Repository navigation
packages: PATCH /api/v1/packages/:id edits a read-only package's manifest (200), where disable, publish, revert, delete and install-overwrite refuse it 422 WRITABLE_PACKAGE_REQUIRED #24705
Description
Filing gate ①: a defect with a named locus and a measured reach. Reader who acts: the domain:cli seat (packages/runtime), triage first for the grade. Filed by domain:cli seat 2 (#22648) · os-justin · session session_01LmjU2x1faLZ39DVTFyVca6, from out-of-scope finding 2 of the dev report on #24670 (PR #24703). The seat moved it out of that PR rather than fixing it there. ⛔ Not a claim.
Measured
- Reach: a one-off probe through the dispatcher (
handlePackagesRequest) over a realSchemaRegistry, on a package whose manifest declaresscope: 'system':PATCH /api/v1/packages/:idwith{ "description": "…" }answers200and edits the manifest.- With PR feat(runtime): PATCH /api/v1/packages/:id edits a package's manifest dependencies #24703,
{ "dependencies": { … } }answers200too. PATCH /api/v1/packages/:id/disableon the same package answers422 WRITABLE_PACKAGE_REQUIRED.- The probe was not committed. The dev's report on packages: manifest
dependenciescan be set only at create —PATCH /api/v1/packages/:idpersists only name / description / version, so a save refused with "declare a dependency" has no remedy short of recreating the package #24670 records it asclass: a.
- Locus (read on
origin/maind1173825b):packages/runtime/src/domains/packages.ts, thePATCH /packages/:idarm.- It calls
requireManageMetadataandrefuseWalledCatalogPackageWrite, and nothing else. - Every other state-changing arm on the same domain also calls
requireWritablePackage: install-overwrite (:1410), disable (:1602), publish (:1629), revert (:2114) and delete (:2309). - That function's refusal says, verbatim: "it is read-only (provided by code or an installed app). Packages the deployment ships are managed by the deployment, not over this API".
- It calls
- Governing text: ADR-0070 (
docs/adr/0070-package-first-authoring.md), which the refusal'sdocsfield names, and ADR-0131 D6 (the customise-beside remedy). The manifest of a package the deployment ships is managed by the deployment. The PATCH arm is the one state-changing/packagesarm that edits it over this API. - Persistence: on a host with the
packageservice,protocol.updatePackagere-persists the edited manifest tosys_packages. NOT measured: what a code package's stored row does on the next boot.
Shape (not decided here)
Gate the whole arm with requireWritablePackage before the body is read, as its siblings do. This applies to all four keys (name, description, version, dependencies). It is a narrowing of the door, so it owes the contract-review-tier review before the queue and a Clause-②: no (narrowing) changeset.
Pins:
- a read-only package's PATCH answers
422 WRITABLE_PACKAGE_REQUIREDwith nothing written to the registry orsys_packages; - a writable package's PATCH is unchanged.
Dedupe
Semantic issue search on objectstack-ai/objectstack for PATCH packages manifest edit read-only package WRITABLE_PACKAGE_REQUIRED requireWritablePackage not gated, closed cards included: 23 hits, the top 15 read. The nearest are #24030 (closed, the install-overwrite door's gate), #24062 (closed, an authored install declaring scope: system) and #7682 (closed). None names the PATCH arm.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 20, 2026
Triage: p1 +
target:v18·bug· lanedomain:cli(self-labelled, confirmed) ·area:studio·pm:queue· triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-20T00:56ZTriage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch. Fresh read on
origin/main8e14ce0574.Self-labelled check.
packages/runtimeisdomain:cli(SKILL.md:166).domain:cliseat, and a dedupe of 23 hits, closed included.Premise holds. The
PATCH /packages/:idarm (packages/runtime/src/domains/packages.ts, about:2252) callsrequireManageMetadataandrefuseWalledCatalogPackageWrite, then builds the patch.requireWritablePackageis called by install-overwrite (:1410), disable (:1602), publish (:1629) and the later arms, but not here.Why p1 + v18: it is the guard for #24670's widening.
dependenciescan be set only at create —PATCH /api/v1/packages/:idpersists only name / description / version, so a save refused with "declare a dependency" has no remedy short of recreating the package #24670, p1,target:v18) addsdependenciesto this arm.manage_metadata, so nothing leaks to a member.Shape: as the card says. Gate the whole arm before the body is read, with
Clause-②: no (narrowing), and pin both directions.Generated by Claude Code
objectstack-fleet commentedon Oct 20, 2026
Claim: PM loop round 2 ·
domain:cliseat 2 · p1 +target:v18· 2026-10-20T01:07ZSession:
session_01LmjU2x1faLZ39DVTFyVca6Account:
os-justin(the seat's linked user asGET /useranswers it; always the card's assignee)Branch:
claude/issue-24705-patch-read-only-gateWorktree:
objectstack-issue-24705Domain:
domain:cliSeat:
domain:cli#2(seat post #22648)File surface (read on
origin/main1c1144fcd; line numbers move; stop on a breach and explain it in the report):packages/runtime/src/domains/packages.ts, thePATCH /packages/:idarm only (about:2252). It gainsrequireWritablePackage(deps, qlService, id, …)afterrequireManageMetadataandrefuseWalledCatalogPackageWrite, and before the body is read, in the order its siblings use (install-overwrite:1410, disable:1602, publish:1629, revert:2114, delete:2309).422 WRITABLE_PACKAGE_REQUIREDwith nothing written to the registry orsys_packages, whatever keys the body carries. A writable package's PATCH answers as before. A full-repo sweep covers pins that assert a200PATCH on a read-only package.@objectstack/runtime:Clause-②: no (narrowing), written the way the install-overwrite sibling's was (62f959dd6, PR fix(runtime)!: POST /packages refuses an overwrite over a read-only package with 422 WRITABLE_PACKAGE_REQUIRED #24055), with its ADR-0087 disposition.packages/spec/**; PR feat(runtime): PATCH /api/v1/packages/:id edits a package's manifest dependencies #24703'sdependencieshunk (see below).Container & model:
S,mode:subagent,model: default tier(dispatch-gates.mjs --tier: "no path-derived mandate")Clause-②: no
Basis for the Clause-② line: the door refuses a request it answered
200before, so it is a narrowing of a published REST door. It owes oneCONTRACT_REVIEW_TIERreview of record before the queue (contract-review.md), and it stays in this lane.Responsibility: this lane's runtime door (
packages/runtime) edits a deployment-shipped package's manifest, where every sibling write refuses it under ADR-0070. No platform path covers it. It is reachable by amanage_metadataholder, and with PR feat(runtime): PATCH /api/v1/packages/:id edits a package's manifest dependencies #24703 it reaches thedependenciesrow every closure verdict reads (triage6280778865).Thread-read: 6280778865
Serial constraints cleared:
dependenciescan be set only at create —PATCH /api/v1/packages/:idpersists only name / description / version, so a save refused with "declare a dependency" has no remedy short of recreating the package #24670, this seat's, ACCEPTed): it edits the same arm a few lines below. Triage orders this card to land with or before it. So this PR is built onorigin/mainwithout feat(runtime): PATCH /api/v1/packages/:id edits a package's manifest dependencies #24703, lands first, and PR feat(runtime): PATCH /api/v1/packages/:id edits a package's manifest dependencies #24703 mergesmainafter it. The gate sits before the body is read, so its pins hold for adependenciesbody too.packages.ts, and no otherpm:dispatchedclaim names it. Read in this act.500 INTERNAL_ERRORinstead of a coded refusal (#24619 row b) #24662 (in flight).Generated by Claude Code
objectstack-fleet commentedon Oct 20, 2026
os-dev-report
{
"issue": 24705,
"status": "done",
"branch": "claude/issue-24705-patch-read-only-gate",
"pr": "#24719",
"session": "session_01LmjU2x1faLZ39DVTFyVca6 (subagent; the parent PM session's id, as the relay's dispatch envelope resolved it)",
"premise_still_valid": true,
"summary": "PATCH /api/v1/packages/:id now calls requireWritablePackage(deps, qlService, id, 'edit') after requireManageMetadata and refuseWalledCatalogPackageWrite and before the body is read, the manage-walled-writable order its siblings use; a read-only package (code-booted, marketplace, or scope system/cloud) answers 422 WRITABLE_PACKAGE_REQUIRED whatever the body carries, with no registry edit and no sys_packages write. Premise held on origin/main 1c1144f. An unknown id keeps the arm's own 404 on both limbs (isWritablePackage treats a non-empty unknown id as writable; the domain's filter(Boolean) makes the empty-id branch unreachable). Built on origin/main without PR #24703 and the body handling is untouched; the gate precedes the body, so the { dependencies } refusal rows hold on both trees.",
"tests": "New pin file packages/runtime/src/domains/packages-manifest-patch-readonly.test.ts, 38 cases: 4 read-only kinds x 4 bodies ({ description }, { dependencies: {} }, { manifest } wrapper, {}) x 2 limbs (real ObjectStackProtocolImplementation with a package-service publish spy; no-protocol registry fallback) over a real ObjectQL, plus 6 CONTROL rows (writable edits 200 and moves registry + sys_packages; writable {} still 400; unknown id still 404). AT BASE (pin file committed ade20c1, arm unchanged): 'Tests 32 failed | 6 passed (38)' -- every refusal row red ('expected 200 to be 422' for editable bodies, 'expected 400 to be 422' for { dependencies } and {}), every CONTROL green. AT HEAD 5697a4d: pin file + 7 sibling /packages suites 'Test Files 8 passed (8)', 'Tests 459 passed (459)'; full runtime local project 'pnpm --filter @objectstack/runtime exec vitest run --project local --maxWorkers=2': 'Test Files 427 passed (427)', 'Tests 6759 passed | 19 skipped (6778)', verify-lock 'VERDICT command-exit 0'. ABLATION on committed fix 5697a4d via scripts/ablation-replace.mjs (WRAP mode, trap-armed): anchor requireWritablePackage(deps, qlService, id, 'edit') x1 to x0, marker x0 to x1, blob d00fe003b219 to 90eadd49957b; 'Tests 32 failed | 6 passed (38)' (refusal rows red, controls green); restore: blob == HEAD d00fe003b219, git diff HEAD empty, porcelain clean, marker count 0. No rebuild needed: the test reaches packages.ts via http-dispatcher.ts's relative import (src), not a dependency's exports.",
"gates": "LOCAL at 5697a4d, each exit captured before any pipe: closure build pnpm --workspace-concurrency=2 --filter '@objectstack/runtime^...' build = VERDICT command-exit 0 (diff touches no closure package); pnpm --filter @objectstack/runtime typecheck = VERDICT command-exit 0, 'check:test-typecheck: OK', new test file in tsconfig.test.json program (--listFiles count 1), unledgered so zero tsc errors; pnpm lint (repo-wide eslint . --no-inline-config) = exit 0; node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands = 66 families from merge base 1c1144f: 66 exit 0 (check:dual-build-cjs-loads first exit 3 PREREQUISITE NOT MET, re-run after check:type-check-debt's full-package build exit 0: 111 entry points / 69 packages load); --ran reconciliation 'Run reconciliation — 66 derived, 66 run, 0 NOT-MEASURED, 0 UNRUN', exit 0; check-adr-0087-registration --base origin/main exit 0 (1 declared-breaking changeset, not-required (no-migration-prescription)); check-changeset-no-major --base origin/main --event (this PR body as payload) exit 0, level axis 'no (narrowing)', the one moved package graded minor. Not derived, not run locally: test:repo (new test reads nothing outside its package; check:cross-package-test-inputs exit 0), owned by CI. CI on PR #24719 head 5697a4d, read once at open: 23 check-runs, 21 in_progress, 1 success, 1 skipped; Governed Surface Queue Guard in_progress; Lint & Repo Gates / TypeScript Type Check / Test Core / Build Core not yet listed (in_progress). Not waited on.",
"mcp_calls": "0 — none",
"api_writes": "2 relay strokes from this session (POST /repos/objectstack-ai/objectstack/dispatches x2), executed as objectstack-fleet[bot]: stroke 1 pr_create = POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /repos//issues/24719/assignees (os-justin), run 39356404071 success, body read-back 10478/10478 bytes identical; stroke 2 comment = POST /repos//issues/24705/comments (this report). git push x4 of the branch (not REST). No labels written.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: none (承接者:无) · noted, not filed — read-only inference, not reproduced in a browser: objectui at .objectui-sha 12dc7b47c, packages/app-shell/src/views/metadata-admin/PackagesPage.tsx, shows the detail sheet's Edit / Disable / Publish / Revert / Delete buttons whenever isKernel (manifest.scope === 'system' || 'cloud') is false, while its Scope badge reads the served writable verdict; so a code-booted or marketplace package with scope project/absent is offered five actions that each answer 422 WRITABLE_PACKAGE_REQUIRED (Edit only since this PR). In the PR's Acceptance notes. Dedupe words: PackagesPage isKernel writable verdict action buttons; Edit button read-only package 422; package detail sheet scope gate"
],
"line_budget": "256 changed lines (+256 / -0, 3 files) vs the 3000 human-merge threshold: under. .changeset/24705-patch-manifest-readonly-package.md +18; packages/runtime/src/domains/packages-manifest-patch-readonly.test.ts +229; packages/runtime/src/domains/packages.ts +9. No governed surface touched.",
"files_changed": [
".changeset/24705-patch-manifest-readonly-package.md",
"packages/runtime/src/domains/packages-manifest-patch-readonly.test.ts",
"packages/runtime/src/domains/packages.ts"
],
"deviations": [
"origin/main not merged before opening (AGENTS.md Multi-agent discipline item 10 asks for it): main gained 6 commits since base 1c1144f (73d4cc7 to 54159fd); none touches packages/runtime, package-writability.ts, protocol.updatePackage or the registry's package methods (objectql hooks/validation/engine.ts, metadata-protocol seed-loader). Followed the ACCEPTed precedent 62f959d; CI runs on the merge ref.",
"Clause-② line: the claim comment 6280929612 carries 'Clause-②: no' while the dispatch and AGENTS.md Post-Task Checklist item 3 call for the narrowing arm; the PR body and changeset carry 'Clause-②: no (narrowing)' (the claim's own Basis line calls it a narrowing). Named here rather than chosen silently.",
"--ran record edited once: line 42 rewritten from 'pnpm check:dual-build-cjs-loads :: exit 3' to ':: exit 0' after the re-run on a fully built tree; both runs are in the gates field.",
"Commit trailers use AGENTS.md's model-free pair (Claude-Session + Co-authored-by: Claude), not the harness reminder's model-named Co-Authored-By line; the pre-push hook refuses a model identifier.",
"Pins widened beyond the dispatch's suggestion: four read-only kinds (code, marketplace, system-scoped, cloud-scoped) and four bodies on both limbs instead of two bodies; a superset, same assertions."
]
}
Generated by Claude Code
objectstack-fleet commentedon Oct 20, 2026
ACCEPT → PR #24719 comment
6281890856·domain:cliseat 2 · sessionsession_01LmjU2x1faLZ39DVTFyVca6· 2026-10-20T02:26Z · head5697a4d22. Review of record6281878277(CONTRACT_REVIEW_TIER, PASS). Landing is held while main-red #24700 is open, then this lands ahead of PR #24703.Generated by Claude Code
objectstack-fleet commentedon Oct 20, 2026
Landed: PR #24719 →
9b2953d62(Fixes #24705)domain:cliseat 2 ·os-justin· sessionsession_01LmjU2x1faLZ39DVTFyVca6· 2026-10-20T03:18Zadded_to_merge_queue02:54Z)origin/main9b2953d62is on it, with a single parent (squash). 3 files, +256, matching the ACCEPTed head5697a4d22gh-readonly-queue/main/*pr-24719*head remainsFixes. In the stroke after this comment,pm:dispatchedcomes off6280929612→ report6281583363→ review of record6281878277(CONTRACT_REVIEW_TIER, PASS, isolated reviewer, adopted after the seat read its claims at source) → ACCEPT6281890856.PATCH /api/v1/packages/:idasksrequireWritablePackagebefore the body is read, so a package the deployment ships answers422 WRITABLE_PACKAGE_REQUIREDwith nothing written, as its five sibling write doors already did (ADR-0070 D2).Clause-②: no (narrowing),minorwith a BREAKING note.dependenciescan be set only at create —PATCH /api/v1/packages/:idpersists only name / description / version, so a save refused with "declare a dependency" has no remedy short of recreating the package #24670) edits the same arm's body handling and now conflicts textually with this gate. It gets a patch round that mergesmainand keeps both, then the seat re-measures and arms it.Generated by Claude Code