release: the console injection assertion is still vacuous at an .objectstack-sha pin whose objectui install IS this tree — its describe probe skips every literal it could witness, and passes the control bundle

Filing gate ②: a measured finding. It comes from os-dev-report 6277654282 on #15194 (the F1 re-test at pin 12dc7b47) and os-dev-report 6278269372 on #24644, out_of_scope_findings 2. It is a residual of #24510, closed: "the console injection assertion has a real witness on a .objectstack-sha pin, instead of passing vacuously".

Reader who acts: the epic seat (epic:#15194, session_01Y5583bs2RDd53MH6kM1ca3).
Dedupe: semantic search for "console spec injection assertion vacuous describeCandidates no observable skew freshWitness null". It found only fix(release): the console injection assertion has a real witness on a .objectstack-sha pin, instead of passing vacuously #24510 and check:console-injection silently drops its only tree-sensitive assertion when packages/spec is unbuilt — and nothing requires the spec blob #10428, both closed.

Measured (PR #24660's build, pin `12dc7b47`, objectui's own `.objectstack-sha` `f4755a68a797`)

pnpm objectui:build prints "no observable skew, so nothing for this check to assert". The stamp records freshWitness: null.
node scripts/assert-console-spec-injection.mjs, run against objectui's own f4755a68a797 reference on the control bundle, exits 0. So the in-build assertion would pass a console that was not injected.
Cause: describeCandidates (scripts/console-spec-probes.mjs:100-107) drops every describe literal shorter than 32 or longer than 160 characters, and every literal with an escape. At this pin, every literal that tells the two specs apart falls outside that filter.
The difference is measurable. The dev's 4 independent witness strings read injected 1/1/1 with stale 0, and control 0/0/0 with stale 1.
check:console-injection --require-stamp still refuses the control bundle (exit 1), so the release path is covered today, by that gate alone.

Wanted

Widen describeCandidates, or add a second candidate source (unescaped substrings of the long literals, or the schema .describe keys themselves), so that at a pin like this one the stamp carries a non-null freshWitness and the assertion exits 1 on the control bundle.
Pin this with a fixture shaped like this pin: every distinguishing literal over 160 characters or escaped. Reverse-verify it.
Change no release workflow. This is the assertion and its probes only.

Claim: epic seat round · 2026-10-19T22:01Z
Session: session_01Y5583bs2RDd53MH6kM1ca3
Account: os-steve (the card's assignee)
Branch: claude/issue-24663-injection-witness
Worktree: the cloud session's own checkout (mode:cloud)
Domain: domain:devx
Seat: epic:#15194 (the epic lane)
File surface, read on origin/main at or after f89d29e38. The dev measures first; a breach stops the work and is explained in the report.

scripts/console-spec-probes.mjs (describeCandidates and its candidate sources), scripts/assert-console-spec-injection.mjs, and their tests and fixtures.
⛔ No release workflow, no .github/workflows/**, no .objectui-sha move.
Container & model: S, mode:cloud, model: TIER_DEFAULT
Clause-②: no. Release tooling only.
Responsibility: n/a. A residual of fix(release): the console injection assertion has a real witness on a .objectstack-sha pin, instead of passing vacuously #24510, measured on os-dev-reports 6277654282 and 6278269372.
Serial constraints cleared: PR chore(console): move the objectui pin 4016370af3c9 → 12dc7b47c340, regime C for sharing rules (objectui#13050) #24660 (the pin move) does not touch these scripts.

os-dev-report
Posted 2026-10-19 · developer session session_019oG4xEYrGxr5n2cdSNbWMK, an os-dev dispatched by the epic PM seat epic:#15194 (session_01Y5583bs2RDd53MH6kM1ca3), working on the claim 6278354881, branch claude/issue-24663-injection-witness.

{
 "issue": 24663,
 "status": "pr_open_draft",
 "branch": "claude/issue-24663-injection-witness",
 "pr": 24672,
 "head": "50f12801",
 "session": "session_019oG4xEYrGxr5n2cdSNbWMK",
 "claim_verified": "the newest Claim: is 6278354881, and it names this branch",
 "summary": "describeCandidates gains a second candidate source. A describe literal the old rule skipped (over 160 characters, or carrying an escape) is cut at every escape sequence and every quote character, and each run of 32 characters or more is a candidate. Literals the old rule accepted are still taken whole. Self-test battery 16 (16 cases) is a fixture shaped like the 12dc7b47 pin, and it is reverse-verified. On a real build at pin 12dc7b47c340 the stamp carries a non-null freshWitness, and the assertion exits 1 on the control bundle.",
 "files": ["scripts/console-spec-probes.mjs", "scripts/check-console-injection.mjs (battery 16, roster floor 13 to 14, imports uniqueCandidates)"],
 "untouched": "no release workflow, nothing under .github/workflows/**, no .objectui-sha move",
 "reverse_verification": "The fix was committed first. With the literalSegments call replaced by a comment, the self-test exited 1 with 8 failures, including the control bundle 'expected 1, got 0' and the stamp witness 'got null'. Restored with git restore --source=HEAD: the porcelain was clean and the self-test exited 0 with 100 assertions.",
 "real_build": {
  "tree": "PR #24660 has not landed, so the build ran in a throwaway worktree: this branch merged locally with #24660's head 0b45222fef. .objectui-sha was 12dc7b47c340, and objectui's .objectstack-sha was f4755a68a797. Nothing from that merge is pushed.",
  "command": "turbo run build --filter=@objectstack/client... --concurrency=2 && bash scripts/build-console.sh (what pnpm objectui:build runs); exit 0; dist 65512 KB",
  "assertion_in_build": "Console bundle carries THIS tree's @objectstack/spec, and only it (vendored: objectui's own build of objectstack f4755a68a797). 3 of 3 injected-only runs are present, and all 2 pin-only runs are absent.",
  "stamp": {"skew": true, "vendoredPin": "f4755a68a797...", "freshWitness": "' system flows keep system privileges; after an approval decision their attribution user is the decider; user = the human whose act is running this segment: the trigger user until a human decision, the decider after it (RLS-respecting; the nodes after an approval decision run with the decider'", "staleDetector": "' not yet rendered] The PARENT record this related list hangs off, bound by a query of its own: an object binding '"},
  "check_console_injection_require_stamp_injected": 0,
  "control_bundle": "objectui's own build of the pin in the same build tree, with OBJECTSTACK_ROOT unset; objectstack-pin.mjs status reported 'built at the pin f4755a68a797'; no stamp",
  "assertion_on_control": {"main_probes": "exit 0, 'no observable skew' (the defect, reproduced)", "this_branch": "exit 1, 'still carries the @objectstack/spec of objectui's own build of objectstack f4755a68a797'"},
  "injected_stamp_replayed_over_control": "check-console-injection.mjs --dist CONTROL --require-stamp, exit 1",
  "grep_lF_assets": "full witness: injected 1, control 0. Full detector: injected 0, control 1."
 },
 "gates": "check-governed-merges --branch: NOT governed, 134 lines. dispatch-gates --commands derived 35, and all 35 exited 0; --ran reported '35 run, 0 NOT-MEASURED'. eslint on both files exited 0. The self-test exited 0 with 100 assertions.",
 "changeset": "none, with label skip-changeset: repo tooling only, as with PR #24532. The PR body says Clause-②: no.",
 "not_measured": ["The Console Pin Gate on CI: it does not run on a PR or in the queue.", "the 15 pending-changeset families (no changeset)"],
 "follow_up": "Merge main into the branch once #24660 lands. Re-run the self-test; the proof above is already at the pin #24660 sets.",
 "api_writes": "2, both through the fleet relay: pr_create #24672 (with assignee and labels), and this comment.",
 "out_of_scope_findings": ["Noted, not filed: the cache-hit replay labels its stale line 'absent (published only)' even when the stamp's reference is a pin build. This is cosmetic, and the PR does not change it."],
 "open_questions": []
}

Generated by Claude Code

Landed and closed · epic PM session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-19T23:14Z. PR #24672 merged as eadea5720.

The fix. describeCandidates now also takes the plain runs (32 characters or more, cut at escapes and quotes) inside describe literals the old rule skipped. The literals it took before are still taken whole.
The effect. At a self-install .objectstack-sha pin like 12dc7b47, the build stamp carries a real freshWitness, and the assertion refuses the control bundle. Before, it exited 0 there.
Proof. Self-test battery 16, reverse-verified: 8 cases go red without the new source. On a real build at 12dc7b47: 3/3 injected-only probes present, 2/2 pin-only probes absent, and the control exits 1 (os-dev-report 6278854813).
Review. Seat review on the PR, in-seat TIER_DEFAULT, ACCEPT. Not governed.

The card closes completed. The dev session is archived.

Navigation Menu

Repository navigation

release: the console injection assertion is still vacuous at an .objectstack-sha pin whose objectui install IS this tree — its describe probe skips every literal it could witness, and passes the control bundle #24663

Measured (PR #24660's build, pin `12dc7b47`, objectui's own `.objectstack-sha` `f4755a68a797`)

Wanted

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

release: the console injection assertion is still vacuous at an .objectstack-sha pin whose objectui install IS this tree — its describe probe skips every literal it could witness, and passes the control bundle #24663

Description

Measured (PR #24660's build, pin 12dc7b47, objectui's own .objectstack-sha f4755a68a797)

Wanted

Activity

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Measured (PR #24660's build, pin `12dc7b47`, objectui's own `.objectstack-sha` `f4755a68a797`)