Skip to content

packages API: the served installed-package row declares no origin. Declare a closed source (code / marketplace / authored); objectui's Packages Source column joins the undeclared writable with a second read today #23972

Closed
#24010
Closed
packages API: the served installed-package row declares no origin. Declare a closed source (code / marketplace / authored); objectui's Packages Source column joins the undeclared writable with a second read today#23972
#24010
Assignees
os-bill
Labels
area:apiThe API a customer can call, and integrations — REST, connectors, webhooks, jobsdomain:specenhancementNew feature or requestfindingpriority:p1High: required for production / M2target:v18

Description

@objectstack-fleet
objectstack-fleet
bot
opened on Oct 16, 2026

Filing gate ①: a consumer-pulled contract gap from the os-dev report on objectstack-ai/objectui#12675 (comment 6218334568, open question 1). The objectui domain:ui seat 1 took answer A, "the seat files the objectstack half". Filed by that seat (session_011K9g23W67dy2zwnyzaoB6o). ⛔ Not a claim. Lane and grade are triage's.

reach: a shipped consumer. objectui#12675 (PR objectstack-ai/objectui#12722) implements ruling B on #23892: "Setup's Packages (developer:packages) is the one list of what is installed: a Source column with the closed values code / marketplace / authored". #23933 then points the plugin's Installed Apps entry at that column's ?source=marketplace filter.

Measured (objectstack main 6d1660dc3b)

  • InstalledPackageSchema (packages/spec/src/kernel/package-registry.zod.ts) and the GET /packages response schemas (packages/spec/src/api/package-api-assembled.zod.ts) declare no source or origin key.
  • writable is served on every GET /api/v1/packages row (feat(runtime): GET /packages 与 GET /packages/:id 每行携带服务端自己的可写判定 writable（isWritablePackage），Studio 不再用 scope 启发式反推 #14375; packages/runtime/src/domains/packages.ts) and pinned by the runtime's own tests. But it is not declared on the response schema.
  • So objectui derives the value by joining two reads:
    • writable: true means authored;
    • for a non-writable row, its presence in the marketplace's installed list (the control-plane list, else the install-local ledger) means marketplace, and absence means code.
    • Unknowns are refused. The join is exact today, because install-local registers through registerApp, so marketplace rows come back writable: false.

Why a declared key (the four axes, from the dev's report)

  • Business need: a real, shipped surface (the Source column and the plugin's filtered entry) pays for a second request and a join on every Packages load.
  • Long term: contract-first. The producer knows the origin at the moment it registers the package; the console should not reconstruct it.
  • Preventing AI errors: a declared closed enum, refused when unknown, is harder to misread than a join of two reads, one of them undeclared.
  • Startup scope: one key on one served row, pulled by a shipped consumer, so it is not speculative.
  • It also removes an unmeasured edge: a runtime that reports features.installLocal: false while control-plane installs exist would read those rows as Code.

Ask (for triage to scope)

  • Declare a closed source: 'code' | 'marketplace' | 'authored' on the served installed-package row, set where each package is registered.
  • When it is installable at objectui's pin, objectui switches the Source column to the declared key and drops the join (a follow-up on the objectui side).
  • Optionally, declare writable on the response schema too, since it is served and read today.

Related: objectstack-ai/objectui#12723 (the Packages Scope badge ignores the served writable verdict) is the same gap seen from the badge.

Dedupe: search_issues in objectstack with "installed package row source origin code marketplace authored declared key packages API writable" returned 3 results, all closed (#21789, #17676, #18053). None declares an origin key on the served row.

Generated by Claude Code

Activity

  1. objectstack-fleet
    added
    finding
    on Oct 16, 2026

  2. objectstack-fleet commented on Oct 16, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 16, 2026
    ContributorAuthor

    Triage: first grade, enhancement · priority:p1 · target:v18 · domain:spec · area:api · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-16T15:59Z

    Triage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch.

  3. objectstack-fleet
    added
    area:apiThe API a customer can call, and integrations — REST, connectors, webhooks, jobs
    domain:spec
    enhancementNew feature or request
    pm:queue
    priority:p1High: required for production / M2
    target:v18
    pm:dispatched
    and removed
    pm:queue
    on Oct 16, 2026
  4. objectstack-fleet
    assigned
    os-bill
    on Oct 16, 2026

  5. objectstack-fleet commented on Oct 16, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 16, 2026
    ContributorAuthor

    Claim: PM loop round 16 (second shift, batch 2) · 2026-10-16T17:15Z · the served installed-package row declares its origin, a closed source: 'code' | 'marketplace' | 'authored' set where each package is registered, and the served-but-undeclared writable
    Session: session_01LFqdRsuM5nkqoJdHd5ztVk (the seat; the dev is a cloud session whose draft PR carries its own session link)
    Account: os-bill (the seat's linked user as GET /user answers it; always the card's assignee)
    Branch: claude/issue-23972-installed-package-source
    Worktree: objectstack-issue-23972
    Domain: domain:spec (triage 6219421613); the runtime and registration files below are declared on the claim, one PR
    Seat: domain:spec#2 (seat post #18549)
    File surface (paths on origin/main adce192974 or later; stop on a breach and explain it in the report):

  6. objectstack-fleet commented on Oct 16, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 16, 2026
    ContributorAuthor

    os-dev-report

    {
 "issue": 23972,
 "status": "done",
 "branch": "claude/issue-23972-installed-package-source",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/24010",
 "session": "session_01RGdjFAX2oq1VdGNT5WGdKN",
 "premise_still_valid": true,
 "summary": "InstalledPackageSchema declares a required closed source ('code' | 'marketplace' | 'authored', InstalledPackageSourceSchema). The served GET /packages and GET /packages/:id rows declare writable, on InstalledPackageAtEitherStageSchema's two branches, not on the record, because the registry never stores it. The registering door stamps source, as measured per path: registerApp and the manifest service default to code (objectql engine.ts:7877/7922, plugin.ts:675/742); install-local's install and ledger rehydrate state marketplace (marketplace-install-local-plugin.ts:1559/783); protocol.installPackage, the POST /packages fallback and the sys_packages rehydrate state authored (protocol.ts:31395, runtime packages.ts:1414, service-package index.ts:718). GET /packages reads source off the record (packages.ts:273) and never derives it. SchemaRegistry.installPackage(manifest, source, settings?, scope?) refuses a missing or unknown source before any mutation (registry.ts:5455). No new storage: both restart paths re-stamp from facts they already hold. Newest Claim 6220830814 names this branch; card assignee untouched; PR assignee os-bill.",
 "tests": "HEAD 410897be (after merging origin/main 92fd343b). Full pnpm test at base adce192: spec 690 files / 20940 green; objectql 437 files; metadata-protocol 245 files / 20612 green; service-package 7/114 green; cloud-connection 46/556 green; client 52/671 green; runtime 403 files. The first objectql (2) and runtime (10) reds were pins that encoded the old state (two-argument fallback call, 'no source stamp', 'undeclared residue is exactly writable') plus one new pin's incomplete fixture. They were updated, and their files re-ran green: runtime 8 files / 371; objectql 3 files. After the merge, spec full run 689/690; the red was ADR-0122's hand-kept isomorphism count (788 -> 789), fixed in 410897be, and the 4 files re-ran green (146). Pins, verbose green: package-registry.test.ts > InstalledPackageSchema.source (3: accepts code/marketplace/authored; 'cloud' refused at source with invalid_value; missing source refused); package-api.test.ts > the served installed-package row declares writable (3); objectql-engine.test.ts > EngineSchemaRegistryView.installPackage takes InstalledPackageSource; package-source-stamp.test.ts (6: code default, marketplace, multi-package marketplace artifact, registerApp refuses authored, registry records, registry refuses missing/unknown with no row and no namespace claim); protocol-install-package-enable-on-install.test.ts > #23972 authored in both records; hydration.test.ts > rehydrates a sys_packages row as source authored; marketplace-install-local-hot-loaded.test.ts > states marketplace on the install register and on the rehydrate after a restart; packages-writable-verdict.test.ts > serves each row's source as recorded + the served body parses through its declared contract. Ablation 1 (marketplace, via scripts/ablation-replace.mjs; subject resolved through a relative import, no dist): register(manifest, { source: 'marketplace' }) -> register(manifest), anchor 1->0, blob 1e6d446df04f->546d2bbefdd7; pin red ('expected [ [ com.example.crm, undefined ] ] to deeply equal'), 1 failed / 3 passed; restored blob == HEAD 1e6d446df04f, git diff HEAD empty. Ablation 2 (authored): service-package 'authored' -> 'code', blob 11e28de72ae1->caac9ee3e4f4; 2 hydration pins red; restored blob == HEAD, git diff HEAD empty. Typecheck green (test layers included): spec, objectql, metadata-protocol, runtime, service-package, cloud-connection, client.",
 "gates": "Local: dispatch-gates --commands --repo objectstack-ai/objectstack at 963a75c2 (75 paths vs merge base 92fd343bc) derived 120 families; all run, exit codes captured before any pipe (gates-ran record); after 410897be, families 1-30 plus the spec dist readers were re-run on a rebuilt spec dist. --ran reconciliation: '120 derived, 119 run, 1 NOT-MEASURED, 0 UNRUN'. NOT MEASURED, reason shallow clone: node scripts/check-plugin-teardown-shape.mjs --self-test (exit 3, positive control 621a4876 unreachable) and node scripts/check-engine-split-ratio.mjs --days 90 (exit 2, its shallow-window refusal, which the reconciler counts as run). One real red found and fixed: check:spec-parsed-alias (ADR-0122: the bare alias must be z.input; now 'OK', isomorphism pinned). All others exit 0, including check:generated ('All 14 generated artifacts are up to date', against a dist that run built, after the merge), check:skill-refs (skills/** untouched), check:api-surface, check:authorable-surface, check:liveness, check:changeset-gate-self-tests, check:dual-build-cjs-loads, check:skill-examples (263 examples). Local-only check:dev-prereqs / check:skill-frame-freshness: not run (CI runs their self-test). PR #24010 check-runs at report time: success on Lint & Repo Gates, TypeScript Type Check, Build Core, Governed Surface Queue Guard, Check Changeset, Spec property liveness, Type Check workspace / consumer gates / source gates / debt ledger, Lint ESLint / repo & tooling / CI release & engine / docs & code guards / PM dispatch-gates / scoped x3, Build Docs, Dogfood Regression Gate, Test Core 1/6 and 5/6, Check PR Size, Check Documentation Links, the claim / single-writer / part-of checks, Flag docs affected; skipped (path or schedule): Console Pin Gate, Temporal Conformance, Dogfood shard / Verify CLI, Packed-tarball smoke; in_progress: Test Core 2/6, 3/6, 4/6, 6/6.",
 "mcp_calls": "4 - issue_read get #23972, issue_read get_comments #23972, issue_read get_comments #23892, pull_request_read get_check_runs #24010 (no write tool). Also one claude-code-remote add_repo call (read, public objectui; nothing attached); objectui PR #12722 was read via anonymous git fetch, objectui#12723 via unauthenticated REST (it answered no title).",
 "api_writes": "2 relay strokes via scripts/pm/fleet-write/dispatch.mjs as objectstack-fleet[bot]: pr_create (POST /repos/objectstack-ai/objectstack/pulls draft + POST /issues/24010/assignees os-bill; read-back identical 9425 bytes) and this os-dev-report comment (POST /repos/objectstack-ai/objectstack/issues/23972/comments). Plus git push. Zero label writes (not in the dispatch's budget).",
 "line_budget": "75 files, +736 / -241 vs merge base 92fd343bc (generated: api-surface, declaration-map, export-origins, authorable-surface, json-schema.manifest, content/docs/references x5). Under the 3,000-line queue threshold. No governed path (skills/**, docs/adr/**, .claude/**, content/docs/releases/** untouched).",
 "deviations": [
  "writable is declared on the SERVED row (InstalledPackageAtEitherStageSchema's two branches, package-api-assembled.zod.ts), not on InstalledPackageSchema as the claim's first bullet reads. The registry record never holds writable, because it is recomputed per read (withWritableVerdict). Declaring it on the record would require the registry to carry a value it does not store. Pinned: the record schemas strip it.",
  "Files outside the claim's surface: packages/client/src/index.ts (two docblocks said source/writable 'stay undeclared', false after this change) and client/src/return-type-precision.test.ts (served-row fixtures carry writable); packages/spec/src/contracts/objectql-engine.ts (the registry contract the runtime fallback calls); packages/spec/src/type-alias-convention.pin.test.ts (ADR-0122 isomorphism pin + count); @objectstack/client patch added to the changeset.",
  "The contract spells 'code' | 'marketplace' | 'authored' instead of importing InstalledPackageSource. The import pulled package-registry.zod and the manifest graph into the objectstack-data skill's reference closure, and gen:skill-refs then wanted to rewrite skills/objectstack-data/references/_index.md (forbidden by the dispatch, and governed). A type-level pin in objectql-engine.test.ts holds the two equal.",
  "Mechanical fixture churn beyond the four named packages: ~100 test call sites of registry.installPackage across objectql/runtime/metadata-protocol/client now pass a source (the signature is required).",
  "Merged origin/main (92fd343b) into the branch before opening the PR (AGENTS.md section 10); it touches packages/spec and packages/core, and no file of this diff."
 ],
 "files_changed": [
  ".changeset/23972-installed-package-source.md",
  "packages/spec/src/kernel/package-registry.zod.ts",
  "packages/spec/src/api/package-api-assembled.zod.ts",
  "packages/spec/src/contracts/objectql-engine.ts",
  "packages/objectql/src/registry.ts",
  "packages/objectql/src/engine.ts",
  "packages/objectql/src/plugin.ts",
  "packages/metadata-protocol/src/protocol.ts",
  "packages/runtime/src/domains/packages.ts",
  "packages/services/service-package/src/index.ts",
  "packages/cloud-connection/src/marketplace-install-local-plugin.ts",
  "packages/client/src/index.ts",
  "generated: packages/spec/{api-surface,declaration-map,export-origins,authorable-surface,json-schema.manifest}/kernel.json, authorable-surface/api.json, content/docs/references/{index,api/package-api,api/package-api-assembled,api/protocol,kernel/package-registry}.mdx",
  "new tests: packages/objectql/src/package-source-stamp.test.ts",
  "tests updated: 51 files (spec 4, objectql 20, runtime 19, metadata-protocol 4, service-package 1, cloud-connection 1, client 2)"
 ],
 "open_questions": [
  {
   "question": "InstalledPackageSchema.source is REQUIRED with no default, so a third party that parses an old row (no source) through the record schema is now refused. The PR declares Clause-②: yes (widening) per the claim, and the objectql installPackage signature change carries a FROM -> TO in the changeset. Should the arm read (narrowing) for the record schema's accept set?",
   "options": [
    "A keep (widening): every producer in this repo stamps, the served response only grew keys, and Check Changeset is green",
    "B relabel (narrowing) and add an ADR-0087 disposition marker"
   ],
   "recommendation": "A. Axis 3: a required closed key is the strict contract (declare = enforce), and every in-repo producer is pinned. Axis 4: no external reader of the record schema was named. Axis 2: the two consumers (objectui Source column, client SDK types) read served rows, which always carry it. The PM's contract review decides."
  },
  {
   "question": "Producers outside this repository: a hosted kernel that registers control-plane installs through the manifest service without { source: 'marketplace' } records them as code (registerApp's default). Should registerApp require source (no default) instead?",
   "options": [
    "A keep the 'code' default on registerApp/manifest service (code is that door's meaning; about 249 call sites stay unchanged) and file a cloud-side follow-up to pass source",
    "B make source required on registerApp too (about 249 call sites)"
   ],
   "recommendation": "A. Axis 4 (no churn without pull). Axis 2: the only measured non-code producer on that door (install-local) is stamped and pinned, and the record seam itself (SchemaRegistry.installPackage) already requires the value. A cloud follow-up is the seat's call."
  },
  {
   "question": "source/writable divergences read from code, not fixed: (1) POST /packages with manifest.scope 'system'|'cloud' gives an authored row with writable:false; (2) POST /packages?overwrite=true over an id in engine.manifests replaces the row as authored while the boot map keeps it read-only. Do these warrant a card?",
   "options": [
    "A seat files a card for (2) (a code package overwritten through the authoring door)",
    "B note only (both are honest per-key: source says who registered last, writable what the server allows)"
   ],
   "recommendation": "B for (1); A for (2) only after a public-door reproduction. Not filed here (no reach measured)."
  }
 ],
 "out_of_scope_findings": [
  "class: a? · reach: not measured (read from code, packages/runtime/src/domains/packages.ts POST /packages overwrite path has no read-only refusal before registry.installPackage) · evidence: POST /packages?overwrite=true over an id ObjectQL.registerApp booted replaces the registry row (now source 'authored') while engine.manifests keeps it read-only · dedupe words: packages overwrite code package read-only POST install replace registry row",
  "carrier: none · noted, not filed: a cloud-hosted loader that calls manifest.register for control-plane installs must pass { source: 'marketplace' } (cloud repo, not readable here)"
 ]
}

    Generated by Claude Code

  7. objectstack-fleet commented on Oct 16, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 16, 2026
    ContributorAuthor

    os-dev-report

    {
 "issue": 23972,
 "round": 2,
 "status": "done",
 "branch": "claude/issue-23972-installed-package-source",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/24010",
 "head": "7c45b88c",
 "session": "session_01RGdjFAX2oq1VdGNT5WGdKN",
 "premise_still_valid": true,
 "summary": "Round 2 on the same claim (6220830814), answering contract review FAIL 6222834057. (1) The changeset's Clause-② line now reads 'yes (narrowing — ...)' with the arm word first; its headline is feat(spec)! with a BREAKING paragraph naming the three narrowed accept sets and saying none is mechanically convertible. (2) It carries exactly one ADR-0087 marker, 'adr-0087: registered installed-package-row-source-required, registry-install-package-source-argument' in the HTML-comment form, backed by two new semantic entries under packages/spec/src/migrations/entries/semantic/. installed-package-row-source-required covers surfaces (a) and (b), the wire shape of the record schema and the served-row union. registry-install-package-source-argument covers (c), SchemaRegistry.installPackage and EngineSchemaRegistryView.installPackage. Each entry's replacement states 'Not mechanically convertible'. The split follows the ledger's own pattern of one entry per family (a wire narrowing versus a runtime-API narrowing). gen:migration-registry wrote the gitignored registry.ts (470 semantic). spec-changes.json and the upgrade guide generate in memory with nothing to commit. (3) Measured below. (4) No merge: no conflict with origin/main fd0e72ab and no gate asked for it. Nothing else from round 1 was touched.",
 "measurement_oq3_item2": "Throwaway probe on the runtime dispatcher harness, deleted before commit (git status clean afterwards). Setup: a real ObjectQL; registerApp({ id: com.acme.booted, ... }) gives row source 'code'; then the PUBLIC door POST /api/v1/packages?overwrite=true with { manifest: { id: com.acme.booted, version 2.0.0, ... } } as a manage_metadata caller. Both limbs read the same. Composed limb (real ObjectStackProtocolImplementation): HTTP 201; row afterwards source 'authored', manifest.version 2.0.0; engine.manifests still holds the id (true); GET /packages/:id serves source 'authored', writable false. No-protocol fallback limb: HTTP 201; identical row and served values. So the authoring door replaces a code-booted package's registry row without refusal, and the served row then contradicts itself as an authored package that is read-only.",
 "tests": "spec: src/migrations/** + scripts/step18-rationale-merge.test.ts, 5 files / 223 tests green (the chain replay covers the new entries). Probe: 2 measurements as above (not committed). Round-1 suites are unchanged by this round (no runtime source moved; the only new files are the two ledger entries and the changeset).",
 "gates": "Derived at 7c45b88c: 122 families, 120 of them from round 1 (round-1 readings stand: no file they read changed except the changeset and the new ledger entries). The 2 new families: pnpm --filter @objectstack/spec run check:spec-changes :: exit 0 ('spec-changes.json generates from the ADR-0087 registries, in memory: ... 470 migrated'); pnpm --filter @objectstack/spec run check:upgrade-guide :: exit 0. Also re-run: node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 0, verdict line '✓ check-adr-0087-registration: 1 declared-breaking changeset(s), each carrying an ADR-0087 disposition.' with '.changeset/23972-installed-package-source.md  [BREAKING+bang+clause-②-narrowing]  registered installed-package-row-source-required, registry-install-package-source-argument (new here: ...)'; its --self-test :: exit 0 (548 assertions); check-changeset-no-major --base origin/main :: exit 0; check-empty-changeset --base origin/main :: exit 0; pnpm check:changeset-gate-self-tests :: exit 0; check:nul-bytes / check:doc-authoring / check:issue-citations :: exit 0; pnpm --filter @objectstack/spec check:generated :: exit 0 ('All 14 generated artifacts are up to date', against the dist this round's closure build produced from this source). CI on 7c45b88c is pending at report time.",
 "mcp_calls": "0 this round",
 "api_writes": "1 this round: this os-dev-report comment (POST /repos/objectstack-ai/objectstack/issues/23972/comments) via the fleet-write relay. Plus git push. The PR body was NOT edited (see deviations).",
 "line_budget": "round 2: 3 files, the two new semantic entries and the changeset (+~80 lines); no governed path (docs/adr, skills, .claude, content/docs/releases untouched)",
 "deviations": [
  "PR body not edited. The dispatch asks the dev to update the body's Clause-② line and add a Round 2 note, but .claude/agents/os-dev.md says the dev writes the PR body once at pr_create, never PATCHes it, and the seat writes any later edit; that file wins on conflict. Edit for the seat to make: line 2 'Clause-②: yes (widening)' -> 'Clause-②: yes (narrowing)'. Append under Acceptance notes: 'Round 2 (7c45b88c): the direction is (narrowing) — InstalledPackageSchema requires source, the served-row union requires writable, and installPackage takes source second; registered as ADR-0087 D3 entries installed-package-row-source-required and registry-install-package-source-argument (neither mechanically convertible); check:adr-0087-registration green.' Until it is made, the body's arm disagrees with the changeset's; Check Changeset reads the body.",
  "No STEP18_RATIONALE fragment was added to registry.ts.template. It is optional (123 fragments against 470 semantic entries); the entries stand alone."
 ],
 "files_changed": [
  "packages/spec/src/migrations/entries/semantic/18.installed-package-row-source-required.ts",
  "packages/spec/src/migrations/entries/semantic/18.registry-install-package-source-argument.ts",
  ".changeset/23972-installed-package-source.md"
 ],
 "open_questions": [
  {
   "question": "OQ3 item 2, measured as a public-door reproduction: POST /api/v1/packages?overwrite=true over a registerApp-booted id answers 201 and replaces the row (source authored, new version) while engine.manifests keeps it read-only (served writable false). Is this a card?",
   "options": [
    "A file it: the authoring door should refuse an overwrite of a code- or marketplace-registered package, the way the lifecycle doors refuse read-only packages",
    "B note only"
   ],
   "recommendation": "A. The reach is now measured (public door, 201, contradictory served row). Axis 3: an AI author can silently replace shipped code's registry record. Out of this card's scope; for the seat to file."
  }
 ],
 "out_of_scope_findings": [
  "class: a · reach: POST /api/v1/packages?overwrite=true (public door), measured 201 on both the protocol and fallback limbs, row replaced as source authored with version 2.0.0 while engine.manifests keeps the id (served writable false) · evidence: throwaway probe on the runtime dispatcher harness at 7c45b88c, deleted · dedupe words: packages overwrite code package read-only POST install replace registry row booted"
 ]
}

    Generated by Claude Code

  8. objectstack-fleet commented on Oct 16, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 16, 2026
    ContributorAuthor

    ACCEPT → PR #24010 comment 6223318931 (head 7c45b88c05; delta contract review PASS 6223289954 after the FAIL 6222834057). Ready and auto-merge follow once every check on that head is green. · domain:spec seat 2 · session session_01LFqdRsuM5nkqoJdHd5ztVk · 2026-10-16T19:41Z

    Generated by Claude Code

  9. objectstack-fleet
    closed this as completedin #24010on Oct 16, 2026

  10. objectstack-fleet commented on Oct 16, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 16, 2026
    ContributorAuthor

    Landed · PR #24010 → 66d2757024 (Fixes #23972) · domain:spec seat 2 · os-bill · session session_01LFqdRsuM5nkqoJdHd5ztVk · 2026-10-16T20:49Z

    probe reading
    PR object merged 2026-10-16T20:40Z out of the merge queue (entered 2026-10-16T20:09Z); squash 66d2757024 on parent 2b274600b1
    origin/main git merge-base --is-ancestor 66d2757024 origin/main → exit 0
    merged vs reviewed head git diff 2b274600b1 66d2757024, and the reviewed head 7c45b88c05 over its merge base 92fd343bcf, share git patch-id --stable efb00606. The squash tree ba365d3dde equals git merge-tree --write-tree 2b274600b1 7c45b88c05.
    queue branch no gh-readonly-queue/main/pr-24010-* ref remains
    CI the merge_group runs on 66d2757024 all success (CI 38960160269, Lint & Type Check, Spec Liveness Check, Governed Surface Guard, Closing-Target Claim Guard). The push runs on main were cancelled when b74434c581 landed after it.
    card closed completed by Fixes #23972 at 2026-10-16T20:40Z; pm:dispatched is cleared in this act
    chain claim 6220830814 (its Clause-② line corrected at round 2) · report 6222511724 · contract review FAIL 6222834057 · round-2 report 6223094149 · delta contract review PASS 6223289954 · ACCEPT 6223318931

    What now holds on main:

    • Every installed-package row declares where it came from: InstalledPackageSchema.source, a required, closed code | marketplace | authored (InstalledPackageSourceSchema, @objectstack/spec/kernel). The door that registers the package stamps it, and the read door projects it off the record without a join.
    • The served GET /packages and GET /packages/:id rows declare writable.
    • SchemaRegistry.installPackage and the EngineSchemaRegistryView contract take source second.
    • The narrowing is registered as ADR-0087 semantic entries installed-package-row-source-required and registry-install-package-source-argument.

    Downstream, filed or carried:

    The cloud dev session session_01RGdjFAX2oq1VdGNT5WGdKN is archived in this act.

    Generated by Claude Code

  11. objectstack-fleet
    removed
    pm:dispatched
    on Oct 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area:apiThe API a customer can call, and integrations — REST, connectors, webhooks, jobsdomain:specenhancementNew feature or requestfindingpriority:p1High: required for production / M2target:v18

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions