capture each exit code before any pipe, and reconcile with --ran.
Quote git rev-parse --short HEAD of that run in the report and the PR body.
CI runs the full farm; cite the PR's check-runs for every family CI runs.

node scripts/check-adr-links.mjs
node scripts/check-adr-links.mjs --self-test
node scripts/check-adr-symbol-anchors.mjs
node scripts/check-adr-symbol-anchors.mjs --self-test
node scripts/check-ci-filter-parity.mjs
node scripts/check-closing-keyword-parity.mjs
node scripts/check-closing-keyword-parity.mjs --self-test
node scripts/check-comment-mask-corpus.mjs
node scripts/check-doc-route-spelling.mjs --advisory
node scripts/check-doc-route-spelling.mjs --self-test
node scripts/check-dts-emitted.mjs --self-test
node scripts/check-skills-token-ratchet.mjs
node scripts/check-skills-token-ratchet.mjs --self-test
pnpm --filter @objectstack/lint run check:doc-formula-expressions
pnpm --filter @objectstack/spec run check:skill-docs
pnpm check:adr-anchors
pnpm check:agent-test-spelling
pnpm check:corpus-claim-drift
pnpm check:cross-package-test-inputs
pnpm check:doc-authoring
pnpm check:driver-memory-census
pnpm check:dts-closure
pnpm check:dual-build-cjs-loads
pnpm check:gitlink-declared
pnpm check:lean-entry-closure
pnpm check:merge-driver
pnpm check:nul-bytes
pnpm check:pm-governed-merges
pnpm check:pm-prior-rulings
pnpm check:pm-skill-id-lint
pnpm check:refd-timer-probe
pnpm check:role-word
pnpm check:skill-compatibility
pnpm check:skill-frame-sync
pnpm check:skill-identifier-liveness
pnpm check:sourcemap-no-sources-content
pnpm check:watch-hint-literal

The PR body quotes the check-skills-token-ratchet verdict lines for both skill files, before and after, beside the line readings.

5. PR body and labels

The first line is Fixes #23787. The next is the line Clause-②: no at line start, copied from the claim, with no arm.
Include a ## 维护者速读(草稿) section: Chinese, business angle, five fixed parts: 改了什么 / 为什么改 / 风险与代价(含回滚) / 席位意见(留空) / 你要做的. If (c) leaves an open question, 你要做的 names it in one line.
Write no label.
The PR is governed, Tier H (skills/** and docs/adr/**): push, open the draft PR, deliver the report and STOP. The seat runs the at-tier contract review and requests the human approvals. ⛔ Never flip it out of draft, never arm auto-merge, never request reviewers.
The footer is the session-URL form. No model identifier appears anywhere in the PR, commits, changeset or comments.

6. Writes

Writes: REST proxy only, through scripts/pm/ tools. Budget:

git push (as needed);
pr_create once (draft, assignees: ["os-elon-musk"]);
post-stamped --comment=23787 once (the os-dev-report comment).

Report api_writes (count + endpoints) and mcp_calls (count + tool names; a write tool in the list gets the report refused).

7. Report

Deliver the JSON report twice, as .claude/agents/os-dev.md specifies:

first as a comment on skills(objectstack-api): the "Choosing between apis: and a code handler" table and the "Code routes" section still teach app authors to mount on http.server, which ruling C′ (#23128) retired as an app-author surface #23787 whose first line is the bare text os-dev-report;
then as your final message (the JSON alone).

Machine-checkable fields only (gates / line_budget / deviations / files_changed / open_questions), with the line and token readings.

8. The four-axis decision frame — use it only if a `needs_decision` arises; ⛔ keep no copy in the repo

Verbatim copy of .claude/skills/pm-dispatch/SKILL.md lines 241–261 at 46ca793ed, md5 abff5f852c8fd09b79ec0623439aa4f0:

每个方案必须沿四条固定评估轴分析,这是决策分析的核心原则,不是可选项:

实际业务需求 — 它服务的是真实存在的业务场景,
还是投机性能力面?判据要求实测(谁在写这个键、谁在读、
示例应用与真实部署的用法),「读起来像有用」不作数。这条轴会改变结论,不是陪衬。
项目长远合理性 — 哪个方案符合北极星方向与可持续架构(no workarounds、
contract-first),临时补丁式选项要明说长期代价。
防 AI 写代码犯错,尤其是防 AI 写元数据 app 犯错 — 哪个方案让 AI 在结构上更难写错:
契约收紧(严格 schema、publish 时响亮拒绝)优于消费端宽容(?? 回退、静默容错)——
宽容恰是 AI 批量犯错被掩盖的温床;声明即强制,绝不让 AI 声明一个运行时不兑现的能力。
创业阶段不扩散需求 — 创业阶段聚焦原则:创业项目先专注核心能力,能力扩张默认
从紧,无拉动的声明面按 implementation-first 处置,已发布零消费能力不因沉没成本豁免。
过渡也从紧 —— 创业阶段不渐进:废弃别名/拼写与能力退役默认立即退休,无分阶段
窗口、无双拼写宽限;staged 仅凭具名外部用户证据方可荐。新增门禁默认否:门禁是只减
不增的零件,例外只有维护者点名;荐新增门禁须引其点名原话,否则荐「不加」。

基本裁决原则:spec 声明 > 实现 > 文档面;声明而未兑现是实现缺口,补实现或退役,
⛔ 不在消费端收窄;未声明键随实现,文档随之。「声明即强制」只及 spec 与元数据契约、
运行时能力,⛔ 不及 AGENTS.md 这类给 agent 读的约定 —— 那些的读者是 agent,不是门禁。
推荐意见必须基于这四条轴给出理由;四轴冲突时如实呈现权衡,
交维护者拍板。

Generated by Claude Code

A release-timing condition this card now carries, from the contract review PASS 6207450159 on PR #23785 (#23216). domain:spec seat 1 · session session_01HjR8RUwTPQ3TgbfKihmxp9 · 2026-10-16T03:32Z.

PR #23785 rewrites migration entry 18's acceptanceCriteria (plugin-manifest-contributes-routes-retired). os migrate meta prints it as verify:, and it says that no former teaching site sends an app author to an imperative http.server mount. That is true inside packages/spec and content/docs at that PR's head. It is fully true only once this card's two sites land: skills/objectstack-api/SKILL.md:119 and :201-:214 with their eval, and docs/adr/0088-metadata-kind-admission-and-retirement.md:40.

If this card lands in the same spec release as PR docs(spec): the routes / App.apis retire text stops sending app authors to an imperative http.server route (ruling C′ item 2) #23785, nothing more is owed.
If it misses that release, domain:spec seat 1 owes a one-sentence narrowing of entry 18's acceptanceCriteria in packages/spec before the release, so that the shipped verify: line does not outclaim the shipped skill (Prime Directive chore: version packages #10).

Generated by Claude Code

docs(skills): objectstack-api stops teaching an app to mount routes o…

os-dev-report

{
  "issue": 23787,
  "status": "done",
  "branch": "claude/issue-23787-api-skill-retired-route-door",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/23807",
  "session": "session_01VqGhCg9wdsBXPz54uAEWg7",
  "premise_still_valid": true,
  "summary": "Implemented the skill half of #23128 ruling C′ item 2 (record 6142279866) plus the ADR-0088 row, as one draft PR to main (head b4ea19079, base b485122a7 = origin/main at worktree creation; the PM's 46ca793ed readings re-measured unchanged there). skills/objectstack-api/SKILL.md: the decision table's `http.server mount (plugin code)` row is replaced by `A flow that runs your code` (a `type: 'flow'` endpoint at a flow whose `script` node names a stack function via defineStack({ functions }) or whose `connector_action` node calls a declared connector, outbound); the paragraph under it names the inbound `type: 'api'` flow hook (pointer to objectstack-automation), states that an app never mounts on `http.server` (wording aligned with PR #23785's retire texts), and names the three cases with no app surface today; the `Code routes: mounting on http.server` section (26 lines) is deleted. evals/endpoints-auth-routes.json eval 3 keeps the Stripe prompt and now expects the gap statement plus what holds for code (must_contain x-objectstack-signature + functions; must_not_contain http.server, kernel:ready, getService). ADR-0088: one **Amended** entry on the Status line citing #23787 and ruling C′ item 2; the `router` row points at it; the KIND's retirement is unchanged. Changeset: @objectstack/skills patch, Clause-②: no (skills/** ships through packages/skills dist via scripts/sync-catalog.mjs; docs/adr/** is in no package's files[] — every tracked package.json scanned, zero hits). PM assumption (c) measured: all three named cases have no app-declarable home today (PM expected at least one); (b) connectors are outbound only; (b4) trigger-api verifies only x-objectstack-signature — all confirmed, see open_questions.",
  "tests": "No package source changed, so no package test suite or typecheck is owed; no tested behaviour changed, so no ablation. Eval file parses (node JSON.parse: valid json). Readings at b4ea19079: SKILL.md 434 → 415 lines, 4754 → 4642 tokens (ceiling 6314, headroom 1560 → 1672); eval 55 → 55 lines, 1042 → 1039 tokens (ceiling 1042, headroom 0 → 3); sum of all skills/*/SKILL.md 4408 → 4389 lines; bundle total 155016 → 154901 tokens; no CEILINGS move. grep http.server|kernel:ready|IHttpServer|http-server over skills/ after the edit: the api skill names http.server only in its `never mounts` sentence and the eval's must_not_contain; remaining kernel:ready hits are objectstack-platform / objectstack-i18n plugin-lifecycle teaching (out of scope).",
  "gates": "Derived after the final commit at b4ea19079 with `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` (no paths): 49 commands = the PM's 37 at 46ca793ed + 12 changeset-family gates the new .changeset/*.md pulls in. All 49 run by a recorder that captures each exit code before any pipe (eval the printed command with output redirected to a log, then status=$?). `dispatch-gates --ran ran.list` verdict, exit 0: `49 derived famil(ies) accounted for — 45 run, 4 NOT-MEASURED (4 DERIVED from a recorded exit 3)`, 0 UNRUN. 45 x exit 0, including check-skills-token-ratchet (+ --self-test), check:skill-docs, check:adr-anchors, check-adr-links (+ --self-test), check-adr-symbol-anchors (+ --self-test), check:skill-identifier-liveness, check:skill-frame-sync, check:skill-compatibility, check:role-word, check:doc-authoring, check:pm-skill-id-lint, check:nul-bytes, check:published-files, check-empty-changeset, check-changeset-no-major, check-adr-0087-registration, check:changeset-gate-self-tests, check:objectui-changeset, check:pm-changeset-deadline-census, check:corpus-claim-drift, check:cross-package-test-inputs, check:merge-driver, check:pm-governed-merges, check:pm-prior-rulings, check-ci-filter-parity, check-closing-keyword-parity, check-comment-mask-corpus, check-doc-route-spelling, check-dts-emitted --self-test, release-rehearsal-clone --self-test, release-pending-publish --self-test, check:agent-test-spelling, check:driver-memory-census, check:gitlink-declared, check:refd-timer-probe, check:watch-hint-literal; and check:doc-formula-expressions (first exit 3: @objectstack/lint not built; built the 4-package closure with `pnpm exec turbo run build --filter=@objectstack/formula --filter=@objectstack/lint --concurrency=2` under os-verify-lock.sh, VERDICT command-exit 0, 88 s held, waited 0 s; rerun exit 0). NOT MEASURED locally (exit 3 PREREQUISITE NOT MET, declared narrowing): check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure, check:sourcemap-no-sources-content — whole-repo dist/ sweeps; the fresh worktree has no dist and this diff touches no package, so the whole-repo build is not owed; they enter the derivation only via ci.yml's Build Core job filter on skills/** and CI measures them there. Local-only families check:dev-prereqs / check:skill-frame-freshness not derived (no packages/spec build or four-axis frame file touched). CI check-runs on b4ea19079 at report time, 36 total: completed/success = filter, Check PR Size, Check Documentation Links, The card this PR closes must claim this branch, Part-of PR must not also close its card, No other open PR may claim the same issue, No other open PR may claim the same single-writer path; completed/skipped = Console Pin Gate, Temporal Conformance (live PG + MySQL), Dogfood Verify CLI, Dogfood Regression Gate (matrix shard), Packed-tarball smoke (opt-in), Build Docs; in_progress = Build Core, Lint · repo & tooling gates, Lint · docs & code guards, Lint · PM dispatch-gates, Lint · ESLint, Lint · CI release & engine gates, Lint · scoped · tooling self-tests, Lint · scoped · slot lookup & corpus, Lint · scoped · query-options erasure, Type Check · workspace / source gates / debt ledger / consumer gates, Test Core 1/6 .. 6/6, Governed Surface Queue Guard, Check Changeset, Dogfood Regression Gate, Auto Label. test:repo not run locally (CI's Test Core).",
  "line_budget": "SKILL.md net lines -19 (434 → 415; budget was net at most 0), tokens 4754 → 4642 / 6314; eval lines 55 → 55, tokens 1042 → 1039 / 1042 (headroom 0 → 3, paid inside the file by content, byte count 4165 → 4156, no re-wrap); package SKILL.md sum 4408 → 4389; bundle 155016 → 154901; CEILINGS untouched.",
  "files_changed": [
    "skills/objectstack-api/SKILL.md",
    "skills/objectstack-api/evals/endpoints-auth-routes.json",
    "docs/adr/0088-metadata-kind-admission-and-retirement.md",
    ".changeset/23787-api-skill-retired-route-door.md"
  ],
  "deviations": [
    "Base: origin/main had moved 46ca793ed → b485122a7 when the worktree was created; the PM's (a) readings were re-measured at b485122a7 and matched exactly (434 lines / 4754 tokens; 55 lines / 1042 tokens; http.server only in the two files). main moved again to 23d0bc78b before the PR opened (two unrelated changesets); not merged — no overlap with the four files, PR #23785 still open.",
    "Derived gate set is 49, not the PM's 37: the new changeset pulls in 12 changeset-family commands. All run.",
    "Four whole-repo dist/ gates recorded exit 3 (PREREQUISITE NOT MET) and are reported NOT MEASURED locally — see gates; CI's Build Core measures them.",
    "PM assumption (c) expected at least one gap case; all three measured as having no app surface today. The skill states the gap in one sentence rather than inventing a door; each case is in open_questions.",
    "Eval 3 keeps the Stripe prompt and expects the gap statement (option 2 of dispatch (d)), not a re-target; reason in the PR body.",
    "Commit trailer: AGENTS.md's model-free pair (`Claude-Session:` + `Co-authored-by: Claude`) was used; the harness reminder's model-named Co-Authored-By line was not, per AGENTS.md precedence. PR footer is the session-URL form; no model identifier anywhere.",
    "All GitHub reads were REST via gh api (issue, comments, PR 23785 state/files/diff, PR 23807 read-back, check-runs); no MCP tool was called. gh pr view --json failed once with a GraphQL 403 and was replaced by the REST read.",
    "No label written (dispatch: write no label).",
    "pnpm install, the scoped turbo build (under the verify lock) and 49 check:* gates ran in the foreground; no background process, watcher or monitor was left running."
  ],
  "mcp_calls": "0 — none",
  "api_writes": "3 REST writes, all through the fleet-write relay as objectstack-fleet[bot]: POST /repos/objectstack-ai/objectstack/pulls (pr_create, draft, run 38847808852 → PR #23807, body 11831 bytes stored identical), POST /repos/objectstack-ai/objectstack/issues/23807/assignees (the same pr_create action's assignee leg; os-elon-musk listed), POST /repos/objectstack-ai/objectstack/issues/23787/comments (this os-dev-report, via post-stamped). Relay transport: 2 x POST /repos/objectstack-ai/objectstack/dispatches (one envelope per action). git push x2 (empty-branch probe, then b4ea19079) — not REST.",
  "open_questions": [
    {
      "question": "Case 1 of the retired row — a third-party callback that verifies its OWN signature over the raw body (eval 3's Stripe-Signature case) — has no app-declarable home today. Measured: trigger-api answers 401 INVALID_SIGNATURE to any post without a valid x-objectstack-signature (packages/triggers/trigger-api/src/api-trigger.ts:321-348; the only scheme it verifies, :142-170 via core verifyHttpSignature); a flow started by the hook or by a type 'flow' endpoint receives the parsed JSON body as its trigger record, never raw bytes or headers (api-trigger.ts:357-366; packages/runtime/src/endpoint-executor.ts:567 passes ctx.body to buildAutomationContext), so a stack function cannot verify the third party's signature. Should an app get a declared inbound door for this, or does the case stay a platform plugin's own door?",
      "options": [
        "A — keep the gap (status quo): the skill says so; such a door is a platform plugin's own primitive, built in the platform when a named consumer appears.",
        "B — extend the `api` flow trigger with a declared verification seam (for example a start-node option naming a stack function that receives the raw body and headers and returns accept/refuse) — new spec + trigger-api + engine work, its own card and ADR-0041 amendment.",
        "C — allow an `api` flow start node to declare a third-party scheme the platform implements (e.g. a `stripe` verifier) — the platform owns each scheme; closed list."
      ],
      "recommendation": "A, because no named external producer was measured (examples/app-showcase mounts no route handler; its recalc is a declared flow endpoint), the startup-focus axis defaults expansion to no, and declaring a door the runtime does not yet serve is forbidden; B or C only on a named user, as its own card."
    },
    {
      "question": "Case 2 — a streaming response — has no app-declarable home: declared endpoints answer one JSON envelope (packages/runtime/src/endpoint-executor.ts:291 and :567-585, successAnswer). Keep as a stated gap?",
      "options": [
        "A — keep the gap; the skill states it.",
        "B — add a streaming answer shape to the declarative endpoint executor (new target or response mode) — spec + runtime work, its own card."
      ],
      "recommendation": "A, because no pull was measured and a streaming contract is a new execution dialect against ADR-0121's 'a stable URL plus a policy layer over an existing pipeline, never a second execution dialect'."
    },
    {
      "question": "Case 3 — a protocol the platform does not speak — has no declared surface by definition (http.server is an HTTP door). Confirm the skill's one-line statement is the intended answer for app authors.",
      "options": [
        "A — yes: it is platform work; the skill says so.",
        "B — name a request path (how an app author asks for a platform door) in the skill."
      ],
      "recommendation": "A; a request path is process text that belongs to the platform docs, not to a customer-loaded skill priced per token."
    }
  ],
  "out_of_scope_findings": [
    "carrier: none · noted, not filed (observation, class none): skills/objectstack-platform/rules/plugin-lifecycle.md:134 teaches ctx.getService('http-server') — the deprecated alias, which the deleted api-skill text recorded as absent on the provider path that registers no alias. Platform-plugin teaching outside this card's file list; in the PR's Acceptance notes. Dedupe words: plugin-lifecycle http-server alias getService.",
    "carrier: none · noted, not filed (observation, class none): the spec's describe texts still spell the executing-type statement as 17.x (packages/spec/src/api/endpoint.zod.ts:174-175; packages/rest/src/openapi-endpoints.ts:218) while the skill's compatibility is 18.x; the skill keeps the same spelling at its L154 for consistency. Dedupe words: endpoint.zod 17.x script proxy execute describe."
  ]
}

Generated by Claude Code

ACCEPT → PR #23807 comment 6207794824 · seat domain:skills#2, session_01VqGhCg9wdsBXPz54uAEWg7 · 2026-10-16T04:04Z

Tier H. The PR stays draft with needs-user-decision and needs:contract-review, and review is requested from os-zhuang and hotlong. Landing needs an authorized APPROVED review and the isolated CONTRACT_REVIEW_TIER PASS on its head (b4ea19079). This card stays pm:dispatched until the PR merges.

维护者提问(不阻塞落地):三类场景今天没有应用可声明的入口,要不要开?

The card's body asks for this: the dev measured each case, and none has an app-declarable home on main (b485122a7). The PR's skill text states the gap in one sentence instead of inventing a door, so it stays true whatever you answer here. A "yes" to B or C is new spec and runtime work and gets its own card.

A third-party callback verified by its own signature over the raw body (Stripe's Stripe-Signature, the eval's case).
- Measured: the inbound type: 'api' hook answers 401 INVALID_SIGNATURE unless the post carries ObjectStack's own x-objectstack-signature (packages/triggers/trigger-api/src/api-trigger.ts L321–348, verified at L142–170).
- A flow started by that hook, or by a type: 'flow' endpoint, receives the parsed JSON body as its trigger record, never the raw bytes or the headers (api-trigger.ts L357–366; packages/runtime/src/endpoint-executor.ts L567). So a stack function cannot check a third party's signature.
- Options:
  - A — keep the gap: such a door is a platform plugin's own, built when a named user needs it.
  - B — a declared verification seam on the api trigger: a start-node option naming a stack function that receives the raw body and headers and returns accept or refuse. This needs spec, trigger-api and engine work, and an ADR-0041 amendment.
  - C — a closed list of platform-implemented third-party schemes (a stripe verifier, …) that a start node selects.
A streaming response.
- Measured: a declared endpoint answers one JSON envelope (endpoint-executor.ts L291, L567–585).
- Options: A keep the gap; B a streaming answer mode on the endpoint executor.
A protocol the platform does not speak.
- There is no declared surface by definition; http.server is an HTTP door in any case.
- Options: A the skill's one-line statement stands; B the skill also names how an app author asks for a platform door.

席位建议:三项都选 A。 Weighed on the four axes:

Business need: no named external producer was measured. examples/app-showcase mounts no route handler; its recalc is a declared flow endpoint.
AI-error axis: declaring a door the runtime does not yet serve is the failure the frame forbids.
Startup-focus axis: capability expansion defaults to no.
Item 2: a streaming mode would be a second execution dialect against ADR-0121's "a stable URL plus a policy layer over an existing pipeline".
Item 3: a request path is process text, which belongs in platform docs and not in a skill priced per token.

B or C becomes right the moment a named user needs it, filed as its own card.

Generated by Claude Code

Landing stopped — classifier refusal · seat domain:skills#2, session_01VqGhCg9wdsBXPz54uAEWg7 · 2026-10-16T04:16Z

PR #23807 met the Tier H landing conditions on head b4ea19079:

os-zhuang (a GOVERNED_APPROVERS account) APPROVED that head at 2026-10-16T04:04Z, review 5542940388;
the isolated CONTRACT_REVIEW_TIER record 6207942851 is PASS on that head;
CI shows 47 check-runs, 0 failures, mergeable_state: clean;
check-governed-merges.mjs --pr 23807 reads landing tier H, 62 changed lines.

The first landing stroke was refused by this session's permission classifier (reason [CI Bypass]) before any request left:

node scripts/pm/label-write.mjs --repo objectstack-ai/objectstack --issue 23807 --remove needs:contract-review

Not attempted: pr_ready and automerge_enable (fleet-write/dispatch.mjs actions file). Per landing-operations.md, the seat stops here and does not rephrase or retry. The PR stays draft with needs:contract-review until the maintainer gives the word or an authorized approver lands it.

Generated by Claude Code

Landed · seat domain:skills#2, session_01VqGhCg9wdsBXPz54uAEWg7 · 2026-10-16T09:42Z

probe	reading
PR #23807	`merged` by the merge queue at 2026-10-16T09:40Z, merge commit `49700e4c0`, from head `b4ea19079`. That head carries `os-zhuang`'s APPROVED review 5542940388 and the at-tier PASS 6207942851 (Tier H). The seat readied it and armed auto-merge on the maintainer's word in this session (「同意落地 23807」), after the classifier refusal recorded in 6207961280.
`origin/main` (tip `0af559e80`)	All four files are byte-identical to the reviewed head: `skills/objectstack-api/SKILL.md` `19be4ce89`, the eval `fdcef0681`, ADR-0088 `2d5e48340`, the changeset `2bc77f978`.
merge queue	no `gh-readonly-queue/main/*` ref names the PR

State. The PR's Fixes closed this card completed. pm:dispatched is removed in this act.

Carried forward (non-blocking).

The maintainer's answer on the three cases with no app surface (6207817517). The skill states the gap, so it stays true whatever the answer is.
The "rate limit" clause shared with PR docs(spec): the routes / App.apis retire text stops sending app authors to an imperative http.server route (ruling C′ item 2) #23785: pointer 6207969413 on docs(spec): the routes retire text and three published pages stop sending app authors to an imperative http.server route — apps declare apis:, compute in flows, register stack functions (ruling C′ on #23128) #23216. The skill's copy follows whichever way that text lands.

Generated by Claude Code

Navigation Menu

Repository navigation

skills(objectstack-api): the "Choosing between `apis:` and a code handler" table and the "Code routes" section still teach app authors to mount on `http.server`, which ruling C′ (#23128) retired as an app-author surface #23787

The ruling

The text

Reader who acts

Dedupe

First grade · `domain:skills` · p2 · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-16T03:06Z

Dispatch — issue #23787 (objectstack-ai/objectstack) · `domain:skills` · PM `session_01VqGhCg9wdsBXPz54uAEWg7` (os-elon-musk)

1. Ruling — #23128 ruling C′ (`6142279866`, the maintainer's 「同意」), item 2, verbatim

2. PM mechanism assumptions — measure before you build; falsify and report where wrong

3. PM suggested route — optional; measurement wins

4. Verification you owe (the derived gate families below are a clue, not the spec)

5. PR body and labels

6. Writes

7. Report

8. The four-axis decision frame — use it only if a `needs_decision` arises; ⛔ keep no copy in the repo

维护者提问(不阻塞落地):三类场景今天没有应用可声明的入口,要不要开?

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

skills(objectstack-api): the "Choosing between apis: and a code handler" table and the "Code routes" section still teach app authors to mount on http.server, which ruling C′ (#23128) retired as an app-author surface #23787

Description

The ruling

The text

Reader who acts

Dedupe

Activity

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

First grade · domain:skills · p2 · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-16T03:06Z

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

Dispatch — issue #23787 (objectstack-ai/objectstack) · domain:skills · PM session_01VqGhCg9wdsBXPz54uAEWg7 (os-elon-musk)

1. Ruling — #23128 ruling C′ (6142279866, the maintainer's 「同意」), item 2, verbatim

2. PM mechanism assumptions — measure before you build; falsify and report where wrong

3. PM suggested route — optional; measurement wins

4. Verification you owe (the derived gate families below are a clue, not the spec)

5. PR body and labels

6. Writes

7. Report

8. The four-axis decision frame — use it only if a needs_decision arises; ⛔ keep no copy in the repo

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

维护者提问(不阻塞落地):三类场景今天没有应用可声明的入口,要不要开?

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

skills(objectstack-api): the "Choosing between `apis:` and a code handler" table and the "Code routes" section still teach app authors to mount on `http.server`, which ruling C′ (#23128) retired as an app-author surface #23787

First grade · `domain:skills` · p2 · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-16T03:06Z

Dispatch — issue #23787 (objectstack-ai/objectstack) · `domain:skills` · PM `session_01VqGhCg9wdsBXPz54uAEWg7` (os-elon-musk)

1. Ruling — #23128 ruling C′ (`6142279866`, the maintainer's 「同意」), item 2, verbatim

8. The four-axis decision frame — use it only if a `needs_decision` arises; ⛔ keep no copy in the repo