qa(checklist): no ledger item carries since: "v18" — author the v18 line's new and changed capabilities into the platform checklist, then run them #23879

Activity

1. objectstack-fleet

   assigned

   os-sales

   on Oct 16, 2026
2. objectstack-fleet

   added

   pm:dispatched

   domain:devx

   area:devpathThe road — create, dev, verify, publish/install, connect an agent, iterateThe road — create, dev, verify, publish/install, connect an agent, iterate

   on Oct 16, 2026
3. objectstack-fleet commented on Oct 16, 2026

   

   objectstack-fleetbot

   on Oct 16, 2026

   ContributorAuthor

   More actions

   Claim: PM loop round 1
   Session: session_014eFvbvGK4FjXvscggDNTD4
   Account: os-sales
   Branch: claude/issue-23879-v18-checklist-items
   Worktree: objectstack-issue-23879 (the cloud session's own checkout)
   Domain: domain:devx
   Seat: domain:devx#1 (seat post #6023)
   File surface: docs/qa/platform-checklist/areas/**, docs/qa/platform-checklist/coverage.json (stop on breach; explain in the report)
   Container & model: L, mode:cloud, model: opus (dispatch-gates --tier on that surface: "no path-derived mandate … floor sonnet · default opus · ceiling fable"; PM picks the default tier)
   Clause-②: no
   Responsibility: n/a — not a defect card
   Thread-read: none
   Serial constraints cleared: none blocking — no open domain:devx pm:dispatched card names docs/qa/platform-checklist/** (seat 2's #23169 / PR #23652 merged 2026-10-15); #23050's rest-server.ts split slices (domain:cli) re-point source anchors in areas/*.json as ordinary concurrency, later lander resolves; #23878 (same batch) makes no ledger edits by its own terms
4. objectstack-fleet commented on Oct 16, 2026

   

   objectstack-fleetbot

   on Oct 16, 2026

   ContributorAuthor

   More actions

   os-dev-report
   {
   "issue": 23879,
   "status": "done",
   "branch": "claude/issue-23879-v18-checklist-items",
   "pr": "#23901",
   "session": "session_016NNWeTTi2eHhhrgDq9sJF8",
   "premise_still_valid": true,
   "summary": "Premise held on origin/main 94114c1: checklist-select since:v18 --json -> [] (exit 1) and .changeset/pre/ held 714 consumed changesets (29 major / 363 minor / 322 patch). Six read-only hunters swept the delta (4 over major/minor, 1 over patch, 1 over the ADR-0087 step-18 registries + ADR-0131 stages); their ~260 rows were grouped into 48 since: v18 items across 14 area files (4 P0, 27 P1, 17 P2), each with its permanent pins in automated.ref and live steps; pure retirements already pinned got no item (pins listed in the PR body). Ran checklist-test since:v18: all 228 pin files pass, live API legs give 1 PASS / 45 PARTIAL / 2 FAIL; the first live pass also disproved four details of my own draft items, corrected before any record pins their revision. Card assignee was os-sales and is mirrored on the PR; a size/xl label on the PR was set by another actor and left alone.",
   "tests": "checklist-test since:v18 (sequential, one runner) — framework 94114c1 (origin/main code; this branch changes ledger data only), fresh showcase boot port 38791 ephemeral DB, Tenancy single, objectui pin daeb77fc (did not build). Proposed qa-run title: QA run · since:v18 (48/48) · 94114c1 · 2026-10-16 · 1 PASS / 45 PARTIAL / 2 FAIL / 0 BLOCKED / 0 NOT-RUN. Tier 1: every automated.ref pin, 228 files / 32 packages, all pass (vitest per package, exit 0 each; e.g. spec 24 files 1546 tests, runtime 34/590, rest 20/802, objectql 23/402, qa/dogfood 15/181, cli 25/330 + its e2e pin under OS_TEST_TIERS=nightly 1/2; lock VERDICT command-exit 0, 18m34s shared box). Reproduction rules for the 2 FAILs: (1) fresh pnpm dev -- --fresh -p PORT; anon GET /api/v1/keys -> expected 401 UNAUTHENTICATED, actual 405 METHOD_NOT_ALLOWED 'GET is not supported for /api/v1/keys. Allowed: POST.' (admin also 405). (2) as admin POST /api/v1/data/sys_user_permission_set {user_id: MEMBER, permission_set: showcase_ops, valid_from: 2027-01-02T00:00:00Z, valid_until: 2027-01-01T00:00:00Z} -> expected 400 VALIDATION_FAILED carrying the validity_window_order message 'Valid Until must be later than Valid From …'; actual 400 VALIDATION_FAILED fields[0].constraint {rule: validity_window_order, reason: unevaluable, fault: 'type: Unknown variable: previous'}. Per-item verdicts: identity-auth.auth-gate-held-session-raw-host-families r1 PARTIAL: pins pass; LIVE pass: held member (admin create-user lands mustChangePassword) got 403 PASSWORD_RESET_REQUIRED on GET /api/settings/branding, GET /api/v1/datasources, GET /api/v1/share-links, POST /api/v1/storage/upload/presigned, POST /api/v1/webhooks/redeliver, POST /api/v1/packages/com.example.showcase/publish, GET /api/v1/data/showcase_task, admin 200 on the GETs; API-key posture clause not-run || identity-auth.api-key-expiry-lifecycle r1 PARTIAL: pins pass; LIVE pass: mint without expiry -> 201 expires_at 2027-01-14 (+90d); 400 days -> 400 API_KEY_EXPIRY_TOO_LONG, sys_api_key total 4 before and after; revoked key -> 403 API_KEY_REVOKED; expired-key arm not-run || identity-auth.cookie-session-renewal-in-process r1 PARTIAL: pins pass; live not-run || identity-auth.default-organization-boot-invariant r1 PARTIAL: pins pass; LIVE pass: one sys_organization slug default; admin owner + member member, both sessions activeOrganizationId org_mvawjes6jmppnta9; 5 seeded sys_business_unit rows carry it; before-first-user ordering not-run || identity-auth.import-invitation-and-sso-domain-answers r1 PARTIAL: pins pass; live not-run || access-security.anonymous-floor-v18-doors r1 FAIL: pins pass; LIVE: anon GET /api/v1/keys -> 405 METHOD_NOT_ALLOWED (twice; contract 401) = FAIL; anon 401 on /notifications, /share-links, /openapi.json, /docs, /i18n/locales, /api/settings/branding = pass; token face /share-links/BOGUS/resolve -> 404 INVALID_OR_EXPIRED (not floored) = pass; anon POST /api/v1/forms/contact-us/submit with forged owner_id -> 201 body exactly {id} = pass || access-security.walled-environment-metadata-operator-only r1 PARTIAL: pins pass; walled boot not provisioned this round -> live not-run || access-security.meta-authoring-trail-and-audience-gates r1 PARTIAL: pins pass; live not-run || access-security.security-catalog-activation-and-clone-doors r1 PARTIAL: pins pass; live not-run || access-security.security-catalog-one-holder-and-boot-report r1 PARTIAL: pins pass; live not-run || access-security.grant-table-write-contract r1 FAIL: pins pass; LIVE: permission_set_id -> 400 INVALID_FIELD, duplicate grant -> 409 UNIQUE_VIOLATION, forged granted_by stamped with the admin = pass; inverted window insert -> 400 VALIDATION_FAILED with constraint.reason unevaluable, fault Unknown variable: previous, rule message never shown (twice) = FAIL; valid-window insert 201 (control); walled non-member arm not-run || access-security.parent-and-organization-write-guards r1 PARTIAL: pins pass; live not-run || access-security.deployment-tables-platform-only r1 PARTIAL: pins pass; LIVE: admin 200 / plain member 403 PERMISSION_DENIED on sys_job and sys_migration; organization_id filter -> 400 INVALID_FIELD = pass; org-admin-not-platform-admin leg not-run (PATCH sys_member role -> 405, no data door to promote) || access-security.share-link-combined-gates r1 PARTIAL: pins pass; live not-run || ai.mcp-coded-refusals-and-runtime-exposure r1 PARTIAL: pins pass; live not-run || api-backend.second-object-exposure-and-internal-fields r1 PARTIAL: pins pass; scratch app not provisioned -> live not-run || api-backend.data-request-shape-and-query-arity r1 PARTIAL: pins pass; LIVE pass: PATCH null / [] / 5 -> 400 VALIDATION_FAILED and updated_at unchanged; expectedVersion empty and empty If-Match -> 400; /query null -> 400; ?status x2 -> 400 VALIDATION_ERROR; DELETE packages keepData x2 -> 400, data intact; stale If-Match on unreadable row not-run || api-backend.meta-read-doors-v18 r1 PARTIAL: pins pass; LIVE pass: /meta/app/com.example.showcase -> showcase_app; unknown package and unknown name same 404; ?memeber -> 400; ?member on object -> 400; ?package=all ids identical (36); caller-FLS sortability not-run || api-backend.error-sentences-and-unique-violation-wire-code r1 PARTIAL: pins pass; live not-run || approvals.request-page-reply-and-reader-visibility r1 PARTIAL: pins pass; live not-run; console clause blocked(environment): objectui pin does not build || approvals.act-door-and-admin-rescue-slate r1 PARTIAL: pins pass; live not-run || attachments-storage.upload-limits-scope-and-ownership r1 PARTIAL: pins pass; LIVE pass: 101 MiB -> 413 PAYLOAD_TOO_LARGE; scope avatars / PUBLIC / public / null -> 400 INVALID_REQUEST naming the 5 scopes; omitted -> 200; member completing admin upload -> 403 PERMISSION_DENIED; live limit move, unclaimed download, metadataRefused not-run || attachments-storage.chunked-upload-integrity r1 PARTIAL: pins pass; live not-run || automation.flow-registration-verdict-on-read r1 PARTIAL: pins pass; LIVE: showcase flow registration.state registered, list carries registrations map; refused-flow arm not-run || automation.flow-authoring-refusals-v18 r1 PARTIAL: pins pass; LIVE spot: notify title single-brace -> PUT 422 INVALID_METADATA expression-invalid, read-back 404; os validate arms not-run || automation.flow-run-semantics-v18 r1 PARTIAL: pins pass; live not-run || automation.inbound-hook-timestamped-signature r1 PARTIAL: pins pass; live not-run || automation.scheduled-work-opt-in r1 PARTIAL: pins pass; LIVE spot: boot log states schedule / time_relative triggers NOT bound, OS_AUTOMATION_SCHEDULED_WORK_ENABLED unset; two-interval run count and flag-on boot not-run || cli.migrate-meta-write-stored-and-all r1 PARTIAL: pins pass; live CLI legs not-run || cli.organization-ownership-ceremony r1 PARTIAL: pins pass; live ceremony on a v17 DB copy not-run || cli.meta-package-flags-and-explain r1 PARTIAL: pins pass; live not-run || cli.validate-v18-authoring-verdicts r1 PARTIAL: pins pass; live not-run || cli.verify-derived-proof-families r1 PARTIAL: pins pass; live not-run || dashboards.analytics-exposure-gate-and-measure-aggregate r1 PARTIAL: pins pass; LIVE pass: dataset/query datasetName sys_user_metrics -> fields [user_count aggregate count]; exposure arms not-run || i18n.flow-copy-translation-and-host-override r1 PARTIAL: pins pass; live not-run || integration-system.inbound-mailbox-association r1 PARTIAL: pins pass; live blocked(fixture): no composed mailbox / IMAP double on stock boot || integration-system.notification-org-and-redeliver-eligibility r1 PARTIAL: pins pass; live not-run || platform-core.v18-boot-refusals r1 PARTIAL: pins pass; v17 DB copy not provisioned -> live not-run || platform-core.protocol-18-handshake-and-stored-replay r1 PARTIAL: pins pass; live not-run || platform-core.settings-organization-isolation-and-platform-rung r1 PARTIAL: pins pass; LIVE spot: member 403 on /data/sys_platform_setting, sys_setting has no scope=global row; global write and walled legs not-run || platform-core.serve-composition-v18 r1 PARTIAL: pins pass (e2e pin needs OS_TEST_TIERS=nightly: 1 file / 2 tests pass); live not-run || records-forms.write-time-option-and-element-shape-judgement r1 PARTIAL: pins pass; live not-run || records-forms.write-answer-advisories-rollback-and-tree-delete r1 PARTIAL: pins pass; live not-run || records-forms.comment-reactions-and-edit-stamps r1 PARTIAL: pins pass; LIVE: reaction 201 with user_id forced to caller, duplicate 409 UNIQUE_VIOLATION, unreadable comment 403 RECORD_NOT_ACCESSIBLE, update 405; reactions column write -> 400 INVALID_FIELD; body edit stamped is_edited true + server edited_at, client values dropped = pass; foreign delete / filter-read halves not-run || records-forms.v18-semantic-defaults r1 PARTIAL: pins pass; browser clauses blocked(environment): objectui pin does not build || studio-authoring.meta-save-preconditions-and-draft-rows r1 PASS: pins pass; LIVE pass: ?state=draft read serves version; If-Match with it 200, same stale token 409 with currentVersion; If-None-Match * on existing 409; If-None-Match abc 400; both headers 400; _drafts row carries label QA OCC 2; history actor = admin || studio-authoring.multi-package-item-rows r1 PARTIAL: pins pass; live not-run || studio-authoring.save-door-runs-authoring-rules r1 PARTIAL: pins pass; LIVE spot: page:header titel -> 422 component-props-unknown-key, read-back 404; url action javascript: -> 422; protection block -> 400; remaining arms not-run",
   "gates": "Local on head 2d410ef from dispatch-gates --commands --repo objectstack-ai/objectstack (exit codes captured before any pipe), all exit 0: node scripts/check-ci-filter-parity.mjs; node scripts/check-closing-keyword-parity.mjs; node scripts/check-closing-keyword-parity.mjs --self-test; node scripts/check-comment-mask-corpus.mjs; pnpm --filter @objectstack/lint run check:doc-formula-expressions; pnpm check:cross-package-test-inputs; pnpm check:doc-authoring; pnpm check:driver-memory-census; pnpm check:gitlink-declared; pnpm check:nul-bytes; pnpm check:platform-checklist (OK — 16 areas, 327 items (322 active, 1 planned); symbol anchors 822/832, the 10 the named residual); pnpm check:refd-timer-probe; pnpm check:watch-hint-literal. --ran reconciliation: '13 derived famil(ies) accounted for — 13 run, 0 NOT-MEASURED (a DERIVED zero — all 13 recorded an exit code and none of them is 3)'. No ① build owed (diff touches no package). CI check-runs on PR #23901: not yet read at report time (in_progress is the honest value). Changeset: skip-changeset applied (docs/qa outside every package files[]). Changed lines 3532 > 3000: lands by authorized review or human merge, not the queue on green.",
   "mcp_calls": "0 — no MCP GitHub tool used (reads were unauthenticated REST GETs through the proxy; writes through scripts/pm)",
   "api_writes": "3 relay dispatches (POST /repos/objectstack-ai/objectstack/dispatches, each 204) executing 4 platform writes as objectstack-fleet[bot]: POST /repos/objectstack-ai/objectstack/pulls (draft #23901) + POST /repos//issues/23901/assignees [os-sales]; POST /repos//issues/23901/labels [skip-changeset]; POST /repos//issues/23879/comments (this report). Plus git push (not REST).",
   "open_questions": [
   {
   "question": "The six stale existing items (and four probable ones) listed in the PR's Acceptance notes contradict v18 behaviour; this card did not revise them because #23878 is running those items now and a revision bump mid-run would orphan its pinned revisions. Who revises them?",
   "options": [
   "A: a follow-up ledger card after #23878 closes, revising each with a history entry",
   "B: fold them into #23878's close-out as checklist-accuracy findings on its anchor"
   ],
   "recommendation": "A, because the edits are revisions with their own history entries and #23878 is declared ledger-read-only; a single follow-up card keeps one writer per area file."
   },
   {
   "question": "The anonymous /keys finding: fix by mounting the non-POST /keys verbs on HonoServer so the dispatcher floor answers, or amend the 23225 contract text to say the floor holds only on dispatcher-only kernels?",
   "options": [
   "A: mount GET/PUT/PATCH/DELETE /keys through the dispatcher (one route owner, floor first)",
   "B: correct the contract and release text instead"
   ],
   "recommendation": "A, because ADR-0138 D2 says the decision is taken once per domain as its first statement; a 405 that describes the route shape to an anonymous caller is exactly what that rule retired."
   }
   ],
   "out_of_scope_findings": [
   "class: b · reach: public door — anonymous GET /api/v1/keys on a stock os dev boot (framework 94114c1) answers 405 METHOD_NOT_ALLOWED 'GET is not supported for /api/v1/keys. Allowed: POST.' where changeset 23225-domain-floor-anonymous-deny states '/keys: 401 UNAUTHENTICATED for every verb' (measured twice; admin also gets 405) · evidence: packages/runtime/src/dispatcher-plugin.ts mounts only server.post(PREFIX/keys), so non-POST verbs never reach packages/runtime/src/domains/keys.ts whose first statement is shouldDenyAnonymous; packages/plugins/plugin-hono-server/src/adapter.ts unmatchedResponse answers 405 · Seam: spec:ADR-0138 D2 anonymous floor → runtime:dispatcher-plugin.ts /keys mount · dedupe words: anonymous keys 405 401; dispatcher-plugin POST keys only; ADR-0138 D2 keys verb floor",
   "class: a · reach: public door — POST /api/v1/data/sys_user_permission_set with valid_until earlier than valid_from answers 400 VALIDATION_FAILED whose constraint.reason is unevaluable ('Unknown variable: previous'), so the rule's authored message is never shown on an insert (measured twice; a valid window inserts 201) · evidence: packages/plugins/plugin-security/src/objects/sys-user-permission-set.object.ts validation validity_window_order condition opens with previous == null || …, and previous is unbound on insert; CEL error absorption only saves it when a later conjunct is false; pin sys-user-permission-set-window-order.test.ts passes, so it does not assert the reason · dedupe words: validity_window_order previous unbound insert; grant window order unevaluable; sys_user_permission_set inverted window message",
   "class: a · reach: named producer — pnpm objectui:build on origin/main 94114c1 at .objectui-sha daeb77fc fails: [MISSING_EXPORT] 'checkPageComponentViewData' is not exported by packages/spec/dist/ui/index.mjs (imported by objectui packages/types/src/zod/layout.zod.ts); the export was deleted by a35f7a6 (#23784) while the pinned objectui still imports it — AGENTS.md Post-Task step 4 (a removal that breaks the pinned sibling ships with the sibling fix and pin bump); the full battery's Console Pin Gate builds exactly this · evidence: build log line 'Build failed with 1 error: [MISSING_EXPORT] checkPageComponentViewData'; packages/spec/src/ui/object-refinement-check-exports.test.ts asserts its absence · dedupe words: checkPageComponentViewData missing export objectui pin; console pin gate red 23784; objectui:build MISSING_EXPORT",
   "carrier: seat (wave anchor #23879) · checklist-accuracy, not filed: stale items cli.migrate-meta-codemod (--write ships; protocol major now 18), access-security.capability-declaration-lifecycle (sys_capability retired), automation.trigger-type-matrix + automation.time-relative-trigger + platform-core.notification-center (scheduled work needs OS_AUTOMATION_SCHEDULED_WORK_ENABLED=true on v18), attachments-storage.attach-requires-parent-edit (non-reader outsider now 404), approvals.approver-resolution-matrix (admin_rescue opens on org admins), records-forms.validation-rule-type-matrix (warnings[] in write answer), cli.scaffold-first-run (skills from @objectstack/skills), cli.hook-body-extraction-gates (22853), platform-core.packaged-object-extend-only (one-sentence sealed refusal), api-backend.date-range-preset-matrix (rolling presets end today), access-security.share-link-capability-tokens (combined gates), platform-core.shell-nav-personalization (drag reorder removed, unchecked)",
   "carrier: seat · readings verified, not touched: records-forms.concurrent-edit-conflict cites packages/rest/src/approvals-routes.ts#mapping for CONCURRENT_UPDATE -> 409 but that map has no CONCURRENT_UPDATE row (it lives in rest-server.ts); access-security record-shares source text says 'registered inline, under no registrar of its own' while packages/rest/src/sharing-routes.ts serves it under RestServer#registerSharingEndpoints",
   "carrier: 承接者:无 · observation: ADR-0131 C8 not landed — packages/drivers/driver-sql/src/sql-driver.ts applyTenantScope still carries .orWhereNull(field); ADR-0131 D14 puts its removal on the v18 line after C7, which has landed",
   "carrier: 承接者:无 · observation: POST /api/v1/keys drops unrecognised body keys without a word (camelCase expiresAt 400 days out -> 201 with the 90-day default, echoed in expires_at; safe direction, documented whitelist in packages/runtime/src/domains/keys.ts)",
   "carrier: 承接者:无 · observation: pins by registry id — 12 of 72 MAJOR_18_CONVERSIONS and 297 of 389 18.* semantic entries are named by no test (excluding the 169-id guidance roster); two retirements have no pin found (discard-overlay route 15204-s7pre, os meta resync 15204-s6b2a); changeset 22573 says reactions are not migrated while 23281 ships os migrate comment-reactions, and 22360 describes a sys_position door that 15204-7b retired — release-notes accuracy",
   "carrier: 承接者:无 · observation (dormant): packages/runtime/src/flow-start-admission.ts refusesElevatedSelfTriggeredStart returns false when the automation service has no getFlow, so a third-party IAutomationService without it would let any caller start a runAs system flow; in-tree engine implements getFlow"
   ]
   }

   ---

   Generated by Claude Code
5. objectstack-fleet commented on Oct 16, 2026

   

   objectstack-fleetbot

   on Oct 16, 2026

   ContributorAuthor

   More actions

   ACCEPT → PR #23901 comment 6215561472
6. os-zhuang

   closed this as completedin #23901on Oct 16, 2026
7. objectstack-fleet

   removed

   pm:dispatched

   on Oct 16, 2026