Repository navigation
rest: every GET /api/v1/data/OBJECT still runs a full zod safeParse of the object's definition (the API-exposure gate's by-name read is decorated with diagnostics) — 11.8% of a HotCRM read's CPU #24535
Description
Filed by the repo:cloud#2 seat (seat post #24145, session session_01Cbdek8SKSHxddGqTPZXdqX) from objectstack-ai/cloud#3053 rounds 1–2 (dev reports 6266807911 and 6267763185). ⛔ Not a claim: the lane dispatches it.
Why it matters. Concurrent requests to one hosted tenant runtime serialize on per-request CPU in its single Node event loop:
- 8 distinct reads fired together take 5.4–8.9× one read;
- a dashboard's 35-call analytics wave takes about the sum of its members;
- inside a batch the
handlerleg grows from 10–17 ms to 100–450 ms, whiledbstays at about 2 ms.
This is measured on local hosted-shaped rigs at framework 584b4225 and fb9c22aa with HotCRM installed. It is the same at both pins, so it is not a regression; it is the steady cost that a near database exposes. The CPU profile is from --cpu-prof, with 1,400 analytics calls and 150 batches of 8 reads, every response 200. This card is one named slice of that CPU.
What was measured (framework fb9c22aa)
-
The call chain: the API-exposure gate
enforceApiAccess(packages/rest/src/rest-server.ts:2561-2600) reads the object throughp.getMetaItem(:2586).readMetaItem(packages/metadata-protocol/src/protocol.ts:11284) decorates it throughdecorateMetadataItem(:11537/:11760), thenmetadata-diagnostics.ts:154-156, thencomputeMetadataDiagnostics(:55, zodsafeParseat:97). -
What the gate uses: only
obj.enable. -
Cost:
- 1.84 ms of 15.60 ms CPU per HotCRM
top=1read (11.8%); - 3.2% on a bare fixture;
- 0.35 ms per analytics call.
It scales with the object's size, so real apps pay more.
- 1.84 ms of 15.60 ms CPU per HotCRM
-
Precedent: rest: every /data request's API-exposure gate reads EVERY object's metadata (with a full schema diagnostic) to check ONE object's enable flags — 62-72% of a data request's time, measured #24031 removed the list-wide form of this cost; the by-name form remains.
Target
The gate reads an undecorated item (no _diagnostics), or diagnostics are memoised per (type, name, version token). Redaction and diagnostics on SERVED metadata reads stay as they are.
Acceptance
- A test counts
computeMetadataDiagnosticscalls perGET /data/OBJECTand asserts 0. Ablation: it goes red when the gate reads the decorated item again. GET /meta/object/NAMEstill serves its diagnostics.
Activity
objectstack-fleet commentedon Oct 19, 2026
Read by
domain:cliseat 1 (seat post #6024) ·zhuangjianguo· sessionsession_01SYEJqDL3NXxrJRBVqaMu9T· 2026-10-19T13:40Z. ⛔ Not a claim, ⛔ no label change.domain:cliandpriority:p1were applied by the filing seat, not by triage. An execution seat claims a self-labelled card only when the body carries the filing gate's three answers (references/filing-gate.md: the category ①–④ as the first line, the reader who acts, and the dedupe query with its hit count, closed included). This body has the reader ("the lane dispatches it") and a named precedent (rest: every /data request's API-exposure gate reads EVERY object's metadata (with a full schema diagnostic) to check ONE object's enable flags — 62-72% of a data request's time, measured #24031), but not the category line or a dedupe query.packages/rest/src/rest-server.ts(about:2561–:2600) reads an undecorated item, since it uses onlyobj.enable. The second option, memoised diagnostics, would sit inpackages/metadata-protocol(domain:engine).domain:cli, this seat claims it at its next fire. The lane is serial by the maintainer's order, and nothing is in flight here now.Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
Triage (first touch): grade and lane confirmed · filing-gate answers supplied · triage seat ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-19T14:24ZTriage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch. This is the first triage touch. The filer applied the labels, and the body lacked the filing gate's three answers, so no execution seat could claim it under
execution-duties.md:11. This comment supplies them. The labels are confirmed as they stand.GET /api/v1/data/OBJECT), not a regression, and one named slice of objectstack-ai/cloud#3053 (p1).domain:cliseat. The fix is the target's first option:enforceApiAccess(packages/rest/src/rest-server.ts:2561, by-name read at:2586) reads an undecorated item, because it uses onlyobj.enable. The memoised-diagnostics option would be adomain:enginechange inpackages/metadata-protocol, and is not needed for this card./meta/diagnostics' untyped sweep stays environment-wide on a justification that PR #14767 may have retired #15691, Security posture: a metadata-store OUTAGE is reported as an absent declaration — getDiagnosed's verdict is computed and discarded #10424,_diagnostics.valid=trueandeditable/deletableare asserted for metadata rows no consumer reads — the envelope has no "in effect" axis #8169 and [P3] Read decorations (_diagnostics, _draft) round-trip into persisted sys_metadata bodies #4326 (closed, other aspects).target:v18: it does not gate the release.origin/mainba4afcc239: the cited lines hold (rest-server.ts:2561/:2586, andmetadata-diagnostics.ts:55computeMetadataDiagnostics). Thedomain:cliseat may claim at its next fire, per its note6268618232.Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
Direct dispatch to
domain:cliseat 1 (seat post #6024) ·zhuangjianguo· sessionsession_01SYEJqDL3NXxrJRBVqaMu9T· 2026-10-19T14:26Z. ⛔ Not yet a claim.references/cross-repo-coordination.md: it holds only for the card the maintainer named). It supersedes this seat's earlier note6268618232.origin/mainba4afcc23:enforceApiAccess(packages/rest/src/rest-server.ts:2561–:2600) reads the one object throughp.getMetaItem, and uses onlyobj.enable.readMetaItemdecorates every by-name read (packages/metadata-protocol/src/protocol.tsabout:11557/:11784,decorateMetadataItem→computeMetadataDiagnostics). The list read already has the split this card needs:getMetaItemsForExecution/readFlattenedMetaItems(…, 'execution')(about:9978–:10667), which rest: every /data request's API-exposure gate reads EVERY object's metadata (with a full schema diagnostic) to check ONE object's enable flags — 62-72% of a data request's time, measured #24031 relied on. The by-name read has no execution twin.protocol.ts, the by-name twin ofgetMetaItemsForExecution, with the same sources, overlays and governance and no serving decoration. The gate inrest-server.tscalls it when the protocol has it. Redaction and diagnostics on served reads stay as they are.protocol.tsisdomain:engine's, and it is declared on [PM seat] domain:engine — 🟢 os-project-manager #6367 at the claim.Fixes #10757,domain:engineseat 1, past its contract review) rewritesreadMetaItem's item-read overlay cache inprotocol.ts(hunks about:11141–:11436). By this seat's hard-serial rule, the merge releases the file. Dispatch follows Authenticated data requests issue ~20 DB queries in ~17 sequential legs — per-request auth/session/localization/metadata resolution has no cross-request caching, costing ~1.5s/request on remote Postgres #10757's close.Blocked-by: Authenticated data requests issue ~20 DB queries in ~17 sequential legs — per-request auth/session/localization/metadata resolution has no cross-request caching, costing ~1.5s/request on remote Postgres #10757
In the stroke after this comment,
pm:queuebecomespm:blocked. The unlock scan returns the card when #10757 closes, and this seat claims and dispatches it at that point; the lane runs serially, and nothing else is in flight.Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
Unlocked: #10757 closed (PR #24533 merged as
5a871e4e4) ·domain:cliseat 1 (seat post #6024) ·zhuangjianguo· sessionsession_01SYEJqDL3NXxrJRBVqaMu9T· 2026-10-19T15:23ZThe premise, re-measured on the merged ref
origin/main5a871e4e4: it still holds.metadata-protocol's overlay cache. What it caches is the item's activesys_metadatarows (packages/metadata-protocol/src/protocol.tsabout:11326, "the served face reads the item's active rows through the overlay cache").:11815,decorateMetadataItem(…)→computeMetadataDiagnostics, and about:11588on the draft path.enforceApiAccess's by-name read still pays a full diagnosticssafeParseperGET /api/v1/data/OBJECT. The cache removed the row query, not the decoration.The planned shape is unchanged (record
6269601173): an item-level execution read inprotocol.ts, the by-name twin ofgetMetaItemsForExecution, with the same sources, overlay cache and governance and no serving decoration. The gate calls it.State:
pm:blockedbecomespm:queuein the stroke after this comment. The maintainer directed this card to this seat (「24535 你可以处理」), and the lane is serial: it is claimed and dispatched as soon as the dev in flight (#24546) has landed.Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
Held again, same-file serial ·
domain:cliseat 1 (seat post #6024) ·zhuangjianguo· sessionsession_01SYEJqDL3NXxrJRBVqaMu9T· 2026-10-19T17:08Zvariableswhen the body also carriesinputs#24546's landing (PR fix(runtime)!: refuse a flow resume body that carries bothinputsandvariables#24594,c3954057f), and a pre-dispatch scan of the open PRs' file lists found PR fix(spec,metadata-protocol)!: the /meta door no longer authors sharing rules; Setup lists declared sharing rules #24599 (Closes #24550,domain:spec, past its contract review) editingpackages/metadata-protocol/src/protocol.ts.:68, about:8837–:8970and:17660–:17740onorigin/mainc3954057f) do not meetreadMetaItem(:11330–:11920) orgetMetaItemsForExecution(:9978). But this seat's rule is hard serial by FILE, released by the merge, not by function. So rest: every GET /api/v1/data/OBJECT still runs a full zod safeParse of the object's definition (the API-exposure gate's by-name read is decorated with diagnostics) — 11.8% of a HotCRM read's CPU #24535 waits for it.6270815614(premise),6269601173(shape). Decoration still runs at:11588/:11815on every by-name read.Blocked-by: fix(plugin-sharing): regime C follow-ups from objectui#12982 — close PUT /meta/sharing_rule as a third authoring door; a Setup nav entry for declared rules #24550
pm:queuebecomespm:blockedin the stroke after this comment. This seat watches PR #24599 and claims and dispatches #24535 when it merges (the lane is serial, and nothing else is in flight).Generated by Claude Code
2 remaining items
objectstack-fleet commentedon Oct 19, 2026
Claim: PM loop round 6 ·
domain:cliseat 1 · p1 · maintainer-directed · 2026-10-19T21:01ZSession:
session_01SYEJqDL3NXxrJRBVqaMu9TAccount:
zhuangjianguo(the seat's linked user asGET /useranswers it; always the card's assignee)Branch:
claude/issue-24535-gate-execution-readWorktree:
objectstack-issue-24535Domain:
domain:cliSeat:
domain:cli#1(seat post #6024)Ruling-ref: the maintainer's order, verbatim, in this session's chat: 「24535 你可以处理」 (direct dispatch, record
6269601173). The premise was re-measured on1e8b6284c(unlock record6275752050) and holds onorigin/mainf89d29e38.File surface (read on
origin/mainf89d29e38; line numbers move; stop on a breach and explain it in the report):packages/metadata-protocol/src/protocol.ts(domain:engine, declared on [PM seat] domain:engine — 🟢 os-project-manager #6367 in this act): a by-name execution read, the twin ofgetMetaItemsForExecution(:10044). It has the same sources, overlay cache, merges and governance asreadMetaItem(:11396), and no serving decoration (decorateMetadataItemat:11654/:11881). The served read is unchanged: redaction and_diagnosticsstay.packages/rest/src/rest-server.tsenforceApiAccess(:2561; it reads at:2586) calls it when the protocol has it, and keeps today's read otherwise. Also the rest-side protocol type that declares it, whereverRestProtocollives inpackages/rest.packages/rest: a count ofcomputeMetadataDiagnosticscalls perGET /api/v1/data/OBJECTequals 0, with an ablation in which the gate reads the decorated item again.GET /meta/object/NAMEstill carries_diagnostics.packages/metadata-protocol: the execution read answers the same item as the served read, minus decoration, overlay and draft cases included.@objectstack/metadata-protocoland@objectstack/rest.packages/spec/**(no request-schema flag;GetMetaItemRequestis spec's); memoising diagnostics (the card's second option,metadata-diagnostics.ts); any served read's body or status.Container & model:
M(two packages, a new protocol read),mode:subagent,model: default tier(dispatch-gates.mjs --tier: "no path-derived mandate")Clause-②: yes
Basis for the Clause-② line: the new method on
metadata-protocol's exported protocol class widens its published.d.tssurface. The dev measures the export list before and after, and the line follows that measurement. No accept set, response body or status changes. The review owed for aClause-②: yesdeclaration is the lane seat's own at the default tier.Responsibility: this lane's gate pays the cost (
packages/rest/src/rest-server.ts), anddomain:engine's read decorates (protocol.ts). No platform path covers it. EveryGET /api/v1/data/OBJECTreaches it; measured byrepo:cloud#2(the card body: 1.84 ms of 15.60 ms CPU per HotCRM read).Thread-read: 6275752050
Serial constraints cleared:
protocol.ts,rest-server.ts,meta-item-read-gate.tsormetadata-diagnostics.ts.pm:dispatchedclaim namesprotocol.ts: A list view bound to an object outside the writing package's dependency closure skips the field-reference check: unknowncolumnsfields are accepted (200 active, draft → publish) where the same body is refused 422list-view-field-unknown#24563 (domain:spec, PR fix(lint)!: the save door refuses a list view written into a package and bound outside its closure #24630), which excludes it ("⛔ noprotocol.tschange") and edits onlyprotocol.runtime-authoring-gate.test.ts.Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
Reply from
domain:engineseat 1 (seat post #6367) ·os-project-manager·session_01JtSQQ3EWsbNPzyYMug1tXy· 2026-10-19T21:07Z, to the declaration 6277246927 on this lane's seat post. ⛔ Not a claim, no label change.No objection to the region. None of this seat's in-flight cards (#24341, #24318, #24619) touches
protocol.ts, and PR #24533's regions have no holder since its merge.One condition, on the surface:
ObjectStackProtocolImplementationis exported from@objectstack/metadata-protocol's entry (src/index.ts:3,exportsis"."). A new public method on it, the by-name twin ofgetMetaItemsForExecution, therefore widens the published surface. By the clause-② predicate ("does this card widen the public surface?") that isClause-②: yes, with its review, not apatchwithClause-②: no.getMetaItemsForExecution's docblock carries the rule "⛔ Never call this from a door that answers a caller". A by-name twin makes that rule easier to break, from any package that imports the class.This lane's practice (PR #24518, PR #24526, PR #24627) is to keep such a seam off the exported class's public members. Either shape below meets this condition:
enable, or the seam is keyed on a symbol the class does not expose as a method;Clause-②: yes, with the review that clause owes. Its docblock carries the same "never from a door" rule.If the PR opens with a new public method under
Clause-②: no, this note is an objection, and it holds the queue until one of the two shapes is taken.Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
os-dev-report
{
"issue": 24535,
"status": "done",
"branch": "claude/issue-24535-gate-execution-read",
"pr": "#24666",
"session": "session_01SYEJqDL3NXxrJRBVqaMu9T — the dispatching seat's session (subagent run); every commit carries it in its Claude-Session trailer",
"premise_still_valid": true,
"summary": "Premise re-measured on origin/main f89d29e, and it holds. enforceApiAccess (rest-server.ts:2561) read the object through p.getMetaItem (:2586) and used only obj.enable. readMetaItem (protocol.ts:11396) decorated its exits (:11654 and :11881) through decorateMetadataItem, which calls computeMetadataDiagnostics. In protocol.ts, getMetaItem and the new getMetaItemForExecution each fold the type at their own boundary, as getMetaItems and getMetaItemsForExecution do. Both then call one private body, readMetaItemFace, which holds getMetaItem's old body: the disabled-package refusal, readMetaItem(request, { face }), and the withholding. readMetaItem's option servedRead becomes face. Either face reads the active rows through the one overlay-cache entry (key { type, name }); authoring callers pass no face, so they read the store, decorated, as before. The faces differ only at the exits. serveItem is decorateMetadataItem on the served face and the identity on the execution face, at the draft-preview, strict-draft and active exits. A view's reference diagnostics and registration are served-only, following the list execution face's precedent. In rest-server.ts, RestProtocol gains the optional member getMetaItemForExecution?. enforceApiAccess uses that face when the protocol has it, else getMetaItem, else the list. meta-item-read-gate.ts changes in two doc comments only; loadObjectItem's contract is unchanged. Changesets: metadata-protocol minor and rest minor, not patch (see deviations).",
"tests": "All at head 8f2b833, exit codes captured before any pipe. (1) pnpm --filter @objectstack/metadata-protocol test: 250 files passed, 3 skipped; 20780 tests passed, 19 skipped; exit 0. (2) pnpm --filter @objectstack/rest test (local project): 301 files; 6107 passed, 326 skipped; exit 0. (3) pnpm --filter @objectstack/rest test:repo: 5 files; 278 passed, 18 skipped; exit 0. (4) Typecheck of both packages, exit 0; rest's typecheck includes check:test-typecheck with 0 errors. (5) New packages/metadata-protocol/src/protocol.item-execution-read.test.ts, 9 tests. Parity: decorateMetadataItem(type, execution.item) toEqual served.item; the envelope is equal apart from registration; every row asserts the served item is decorated. Cases: a code item; an overlay item through ONE cache entry for both faces (served fills, execution hits, 1 store read; a write retires the entry for both); a datasource, where only execution carries the password; strict draft; preview with and without a draft; NO_DRAFT and OBJECT_PACKAGE_DISABLED on both faces; a missing name; registration on the served face only. (6) New packages/rest/src/rest-exposure-gate-execution-read.test.ts, 12 tests. Instrument: the object schema is swapped through registerMetadataTypeSchema for a recording proxy over the same schema, so every computeMetadataDiagnostics safeParse records the parsed name. GET /api/v1/data/OBJECT through the real route records 0 diagnostics for a code object and a stored object, unscoped and environment-scoped; a refused request (405) also records 0. Fallback control: a protocol without the execution face is asked getMetaItem, gives the same answers and records exactly [name]. Control: GET /api/v1/meta/object/NAME still serves _diagnostics and records it. (7) Ablation, one-off, via scripts/ablation-replace.mjs on committed head 32d829f: replaced
const byName = typeof p.getMetaItemForExecution === 'function'withconst byName = false, so the gate read getMetaItem again (anchor 1 to 0, blob 1aa8eeb5a2b2 to 68a515a0f7c2). Result: 6 failed, 6 passed. The six zero rows went red (expected [ 'code_widget' ] to deeply equal []; expected [ 'stored_widget' ] to deeply equal []); the fallback and control rows stayed green. Restored: blob == HEAD and git diff HEAD empty. No build was needed: rest tests import rest-server.ts by relative path, and metadata-protocol's dist was rebuilt before every rest run. (8) One-off proof that the served body is byte-identical: the previous build (dist at f89d29e) against this head's build. 4 hosts x 3 served entry points (getMetaItem, getMetaItemCached, authoring readMetaItem) x 20 requests x 2 passes = 480 JSON answers, 0 mismatches. Normalised: a deterministic keyed digest, because each module instance keys version tokens under its own random key, and a frozen clock for lastModified. Control: old served against new execution differs on 16 of 20, exactly the decorated answers. (9) Three pins in the #24031 file now name the execution face. The read-verb fold population pin (protocol.read-verb-canonical-fold.test.ts) was red at a691f19 because the derived population lacked the new verb; b163268 folds at each face and registers the seventeenth verb. (10) Cost, built dist, warm cache, shared box: served against execution median per read was 390.9 vs 41.5 us at 10 fields (0.106), 1028.9 vs 32.2 us at 60 fields (0.031), and 2723.7 vs 63.1 us at 200 fields (0.023).","gates": "Local subset at head 8f2b833. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 78 commands from merge base f89d29e, covering 10 paths; each ran with its exit code captured before any pipe, and all 78 exited 0. --ran gave 'Run reconciliation — 78 derived, 78 run, 0 NOT-MEASURED, 0 UNRUN', and its verdict exit code was 0. An earlier battery at a691f19 (69 commands) had two non-zero exits. check:engine-double-contract exited 1: the pinned ledger lacked the two new test files' findOne doubles, so --write added exactly those 2 rows in 8f2b833, and the gate is now green. check:dual-build-cjs-loads exited 3 (PREREQUISITE NOT MET, read as NOT MEASURED); it measured and passed at the final head. Also: eslint --no-inline-config over the 7 changed .ts files, exit 0; pnpm lint (full union), exit 0. check-changeset-no-major --event with the PR body: LEVEL AXIS clean. On a throwaway committed probe that grades both packages patch, it exits 1 naming both lines. node scripts/check-platform-checklist.mjs was not run, because no exported symbol was renamed or deleted. CI check-runs on 8f2b833 at report time: completed success — No other open PR may claim the same issue, Check PR Size, The card this PR closes must claim this branch, No other open PR may claim the same single-writer path, Part-of PR must not also close its card, Check Documentation Links, Auto Label, filter, Dogfood Regression Gate. Skipped — Packed-tarball smoke (opt-in), Dogfood Regression Gate shards, Console Pin Gate, Dogfood Verify CLI, Temporal Conformance, Build Docs. in_progress — Check Changeset, Lint & Repo Gates jobs (ESLint, PM dispatch-gates, CI release & engine gates, repo & tooling gates, docs & code guards, the scoped lanes), the Type Check lanes, Test Core 1-6/6, Build Core, Governed Surface Queue Guard, Flag docs affected by code changes. Not polled further, per contract.",
"mcp_calls": "0 — no MCP GitHub tool was called; reads were single-card REST reads (gh api issues/24535, the named comments, the pull and its check-runs)",
"api_writes": "2 seat-side REST writes, both POST /repos/objectstack-ai/objectstack/dispatches (fleet-write relay strokes), executing 3 writes as objectstack-fleet[bot]: POST /repos/objectstack-ai/objectstack/pulls (draft PR 24666), POST /repos//issues/24666/assignees (zhuangjianguo), POST /repos//issues/24535/comments (this os-dev-report). The relay's read-back for the PR found 12625 bytes sent and stored, identical. git pushes of the branch are not REST writes. No labels were written: the dispatch named none, and skip-changeset does not apply.",
"open_questions": [],
"deviations": [
"Changeset level. The dispatch said patch for both packages. AGENTS.md (Post-Task Checklist step 3) says a Clause-②: yes takes at least minor, and AGENTS.md wins. Measured: check-changeset-no-major.mjs --event with this PR body exits 1, naming both lines, on a committed probe that grades both packages patch, and is clean with minor. Both published surfaces widen, so both are graded minor. The first attempt at this probe was a no-op and is void: the mutation was uncommitted, and the gate diffs HEAD. It was redone on a committed probe in a throwaway detached worktree, since removed.",
"File surface. Beyond the claim's named files, the PR touches packages/metadata-protocol/src/protocol.read-verb-canonical-fold.test.ts (an existing pin whose derived verb population had to register the new verb) and scripts/engine-double-contract.pinned.json (2 rows that check:engine-double-contract prescribed for the two new test files' pinned doubles). It also touches packages/rest/src/meta-item-read-gate.ts, in doc comments only, which the PR body says. No hold-off was crossed: packages/spec/**, metadata-diagnostics.ts and the served read's body, status and headers are untouched.",
"Attribution. Commits end with the model-free trailer pair AGENTS.md requires, and the PR body ends with the session-URL footer AGENTS.md prescribes. These follow AGENTS.md rather than the harness's model-named trailer and footer text.",
"No pre-PR merge of origin/main. Per the dispatch and os-dev.md, merges happen only for the listed reasons. origin/main moved 2 commits, neither touching either package, and a local merge-tree of HEAD with origin/main is clean."
],
"out_of_scope_findings": [
"carrier: 承接者:无 · noted in the PR's Acceptance notes, not filed · other in-process consumers of the served by-name read act on a definition rather than serve it: the seed loader's getObject adapter (protocol.ts applySeedBodies) and the post-publish build probes' getItem (runBuildProbes). They run per publish, not per request, so they are zero-pull for this card's cost and are left on the served face."
]
}
Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
ACCEPT → PR #24666 comment
6278511021·domain:cliseat 1 · sessionsession_01SYEJqDL3NXxrJRBVqaMu9T· 2026-10-19T22:12Z · on head8f2b83379. A by-name execution read shares every source, the overlay cache and governance withgetMetaItemand skips only the serving decorations. The exposure gate uses it, andGET /datarecords 0 diagnosticssafeParse; the ablation reds the 6 zero rows. Served reads are byte-identical (480 answers).Clause-②: yes (widening), minor, reviewed here at the default tier. Landing waits on every check of this head.Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
REWORK (patch round 1) → PR #24666 comment
6278921779·domain:cliseat 1 · sessionsession_01SYEJqDL3NXxrJRBVqaMu9T· 2026-10-19T22:39ZTest Core (6/6)on head8f2b83379:packages/runtime/src/domains/data-write-request-gate.test.ts, 12 exposure rows answer 400 instead of 405/404. The rig stubsgetMetaItemon a real protocol, and the gate now reads the unstubbedgetMetaItemForExecution.packages/runtime, declared here beyond the claim's surface.6278511021. Landing waits for an all-green head.Generated by Claude Code
objectstack-fleet commentedon Oct 19, 2026
os-dev-report
{
"issue": 24535,
"status": "done",
"round": "patch round 1 (REWORK record: PR 24666 comment 6278921779)",
"branch": "claude/issue-24535-gate-execution-read",
"pr": "#24666",
"head": "a132ad0cf",
"session": "session_01SYEJqDL3NXxrJRBVqaMu9T — the dispatching seat's session (subagent run); every commit carries it in its Claude-Session trailer",
"premise_still_valid": true,
"summary": "Test Core (6/6) was red on 8f2b833, and the cause was the one the REWORK names. packages/runtime/src/domains/data-write-request-gate.test.ts gives RestServer a real ObjectStackProtocolImplementation with no metadata store. Its rig (bootRestServer) answered only getMetaItem from the registry. The exposure gate now prefers getMetaItemForExecution, so it read the unstubbed face, failed open, and the body gate answered first: every locked and hidden row returned 400 VALIDATION_FAILED. The fix is a test-only rider in packages/runtime, which the REWORK declared: the rig installs its one registry-backed by-name stub on both faces, getMetaItem and getMetaItemForExecution, and the rig note names both. The protocol.ts and rest-server.ts change is untouched. origin/main was merged first (e47f72d, a merge commit, clean). On head a132ad0 every CI check is green, Test Core (6/6) included. The census found no other test that holds a real protocol instance with getMetaItem overridden and drives a /data door through RestServer, apart from this PR's two exposure-gate files, which were already on the execution face. The production census agrees with the seat for this repository; objectstack-ai/cloud was not measured.",
"census": {
"method": "Tests that construct a real ObjectStackProtocolImplementation and override getMetaItem in any spelling (assignment, bracket assignment, spyOn, an object-literal key, a subclass, defineProperty): 18 files. The gate is reached only from RestServer's /data/:object doors (crud-routes, batch-routes, data-action-routes, and rest-server.ts:2770 import). A file reaches it only if a real instance with an overridden getMetaItem is mounted in RestServer and a /data door is driven. Second sweep: 98 test files override getMetaItem and name the REST layer. Except the files below, they hand RestServer an object-literal protocol. A literal has no execution face, so the gate still asks its override, and behaviour is unchanged.",
"reaches_the_gate": [
"packages/runtime/src/domains/data-write-request-gate.test.ts — FIXED this round: the stub is on both faces. Reverse check: with the stub on getMetaItem alone, 12 of 73 fail, reproducing the CI red; with both faces, 73 of 73 pass.",
"packages/rest/src/rest-exposure-gate-one-object-read.test.ts — already on the execution face since round 0: it spies on the execution face and the throwing read is the execution face, and withoutByName removes both faces.",
"packages/rest/src/rest-exposure-gate-execution-read.test.ts — this PR's counting test; withoutExecutionFace is its deliberate fallback row."
],
"does_not_reach_the_gate": [
"packages/rest/src/rest-5xx-message-sanitization.test.ts — the overrides are on the object-literal protocol from setup(); the real protocol (bootRealProtocol) is mounted with no override and is driven on a /meta door.",
"packages/rest/src/rest-server-canonical-query-ast.test.ts — the override is on an object literal (mountedRoutes); the real protocol only has findData called on it directly and is never mounted in RestServer.",
"packages/rest/src/rest-server-meta-member-selector.test.ts — RestServer over a delegating literal; it drives /meta doors only, with 0 /data paths.",
"packages/runtime/src/domains/meta-item-query-decision.test.ts — a literal double, plus a spy on a real protocol; it drives /meta doors only, with 0 /data paths.",
"packages/runtime/src/http-dispatcher.test.ts — constructs no RestServer. It drives HttpDispatcher, whose /data exposure gate reads the metadata service's getObject. Its getMetaItem overrides are on literals.",
"packages/runtime/src/domains/packages-seed-apply-org-scope.test.ts — wraps real.getMetaItem in a literal for the dispatcher's packages domain (seed apply); constructs no RestServer.",
"packages/runtime/src/domains/packages-seed-apply-read-decorations.test.ts — the same shape; constructs no RestServer.",
"packages/runtime/src/domains/packages-publish-drafts-response-conformance.test.ts — the dispatcher's packages domain over a literal; constructs no RestServer.",
"packages/metadata-protocol/src/protocol.batch-verb-driver-text.test.ts — constructs no RestServer; metadata-protocol does not depend on rest.",
"packages/metadata-protocol/src/protocol.lock-one-resolution.kit.test.ts — constructs no RestServer.",
"packages/objectql/src/build-probes.test.ts — constructs no RestServer.",
"packages/objectql/src/protocol-meta-effective-schema.test.ts — constructs no RestServer.",
"packages/objectql/src/protocol-publish-package-drafts.test.ts — constructs no RestServer.",
"packages/plugins/plugin-security/src/security-catalog-echo.test.ts — constructs no RestServer.",
"packages/spec/src/api/protocol.test.ts — getMetaItem appears only in comments; constructs no RestServer."
],
"production": "Confirmed for this repository at a132ad0. No production code reassigns getMetaItem on a protocol instance (in any spelling), and nothing subclasses ObjectStackProtocolImplementation outside tests. RestApiPlugin hands RestServer the kernel's protocol service as registered, unwrapped (rest-api-plugin.ts:161). The one production object that carries a getMetaItem key, in plugin-auth auth-plugin.ts:3324, is a deps bag for the user-import runner and never reaches RestServer. The local objectui and hotcrm checkouts have none either. NOT MEASURED: objectstack-ai/cloud, which has no checkout in this container. A cloud host that subclasses the protocol or reassigns getMetaItem, and mounts it in RestServer, would now have the gate read the execution face instead."
},
"tests": "All at head a132ad0, exit codes captured before any pipe, under the verify lock. packages/runtime: typecheck, which includes its test layer, exit 0. test (unit tier, local project): 425 files passed; 6678 tests passed, 19 skipped; exit 0. test:repo: 3 files; 808 passed; exit 0. packages/metadata-protocol: typecheck exit 0; test: 250 files passed, 3 skipped; 20790 tests passed, 19 skipped; exit 0. packages/rest: typecheck exit 0; test: 301 files; 6107 passed, 326 skipped; exit 0. test:repo: 5 files; 278 passed, 18 skipped; exit 0. The census touches no other package. Reverse check of the rig fix, via scripts/ablation-replace.mjs on the committed head: narrowing the face list to getMetaItem alone gave 12 failed and 61 passed of 73, reproducing CI's assertions (400 VALIDATION_FAILED where 404 or 405 is expected). It was restored with blob == HEAD and git diff HEAD empty. The round-0 parity, counting, ablation and differential results stand; the protocol and rest source is unchanged this round.",
"gates": "Local at head a132ad0. dispatch-gates --commands --repo objectstack-ai/objectstack derived 78 commands from merge base eadea57, covering 11 paths. 77 exited 0 on the first pass. pnpm check:dual-build-cjs-loads exited 3 (PREREQUISITE NOT MET: some packages had no dist in the fresh worktree); after the battery had built them it was re-run, measured, and exited 0, and the ran list records that measured run. --ran gave 'Run reconciliation — 78 derived, 78 run, 0 NOT-MEASURED, 0 UNRUN', and its verdict exit code was 0. eslint --no-inline-config over the changed files exited 0, and pnpm lint (the full union) exited 0. CI on a132ad0: all 40 check runs are completed. These succeeded: Lint & Repo Gates and its jobs, TypeScript Type Check and its lanes, Test Core 1-6/6 and the Test Core rollup, Build Core, Check Changeset, Governed Surface Queue Guard, Dogfood Regression Gate, Check PR Size, Check Documentation Links, Flag docs affected by code changes, Auto Label, filter, the claim and single-writer guards, and Part-of PR must not also close its card. These were skipped: Packed-tarball smoke (opt-in), the push-only Dogfood shards, Dogfood Verify CLI, Console Pin Gate, Temporal Conformance and Build Docs.",
"mcp_calls": "0 — no MCP GitHub tool was called; reads were REST: the REWORK comment, the pull, and its check-runs",
"api_writes": "1 seat-side REST write this round: POST /repos/objectstack-ai/objectstack/dispatches (a fleet-write relay stroke), executing POST /repos//issues/24535/comments (this os-dev-report) as objectstack-fleet[bot]. There were git pushes of the merge commit and the rig fix, which are not REST writes. The PR body was not patched; corrections are in body_edits.",
"body_edits": [
{
"op": "insert_before",
"anchor": "---\n_Generated by Claude Code_",
"text": "## Patch round 1 (head
a132ad0cf)\n\n- Red on8f2b83379: Test Core (6/6).packages/runtime/src/domains/data-write-request-gate.test.tsfailed 12 tests: everylockedandhiddenrow answered400 VALIDATION_FAILED. Its rig givesRestServera realObjectStackProtocolImplementationwith no metadata store, and it answered onlygetMetaItemfrom the registry. The exposure gate now readsgetMetaItemForExecution, which the rig left unstubbed, so the gate failed open and the body gate answered first.\n- Fix: a test-only rider inpackages/runtime, declared in the seat's REWORK. The rig installs its one registry-backed by-name stub on both faces, and its note names both. Reverse check: with the stub ongetMetaItemalone, the file fails 12 of 73, which reproduces the CI red; with both faces stubbed, 73 of 73 pass.\n- Test census: 18 test files build a real protocol and overridegetMetaItem. Three of them reachRestServer's exposure gate on a real instance: this rig (fixed) and this PR's two exposure-gate files (already on the execution face). The other 15 never mount that instance inRestServerbehind a/datadoor. Beyond those, 98 test files overridegetMetaItemand name the REST layer; the rest of them handRestServeran object-literal protocol, which has no execution face, so the gate still asks their override.\n- Production census: nothing in this repository reassignsgetMetaItemon a protocol instance or subclassesObjectStackProtocolImplementation, andRestApiPluginhandsRestServerthe kernel'sprotocolservice unwrapped.objectstack-ai/cloudis not measured here.\n- Mergedorigin/main:e47f72d38, a merge commit, clean.\n- Verification ata132ad0cf:\n -@objectstack/runtime: typecheck exit 0.test: 425 files; 6678 passed, 19 skipped.test:repo: 3 files; 808 passed.\n -@objectstack/metadata-protocol: typecheck exit 0.test: 250 files passed, 3 skipped; 20790 tests passed, 19 skipped.\n -@objectstack/rest: typecheck exit 0.test: 301 files; 6107 passed, 326 skipped.test:repo: 5 files; 278 passed, 18 skipped.\n - Lint: eslint over the changed files andpnpm lint, exit 0.\n - Derived gates: 78 of 78 exit 0;--ranreports 0 NOT-MEASURED and 0 UNRUN.\n - CI ona132ad0cf: every check green, including Test Core (6/6).\n\n"},
{
"op": "replace",
"old": "## Verification at head
8f2b83379","new": "## Verification at head
8f2b83379(round 0; see Patch round 1 for the current head)"}
],
"open_questions": [],
"deviations": [
"check:dual-build-cjs-loads is recorded with its measured re-run (exit 0), not its first run (exit 3, PREREQUISITE NOT MET: no dist in the fresh worktree). The first run measured nothing, and --ran flags one command recorded with two codes.",
"Round 0 deviations stand: changesets graded minor, not patch, as AGENTS.md requires and as measured against the level axis; and the file-surface additions (the fold pin and the engine-double ledger rows). This round adds one test-only rider in packages/runtime, which the REWORK declared."
],
"out_of_scope_findings": [
"carrier: 承接者:无 · noted in the PR's Acceptance notes in round 0, not filed · the seed loader's getObject adapter and the post-publish build probes' getItem read the served by-name face to act on definitions. They run per publish, not per request, so they are zero-pull for this card's cost."
]
}
Generated by Claude Code
objectstack-fleet commentedon Oct 20, 2026
ACCEPT (patch round 1) → PR #24666 comment
6280040416·domain:cliseat 1 · sessionsession_01SYEJqDL3NXxrJRBVqaMu9T· 2026-10-20T00:01Z · heada132ad0cf. The rig now stubs both by-name faces, and every check on the head is green. Landing goes through the queue.Generated by Claude Code
objectstack-fleet commentedon Oct 20, 2026
Landed: PR #24666 →
6464df346·domain:cliseat 1 ·zhuangjianguo· sessionsession_01SYEJqDL3NXxrJRBVqaMu9T· 2026-10-20T00:33Zmerged: true, merge commit6464df346, merged 2026-10-20T00:33Z through the merge queueorigin/main6464df346is an ancestor oforigin/main, with a single parent (squash). The 11 files and +668 / −37 match what was reviewed ata132ad0cfgh-readonly-queue/main/*pr-24666*head remains6277236465→ report6278478154→ ACCEPT6278511021→Test Core (6/6)red (a rig stubbing one by-name face) → REWORK6278921779→ report6279996027→ the seat's body edits → ACCEPT6280040416→ ready and auto-merge.ObjectStackProtocolImplementationgainsgetMetaItemForExecution, the by-name twin ofgetMetaItemsForExecution. It has the same sources, overlay cache and governance asgetMetaItem, with no serving decoration.RestServer's API-exposure gate reads that face, soGET /api/v1/data/OBJECTno longer runs a diagnosticssafeParseof the object's definition per request.minoron@objectstack/metadata-protocoland@objectstack/rest(Clause-②: yes, widening).getObjectand the post-publish build probes still read the served face. They run per publish, not per request.objectstack-ai/cloudwas not measured for a host that wrapsgetMetaItembefore mountingRestServer.completedon the merge.pm:dispatchedis removed in the stroke after this comment.Generated by Claude Code