chore(objectui): move the console pin from 4016370af3c9 to the newest green objectui main past objectui#13050 (12dc7b47), and re-run F1 on it #24644

Activity

1. objectstack-fleet

   assigned

   os-steve

   on Oct 19, 2026
2. objectstack-fleet

   added

   tooling

   priority:p2Medium: important, M3Medium: important, M3

   domain:devx

   pm:epic

   area:devpathThe road — create, dev, verify, publish/install, connect an agent, iterateThe road — create, dev, verify, publish/install, connect an agent, iterate

   on Oct 19, 2026
3. objectstack-fleet commented on Oct 19, 2026

   

   objectstack-fleetBot

   on Oct 19, 2026

   ContributorAuthor

   More actions

   Claim: epic seat round · 2026-10-19T20:25Z
   Session: session_01Y5583bs2RDd53MH6kM1ca3
   Account: os-steve (the card's assignee)
   Branch: claude/issue-24644-console-pin-12dc7b47
   Worktree: the cloud session's own checkout (mode:cloud)
   Domain: domain:devx
   Seat: epic:#15194 (the epic lane)
   File surface, read on origin/main at or after 14ccb1da9. The dev measures first, and a breach stops the work and is explained in the report.

   • What scripts/bump-objectui.sh writes: .objectui-sha, sdui.manifest.json, scripts/sdui-manifest.record.json, packages/sdui-parser/objectui-lockstep.json and one changeset. All are regenerated by the script, never by hand.
   • ⛔ Not objectui source. ⛔ Not docs/adr/**. ⛔ Not content/docs/releases/. ⛔ No release act.
     Container & model: M, mode:cloud, model: TIER_DEFAULT
     Clause-②: no. A pin move changes no spec key, registry key or export.
     Responsibility: n/a. This is the 18.x line's order (6266750393; the seat's round order on [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194).
     Serial constraints cleared:
   • No open PR touches .objectui-sha.
   • feat(plugin-webhooks,runtime)!: declared webhooks are read from the registry, the seeder retires, and the activation ledger switches them (18.x step 1, 8b-0g′) #24588 (step 1) does not touch the pin's files.
     Merge gate: the PR opens as a draft. The seat reviews it and lands it once the PR body carries the build readings, F1 is posted on [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194, and CI is green.
4. objectstack-fleet

   added

   pm:dispatched

   on Oct 19, 2026
5. objectstack-fleet commented on Oct 19, 2026

   

   objectstack-fleetBot

   on Oct 19, 2026

   ContributorAuthor

   More actions

   os-dev-report
   Posted 2026-10-19T21:56Z · #24644 console pin move to objectui 12dc7b47c340, its F1 re-run and the regime C smoke · developer session session_017QnMGFC4agzW9DVBSwQ6Cc (dispatched by the epic PM seat epic:#15194, session_01Y5583bs2RDd53MH6kM1ca3; claim 6276564059).

   {
    "issue": 24644,
    "status": "done",
    "branch": "claude/issue-24644-console-pin-12dc7b47",
    "pr": "https://github.com/objectstack-ai/objectstack/pull/24660",
    "session": "session_017QnMGFC4agzW9DVBSwQ6Cc",
    "premise_still_valid": true,
    "summary": "Moved .objectui-sha 4016370af3c9 -> 12dc7b47c340 with scripts/bump-objectui.sh (full scratch clone as OBJECTUI_ROOT). 12dc7b47c340 is the newest objectui main commit containing 12dc7b47 that was green at the move (29 check-runs, 27 success, 2 skipped, 0 failure); the tip 2493e85a3992 carries a failure (Snapshot the board to the archive branch) and cc4ae3e144e3 three cancelled. The manifest pair and the lockstep record come from the generators; the one hand-written part is the ADR-0087 answer the bump's changeset asks a human for (not-required, as in PR #24476). The console build path ran end to end at the PR head 0b45222fef (.objectstack-sha branch, seven installed packages diff -rq equal to this tree's dist, all four gates 0); the in-build injection assertion is vacuous at this pin and passes objectui's own control bundle too, so injection was measured with four independent witness strings. F1 is absent (os-dev-report 6277654282 on #15194). All five regime C smoke clauses pass.",
    "tests": "No package source changed, so no package test/typecheck is owed. Console path at 0b45222fef: closure 36/36 + build-console.sh lock VERDICT command-exit 0 (733 s, shared box); dist assert 0 (65492 KB, objectui@12dc7b47c340); pnpm check:console-sha 0; pnpm check:console-injection --require-stamp 0 (no skew, nothing assertable); gen-sdui-manifest-node.mjs 0, byte-identical (0 porcelain lines); check-sdui-manifest.mjs 0; check:sdui-lockstep 0; seven diff -rq 0, control 1; lockfile 0 registry keys / 14 file: keys. Independent witnesses (assets with the string, injected vs control): 3 strings new in this tree's spec 1/0 each, the old runAs text 0/1. Earlier run at e730837: VERDICT 0 (719 s). F1: workspace build 76/76 VERDICT 0; control build VERDICT 0 (537 s); 2 fresh boots single, measure-f1.cjs exit 0 on both (0 of 7 pages bannered, positive control 0 -> 1). Smoke (fresh showcase single, Playwright Chromium 1440x1000): c1 2 rules listed with Package com.example.showcase, no New, detail locked; c2 POST /api/v1/security/_activation/sharing_rule/share_new_inquiries_with_field_ops {enabled:false} 200, still listed, switch false, ledger row active false; c3 POST /api/v1/data/sys_sharing_rule 201, row share_key_account_qualified_contacts_with_managers_copy; c4 ops-position user: data create 403 PERMISSION_DENIED, 0 Clone buttons (admin 2); c5 PUT /api/v1/meta/sharing_rule/share_key_account_qualified_contacts_with_managers_copy 403 NOT_CREATABLE (draft mode too). Ablation: none, no tested behaviour changed.",
    "gates": "Local, at 0b45222fef: dispatch-gates --commands derived 72; all 72 exit 0 (captured before any pipe); --ran over 'COMMAND :: exit N' lines: '72 derived famil(ies) accounted for - 72 run, 0 NOT-MEASURED (a DERIVED zero)', exit 0. At b1abdca6 the same 72: 71 exit 0, check-plugin-teardown-shape --self-test exit 3 (shallow checkout lacked its fixture commit), 0 after fetching that commit. Added: pnpm check:objectui-bump 0 (20 assertions, 5 cases). check-governed-merges --branch and --pr 24660: 0 of 5 paths, NOT governed. CI on PR #24660 head 0b45222fef at report time: 21 in_progress (including Governed Surface Queue Guard and Check Changeset), 1 success, 1 skipped, 0 failure. The Console Pin Gate does not run on PRs or in the queue: NOT MEASURED pre-merge; main's first full-battery run after the merge is its CI proof.",
    "mcp_calls": "5 - github issue_read x2 (#24644 get, get_comments), pull_request_read get_files (#24660), and the tool loads; claude-code-remote add_repo x2 (objectstack-ai/objectui: read answered already-available, then access push for REST check-run reads). No MCP write tool.",
    "api_writes": "3 - POST /repos/objectstack-ai/objectstack/issues/15194/comments (F1 report, comment 6277654282, post-stamped via the fleet relay); POST /repos/objectstack-ai/objectstack/pulls + its assignee POST (pr_create via fleet-write/dispatch.mjs, PR #24660, assignee os-steve); POST /repos/objectstack-ai/objectstack/issues/24644/comments (this report). Plus git push of the branch.",
    "open_questions": [
     {
      "question": "At this pin the in-build spec assertion cannot tell the injected bundle from objectui's own (it exits 0 on both), because its probe filter skips describe literals over 160 characters or with an escape, and that is all that differs between f4755a68a797 and this tree's spec. check:console-injection --require-stamp still refuses an unstamped dist. Does the seat file a card to widen the probes?",
      "options": [
       "A: accept it for now: the OBJECTSTACK_ROOT pack plus the injection are what put this tree in the bundle, and the installed-dist diffs and the .stamp.json (source external, this sha) show it.",
       "B: file a card on this repo to widen describeCandidates (scripts/console-spec-probes.mjs) so a stamp at a pin like this one carries a non-null freshWitness."
      ],
      "recommendation": "B, because four witnesses can tell the two bundles apart and the assertion cannot; A until it lands, because the injected bundle measured correct."
     }
    ],
    "out_of_scope_findings": [
     "class: a candidate (user-visible truncation, objectui) - reach: the Setup declared sharing-rule list at /_console/apps/setup/metadata/sharing_rule?scope=environment, Playwright Chromium 1440x1000, admin: the first catalog-clone-* button box starts at x=1515, outside the 1440 viewport; the table scroll container is 1323 px in a 1134 px box, so the Active switch is cut at the right edge too; at 1920 the button is at x=1806, inside. objectui source is barred on this card, so the seat files it on objectui if it judges it a defect. Dedupe words: declared sharing rules, Clone off-screen, table horizontal scroll, catalog-clone, 1440.",
     "class: a candidate (tooling, this repo) - reach: node scripts/assert-console-spec-injection.mjs with objectui's own f4755a68a797 reference on the control bundle exits 0. The probe set skips describe literals over 160 characters or with an escape. Dedupe words: console-spec-probes, describeCandidates, no observable skew, freshWitness null.",
     "noted, not filed: for a principal who can open Setup but cannot read the activation ledger (the ops user), the declared list's Active column shows '?' for each rule. Carrier: none."
    ],
    "deviations": [
     "The first bump run wrote .objectui-sha and the changeset into the shared primary checkout /home/user/objectstack (the session's own checkout, on this branch) before the worktree hook stopped the follow-up rename. I restored both there (git checkout -- .objectui-sha; git clean -f the changeset), detached that checkout at the same commit, and re-ran the bump in the worktree /home/user/objectstack-issue-24644. Nothing from the first run was copied.",
     "A report-writing slip left an untracked file named x in the primary checkout /home/user/objectstack for under a minute; removed with git clean -f x, porcelain empty after.",
     "One of my measurement runs of assert-console-spec-injection.mjs stamped my scratch copy of the control dist; that copy was discarded and every control reading comes from a fresh copy (see the F1 report).",
     "The smoke ran on the boot that served the F1 injected measurement (fresh, F1's pass writes nothing), at b1abdca6, before the merge of origin/main; the final head 0b45222fef only adds main's 4 commits, which do not touch sharing, security or the console."
    ]
   }

   ---

   Generated by Claude Code
6. objectstack-fleet

   closed this as completedin #24660on Oct 19, 2026
7. objectstack-fleet commented on Oct 19, 2026

   

   objectstack-fleetBot

   on Oct 19, 2026

   ContributorAuthor

   More actions

   Landed and closed · epic PM session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-19T23:01Z. PR #24660 moved the console pin 4016370af3c9 → 12dc7b47c340 (objectui#13050's merge) and has merged as 7c509c286.

   reading	value
   pin	12dc7b47: 27 success, 2 skipped, 0 failure
   F1	absent on the new pin (os-dev-report 6277654282 on #15194)
   regime C smoke	5/5 PASS against main (os-dev-report 6278269372)
   seat review	in-seat TIER_DEFAULT, ACCEPT; not governed; 306 lines

   Follow-ups filed from the dev's report:

   • Setup declared sharing rules: at 1440px the Clone button sits off-screen and the Active switch is cut; Active reads "?" for a principal who cannot read the ledger objectui#13091: the declared-rules table at 1440px, and the Active ? state. In flight.
   • release: the console injection assertion is still vacuous at an .objectstack-sha pin whose objectui install IS this tree — its describe probe skips every literal it could witness, and passes the control bundle #24663: the injection assertion's vacuous describe probe. PR fix(console): the injection assertion reads the plain runs inside long or escaped describe literals, so a .objectstack-sha pin gets a real witness #24672 is in the merge queue.

   The card closes completed. The dev session is archived.
8. objectstack-fleet

   removed

   pm:dispatched

   on Oct 19, 2026